API tools faq
paste
JTSEC1333

Anonymous JTSEC #OpSudan Full Recon #65

JTSEC1333
May 1st, 2019
819
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 70.02 KB | None | 0 0
raw download clone embed print report
  1. #######################################################################################################################################
  2. ======================================================================================================================================
  3. Hostname mininfo.gov.sd ISP Online S.a.s.
  4. Continent Europe Flag
  5. FR
  6. Country France Country Code FR
  7. Region Vendée Local time 01 May 2019 21:35 CEST
  8. City Chavagnes-en-Paillers Postal Code 85250
  9. IP Address 212.83.140.187 Latitude 46.892
  10. Longitude -1.252
  11.  
  12. =======================================================================================================================================
  13. #######################################################################################################################################
  14. > mininfo.gov.sd
  15. Server: 38.132.106.139
  16. Address: 38.132.106.139#53
  17.  
  18. Non-authoritative answer:
  19. Name: mininfo.gov.sd
  20. Address: 212.83.140.187
  21. >
  22. #######################################################################################################################################
  23. HostIP:212.83.140.187
  24. HostName:mininfo.gov.sd
  25.  
  26. Gathered Inet-whois information for 212.83.140.187
  27. ---------------------------------------------------------------------------------------------------------------------------------------
  28.  
  29.  
  30. inetnum: 212.83.128.0 - 212.83.143.255
  31. org: ORG-ONLI1-RIPE
  32. netname: Online
  33. descr: Online SAS - Dedibox
  34. country: FR
  35. admin-c: TTFR1-RIPE
  36. tech-c: TTFR1-RIPE
  37. status: ASSIGNED PA
  38. mnt-by: MNT-TISCALIFR
  39. mnt-by: MNT-TISCALIFR-B2B
  40. created: 2016-02-23T12:28:33Z
  41. last-modified: 2016-02-23T16:51:16Z
  42. source: RIPE
  43.  
  44. organisation: ORG-ONLI1-RIPE
  45. mnt-ref: MNT-TISCALIFR-B2B
  46. org-name: ONLINE SAS
  47. org-type: OTHER
  48. address: 8 rue de la ville l'eveque 75008 PARIS
  49. abuse-c: AR32851-RIPE
  50. mnt-ref: ONLINESAS-MNT
  51. mnt-by: ONLINESAS-MNT
  52. created: 2015-07-10T15:20:41Z
  53. last-modified: 2017-10-30T14:40:53Z
  54. source: RIPE # Filtered
  55.  
  56. role: Tiscali Telecom France Registry
  57. remarks: now known as Online S.A.S. / Iliad-Entreprises
  58. address: 8 rue de la ville l'�v�que
  59. address: 75008 Paris
  60. address: France
  61. abuse-mailbox: [email protected]
  62. admin-c: IENT-RIPE
  63. tech-c: IENT-RIPE
  64. tech-c: NR1053-RIPE
  65. nic-hdl: TTFR1-RIPE
  66. mnt-by: MNT-TISCALIFR
  67. created: 2002-09-24T14:16:42Z
  68. last-modified: 2012-11-05T16:08:46Z
  69. source: RIPE # Filtered
  70.  
  71. % Information related to '212.83.128.0/19AS12876'
  72.  
  73. route: 212.83.128.0/19
  74. descr: Online SAS
  75. descr: Paris, France
  76. origin: AS12876
  77. mnt-by: MNT-TISCALIFR
  78. created: 2013-08-02T09:07:45Z
  79. last-modified: 2013-08-02T09:07:45Z
  80. source: RIPE
  81.  
  82. % This query was served by the RIPE Database Query Service version 1.93.2 (WAGYU)
  83.  
  84.  
  85.  
  86. Gathered Inic-whois information for mininfo.gov.sd
  87. ---------------------------------------------------------------------------------------------------------------------------------------
  88. Error: Unable to connect - Invalid Host
  89. ERROR: Connection to InicWhois Server sd.whois-servers.net failed
  90. close error
  91.  
  92. Gathered Netcraft information for mininfo.gov.sd
  93. ---------------------------------------------------------------------------------------------------------------------------------------
  94.  
  95. Retrieving Netcraft.com information for mininfo.gov.sd
  96. Netcraft.com Information gathered
  97.  
  98. Gathered Subdomain information for mininfo.gov.sd
  99. ---------------------------------------------------------------------------------------------------------------------------------------
  100. Searching Google.com:80...
  101. Searching Altavista.com:80...
  102. Found 0 possible subdomain(s) for host mininfo.gov.sd, Searched 0 pages containing 0 results
  103.  
  104. Gathered E-Mail information for mininfo.gov.sd
  105. ---------------------------------------------------------------------------------------------------------------------------------------
  106. Searching Google.com:80...
  107. Searching Altavista.com:80...
  108. Found 0 E-Mail(s) for host mininfo.gov.sd, Searched 0 pages containing 0 results
  109.  
  110. Gathered TCP Port information for 212.83.140.187
  111. ---------------------------------------------------------------------------------------------------------------------------------------
  112.  
  113. Port State
  114.  
  115. 21/tcp open
  116. 22/tcp open
  117. 53/tcp open
  118. 80/tcp open
  119. 143/tcp open
  120.  
  121. Portscan Finished: Scanned 150 ports, 3 ports were in state closed
  122. #######################################################################################################################################
  123. [i] Scanning Site: http://mininfo.gov.sd
  124.  
  125.  
  126.  
  127. B A S I C I N F O
  128. =======================================================================================================================================
  129.  
  130.  
  131. [+] Site Title: وزارة الإعلام | جمهورية السودان
  132. [+] IP address: 212.83.140.187
  133. [+] Web Server: Could Not Detect
  134. [+] CMS: WordPress
  135. [+] Cloudflare: Not Detected
  136. [+] Robots File: Found
  137.  
  138. -------------[ contents ]----------------
  139. User-agent: *
  140.  
  141. -----------[end of contents]-------------
  142.  
  143.  
  144.  
  145.  
  146.  
  147. G E O I P L O O K U P
  148. =======================================================================================================================================
  149.  
  150. [i] IP Address: 212.83.140.187
  151. [i] Country: France
  152. [i] State: Vendee
  153. [i] City: Chavagnes-en-Paillers
  154. [i] Latitude: 46.8917
  155. [i] Longitude: -1.2521
  156.  
  157.  
  158.  
  159.  
  160. H T T P H E A D E R S
  161. =======================================================================================================================================
  162.  
  163.  
  164. [i] HTTP/1.1 200 OK
  165. [i] Date: Wed, 01 May 2019 20:22:39 GMT
  166. [i] Last-Modified: Wed, 01 May 2019 05:31:04 GMT
  167. [i] Accept-Ranges: bytes
  168. [i] Vary: Accept-Encoding
  169. [i] Cache-Control: max-age=0, no-cache, no-store, must-revalidate
  170. [i] Pragma: no-cache
  171. [i] Expires: Mon, 29 Oct 1923 20:30:00 GMT
  172. [i] Content-Type: text/html; charset=UTF-8
  173. [i] Connection: close
  174.  
  175.  
  176.  
  177.  
  178. D N S L O O K U P
  179. =======================================================================================================================================
  180.  
  181. mininfo.gov.sd. 3599 IN MX 10 mail.mininfo.gov.sd.
  182. mininfo.gov.sd. 3599 IN NS ns51.mazinhost.net.
  183. mininfo.gov.sd. 3599 IN NS ns52.mazinhost.net.
  184. mininfo.gov.sd. 3599 IN TXT "v=spf1 mx a ~all"
  185. mininfo.gov.sd. 3599 IN A 212.83.140.187
  186. mininfo.gov.sd. 3599 IN SOA ns51.mazinhost.net. info.mazinhost.com. 2018041903 7200 540 604800 3600
  187.  
  188.  
  189.  
  190.  
  191. S U B N E T C A L C U L A T I O N
  192. =======================================================================================================================================
  193.  
  194. Address = 212.83.140.187
  195. Network = 212.83.140.187 / 32
  196. Netmask = 255.255.255.255
  197. Broadcast = not needed on Point-to-Point links
  198. Wildcard Mask = 0.0.0.0
  199. Hosts Bits = 0
  200. Max. Hosts = 1 (2^0 - 0)
  201. Host Range = { 212.83.140.187 - 212.83.140.187 }
  202.  
  203.  
  204.  
  205. N M A P P O R T S C A N
  206. =======================================================================================================================================
  207.  
  208. Starting Nmap 7.70 ( https://nmap.org ) at 2019-05-01 20:22 UTC
  209. Nmap scan report for mininfo.gov.sd (212.83.140.187)
  210. Host is up (0.074s latency).
  211. rDNS record for 212.83.140.187: ns51.mazinhost.net
  212.  
  213. PORT STATE SERVICE
  214. 21/tcp open ftp
  215. 22/tcp open ssh
  216. 23/tcp filtered telnet
  217. 80/tcp open http
  218. 110/tcp open pop3
  219. 143/tcp open imap
  220. 443/tcp open https
  221. 3389/tcp filtered ms-wbt-server
  222.  
  223. Nmap done: 1 IP address (1 host up) scanned in 1.35 seconds
  224.  
  225.  
  226.  
  227. S U B - D O M A I N F I N D E R
  228. =======================================================================================================================================
  229.  
  230.  
  231. [i] Total Subdomains Found : 1
  232.  
  233. [+] Subdomain: mail.mininfo.gov.sd
  234. [-] IP: 212.83.140.187
  235. #######################################################################################################################################
  236. [?] Enter the target: example( http://domain.com )
  237. http://mininfo.gov.sd/
  238. [!] IP Address : 212.83.140.187
  239. [+] Operating System : Ubuntu"
  240.  
  241. [!] mininfo.gov.sd doesn't seem to use a CMS
  242. [+] Honeypot Probabilty: 30%
  243. ---------------------------------------------------------------------------------------------------------------------------------------
  244. [~] Trying to gather whois information for mininfo.gov.sd
  245. [+] Whois information found
  246. [-] Unable to build response, visit https://who.is/whois/mininfo.gov.sd
  247. ---------------------------------------------------------------------------------------------------------------------------------------
  248. PORT STATE SERVICE
  249. 21/tcp open ftp
  250. 22/tcp open ssh
  251. 23/tcp filtered telnet
  252. 80/tcp open http
  253. 110/tcp open pop3
  254. 143/tcp open imap
  255. 443/tcp open https
  256. 3389/tcp filtered ms-wbt-server
  257. Nmap done: 1 IP address (1 host up) scanned in 1.37 seconds
  258. ---------------------------------------------------------------------------------------------------------------------------------------
  259.  
  260. [+] DNS Records
  261. ns51.mazinhost.net. (212.83.140.187) AS12876 Online S.a.s. France
  262. ns52.mazinhost.net. (212.83.140.187) AS12876 Online S.a.s. France
  263.  
  264. [+] MX Records
  265. 10 (212.83.140.187) AS12876 Online S.a.s. France
  266.  
  267. [+] Host Records (A)
  268. mininfo.gov.sdHTTP: (ns51.mazinhost.net) (212.83.140.187) AS12876 Online S.a.s. France
  269. mail.mininfo.gov.sdHTTP: (ns51.mazinhost.net) (212.83.140.187) AS12876 Online S.a.s. France
  270.  
  271. [+] TXT Records
  272. "v=spf1 mx a ~all"
  273.  
  274. [+] DNS Map: https://dnsdumpster.com/static/map/mininfo.gov.sd.png
  275.  
  276. [>] Initiating 3 intel modules
  277. [>] Loading Alpha module (1/3)
  278. [>] Beta module deployed (2/3)
  279. [>] Gamma module initiated (3/3)
  280.  
  281.  
  282. [+] Emails found:
  283. ---------------------------------------------------------------------------------------------------------------------------------------
  284. [email protected]
  285.  
  286. [+] Hosts found in search engines:
  287. ---------------------------------------------------------------------------------------------------------------------------------------
  288. [-] Resolving hostnames IPs...
  289. 212.83.140.187:www.mininfo.gov.sd
  290. [+] Virtual hosts:
  291. ---------------------------------------------------------------------------------------------------------------------------------------
  292. #######################################################################################################################################
  293. Enter Address Website = mininfo.gov.sd
  294.  
  295. Reversing IP With HackTarget 'mininfo.gov.sd'
  296. ---------------------------------------------------------------------------------------------------------------------------------------
  297.  
  298. [+] elbadri.org
  299. [+] mail.mininfo.gov.sd
  300. [+] mininfo.gov.sd
  301. [+] ns51.mazinhost.net
  302. [+] ns52.mazinhost.net
  303. [+] ns516.mazinhost.net
  304. [+] ns517.mazinhost.net
  305. #######################################################################################################################################
  306.  
  307. Reverse IP With YouGetSignal 'mininfo.gov.sd'
  308. ---------------------------------------------------------------------------------------------------------------------------------------
  309.  
  310. [*] IP: 212.83.140.187
  311. [*] Domain: mininfo.gov.sd
  312. [*] Total Domains: 3
  313.  
  314. [+] mininfo.gov.sd
  315. [+] pharmacyalberta.com
  316. [+] www.mininfo.gov.sd
  317. #######################################################################################################################################
  318.  
  319. Geo IP Lookup 'mininfo.gov.sd'
  320. ---------------------------------------------------------------------------------------------------------------------------------------
  321.  
  322. [+] IP Address: 212.83.140.187
  323. [+] Country: France
  324. [+] State: Vendee
  325. [+] City: Chavagnes-en-Paillers
  326. [+] Latitude: 46.8917
  327. [+] Longitude: -1.2521
  328. #######################################################################################################################################
  329.  
  330. Bypass Cloudflare 'mininfo.gov.sd'
  331. ---------------------------------------------------------------------------------------------------------------------------------------
  332.  
  333. [!] CloudFlare Bypass 212.83.140.187 | webmail.mininfo.gov.sd
  334. [!] CloudFlare Bypass 212.83.140.187 | mail.mininfo.gov.sd
  335. [!] CloudFlare Bypass 212.83.140.187 | www.mininfo.gov.sd
  336. #######################################################################################################################################
  337.  
  338. DNS Lookup 'mininfo.gov.sd'
  339. ---------------------------------------------------------------------------------------------------------------------------------------
  340.  
  341. [+] mininfo.gov.sd. 3599 IN MX 10 mail.mininfo.gov.sd.
  342. [+] mininfo.gov.sd. 3599 IN NS ns52.mazinhost.net.
  343. [+] mininfo.gov.sd. 3599 IN NS ns51.mazinhost.net.
  344. [+] mininfo.gov.sd. 3599 IN TXT "v=spf1 mx a ~all"
  345. [+] mininfo.gov.sd. 3599 IN A 212.83.140.187
  346. [+] mininfo.gov.sd. 3599 IN SOA ns51.mazinhost.net. info.mazinhost.com. 2018041903 7200 540 604800 3600
  347. #######################################################################################################################################
  348.  
  349. Show HTTP Header 'mininfo.gov.sd'
  350. ---------------------------------------------------------------------------------------------------------------------------------------
  351.  
  352. [+] HTTP/1.1 200 OK
  353. [+] Date: Wed, 01 May 2019 20:22:21 GMT
  354. [+] Server: Apache/2.4.18 (Ubuntu)
  355. [+] Last-Modified: Wed, 01 May 2019 05:31:04 GMT
  356. [+] Accept-Ranges: bytes
  357. [+] Content-Length: 263075
  358. [+] Vary: Accept-Encoding
  359. [+] Cache-Control: max-age=0, no-cache, no-store, must-revalidate
  360. [+] Pragma: no-cache
  361. [+] Expires: Mon, 29 Oct 1923 20:30:00 GMT
  362. [+] Content-Type: text/html; charset=UTF-8
  363. #######################################################################################################################################
  364.  
  365. Port Scan 'mininfo.gov.sd'
  366. ---------------------------------------------------------------------------------------------------------------------------------------
  367.  
  368. Starting Nmap 7.70 ( https://nmap.org ) at 2019-05-01 20:22 UTC
  369. Nmap scan report for mininfo.gov.sd (212.83.140.187)
  370. Host is up (0.074s latency).
  371. rDNS record for 212.83.140.187: ns51.mazinhost.net
  372.  
  373. PORT STATE SERVICE
  374. 21/tcp open ftp
  375. 22/tcp open ssh
  376. 23/tcp filtered telnet
  377. 80/tcp open http
  378. 110/tcp open pop3
  379. 143/tcp open imap
  380. 443/tcp open https
  381. 3389/tcp filtered ms-wbt-server
  382.  
  383. Nmap done: 1 IP address (1 host up) scanned in 1.72 seconds
  384. #######################################################################################################################################
  385.  
  386. Traceroute 'mininfo.gov.sd'
  387. ---------------------------------------------------------------------------------------------------------------------------------------
  388.  
  389. Start: 2019-05-01T20:22:30+0000
  390. HOST: web01 Loss% Snt Last Avg Best Wrst StDev
  391. 1.|-- 45.79.12.202 0.0% 3 0.8 1.1 0.8 1.5 0.4
  392. 2.|-- 45.79.12.6 0.0% 3 0.5 2.0 0.5 4.7 2.3
  393. 3.|-- 45.79.12.8 0.0% 3 0.6 0.7 0.5 0.8 0.1
  394. 4.|-- hu0-7-0-7.ccr41.dfw03.atlas.cogentco.com 0.0% 3 1.2 1.5 1.2 1.8 0.3
  395. 5.|-- be2763.ccr31.dfw01.atlas.cogentco.com 0.0% 3 1.6 1.8 1.6 2.2 0.3
  396. 6.|-- be2441.ccr41.iah01.atlas.cogentco.com 0.0% 3 7.6 7.2 6.9 7.6 0.4
  397. 7.|-- be2687.ccr41.atl01.atlas.cogentco.com 0.0% 3 20.9 21.2 20.9 21.6 0.3
  398. 8.|-- be2112.ccr41.dca01.atlas.cogentco.com 0.0% 3 32.1 32.1 32.1 32.2 0.0
  399. 9.|-- be2806.ccr41.jfk02.atlas.cogentco.com 0.0% 3 38.0 38.1 38.0 38.2 0.1
  400. 10.|-- be3627.ccr41.par01.atlas.cogentco.com 0.0% 3 110.8 114.4 110.8 121.0 5.7
  401. 11.|-- be3183.ccr31.par04.atlas.cogentco.com 0.0% 3 111.2 111.1 111.0 111.2 0.2
  402. 12.|-- be3750.rcr21.b022890-0.par04.atlas.cogentco.com 0.0% 3 113.9 116.1 112.9 121.5 4.7
  403. 13.|-- online.demarc.cogentco.com 0.0% 3 112.0 111.8 111.6 112.0 0.2
  404. 14.|-- pni-th2-a9k1.th2.poneytelecom.eu 0.0% 3 113.3 113.9 113.1 115.2 1.1
  405. 15.|-- 195.154.2.145 0.0% 3 111.4 111.2 110.9 111.4 0.3
  406. 16.|-- ns51.mazinhost.net 0.0% 3 113.0 113.2 113.0 113.3 0.2
  407. #######################################################################################################################################
  408.  
  409. Ping 'mininfo.gov.sd'
  410. ---------------------------------------------------------------------------------------------------------------------------------------
  411.  
  412.  
  413. Starting Nping 0.7.70 ( https://nmap.org/nping ) at 2019-05-01 20:23 UTC
  414. SENT (0.2808s) ICMP [104.237.144.6 > 212.83.140.187 Echo request (type=8/code=0) id=31026 seq=1] IP [ttl=64 id=14946 iplen=28 ]
  415. RCVD (0.4826s) ICMP [212.83.140.187 > 104.237.144.6 Echo reply (type=0/code=0) id=31026 seq=1] IP [ttl=54 id=36499 iplen=28 ]
  416. SENT (1.2816s) ICMP [104.237.144.6 > 212.83.140.187 Echo request (type=8/code=0) id=31026 seq=2] IP [ttl=64 id=14946 iplen=28 ]
  417. RCVD (1.5022s) ICMP [212.83.140.187 > 104.237.144.6 Echo reply (type=0/code=0) id=31026 seq=2] IP [ttl=54 id=36565 iplen=28 ]
  418. SENT (2.2843s) ICMP [104.237.144.6 > 212.83.140.187 Echo request (type=8/code=0) id=31026 seq=3] IP [ttl=64 id=14946 iplen=28 ]
  419. RCVD (2.5223s) ICMP [212.83.140.187 > 104.237.144.6 Echo reply (type=0/code=0) id=31026 seq=3] IP [ttl=54 id=36667 iplen=28 ]
  420. SENT (3.2866s) ICMP [104.237.144.6 > 212.83.140.187 Echo request (type=8/code=0) id=31026 seq=4] IP [ttl=64 id=14946 iplen=28 ]
  421. RCVD (3.5425s) ICMP [212.83.140.187 > 104.237.144.6 Echo reply (type=0/code=0) id=31026 seq=4] IP [ttl=54 id=36738 iplen=28 ]
  422.  
  423. Max rtt: 255.888ms | Min rtt: 201.807ms | Avg rtt: 228.959ms
  424. Raw packets sent: 4 (112B) | Rcvd: 4 (184B) | Lost: 0 (0.00%)
  425. Nping done: 1 IP address pinged in 3.54 seconds
  426. #######################################################################################################################################
  427. ; <<>> DiG 9.11.5-P4-3-Debian <<>> mininfo.gov.sd
  428. ;; global options: +cmd
  429. ;; Got answer:
  430. ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 14332
  431. ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
  432.  
  433. ;; OPT PSEUDOSECTION:
  434. ; EDNS: version: 0, flags:; udp: 4096
  435. ;; QUESTION SECTION:
  436. ;mininfo.gov.sd. IN A
  437.  
  438. ;; ANSWER SECTION:
  439. mininfo.gov.sd. 1323 IN A 212.83.140.187
  440.  
  441. ;; Query time: 222 msec
  442. ;; SERVER: 185.93.180.131#53(185.93.180.131)
  443. ;; WHEN: mer mai 01 22:54:58 EDT 2019
  444. ;; MSG SIZE rcvd: 59
  445. #######################################################################################################################################
  446. ; <<>> DiG 9.11.5-P4-3-Debian <<>> +trace mininfo.gov.sd
  447. ;; global options: +cmd
  448. . 81897 IN NS a.root-servers.net.
  449. . 81897 IN NS k.root-servers.net.
  450. . 81897 IN NS f.root-servers.net.
  451. . 81897 IN NS d.root-servers.net.
  452. . 81897 IN NS g.root-servers.net.
  453. . 81897 IN NS h.root-servers.net.
  454. . 81897 IN NS c.root-servers.net.
  455. . 81897 IN NS b.root-servers.net.
  456. . 81897 IN NS m.root-servers.net.
  457. . 81897 IN NS j.root-servers.net.
  458. . 81897 IN NS e.root-servers.net.
  459. . 81897 IN NS i.root-servers.net.
  460. . 81897 IN NS l.root-servers.net.
  461. . 81897 IN RRSIG NS 8 0 518400 20190514170000 20190501160000 25266 . w4ssTvTC9iBkFkqxTfOYUUzNPGYa6X8OafW9aSqZemGH5DXIrB7qHOf2 5wje3SBrkIEEbDa6EfNdcwIzMOf5XhhuwfM5dnO8tKSfnKpasFHMrBHG S3ugP+fPEGuIWtol0nyjdVqcbbDtlWWLBSX6KJs/no3vGbzlAbLZJap4 0XaRFnoWJLz0kDceA8QXeuuh//zpeHCHyzv/OJ8lmPSdBeRUmMLm/Kab Lm4zG+UJSYH3HCLkUNAvDylul5uUoue3jiZTKjwK+MxjdqUQa/FyPXow gN8goiu8cUKc6OAUnWn0dV6T/cDZC5Lj0O/Oaj+9rV7nGNTETqNwhcQt JWHhqw==
  462. ;; Received 525 bytes from 185.93.180.131#53(185.93.180.131) in 218 ms
  463.  
  464. sd. 172800 IN NS sd.cctld.authdns.ripe.net.
  465. sd. 172800 IN NS ns1.uaenic.ae.
  466. sd. 172800 IN NS ns2.uaenic.ae.
  467. sd. 172800 IN NS ans1.sis.sd.
  468. sd. 172800 IN NS ans1.canar.sd.
  469. sd. 172800 IN NS ans2.canar.sd.
  470. sd. 172800 IN NS ns-sd.afrinic.net.
  471. sd. 86400 IN NSEC se. NS RRSIG NSEC
  472. sd. 86400 IN RRSIG NSEC 8 1 86400 20190514170000 20190501160000 25266 . RvWMl899QG/w8chpHW82ngDehj9ubgmK53QxZzcDub+gqGYHTtZSY67i Cv7IAvZb3XIHN+lbYe3c+nl3mIEzL1iSlDhtYmJtI6Z3abJBSu6S6ILk RHn3xyixJO9YMgXwGCn/TehgPbCqBE+NlI5GC9saGA5sa2UPvyMqLMTB reU28UtE5UzyyyNHGmuB0Ft6eONuuHrFfFuAAOFGyKTS9smX3kmyu78q P2Ys7Xxp2pnPefEQa54S8ZJ9tVFjoQw+VPvPQDF5IbmWUoGm6mcJj6pW CRm0JuA/UjZ2JS9HGwL64HzuZpy+M4LbCclsYG0uE9ugv0D9YPLkExN1 IpuUUg==
  473. ;; Received 701 bytes from 2001:500:2f::f#53(f.root-servers.net) in 28 ms
  474.  
  475. ;; Received 71 bytes from 195.229.0.186#53(ns2.uaenic.ae) in 423 ms
  476. #######################################################################################################################################
  477. [*] Performing General Enumeration of Domain: mininfo.gov.sd
  478. [-] DNSSEC is not configured for mininfo.gov.sd
  479. [*] SOA ns51.mazinhost.net 212.83.140.187
  480. [*] NS ns52.mazinhost.net 212.83.140.187
  481. [*] NS ns51.mazinhost.net 212.83.140.187
  482. [*] MX mail.mininfo.gov.sd 212.83.140.187
  483. [*] A mininfo.gov.sd 212.83.140.187
  484. [*] TXT mininfo.gov.sd v=spf1 mx a ~all
  485. [*] Enumerating SRV Records
  486. [-] No SRV Records Found for mininfo.gov.sd
  487. [+] 0 Records Found
  488. #######################################################################################################################################
  489. [*] Processing domain mininfo.gov.sd
  490. [*] Using system resolvers ['185.93.180.131', '194.187.251.67', '38.132.106.139', '192.168.0.1', '2001:18c0:121:6900:724f:b8ff:fefd:5b6a']
  491. [+] Getting nameservers
  492. 212.83.140.187 - ns52.mazinhost.net
  493. 212.83.140.187 - ns51.mazinhost.net
  494. [-] Zone transfer failed
  495.  
  496. [+] TXT records found
  497. "v=spf1 mx a ~all"
  498.  
  499. [+] MX records found, added to target list
  500. 10 mail.mininfo.gov.sd.
  501.  
  502. [*] Scanning mininfo.gov.sd for A records
  503. 212.83.140.187 - mininfo.gov.sd
  504. 212.83.140.187 - mail.mininfo.gov.sd
  505. 212.83.140.187 - webmail.mininfo.gov.sd
  506. 212.83.140.187 - www.mininfo.gov.sd
  507. #######################################################################################################################################
  508. [+] Testing domain
  509. www.mininfo.gov.sd 212.83.140.187
  510. [+] Dns resolving
  511. Domain name Ip address Name server
  512. mininfo.gov.sd 212.83.140.187 ns51.mazinhost.net
  513. Found 1 host(s) for mininfo.gov.sd
  514. [+] Testing wildcard
  515. Ok, no wildcard found.
  516.  
  517. [+] Scanning for subdomain on mininfo.gov.sd
  518. [!] Wordlist not specified. I scannig with my internal wordlist...
  519. Estimated time about 259.36 seconds
  520.  
  521. Subdomain Ip address Name server
  522.  
  523. mail.mininfo.gov.sd 212.83.140.187 ns51.mazinhost.net
  524. webmail.mininfo.gov.sd 212.83.140.187 ns51.mazinhost.net
  525. www.mininfo.gov.sd 212.83.140.187 ns51.mazinhost.net
  526. #######################################################################################################################################
  527. dnsenum VERSION:1.2.4
  528.  
  529. ----- mininfo.gov.sd -----
  530.  
  531.  
  532. Host's addresses:
  533. __________________
  534.  
  535. mininfo.gov.sd. 3600 IN A 212.83.140.187
  536.  
  537.  
  538. Name Servers:
  539. ______________
  540.  
  541. ns52.mazinhost.net. 14398 IN A 212.83.140.187
  542. ns51.mazinhost.net. 14399 IN A 212.83.140.187
  543.  
  544.  
  545. Mail (MX) Servers:
  546. ___________________
  547.  
  548. mail.mininfo.gov.sd. 3599 IN A 212.83.140.187
  549.  
  550.  
  551. Trying Zone Transfers and getting Bind Versions:
  552. _________________________________________________
  553.  
  554.  
  555. Trying Zone Transfer for mininfo.gov.sd on ns52.mazinhost.net ...
  556.  
  557. Trying Zone Transfer for mininfo.gov.sd on ns51.mazinhost.net ...
  558.  
  559. brute force file not specified, bay.
  560. #######################################################################################################################################
  561.  
  562. ____ _ _ _ _ _____
  563. / ___| _ _| |__ | (_)___| |_|___ / _ __
  564. \___ \| | | | '_ \| | / __| __| |_ \| '__|
  565. ___) | |_| | |_) | | \__ \ |_ ___) | |
  566. |____/ \__,_|_.__/|_|_|___/\__|____/|_|
  567.  
  568. # Coded By Ahmed Aboul-Ela - @aboul3la
  569.  
  570. [-] Enumerating subdomains now for mininfo.gov.sd
  571. [-] verbosity is enabled, will show the subdomains results in realtime
  572. [-] Searching now in Baidu..
  573. [-] Searching now in Yahoo..
  574. [-] Searching now in Google..
  575. [-] Searching now in Bing..
  576. [-] Searching now in Ask..
  577. [-] Searching now in Netcraft..
  578. [-] Searching now in DNSdumpster..
  579. [-] Searching now in Virustotal..
  580. [-] Searching now in ThreatCrowd..
  581. [-] Searching now in SSL Certificates..
  582. [-] Searching now in PassiveDNS..
  583. Virustotal: www.mininfo.gov.sd
  584. DNSdumpster: mail.mininfo.gov.sd
  585. [-] Saving results to file: /usr/share/sniper/loot//domains/domains-mininfo.gov.sd.txt
  586. [-] Total Unique Subdomains Found: 2
  587. www.mininfo.gov.sd
  588. mail.mininfo.gov.sd
  589. #######################################################################################################################################
  590. ===============================================
  591. -=Subfinder v1.1.3 github.com/subfinder/subfinder
  592. ===============================================
  593.  
  594.  
  595. Running Source: Ask
  596. Running Source: Archive.is
  597. Running Source: Baidu
  598. Running Source: Bing
  599. Running Source: CertDB
  600. Running Source: CertificateTransparency
  601. Running Source: Certspotter
  602. Running Source: Commoncrawl
  603. Running Source: Crt.sh
  604. Running Source: Dnsdb
  605. Running Source: DNSDumpster
  606. Running Source: DNSTable
  607. Running Source: Dogpile
  608. Running Source: Exalead
  609. Running Source: Findsubdomains
  610. Running Source: Googleter
  611. Running Source: Hackertarget
  612. Running Source: Ipv4Info
  613. Running Source: PTRArchive
  614. Running Source: Sitedossier
  615. Running Source: Threatcrowd
  616. Running Source: ThreatMiner
  617. Running Source: WaybackArchive
  618. Running Source: Yahoo
  619.  
  620. Running enumeration on mininfo.gov.sd
  621.  
  622. dnsdb: Unexpected return status 503
  623.  
  624. waybackarchive: parse http://web.archive.org/cdx/search/cdx?url=*.mininfo.gov.sd/*&output=json&fl=original&collapse=urlkey&page=: net/url: invalid control character in URL
  625.  
  626. dogpile: Get https://www.dogpile.com/search/web?q=mininfo.gov.sd&qsi=1: EOF
  627.  
  628. baidu: Get https://www.baidu.com/s?rn=100&pn=0&wd=site%3Amininfo.gov.sd&oq=site%3Amininfo.gov.sd: net/http: request canceled while waiting for connection (Client.Timeout exceeded while awaiting headers)
  629.  
  630.  
  631. Starting Bruteforcing of mininfo.gov.sd with 9985 words
  632.  
  633. Total 6 Unique subdomains found for mininfo.gov.sd
  634.  
  635. .mininfo.gov.sd
  636. mail.mininfo.gov.sd
  637. mail.mininfo.gov.sd
  638. webmail.mininfo.gov.sd
  639. www.mininfo.gov.sd
  640. www.mininfo.gov.sd
  641. #######################################################################################################################################
  642. [*] Processing domain mininfo.gov.sd
  643. [*] Using system resolvers ['185.93.180.131', '194.187.251.67', '38.132.106.139', '192.168.0.1', '2001:18c0:121:6900:724f:b8ff:fefd:5b6a']
  644. [+] Getting nameservers
  645. 212.83.140.187 - ns52.mazinhost.net
  646. 212.83.140.187 - ns51.mazinhost.net
  647. [-] Zone transfer failed
  648.  
  649. [+] TXT records found
  650. "v=spf1 mx a ~all"
  651.  
  652. [+] MX records found, added to target list
  653. 10 mail.mininfo.gov.sd.
  654.  
  655. [*] Scanning mininfo.gov.sd for A records
  656. 212.83.140.187 - mininfo.gov.sd
  657. 212.83.140.187 - mail.mininfo.gov.sd
  658. 212.83.140.187 - webmail.mininfo.gov.sd
  659. 212.83.140.187 - www.mininfo.gov.sd
  660. #######################################################################################################################################
  661. mail.mininfo.gov.sd
  662. www.mininfo.gov.sd
  663. #######################################################################################################################################
  664. [*] Found SPF record:
  665. [*] v=spf1 mx a ~all
  666. [*] SPF record contains an All item: ~all
  667. [*] No DMARC record found. Looking for organizational record
  668. [+] No organizational DMARC record
  669. [+] Spoofing possible for mininfo.gov.sd!
  670. #######################################################################################################################################
  671. Starting Nmap 7.70 ( https://nmap.org ) at 2019-05-01 22:31 EDT
  672. Nmap scan report for mininfo.gov.sd (212.83.140.187)
  673. Host is up (0.17s latency).
  674. rDNS record for 212.83.140.187: ns51.mazinhost.net
  675. Not shown: 2 filtered ports
  676. PORT STATE SERVICE
  677. 53/udp open|filtered domain
  678. 67/udp open|filtered dhcps
  679. 68/udp open|filtered dhcpc
  680. 69/udp open|filtered tftp
  681. 88/udp open|filtered kerberos-sec
  682. 123/udp open|filtered ntp
  683. 139/udp open|filtered netbios-ssn
  684. 161/udp open|filtered snmp
  685. 162/udp open|filtered snmptrap
  686. 389/udp open|filtered ldap
  687. 520/udp open|filtered route
  688. 2049/udp open|filtered nfs
  689.  
  690. Nmap done: 1 IP address (1 host up) scanned in 2.89 seconds
  691. #######################################################################################################################################
  692. Starting Nmap 7.70 ( https://nmap.org ) at 2019-05-01 18:10 EDT
  693. Nmap scan report for ns51.mazinhost.net (212.83.140.187)
  694. Host is up (0.23s latency).
  695. Not shown: 461 filtered ports, 3 closed ports
  696. Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
  697. PORT STATE SERVICE
  698. 21/tcp open ftp
  699. 22/tcp open ssh
  700. 53/tcp open domain
  701. 80/tcp open http
  702. 110/tcp open pop3
  703. 143/tcp open imap
  704. 443/tcp open https
  705. 465/tcp open smtps
  706. 587/tcp open submission
  707. 993/tcp open imaps
  708. 995/tcp open pop3s
  709. 8080/tcp open http-proxy
  710. #######################################################################################################################################
  711. Starting Nmap 7.70 ( https://nmap.org ) at 2019-05-01 18:10 EDT
  712. Nmap scan report for ns51.mazinhost.net (212.83.140.187)
  713. Host is up (0.18s latency).
  714. Not shown: 2 filtered ports
  715. PORT STATE SERVICE
  716. 53/udp open domain
  717. 67/udp open|filtered dhcps
  718. 68/udp open|filtered dhcpc
  719. 69/udp open|filtered tftp
  720. 88/udp open|filtered kerberos-sec
  721. 123/udp open|filtered ntp
  722. 139/udp open|filtered netbios-ssn
  723. 161/udp open|filtered snmp
  724. 162/udp open|filtered snmptrap
  725. 389/udp open|filtered ldap
  726. 520/udp open|filtered route
  727. 2049/udp open|filtered nfs
  728. #######################################################################################################################################
  729. Starting Nmap 7.70 ( https://nmap.org ) at 2019-05-01 18:10 EDT
  730. Nmap scan report for ns51.mazinhost.net (212.83.140.187)
  731. Host is up (0.24s latency).
  732.  
  733. PORT STATE SERVICE VERSION
  734. 21/tcp open ftp Pure-FTPd
  735. Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
  736. Device type: general purpose
  737. Running (JUST GUESSING): Linux 3.X|4.X|2.6.X (91%)
  738. OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:2.6
  739. Aggressive OS guesses: Linux 3.11 - 4.1 (91%), Linux 4.4 (91%), Linux 3.2.0 (90%), Linux 3.16 (89%), Linux 3.13 (88%), Linux 2.6.18 - 2.6.22 (86%), Linux 3.10 - 3.16 (86%), Linux 3.10 - 3.12 (85%), Linux 3.10 - 4.11 (85%), Linux 3.12 (85%)
  740. No exact OS matches for host (test conditions non-ideal).
  741. Network Distance: 11 hops
  742.  
  743. TRACEROUTE (using port 21/tcp)
  744. HOP RTT ADDRESS
  745. 1 170.35 ms 10.251.200.1
  746. 2 172.10 ms 213.184.122.97
  747. 3 170.71 ms bzq-82-80-246-9.cablep.bezeqint.net (82.80.246.9)
  748. 4 170.94 ms bzq-179-124-185.cust.bezeqint.net (212.179.124.185)
  749. 5 220.72 ms bzq-114-65-1.cust.bezeqint.net (192.114.65.1)
  750. 6 218.35 ms bzq-161-218.pop.bezeqint.net (212.179.161.218)
  751. 7 242.17 ms 80.249.212.93
  752. 8 245.16 ms 51.158.8.185
  753. 9 255.59 ms 195.154.2.103
  754. 10 247.89 ms 51.158.8.185
  755. 11 242.22 ms ns51.mazinhost.net (212.83.140.187)
  756. #######################################################################################################################################
  757. # general
  758. (gen) banner: SSH-2.0-OpenSSH_7.2p2 Ubuntu-4ubuntu2.4
  759. (gen) software: OpenSSH 7.2p2
  760. (gen) compatibility: OpenSSH 7.2+, Dropbear SSH 2013.62+
  761. (gen) compression: enabled ([email protected])
  762.  
  763. # key exchange algorithms
  764. (kex) [email protected] -- [info] available since OpenSSH 6.5, Dropbear SSH 2013.62
  765. (kex) ecdh-sha2-nistp256 -- [fail] using weak elliptic curves
  766. `- [info] available since OpenSSH 5.7, Dropbear SSH 2013.62
  767. (kex) ecdh-sha2-nistp384 -- [fail] using weak elliptic curves
  768. `- [info] available since OpenSSH 5.7, Dropbear SSH 2013.62
  769. (kex) ecdh-sha2-nistp521 -- [fail] using weak elliptic curves
  770. `- [info] available since OpenSSH 5.7, Dropbear SSH 2013.62
  771. (kex) diffie-hellman-group-exchange-sha256 -- [warn] using custom size modulus (possibly weak)
  772. `- [info] available since OpenSSH 4.4
  773. (kex) diffie-hellman-group14-sha1 -- [warn] using weak hashing algorithm
  774. `- [info] available since OpenSSH 3.9, Dropbear SSH 0.53
  775.  
  776. # host-key algorithms
  777. (key) ssh-rsa -- [info] available since OpenSSH 2.5.0, Dropbear SSH 0.28
  778. (key) rsa-sha2-512 -- [info] available since OpenSSH 7.2
  779. (key) rsa-sha2-256 -- [info] available since OpenSSH 7.2
  780. (key) ecdsa-sha2-nistp256 -- [fail] using weak elliptic curves
  781. `- [warn] using weak random number generator could reveal the key
  782. `- [info] available since OpenSSH 5.7, Dropbear SSH 2013.62
  783. (key) ssh-ed25519 -- [info] available since OpenSSH 6.5
  784.  
  785. # encryption algorithms (ciphers)
  786. (enc) [email protected] -- [info] available since OpenSSH 6.5
  787. `- [info] default cipher since OpenSSH 6.9.
  788. (enc) aes128-ctr -- [info] available since OpenSSH 3.7, Dropbear SSH 0.52
  789. (enc) aes192-ctr -- [info] available since OpenSSH 3.7
  790. (enc) aes256-ctr -- [info] available since OpenSSH 3.7, Dropbear SSH 0.52
  791. (enc) [email protected] -- [info] available since OpenSSH 6.2
  792. (enc) [email protected] -- [info] available since OpenSSH 6.2
  793.  
  794. # message authentication code algorithms
  795. (mac) [email protected] -- [warn] using small 64-bit tag size
  796. `- [info] available since OpenSSH 6.2
  797. (mac) [email protected] -- [info] available since OpenSSH 6.2
  798. (mac) [email protected] -- [info] available since OpenSSH 6.2
  799. (mac) [email protected] -- [info] available since OpenSSH 6.2
  800. (mac) [email protected] -- [warn] using weak hashing algorithm
  801. `- [info] available since OpenSSH 6.2
  802. (mac) [email protected] -- [warn] using encrypt-and-MAC mode
  803. `- [warn] using small 64-bit tag size
  804. `- [info] available since OpenSSH 4.7
  805. (mac) [email protected] -- [warn] using encrypt-and-MAC mode
  806. `- [info] available since OpenSSH 6.2
  807. (mac) hmac-sha2-256 -- [warn] using encrypt-and-MAC mode
  808. `- [info] available since OpenSSH 5.9, Dropbear SSH 2013.56
  809. (mac) hmac-sha2-512 -- [warn] using encrypt-and-MAC mode
  810. `- [info] available since OpenSSH 5.9, Dropbear SSH 2013.56
  811. (mac) hmac-sha1 -- [warn] using encrypt-and-MAC mode
  812. `- [warn] using weak hashing algorithm
  813. `- [info] available since OpenSSH 2.1.0, Dropbear SSH 0.28
  814.  
  815. # algorithm recommendations (for OpenSSH 7.2)
  816. (rec) -ecdh-sha2-nistp521 -- kex algorithm to remove
  817. (rec) -ecdh-sha2-nistp384 -- kex algorithm to remove
  818. (rec) -ecdh-sha2-nistp256 -- kex algorithm to remove
  819. (rec) -diffie-hellman-group14-sha1 -- kex algorithm to remove
  820. (rec) -ecdsa-sha2-nistp256 -- key algorithm to remove
  821. (rec) -hmac-sha2-512 -- mac algorithm to remove
  822. (rec) [email protected] -- mac algorithm to remove
  823. (rec) -hmac-sha2-256 -- mac algorithm to remove
  824. (rec) [email protected] -- mac algorithm to remove
  825. (rec) -hmac-sha1 -- mac algorithm to remove
  826. (rec) [email protected] -- mac algorithm to remove
  827. (rec) [email protected] -- mac algorithm to remove
  828. #######################################################################################################################################
  829. Starting Nmap 7.70 ( https://nmap.org ) at 2019-05-01 18:21 EDT
  830. NSE: [ssh-run] Failed to specify credentials and command to run.
  831. NSE: [ssh-brute] Trying username/password pair: root:root
  832. NSE: [ssh-brute] Trying username/password pair: admin:admin
  833. NSE: [ssh-brute] Trying username/password pair: administrator:administrator
  834. NSE: [ssh-brute] Trying username/password pair: webadmin:webadmin
  835. NSE: [ssh-brute] Trying username/password pair: sysadmin:sysadmin
  836. NSE: [ssh-brute] Trying username/password pair: netadmin:netadmin
  837. NSE: [ssh-brute] Trying username/password pair: guest:guest
  838. NSE: [ssh-brute] Trying username/password pair: user:user
  839. NSE: [ssh-brute] Trying username/password pair: web:web
  840. NSE: [ssh-brute] Trying username/password pair: test:test
  841. NSE: [ssh-brute] Trying username/password pair: root:
  842. NSE: [ssh-brute] Trying username/password pair: admin:
  843. NSE: [ssh-brute] Trying username/password pair: administrator:
  844. NSE: [ssh-brute] Trying username/password pair: webadmin:
  845. NSE: [ssh-brute] Trying username/password pair: sysadmin:
  846. NSE: [ssh-brute] Trying username/password pair: netadmin:
  847. NSE: [ssh-brute] Trying username/password pair: guest:
  848. NSE: [ssh-brute] Trying username/password pair: user:
  849. NSE: [ssh-brute] Trying username/password pair: web:
  850. NSE: [ssh-brute] Trying username/password pair: test:
  851. NSE: [ssh-brute] Trying username/password pair: root:123456
  852. NSE: [ssh-brute] Trying username/password pair: admin:123456
  853. NSE: [ssh-brute] Trying username/password pair: administrator:123456
  854. NSE: [ssh-brute] Trying username/password pair: webadmin:123456
  855. NSE: [ssh-brute] Trying username/password pair: sysadmin:123456
  856. NSE: [ssh-brute] Trying username/password pair: netadmin:123456
  857. NSE: [ssh-brute] Trying username/password pair: guest:123456
  858. NSE: [ssh-brute] Trying username/password pair: user:123456
  859. NSE: [ssh-brute] Trying username/password pair: web:123456
  860. NSE: [ssh-brute] Trying username/password pair: test:123456
  861. NSE: [ssh-brute] Trying username/password pair: root:12345
  862. NSE: [ssh-brute] Trying username/password pair: admin:12345
  863. NSE: [ssh-brute] Trying username/password pair: administrator:12345
  864. NSE: [ssh-brute] Trying username/password pair: webadmin:12345
  865. NSE: [ssh-brute] Trying username/password pair: sysadmin:12345
  866. NSE: [ssh-brute] Trying username/password pair: netadmin:12345
  867. NSE: [ssh-brute] Trying username/password pair: guest:12345
  868. NSE: [ssh-brute] Trying username/password pair: user:12345
  869. NSE: [ssh-brute] Trying username/password pair: web:12345
  870. NSE: [ssh-brute] Trying username/password pair: test:12345
  871. NSE: [ssh-brute] Trying username/password pair: root:123456789
  872. NSE: [ssh-brute] Trying username/password pair: admin:123456789
  873. NSE: [ssh-brute] Trying username/password pair: administrator:123456789
  874. NSE: [ssh-brute] Trying username/password pair: webadmin:123456789
  875. NSE: [ssh-brute] Trying username/password pair: sysadmin:123456789
  876. NSE: [ssh-brute] Trying username/password pair: netadmin:123456789
  877. NSE: [ssh-brute] Trying username/password pair: guest:123456789
  878. NSE: [ssh-brute] Trying username/password pair: user:123456789
  879. NSE: [ssh-brute] Trying username/password pair: web:123456789
  880. NSE: [ssh-brute] Trying username/password pair: test:123456789
  881. NSE: [ssh-brute] Trying username/password pair: root:password
  882. NSE: [ssh-brute] Trying username/password pair: admin:password
  883. NSE: [ssh-brute] Trying username/password pair: administrator:password
  884. NSE: [ssh-brute] Trying username/password pair: webadmin:password
  885. NSE: [ssh-brute] Trying username/password pair: sysadmin:password
  886. NSE: [ssh-brute] Trying username/password pair: netadmin:password
  887. NSE: [ssh-brute] Trying username/password pair: guest:password
  888. NSE: [ssh-brute] Trying username/password pair: user:password
  889. NSE: [ssh-brute] Trying username/password pair: web:password
  890. NSE: [ssh-brute] Trying username/password pair: test:password
  891. NSE: [ssh-brute] Trying username/password pair: root:iloveyou
  892. NSE: [ssh-brute] Trying username/password pair: admin:iloveyou
  893. NSE: [ssh-brute] Trying username/password pair: administrator:iloveyou
  894. NSE: [ssh-brute] Trying username/password pair: webadmin:iloveyou
  895. NSE: [ssh-brute] Trying username/password pair: sysadmin:iloveyou
  896. Nmap scan report for ns51.mazinhost.net (212.83.140.187)
  897. Host is up (0.24s latency).
  898.  
  899. PORT STATE SERVICE VERSION
  900. 22/tcp open ssh OpenSSH 7.2p2 Ubuntu 4ubuntu2.4 (Ubuntu Linux; protocol 2.0)
  901. | ssh-auth-methods:
  902. | Supported authentication methods:
  903. | publickey
  904. |_ password
  905. | ssh-hostkey:
  906. | 2048 af:4b:11:25:a5:bb:ab:68:84:95:0d:08:c2:07:2c:b9 (RSA)
  907. | 256 d1:31:9e:37:4b:70:f9:16:1e:e6:49:68:2d:d8:c8:bf (ECDSA)
  908. |_ 256 fc:ca:4c:d1:7c:1a:80:3c:17:66:4f:bc:ff:73:32:fd (ED25519)
  909. | ssh-publickey-acceptance:
  910. |_ Accepted Public Keys: No public keys accepted
  911. |_ssh-run: Failed to specify credentials and command to run.
  912. Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
  913. Device type: general purpose
  914. Running (JUST GUESSING): Linux 3.X|4.X|2.6.X (91%)
  915. OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:2.6
  916. Aggressive OS guesses: Linux 3.11 - 4.1 (91%), Linux 4.4 (91%), Linux 3.2.0 (90%), Linux 3.16 (89%), Linux 3.13 (88%), Linux 2.6.18 - 2.6.22 (86%), Linux 3.10 - 3.12 (85%), Linux 3.10 - 4.11 (85%), Linux 3.12 (85%), Linux 3.13 or 4.2 (85%)
  917. No exact OS matches for host (test conditions non-ideal).
  918. Network Distance: 11 hops
  919. Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
  920.  
  921. TRACEROUTE (using port 22/tcp)
  922. HOP RTT ADDRESS
  923. 1 173.95 ms 10.251.200.1
  924. 2 174.94 ms 213.184.122.97
  925. 3 173.98 ms bzq-82-80-246-9.cablep.bezeqint.net (82.80.246.9)
  926. 4 176.56 ms bzq-179-124-185.cust.bezeqint.net (212.179.124.185)
  927. 5 225.59 ms bzq-179-124-153.cust.bezeqint.net (212.179.124.153)
  928. 6 217.37 ms bzq-179-124-34.cust.bezeqint.net (212.179.124.34)
  929. 7 239.59 ms 195.154.2.103
  930. 8 241.59 ms 195.154.2.103
  931. 9 243.56 ms 195.154.2.103
  932. 10 243.62 ms 49e-s202b-1-dc2-a9k1.dc2.poneytelecom.eu (195.154.1.29)
  933. 11 241.86 ms ns51.mazinhost.net (212.83.140.187)
  934. #######################################################################################################################################
  935. USER_FILE => /usr/share/brutex/wordlists/simple-users.txt
  936. RHOSTS => 212.83.140.187
  937. RHOST => 212.83.140.187
  938. [*] 212.83.140.187:22 - SSH - Using malformed packet technique
  939. [*] 212.83.140.187:22 - SSH - Starting scan
  940. [-] 212.83.140.187:22 - SSH - User 'admin' on could not connect
  941. [-] 212.83.140.187:22 - SSH - User 'administrator' on could not connect
  942. [-] 212.83.140.187:22 - SSH - User 'anonymous' on could not connect
  943. [-] 212.83.140.187:22 - SSH - User 'backup' on could not connect
  944. [-] 212.83.140.187:22 - SSH - User 'bee' on could not connect
  945. [-] 212.83.140.187:22 - SSH - User 'ftp' on could not connect
  946. [-] 212.83.140.187:22 - SSH - User 'guest' on could not connect
  947. [-] 212.83.140.187:22 - SSH - User 'GUEST' on could not connect
  948. [-] 212.83.140.187:22 - SSH - User 'info' on could not connect
  949. [-] 212.83.140.187:22 - SSH - User 'mail' on could not connect
  950. [-] 212.83.140.187:22 - SSH - User 'mailadmin' on could not connect
  951. [-] 212.83.140.187:22 - SSH - User 'msfadmin' on could not connect
  952. [-] 212.83.140.187:22 - SSH - User 'mysql' on could not connect
  953. [-] 212.83.140.187:22 - SSH - User 'nobody' on could not connect
  954. [-] 212.83.140.187:22 - SSH - User 'oracle' on could not connect
  955. [-] 212.83.140.187:22 - SSH - User 'owaspbwa' on could not connect
  956. [-] 212.83.140.187:22 - SSH - User 'postfix' on could not connect
  957. [-] 212.83.140.187:22 - SSH - User 'postgres' on could not connect
  958. [-] 212.83.140.187:22 - SSH - User 'private' on could not connect
  959. [-] 212.83.140.187:22 - SSH - User 'proftpd' on could not connect
  960. [-] 212.83.140.187:22 - SSH - User 'public' on could not connect
  961. [-] 212.83.140.187:22 - SSH - User 'root' on could not connect
  962. [-] 212.83.140.187:22 - SSH - User 'superadmin' on could not connect
  963. [-] 212.83.140.187:22 - SSH - User 'support' on could not connect
  964. [-] 212.83.140.187:22 - SSH - User 'sys' on could not connect
  965. [-] 212.83.140.187:22 - SSH - User 'system' on could not connect
  966. [-] 212.83.140.187:22 - SSH - User 'systemadmin' on could not connect
  967. [-] 212.83.140.187:22 - SSH - User 'systemadministrator' on could not connect
  968. [-] 212.83.140.187:22 - SSH - User 'test' on could not connect
  969. [-] 212.83.140.187:22 - SSH - User 'tomcat' on could not connect
  970. [-] 212.83.140.187:22 - SSH - User 'user' on could not connect
  971. [-] 212.83.140.187:22 - SSH - User 'webmaster' on could not connect
  972. [-] 212.83.140.187:22 - SSH - User 'www-data' on could not connect
  973. [-] 212.83.140.187:22 - SSH - User 'Fortimanager_Access' on could not connect
  974. [*] Scanned 1 of 1 hosts (100% complete)
  975. [*] Auxiliary module execution completed
  976. #######################################################################################################################################
  977. Starting Nmap 7.70 ( https://nmap.org ) at 2019-05-01 18:52 EDT
  978. Nmap scan report for ns51.mazinhost.net (212.83.140.187)
  979. Host is up.
  980.  
  981. PORT STATE SERVICE VERSION
  982. 53/tcp filtered domain
  983. Too many fingerprints match this host to give specific OS details
  984.  
  985. Host script results:
  986. | dns-brute:
  987. | DNS Brute-force hostnames:
  988. | www.mazinhost.net - 162.251.82.251
  989. | ns1.mazinhost.net - 95.216.109.43
  990. | ns2.mazinhost.net - 95.216.109.43
  991. | ns3.mazinhost.net - 95.216.109.43
  992. | smtp.mazinhost.net - 208.91.198.143
  993. | smtp.mazinhost.net - 208.91.199.223
  994. | smtp.mazinhost.net - 208.91.199.224
  995. |_ smtp.mazinhost.net - 208.91.199.225
  996.  
  997. TRACEROUTE (using proto 1/icmp)
  998. HOP RTT ADDRESS
  999. 1 167.60 ms 10.251.200.1
  1000. 2 168.57 ms 213.184.122.97
  1001. 3 167.65 ms bzq-82-80-246-9.cablep.bezeqint.net (82.80.246.9)
  1002. 4 168.02 ms bzq-179-124-185.cust.bezeqint.net (212.179.124.185)
  1003. 5 217.45 ms bzq-179-124-190.cust.bezeqint.net (212.179.124.190)
  1004. 6 228.10 ms 80.249.212.93
  1005. 7 242.26 ms 195.154.2.103
  1006. 8 243.84 ms 51.158.8.185
  1007. 9 241.46 ms 195.154.2.145
  1008. 10 ... 30
  1009. #######################################################################################################################################
  1010. Starting Nmap 7.70 ( https://nmap.org ) at 2019-05-01 18:52 EDT
  1011. Nmap scan report for ns51.mazinhost.net (212.83.140.187)
  1012. Host is up.
  1013.  
  1014. PORT STATE SERVICE VERSION
  1015. 67/udp open|filtered dhcps
  1016. |_dhcp-discover: ERROR: Script execution failed (use -d to debug)
  1017. Too many fingerprints match this host to give specific OS details
  1018.  
  1019. TRACEROUTE (using proto 1/icmp)
  1020. HOP RTT ADDRESS
  1021. 1 169.35 ms 10.251.200.1
  1022. 2 171.00 ms 213.184.122.97
  1023. 3 170.86 ms bzq-82-80-246-9.cablep.bezeqint.net (82.80.246.9)
  1024. 4 170.92 ms bzq-179-124-185.cust.bezeqint.net (212.179.124.185)
  1025. 5 219.26 ms bzq-179-124-190.cust.bezeqint.net (212.179.124.190)
  1026. 6 228.64 ms 80.249.212.93
  1027. 7 243.03 ms 195.154.2.103
  1028. 8 244.25 ms 51.158.8.185
  1029. 9 241.89 ms 195.154.2.145
  1030. 10 ... 30
  1031. #######################################################################################################################################
  1032. Starting Nmap 7.70 ( https://nmap.org ) at 2019-05-01 18:54 EDT
  1033. Nmap scan report for ns51.mazinhost.net (212.83.140.187)
  1034. Host is up.
  1035.  
  1036. PORT STATE SERVICE VERSION
  1037. 68/udp open|filtered dhcpc
  1038. Too many fingerprints match this host to give specific OS details
  1039.  
  1040. TRACEROUTE (using proto 1/icmp)
  1041. HOP RTT ADDRESS
  1042. 1 172.86 ms 10.251.200.1
  1043. 2 174.04 ms 213.184.122.97
  1044. 3 167.87 ms bzq-82-80-246-9.cablep.bezeqint.net (82.80.246.9)
  1045. 4 168.09 ms bzq-179-124-185.cust.bezeqint.net (212.179.124.185)
  1046. 5 217.90 ms bzq-179-124-190.cust.bezeqint.net (212.179.124.190)
  1047. 6 228.73 ms 80.249.212.93
  1048. 7 242.92 ms 195.154.2.103
  1049. 8 244.14 ms 51.158.8.185
  1050. 9 241.50 ms 195.154.2.145
  1051. 10 ... 30
  1052. #######################################################################################################################################
  1053. Starting Nmap 7.70 ( https://nmap.org ) at 2019-05-01 18:56 EDT
  1054. Nmap scan report for ns51.mazinhost.net (212.83.140.187)
  1055. Host is up.
  1056.  
  1057. PORT STATE SERVICE VERSION
  1058. 69/udp open|filtered tftp
  1059. Too many fingerprints match this host to give specific OS details
  1060.  
  1061. TRACEROUTE (using proto 1/icmp)
  1062. HOP RTT ADDRESS
  1063. 1 168.89 ms 10.251.200.1
  1064. 2 170.10 ms 213.184.122.97
  1065. 3 168.93 ms bzq-82-80-246-9.cablep.bezeqint.net (82.80.246.9)
  1066. 4 169.13 ms bzq-179-124-185.cust.bezeqint.net (212.179.124.185)
  1067. 5 219.17 ms bzq-179-124-190.cust.bezeqint.net (212.179.124.190)
  1068. 6 229.40 ms 80.249.212.93
  1069. 7 243.39 ms 195.154.2.103
  1070. 8 244.78 ms 51.158.8.185
  1071. 9 242.62 ms 195.154.2.145
  1072. 10 ... 30
  1073. #######################################################################################################################################
  1074. Starting Nmap 7.70 ( https://nmap.org ) at 2019-05-01 19:02 EDT
  1075. Nmap scan report for ns51.mazinhost.net (212.83.140.187)
  1076. Host is up.
  1077.  
  1078. PORT STATE SERVICE VERSION
  1079. 123/udp open|filtered ntp
  1080. Too many fingerprints match this host to give specific OS details
  1081.  
  1082. TRACEROUTE (using proto 1/icmp)
  1083. HOP RTT ADDRESS
  1084. 1 167.24 ms 10.251.200.1
  1085. 2 168.25 ms 213.184.122.97
  1086. 3 167.29 ms bzq-82-80-246-9.cablep.bezeqint.net (82.80.246.9)
  1087. 4 167.63 ms bzq-179-124-185.cust.bezeqint.net (212.179.124.185)
  1088. 5 217.46 ms bzq-179-124-190.cust.bezeqint.net (212.179.124.190)
  1089. 6 227.88 ms 80.249.212.93
  1090. 7 242.27 ms 195.154.2.103
  1091. 8 243.66 ms 51.158.8.185
  1092. 9 241.11 ms 195.154.2.145
  1093. 10 ... 30
  1094. #######################################################################################################################################
  1095. Starting Nmap 7.70 ( https://nmap.org ) at 2019-05-01 19:10 EDT
  1096. NSE: Loaded 148 scripts for scanning.
  1097. NSE: Script Pre-scanning.
  1098. NSE: Starting runlevel 1 (of 2) scan.
  1099. Initiating NSE at 19:10
  1100. Completed NSE at 19:10, 0.00s elapsed
  1101. NSE: Starting runlevel 2 (of 2) scan.
  1102. Initiating NSE at 19:10
  1103. Completed NSE at 19:10, 0.00s elapsed
  1104. Initiating Ping Scan at 19:10
  1105. Scanning 212.83.140.187 [4 ports]
  1106. Completed Ping Scan at 19:10, 2.04s elapsed (1 total hosts)
  1107. Nmap scan report for 212.83.140.187 [host down, received no-response]
  1108. NSE: Script Post-scanning.
  1109. NSE: Starting runlevel 1 (of 2) scan.
  1110. Initiating NSE at 19:10
  1111. Completed NSE at 19:10, 0.00s elapsed
  1112. NSE: Starting runlevel 2 (of 2) scan.
  1113. Initiating NSE at 19:10
  1114. Completed NSE at 19:10, 0.00s elapsed
  1115. Read data files from: /usr/bin/../share/nmap
  1116. Note: Host seems down. If it is really up, but blocking our ping probes, try -Pn
  1117. Nmap done: 1 IP address (0 hosts up) scanned in 2.51 seconds
  1118. Raw packets sent: 8 (304B) | Rcvd: 0 (0B)
  1119. #######################################################################################################################################
  1120. Starting Nmap 7.70 ( https://nmap.org ) at 2019-05-01 19:10 EDT
  1121. NSE: Loaded 148 scripts for scanning.
  1122. NSE: Script Pre-scanning.
  1123. Initiating NSE at 19:10
  1124. Completed NSE at 19:10, 0.00s elapsed
  1125. Initiating NSE at 19:10
  1126. Completed NSE at 19:10, 0.00s elapsed
  1127. Initiating Parallel DNS resolution of 1 host. at 19:10
  1128. Completed Parallel DNS resolution of 1 host. at 19:10, 0.03s elapsed
  1129. Initiating UDP Scan at 19:10
  1130. Scanning ns51.mazinhost.net (212.83.140.187) [14 ports]
  1131. Completed UDP Scan at 19:10, 2.58s elapsed (14 total ports)
  1132. Initiating Service scan at 19:10
  1133. Scanning 12 services on ns51.mazinhost.net (212.83.140.187)
  1134. Service scan Timing: About 8.33% done; ETC: 19:30 (0:17:58 remaining)
  1135. Completed Service scan at 19:12, 102.59s elapsed (12 services on 1 host)
  1136. Initiating OS detection (try #1) against ns51.mazinhost.net (212.83.140.187)
  1137. Retrying OS detection (try #2) against ns51.mazinhost.net (212.83.140.187)
  1138. Initiating Traceroute at 19:12
  1139. Completed Traceroute at 19:12, 7.22s elapsed
  1140. Initiating Parallel DNS resolution of 1 host. at 19:12
  1141. Completed Parallel DNS resolution of 1 host. at 19:12, 0.01s elapsed
  1142. NSE: Script scanning 212.83.140.187.
  1143. Initiating NSE at 19:12
  1144. Completed NSE at 19:12, 20.37s elapsed
  1145. Initiating NSE at 19:12
  1146. Completed NSE at 19:12, 1.32s elapsed
  1147. Nmap scan report for ns51.mazinhost.net (212.83.140.187)
  1148. Host is up (0.17s latency).
  1149.  
  1150. PORT STATE SERVICE VERSION
  1151. 53/udp open|filtered domain
  1152. 67/udp open|filtered dhcps
  1153. 68/udp open|filtered dhcpc
  1154. 69/udp open|filtered tftp
  1155. 88/udp open|filtered kerberos-sec
  1156. 123/udp open|filtered ntp
  1157. 137/udp filtered netbios-ns
  1158. 138/udp filtered netbios-dgm
  1159. 139/udp open|filtered netbios-ssn
  1160. 161/udp open|filtered snmp
  1161. 162/udp open|filtered snmptrap
  1162. 389/udp open|filtered ldap
  1163. 520/udp open|filtered route
  1164. 2049/udp open|filtered nfs
  1165. Too many fingerprints match this host to give specific OS details
  1166.  
  1167. TRACEROUTE (using port 137/udp)
  1168. HOP RTT ADDRESS
  1169. 1 167.91 ms 10.251.200.1
  1170. 2 ... 3
  1171. 4 167.58 ms 10.251.200.1
  1172. 5 167.87 ms 10.251.200.1
  1173. 6 167.86 ms 10.251.200.1
  1174. 7 167.85 ms 10.251.200.1
  1175. 8 167.84 ms 10.251.200.1
  1176. 9 167.84 ms 10.251.200.1
  1177. 10 167.86 ms 10.251.200.1
  1178. 11 ... 18
  1179. 19 167.19 ms 10.251.200.1
  1180. 20 167.29 ms 10.251.200.1
  1181. 21 166.74 ms 10.251.200.1
  1182. 22 ... 29
  1183. 30 168.18 ms 10.251.200.1
  1184.  
  1185. NSE: Script Post-scanning.
  1186. Initiating NSE at 19:12
  1187. Completed NSE at 19:12, 0.00s elapsed
  1188. Initiating NSE at 19:12
  1189. Completed NSE at 19:12, 0.00s elapsed
  1190. Read data files from: /usr/bin/../share/nmap
  1191. OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
  1192. Nmap done: 1 IP address (1 host up) scanned in 140.69 seconds
  1193. Raw packets sent: 148 (13.692KB) | Rcvd: 21 (2.284KB)
  1194. #######################################################################################################################################
  1195. [+] URL: http://mininfo.gov.sd/
  1196. [+] Started: Wed May 1 15:38:35 2019
  1197.  
  1198. Interesting Finding(s):
  1199.  
  1200. [+] http://mininfo.gov.sd/robots.txt
  1201. | Found By: Robots Txt (Aggressive Detection)
  1202. | Confidence: 100%
  1203.  
  1204. [+] http://mininfo.gov.sd/xmlrpc.php
  1205. | Found By: Link Tag (Passive Detection)
  1206. | Confidence: 100%
  1207. | Confirmed By: Direct Access (Aggressive Detection), 100% confidence
  1208. | References:
  1209. | - http://codex.wordpress.org/XML-RPC_Pingback_API
  1210. | - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_ghost_scanner
  1211. | - https://www.rapid7.com/db/modules/auxiliary/dos/http/wordpress_xmlrpc_dos
  1212. | - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_xmlrpc_login
  1213. | - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_pingback_access
  1214.  
  1215. [+] http://mininfo.gov.sd/wp-cron.php
  1216. | Found By: Direct Access (Aggressive Detection)
  1217. | Confidence: 60%
  1218. | References:
  1219. | - https://www.iplocation.net/defend-wordpress-from-ddos
  1220. | - https://github.com/wpscanteam/wpscan/issues/1299
  1221.  
  1222. Fingerprinting the version - Time: 00:01:25 <=========> (346 / 346) 100.00% Time: 00:01:25
  1223. [+] WordPress version 5.1.1 identified (Latest, released on 2019-03-13).
  1224. | Detected By: Query Parameter In Install Page (Aggressive Detection)
  1225. | - http://mininfo.gov.sd/wp-includes/css/dashicons.min.css?ver=5.1.1
  1226. | Confirmed By: Unique Fingerprinting (Aggressive Detection)
  1227. | - http://mininfo.gov.sd/wp-admin/js/widgets/custom-html-widgets.js md5sum is 0c079b9a73b9cfc434e2188b5b9a2ce8
  1228.  
  1229. [+] WordPress theme in use: alyoum2
  1230. | Location: http://mininfo.gov.sd/wp-content/themes/alyoum2/
  1231. | [!] An error log file has been found: http://mininfo.gov.sd/wp-content/themes/alyoum2/error_log
  1232. | Style URL: http://mininfo.gov.sd/wp-content/themes/alyoum2/style.css
  1233. | Style Name: AlYoum Premium Blog/Magazine WordPress Theme
  1234. | Style URI: http://themeforest.net/user/Code125?ref=code125
  1235. | Description: AlYoum Premium Magazine & Blog WordPress Theme available on themeforest with many features and optio...
  1236. | Author: Code125
  1237. | Author URI: http://www.code125.com
  1238. |
  1239. | Detected By: Urls In Homepage (Passive Detection)
  1240. |
  1241. | Version: 5.9.2 (80% confidence)
  1242. | Detected By: Style (Passive Detection)
  1243. | - http://mininfo.gov.sd/wp-content/themes/alyoum2/style.css, Match: 'Version: 5.9.2'
  1244.  
  1245. [+] Enumerating All Plugins (via Passive Methods)
  1246. [+] Checking Plugin Versions (via Passive and Aggressive Methods)
  1247.  
  1248. [i] Plugin(s) Identified:
  1249.  
  1250. [+] gs-logo-slider
  1251. | Location: http://mininfo.gov.sd/wp-content/plugins/gs-logo-slider/
  1252. | Last Updated: 2019-01-17T11:16:00.000Z
  1253. | [!] The version is out of date, the latest version is 1.8.2
  1254. |
  1255. | Detected By: Urls In Homepage (Passive Detection)
  1256. |
  1257. | Version: 1.8.1 (100% confidence)
  1258. | Detected By: Readme - Stable Tag (Aggressive Detection)
  1259. | - http://mininfo.gov.sd/wp-content/plugins/gs-logo-slider/readme.txt
  1260. | Confirmed By: Readme - ChangeLog Section (Aggressive Detection)
  1261. | - http://mininfo.gov.sd/wp-content/plugins/gs-logo-slider/readme.txt
  1262.  
  1263. [+] revslider
  1264. | Location: http://mininfo.gov.sd/wp-content/plugins/revslider/
  1265. |
  1266. | Detected By: Meta Generator (Passive Detection)
  1267. |
  1268. | Version: 5.3.0.2 (100% confidence)
  1269. | Detected By: Meta Generator (Passive Detection)
  1270. | - http://mininfo.gov.sd/, Match: 'Powered by Slider Revolution 5.3.0.2'
  1271. | Confirmed By: Release Log (Aggressive Detection)
  1272. | - http://mininfo.gov.sd/wp-content/plugins/revslider/release_log.html, Match: 'Version 5.3.0.2 StarPath (26th October 2016)'
  1273.  
  1274. [+] sitepress-multilingual-cms
  1275. | Location: http://mininfo.gov.sd/wp-content/plugins/sitepress-multilingual-cms/
  1276. | Latest Version: 2.0.4.1 (up to date)
  1277. | Last Updated: 2011-06-05T13:40:00.000Z
  1278. |
  1279. | Detected By: Urls In Homepage (Passive Detection)
  1280. | Confirmed By: Meta Generator (Passive Detection)
  1281. |
  1282. | Version: 4.1.3 (60% confidence)
  1283. | Detected By: Meta Generator (Passive Detection)
  1284. | - http://mininfo.gov.sd/, Match: 'WPML ver:4.1.3 stt'
  1285.  
  1286. [+] xt-visitor-counter
  1287. | Location: http://mininfo.gov.sd/wp-content/plugins/xt-visitor-counter/
  1288. | Latest Version: 1.4.1
  1289. | Last Updated: 2018-10-18T08:31:00.000Z
  1290. |
  1291. | Detected By: Urls In Homepage (Passive Detection)
  1292. |
  1293. | The version could not be determined.
  1294.  
  1295. [+] Enumerating Config Backups (via Passive and Aggressive Methods)
  1296. Checking Config Backups - Time: 00:00:01 <=============> (21 / 21) 100.00% Time: 00:00:01
  1297.  
  1298. [i] No Config Backups Found.
  1299.  
  1300.  
  1301. [+] Finished: Wed May 1 15:55:00 2019
  1302. [+] Requests Done: 250
  1303. [+] Cached Requests: 7
  1304. [+] Data Sent: 50.873 KB
  1305. [+] Data Received: 20.745 MB
  1306. [+] Memory used: 173.645 MB
  1307. [+] Elapsed time: 00:16:25
  1308. #######################################################################################################################################
  1309. [+] URL: http://mininfo.gov.sd/
  1310. [+] Started: Wed May 1 15:38:35 2019
  1311.  
  1312. Interesting Finding(s):
  1313.  
  1314. [+] http://mininfo.gov.sd/robots.txt
  1315. | Found By: Robots Txt (Aggressive Detection)
  1316. | Confidence: 100%
  1317.  
  1318. [+] http://mininfo.gov.sd/xmlrpc.php
  1319. | Found By: Link Tag (Passive Detection)
  1320. | Confidence: 100%
  1321. | Confirmed By: Direct Access (Aggressive Detection), 100% confidence
  1322. | References:
  1323. | - http://codex.wordpress.org/XML-RPC_Pingback_API
  1324. | - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_ghost_scanner
  1325. | - https://www.rapid7.com/db/modules/auxiliary/dos/http/wordpress_xmlrpc_dos
  1326. | - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_xmlrpc_login
  1327. | - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_pingback_access
  1328.  
  1329. [+] http://mininfo.gov.sd/wp-cron.php
  1330. | Found By: Direct Access (Aggressive Detection)
  1331. | Confidence: 60%
  1332. | References:
  1333. | - https://www.iplocation.net/defend-wordpress-from-ddos
  1334. | - https://github.com/wpscanteam/wpscan/issues/1299
  1335.  
  1336. Fingerprinting the version - Time: 00:01:26 <> (346 / 346) 100.00% Time: 00:01:26
  1337. [+] WordPress version 5.1.1 identified (Latest, released on 2019-03-13).
  1338. | Detected By: Query Parameter In Install Page (Aggressive Detection)
  1339. | - http://mininfo.gov.sd/wp-includes/css/dashicons.min.css?ver=5.1.1
  1340. | Confirmed By: Unique Fingerprinting (Aggressive Detection)
  1341. | - http://mininfo.gov.sd/wp-admin/js/widgets/custom-html-widgets.js md5sum is 0c079b9a73b9cfc434e2188b5b9a2ce8
  1342.  
  1343. [+] WordPress theme in use: alyoum2
  1344. | Location: http://mininfo.gov.sd/wp-content/themes/alyoum2/
  1345. | [!] An error log file has been found: http://mininfo.gov.sd/wp-content/themes/alyoum2/error_log
  1346. | Style URL: http://mininfo.gov.sd/wp-content/themes/alyoum2/style.css
  1347. | Style Name: AlYoum Premium Blog/Magazine WordPress Theme
  1348. | Style URI: http://themeforest.net/user/Code125?ref=code125
  1349. | Description: AlYoum Premium Magazine & Blog WordPress Theme available on themeforest with many features and optio...
  1350. | Author: Code125
  1351. | Author URI: http://www.code125.com
  1352. |
  1353. | Detected By: Urls In Homepage (Passive Detection)
  1354. |
  1355. | Version: 5.9.2 (80% confidence)
  1356. | Detected By: Style (Passive Detection)
  1357. | - http://mininfo.gov.sd/wp-content/themes/alyoum2/style.css, Match: 'Version: 5.9.2'
  1358.  
  1359. [+] Enumerating Users (via Passive and Aggressive Methods)
  1360. Brute Forcing Author IDs - Time: 00:00:10 <==> (10 / 10) 100.00% Time: 00:00:10
  1361.  
  1362. [i] User(s) Identified:
  1363.  
  1364. [+] mazin
  1365. | Detected By: Author Posts - Author Pattern (Passive Detection)
  1366.  
  1367. [+] edit-min-sd
  1368. | Detected By: Author Posts - Author Pattern (Passive Detection)
  1369.  
  1370.  
  1371. [+] Finished: Wed May 1 15:53:47 2019
  1372. [+] Requests Done: 149
  1373. [+] Cached Requests: 81
  1374. [+] Data Sent: 30.478 KB
  1375. [+] Data Received: 1.25 MB
  1376. [+] Memory used: 88.637 MB
  1377. [+] Elapsed time: 00:15:11
  1378. #######################################################################################################################################
  1379. [+] URL: http://mininfo.gov.sd/
  1380. [+] Started: Wed May 1 15:57:27 2019
  1381.  
  1382. Interesting Finding(s):
  1383.  
  1384. [+] http://mininfo.gov.sd/robots.txt
  1385. | Found By: Robots Txt (Aggressive Detection)
  1386. | Confidence: 100%
  1387.  
  1388. [+] http://mininfo.gov.sd/xmlrpc.php
  1389. | Found By: Link Tag (Passive Detection)
  1390. | Confidence: 30%
  1391. | References:
  1392. | - http://codex.wordpress.org/XML-RPC_Pingback_API
  1393. | - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_ghost_scanner
  1394. | - https://www.rapid7.com/db/modules/auxiliary/dos/http/wordpress_xmlrpc_dos
  1395. | - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_xmlrpc_login
  1396. | - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_pingback_access
  1397.  
  1398. [+] http://mininfo.gov.sd/wp-cron.php
  1399. | Found By: Direct Access (Aggressive Detection)
  1400. | Confidence: 60%
  1401. | References:
  1402. | - https://www.iplocation.net/defend-wordpress-from-ddos
  1403. | - https://github.com/wpscanteam/wpscan/issues/1299
  1404.  
  1405. Fingerprinting the version - Time: 00:00:36 <=========> (346 / 346) 100.00% Time: 00:00:36
  1406. [+] WordPress version 5.1.1 identified (Latest, released on 2019-03-13).
  1407. | Detected By: Query Parameter In Install Page (Aggressive Detection)
  1408. | - http://mininfo.gov.sd/wp-includes/css/dashicons.min.css?ver=5.1.1
  1409. | Confirmed By: Unique Fingerprinting (Aggressive Detection)
  1410. | - http://mininfo.gov.sd/wp-admin/js/widgets/custom-html-widgets.js md5sum is 0c079b9a73b9cfc434e2188b5b9a2ce8
  1411.  
  1412. [+] WordPress theme in use: alyoum2
  1413. | Location: http://mininfo.gov.sd/wp-content/themes/alyoum2/
  1414. | [!] An error log file has been found: http://mininfo.gov.sd/wp-content/themes/alyoum2/error_log
  1415. | Style URL: http://mininfo.gov.sd/wp-content/themes/alyoum2/style.css
  1416. | Style Name: AlYoum Premium Blog/Magazine WordPress Theme
  1417. | Style URI: http://themeforest.net/user/Code125?ref=code125
  1418. | Description: AlYoum Premium Magazine & Blog WordPress Theme available on themeforest with many features and optio...
  1419. | Author: Code125
  1420. | Author URI: http://www.code125.com
  1421. |
  1422. | Detected By: Urls In Homepage (Passive Detection)
  1423. |
  1424. | Version: 5.9.2 (80% confidence)
  1425. | Detected By: Style (Passive Detection)
  1426. | - http://mininfo.gov.sd/wp-content/themes/alyoum2/style.css, Match: 'Version: 5.9.2'
  1427.  
  1428. [+] Enumerating Users (via Passive and Aggressive Methods)
  1429. Brute Forcing Author IDs - Time: 00:00:03 <============> (10 / 10) 100.00% Time: 00:00:03
  1430.  
  1431. [i] User(s) Identified:
  1432.  
  1433. [+] mazin
  1434. | Detected By: Author Posts - Author Pattern (Passive Detection)
  1435.  
  1436. [+] edit-min-sd
  1437. | Detected By: Author Posts - Author Pattern (Passive Detection)
  1438.  
  1439.  
  1440. [+] Finished: Wed May 1 16:12:22 2019
  1441. [+] Requests Done: 214
  1442. [+] Cached Requests: 7
  1443. [+] Data Sent: 44.524 KB
  1444. [+] Data Received: 4.377 MB
  1445. [+] Memory used: 89.316 MB
  1446. [+] Elapsed time: 00:14:55
  1447. #######################################################################################################################################
  1448. [-] Date & Time: 01/05/2019 15:38:19
  1449. [I] Threads: 5
  1450. [-] Target: http://mininfo.gov.sd (212.83.140.187)
  1451. [M] Website Not in HTTPS: http://mininfo.gov.sd
  1452. [L] X-Frame-Options: Not Enforced
  1453. [I] Strict-Transport-Security: Not Enforced
  1454. [I] X-Content-Security-Policy: Not Enforced
  1455. [I] X-Content-Type-Options: Not Enforced
  1456. [L] Robots.txt Found: http://mininfo.gov.sd/robots.txt
  1457. [I] CMS Detection: WordPress
  1458. [I] Wordpress Theme: alyoum2
  1459. [-] WordPress usernames identified:
  1460. [M] وزارة الإعلام
  1461. [M] XML-RPC services are enabled
  1462. [I] Autocomplete Off Not Found: http://mininfo.gov.sd/wp-login.php
  1463. [-] Default WordPress Files:
  1464. [I] http://mininfo.gov.sd/license.txt
  1465. [I] http://mininfo.gov.sd/wp-content/themes/twentyfifteen/genericons/COPYING.txt
  1466. [I] http://mininfo.gov.sd/wp-content/themes/twentyfifteen/genericons/LICENSE.txt
  1467. [I] http://mininfo.gov.sd/wp-content/themes/twentyfifteen/readme.txt
  1468. [I] http://mininfo.gov.sd/wp-content/themes/twentynineteen/readme.txt
  1469. [I] http://mininfo.gov.sd/wp-content/themes/twentyseventeen/README.txt
  1470. [I] http://mininfo.gov.sd/wp-content/themes/twentysixteen/genericons/COPYING.txt
  1471. [I] http://mininfo.gov.sd/wp-content/themes/twentysixteen/genericons/LICENSE.txt
  1472. [I] http://mininfo.gov.sd/wp-content/themes/twentysixteen/readme.txt
  1473. [I] http://mininfo.gov.sd/wp-includes/ID3/license.commercial.txt
  1474. [I] http://mininfo.gov.sd/wp-includes/ID3/license.txt
  1475. [I] http://mininfo.gov.sd/wp-includes/ID3/readme.txt
  1476. [I] http://mininfo.gov.sd/wp-includes/images/crystal/license.txt
  1477. [I] http://mininfo.gov.sd/wp-includes/js/plupload/license.txt
  1478. [I] http://mininfo.gov.sd/wp-includes/js/swfupload/license.txt
  1479. [I] http://mininfo.gov.sd/wp-includes/js/tinymce/license.txt
  1480. [-] Searching Wordpress Plugins ...
  1481. [I] "+plugin+"
  1482. [I] $plugin
  1483. [I] Enigma2.php?boarddir=http:
  1484. [I] adrotate
  1485. [M] EDB-ID: 17888 "WordPress Plugin AdRotate 3.6.5 - SQL Injection"
  1486. [M] EDB-ID: 18114 "WordPress Plugin AdRotate 3.6.6 - SQL Injection"
  1487. [M] EDB-ID: 31834 "WordPress Plugin AdRotate 3.9.4 - 'clicktracker.ph?track' SQL Injection"
  1488. [I] ads-box
  1489. [M] EDB-ID: 38060 "WordPress Plugin Ads Box - 'count' SQL Injection"
  1490. [I] all-in-one-wp-security-and-firewall
  1491. [M] EDB-ID: 34854 "WordPress Plugin All In One WP Security & Firewall 3.8.3 - Persistent Cross-Site Scripting"
  1492. [I] feed
  1493. [M] EDB-ID: 38624 "WordPress Plugin WP Feed - 'nid' SQL Injection"
  1494. [I] firestats
  1495. [M] EDB-ID: 14308 "WordPress Plugin Firestats - Remote Configuration File Download"
  1496. [M] EDB-ID: 33367 "WordPress Plugin Firestats 1.0.2 - Multiple Cross-Site Scripting / Authentication Bypass Vulnerabilities (1)"
  1497. [M] EDB-ID: 33368 "WordPress Plugin Firestats 1.0.2 - Multiple Cross-Site Scripting / Authentication Bypass Vulnerabilities (2)"
  1498. [I] gs-logo-slider v1.8.1
  1499. [I] revslider
  1500. [I] simple-ads-manager
  1501. [M] EDB-ID: 36613 "WordPress Plugin Simple Ads Manager - Multiple SQL Injections"
  1502. [M] EDB-ID: 36614 "WordPress Plugin Simple Ads Manager 2.5.94 - Arbitrary File Upload"
  1503. [M] EDB-ID: 36615 "WordPress Plugin Simple Ads Manager - Information Disclosure"
  1504. [M] EDB-ID: 39133 "WordPress Plugin Simple Ads Manager 2.9.4.116 - SQL Injection"
  1505. [I] sitepress-multilingual-cms
  1506. [I] wp-bannerize
  1507. [M] EDB-ID: 17764 "WordPress Plugin Bannerize 2.8.6 - SQL Injection"
  1508. [M] EDB-ID: 17906 "WordPress Plugin Bannerize 2.8.7 - SQL Injection"
  1509. [M] EDB-ID: 36193 "WordPress Plugin WP Bannerize 2.8.7 - 'ajax_sorter.php' SQL Injection"
  1510. [I] xt-visitor-counter
  1511. [I] Checking for Directory Listing Enabled ...
  1512. [-] Date & Time: 01/05/2019 16:05:08
  1513. [-] Completed in: 0:26:49
  1514. ######################################################################################################################################
  1515. --------------------------------------------------------------------------------------------------------------------------------------
  1516. + Target IP: 212.83.140.187
  1517. + Target Hostname: mininfo.gov.sd
  1518. + Target Port: 80
  1519. + Start Time: 2019-05-01 16:39:01 (GMT-4)
  1520. ---------------------------------------------------------------------------------------------------------------------------------------
  1521. + Server: No banner retrieved
  1522. + The anti-clickjacking X-Frame-Options header is not present.
  1523. + The X-XSS-Protection header is not defined. This header can hint to the user agent to protect against some forms of XSS
  1524. + The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type
  1525. + Uncommon header 'x-squid-error' found, with contents: ERR_INVALID_URL 0
  1526. + ERROR: Error limit (20) reached for host, giving up. Last error: error reading HTTP response
  1527. + Scan terminated: 20 error(s) and 4 item(s) reported on remote host
  1528. + End Time: 2019-05-01 16:48:27 (GMT-4) (566 seconds)
  1529. ---------------------------------------------------------------------------------------------------------------------------------------
  1530. #######################################################################################################################################
  1531. Anonymous JTSEC #OpSudan Full Recon #65
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!