API tools faq
paste
marys

EXPLOITS/BAESYSTEMS

marys
Dec 13th, 2014
952
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 11.79 KB | None | 0 0
raw download clone embed print report
  1. EXPLOITATION & VULNERABILITY REPORT BY ANON-NINJA-CAT <3 SEE CONE-CAT FOR CLEARANCE , WHO WILL CONTACT INFOSEC-CAT WHO WILL ACCESS THE CYBER-HIVE.
  2.  
  3. MILD/EXPLOITATION @ 48%. I am Available for Freelance Work etc .
  4.  
  5. WE ARE ANONYMOUS.
  6. WE ARE LEGION.
  7. WE ARE GHOSTS OF THE CYBER-HIVE.
  8. WE OWN THE MATRIX...WORLDWIDE.
  9.  
  10. BAE Systems plc is a British multinational defence, security and aerospace company headquartered in London in the United Kingdom and with operations worldwide.
  11.  
  12. http://www.baesystems.com / I grade there System @ GRADE F .
  13.  
  14. IP Address 173.223.204.88 <<< deploy.static.akamaitechnologies.com )
  15.  
  16. report for a173-223-204-88.deploy.static.akamaitechnologies.com (173.223.204.88)
  17. Host is up (0.013s latency).
  18. PORT STATE SERVICE
  19. 80/tcp open http
  20. 443/tcp open https
  21.  
  22. Server Type Oracle-Application-Server-11g Oracle-Web-Cache-11g/11.1.1.6.0 (M;max-age=4294788147+0;age=0;ecid=18526259454861
  23.  
  24. The remote network has an active filter.
  25. ---------------------------------------------------------------------------------------------------------------------------------------
  26. ----- www.baesystems.com -----
  27.  
  28.  
  29. Host's addresses:
  30. __________________
  31.  
  32. a1017.b.akamai.net 5 IN A 203.97.86.200
  33. a1017.b.akamai.net 5 IN A 203.97.86.219
  34.  
  35. CNAME www.baesystems.com www.baesystems.com.edgesuite.net. CNAME www.baesystems.com.edgesuite.net a1017.b.akamai.net.
  36. A a1017.b.akamai.net 203.97.86.200
  37. A a1017.b.akamai.net 203.97.86.219
  38.  
  39. Name Server IP Location
  40. ns.domainnetwork.se 209.112.113.33 Sterling, VA, US
  41.  
  42. ns2.domainnetwork.se 209.112.114.33 Sterling, VA, US
  43.  
  44. ns3.domainnetwork.com 69.36.145.33 Sterling, VA, US
  45.  
  46. ===============================================================================================================================
  47. www.baesystems.com (23.61.194.233) (SERVER 1)
  48.  
  49. Server:Apache
  50. IP Address:23.61.194.233
  51. Port:443
  52. Hostname:www.baesystems.com
  53.  
  54. 23.61.194.233
  55.  
  56. 18 site(s) hosted on ip 23.61.194.233
  57. Location: Cambridge,United States
  58.  
  59. Recommended certificate chain:
  60.  
  61. Serial Number:0727370C
  62. Fingerprint (SHA-1):30D1FD4A296AB1A8831CD56B4110A227F557BFFF
  63.  
  64. Serial Number:020000B9
  65. Fingerprint (SHA-1):D4DE20D05E66FC53FE1A50882C78DB2852CAE474
  66.  
  67. Certificates sent by server:
  68.  
  69. Serial Number:0200000000014691CB0B265BEFFE
  70. Fingerprint (SHA-1):F01A81F9C6C0A1FFB26B477FA38145CE428A4FF9
  71.  
  72. Serial Number:0727370C
  73. Fingerprint (SHA-1):30D1FD4A296AB1A8831CD56B4110A227F557BFFF
  74.  
  75. Serial Number:07278EED
  76. Fingerprint (SHA-1):4D34EA92764B3A3149119952F41930CA11348361
  77. ------------------------------------------------------------------------------------------------------------------------
  78. PULSE BAE Systems Electronic Systems The Employees ...
  79. www.eis.na.baesystems.com/pulse/current/files/data/search.xml
  80.  
  81. Click and drag a corner to turn a page View note Note Yes ...
  82. www.eis.na.baesystems.com/pulse/current/files/data/bookinfo.xml
  83.  
  84. Index of /barcode
  85. barcode.eis.na.baesystems.com/barcode/
  86.  
  87. Index of /supplierlink/pdf - BAE Systems
  88. www.eis.na.baesystems.com/supplierlink/pdf/
  89.  
  90. https://www.google.co.nz/search?q=site:baesystems.com+ext:doc+|+ext:docx+|+ext:odt+|+ext:pdf+|+ext:rtf+|+ext:sxw+|+ext:psw+|+ext:ppt+|+ext:pptx+|+ext:pps+|+ext:csv&gws_rd=cr&ei=FyqMVL25DuLHmwWhsoKIAw
  91. -----------------------------------------------------------------------------------------------------------------------------------------
  92. http://www.baesystems.com/robots.txt.
  93.  
  94. # Allow all.
  95. User-Agent: *
  96. #Disallow: /
  97. Allow: /
  98. # Disallow search results, duplicate pages and the main broken pages from the old site
  99. Disallow: /page/search*
  100. Disallow: /*.html$
  101. Disallow: /csSmallBusiness/
  102. Disallow: /cs/
  103. Disallow: /index.htm
  104. Disallow: /baesystems/media
  105. Disallow: /Newsroom/NewsReleases
  106. Disallow: /ProductsServices/
  107. Disallow: /BAEProd/
  108. # Disallow pages related to furlough
  109. Disallow: /campaigns/furlough-information-resource/
  110. Disallow: /article/BAES_156674
  111. Disallow: /landing/BAES_157044
  112. Disallow: /article/BAES_157294
  113. Disallow: /article/BAES_157376
  114. Disallow: /article/BAES_157377
  115. Disallow: /article/BAES_157303
  116. Disallow: /article/BAES_157255
  117. Disallow: /article/BAES_157264
  118. Disallow: /article/BAES_157259
  119. Disallow: /article/BAES_157287
  120. # Main navigation sitemap.
  121. Sitemap: http://www.baesystems.com/sitemap.xml
  122. ---------------------------------------------------------------------------------------------------------------------------------
  123.  
  124. EXPLOITS:>>> WWW.BAESYSTEMS.COM.
  125.  
  126. the whole target has no protection (X-Frame-Options header) against ClickJacking attack
  127.  
  128. WordPress version "2.5" found from data.
  129. GET http://www.baesystems.com/wp-admin/async-upload.php HTTP/1.1
  130. Host: www.baesystems.com
  131. Cookie: ORA_WX_SESSION="66252772CE876C0088ED5EBC666847802EF7EBDF-2#1"; A10-RED-cookie-www.baesystems.com-20480=DEDADMAKGBBO; baeSessionId=cbpDm5M0PQo20lubQlYj0AusqorTUY7gtCW_ybDHzX2CZCB9Fpx9!1317467394
  132.  
  133. A robots.txt file was found at: "http://www.baesystems.com/robots.txt".
  134. GET http://www.baesystems.com/robots.txt HTTP/1.1
  135. Host: www.baesystems.com
  136. Cookie: ORA_WX_SESSION="66252772CE876C0088ED5EBC666847802EF7EBDF-2#1"; A10-RED-cookie-www.baesystems.com-20480=DEDADMAKGBBO; baeSessionId=cbpDm5M0PQo20lubQlYj0AusqorTUY7gtCW_ybDHzX2CZCB9Fpx9!1317467394
  137.  
  138. https://iserv1.lna.us.baesystems.com/nidp/app/login?id=27&sid&option=credential
  139.  
  140. X-Powered-By" header for this HTTP server is: "Servlet/2.5 JSP/2.1
  141.  
  142. GET http://www.baesystems.com/home HTTP/1.1
  143. Host: www.baesystems.com
  144. Cookie: ORA_WX_SESSION="66252772CE876C0088ED5EBC666847802EF7EBDF-2#1"; A10-RED-cookie-www.baesystems.com-20480=DEDADMAKGBBO; baeSessionId=dkJDlnd4qxnNGdVxPWfy4NQHbexnVm7CwASyi6Zn821l3At8i6x5!-1533942798
  145.  
  146. The server header for the remote web server is: "Oracle-Application-Server-11g Oracle-Web-Cache-11g/11.1.1.6.0 (N;ecid=80500508421969662,0:1)"
  147.  
  148. GET http://www.baesystems.com/home HTTP/1.1
  149. Host: www.baesystems.com
  150. Cookie: ORA_WX_SESSION="66252772CE876C0088ED5EBC666847802EF7EBDF-2#1"; A10-RED-cookie-www.baesystems.com-20480=DEDADMAKGBBO; baeSessionId=dkJDlnd4qxnNGdVxPWfy4NQHbexnVm7CwASyi6Zn821l3At8i6x5!-1533942798
  151.  
  152. The URL "http://www.baesystems.com/" has the following allowed methods: *, BASELINE_CONTROL, CHECKIN, CHECKOUT, CONNECT, DEBUG, GET, HEAD, INDEX, INVALID, INVOKE, LABEL, LINK, MERGE, MKACTIVITY, MKDIR, MKWORKSPACE, NOTIFY, PIN, POLL, POST, REPLY, RMDIR, SEARCH, SHOWMETHOD, SPACEJUMP, SUBSCRIBE, SUBSCRIPTIONS, TEXTSEARCH, TRACK, UNCHECKOUT, UNLINK, UNSUBSCRIBE, VERSION_CONTROL.
  153.  
  154. The URL: "http://www.baesystems.com" sent the cookie: "A10-RED-cookie-www.baesystems.com-20480=DEDADMAKGBBO; Expires=Sat, 13-Dec-2014 14:38:28 GMT; Path=/"
  155. GET http://www.baesystems.com/home HTTP/1.1
  156. Host: www.baesystems.com
  157. Cookie: A10-RED-cookie-www.baesystems.com-20480=DEDADMAKGBBO
  158.  
  159. Hostname in certificate and DNS name do not match
  160. Users will receive strong browser warnings
  161.  
  162. Server does not use secure renegotiation settings
  163. Site is more vulnerable to Denial of Service (DOS) attacks
  164.  
  165. Server has not enabled HTTP Strict-Transport-Security
  166. Users may be exposed to man-in-the-middle attacks
  167.  
  168. Site is using certificate from CA that doesn’t support IPv4
  169. IPv4-only users may experience errors when visiting your site
  170.  
  171. Server doesn’t prefer ciphers that enable forward secrecy.
  172. Encrypted communications captured today are at risk of being decrypted by an attacker in the future.
  173.  
  174. Server uses RC4 cipher with modern browsers
  175. More secure ciphers are available for TLS 1.1 and newer
  176.  
  177. Server configuration does not meet PCI/DSS guidelines
  178. This is a problem if you process credit card information
  179.  
  180. Server is using RC4-based ciphersuites which have known vulnerabilities
  181. Evaluate your client compatibility requirements to determine if you can disable RC4-based ciphersuites
  182.  
  183. Server has not yet upgraded to a Extended Validation certificate
  184. Increase customer confidence by offering visitors the highest level of assurance
  185.  
  186. SSL 2.0 Disabled:Pass
  187. SSL 3.0 Disabled:Pass
  188. TLS 1.0 Enabled:Pass
  189. TLS 1.1 Enabled:Pass
  190. TLS 1.2 Enabled:Pass
  191. Weak ciphersuites disabled:Pass
  192. Certificates configured correctly:Fail <<<<<
  193. Secure renegotiation configured:Fail <<<<<
  194. Session resumption configured:Pass
  195. BEAST Vulnerability:Pass
  196. OCSP Stapling:Fail <<<<<
  197. PCI Compliant:Fail <<<<
  198. FIPS Compliant:Fail <<<<<
  199. Forward Secrecy Supported:Fail <<<<
  200. Heartbleed Vulnerability:Pass
  201.  
  202. Strict Transport Security:Fail <<<<<
  203. Mixed Content (HTTP and HTTPS):Timed Out <<<<<
  204. Domain name resolves to IPv4 address:Pass
  205. Domain name resolves to IPv6 address:Fail <<<<<
  206. =============================================================================================================
  207. www.baesystems.com (23.61.194.171) (SERVER 2)
  208.  
  209. Server:Apache
  210. IP Address:23.61.194.171
  211. Port:443
  212. Hostname:www.baesystems.com
  213.  
  214. 23.61.194.171
  215.  
  216. 47 site(s) hosted on ip 23.61.194.171
  217. Location: Cambridge,United States
  218.  
  219. Recommended certificate chain:
  220.  
  221. Serial Number:0200000000014691CB0B265BEFFE
  222. Fingerprint (SHA-1):F01A81F9C6C0A1FFB26B477FA38145CE428A4FF9
  223.  
  224. Serial Number:0727370C
  225. Fingerprint (SHA-1):30D1FD4A296AB1A8831CD56B4110A227F557BFFF
  226.  
  227. Serial Number:020000B9
  228. Fingerprint (SHA-1):D4DE20D05E66FC53FE1A50882C78DB2852CAE474
  229.  
  230. Certificates sent by server:
  231.  
  232. Serial Number:0200000000014691CB0B265BEFFE
  233. Fingerprint (SHA-1): F01A81F9C6C0A1FFB26B477FA38145CE428A4FF9
  234.  
  235. Serial Number:0727370C
  236. Fingerprint (SHA-1):30D1FD4A296AB1A8831CD56B4110A227F557BFFF
  237.  
  238. Serial Number:07278EED
  239. Fingerprint (SHA-1):4D34EA92764B3A3149119952F41930CA11348361
  240.  
  241. EXPLOITS:
  242.  
  243. Hostname in certificate and DNS name do not match
  244. Users will receive strong browser warnings
  245.  
  246. Server does not use secure renegotiation settings
  247. Site is more vulnerable to Denial of Service (DOS) attacks
  248.  
  249. Server has not enabled HTTP Strict-Transport-Security
  250. Users may be exposed to man-in-the-middle attacks
  251.  
  252. Site is using certificate from CA that doesn’t support IPv4
  253. IPv4-only users may experience errors when visiting your site.
  254.  
  255. Server doesn’t prefer ciphers that enable forward secrecy.
  256. Encrypted communications captured today are at risk of being decrypted by an attacker in the future
  257.  
  258. Server uses RC4 cipher with modern browsers
  259. More secure ciphers are available for TLS 1.1 and newer
  260.  
  261. Server configuration does not meet FIPS guidelines
  262. Federal standards for data handling are not being met
  263.  
  264. Server configuration does not meet PCI/DSS guidelines
  265. This is a problem if you process credit card information
  266.  
  267. Server has not yet upgraded to a Extended Validation certificate
  268. Increase customer confidence by offering visitors the highest level of assurance.
  269.  
  270. SSL 2.0 Disabled:Pass
  271. SSL 3.0 Disabled:Pass
  272. TLS 1.0 Enabled:Pass
  273. TLS 1.1 Enabled:Pass
  274. TLS 1.2 Enabled:Pass
  275. Weak ciphersuites disabled:Pass
  276. Certificates configured correctly:Fail <<<<
  277. Secure renegotiation configured:Fail <<<<
  278. Session resumption configured:Pass
  279. BEAST Vulnerability:Pass
  280. OCSP Stapling:Fail <<<<
  281. PCI Compliant:Fail <<<<
  282. FIPS Compliant:Fail <<<<
  283. Forward Secrecy Supported:Fail <<<<
  284. Heartbleed Vulnerability:Pass
  285.  
  286. Strict Transport Security:Fail <<<<
  287. Mixed Content (HTTP and HTTPS):Timed Out <<<<<
  288. Domain name resolves to IPv4 address:Pass
  289. Domain name resolves to IPv6 address:Fail <<<<<
  290. ==========================================================================================================================
  291. www.baesystems.com 149.32.227.51 (Server 3 )
  292.  
  293. 149.32.227.51
  294.  
  295. 6 site(s) hosted on ip 149.32.227.51
  296. Location: Rockville,United States
  297.  
  298. report for baesystems.com (149.32.227.51)
  299. Host is up (0.0083s latency).
  300. PORT STATE SERVICE
  301. 80/tcp open http
  302. ---------------------------------------------------------------------------------------------------------------------------
  303. For the full file " read the top line "
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!