API tools faq
paste
JTSEC1333

Anonymous JTSEC #OpSudan Full Recon #46

JTSEC1333
Mar 21st, 2019
1,498
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 78.42 KB | None | 0 0
raw download clone embed print report
  1. #######################################################################################################################################
  2. =======================================================================================================================================
  3. Hostname www.rivernilestate.gov.sd ISP NICDC
  4. Continent Africa Flag
  5. SD
  6. Country Sudan Country Code SD
  7. Region Unknown Local time 21 Mar 2019 17:10 CAT
  8. City Unknown Postal Code Unknown
  9. IP Address 62.12.105.2 Latitude 15
  10. =======================================================================================================================================
  11. #######################################################################################################################################
  12. > www.rivernilestate.gov.sd
  13. Server: 38.132.106.139
  14. Address: 38.132.106.139#53
  15.  
  16. Non-authoritative answer:
  17. Name: www.rivernilestate.gov.sd
  18. Address: 62.12.105.2
  19. >
  20. #######################################################################################################################################
  21.  
  22. HostIP:62.12.105.2
  23. HostName:www.rivernilestate.gov.sd
  24.  
  25. Gathered Inet-whois information for 62.12.105.2
  26. ---------------------------------------------------------------------------------------------------------------------------------------
  27.  
  28.  
  29. inetnum: 62.12.96.0 - 62.12.127.255
  30. netname: NON-RIPE-NCC-MANAGED-ADDRESS-BLOCK
  31. descr: IPv4 address block not managed by the RIPE NCC
  32. remarks: ------------------------------------------------------
  33. remarks:
  34. remarks: For registration information,
  35. remarks: you can consult the following sources:
  36. remarks:
  37. remarks: IANA
  38. remarks: http://www.iana.org/assignments/ipv4-address-space
  39. remarks: http://www.iana.org/assignments/iana-ipv4-special-registry
  40. remarks: http://www.iana.org/assignments/ipv4-recovered-address-space
  41. remarks:
  42. remarks: AFRINIC (Africa)
  43. remarks: http://www.afrinic.net/ whois.afrinic.net
  44. remarks:
  45. remarks: APNIC (Asia Pacific)
  46. remarks: http://www.apnic.net/ whois.apnic.net
  47. remarks:
  48. remarks: ARIN (Northern America)
  49. remarks: http://www.arin.net/ whois.arin.net
  50. remarks:
  51. remarks: LACNIC (Latin America and the Carribean)
  52. remarks: http://www.lacnic.net/ whois.lacnic.net
  53. remarks:
  54. remarks: ------------------------------------------------------
  55. country: EU # Country is really world wide
  56. admin-c: IANA1-RIPE
  57. tech-c: IANA1-RIPE
  58. status: ALLOCATED UNSPECIFIED
  59. mnt-by: RIPE-NCC-HM-MNT
  60. created: 2019-01-07T10:46:54Z
  61. last-modified: 2019-01-07T10:46:54Z
  62. source: RIPE
  63.  
  64. role: Internet Assigned Numbers Authority
  65. address: see http://www.iana.org.
  66. admin-c: IANA1-RIPE
  67. tech-c: IANA1-RIPE
  68. nic-hdl: IANA1-RIPE
  69. remarks: For more information on IANA services
  70. remarks: go to IANA web site at http://www.iana.org.
  71. mnt-by: RIPE-NCC-MNT
  72. created: 1970-01-01T00:00:00Z
  73. last-modified: 2001-09-22T09:31:27Z
  74. source: RIPE # Filtered
  75.  
  76. % This query was served by the RIPE Database Query Service version 1.93.2 (BLAARKOP)
  77.  
  78.  
  79.  
  80. Gathered Inic-whois information for rivernilestate.gov.sd
  81. ---------------------------------------------------------------------------------------------------------------------------------------
  82. Error: Unable to connect - Invalid Host
  83. ERROR: Connection to InicWhois Server sd.whois-servers.net failed
  84. close error
  85.  
  86. Gathered Netcraft information for www.rivernilestate.gov.sd
  87. ---------------------------------------------------------------------------------------------------------------------------------------
  88.  
  89. Retrieving Netcraft.com information for www.rivernilestate.gov.sd
  90. Netcraft.com Information gathered
  91.  
  92. Gathered Subdomain information for rivernilestate.gov.sd
  93. ---------------------------------------------------------------------------------------------------------------------------------------
  94. Searching Google.com:80...
  95. Searching Altavista.com:80...
  96. Found 0 possible subdomain(s) for host rivernilestate.gov.sd, Searched 0 pages containing 0 results
  97.  
  98. Gathered E-Mail information for rivernilestate.gov.sd
  99. ---------------------------------------------------------------------------------------------------------------------------------------
  100. Searching Google.com:80...
  101. Searching Altavista.com:80...
  102. Found 0 E-Mail(s) for host rivernilestate.gov.sd, Searched 0 pages containing 0 results
  103.  
  104. Gathered TCP Port information for 62.12.105.2
  105. ---------------------------------------------------------------------------------------------------------------------------------------
  106.  
  107. Port State
  108.  
  109. 21/tcp open
  110. 80/tcp open
  111. 110/tcp open
  112. 143/tcp open
  113.  
  114. Portscan Finished: Scanned 150 ports, 4 ports were in state closed
  115. #######################################################################################################################################
  116. [i] Scanning Site: http://www.rivernilestate.gov.sd
  117.  
  118.  
  119.  
  120. B A S I C I N F O
  121. =======================================================================================================================================
  122.  
  123.  
  124. [+] Site Title: الموقع الرسمي لحكومة ولاية نهر النيل – الموقع الرسمي لحكومة ولاية نهر النيل
  125. [+] IP address: 62.12.105.2
  126. [+] Web Server: Could Not Detect
  127. [+] CMS: WordPress
  128. [+] Cloudflare: Not Detected
  129. [+] Robots File: Could NOT Find robots.txt!
  130.  
  131.  
  132.  
  133.  
  134.  
  135. G E O I P L O O K U P
  136. =======================================================================================================================================
  137.  
  138. [i] IP Address: 62.12.105.2
  139. [i] Country: Sudan
  140. [i] State:
  141. [i] City:
  142. [i] Latitude: 15.0
  143. [i] Longitude: 30.0
  144.  
  145.  
  146.  
  147.  
  148. H T T P H E A D E R S
  149. =======================================================================================================================================
  150.  
  151.  
  152. [i] HTTP/1.1 200 OK
  153. [i] Date: Thu, 21 Mar 2019 15:06:01 GMT
  154. [i] Content-Type: text/html; charset=UTF-8
  155. [i] X-Powered-By: PHP/5.4.16
  156. [i] Set-Cookie: PHPSESSID=skdob9s9is32h5ca4e4ad8rik1; path=/
  157. [i] Expires: Thu, 19 Nov 1981 08:52:00 GMT
  158. [i] Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
  159. [i] Pragma: no-cache
  160. [i] X-UA-Compatible: IE=edge
  161. [i] Link: <http://www.rivernilestate.gov.sd/index.php?rest_route=/>; rel="https://api.w.org/"
  162. [i] Link: <http://www.rivernilestate.gov.sd/>; rel=shortlink
  163. [i] X-Powered-By: PleskLin
  164. [i] Connection: close
  165.  
  166.  
  167.  
  168.  
  169. D N S L O O K U P
  170. =======================================================================================================================================
  171.  
  172. rivernilestate.gov.sd. 21599 IN SOA ns0.ndc.gov.sd. root.ndc.gov.sd. 2016011408 10800 900 604800 86400
  173. rivernilestate.gov.sd. 21599 IN NS ns1.ndc.gov.sd.
  174. rivernilestate.gov.sd. 21599 IN NS ns0.ndc.gov.sd.
  175. rivernilestate.gov.sd. 21599 IN A 62.12.105.2
  176. rivernilestate.gov.sd. 21599 IN MX 10 mail.rivernilestate.gov.sd.
  177. rivernilestate.gov.sd. 21599 IN TXT "v=spf1 mx -all"
  178.  
  179.  
  180.  
  181.  
  182. S U B N E T C A L C U L A T I O N
  183. =======================================================================================================================================
  184.  
  185. Address = 62.12.105.2
  186. Network = 62.12.105.2 / 32
  187. Netmask = 255.255.255.255
  188. Broadcast = not needed on Point-to-Point links
  189. Wildcard Mask = 0.0.0.0
  190. Hosts Bits = 0
  191. Max. Hosts = 1 (2^0 - 0)
  192. Host Range = { 62.12.105.2 - 62.12.105.2 }
  193.  
  194.  
  195.  
  196. N M A P P O R T S C A N
  197. =======================================================================================================================================
  198.  
  199. Starting Nmap 7.70 ( https://nmap.org ) at 2019-03-21 16:03 UTC
  200. Nmap scan report for rivernilestate.gov.sd (62.12.105.2)
  201. Host is up (0.20s latency).
  202. rDNS record for 62.12.105.2: f03-web02.nic.gov.sd
  203.  
  204. PORT STATE SERVICE
  205. 21/tcp open ftp
  206. 22/tcp filtered ssh
  207. 23/tcp filtered telnet
  208. 80/tcp open http
  209. 110/tcp open pop3
  210. 143/tcp open imap
  211. 443/tcp open https
  212. 3389/tcp filtered ms-wbt-server
  213.  
  214. Nmap done: 1 IP address (1 host up) scanned in 2.94 seconds
  215. #######################################################################################################################################
  216. [?] Enter the target: example( http://domain.com )
  217. http://www.rivernilestate.gov.sd/
  218. [!] IP Address : 62.12.105.2
  219. [!] www.rivernilestate.gov.sd doesn't seem to use a CMS
  220. [+] Honeypot Probabilty: 30%
  221. ---------------------------------------------------------------------------------------------------------------------------------------
  222. [~] Trying to gather whois information for www.rivernilestate.gov.sd
  223. [+] Whois information found
  224. [-] Unable to build response, visit https://who.is/whois/www.rivernilestate.gov.sd
  225. ---------------------------------------------------------------------------------------------------------------------------------------
  226. PORT STATE SERVICE
  227. 21/tcp open ftp
  228. 22/tcp filtered ssh
  229. 23/tcp filtered telnet
  230. 80/tcp open http
  231. 110/tcp open pop3
  232. 143/tcp open imap
  233. 443/tcp open https
  234. 3389/tcp filtered ms-wbt-server
  235. Nmap done: 1 IP address (1 host up) scanned in 2.32 seconds
  236. ---------------------------------------------------------------------------------------------------------------------------------------
  237. There was an error getting results
  238.  
  239. [-] DNS Records
  240. [>] Initiating 3 intel modules
  241. [>] Loading Alpha module (1/3)
  242. [>] Beta module deployed (2/3)
  243. [>] Gamma module initiated (3/3)
  244.  
  245.  
  246. [+] Emails found:
  247. ---------------------------------------------------------------------------------------------------------------------------------------
  248. [email protected]
  249. [email protected]
  250. No hosts found
  251. [+] Virtual hosts:
  252. ---------------------------------------------------------------------------------------------------------------------------------------
  253. #######################################################################################################################################
  254. Enter Address Website = rivernilestate.gov.sd
  255.  
  256. Reverse IP With YouGetSignal 'rivernilestate.gov.sd'
  257. ---------------------------------------------------------------------------------------------------------------------------------------
  258.  
  259. [*] IP: 62.12.105.2
  260. [*] Domain: rivernilestate.gov.sd
  261. [*] Total Domains: 11
  262.  
  263. [+] agricmi.gov.sd
  264. [+] eastgezira.gov.sd
  265. [+] health.gov.sd
  266. [+] kassalamoe.gov.sd
  267. [+] mocit.gov.sd
  268. [+] rivernilestate.gov.sd
  269. [+] rnspolice.gov.sd
  270. [+] sudan.gov.sd
  271. [+] unionkhr.sd
  272. [+] wgpolice.gov.sd
  273. [+] www.sudan.gov.sd
  274. #######################################################################################################################################
  275.  
  276. Geo IP Lookup 'rivernilestate.gov.sd'
  277. ---------------------------------------------------------------------------------------------------------------------------------------
  278.  
  279. [+] IP Address: 62.12.105.2
  280. [+] Country: Sudan
  281. [+] State:
  282. [+] City:
  283. [+] Latitude: 15.0
  284. [+] Longitude: 30.0
  285. #######################################################################################################################################
  286.  
  287. Bypass Cloudflare 'rivernilestate.gov.sd'
  288. ---------------------------------------------------------------------------------------------------------------------------------------
  289.  
  290. [!] CloudFlare Bypass 197.254.200.161 | webmail.rivernilestate.gov.sd
  291. [!] CloudFlare Bypass 197.254.200.161 | mail.rivernilestate.gov.sd
  292. [!] CloudFlare Bypass 62.12.105.2 | www.rivernilestate.gov.sd
  293. #######################################################################################################################################
  294.  
  295. DNS Lookup 'rivernilestate.gov.sd'
  296. ---------------------------------------------------------------------------------------------------------------------------------------
  297.  
  298. [+] rivernilestate.gov.sd. 21599 IN SOA ns0.ndc.gov.sd. root.ndc.gov.sd. 2016011408 10800 900 604800 86400
  299. [+] rivernilestate.gov.sd. 21599 IN NS ns0.ndc.gov.sd.
  300. [+] rivernilestate.gov.sd. 21599 IN NS ns1.ndc.gov.sd.
  301. [+] rivernilestate.gov.sd. 21599 IN A 62.12.105.2
  302. [+] rivernilestate.gov.sd. 21599 IN MX 10 mail.rivernilestate.gov.sd.
  303. [+] rivernilestate.gov.sd. 21599 IN TXT "v=spf1 mx -all"
  304. #######################################################################################################################################
  305.  
  306. Show HTTP Header 'rivernilestate.gov.sd'
  307. ---------------------------------------------------------------------------------------------------------------------------------------
  308.  
  309. [+] HTTP/1.1 301 Moved Permanently
  310. [+] Server: nginx
  311. [+] Date: Thu, 21 Mar 2019 15:06:04 GMT
  312. [+] Content-Type: text/html
  313. [+] Content-Length: 178
  314. [+] Connection: keep-alive
  315. [+] Location: http://www.rivernilestate.gov.sd/
  316. [+] X-Powered-By: PleskLin
  317. #######################################################################################################################################
  318.  
  319. Port Scan 'rivernilestate.gov.sd'
  320. ---------------------------------------------------------------------------------------------------------------------------------------
  321.  
  322. Starting Nmap 7.70 ( https://nmap.org ) at 2019-03-21 16:03 UTC
  323. Nmap scan report for rivernilestate.gov.sd (62.12.105.2)
  324. Host is up (0.20s latency).
  325. rDNS record for 62.12.105.2: f03-web02.nic.gov.sd
  326.  
  327. PORT STATE SERVICE
  328. 21/tcp open ftp
  329. 22/tcp filtered ssh
  330. 23/tcp filtered telnet
  331. 80/tcp open http
  332. 110/tcp open pop3
  333. 143/tcp open imap
  334. 443/tcp open https
  335. 3389/tcp filtered ms-wbt-server
  336.  
  337. Nmap done: 1 IP address (1 host up) scanned in 2.33 seconds
  338. #######################################################################################################################################
  339.  
  340. Traceroute 'rivernilestate.gov.sd'
  341. ---------------------------------------------------------------------------------------------------------------------------------------
  342.  
  343. Start: 2019-03-21T16:04:13+0000
  344. HOST: web01 Loss% Snt Last Avg Best Wrst StDev
  345. 1.|-- 45.79.12.201 0.0% 3 0.7 0.8 0.7 0.9 0.2
  346. 2.|-- 45.79.12.0 0.0% 3 1.7 4.9 1.4 11.6 5.8
  347. 3.|-- hu0-7-0-7.ccr41.dfw03.atlas.cogentco.com 0.0% 3 1.8 1.7 1.3 2.2 0.4
  348. 4.|-- be2764.ccr32.dfw01.atlas.cogentco.com 0.0% 3 1.7 1.6 1.3 1.7 0.2
  349. 5.|-- be2443.ccr42.iah01.atlas.cogentco.com 0.0% 3 7.0 7.0 6.7 7.2 0.3
  350. 6.|-- be2690.ccr42.atl01.atlas.cogentco.com 0.0% 3 21.3 21.1 20.9 21.3 0.2
  351. 7.|-- be2113.ccr42.dca01.atlas.cogentco.com 0.0% 3 32.2 32.2 32.2 32.3 0.1
  352. 8.|-- be2807.ccr42.jfk02.atlas.cogentco.com 0.0% 3 38.3 38.2 38.1 38.3 0.1
  353. 9.|-- be2490.ccr42.lon13.atlas.cogentco.com 0.0% 3 110.4 110.2 109.9 110.4 0.3
  354. 10.|-- be2871.ccr21.lon01.atlas.cogentco.com 0.0% 3 108.8 108.4 107.9 108.8 0.5
  355. 11.|-- expressotelecom.demarc.cogentco.com 0.0% 3 107.3 107.5 107.3 107.9 0.3
  356. 12.|-- 185.153.20.70 0.0% 3 186.4 186.5 186.4 186.9 0.3
  357. 13.|-- 185.153.20.82 0.0% 3 190.0 189.2 188.7 190.0 0.7
  358. 14.|-- 185.153.20.94 0.0% 3 186.5 186.6 186.4 186.9 0.2
  359. 15.|-- 185.153.20.153 0.0% 3 193.2 190.4 187.5 193.2 2.9
  360. 16.|-- 212.0.131.109 0.0% 3 201.5 202.0 201.5 202.8 0.7
  361. 17.|-- 196.202.137.249 0.0% 3 199.1 199.4 199.1 199.8 0.4
  362. 18.|-- 196.202.145.94 0.0% 3 202.2 202.0 201.9 202.2 0.2
  363. 19.|-- ??? 100.0 3 0.0 0.0 0.0 0.0 0.0
  364. #######################################################################################################################################
  365.  
  366. Ping 'rivernilestate.gov.sd'
  367. ---------------------------------------------------------------------------------------------------------------------------------------
  368.  
  369.  
  370. Starting Nping 0.7.70 ( https://nmap.org/nping ) at 2019-03-21 16:04 UTC
  371. SENT (0.7660s) ICMP [104.237.144.6 > 62.12.105.2 Echo request (type=8/code=0) id=47665 seq=1] IP [ttl=64 id=16174 iplen=28 ]
  372. SENT (1.7663s) ICMP [104.237.144.6 > 62.12.105.2 Echo request (type=8/code=0) id=47665 seq=2] IP [ttl=64 id=16174 iplen=28 ]
  373. SENT (2.7676s) ICMP [104.237.144.6 > 62.12.105.2 Echo request (type=8/code=0) id=47665 seq=3] IP [ttl=64 id=16174 iplen=28 ]
  374. SENT (3.7694s) ICMP [104.237.144.6 > 62.12.105.2 Echo request (type=8/code=0) id=47665 seq=4] IP [ttl=64 id=16174 iplen=28 ]
  375.  
  376. Max rtt: N/A | Min rtt: N/A | Avg rtt: N/A
  377. Raw packets sent: 4 (112B) | Rcvd: 0 (0B) | Lost: 4 (100.00%)
  378. Nping done: 1 IP address pinged in 4.77 seconds
  379. #######################################################################################################################################
  380.  
  381. Page Admin Finder 'rivernilestate.gov.sd'
  382. ---------------------------------------------------------------------------------------------------------------------------------------
  383.  
  384.  
  385.  
  386. Avilable Links :
  387.  
  388. Find Page >> http://rivernilestate.gov.sd/wp-login.php
  389. #######################################################################################################################################
  390. <<>> DiG 9.11.5-P4-1-Debian <<>> rivernilestate.gov.sd
  391. ;; global options: +cmd
  392. ;; Got answer:
  393. ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 6065
  394. ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
  395.  
  396. ;; OPT PSEUDOSECTION:
  397. ; EDNS: version: 0, flags:; udp: 4096
  398. ;; QUESTION SECTION:
  399. ;rivernilestate.gov.sd. IN A
  400.  
  401. ;; ANSWER SECTION:
  402. rivernilestate.gov.sd. 86397 IN A 62.12.105.2
  403.  
  404. ;; Query time: 32 msec
  405. ;; SERVER: 38.132.106.139#53(38.132.106.139)
  406. ;; WHEN: jeu mar 21 13:12:36 EDT 2019
  407. ;; MSG SIZE rcvd: 66
  408. #######################################################################################################################################
  409. ; <<>> DiG 9.11.5-P4-1-Debian <<>> +trace rivernilestate.gov.sd
  410. ;; global options: +cmd
  411. . 80226 IN NS h.root-servers.net.
  412. . 80226 IN NS i.root-servers.net.
  413. . 80226 IN NS j.root-servers.net.
  414. . 80226 IN NS m.root-servers.net.
  415. . 80226 IN NS c.root-servers.net.
  416. . 80226 IN NS k.root-servers.net.
  417. . 80226 IN NS g.root-servers.net.
  418. . 80226 IN NS l.root-servers.net.
  419. . 80226 IN NS d.root-servers.net.
  420. . 80226 IN NS b.root-servers.net.
  421. . 80226 IN NS a.root-servers.net.
  422. . 80226 IN NS f.root-servers.net.
  423. . 80226 IN NS e.root-servers.net.
  424. . 80226 IN RRSIG NS 8 0 518400 20190403050000 20190321040000 16749 . tuS4xu8Ml9FLMdF1LrNv2ocijVITDu1w4a9VSh/Cok3ppyyopdj6ka1g q7uLKJSrdRU1pb7k752L+WaaHuG4RFXxKGD2APMxZU5pgzkBew+l6R1v PxZkOf0W3dbYEOd7W89WlVomiCyEga+FfkEl5MkocpuFFMMWaYUzPmU6 syCwDRRYfj6OEHi1C9oYF3Q4yFzQ2cun3kMgkRmIeMlBqOOdenVtYlby QlwMHMQ5iLE/RNE73XwJZvqcToVIWRx6nCtjKsahRhyajJgDfy4KSMdz eWaSFmyd0fFYxOujmKyFwsYmwilWrQ5PI2iQMevPA8eXCumfWR1osXtv 04RVZg==
  425. ;; Received 525 bytes from 38.132.106.139#53(38.132.106.139) in 35 ms
  426.  
  427. sd. 172800 IN NS sd.cctld.authdns.ripe.net.
  428. sd. 172800 IN NS ns1.uaenic.ae.
  429. sd. 172800 IN NS ns2.uaenic.ae.
  430. sd. 172800 IN NS ans1.sis.sd.
  431. sd. 172800 IN NS ans1.canar.sd.
  432. sd. 172800 IN NS ans2.canar.sd.
  433. sd. 172800 IN NS ns-sd.afrinic.net.
  434. sd. 86400 IN NSEC se. NS RRSIG NSEC
  435. sd. 86400 IN RRSIG NSEC 8 1 86400 20190403050000 20190321040000 16749 . cntDUJ26GpKEwsIPTrfvlMAR3To24WVW1xu3RWAgRz/hnIeffuGc9S+9 SfNIaGu5odXTmaABfWH6uVcDcgiPHVAk1c84m+I5v3Kc6rqSnrh54YPq leUkf3kzdPfwYWCSrmfXjpt5ksvtqUtwvo+pSVf4tMvmQCwHl4OR4Fq1 h675eYnrDS2c5yo9qEPwjRe/URFxHkabQOTm934JO8g0vazx8lCxxC8k YzVrAIQC9RM/TEVAcdohbdUkG/PnARIq62i7lKuI5FuLQR4tb2gABP9A U7ZV2rO3oxN4NmZ4hKOWUZxN3Kti0NMNBNjH4wcO4PqbKMuEKPezvzXW wTBNeQ==
  436. ;; Received 708 bytes from 2001:500:2f::f#53(f.root-servers.net) in 25 ms
  437.  
  438. rivernilestate.gov.sd. 14400 IN NS ns1.ndc.gov.sd.
  439. rivernilestate.gov.sd. 14400 IN NS ns0.ndc.gov.sd.
  440. ;; Received 122 bytes from 196.29.166.134#53(ans1.sis.sd) in 186 ms
  441.  
  442. rivernilestate.gov.sd. 86400 IN A 62.12.105.2
  443. rivernilestate.gov.sd. 86400 IN NS ns1.ndc.gov.sd.
  444. rivernilestate.gov.sd. 86400 IN NS ns0.ndc.gov.sd.
  445. ;; Received 138 bytes from 62.12.109.3#53(ns1.ndc.gov.sd) in 193 ms
  446. #######################################################################################################################################
  447. [*] Processing domain rivernilestate.gov.sd
  448. [*] Using system resolvers ['38.132.106.139', '194.187.251.67', '185.93.180.131', '192.168.0.1', '2001:18c0:121:6900:724f:b8ff:fefd:5b6a']
  449. [+] Getting nameservers
  450. 62.12.109.2 - ns0.ndc.gov.sd
  451. [+] Zone transfer sucessful using nameserver ns0.ndc.gov.sd
  452. rivernilestate.gov.sd. 86400 IN SOA ns0.ndc.gov.sd. root.ndc.gov.sd. 2016011408 10800 900 604800 86400
  453. rivernilestate.gov.sd. 86400 IN NS ns0.ndc.gov.sd.
  454. rivernilestate.gov.sd. 86400 IN NS ns1.ndc.gov.sd.
  455. rivernilestate.gov.sd. 86400 IN A 62.12.105.2
  456. rivernilestate.gov.sd. 86400 IN MX 10 mail.rivernilestate.gov.sd.
  457. rivernilestate.gov.sd. 86400 IN TXT "v=spf1 mx -all"
  458. mail.rivernilestate.gov.sd. 86400 IN A 197.254.200.161
  459. mail.rivernilestate.gov.sd. 86400 IN MX 10 mail.rivernilestate.gov.sd.
  460. webmail.rivernilestate.gov.sd. 86400 IN CNAME mail.rivernilestate.gov.sd.
  461. www.rivernilestate.gov.sd. 86400 IN A 62.12.105.2
  462. #######################################################################################################################################
  463. [*] Performing General Enumeration of Domain: rivernilestate.gov.sd
  464. [-] DNSSEC is not configured for rivernilestate.gov.sd
  465. [*] SOA ns0.ndc.gov.sd 62.12.109.2
  466. [*] NS ns0.ndc.gov.sd 62.12.109.2
  467. [*] Bind Version for 62.12.109.2 you guess!
  468. [*] NS ns1.ndc.gov.sd 62.12.109.3
  469. [*] Bind Version for 62.12.109.3 you guess!
  470. [*] MX mail.rivernilestate.gov.sd 197.254.200.161
  471. [*] A rivernilestate.gov.sd 62.12.105.2
  472. [*] TXT rivernilestate.gov.sd v=spf1 mx -all
  473. [*] Enumerating SRV Records
  474. [-] No SRV Records Found for rivernilestate.gov.sd
  475. [+] 0 Records Found
  476. #######################################################################################################################################
  477. dnsenum VERSION:1.2.4
  478.  
  479. ----- www.rivernilestate.gov.sd -----
  480.  
  481.  
  482. Host's addresses:
  483. __________________
  484.  
  485. www.rivernilestate.gov.sd. 81728 IN A 62.12.105.2
  486.  
  487.  
  488. Name Servers:
  489. ______________
  490. #######################################################################################################################################
  491. ===============================================
  492. -=Subfinder v1.1.3 github.com/subfinder/subfinder
  493. ===============================================
  494.  
  495.  
  496. Running Source: Ask
  497. Running Source: Archive.is
  498. Running Source: Baidu
  499. Running Source: Bing
  500. Running Source: CertDB
  501. Running Source: CertificateTransparency
  502. Running Source: Certspotter
  503. Running Source: Commoncrawl
  504. Running Source: Crt.sh
  505. Running Source: Dnsdb
  506. Running Source: DNSDumpster
  507. Running Source: DNSTable
  508. Running Source: Dogpile
  509. Running Source: Exalead
  510. Running Source: Findsubdomains
  511. Running Source: Googleter
  512. Running Source: Hackertarget
  513. Running Source: Ipv4Info
  514. Running Source: PTRArchive
  515. Running Source: Sitedossier
  516. Running Source: Threatcrowd
  517. Running Source: ThreatMiner
  518. Running Source: WaybackArchive
  519. Running Source: Yahoo
  520.  
  521. Running enumeration on www.rivernilestate.gov.sd
  522.  
  523. dnsdb: Unexpected return status 503
  524.  
  525.  
  526. Starting Bruteforcing of www.rivernilestate.gov.sd with 9985 words
  527.  
  528. Total 1 Unique subdomains found for www.rivernilestate.gov.sd
  529.  
  530. .www.rivernilestate.gov.sd
  531. #######################################################################################################################################
  532. [*] Processing domain www.rivernilestate.gov.sd
  533. [*] Using system resolvers ['38.132.106.139', '194.187.251.67', '185.93.180.131', '192.168.0.1', '2001:18c0:121:6900:724f:b8ff:fefd:5b6a']
  534. [+] Getting nameservers
  535. [-] Getting nameservers failed
  536. [-] Zone transfer failed
  537.  
  538. [*] Scanning www.rivernilestate.gov.sd for A records
  539. 62.12.105.2 - www.rivernilestate.gov.sd
  540. #######################################################################################################################################
  541. [+] www.rivernilestate.gov.sd has no SPF record!
  542. [*] No DMARC record found. Looking for organizational record
  543. [+] No organizational DMARC record
  544. [+] Spoofing possible for www.rivernilestate.gov.sd!
  545. #######################################################################################################################################
  546. Starting Nmap 7.70 ( https://nmap.org ) at 2019-03-21 12:31 EDT
  547. Nmap scan report for www.rivernilestate.gov.sd (62.12.105.2)
  548. Host is up (0.18s latency).
  549. rDNS record for 62.12.105.2: f03-web02.nic.gov.sd
  550. Not shown: 464 filtered ports, 4 closed ports
  551. Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
  552. PORT STATE SERVICE
  553. 21/tcp open ftp
  554. 80/tcp open http
  555. 110/tcp open pop3
  556. 143/tcp open imap
  557. 443/tcp open https
  558. 993/tcp open imaps
  559. 995/tcp open pop3s
  560. 8443/tcp open https-alt
  561. #######################################################################################################################################
  562. Starting Nmap 7.70 ( https://nmap.org ) at 2019-03-21 12:31 EDT
  563. Nmap scan report for www.rivernilestate.gov.sd (62.12.105.2)
  564. Host is up (0.020s latency).
  565. rDNS record for 62.12.105.2: f03-web02.nic.gov.sd
  566. Not shown: 2 filtered ports
  567. PORT STATE SERVICE
  568. 53/udp open|filtered domain
  569. 67/udp open|filtered dhcps
  570. 68/udp open|filtered dhcpc
  571. 69/udp open|filtered tftp
  572. 88/udp open|filtered kerberos-sec
  573. 123/udp open|filtered ntp
  574. 139/udp open|filtered netbios-ssn
  575. 161/udp open|filtered snmp
  576. 162/udp open|filtered snmptrap
  577. 389/udp open|filtered ldap
  578. 520/udp open|filtered route
  579. 2049/udp open|filtered nfs
  580. #######################################################################################################################################
  581. Starting Nmap 7.70 ( https://nmap.org ) at 2019-03-21 12:31 EDT
  582. Nmap scan report for www.rivernilestate.gov.sd (62.12.105.2)
  583. Host is up (0.20s latency).
  584. rDNS record for 62.12.105.2: f03-web02.nic.gov.sd
  585.  
  586. PORT STATE SERVICE VERSION
  587. 21/tcp open tcpwrapped
  588. Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
  589. Device type: specialized|WAP|general purpose|router
  590. Running: AVtech embedded, Linux 2.4.X|2.6.X|3.X, MikroTik RouterOS 6.X
  591. OS CPE: cpe:/o:linux:linux_kernel:2.4.20 cpe:/o:linux:linux_kernel:2.6 cpe:/o:linux:linux_kernel:3.2.0 cpe:/o:mikrotik:routeros:6.15
  592. OS details: AVtech Room Alert 26W environmental monitor, Tomato 1.27 - 1.28 (Linux 2.4.20), Linux 2.6.18 - 2.6.22, Linux 3.2.0, MikroTik RouterOS 6.15 (Linux 3.3.5)
  593. Network Distance: 20 hops
  594.  
  595. TRACEROUTE (using port 21/tcp)
  596. HOP RTT ADDRESS
  597. 1 21.17 ms 10.249.200.1
  598. 2 21.64 ms vlan102.as02.qc1.ca.m247.com (176.113.74.17)
  599. 3 26.00 ms xe-0-0-1-0.agg2.qc1.ca.m247.com (37.120.128.166)
  600. 4 21.63 ms vlan304.as032.buc.ro.m247.com (77.243.185.226)
  601. 5 22.02 ms te0-7-0-2.rcr21.ymq02.atlas.cogentco.com (38.122.42.161)
  602. 6 21.68 ms hu0-4-0-1.ccr21.ymq01.atlas.cogentco.com (154.54.25.126)
  603. 7 91.50 ms be3042.ccr21.lpl01.atlas.cogentco.com (154.54.44.161)
  604. 8 98.08 ms be2391.ccr51.lhr01.atlas.cogentco.com (154.54.39.149)
  605. 9 98.52 ms be3488.ccr42.lon13.atlas.cogentco.com (154.54.60.13)
  606. 10 98.59 ms be2871.ccr21.lon01.atlas.cogentco.com (154.54.58.186)
  607. 11 102.26 ms expressotelecom.demarc.cogentco.com (149.14.248.202)
  608. 12 181.31 ms 185.153.20.70
  609. 13 181.31 ms 185.153.20.82
  610. 14 181.25 ms 185.153.20.94
  611. 15 184.46 ms 185.153.20.153
  612. 16 ... 17
  613. 18 200.76 ms 196.202.145.94
  614. 19 ...
  615. 20 207.85 ms f03-web02.nic.gov.sd (62.12.105.2)
  616. #######################################################################################################################################
  617. HTTP/1.1 302 Moved Temporarily
  618. Server: nginx
  619. Date: Thu, 21 Mar 2019 15:44:02 GMT
  620. Content-Type: text/html
  621. Connection: keep-alive
  622. X-Powered-By: PHP/5.4.16
  623. Set-Cookie: PHPSESSID=v5ebfiiakv3fbomrkb64ak0th2; path=/
  624. Expires: Thu, 19 Nov 1981 08:52:00 GMT
  625. Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
  626. Pragma: no-cache
  627. Location: http://127.0.0.1
  628. X-Powered-By: PleskLin
  629.  
  630. HTTP/1.1 302 Moved Temporarily
  631. Server: nginx
  632. Date: Thu, 21 Mar 2019 15:44:03 GMT
  633. Content-Type: text/html
  634. Connection: keep-alive
  635. X-Powered-By: PHP/5.4.16
  636. Set-Cookie: PHPSESSID=6gipb8j4p1u0l8kivh76trkit2; path=/
  637. Expires: Thu, 19 Nov 1981 08:52:00 GMT
  638. Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
  639. Pragma: no-cache
  640. Location: http://127.0.0.1
  641. X-Powered-By: PleskLin
  642. #######################################################################################################################################
  643. Starting Nmap 7.70 ( https://nmap.org ) at 2019-03-21 12:42 EDT
  644. Nmap scan report for www.rivernilestate.gov.sd (62.12.105.2)
  645. Host is up (0.20s latency).
  646. rDNS record for 62.12.105.2: f03-web02.nic.gov.sd
  647.  
  648. PORT STATE SERVICE VERSION
  649. 110/tcp open pop3 Dovecot pop3d
  650. | pop3-brute:
  651. | Accounts: No valid accounts found
  652. |_ Statistics: Performed 221 guesses in 197 seconds, average tps: 1.1
  653. |_pop3-capabilities: TOP PIPELINING USER CAPA UIDL AUTH-RESP-CODE RESP-CODES APOP SASL(PLAIN LOGIN DIGEST-MD5 CRAM-MD5) STLS
  654. Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
  655. Device type: specialized|WAP|general purpose|router
  656. Running: AVtech embedded, Linux 2.4.X|2.6.X|3.X, MikroTik RouterOS 6.X
  657. OS CPE: cpe:/o:linux:linux_kernel:2.4.20 cpe:/o:linux:linux_kernel:2.6 cpe:/o:linux:linux_kernel:3.2.0 cpe:/o:mikrotik:routeros:6.15
  658. OS details: AVtech Room Alert 26W environmental monitor, Tomato 1.27 - 1.28 (Linux 2.4.20), Linux 2.6.18 - 2.6.22, Linux 3.2.0, MikroTik RouterOS 6.15 (Linux 3.3.5)
  659. Network Distance: 20 hops
  660. Service Info: Host: fo3-web02.nic.gov.sd
  661.  
  662. TRACEROUTE (using port 443/tcp)
  663. HOP RTT ADDRESS
  664. 1 20.94 ms 10.249.200.1
  665. 2 21.37 ms vlan102.as02.qc1.ca.m247.com (176.113.74.17)
  666. 3 25.94 ms xe-0-0-1-0.agg2.qc1.ca.m247.com (37.120.128.166)
  667. 4 20.99 ms vlan304.as032.buc.ro.m247.com (77.243.185.226)
  668. 5 21.80 ms te0-7-0-2.rcr21.ymq02.atlas.cogentco.com (38.122.42.161)
  669. 6 21.44 ms hu0-4-0-1.ccr22.ymq01.atlas.cogentco.com (154.54.31.222)
  670. 7 91.12 ms be3043.ccr22.lpl01.atlas.cogentco.com (154.54.44.165)
  671. 8 96.96 ms be2491.ccr52.lhr01.atlas.cogentco.com (154.54.39.118)
  672. 9 98.18 ms be3487.ccr41.lon13.atlas.cogentco.com (154.54.60.5)
  673. 10 97.99 ms be2868.ccr21.lon01.atlas.cogentco.com (154.54.57.154)
  674. 11 100.63 ms expressotelecom.demarc.cogentco.com (149.14.248.202)
  675. 12 180.00 ms 185.153.20.70
  676. 13 179.96 ms 185.153.20.82
  677. 14 179.75 ms 185.153.20.94
  678. 15 183.51 ms 185.153.20.153
  679. 16 ... 17
  680. 18 202.64 ms 196.202.145.94
  681. 19 ...
  682. 20 209.12 ms f03-web02.nic.gov.sd (62.12.105.2)
  683. #######################################################################################################################################
  684. http://127.0.0.1 ERROR: Connection refused - connect(2) for "127.0.0.1" port 80
  685. https://www.rivernilestate.gov.sd [302 Found] Cookies[PHPSESSID], HTTPServer[nginx], IP[62.12.105.2], PHP[5.4.16,], Plesk[Lin], RedirectLocation[http://127.0.0.1], X-Powered-By[PHP/5.4.16, PleskLin], nginx
  686. http://127.0.0.1 [ Unassigned]
  687. #######################################################################################################################################
  688. Version: 1.11.12-static
  689. OpenSSL 1.0.2-chacha (1.0.2g-dev)
  690.  
  691. Connected to 62.12.105.2
  692.  
  693. Testing SSL server www.rivernilestate.gov.sd on port 443 using SNI name www.rivernilestate.gov.sd
  694.  
  695. TLS Fallback SCSV:
  696. Server supports TLS Fallback SCSV
  697.  
  698. TLS renegotiation:
  699. Secure session renegotiation supported
  700.  
  701. TLS Compression:
  702. Compression disabled
  703.  
  704. Heartbleed:
  705. TLS 1.2 not vulnerable to heartbleed
  706. TLS 1.1 not vulnerable to heartbleed
  707. TLS 1.0 not vulnerable to heartbleed
  708.  
  709. Supported Server Cipher(s):
  710. Preferred TLSv1.2 256 bits ECDHE-RSA-AES256-GCM-SHA384 Curve P-256 DHE 256
  711. Accepted TLSv1.2 256 bits ECDHE-RSA-AES256-SHA384 Curve P-256 DHE 256
  712. Accepted TLSv1.2 256 bits ECDHE-RSA-AES256-SHA Curve P-256 DHE 256
  713. Accepted TLSv1.2 256 bits AES256-GCM-SHA384
  714. Accepted TLSv1.2 256 bits AES256-SHA256
  715. Accepted TLSv1.2 256 bits AES256-SHA
  716. Accepted TLSv1.2 256 bits CAMELLIA256-SHA
  717. Accepted TLSv1.2 128 bits ECDHE-RSA-AES128-GCM-SHA256 Curve P-256 DHE 256
  718. Accepted TLSv1.2 128 bits ECDHE-RSA-AES128-SHA256 Curve P-256 DHE 256
  719. Accepted TLSv1.2 128 bits ECDHE-RSA-AES128-SHA Curve P-256 DHE 256
  720. Accepted TLSv1.2 128 bits AES128-GCM-SHA256
  721. Accepted TLSv1.2 128 bits AES128-SHA256
  722. Accepted TLSv1.2 128 bits AES128-SHA
  723. Accepted TLSv1.2 128 bits CAMELLIA128-SHA
  724. Preferred TLSv1.1 256 bits ECDHE-RSA-AES256-SHA Curve P-256 DHE 256
  725. Accepted TLSv1.1 256 bits AES256-SHA
  726. Accepted TLSv1.1 256 bits CAMELLIA256-SHA
  727. Accepted TLSv1.1 128 bits ECDHE-RSA-AES128-SHA Curve P-256 DHE 256
  728. Accepted TLSv1.1 128 bits AES128-SHA
  729. Accepted TLSv1.1 128 bits CAMELLIA128-SHA
  730. Preferred TLSv1.0 256 bits ECDHE-RSA-AES256-SHA Curve P-256 DHE 256
  731. Accepted TLSv1.0 256 bits AES256-SHA
  732. Accepted TLSv1.0 256 bits CAMELLIA256-SHA
  733. Accepted TLSv1.0 128 bits ECDHE-RSA-AES128-SHA Curve P-256 DHE 256
  734. Accepted TLSv1.0 128 bits AES128-SHA
  735. Accepted TLSv1.0 128 bits CAMELLIA128-SHA
  736.  
  737. SSL Certificate:
  738. Signature Algorithm: sha256WithRSAEncryption
  739. RSA Key Strength: 2048
  740.  
  741. Subject: Plesk
  742. Issuer: Plesk
  743.  
  744. Not valid before: Apr 20 02:40:27 2016 GMT
  745. Not valid after: Apr 20 02:40:27 2017 GMT
  746. #######################################################################################################################################
  747. --------------------------------------------------------
  748. <<<Yasuo discovered following vulnerable applications>>>
  749. --------------------------------------------------------
  750. +------------+--------------------------------------+--------------------------------------------------+----------+----------+
  751. | App Name | URL to Application | Potential Exploit | Username | Password |
  752. +------------+--------------------------------------+--------------------------------------------------+----------+----------+
  753. | phpMyAdmin | https://62.12.105.2:8443/phpmyadmin/ | ./exploits/multi/http/phpmyadmin_preg_replace.rb | None | None |
  754. +------------+--------------------------------------+--------------------------------------------------+----------+----------+
  755. #######################################################################################################################################
  756. Starting Nmap 7.70 ( https://nmap.org ) at 2019-03-21 12:40 EDT
  757. Nmap scan report for f03-web02.nic.gov.sd (62.12.105.2)
  758. Host is up (0.17s latency).
  759. Not shown: 464 filtered ports, 4 closed ports
  760. Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
  761. PORT STATE SERVICE
  762. 21/tcp open ftp
  763. 80/tcp open http
  764. 110/tcp open pop3
  765. 143/tcp open imap
  766. 443/tcp open https
  767. 993/tcp open imaps
  768. 995/tcp open pop3s
  769. 8443/tcp open https-alt
  770. #######################################################################################################################################
  771. Starting Nmap 7.70 ( https://nmap.org ) at 2019-03-21 12:40 EDT
  772. Nmap scan report for f03-web02.nic.gov.sd (62.12.105.2)
  773. Host is up (0.020s latency).
  774. Not shown: 2 filtered ports
  775. PORT STATE SERVICE
  776. 53/udp open|filtered domain
  777. 67/udp open|filtered dhcps
  778. 68/udp open|filtered dhcpc
  779. 69/udp open|filtered tftp
  780. 88/udp open|filtered kerberos-sec
  781. 123/udp open|filtered ntp
  782. 139/udp open|filtered netbios-ssn
  783. 161/udp open|filtered snmp
  784. 162/udp open|filtered snmptrap
  785. 389/udp open|filtered ldap
  786. 520/udp open|filtered route
  787. 2049/udp open|filtered nfs
  788. #######################################################################################################################################
  789. Starting Nmap 7.70 ( https://nmap.org ) at 2019-03-21 12:41 EDT
  790. Nmap scan report for f03-web02.nic.gov.sd (62.12.105.2)
  791. Host is up (0.20s latency).
  792.  
  793. PORT STATE SERVICE VERSION
  794. 21/tcp open tcpwrapped
  795. |_ftp-libopie: ERROR: Script execution failed (use -d to debug)
  796. Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
  797. Device type: specialized|WAP|general purpose|router
  798. Running: AVtech embedded, Linux 2.4.X|2.6.X|3.X, MikroTik RouterOS 6.X
  799. OS CPE: cpe:/o:linux:linux_kernel:2.4.20 cpe:/o:linux:linux_kernel:2.6 cpe:/o:linux:linux_kernel:3.2.0 cpe:/o:mikrotik:routeros:6.15
  800. OS details: AVtech Room Alert 26W environmental monitor, Tomato 1.27 - 1.28 (Linux 2.4.20), Linux 2.6.18 - 2.6.22, Linux 3.2.0, MikroTik RouterOS 6.15 (Linux 3.3.5)
  801. Network Distance: 20 hops
  802.  
  803. TRACEROUTE (using port 21/tcp)
  804. HOP RTT ADDRESS
  805. 1 22.00 ms 10.249.200.1
  806. 2 22.34 ms vlan102.as02.qc1.ca.m247.com (176.113.74.17)
  807. 3 32.77 ms xe-0-0-1-0.agg2.qc1.ca.m247.com (37.120.128.166)
  808. 4 25.96 ms vlan304.as032.buc.ro.m247.com (77.243.185.226)
  809. 5 22.75 ms te0-7-0-2.rcr21.ymq02.atlas.cogentco.com (38.122.42.161)
  810. 6 22.43 ms hu0-4-0-1.ccr22.ymq01.atlas.cogentco.com (154.54.31.222)
  811. 7 91.99 ms be3043.ccr22.lpl01.atlas.cogentco.com (154.54.44.165)
  812. 8 97.80 ms be2491.ccr52.lhr01.atlas.cogentco.com (154.54.39.118)
  813. 9 99.03 ms be3487.ccr41.lon13.atlas.cogentco.com (154.54.60.5)
  814. 10 99.10 ms be2868.ccr21.lon01.atlas.cogentco.com (154.54.57.154)
  815. 11 97.73 ms expressotelecom.demarc.cogentco.com (149.14.248.202)
  816. 12 176.79 ms 185.153.20.70
  817. 13 176.76 ms 185.153.20.82
  818. 14 176.71 ms 185.153.20.94
  819. 15 180.26 ms 185.153.20.153
  820. 16 ... 17
  821. 18 202.69 ms 196.202.145.94
  822. 19 ...
  823. 20 210.39 ms f03-web02.nic.gov.sd (62.12.105.2)
  824. #######################################################################################################################################
  825. Starting Nmap 7.70 ( https://nmap.org ) at 2019-03-21 12:51 EDT
  826. Nmap scan report for f03-web02.nic.gov.sd (62.12.105.2)
  827. Host is up.
  828.  
  829. PORT STATE SERVICE VERSION
  830. 67/udp open|filtered dhcps
  831. |_dhcp-discover: ERROR: Script execution failed (use -d to debug)
  832. Too many fingerprints match this host to give specific OS details
  833.  
  834. TRACEROUTE (using proto 1/icmp)
  835. HOP RTT ADDRESS
  836. 1 20.72 ms 10.249.200.1
  837. 2 21.68 ms vlan102.as02.qc1.ca.m247.com (176.113.74.17)
  838. 3 37.35 ms xe-0-0-1-0.agg2.qc1.ca.m247.com (37.120.128.166)
  839. 4 20.77 ms vlan304.as032.buc.ro.m247.com (77.243.185.226)
  840. 5 21.18 ms te0-7-0-2.rcr21.ymq02.atlas.cogentco.com (38.122.42.161)
  841. 6 21.17 ms hu0-4-0-1.ccr22.ymq01.atlas.cogentco.com (154.54.31.222)
  842. 7 90.78 ms be3043.ccr22.lpl01.atlas.cogentco.com (154.54.44.165)
  843. 8 96.48 ms be2491.ccr52.lhr01.atlas.cogentco.com (154.54.39.118)
  844. 9 97.34 ms be3488.ccr42.lon13.atlas.cogentco.com (154.54.60.13)
  845. 10 97.39 ms be2871.ccr21.lon01.atlas.cogentco.com (154.54.58.186)
  846. 11 96.73 ms expressotelecom.demarc.cogentco.com (149.14.248.202)
  847. 12 175.79 ms 185.153.20.70
  848. 13 175.80 ms 185.153.20.82
  849. 14 175.75 ms 185.153.20.94
  850. 15 179.57 ms 185.153.20.153
  851. 16 201.62 ms 212.0.131.109
  852. 17 204.44 ms 196.202.137.249
  853. 18 199.86 ms 196.202.145.94
  854. 19 ... 30
  855. #######################################################################################################################################
  856. Starting Nmap 7.70 ( https://nmap.org ) at 2019-03-21 12:53 EDT
  857. Nmap scan report for f03-web02.nic.gov.sd (62.12.105.2)
  858. Host is up.
  859.  
  860. PORT STATE SERVICE VERSION
  861. 68/udp open|filtered dhcpc
  862. Too many fingerprints match this host to give specific OS details
  863.  
  864. TRACEROUTE (using proto 1/icmp)
  865. HOP RTT ADDRESS
  866. 1 26.33 ms 10.249.200.1
  867. 2 26.86 ms vlan102.as02.qc1.ca.m247.com (176.113.74.17)
  868. 3 33.10 ms xe-0-0-1-0.agg2.qc1.ca.m247.com (37.120.128.166)
  869. 4 21.51 ms vlan304.as032.buc.ro.m247.com (77.243.185.226)
  870. 5 21.99 ms te0-7-0-2.rcr21.ymq02.atlas.cogentco.com (38.122.42.161)
  871. 6 21.96 ms hu0-4-0-1.ccr22.ymq01.atlas.cogentco.com (154.54.31.222)
  872. 7 90.75 ms be3043.ccr22.lpl01.atlas.cogentco.com (154.54.44.165)
  873. 8 97.02 ms be2491.ccr52.lhr01.atlas.cogentco.com (154.54.39.118)
  874. 9 97.98 ms be3488.ccr42.lon13.atlas.cogentco.com (154.54.60.13)
  875. 10 98.25 ms be2871.ccr21.lon01.atlas.cogentco.com (154.54.58.186)
  876. 11 102.93 ms expressotelecom.demarc.cogentco.com (149.14.248.202)
  877. 12 181.95 ms 185.153.20.70
  878. 13 181.99 ms 185.153.20.82
  879. 14 181.96 ms 185.153.20.94
  880. 15 185.65 ms 185.153.20.153
  881. 16 201.95 ms 212.0.131.109
  882. 17 204.91 ms 196.202.137.249
  883. 18 199.94 ms 196.202.145.94
  884. 19 ... 30
  885. #######################################################################################################################################
  886. Starting Nmap 7.70 ( https://nmap.org ) at 2019-03-21 12:54 EDT
  887. Nmap scan report for f03-web02.nic.gov.sd (62.12.105.2)
  888. Host is up.
  889.  
  890. PORT STATE SERVICE VERSION
  891. 69/udp open|filtered tftp
  892. Too many fingerprints match this host to give specific OS details
  893.  
  894. TRACEROUTE (using proto 1/icmp)
  895. HOP RTT ADDRESS
  896. 1 20.91 ms 10.249.200.1
  897. 2 21.33 ms vlan102.as02.qc1.ca.m247.com (176.113.74.17)
  898. 3 40.13 ms xe-0-0-1-0.agg2.qc1.ca.m247.com (37.120.128.166)
  899. 4 20.99 ms vlan304.as032.buc.ro.m247.com (77.243.185.226)
  900. 5 21.78 ms te0-7-0-2.rcr21.ymq02.atlas.cogentco.com (38.122.42.161)
  901. 6 21.42 ms hu0-4-0-1.ccr22.ymq01.atlas.cogentco.com (154.54.31.222)
  902. 7 91.21 ms be3043.ccr22.lpl01.atlas.cogentco.com (154.54.44.165)
  903. 8 96.90 ms be2491.ccr52.lhr01.atlas.cogentco.com (154.54.39.118)
  904. 9 98.19 ms be3488.ccr42.lon13.atlas.cogentco.com (154.54.60.13)
  905. 10 97.89 ms be2871.ccr21.lon01.atlas.cogentco.com (154.54.58.186)
  906. 11 96.88 ms expressotelecom.demarc.cogentco.com (149.14.248.202)
  907. 12 175.74 ms 185.153.20.70
  908. 13 175.77 ms 185.153.20.82
  909. 14 175.78 ms 185.153.20.94
  910. 15 179.26 ms 185.153.20.153
  911. 16 199.81 ms 212.0.131.109
  912. 17 204.71 ms 196.202.137.249
  913. 18 199.53 ms 196.202.145.94
  914. 19 ... 30
  915. #######################################################################################################################################
  916. HTTP/1.1 200 OK
  917. Server: nginx
  918. Date: Thu, 21 Mar 2019 16:01:59 GMT
  919. Content-Type: text/html
  920. Content-Length: 3750
  921. Connection: keep-alive
  922. Last-Modified: Wed, 07 Feb 2018 11:25:44 GMT
  923. ETag: "ea6-5649d8e57844b"
  924. Accept-Ranges: bytes
  925.  
  926. HTTP/1.1 200 OK
  927. Server: nginx
  928. Date: Thu, 21 Mar 2019 16:02:00 GMT
  929. Content-Type: text/html
  930. Content-Length: 3750
  931. Connection: keep-alive
  932. Last-Modified: Wed, 07 Feb 2018 11:25:44 GMT
  933. ETag: "ea6-5649d8e57844b"
  934. Accept-Ranges: bytes
  935. #######################################################################################################################################
  936. Starting Nmap 7.70 ( https://nmap.org ) at 2019-03-21 12:59 EDT
  937. Nmap scan report for f03-web02.nic.gov.sd (62.12.105.2)
  938. Host is up (0.20s latency).
  939.  
  940. PORT STATE SERVICE VERSION
  941. 110/tcp open pop3 Dovecot pop3d
  942. | pop3-brute:
  943. | Accounts: No valid accounts found
  944. |_ Statistics: Performed 213 guesses in 196 seconds, average tps: 1.1
  945. |_pop3-capabilities: PIPELINING CAPA UIDL USER RESP-CODES SASL(PLAIN LOGIN DIGEST-MD5 CRAM-MD5) STLS TOP APOP AUTH-RESP-CODE
  946. Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
  947. Device type: specialized|WAP|general purpose|router
  948. Running: AVtech embedded, Linux 2.4.X|2.6.X|3.X, MikroTik RouterOS 6.X
  949. OS CPE: cpe:/o:linux:linux_kernel:2.4.20 cpe:/o:linux:linux_kernel:2.6 cpe:/o:linux:linux_kernel:3.2.0 cpe:/o:mikrotik:routeros:6.15
  950. OS details: AVtech Room Alert 26W environmental monitor, Tomato 1.27 - 1.28 (Linux 2.4.20), Linux 2.6.18 - 2.6.22, Linux 3.2.0, MikroTik RouterOS 6.15 (Linux 3.3.5)
  951. Network Distance: 20 hops
  952. Service Info: Host: fo3-web02.nic.gov.sd
  953.  
  954. TRACEROUTE (using port 443/tcp)
  955. HOP RTT ADDRESS
  956. 1 27.99 ms 10.249.200.1
  957. 2 28.04 ms vlan102.as02.qc1.ca.m247.com (176.113.74.17)
  958. 3 35.60 ms xe-0-0-1-0.agg2.qc1.ca.m247.com (37.120.128.166)
  959. 4 22.37 ms vlan304.as032.buc.ro.m247.com (77.243.185.226)
  960. 5 23.26 ms te0-7-0-2.rcr21.ymq02.atlas.cogentco.com (38.122.42.161)
  961. 6 23.23 ms hu0-4-0-1.ccr21.ymq01.atlas.cogentco.com (154.54.25.126)
  962. 7 92.31 ms be3043.ccr22.lpl01.atlas.cogentco.com (154.54.44.165)
  963. 8 98.53 ms be2391.ccr51.lhr01.atlas.cogentco.com (154.54.39.149)
  964. 9 98.58 ms be3487.ccr41.lon13.atlas.cogentco.com (154.54.60.5)
  965. 10 99.75 ms be2871.ccr21.lon01.atlas.cogentco.com (154.54.58.186)
  966. 11 98.65 ms expressotelecom.demarc.cogentco.com (149.14.248.202)
  967. 12 177.36 ms 185.153.20.70
  968. 13 177.38 ms 185.153.20.82
  969. 14 176.97 ms 185.153.20.94
  970. 15 180.36 ms 185.153.20.153
  971. 16 ... 17
  972. 18 201.90 ms 196.202.145.94
  973. 19 ...
  974. 20 209.07 ms f03-web02.nic.gov.sd (62.12.105.2)
  975. #######################################################################################################################################
  976. Starting Nmap 7.70 ( https://nmap.org ) at 2019-03-21 13:03 EDT
  977. Nmap scan report for f03-web02.nic.gov.sd (62.12.105.2)
  978. Host is up.
  979.  
  980. PORT STATE SERVICE VERSION
  981. 123/udp open|filtered ntp
  982. Too many fingerprints match this host to give specific OS details
  983.  
  984. TRACEROUTE (using proto 1/icmp)
  985. HOP RTT ADDRESS
  986. 1 20.94 ms 10.249.200.1
  987. 2 30.65 ms vlan102.as02.qc1.ca.m247.com (176.113.74.17)
  988. 3 40.56 ms xe-0-0-1-0.agg2.qc1.ca.m247.com (37.120.128.166)
  989. 4 20.97 ms vlan304.as032.buc.ro.m247.com (77.243.185.226)
  990. 5 21.53 ms te0-7-0-2.rcr21.ymq02.atlas.cogentco.com (38.122.42.161)
  991. 6 21.51 ms hu0-4-0-1.ccr22.ymq01.atlas.cogentco.com (154.54.31.222)
  992. 7 91.20 ms be3043.ccr22.lpl01.atlas.cogentco.com (154.54.44.165)
  993. 8 96.68 ms be2491.ccr52.lhr01.atlas.cogentco.com (154.54.39.118)
  994. 9 97.65 ms be3488.ccr42.lon13.atlas.cogentco.com (154.54.60.13)
  995. 10 97.65 ms be2871.ccr21.lon01.atlas.cogentco.com (154.54.58.186)
  996. 11 96.52 ms expressotelecom.demarc.cogentco.com (149.14.248.202)
  997. 12 181.89 ms 185.153.20.70
  998. 13 182.31 ms 185.153.20.82
  999. 14 181.84 ms 185.153.20.94
  1000. 15 181.19 ms 185.153.20.153
  1001. 16 200.25 ms 212.0.131.109
  1002. 17 204.51 ms 196.202.137.249
  1003. 18 199.95 ms 196.202.145.94
  1004. 19 ... 30
  1005. #######################################################################################################################################
  1006. Starting Nmap 7.70 ( https://nmap.org ) at 2019-03-21 13:05 EDT
  1007. Nmap scan report for f03-web02.nic.gov.sd (62.12.105.2)
  1008. Host is up (0.19s latency).
  1009.  
  1010. PORT STATE SERVICE VERSION
  1011. 161/tcp filtered snmp
  1012. 161/udp open|filtered snmp
  1013. Too many fingerprints match this host to give specific OS details
  1014.  
  1015. TRACEROUTE (using proto 1/icmp)
  1016. HOP RTT ADDRESS
  1017. 1 21.35 ms 10.249.200.1
  1018. 2 21.90 ms vlan102.as02.qc1.ca.m247.com (176.113.74.17)
  1019. 3 43.56 ms xe-0-0-1-0.agg2.qc1.ca.m247.com (37.120.128.166)
  1020. 4 21.73 ms vlan304.as032.buc.ro.m247.com (77.243.185.226)
  1021. 5 22.14 ms te0-7-0-2.rcr21.ymq02.atlas.cogentco.com (38.122.42.161)
  1022. 6 22.15 ms hu0-4-0-1.ccr22.ymq01.atlas.cogentco.com (154.54.31.222)
  1023. 7 91.24 ms be3043.ccr22.lpl01.atlas.cogentco.com (154.54.44.165)
  1024. 8 97.62 ms be2491.ccr52.lhr01.atlas.cogentco.com (154.54.39.118)
  1025. 9 98.24 ms be3488.ccr42.lon13.atlas.cogentco.com (154.54.60.13)
  1026. 10 98.26 ms be2871.ccr21.lon01.atlas.cogentco.com (154.54.58.186)
  1027. 11 97.79 ms expressotelecom.demarc.cogentco.com (149.14.248.202)
  1028. 12 177.15 ms 185.153.20.70
  1029. 13 176.76 ms 185.153.20.82
  1030. 14 176.74 ms 185.153.20.94
  1031. 15 179.65 ms 185.153.20.153
  1032. 16 202.37 ms 212.0.131.109
  1033. 17 205.86 ms 196.202.137.249
  1034. 18 201.67 ms 196.202.145.94
  1035. 19 ... 30
  1036. #######################################################################################################################################
  1037. Version: 1.11.12-static
  1038. OpenSSL 1.0.2-chacha (1.0.2g-dev)
  1039.  
  1040. Connected to 62.12.105.2
  1041.  
  1042. Testing SSL server 62.12.105.2 on port 443 using SNI name 62.12.105.2
  1043.  
  1044. TLS Fallback SCSV:
  1045. Server supports TLS Fallback SCSV
  1046.  
  1047. TLS renegotiation:
  1048. Secure session renegotiation supported
  1049.  
  1050. TLS Compression:
  1051. Compression disabled
  1052.  
  1053. Heartbleed:
  1054. TLS 1.2 not vulnerable to heartbleed
  1055. TLS 1.1 not vulnerable to heartbleed
  1056. TLS 1.0 not vulnerable to heartbleed
  1057.  
  1058. Supported Server Cipher(s):
  1059. Preferred TLSv1.2 256 bits ECDHE-RSA-AES256-GCM-SHA384 Curve P-256 DHE 256
  1060. Accepted TLSv1.2 256 bits ECDHE-RSA-AES256-SHA384 Curve P-256 DHE 256
  1061. Accepted TLSv1.2 256 bits ECDHE-RSA-AES256-SHA Curve P-256 DHE 256
  1062. Accepted TLSv1.2 256 bits AES256-GCM-SHA384
  1063. Accepted TLSv1.2 256 bits AES256-SHA256
  1064. Accepted TLSv1.2 256 bits AES256-SHA
  1065. Accepted TLSv1.2 256 bits CAMELLIA256-SHA
  1066. Accepted TLSv1.2 128 bits ECDHE-RSA-AES128-GCM-SHA256 Curve P-256 DHE 256
  1067. Accepted TLSv1.2 128 bits ECDHE-RSA-AES128-SHA256 Curve P-256 DHE 256
  1068. Accepted TLSv1.2 128 bits ECDHE-RSA-AES128-SHA Curve P-256 DHE 256
  1069. Accepted TLSv1.2 128 bits AES128-GCM-SHA256
  1070. Accepted TLSv1.2 128 bits AES128-SHA256
  1071. Accepted TLSv1.2 128 bits AES128-SHA
  1072. Accepted TLSv1.2 128 bits CAMELLIA128-SHA
  1073. Preferred TLSv1.1 256 bits ECDHE-RSA-AES256-SHA Curve P-256 DHE 256
  1074. Accepted TLSv1.1 256 bits AES256-SHA
  1075. Accepted TLSv1.1 256 bits CAMELLIA256-SHA
  1076. Accepted TLSv1.1 128 bits ECDHE-RSA-AES128-SHA Curve P-256 DHE 256
  1077. Accepted TLSv1.1 128 bits AES128-SHA
  1078. Accepted TLSv1.1 128 bits CAMELLIA128-SHA
  1079. Preferred TLSv1.0 256 bits ECDHE-RSA-AES256-SHA Curve P-256 DHE 256
  1080. Accepted TLSv1.0 256 bits AES256-SHA
  1081. Accepted TLSv1.0 256 bits CAMELLIA256-SHA
  1082. Accepted TLSv1.0 128 bits ECDHE-RSA-AES128-SHA Curve P-256 DHE 256
  1083. Accepted TLSv1.0 128 bits AES128-SHA
  1084. Accepted TLSv1.0 128 bits CAMELLIA128-SHA
  1085.  
  1086. SSL Certificate:
  1087. Signature Algorithm: sha256WithRSAEncryption
  1088. RSA Key Strength: 2048
  1089.  
  1090. Subject: Plesk
  1091. Issuer: Plesk
  1092.  
  1093. Not valid before: Apr 20 02:40:27 2016 GMT
  1094. Not valid after: Apr 20 02:40:27 2017 GMT
  1095. #######################################################################################################################################
  1096. --------------------------------------------------------
  1097. <<<Yasuo discovered following vulnerable applications>>>
  1098. --------------------------------------------------------
  1099. +------------+--------------------------------------+--------------------------------------------------+----------+----------+
  1100. | App Name | URL to Application | Potential Exploit | Username | Password |
  1101. +------------+--------------------------------------+--------------------------------------------------+----------+----------+
  1102. | phpMyAdmin | https://62.12.105.2:8443/phpmyadmin/ | ./exploits/multi/http/phpmyadmin_preg_replace.rb | None | None |
  1103. +------------+--------------------------------------+--------------------------------------------------+----------+----------+
  1104. #######################################################################################################################################
  1105. Starting Nmap 7.70 ( https://nmap.org ) at 2019-03-21 13:12 EDT
  1106. NSE: Loaded 148 scripts for scanning.
  1107. NSE: Script Pre-scanning.
  1108. NSE: Starting runlevel 1 (of 2) scan.
  1109. Initiating NSE at 13:12
  1110. Completed NSE at 13:12, 0.00s elapsed
  1111. NSE: Starting runlevel 2 (of 2) scan.
  1112. Initiating NSE at 13:12
  1113. Completed NSE at 13:12, 0.00s elapsed
  1114. Initiating Ping Scan at 13:12
  1115. Scanning 62.12.105.2 [4 ports]
  1116. Completed Ping Scan at 13:12, 0.22s elapsed (1 total hosts)
  1117. Initiating Parallel DNS resolution of 1 host. at 13:12
  1118. Completed Parallel DNS resolution of 1 host. at 13:12, 0.03s elapsed
  1119. Initiating Connect Scan at 13:12
  1120. Scanning f03-web02.nic.gov.sd (62.12.105.2) [65535 ports]
  1121. Discovered open port 21/tcp on 62.12.105.2
  1122. Discovered open port 80/tcp on 62.12.105.2
  1123. Discovered open port 143/tcp on 62.12.105.2
  1124. Discovered open port 110/tcp on 62.12.105.2
  1125. Discovered open port 993/tcp on 62.12.105.2
  1126. Discovered open port 995/tcp on 62.12.105.2
  1127. Discovered open port 443/tcp on 62.12.105.2
  1128. Connect Scan Timing: About 9.69% done; ETC: 13:18 (0:04:49 remaining)
  1129. Connect Scan Timing: About 44.66% done; ETC: 13:15 (0:01:16 remaining)
  1130. Completed Connect Scan at 13:14, 103.37s elapsed (65535 total ports)
  1131. Initiating Service scan at 13:14
  1132. Scanning 7 services on f03-web02.nic.gov.sd (62.12.105.2)
  1133. Completed Service scan at 13:14, 14.40s elapsed (7 services on 1 host)
  1134. Initiating OS detection (try #1) against f03-web02.nic.gov.sd (62.12.105.2)
  1135. Retrying OS detection (try #2) against f03-web02.nic.gov.sd (62.12.105.2)
  1136. WARNING: OS didn't match until try #2
  1137. Initiating Traceroute at 13:14
  1138. Completed Traceroute at 13:14, 6.11s elapsed
  1139. Initiating Parallel DNS resolution of 18 hosts. at 13:14
  1140. Completed Parallel DNS resolution of 18 hosts. at 13:14, 2.54s elapsed
  1141. NSE: Script scanning 62.12.105.2.
  1142. NSE: Starting runlevel 1 (of 2) scan.
  1143. Initiating NSE at 13:14
  1144. NSE Timing: About 99.06% done; ETC: 13:15 (0:00:00 remaining)
  1145. NSE Timing: About 99.37% done; ETC: 13:15 (0:00:00 remaining)
  1146. NSE Timing: About 99.48% done; ETC: 13:16 (0:00:00 remaining)
  1147. NSE Timing: About 99.58% done; ETC: 13:16 (0:00:01 remaining)
  1148. Completed NSE at 13:17, 137.65s elapsed
  1149. NSE: Starting runlevel 2 (of 2) scan.
  1150. Initiating NSE at 13:17
  1151. Completed NSE at 13:17, 0.45s elapsed
  1152. Nmap scan report for f03-web02.nic.gov.sd (62.12.105.2)
  1153. Host is up, received syn-ack ttl 45 (0.022s latency).
  1154. Scanned at 2019-03-21 13:12:45 EDT for 270s
  1155. Not shown: 65524 filtered ports
  1156. Reason: 65523 no-responses and 1 host-unreach
  1157. PORT STATE SERVICE REASON VERSION
  1158. 21/tcp open tcpwrapped syn-ack
  1159. 25/tcp closed smtp conn-refused
  1160. 80/tcp open http syn-ack nginx
  1161. |_http-favicon: Unknown favicon MD5: 1DB747255C64A30F9236E9D929E986CA
  1162. | http-methods:
  1163. |_ Supported Methods: POST OPTIONS GET HEAD
  1164. |_http-server-header: nginx
  1165. |_http-title: Domain Default page
  1166. 110/tcp open pop3 syn-ack Dovecot pop3d
  1167. |_pop3-capabilities: CAPA STLS APOP RESP-CODES PIPELINING SASL(PLAIN LOGIN DIGEST-MD5 CRAM-MD5) AUTH-RESP-CODE USER UIDL TOP
  1168. |_ssl-date: TLS randomness does not represent time
  1169. 113/tcp closed ident conn-refused
  1170. 139/tcp closed netbios-ssn conn-refused
  1171. 143/tcp open imap syn-ack Dovecot imapd
  1172. |_imap-capabilities: ID AUTH=PLAIN Pre-login have OK LOGIN-REFERRALS STARTTLS IMAP4rev1 SASL-IR ENABLE AUTH=DIGEST-MD5 AUTH=CRAM-MD5A0001 more post-login capabilities IDLE AUTH=LOGIN LITERAL+ listed
  1173. |_ssl-date: TLS randomness does not represent time
  1174. 443/tcp open ssl/http syn-ack nginx
  1175. | http-methods:
  1176. |_ Supported Methods: POST OPTIONS GET HEAD
  1177. |_http-server-header: nginx
  1178. |_http-title: 400 The plain HTTP request was sent to HTTPS port
  1179. | ssl-cert: Subject: commonName=Plesk/organizationName=Odin/stateOrProvinceName=Washington/countryName=US/[email protected]/localityName=Seattle/organizationalUnitName=Plesk
  1180. | Issuer: commonName=Plesk/organizationName=Odin/stateOrProvinceName=Washington/countryName=US/[email protected]/localityName=Seattle/organizationalUnitName=Plesk
  1181. | Public Key type: rsa
  1182. | Public Key bits: 2048
  1183. | Signature Algorithm: sha256WithRSAEncryption
  1184. | Not valid before: 2016-04-20T02:40:27
  1185. | Not valid after: 2017-04-20T02:40:27
  1186. | MD5: a38f 7308 6ca0 a95d 2faa d3f0 6cb4 5553
  1187. | SHA-1: 1479 6658 f803 6987 8f42 5473 9eaf 97e1 50dd 2d68
  1188. | -----BEGIN CERTIFICATE-----
  1189. | MIIDfTCCAmUCBFcW7BswDQYJKoZIhvcNAQELBQAwgYIxCzAJBgNVBAYTAlVTMRMw
  1190. | EQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdTZWF0dGxlMQ0wCwYDVQQKEwRP
  1191. | ZGluMQ4wDAYDVQQLEwVQbGVzazEOMAwGA1UEAxMFUGxlc2sxHTAbBgkqhkiG9w0B
  1192. | CQEWDmluZm9AcGxlc2suY29tMB4XDTE2MDQyMDAyNDAyN1oXDTE3MDQyMDAyNDAy
  1193. | N1owgYIxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQH
  1194. | EwdTZWF0dGxlMQ0wCwYDVQQKEwRPZGluMQ4wDAYDVQQLEwVQbGVzazEOMAwGA1UE
  1195. | AxMFUGxlc2sxHTAbBgkqhkiG9w0BCQEWDmluZm9AcGxlc2suY29tMIIBIjANBgkq
  1196. | hkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA6ZDNfEWzRPuiKR6QpFWONPYHX+Pl6rwn
  1197. | 6ctlVkGd2xcdnPKqzuL8z06rprVz1ro/kK7O9Xna4YfMzqoZjanxdzvjg5936PKF
  1198. | jjf5+AA4mmbD1SD1wFCE4+U4PnE2lz/Ae/Nj5wSLK1xAL3zitACHRLTXs3a4GMQC
  1199. | Q1LD36PSzhTl2EhDgQbSK+HB3YqsuJ8tKvn7P4qIGTZJ+HPikTXZ2e+bztPJGN4H
  1200. | iL16zcL5F8DcIKuRx6qpmGjji8As/JsNLckYD0O8CFWZHNjbAniQ+c64Umif9UrD
  1201. | IMcNJ3sgChQA7o8A1Qlu63FqJWGwxKlnPGt94tRpTUT1SGDCCMTTTwIDAQABMA0G
  1202. | CSqGSIb3DQEBCwUAA4IBAQAmNWQp2HI7DaKdIhVqqviur4Z852Z1RCrqWXMl95DP
  1203. | vtMpgRNrfdqC33xw627iWLJo4vKLvFK0OBgZ6O1gcLhcOeTGGbJLykhNjiPd0YU1
  1204. | oIg7G6HWKeQ30q2FTv43qoc1s6uiuflihbctsF7tnLxMXQcZO3nwWkkLcuQtMDFS
  1205. | RAkfBKbIoI/36MFs4GUh/nS78k9b3RgnSWwAD7DQi2+FrVr712EelRT627XIDp0U
  1206. | t3D2RhpH0SqBX1ncmzF5P9wll3Yqoy0nrJOpXXEf3nP9LyTBA2imWclm4NHaBVat
  1207. | CfsxXtJeFHpedfALThLxsTPAz/fsZoMC4s4N/ViMbF62
  1208. |_-----END CERTIFICATE-----
  1209. |_ssl-date: TLS randomness does not represent time
  1210. | tls-alpn:
  1211. |_ http/1.1
  1212. | tls-nextprotoneg:
  1213. |_ http/1.1
  1214. 445/tcp closed microsoft-ds conn-refused
  1215. 993/tcp open ssl/imaps? syn-ack
  1216. |_ssl-date: TLS randomness does not represent time
  1217. 995/tcp open ssl/pop3s? syn-ack
  1218. |_ssl-date: TLS randomness does not represent time
  1219. Device type: general purpose
  1220. Running: Linux 2.6.X
  1221. OS CPE: cpe:/o:linux:linux_kernel:2.6
  1222. OS details: Linux 2.6.18 - 2.6.22
  1223. TCP/IP fingerprint:
  1224. OS:SCAN(V=7.70%E=4%D=3/21%OT=80%CT=25%CU=%PV=N%G=N%TM=5C93C71B%P=x86_64-pc-
  1225. OS:linux-gnu)SEQ(SP=102%GCD=1%ISR=10B%TI=Z%CI=Z%TS=A)SEQ(CI=Z)OPS(O1=M4B3ST
  1226. OS:11NW7%O2=M4B3ST11NW7%O3=M4B3NNT11NW7%O4=M4B3ST11NW7%O5=M4B3ST11NW7%O6=M4
  1227. OS:B3ST11)WIN(W1=7120%W2=7120%W3=7120%W4=7120%W5=7120%W6=7120)ECN(R=Y%DF=Y%
  1228. OS:TG=40%W=7210%O=M4B3NNSNW7%CC=Y%Q=)ECN(R=N)T1(R=Y%DF=Y%TG=40%S=O%A=S+%F=A
  1229. OS:S%RD=0%Q=)T2(R=N)T3(R=N)T4(R=N)T5(R=Y%DF=Y%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD
  1230. OS:=0%Q=)T6(R=Y%DF=Y%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T7(R=N)U1(R=N)IE(R=N)
  1231.  
  1232. Service Info: Host: fo3-web02.nic.gov.sd
  1233.  
  1234. TRACEROUTE (using proto 1/icmp)
  1235. HOP RTT ADDRESS
  1236. 1 21.14 ms 10.249.200.1
  1237. 2 21.72 ms vlan102.as02.qc1.ca.m247.com (176.113.74.17)
  1238. 3 34.78 ms xe-0-0-1-0.agg2.qc1.ca.m247.com (37.120.128.166)
  1239. 4 21.70 ms vlan304.as032.buc.ro.m247.com (77.243.185.226)
  1240. 5 21.76 ms te0-7-0-2.rcr21.ymq02.atlas.cogentco.com (38.122.42.161)
  1241. 6 21.75 ms hu0-4-0-1.ccr22.ymq01.atlas.cogentco.com (154.54.31.222)
  1242. 7 91.40 ms be3043.ccr22.lpl01.atlas.cogentco.com (154.54.44.165)
  1243. 8 96.96 ms be2491.ccr52.lhr01.atlas.cogentco.com (154.54.39.118)
  1244. 9 97.83 ms be3488.ccr42.lon13.atlas.cogentco.com (154.54.60.13)
  1245. 10 97.89 ms be2871.ccr21.lon01.atlas.cogentco.com (154.54.58.186)
  1246. 11 96.47 ms expressotelecom.demarc.cogentco.com (149.14.248.202)
  1247. 12 176.68 ms 185.153.20.70
  1248. 13 176.69 ms 185.153.20.82
  1249. 14 176.61 ms 185.153.20.94
  1250. 15 179.65 ms 185.153.20.153
  1251. 16 201.26 ms 212.0.131.109
  1252. 17 208.17 ms 196.202.137.249
  1253. 18 203.44 ms 196.202.145.94
  1254. 19 ... 30
  1255.  
  1256. NSE: Script Post-scanning.
  1257. NSE: Starting runlevel 1 (of 2) scan.
  1258. Initiating NSE at 13:17
  1259. Completed NSE at 13:17, 0.00s elapsed
  1260. NSE: Starting runlevel 2 (of 2) scan.
  1261. Initiating NSE at 13:17
  1262. Completed NSE at 13:17, 0.00s elapsed
  1263. Read data files from: /usr/bin/../share/nmap
  1264. OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
  1265. Nmap done: 1 IP address (1 host up) scanned in 270.63 seconds
  1266. Raw packets sent: 174 (12.288KB) | Rcvd: 200 (31.984KB)
  1267. #######################################################################################################################################
  1268. Starting Nmap 7.70 ( https://nmap.org ) at 2019-03-21 13:17 EDT
  1269. NSE: Loaded 148 scripts for scanning.
  1270. NSE: Script Pre-scanning.
  1271. Initiating NSE at 13:17
  1272. Completed NSE at 13:17, 0.00s elapsed
  1273. Initiating NSE at 13:17
  1274. Completed NSE at 13:17, 0.00s elapsed
  1275. Initiating Parallel DNS resolution of 1 host. at 13:17
  1276. Completed Parallel DNS resolution of 1 host. at 13:17, 0.03s elapsed
  1277. Initiating UDP Scan at 13:17
  1278. Scanning f03-web02.nic.gov.sd (62.12.105.2) [14 ports]
  1279. Completed UDP Scan at 13:17, 1.25s elapsed (14 total ports)
  1280. Initiating Service scan at 13:17
  1281. Scanning 12 services on f03-web02.nic.gov.sd (62.12.105.2)
  1282. Service scan Timing: About 8.33% done; ETC: 13:36 (0:17:58 remaining)
  1283. Completed Service scan at 13:19, 102.58s elapsed (12 services on 1 host)
  1284. Initiating OS detection (try #1) against f03-web02.nic.gov.sd (62.12.105.2)
  1285. Retrying OS detection (try #2) against f03-web02.nic.gov.sd (62.12.105.2)
  1286. Initiating Traceroute at 13:19
  1287. Completed Traceroute at 13:19, 7.03s elapsed
  1288. Initiating Parallel DNS resolution of 1 host. at 13:19
  1289. Completed Parallel DNS resolution of 1 host. at 13:19, 0.00s elapsed
  1290. NSE: Script scanning 62.12.105.2.
  1291. Initiating NSE at 13:19
  1292. Completed NSE at 13:19, 20.31s elapsed
  1293. Initiating NSE at 13:19
  1294. Completed NSE at 13:19, 1.03s elapsed
  1295. Nmap scan report for f03-web02.nic.gov.sd (62.12.105.2)
  1296. Host is up (0.026s latency).
  1297.  
  1298. PORT STATE SERVICE VERSION
  1299. 53/udp open|filtered domain
  1300. 67/udp open|filtered dhcps
  1301. 68/udp open|filtered dhcpc
  1302. 69/udp open|filtered tftp
  1303. 88/udp open|filtered kerberos-sec
  1304. 123/udp open|filtered ntp
  1305. 137/udp filtered netbios-ns
  1306. 138/udp filtered netbios-dgm
  1307. 139/udp open|filtered netbios-ssn
  1308. 161/udp open|filtered snmp
  1309. 162/udp open|filtered snmptrap
  1310. 389/udp open|filtered ldap
  1311. 520/udp open|filtered route
  1312. 2049/udp open|filtered nfs
  1313. Too many fingerprints match this host to give specific OS details
  1314.  
  1315. TRACEROUTE (using port 138/udp)
  1316. HOP RTT ADDRESS
  1317. 1 ... 3
  1318. 4 26.15 ms 10.249.200.1
  1319. 5 27.21 ms 10.249.200.1
  1320. 6 27.20 ms 10.249.200.1
  1321. 7 27.19 ms 10.249.200.1
  1322. 8 27.19 ms 10.249.200.1
  1323. 9 27.19 ms 10.249.200.1
  1324. 10 27.21 ms 10.249.200.1
  1325. 11 ... 16
  1326. 17 22.24 ms 10.249.200.1
  1327. 18 ...
  1328. 19 21.20 ms 10.249.200.1
  1329. 20 19.40 ms 10.249.200.1
  1330. 21 20.23 ms 10.249.200.1
  1331. 22 ... 29
  1332. 30 19.81 ms 10.249.200.1
  1333.  
  1334. NSE: Script Post-scanning.
  1335. Initiating NSE at 13:19
  1336. Completed NSE at 13:19, 0.00s elapsed
  1337. Initiating NSE at 13:19
  1338. Completed NSE at 13:19, 0.00s elapsed
  1339. Read data files from: /usr/bin/../share/nmap
  1340. OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
  1341. Nmap done: 1 IP address (1 host up) scanned in 135.40 seconds
  1342. Raw packets sent: 146 (9.936KB) | Rcvd: 203 (26.713KB)
  1343. #######################################################################################################################################
  1344. ---------------------------------------------------------------------------------------------------------------------------------------
  1345. + Target IP: 62.12.105.2
  1346. + Target Hostname: 62.12.105.2
  1347. + Target Port: 443
  1348. ---------------------------------------------------------------------------------------------------------------------------------------
  1349. + SSL Info: Subject: /C=US/ST=Washington/L=Seattle/O=Odin/OU=Plesk/CN=Plesk/[email protected]
  1350. Ciphers: ECDHE-RSA-AES256-GCM-SHA384
  1351. Issuer: /C=US/ST=Washington/L=Seattle/O=Odin/OU=Plesk/CN=Plesk/[email protected]
  1352. + Start Time: 2019-03-21 12:40:51 (GMT-4)
  1353. ---------------------------------------------------------------------------------------------------------------------------------------
  1354. + Server: nginx
  1355. + The anti-clickjacking X-Frame-Options header is not present.
  1356. + The X-XSS-Protection header is not defined. This header can hint to the user agent to protect against some forms of XSS
  1357. + The site uses SSL and the Strict-Transport-Security HTTP header is not defined.
  1358. + The site uses SSL and Expect-CT header is not present.
  1359. + The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type
  1360. + Hostname '62.12.105.2' does not match certificate's names: Plesk
  1361. + Allowed HTTP Methods: POST, OPTIONS, GET, HEAD
  1362. + OSVDB-3233: /mailman/listinfo: Mailman was found on the server.
  1363. + ERROR: Error limit (20) reached for host, giving up. Last error: opening stream: can't connect: SSL negotiation failed: at /var/lib/nikto/plugins/LW2.pm line 5157.
  1364. at /var/lib/nikto/plugins/LW2.pm line 5157.
  1365. ; Interrupted system call at /var/lib/nikto/plugins/LW2.pm line 5157.
  1366. : Interrupted system call
  1367. + Scan terminated: 17 error(s) and 8 item(s) reported on remote host
  1368. + End Time: 2019-03-21 13:32:01 (GMT-4) (3070 seconds)
  1369. ---------------------------------------------------------------------------------------------------------------------------------------
  1370. #######################################################################################################################################
  1371. [i] Updating the Database ...
  1372. [i] Update completed.
  1373.  
  1374. [+] URL: http://www.rivernilestate.gov.sd/
  1375. [+] Started: Thu Mar 21 11:14:13 2019
  1376.  
  1377. Interesting Finding(s):
  1378.  
  1379. [+] http://www.rivernilestate.gov.sd/
  1380. | Interesting Entries:
  1381. | - X-Powered-By: PHP/5.4.16, PleskLin
  1382. | - X-UA-Compatible: IE=edge
  1383. | Found By: Headers (Passive Detection)
  1384. | Confidence: 100%
  1385.  
  1386. [+] http://www.rivernilestate.gov.sd/xmlrpc.php
  1387. | Found By: Direct Access (Aggressive Detection)
  1388. | Confidence: 100%
  1389. | References:
  1390. | - http://codex.wordpress.org/XML-RPC_Pingback_API
  1391. | - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_ghost_scanner
  1392. | - https://www.rapid7.com/db/modules/auxiliary/dos/http/wordpress_xmlrpc_dos
  1393. | - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_xmlrpc_login
  1394. | - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_pingback_access
  1395.  
  1396. [+] http://www.rivernilestate.gov.sd/wp-cron.php
  1397. | Found By: Direct Access (Aggressive Detection)
  1398. | Confidence: 60%
  1399. | References:
  1400. | - https://www.iplocation.net/defend-wordpress-from-ddos
  1401. | - https://github.com/wpscanteam/wpscan/issues/1299
  1402.  
  1403. Fingerprinting the version - Time: 00:00:20 <=========> (346 / 346) 100.00% Time: 00:00:20
  1404. [+] WordPress version 5.1.1 identified (Latest, released on 2019-03-13).
  1405. | Detected By: Query Parameter In Install Page (Aggressive Detection)
  1406. | - http://www.rivernilestate.gov.sd/wp-includes/css/dashicons.min.css?ver=5.1.1
  1407. | Confirmed By: Unique Fingerprinting (Aggressive Detection)
  1408. | - http://www.rivernilestate.gov.sd/wp-admin/images/loading.gif md5sum is 876d276e7d54dd2d568de865c3e0f60a
  1409.  
  1410. [+] WordPress theme in use: jannah
  1411. | Location: http://www.rivernilestate.gov.sd/wp-content/themes/jannah/
  1412. | Style URL: http://www.rivernilestate.gov.sd/wp-content/themes/jannah/style.css
  1413. | Style Name: Jannah | Shared by Themes24x7.com
  1414. | Style URI: http://jannah.tielabs.com/
  1415. | Description: Beautiful, Powerful & Flexible WordPress Theme for News, Magazine and Blog websites....
  1416. | Author: TieLabs
  1417. | Author URI: https://tielabs.com/
  1418. |
  1419. | Detected By: Urls In Homepage (Passive Detection)
  1420. |
  1421. | Version: 1.1.1 (80% confidence)
  1422. | Detected By: Style (Passive Detection)
  1423. | - http://www.rivernilestate.gov.sd/wp-content/themes/jannah/style.css, Match: 'Version: 1.1.1'
  1424.  
  1425. [+] Enumerating All Plugins (via Passive Methods)
  1426. [+] Checking Plugin Versions (via Passive and Aggressive Methods)
  1427.  
  1428. [i] Plugin(s) Identified:
  1429.  
  1430. [+] better-wp-security
  1431. | Location: http://www.rivernilestate.gov.sd/wp-content/plugins/better-wp-security/
  1432. | Last Updated: 2019-03-19T18:24:00.000Z
  1433. | [!] The version is out of date, the latest version is 7.3.2
  1434. |
  1435. | Detected By: Urls In Homepage (Passive Detection)
  1436. |
  1437. | Version: 7.2.0 (100% confidence)
  1438. | Detected By: Readme - Stable Tag (Aggressive Detection)
  1439. | - http://www.rivernilestate.gov.sd/wp-content/plugins/better-wp-security/readme.txt
  1440. | Confirmed By: Readme - ChangeLog Section (Aggressive Detection)
  1441. | - http://www.rivernilestate.gov.sd/wp-content/plugins/better-wp-security/readme.txt
  1442.  
  1443. [+] contact-form-7
  1444. | Location: http://www.rivernilestate.gov.sd/wp-content/plugins/contact-form-7/
  1445. | Last Updated: 2018-12-18T18:05:00.000Z
  1446. | [!] The version is out of date, the latest version is 5.1.1
  1447. |
  1448. | Detected By: Urls In Homepage (Passive Detection)
  1449. |
  1450. | Version: 5.0.5 (100% confidence)
  1451. | Detected By: Readme - Stable Tag (Aggressive Detection)
  1452. | - http://www.rivernilestate.gov.sd/wp-content/plugins/contact-form-7/readme.txt
  1453. | Confirmed By: Readme - ChangeLog Section (Aggressive Detection)
  1454. | - http://www.rivernilestate.gov.sd/wp-content/plugins/contact-form-7/readme.txt
  1455.  
  1456. [+] instanow
  1457. | Location: http://www.rivernilestate.gov.sd/wp-content/plugins/instanow/
  1458. |
  1459. | Detected By: Urls In Homepage (Passive Detection)
  1460. |
  1461. | The version could not be determined.
  1462.  
  1463. [+] taqyeem-buttons
  1464. | Location: http://www.rivernilestate.gov.sd/wp-content/plugins/taqyeem-buttons/
  1465. |
  1466. | Detected By: Urls In Homepage (Passive Detection)
  1467. |
  1468. | The version could not be determined.
  1469.  
  1470. [+] wp-statistics
  1471. | Location: http://www.rivernilestate.gov.sd/wp-content/plugins/wp-statistics/
  1472. | Last Updated: 2019-03-20T07:21:00.000Z
  1473. | [!] The version is out of date, the latest version is 12.6.1
  1474. |
  1475. | Detected By: Urls In Homepage (Passive Detection)
  1476. |
  1477. | Version: 12.5.2 (100% confidence)
  1478. | Detected By: Readme - Stable Tag (Aggressive Detection)
  1479. | - http://www.rivernilestate.gov.sd/wp-content/plugins/wp-statistics/readme.txt
  1480. | Confirmed By: Readme - ChangeLog Section (Aggressive Detection)
  1481. | - http://www.rivernilestate.gov.sd/wp-content/plugins/wp-statistics/readme.txt
  1482.  
  1483. [+] Enumerating Config Backups (via Passive and Aggressive Methods)
  1484. Checking Config Backups - Time: 00:00:02 <=============> (21 / 21) 100.00% Time: 00:00:02
  1485.  
  1486. [i] No Config Backups Found.
  1487.  
  1488. [+] Finished: Thu Mar 21 11:15:56 2019
  1489. [+] Requests Done: 190
  1490. [+] Cached Requests: 6
  1491. [+] Data Sent: 45.41 KB
  1492. [+] Data Received: 25.909 MB
  1493. [+] Memory used: 128.176 MB
  1494. [+] Elapsed time: 00:01:42
  1495. #######################################################################################################################################
  1496. +] URL: http://www.rivernilestate.gov.sd/
  1497. [+] Started: Thu Mar 21 11:14:13 2019
  1498.  
  1499. Interesting Finding(s):
  1500.  
  1501. [+] http://www.rivernilestate.gov.sd/
  1502. | Interesting Entries:
  1503. | - X-Powered-By: PHP/5.4.16, PleskLin
  1504. | - X-UA-Compatible: IE=edge
  1505. | Found By: Headers (Passive Detection)
  1506. | Confidence: 100%
  1507.  
  1508. [+] http://www.rivernilestate.gov.sd/xmlrpc.php
  1509. | Found By: Direct Access (Aggressive Detection)
  1510. | Confidence: 100%
  1511. | References:
  1512. | - http://codex.wordpress.org/XML-RPC_Pingback_API
  1513. | - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_ghost_scanner
  1514. | - https://www.rapid7.com/db/modules/auxiliary/dos/http/wordpress_xmlrpc_dos
  1515. | - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_xmlrpc_login
  1516. | - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_pingback_access
  1517.  
  1518. [+] http://www.rivernilestate.gov.sd/wp-cron.php
  1519. | Found By: Direct Access (Aggressive Detection)
  1520. | Confidence: 60%
  1521. | References:
  1522. | - https://www.iplocation.net/defend-wordpress-from-ddos
  1523. | - https://github.com/wpscanteam/wpscan/issues/1299
  1524.  
  1525. Fingerprinting the version - Time: 00:00:20 <> (346 / 346) 100.00% Time: 00:00:20
  1526. [+] WordPress version 5.1.1 identified (Latest, released on 2019-03-13).
  1527. | Detected By: Query Parameter In Install Page (Aggressive Detection)
  1528. | - http://www.rivernilestate.gov.sd/wp-includes/css/dashicons.min.css?ver=5.1.1
  1529. | Confirmed By: Unique Fingerprinting (Aggressive Detection)
  1530. | - http://www.rivernilestate.gov.sd/wp-admin/images/loading.gif md5sum is 876d276e7d54dd2d568de865c3e0f60a
  1531.  
  1532. [+] WordPress theme in use: jannah
  1533. | Location: http://www.rivernilestate.gov.sd/wp-content/themes/jannah/
  1534. | Style URL: http://www.rivernilestate.gov.sd/wp-content/themes/jannah/style.css
  1535. | Style Name: Jannah | Shared by Themes24x7.com
  1536. | Style URI: http://jannah.tielabs.com/
  1537. | Description: Beautiful, Powerful & Flexible WordPress Theme for News, Magazine and Blog websites....
  1538. | Author: TieLabs
  1539. | Author URI: https://tielabs.com/
  1540. |
  1541. | Detected By: Urls In Homepage (Passive Detection)
  1542. |
  1543. | Version: 1.1.1 (80% confidence)
  1544. | Detected By: Style (Passive Detection)
  1545. | - http://www.rivernilestate.gov.sd/wp-content/themes/jannah/style.css, Match: 'Version: 1.1.1'
  1546.  
  1547. [+] Enumerating Users (via Passive and Aggressive Methods)
  1548. Brute Forcing Author IDs - Time: 00:00:07 <==> (10 / 10) 100.00% Time: 00:00:07
  1549.  
  1550. [i] User(s) Identified:
  1551.  
  1552. [+] ���������� ����������������
  1553. | Detected By: Author Posts - Display Name (Passive Detection)
  1554.  
  1555. [+] ولاية نهرالنيل
  1556. | Detected By: Author Id Brute Forcing - Display Name (Aggressive Detection)
  1557.  
  1558. [+] Finished: Thu Mar 21 11:15:57 2019
  1559. [+] Requests Done: 165
  1560. [+] Cached Requests: 12
  1561. [+] Data Sent: 39.695 KB
  1562. [+] Data Received: 24.382 MB
  1563. [+] Memory used: 27.273 MB
  1564. [+] Elapsed time: 00:01:44
  1565. #######################################################################################################################################
  1566. [+] URL: http://www.rivernilestate.gov.sd/
  1567. [+] Started: Thu Mar 21 11:50:39 2019
  1568.  
  1569. Interesting Finding(s):
  1570.  
  1571. [+] http://www.rivernilestate.gov.sd/
  1572. | Interesting Entries:
  1573. | - X-Powered-By: PHP/5.4.16, PleskLin
  1574. | - X-UA-Compatible: IE=edge
  1575. | Found By: Headers (Passive Detection)
  1576. | Confidence: 100%
  1577.  
  1578. [+] http://www.rivernilestate.gov.sd/xmlrpc.php
  1579. | Found By: Direct Access (Aggressive Detection)
  1580. | Confidence: 100%
  1581. | References:
  1582. | - http://codex.wordpress.org/XML-RPC_Pingback_API
  1583. | - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_ghost_scanner
  1584. | - https://www.rapid7.com/db/modules/auxiliary/dos/http/wordpress_xmlrpc_dos
  1585. | - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_xmlrpc_login
  1586. | - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_pingback_access
  1587.  
  1588. [+] http://www.rivernilestate.gov.sd/wp-cron.php
  1589. | Found By: Direct Access (Aggressive Detection)
  1590. | Confidence: 60%
  1591. | References:
  1592. | - https://www.iplocation.net/defend-wordpress-from-ddos
  1593. | - https://github.com/wpscanteam/wpscan/issues/1299
  1594.  
  1595. Fingerprinting the version - Time: 00:00:32 <=========> (346 / 346) 100.00% Time: 00:00:32
  1596. [+] WordPress version 5.1.1 identified (Latest, released on 2019-03-13).
  1597. | Detected By: Query Parameter In Install Page (Aggressive Detection)
  1598. | - http://www.rivernilestate.gov.sd/wp-includes/css/dashicons.min.css?ver=5.1.1
  1599. | Confirmed By: Unique Fingerprinting (Aggressive Detection)
  1600. | - http://www.rivernilestate.gov.sd/wp-admin/js/widgets/custom-html-widgets.js md5sum is 0c079b9a73b9cfc434e2188b5b9a2ce8
  1601.  
  1602. [+] WordPress theme in use: jannah
  1603. | Location: http://www.rivernilestate.gov.sd/wp-content/themes/jannah/
  1604. | Style URL: http://www.rivernilestate.gov.sd/wp-content/themes/jannah/style.css
  1605. | Style Name: Jannah | Shared by Themes24x7.com
  1606. | Style URI: http://jannah.tielabs.com/
  1607. | Description: Beautiful, Powerful & Flexible WordPress Theme for News, Magazine and Blog websites....
  1608. | Author: TieLabs
  1609. | Author URI: https://tielabs.com/
  1610. |
  1611. | Detected By: Urls In Homepage (Passive Detection)
  1612. |
  1613. | Version: 1.1.1 (80% confidence)
  1614. | Detected By: Style (Passive Detection)
  1615. | - http://www.rivernilestate.gov.sd/wp-content/themes/jannah/style.css, Match: 'Version: 1.1.1'
  1616.  
  1617. [+] Enumerating Users (via Passive and Aggressive Methods)
  1618. Brute Forcing Author IDs - Time: 00:00:09 <============> (10 / 10) 100.00% Time: 00:00:09
  1619.  
  1620. [i] User(s) Identified:
  1621.  
  1622. [+] ���������� ����������������
  1623. | Detected By: Author Posts - Display Name (Passive Detection)
  1624.  
  1625. [+] ولاية نهرالنيل
  1626. | Detected By: Author Id Brute Forcing - Display Name (Aggressive Detection)
  1627.  
  1628. [+] Finished: Thu Mar 21 11:52:21 2019
  1629. [+] Requests Done: 149
  1630. [+] Cached Requests: 11
  1631. [+] Data Sent: 38.027 KB
  1632. [+] Data Received: 3.857 MB
  1633. [+] Memory used: 26.066 MB
  1634. [+] Elapsed time: 00:01:41
  1635. #######################################################################################################################################
  1636. [-] Date & Time: 21/03/2019 11:26:04
  1637. [I] Threads: 5
  1638. [-] Target: http://www.rivernilestate.gov.sd (62.12.105.2)
  1639. [M] Website Not in HTTPS: http://www.rivernilestate.gov.sd
  1640. [I] X-Powered-By: PHP/5.4.16
  1641. [L] X-Frame-Options: Not Enforced
  1642. [I] Strict-Transport-Security: Not Enforced
  1643. [I] X-Content-Security-Policy: Not Enforced
  1644. [I] X-Content-Type-Options: Not Enforced
  1645. [L] No Robots.txt Found
  1646. [I] CMS Detection: WordPress
  1647. [I] Wordpress Theme: jannah
  1648. [-] WordPress usernames identified:
  1649. [M] alnfeedabi
  1650. [M] fox
  1651. [M] rns
  1652. [M] ولاية نهرالنيل
  1653. [M] XML-RPC services are enabled
  1654. [I] Autocomplete Off Not Found: http://www.rivernilestate.gov.sd/wp-login.php
  1655. [-] Default WordPress Files:
  1656. [I] http://www.rivernilestate.gov.sd/wp-content/themes/twentynineteen/readme.txt
  1657. [I] http://www.rivernilestate.gov.sd/wp-includes/ID3/license.commercial.txt
  1658. [I] http://www.rivernilestate.gov.sd/wp-includes/ID3/readme.txt
  1659. [-] Searching Wordpress Plugins ...
  1660. [I] adrotate
  1661. [M] EDB-ID: 17888 "WordPress Plugin AdRotate 3.6.5 - SQL Injection"
  1662. [M] EDB-ID: 18114 "WordPress Plugin AdRotate 3.6.6 - SQL Injection"
  1663. [M] EDB-ID: 31834 "WordPress Plugin AdRotate 3.9.4 - 'clicktracker.ph?track' SQL Injection"
  1664. [I] ads-box
  1665. [M] EDB-ID: 38060 "WordPress Plugin Ads Box - 'count' SQL Injection"
  1666. [I] akismet
  1667. [M] EDB-ID: 37826 "WordPress 3.4.2 - Multiple Path Disclosure Vulnerabilities"
  1668. [M] EDB-ID: 37902 "WordPress Plugin Akismet - Multiple Cross-Site Scripting Vulnerabilities"
  1669. [I] all-in-one-wp-security-and-firewall v4.3.7.2
  1670. [M] EDB-ID: 34854 "WordPress Plugin All In One WP Security & Firewall 3.8.3 - Persistent Cross-Site Scripting"
  1671. [I] firestats
  1672. [M] EDB-ID: 14308 "WordPress Plugin Firestats - Remote Configuration File Download"
  1673. [M] EDB-ID: 33367 "WordPress Plugin Firestats 1.0.2 - Multiple Cross-Site Scripting / Authentication Bypass Vulnerabilities (1)"
  1674. [M] EDB-ID: 33368 "WordPress Plugin Firestats 1.0.2 - Multiple Cross-Site Scripting / Authentication Bypass Vulnerabilities (2)"
  1675. [I] simple-ads-manager
  1676. [M] EDB-ID: 36613 "WordPress Plugin Simple Ads Manager - Multiple SQL Injections"
  1677. [M] EDB-ID: 36614 "WordPress Plugin Simple Ads Manager 2.5.94 - Arbitrary File Upload"
  1678. [M] EDB-ID: 36615 "WordPress Plugin Simple Ads Manager - Information Disclosure"
  1679. [M] EDB-ID: 39133 "WordPress Plugin Simple Ads Manager 2.9.4.116 - SQL Injection"
  1680. [I] wp-bannerize
  1681. [M] EDB-ID: 17764 "WordPress Plugin Bannerize 2.8.6 - SQL Injection"
  1682. [M] EDB-ID: 17906 "WordPress Plugin Bannerize 2.8.7 - SQL Injection"
  1683. [M] EDB-ID: 36193 "WordPress Plugin WP Bannerize 2.8.7 - 'ajax_sorter.php' SQL Injection"
  1684. [I] Checking for Directory Listing Enabled ...
  1685. [-] Date & Time: 21/03/2019 11:32:34
  1686. [-] Completed in: 0:06:29
  1687. #######################################################################################################################################
  1688. Anonymous JTSEC #OpSudan Full Recon #46
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!