API tools faq
paste
Advertisement
Guest User

Anonymous V.S BlackHat #OpWhales JTSEC full Recon #3

a guest
Jan 8th, 2018
794
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 45.71 KB | None | 0 0
raw download clone embed print report
  1. #######################################################################################################################################
  2. Hostname www.jpf.go.jp ISP Incapsula Inc (AS19551)
  3. Continent North America Flag
  4. US
  5. Country United States Country Code US (USA)
  6. Region CA Local time 08 Jan 2018 08:36 PST
  7. Metropolis* San Francisco-Oakland-San Jose Postal Code 94065
  8. City Redwood City Latitude 37.533
  9. IP Address 192.230.124.46 Longitude -122.247
  10. ######################################################################################################################################
  11. [i] Scanning Site: http://192.230.124.46
  12.  
  13.  
  14.  
  15. B A S I C I N F O
  16. ====================
  17.  
  18.  
  19. [+] Site Title:
  20. [+] IP address: 192.230.124.46
  21. [+] Web Server: Could Not Detect
  22. [+] CMS: Could Not Detect
  23. [+] Cloudflare: Not Detected
  24. [+] Robots File: Could NOT Find robots.txt!
  25.  
  26.  
  27.  
  28.  
  29. W H O I S L O O K U P
  30. ========================
  31.  
  32.  
  33. #
  34. # ARIN WHOIS data and services are subject to the Terms of Use
  35. # available at: https://www.arin.net/whois_tou.html
  36. #
  37. # If you see inaccuracies in the results, please report at
  38. # https://www.arin.net/public/whoisinaccuracy/index.xhtml
  39. #
  40.  
  41.  
  42. #
  43. # The following results may also be obtained via:
  44. # https://whois.arin.net/rest/nets;q=192.230.124.46?showDetails=true&showARIN=false&showNonArinTopLevelNet=false&ext=netref2
  45. #
  46.  
  47. NetRange: 192.230.64.0 - 192.230.127.255
  48. CIDR: 192.230.64.0/18
  49. NetName: INCAPSULA-NETWORK
  50. NetHandle: NET-192-230-64-0-1
  51. Parent: NET192 (NET-192-0-0-0-0)
  52. NetType: Direct Assignment
  53. OriginAS: AS19551
  54. Organization: Incapsula Inc (INCAP-5)
  55. RegDate: 2013-05-08
  56. Updated: 2013-05-08
  57. Ref: https://whois.arin.net/rest/net/NET-192-230-64-0-1
  58.  
  59.  
  60. OrgName: Incapsula Inc
  61. OrgId: INCAP-5
  62. Address: 3400 Bridge Parkway, Suite 200
  63. City: Redwood Shores
  64. StateProv: CA
  65. PostalCode: 94065
  66. Country: US
  67. RegDate: 2010-09-14
  68. Updated: 2016-03-15
  69. Ref: https://whois.arin.net/rest/org/INCAP-5
  70.  
  71.  
  72. OrgNOCHandle: INCAP2-ARIN
  73. OrgNOCName: Incapsula Operations
  74. OrgNOCPhone: +1-866-250-7659
  75. OrgNOCEmail: ip@incapsula.com
  76. OrgNOCRef: https://whois.arin.net/rest/poc/INCAP2-ARIN
  77.  
  78. OrgTechHandle: BRONS9-ARIN
  79. OrgTechName: Bronstein, Tomer
  80. OrgTechPhone: +1-866-250-7659
  81. OrgTechEmail: tomer@incapsula.com
  82. OrgTechRef: https://whois.arin.net/rest/poc/BRONS9-ARIN
  83.  
  84. OrgAbuseHandle: INCAP1-ARIN
  85. OrgAbuseName: Incapsula AbuseDesk
  86. OrgAbusePhone: +1-866-250-7659
  87. OrgAbuseEmail: abuse@incapsula.com
  88. OrgAbuseRef: https://whois.arin.net/rest/poc/INCAP1-ARIN
  89.  
  90. OrgTechHandle: INCAP2-ARIN
  91. OrgTechName: Incapsula Operations
  92. OrgTechPhone: +1-866-250-7659
  93. OrgTechEmail: ip@incapsula.com
  94. OrgTechRef: https://whois.arin.net/rest/poc/INCAP2-ARIN
  95.  
  96.  
  97. #
  98. # ARIN WHOIS data and services are subject to the Terms of Use
  99. # available at: https://www.arin.net/whois_tou.html
  100. #
  101. # If you see inaccuracies in the results, please report at
  102. # https://www.arin.net/public/whoisinaccuracy/index.xhtml
  103. #
  104.  
  105.  
  106.  
  107.  
  108.  
  109. G E O I P L O O K U P
  110. =========================
  111.  
  112. [i] IP Address: 192.230.124.46
  113. [i] Country: US
  114. [i] State: California
  115. [i] City: Redwood City
  116. [i] Latitude: 37.533100
  117. [i] Longitude: -122.247101
  118.  
  119.  
  120.  
  121.  
  122. H T T P H E A D E R S
  123. =======================
  124.  
  125.  
  126. [i] HTTP/1.1 503 Service Unavailable
  127. [i] Content-Type: text/html
  128. [i] Cache-Control: no-cache
  129. [i] Connection: close
  130. [i] Content-Length: 654
  131. [i] X-Iinfo: 9-161509514-0 0NNN RT(1515429635780 0) q(1 -1 -1 -1) r(1 -1)
  132.  
  133.  
  134.  
  135.  
  136. D N S L O O K U P
  137. ===================
  138.  
  139. no records found
  140.  
  141.  
  142.  
  143. S U B N E T C A L C U L A T I O N
  144. ====================================
  145.  
  146. Address = 192.230.124.46
  147. Network = 192.230.124.46 / 32
  148. Netmask = 255.255.255.255
  149. Broadcast = not needed on Point-to-Point links
  150. Wildcard Mask = 0.0.0.0
  151. Hosts Bits = 0
  152. Max. Hosts = 1 (2^0 - 0)
  153. Host Range = { 192.230.124.46 - 192.230.124.46 }
  154.  
  155.  
  156.  
  157. N M A P P O R T S C A N
  158. ============================
  159.  
  160.  
  161. Starting Nmap 7.01 ( https://nmap.org ) at 2018-01-08 16:40 UTC
  162. Nmap scan report for 192.230.124.46.ip.incapdns.net (192.230.124.46)
  163. Host is up (0.076s latency).
  164. PORT STATE SERVICE VERSION
  165. 21/tcp filtered ftp
  166. 22/tcp filtered ssh
  167. 23/tcp filtered telnet
  168. 25/tcp open smtp?
  169. 80/tcp open http Incapsula CDN httpd
  170. 110/tcp filtered pop3
  171. 143/tcp filtered imap
  172. 443/tcp open ssl/http Incapsula CDN httpd
  173. 445/tcp open microsoft-ds?
  174. 3389/tcp open ssl/ms-wbt-server?
  175. 1 service unrecognized despite returning data. If you know the service/version, please submit t
  176. [!] IP Address : 192.230.124.46
  177. [!] 192.230.124.46 doesn't seem to use a CMS
  178. [+] Honeypot Probabilty: 30%
  179. ----------------------------------------
  180. PORT STATE SERVICE VERSION
  181. 21/tcp filtered ftp
  182. 22/tcp filtered ssh
  183. 23/tcp filtered telnet
  184. 25/tcp open smtp?
  185. 80/tcp open http Incapsula CDN httpd
  186. 110/tcp filtered pop3
  187. 143/tcp filtered imap
  188. 443/tcp open ssl/http Incapsula CDN httpd
  189. 445/tcp open microsoft-ds?
  190. 3389/tcp open ssl/ms-wbt-server?
  191. [92m====================================================================================
  192.  RUNNING NSLOOKUP 
  193. ====================================================================================
  194. Server: 192.168.1.254
  195. Address: 192.168.1.254#53
  196.  
  197. Non-authoritative answer:
  198. *** Can't find jpf.go.jp: No answer
  199.  
  200. jpf.go.jp mail is handled by 20 cluster4a.us.messagelabs.com.
  201. jpf.go.jp mail is handled by 10 cluster4.us.messagelabs.com.
  202. ====================================================================================
  203.  CHECKING OS FINGERPRINT 
  204. ====================================================================================
  205.  
  206. Xprobe2 v.0.3 Copyright (c) 2002-2005 fyodor@o0o.nu, ofir@sys-security.com, meder@o0o.nu
  207.  
  208. [+] Target is jpf.go.jp
  209. ====================================================================================
  210.  GATHERING WHOIS INFO 
  211. ====================================================================================
  212. [ JPRS database provides information on network administration. Its use is ]
  213. [ restricted to network administration purposes. For further information, ]
  214. [ use 'whois -h whois.jprs.jp help'. To suppress Japanese output, add'/e' ]
  215. [ at the end of command, e.g. 'whois -h whois.jprs.jp xxx/e'. ]
  216.  
  217. Domain Information:
  218. a. [Domain Name] JPF.GO.JP
  219. g. [Organization] The Japan Foundation
  220. l. [Organization Type] Independent Administrative Institution
  221. m. [Administrative Contact] SS32126JP
  222. n. [Technical Contact] SS32126JP
  223. p. [Name Server] nsk0.secure.ne.jp
  224. p. [Name Server] nsk1.secure.ne.jp
  225. s. [Signing Key]
  226. [State] Connected (2018/06/30)
  227. [Registered Date] 1996/06/12
  228. [Connected Date] 1996/11/25
  229. [Last Update] 2017/07/01 01:21:07 (JST)
  230.  
  231. ====================================================================================
  232.  GATHERING OSINT INFO 
  233. ====================================================================================
  234.  
  235. *******************************************************************
  236. * *
  237. * | |_| |__ ___ /\ /\__ _ _ ____ _____ ___| |_ ___ _ __ *
  238. * | __| '_ \ / _ \ / /_/ / _` | '__\ \ / / _ \/ __| __/ _ \ '__| *
  239. * | |_| | | | __/ / __ / (_| | | \ V / __/\__ \ || __/ | *
  240. * \__|_| |_|\___| \/ /_/ \__,_|_| \_/ \___||___/\__\___|_| *
  241. * *
  242. * TheHarvester Ver. 2.7 *
  243. * Coded by Christian Martorella *
  244. * Edge-Security Research *
  245. * cmartorella@edge-security.com *
  246. *******************************************************************
  247.  
  248.  
  249. Full harvest..
  250. [-] Searching in Google..
  251. Searching 0 results...
  252. [-] Searching in PGP Key server..
  253. [-] Searching in Bing..
  254. Searching 50 results...
  255. [-] Searching in Exalead..
  256. Searching 50 results...
  257.  
  258.  
  259. [+] Emails found:
  260. ------------------
  261. app-kc@jpf.go.jp
  262. arts@jpf.go.jp
  263. film_tv_and_publication_division@jpf.go.jp
  264. mcjp@jpf.go.jp
  265. oca@jpf.go.jp
  266. pixel-1515439246909107-web-@jpf.go.jp
  267. summer_institute@jpf.go.jp
  268. webmaster@jpf.go.jp
  269.  
  270. [+] Hosts found in search engines:
  271. ------------------------------------
  272. [-] Resolving hostnames IPs...
  273. 111.87.28.180:Momo.jpf.go.jp
  274. 153.150.68.139:jli-opac.jpf.go.jp
  275. 111.87.28.180:momo.jpf.go.jp
  276. 192.230.124.46:www.jpf.go.jp
  277. [+] Virtual hosts:
  278. ==================
  279.  
  280. ******************************************************
  281. * /\/\ ___| |_ __ _ __ _ ___ ___ / _(_) | *
  282. * / \ / _ \ __/ _` |/ _` |/ _ \ / _ \| |_| | | *
  283. * / /\/\ \ __/ || (_| | (_| | (_) | (_) | _| | | *
  284. * \/ \/\___|\__\__,_|\__, |\___/ \___/|_| |_|_| *
  285. * |___/ *
  286. * Metagoofil Ver 2.2 *
  287. * Christian Martorella *
  288. * Edge-Security.com *
  289. * cmartorella_at_edge-security.com *
  290. ******************************************************
  291.  
  292. [-] Starting online search...
  293.  
  294. [-] Searching for doc files, with a limit of 25
  295. Searching 100 results...
  296. Results: 0 files found
  297. Starting to download 25 of them:
  298. ----------------------------------------
  299.  
  300.  
  301. [-] Searching for pdf files, with a limit of 25
  302. Searching 100 results...
  303. Results: 0 files found
  304. Starting to download 25 of them:
  305. ----------------------------------------
  306.  
  307.  
  308. [-] Searching for xls files, with a limit of 25
  309. Searching 100 results...
  310. Results: 0 files found
  311. Starting to download 25 of them:
  312. ----------------------------------------
  313.  
  314.  
  315. [-] Searching for csv files, with a limit of 25
  316. Searching 100 results...
  317. Results: 0 files found
  318. Starting to download 25 of them:
  319. ----------------------------------------
  320.  
  321.  
  322. [-] Searching for txt files, with a limit of 25
  323. Searching 100 results...
  324. Results: 0 files found
  325. Starting to download 25 of them:
  326. ----------------------------------------
  327.  
  328. processing
  329. user
  330. email
  331.  
  332. [+] List of users found:
  333. --------------------------
  334.  
  335. [+] List of software found:
  336. -----------------------------
  337.  
  338. [+] List of paths and servers found:
  339. ---------------------------------------
  340.  
  341. [+] List of e-mails found:
  342. ----------------------------
  343. ====================================================================================
  344.  GATHERING DNS INFO 
  345. ====================================================================================
  346.  
  347. ; <<>> DiG 9.11.2-5-Debian <<>> -x jpf.go.jp
  348. ;; global options: +cmd
  349. ;; Got answer:
  350. ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 3476
  351. ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1
  352.  
  353. ;; OPT PSEUDOSECTION:
  354. ; EDNS: version: 0, flags:; udp: 4096
  355. ;; QUESTION SECTION:
  356. ;jp.go.jpf.in-addr.arpa. IN PTR
  357.  
  358. ;; AUTHORITY SECTION:
  359. in-addr.arpa. 3599 IN SOA b.in-addr-servers.arpa. nstld.iana.org. 2017102553 1800 900 604800 3600
  360.  
  361. ;; Query time: 152 msec
  362. ;; SERVER: 192.168.1.254#53(192.168.1.254)
  363. ;; WHEN: Mon Jan 08 14:20:59 EST 2018
  364. ;; MSG SIZE rcvd: 119
  365.  
  366. dnsenum VERSION:1.2.4
  367. 
  368. ----- jpf.go.jp -----
  369. 
  370.  
  371. Host's addresses:
  372. __________________
  373.  
  374. 
  375.  
  376. Name Servers:
  377. ______________
  378.  
  379. nsk0.secure.ne.jp. 599 IN A 122.200.212.137
  380. nsk1.secure.ne.jp. 299 IN A 122.200.253.229
  381. 
  382.  
  383. Mail (MX) Servers:
  384. ___________________
  385.  
  386. cluster4a.us.messagelabs.com. 300 IN A 216.82.251.230
  387. cluster4.us.messagelabs.com. 900 IN A 216.82.251.33
  388. cluster4.us.messagelabs.com. 900 IN A 216.82.242.33
  389. cluster4.us.messagelabs.com. 900 IN A 216.82.251.34
  390. cluster4.us.messagelabs.com. 900 IN A 216.82.242.179
  391. 
  392.  
  393. Trying Zone Transfers and getting Bind Versions:
  394. _________________________________________________
  395.  
  396. 
  397. Trying Zone Transfer for jpf.go.jp on nsk0.secure.ne.jp ...
  398.  
  399. Trying Zone Transfer for jpf.go.jp on nsk1.secure.ne.jp ...
  400.  
  401. brute force file not specified, bay.
  402. ====================================================================================
  403.  GATHERING DNS SUBDOMAINS 
  404. ====================================================================================
  405. 
  406. ____ _ _ _ _ _____
  407. / ___| _ _| |__ | (_)___| |_|___ / _ __
  408. \___ \| | | | '_ \| | / __| __| |_ \| '__|
  409. ___) | |_| | |_) | | \__ \ |_ ___) | |
  410. |____/ \__,_|_.__/|_|_|___/\__|____/|_|
  411.  
  412. # Coded By Ahmed Aboul-Ela - @aboul3la
  413.  
  414. [-] Enumerating subdomains now for jpf.go.jp
  415. [-] verbosity is enabled, will show the subdomains results in realtime
  416. [-] Searching now in Baidu..
  417. [-] Searching now in Yahoo..
  418. [-] Searching now in Google..
  419. [-] Searching now in Bing..
  420. [-] Searching now in Ask..
  421. [-] Searching now in Netcraft..
  422. [-] Searching now in DNSdumpster..
  423. [-] Searching now in Virustotal..
  424. [-] Searching now in ThreatCrowd..
  425. [-] Searching now in SSL Certificates..
  426. [-] Searching now in PassiveDNS..
  427. Virustotal: jlik-opac.jpf.go.jp
  428. Virustotal: soba.jpf.go.jp
  429. Virustotal: jli-opac.jpf.go.jp
  430. Virustotal: lib-opac.jpf.go.jp
  431. Virustotal: momo.jpf.go.jp
  432. Virustotal: www.jpf.go.jp
  433. Netcraft: www.jpf.go.jp
  434. SSL Certificates: jlik-opac.jpf.go.jp
  435. SSL Certificates: jli-opac.jpf.go.jp
  436. SSL Certificates: lib-opac.jpf.go.jp
  437. SSL Certificates: momo.jpf.go.jp
  438. SSL Certificates: medaka.jpf.go.jp
  439. SSL Certificates: www.jpf.go.jp
  440. SSL Certificates: momiji.jpf.go.jp
  441. SSL Certificates: soba.jpf.go.jp
  442. SSL Certificates: kamasu.jpf.go.jp
  443. ThreatCrowd: soba.jpf.go.jp
  444. ThreatCrowd: lib-opac.jpf.go.jp
  445. ThreatCrowd: jli-opac.jpf.go.jp
  446. ThreatCrowd: jlik-opac.jpf.go.jp
  447. ThreatCrowd: momo.jpf.go.jp
  448. ThreatCrowd: www.jpf.go.jp
  449. Bing: www.jpf.go.jp
  450. Bing: soba.jpf.go.jp
  451. Bing: jli-opac.jpf.go.jp
  452. Bing: jlik-opac.jpf.go.jp
  453. Yahoo: www.jpf.go.jp
  454. Yahoo: lib-opac.jpf.go.jp
  455. Yahoo: jli-opac.jpf.go.jp
  456. Yahoo: soba.jpf.go.jp
  457. Yahoo: jlik-opac.jpf.go.jp
  458. Google: lib-opac.jpf.go.jp
  459. Google: jlik-opac.jpf.go.jp
  460. Google: soba.jpf.go.jp
  461. Google: jli-opac.jpf.go.jp
  462. [-] Saving results to file: /usr/share/sniper/loot/domains/domains-jpf.go.jp.txt
  463. [-] Total Unique Subdomains Found: 9
  464. www.jpf.go.jp
  465. jli-opac.jpf.go.jp
  466. jlik-opac.jpf.go.jp
  467. kamasu.jpf.go.jp
  468. lib-opac.jpf.go.jp
  469. medaka.jpf.go.jp
  470. momiji.jpf.go.jp
  471. momo.jpf.go.jp
  472. soba.jpf.go.jp
  473.  
  474.  ╔═╗╦═╗╔╦╗╔═╗╦ ╦
  475.  ║ ╠╦╝ ║ ╚═╗╠═╣
  476.  ╚═╝╩╚═ ╩o╚═╝╩ ╩
  477. ====================================================================================
  478.  GATHERING CERTIFICATE SUBDOMAINS 
  479. ====================================================================================
  480. 
  481. jlik-opac.jpf.go.jp
  482. jli-opac.jpf.go.jp
  483. *.jpf.go.jp
  484. kamasu.jpf.go.jp
  485. lib-opac.jpf.go.jp
  486. medaka.jpf.go.jp
  487. momiji.jpf.go.jp
  488. momo.jpf.go.jp
  489. soba.jpf.go.jp
  490. www.jpf.go.jp
  491.  
  492.  \______ \_______ __ ___/ |_ ____ \ \/ /
  493.  | | _/\_ __ \ | \ __\/ __ \ \ / 
  494.  | | \ | | \/ | /| | \ ___/ / \ 
  495.  |______ / |__| |____/ |__| \___ >___/\ \ 
  496.  \/ \/ \_/
  497.  
  498.  + -- --=[BruteX v1.7 by 1N3
  499.  + -- --=[http://crowdshield.com
  500.  
  501.  
  502. ######################################################################################################################################
  503. Hostname www.mofa.go.jp ISP Unknown
  504. Continent Unknown Flag
  505. CA
  506. Country Canada Country Code CA
  507. Region Unknown Local time 08 Jan 2018 11:03 CST
  508. City Unknown Latitude 60
  509. IP Address (IPv6) 2001:56a:2:9::cfe4:533a Longitude -95
  510. #####################################################################################################################################
  511. i] Scanning Site: http://2.16.186.97
  512.  
  513.  
  514.  
  515. B A S I C I N F O
  516. ====================
  517.  
  518.  
  519. [+] Site Title:
  520. [+] IP address: 2.16.186.97
  521. [+] Web Server: AkamaiGHost
  522. [+] CMS: Could Not Detect
  523. [+] Cloudflare: Not Detected
  524. [+] Robots File: Could NOT Find robots.txt!
  525.  
  526.  
  527.  
  528.  
  529. W H O I S L O O K U P
  530. ========================
  531.  
  532. % This is the RIPE Database query service.
  533. % The objects are in RPSL format.
  534. %
  535. % The RIPE Database is subject to Terms and Conditions.
  536. % See http://www.ripe.net/db/support/db-terms-conditions.pdf
  537.  
  538. % Note: this output has been filtered.
  539. % To receive output for a database update, use the "-B" flag.
  540.  
  541. % Information related to '2.16.186.0 - 2.16.187.255'
  542.  
  543. % Abuse contact for '2.16.186.0 - 2.16.187.255' is 'abuse@akamai.com'
  544.  
  545. inetnum: 2.16.186.0 - 2.16.187.255
  546. netname: AKAMAI-PA
  547. descr: Akamai Technologies
  548. country: EU
  549. admin-c: NARA1-RIPE
  550. tech-c: NARA1-RIPE
  551. status: ASSIGNED PA
  552. mnt-by: AKAM1-RIPE-MNT
  553. mnt-routes: AKAM1-RIPE-MNT
  554. created: 2011-07-14T21:43:33Z
  555. last-modified: 2011-08-24T19:31:48Z
  556. source: RIPE
  557.  
  558. role: Network Architecture Role Account
  559. address: Akamai Technologies
  560. address: 8 Cambridge Center
  561. address: Cambridge, MA 02142
  562. phone: +1-617-938-3130
  563. abuse-mailbox: abuse@akamai.com
  564. admin-c: NF1714-RIPE
  565. admin-c: CKAK-RIPE
  566. tech-c: NF1714-RIPE
  567. tech-c: JP1944-RIPE
  568. tech-c: APB15-RIPE
  569. tech-c: CKAK-RIPE
  570. tech-c: TBAK-RIPE
  571. tech-c: NB782-RIPE
  572. tech-c: RM4844-RIPE
  573. tech-c: JZ2012-RIPE
  574. nic-hdl: NARA1-RIPE
  575. mnt-by: AKAM1-RIPE-MNT
  576. created: 2002-03-06T09:02:17Z
  577. last-modified: 2017-07-12T16:18:37Z
  578. source: RIPE # Filtered
  579.  
  580. % Information related to '2.16.186.0/23AS16625'
  581.  
  582. route: 2.16.186.0/23
  583. descr: Akamai Technologies
  584. origin: AS16625
  585. mnt-by: AKAM1-RIPE-MNT
  586. created: 2017-04-04T16:30:16Z
  587. last-modified: 2017-04-04T16:30:16Z
  588. source: RIPE
  589.  
  590. % Information related to '2.16.186.0/23AS20940'
  591.  
  592. route: 2.16.186.0/23
  593. descr: Akamai Technologies
  594. origin: AS20940
  595. mnt-by: AKAM1-RIPE-MNT
  596. created: 2017-04-04T16:30:16Z
  597. last-modified: 2017-04-04T16:30:16Z
  598. source: RIPE
  599.  
  600. % This query was served by the RIPE Database Query Service version 1.90 (ANGUS)
  601.  
  602.  
  603.  
  604.  
  605.  
  606.  
  607. G E O I P L O O K U P
  608. =========================
  609.  
  610. [i] IP Address: 2.16.186.97
  611. [i] Country: EU
  612. [i] State: N/A
  613. [i] City: N/A
  614. [i] Latitude: 47.000000
  615. [i] Longitude: 8.000000
  616.  
  617.  
  618.  
  619.  
  620. H T T P H E A D E R S
  621. =======================
  622.  
  623.  
  624. [i] HTTP/1.0 400 Bad Request
  625. [i] Server: AkamaiGHost
  626. [i] Mime-Version: 1.0
  627. [i] Content-Type: text/html
  628. [i] Content-Length: 208
  629. [i] Expires: Mon, 08 Jan 2018 17:09:25 GMT
  630. [i] Date: Mon, 08 Jan 2018 17:09:25 GMT
  631. [i] Connection: close
  632.  
  633.  
  634.  
  635.  
  636. D N S L O O K U P
  637. ===================
  638.  
  639. no records found
  640.  
  641.  
  642.  
  643. S U B N E T C A L C U L A T I O N
  644. ====================================
  645.  
  646. Address = 2.16.186.97
  647. Network = 2.16.186.97 / 32
  648. Netmask = 255.255.255.255
  649. Broadcast = not needed on Point-to-Point links
  650. Wildcard Mask = 0.0.0.0
  651. Hosts Bits = 0
  652. Max. Hosts = 1 (2^0 - 0)
  653. Host Range = { 2.16.186.97 - 2.16.186.97 }
  654.  
  655.  
  656.  
  657. N M A P P O R T S C A N
  658. ============================
  659.  
  660.  
  661. Starting Nmap 7.01 ( https://nmap.org ) at 2018-01-08 17:09 UTC
  662. Nmap scan report for a2-16-186-97.deploy.akamaitechnologies.com (2.16.186.97)
  663. Host is up (0.094s latency).
  664. PORT STATE SERVICE VERSION
  665. 21/tcp filtered ftp
  666. 22/tcp filtered ssh
  667. 23/tcp filtered telnet
  668. 25/tcp filtered smtp
  669. 80/tcp open http AkamaiGHost (Akamais HTTP Acceleration/Mirror service)
  670. 110/tcp filtered pop3
  671. 143/tcp filtered imap
  672. 443/tcp open ssl/http AkamaiGHost (Akamais HTTP Acceleration/Mirror service)
  673. 445/tcp filtered microsoft-ds
  674. 3389/tcp filtered ms-wbt-server
  675.  
  676. Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
  677. Nmap done: 1 IP address (1 host up) scanned in 14.98 seconds
  678. [!] IP Address : 2.16.186.97
  679. [+] Honeypot Probabilty: 0%
  680. ----------------------------------------
  681. PORT STATE SERVICE VERSION
  682. 21/tcp filtered ftp
  683. 22/tcp filtered ssh
  684. 23/tcp filtered telnet
  685. 25/tcp filtered smtp
  686. 80/tcp open http AkamaiGHost (Akamais HTTP Acceleration/Mirror service)
  687. 110/tcp filtered pop3
  688. 143/tcp filtered imap
  689. 443/tcp open ssl/http AkamaiGHost (Akamais HTTP Acceleration/Mirror service)
  690. 445/tcp filtered microsoft-ds
  691. 3389/tcp filtered ms-wbt-server
  692. ----------------------------------------
  693. There was an error getting results
  694. RUNNING NSLOOKUP
  695. ====================================================================================
  696. 97.186.16.2.in-addr.arpa name = a2-16-186-97.deploy.akamaitechnologies.com.
  697.  
  698. Authoritative answers can be found from:
  699.  
  700. 97.186.16.2.in-addr.arpa domain name pointer a2-16-186-97.deploy.akamaitechnologies.com.
  701. ====================================================================================
  702. CHECKING OS FINGERPRINT
  703. ====================================================================================
  704.  
  705. Xprobe2 v.0.3 Copyright (c) 2002-2005 fyodor@o0o.nu, ofir@sys-security.com, meder@o0o.nu
  706.  
  707. [+] Target is 2.16.186.97
  708. [+] Loading modules.
  709. [+] Following modules are loaded:
  710. [x] [1] ping:icmp_ping - ICMP echo discovery module
  711. [x] [2] ping:tcp_ping - TCP-based ping discovery module
  712. [x] [3] ping:udp_ping - UDP-based ping discovery module
  713. [x] [4] infogather:ttl_calc - TCP and UDP based TTL distance calculation
  714. [x] [5] infogather:portscan - TCP and UDP PortScanner
  715. [x] [6] fingerprint:icmp_echo - ICMP Echo request fingerprinting module
  716. [x] [7] fingerprint:icmp_tstamp - ICMP Timestamp request fingerprinting module
  717. [x] [8] fingerprint:icmp_amask - ICMP Address mask request fingerprinting module
  718. [x] [9] fingerprint:icmp_port_unreach - ICMP port unreachable fingerprinting module
  719. [x] [10] fingerprint:tcp_hshake - TCP Handshake fingerprinting module
  720. [x] [11] fingerprint:tcp_rst - TCP RST fingerprinting module
  721. [x] [12] fingerprint:smb - SMB fingerprinting module
  722. [x] [13] fingerprint:snmp - SNMPv2c fingerprinting module
  723. [+] 13 modules registered
  724. [+] Initializing scan engine
  725. [+] Running scan engine
  726. [-] ping:tcp_ping module: no closed/open TCP ports known on 2.16.186.97. Module test failed
  727. [-] ping:udp_ping module: no closed/open UDP ports known on 2.16.186.97. Module test failed
  728. [-] No distance calculation. 2.16.186.97 appears to be dead or no ports known
  729. [+] Host: 2.16.186.97 is up (Guess probability: 50%)
  730. [+] Target: 2.16.186.97 is alive. Round-Trip Time: 0.50357 sec
  731. [+] Selected safe Round-Trip Time value is: 1.00714 sec
  732. [-] fingerprint:tcp_hshake Module execution aborted (no open TCP ports known)
  733. [-] fingerprint:smb need either TCP port 139 or 445 to run
  734. [-] fingerprint:snmp: need UDP port 161 open
  735. [+] Primary guess:
  736. [+] Host 2.16.186.97 Running OS: (Guess probability: 100%)
  737. [+] Other guesses:
  738. [+] Host 2.16.186.97 Running OS: (Guess probability: 100%)
  739. [+] Host 2.16.186.97 Running OS: (Guess probability: 100%)
  740. [+] Host 2.16.186.97 Running OS: (Guess probability: 100%)
  741. [+] Host 2.16.186.97 Running OS: (Guess probability: 100%)
  742. [+] Host 2.16.186.97 Running OS: (Guess probability: 100%)
  743. [+] Host 2.16.186.97 Running OS: (Guess probability: 100%)
  744. [+] Host 2.16.186.97 Running OS: (Guess probability: 100%)
  745. [+] Host 2.16.186.97 Running OS: (Guess probability: 100%)
  746. [+] Host 2.16.186.97 Running OS: (Guess probability: 100%)
  747. [+] Cleaning up scan engine
  748. [+] Modules deinitialized
  749. [+] Execution completed.
  750.  
  751. ====================================================================================
  752. PINGING HOST
  753. ====================================================================================
  754. PING 2.16.186.97 (2.16.186.97) 56(84) bytes of data.
  755. 64 bytes from 2.16.186.97: icmp_seq=1 ttl=50 time=124 ms
  756.  
  757. --- 2.16.186.97 ping statistics ---
  758. 1 packets transmitted, 1 received, 0% packet loss, time 0ms
  759. rtt min/avg/max/mdev = 124.696/124.696/124.696/0.000 ms
  760.  
  761. ====================================================================================
  762. RUNNING TCP PORT SCAN
  763. ====================================================================================
  764.  
  765. Starting Nmap 7.60 ( https://nmap.org ) at 2018-01-08 12:16 EST
  766. Nmap scan report for a2-16-186-97.deploy.akamaitechnologies.com (2.16.186.97)
  767. Host is up (0.12s latency).
  768. Not shown: 470 filtered ports, 1 closed port
  769. Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
  770. PORT STATE SERVICE
  771. 80/tcp open http
  772. 443/tcp open https
  773.  
  774. Nmap done: 1 IP address (1 host up) scanned in 5.91 seconds
  775.  
  776. ====================================================================================
  777. RUNNING INTRUSIVE SCANS
  778. ====================================================================================
  779. + -- --=[Port 21 closed... skipping.
  780. + -- --=[Port 22 closed... skipping.
  781. + -- --=[Port 23 closed... skipping.
  782. + -- --=[Port 25 closed... skipping.
  783. + -- --=[Port 53 closed... skipping.
  784. + -- --=[Port 79 closed... skipping.
  785. + -- --=[Port 80 opened... running tests...
  786. ====================================================================================
  787. CHECKING FOR WAF
  788. ====================================================================================
  789.  
  790. ^ ^
  791. _ __ _ ____ _ __ _ _ ____
  792. ///7/ /.' \ / __////7/ /,' \ ,' \ / __/
  793. | V V // o // _/ | V V // 0 // 0 // _/
  794. |_n_,'/_n_//_/ |_n_,' \_,' \_,'/_/
  795. <
  796. ...'
  797.  
  798. WAFW00F - Web Application Firewall Detection Tool
  799.  
  800. By Sandro Gauci && Wendel G. Henrique
  801.  
  802. Checking http://2.16.186.97
  803. The site http://2.16.186.97 is behind a Imperva SecureSphere
  804. Number of requests: 9
  805.  
  806. ====================================================================================
  807. GATHERING HTTP INFO
  808. ====================================================================================
  809. http://2.16.186.97 [400 Bad Request] Akamai-Global-Host, Country[EUROPEAN UNION][EU], HTTPServer[AkamaiGHost], IP[2.16.186.97], Title[Invalid URL]
  810.  
  811. __ ______ _____
  812. \ \/ / ___|_ _|
  813. \ /\___ \ | |
  814. / \ ___) || |
  815. /_/\_|____/ |_|
  816.  
  817. + -- --=[Cross-Site Tracer v1.3 by 1N3 @ CrowdShield
  818. + -- --=[Target: 2.16.186.97:80
  819. + -- --=[Site not vulnerable to Cross-Site Tracing!
  820. + -- --=[Site not vulnerable to Host Header Injection!
  821. + -- --=[Site vulnerable to Cross-Frame Scripting!
  822. + -- --=[Site vulnerable to Clickjacking!
  823.  
  824. HTTP/1.0 400 Bad Request
  825. Server: AkamaiGHost
  826. Mime-Version: 1.0
  827. Content-Type: text/html
  828. Content-Length: 208
  829. Expires: Mon, 08 Jan 2018 17:16:19 GMT
  830. Date: Mon, 08 Jan 2018 17:16:19 GMT
  831. Connection: close
  832.  
  833. <HTML><HEAD>
  834. <TITLE>Invalid URL</TITLE>
  835. </HEAD><BODY>
  836. <H1>Invalid URL</H1>
  837. The requested URL "&#91;no&#32;URL&#93;", is invalid.<p>
  838. Reference&#32;&#35;9&#46;5dba1002&#46;1515431779&#46;abd0faa
  839. </BODY></HTML>
  840.  
  841. HTTP/1.0 400 Bad Request
  842. Server: AkamaiGHost
  843. Mime-Version: 1.0
  844. Content-Type: text/html
  845. Content-Length: 208
  846. Expires: Mon, 08 Jan 2018 17:16:20 GMT
  847. Date: Mon, 08 Jan 2018 17:16:20 GMT
  848. Connection: close
  849.  
  850. <HTML><HEAD>
  851. <TITLE>Invalid URL</TITLE>
  852. </HEAD><BODY>
  853. <H1>Invalid URL</H1>
  854. The requested URL "&#91;no&#32;URL&#93;", is invalid.<p>
  855. Reference&#32;&#35;9&#46;5dba1002&#46;1515431780&#46;abd1040
  856. </BODY></HTML>
  857.  
  858.  
  859.  
  860.  
  861. ====================================================================================
  862. CHECKING HTTP HEADERS
  863. ====================================================================================
  864. + -- --=[Checking if X-Content options are enabled on 2.16.186.97...
  865.  
  866. + -- --=[Checking if X-Frame options are enabled on 2.16.186.97...
  867.  
  868. + -- --=[Checking if X-XSS-Protection header is enabled on 2.16.186.97...
  869.  
  870. + -- --=[Checking HTTP methods on 2.16.186.97...
  871.  
  872. + -- --=[Checking if TRACE method is enabled on 2.16.186.97...
  873.  
  874. + -- --=[Checking for META tags on 2.16.186.97...
  875.  
  876. + -- --=[Checking for open proxy on 2.16.186.97...
  877. <HTML><HEAD>
  878. <TITLE>Invalid URL</TITLE>
  879. </HEAD><BODY>
  880. <H1>Invalid URL</H1>
  881. The requested URL "&#91;no&#32;URL&#93;", is invalid.<p>
  882. Reference&#32;&#35;9&#46;5dba1002&#46;1515431782&#46;abd11e4
  883. </BODY></HTML>
  884.  
  885. + -- --=[Enumerating software on 2.16.186.97...
  886. Server: AkamaiGHost
  887.  
  888. + -- --=[Checking if Strict-Transport-Security is enabled on 2.16.186.97...
  889.  
  890. + -- --=[Checking for Flash cross-domain policy on 2.16.186.97...
  891. <HTML><HEAD>
  892. <TITLE>Invalid URL</TITLE>
  893. </HEAD><BODY>
  894. <H1>Invalid URL</H1>
  895. The requested URL "&#91;no&#32;URL&#93;", is invalid.<p>
  896. Reference&#32;&#35;9&#46;5dba1002&#46;1515431782&#46;abd1287
  897. </BODY></HTML>
  898.  
  899. + -- --=[Checking for Silverlight cross-domain policy on 2.16.186.97...
  900. <HTML><HEAD>
  901. <TITLE>Invalid URL</TITLE>
  902. </HEAD><BODY>
  903. <H1>Invalid URL</H1>
  904. The requested URL "&#91;no&#32;URL&#93;", is invalid.<p>
  905. Reference&#32;&#35;9&#46;5dba1002&#46;1515431783&#46;abd12d1
  906. </BODY></HTML>
  907.  
  908. + -- --=[Checking for HTML5 cross-origin resource sharing on 2.16.186.97...
  909.  
  910. + -- --=[Retrieving robots.txt on 2.16.186.97...
  911. <HTML><HEAD>
  912. <TITLE>Invalid URL</TITLE>
  913. </HEAD><BODY>
  914. <H1>Invalid URL</H1>
  915. The requested URL "http&#58;&#47;&#47;&#37;5bNo&#37;20Host&#37;5d&#47;robots&#46;txt", is invalid.<p>
  916. Reference&#32;&#35;9&#46;5dba1002&#46;1515431783&#46;abd1347
  917. </BODY></HTML>
  918.  
  919. + -- --=[Retrieving sitemap.xml on 2.16.186.97...
  920. <HTML><HEAD>
  921. <TITLE>Invalid URL</TITLE>
  922. </HEAD><BODY>
  923. <H1>Invalid URL</H1>
  924. The requested URL "&#91;no&#32;URL&#93;", is invalid.<p>
  925. Reference&#32;&#35;9&#46;5dba1002&#46;1515431783&#46;abd138b
  926. </BODY></HTML>
  927.  
  928. + -- --=[Checking cookie attributes on 2.16.186.97...
  929.  
  930. + -- --=[Checking for ASP.NET Detailed Errors on 2.16.186.97...
  931.  
  932.  
  933. ====================================================================================
  934. SAVING SCREENSHOTS
  935. ====================================================================================
  936. [+] Screenshot saved to /usr/share/sniper/loot/screenshots/2.16.186.97-port80.jpg
  937. libpng warning: iCCP: known incorrect sRGB profile
  938. libpng warning: iCCP: known incorrect sRGB profile
  939. + -- --=[Port 110 closed... skipping.
  940. + -- --=[Port 111 closed... skipping.
  941. + -- --=[Port 135 closed... skipping.
  942. + -- --=[Port 139 closed... skipping.
  943. + -- --=[Port 161 closed... skipping.
  944. + -- --=[Port 162 closed... skipping.
  945. + -- --=[Port 389 closed... skipping.
  946. + -- --=[Port 443 opened... running tests...
  947. ====================================================================================
  948. CHECKING FOR WAF
  949. ====================================================================================
  950.  
  951. ^ ^
  952. _ __ _ ____ _ __ _ _ ____
  953. ///7/ /.' \ / __////7/ /,' \ ,' \ / __/
  954. | V V // o // _/ | V V // 0 // 0 // _/
  955. |_n_,'/_n_//_/ |_n_,' \_,' \_,'/_/
  956. <
  957. ...'
  958.  
  959. WAFW00F - Web Application Firewall Detection Tool
  960.  
  961. By Sandro Gauci && Wendel G. Henrique
  962.  
  963. Checking https://2.16.186.97
  964. Traceback (most recent call last):
  965. File "/usr/bin/wafw00f", line 8, in <module>
  966. main()
  967. File "/usr/lib/python2.7/dist-packages/wafw00f/__init__.py", line 808, in main
  968. if attacker.normalrequest() is None:
  969. File "/usr/lib/python2.7/dist-packages/wafw00f/__init__.py", line 96, in normalrequest
  970. return self.request(usecache=usecache, cacheresponse=cacheresponse, headers=headers)
  971. File "/usr/lib/python2.7/dist-packages/wafw00f/lib/evillib.py", line 323, in request
  972. h.request(method, path, headers=headers)
  973. File "/usr/lib/python2.7/httplib.py", line 1042, in request
  974. self._send_request(method, url, body, headers)
  975. File "/usr/lib/python2.7/httplib.py", line 1082, in _send_request
  976. self.endheaders(body)
  977. File "/usr/lib/python2.7/httplib.py", line 1038, in endheaders
  978. self._send_output(message_body)
  979. File "/usr/lib/python2.7/httplib.py", line 882, in _send_output
  980. self.send(msg)
  981. File "/usr/lib/python2.7/httplib.py", line 844, in send
  982. self.connect()
  983. File "/usr/lib/python2.7/httplib.py", line 1263, in connect
  984. server_hostname=server_hostname)
  985. File "/usr/lib/python2.7/ssl.py", line 369, in wrap_socket
  986. _context=self)
  987. File "/usr/lib/python2.7/ssl.py", line 617, in __init__
  988. self.do_handshake()
  989. File "/usr/lib/python2.7/ssl.py", line 854, in do_handshake
  990. match_hostname(self.getpeercert(), self.server_hostname)
  991. File "/usr/lib/python2.7/ssl.py", line 288, in match_hostname
  992. % (hostname, ', '.join(map(repr, dnsnames))))
  993. ssl.CertificateError: hostname '2.16.186.97' doesn't match either of '*.akamaihd-staging.net', '*.akamaihd.net', '*.akamaized.net', '*.akamaized-staging.net', 'a248.e.akamai.net'
  994.  
  995. ====================================================================================
  996. GATHERING HTTP INFO
  997. ====================================================================================
  998. https://2.16.186.97 [400 Bad Request] Akamai-Global-Host, Country[EUROPEAN UNION][EU], HTTPServer[AkamaiGHost], IP[2.16.186.97], Title[Invalid URL]
  999.  
  1000. ====================================================================================
  1001. GATHERING SSL/TLS INFO
  1002. ====================================================================================
  1003.  
  1004.  
  1005.  
  1006. AVAILABLE PLUGINS
  1007. -----------------
  1008.  
  1009. PluginHSTS
  1010. PluginOpenSSLCipherSuites
  1011. PluginCertInfo
  1012. PluginSessionRenegotiation
  1013. PluginCompression
  1014. PluginChromeSha1Deprecation
  1015. PluginSessionResumption
  1016. PluginHeartbleed
  1017.  
  1018.  
  1019.  
  1020. CHECKING HOST(S) AVAILABILITY
  1021. -----------------------------
  1022.  
  1023. 2.16.186.97:443 => 2.16.186.97:443
  1024.  
  1025.  
  1026.  
  1027. SCAN RESULTS FOR 2.16.186.97:443 - 2.16.186.97:443
  1028. --------------------------------------------------
  1029.  
  1030. * Deflate Compression:
  1031. OK - Compression disabled
  1032.  
  1033. * Session Renegotiation:
  1034. Client-initiated Renegotiations: OK - Rejected
  1035. Secure Renegotiation: VULNERABLE - Secure renegotiation not supported
  1036.  
  1037. * Certificate - Content:
  1038. SHA1 Fingerprint: 0e0dc04bd87b542328a9d6d3fe3d31fde4e4c76e
  1039. Common Name: a248.e.akamai.net
  1040. Issuer: Symantec Class 3 Secure Server CA - G4
  1041. Serial Number: 21C0AE35B8240503E5A5894F40D5BFEB
  1042. Not Before: Mar 7 00:00:00 2017 GMT
  1043. Not After: May 6 23:59:59 2018 GMT
  1044. Signature Algorithm: sha256WithRSAEncryption
  1045. Public Key Algorithm: rsaEncryption
  1046. Key Size: 2048 bit
  1047. Exponent: 65537 (0x10001)
  1048. X509v3 Subject Alternative Name: {'DNS': ['*.akamaihd.net', '*.akamaized.net', '*.akamaized-staging.net', '*.akamaihd-staging.net', 'a248.e.akamai.net']}
  1049.  
  1050. * Certificate - Trust:
  1051. Hostname Validation: FAILED - Certificate does NOT match 2.16.186.97
  1052. Google CA Store (09/2015): OK - Certificate is trusted
  1053. Java 6 CA Store (Update 65): OK - Certificate is trusted
  1054. Microsoft CA Store (09/2015): OK - Certificate is trusted
  1055. Mozilla NSS CA Store (09/2015): OK - Certificate is trusted
  1056. Apple CA Store (OS X 10.10.5): OK - Certificate is trusted
  1057. Certificate Chain Received: ['a248.e.akamai.net', 'Symantec Class 3 Secure Server CA - G4', 'VeriSign Class 3 Public Primary Certification Authority - G5']
  1058.  
  1059. * Certificate - OCSP Stapling:
  1060. OCSP Response Status: successful
  1061. Validation w/ Mozilla's CA Store: OK - Response is trusted
  1062. Responder Id: 0B5E5A4B922211161BFF0E087EC9F5D1A36D4DBC
  1063. Cert Status: good
  1064. Cert Serial Number: 21C0AE35B8240503E5A5894F40D5BFEB
  1065. This Update: Jan 5 02:40:02 2018 GMT
  1066. Next Update: Jan 12 02:40:02 2018 GMT
  1067.  
  1068. * Session Resumption:
  1069. With Session IDs: OK - Supported (5 successful, 0 failed, 0 errors, 5 total attempts).
  1070. With TLS Session Tickets: OK - Supported
  1071.  
  1072. * SSLV2 Cipher Suites:
  1073. Server rejected all cipher suites.
  1074.  
  1075. * SSLV3 Cipher Suites:
  1076. Server rejected all cipher suites.
  1077.  
  1078.  
  1079.  
  1080. SCAN COMPLETED IN 2.33 S
  1081. ------------------------
  1082. Version: 1.11.10-static
  1083. OpenSSL 1.0.2-chacha (1.0.2g-dev)
  1084.  
  1085. Testing SSL server 2.16.186.97 on port 443 using SNI name 2.16.186.97
  1086.  
  1087. TLS Fallback SCSV:
  1088. Server supports TLS Fallback SCSV
  1089.  
  1090. TLS renegotiation:
  1091. Session renegotiation not supported
  1092.  
  1093. TLS Compression:
  1094. Compression disabled
  1095.  
  1096. Heartbleed:
  1097. TLS 1.2 not vulnerable to heartbleed
  1098. TLS 1.1 not vulnerable to heartbleed
  1099. TLS 1.0 not vulnerable to heartbleed
  1100.  
  1101. Supported Server Cipher(s):
  1102. Preferred TLSv1.2 256 bits ECDHE-ECDSA-AES256-GCM-SHA384 Curve P-256 DHE 256
  1103. Accepted TLSv1.2 128 bits ECDHE-ECDSA-AES128-GCM-SHA256 Curve P-256 DHE 256
  1104. Accepted TLSv1.2 256 bits ECDHE-RSA-AES256-GCM-SHA384 Curve P-256 DHE 256
  1105. Accepted TLSv1.2 128 bits ECDHE-RSA-AES128-GCM-SHA256 Curve P-256 DHE 256
  1106. Accepted TLSv1.2 256 bits ECDHE-ECDSA-AES256-SHA384 Curve P-256 DHE 256
  1107. Accepted TLSv1.2 128 bits ECDHE-ECDSA-AES128-SHA256 Curve P-256 DHE 256
  1108. Accepted TLSv1.2 256 bits ECDHE-RSA-AES256-SHA384 Curve P-256 DHE 256
  1109. Accepted TLSv1.2 256 bits ECDHE-RSA-AES256-SHA Curve P-256 DHE 256
  1110. Accepted TLSv1.2 128 bits ECDHE-RSA-AES128-SHA256 Curve P-256 DHE 256
  1111. Accepted TLSv1.2 128 bits ECDHE-RSA-AES128-SHA Curve P-256 DHE 256
  1112. Accepted TLSv1.2 256 bits AES256-GCM-SHA384
  1113. Accepted TLSv1.2 128 bits AES128-GCM-SHA256
  1114. Accepted TLSv1.2 256 bits AES256-SHA256
  1115. Accepted TLSv1.2 128 bits AES128-SHA256
  1116. Accepted TLSv1.2 128 bits AES128-SHA
  1117. Accepted TLSv1.2 112 bits DES-CBC3-SHA
  1118. Preferred TLSv1.1 256 bits ECDHE-RSA-AES256-SHA Curve P-256 DHE 256
  1119. Accepted TLSv1.1 128 bits ECDHE-RSA-AES128-SHA Curve P-256 DHE 256
  1120. Accepted TLSv1.1 128 bits AES128-SHA
  1121. Accepted TLSv1.1 112 bits DES-CBC3-SHA
  1122. Preferred TLSv1.0 256 bits ECDHE-RSA-AES256-SHA Curve P-256 DHE 256
  1123. Accepted TLSv1.0 128 bits ECDHE-RSA-AES128-SHA Curve P-256 DHE 256
  1124. Accepted TLSv1.0 128 bits AES128-SHA
  1125. Accepted TLSv1.0 112 bits DES-CBC3-SHA
  1126.  
  1127. SSL Certificate:
  1128. Signature Algorithm: ecdsa-with-SHA256
  1129. Subject: a248.e.akamai.net
  1130. Altnames: DNS:*.akamaihd-staging.net, DNS:*.akamaihd.net, DNS:*.akamaized.net, DNS:*.akamaized-staging.net, DNS:a248.e.akamai.net
  1131. Issuer: Symantec Class 3 ECC 256 bit SSL CA - G2
  1132.  
  1133. + -- --=[MÄŚŚBĻËËĐ V20160303 BŸ 1Ņ3 @ ĊŖÖŴĐŚȞÏËĻĐ - https://crowdshield.com
  1134. + -- --=[Checking for DROWN (SSLv2): 2.16.186.97:443
  1135. + -- --=[Checking for HeartBleed: 2.16.186.97:443
  1136. + -- --=[Checking for OpenSSL CCS: 2.16.186.97:443
  1137. + -- --=[Checking for Poodle (SSLv3): 2.16.186.97:443
  1138. + -- --=[Checking for WinShock (MS14-066): 2.16.186.97:443
  1139. Testing if OpenSSL supports the ciphers we are checking for: YES
  1140.  
  1141. Testing 2.16.186.97:443 for availability of SSL ciphers added in MS14-066...
  1142. Testing cipher DHE-RSA-AES256-GCM-SHA384: UNSUPPORTED
  1143. Testing cipher DHE-RSA-AES128-GCM-SHA256: UNSUPPORTED
  1144. Testing cipher AES256-GCM-SHA384: SUPPORTED
  1145. Testing cipher AES128-GCM-SHA256: SUPPORTED
  1146. Testing if IIS is running on port 443: NO
  1147. Checking if target system is running Windows Server 2012 or later...
  1148. Testing cipher ECDHE-RSA-AES256-SHA384: SUPPORTED
  1149. 2.16.186.97:443 is patched: UNKNOWN: Windows Server 2012 or later detected.
  1150. + -- --=[Scan Complete!
  1151. ====================================================================================
  1152. CHECKING HTTP HEADERS
  1153. ====================================================================================
  1154. + -- --=[Checking if X-Content options are enabled on 2.16.186.97...
  1155.  
  1156. + -- --=[Checking if X-Frame options are enabled on 2.16.186.97...
  1157.  
  1158. + -- --=[Checking if X-XSS-Protection header is enabled on 2.16.186.97...
  1159.  
  1160. + -- --=[Checking HTTP methods on 2.16.186.97...
  1161.  
  1162. + -- --=[Checking if TRACE method is enabled on 2.16.186.97...
  1163.  
  1164. + -- --=[Checking for META tags on 2.16.186.97...
  1165.  
  1166. + -- --=[Checking for open proxy on 2.16.186.97...
  1167.  
  1168. + -- --=[Enumerating software on 2.16.186.97...
  1169. Server: AkamaiGHost
  1170.  
  1171. + -- --=[Checking if Strict-Transport-Security is enabled on 2.16.186.97...
  1172.  
  1173. + -- --=[Checking for Flash cross-domain policy on 2.16.186.97...
  1174. <HTML><HEAD>
  1175. <TITLE>Invalid URL</TITLE>
  1176. </HEAD><BODY>
  1177. <H1>Invalid URL</H1>
  1178. The requested URL "&#91;no&#32;URL&#93;", is invalid.<p>
  1179. Reference&#32;&#35;9&#46;5dba1002&#46;1515431819&#46;abd37b2
  1180. </BODY></HTML>
  1181.  
  1182. + -- --=[Checking for Silverlight cross-domain policy on 2.16.186.97...
  1183. <HTML><HEAD>
  1184. <TITLE>Invalid URL</TITLE>
  1185. </HEAD><BODY>
  1186. <H1>Invalid URL</H1>
  1187. The requested URL "&#91;no&#32;URL&#93;", is invalid.<p>
  1188. Reference&#32;&#35;9&#46;5dba1002&#46;1515431820&#46;abd383b
  1189. </BODY></HTML>
  1190.  
  1191. + -- --=[Checking for HTML5 cross-origin resource sharing on 2.16.186.97...
  1192.  
  1193. + -- --=[Retrieving robots.txt on 2.16.186.97...
  1194. <HTML><HEAD>
  1195. <TITLE>Invalid URL</TITLE>
  1196. </HEAD><BODY>
  1197. <H1>Invalid URL</H1>
  1198. The requested URL "http&#58;&#47;&#47;&#37;5bNo&#37;20Host&#37;5d&#47;robots&#46;txt", is invalid.<p>
  1199. Reference&#32;&#35;9&#46;5dba1002&#46;1515431821&#46;abd3995
  1200. </BODY></HTML>
  1201.  
  1202. + -- --=[Retrieving sitemap.xml on 2.16.186.97...
  1203. <HTML><HEAD>
  1204. <TITLE>Invalid URL</TITLE>
  1205. </HEAD><BODY>
  1206. <H1>Invalid URL</H1>
  1207. The requested URL "&#91;no&#32;URL&#93;", is invalid.<p>
  1208. Reference&#32;&#35;9&#46;5dba1002&#46;1515431821&#46;abd3a31
  1209. </BODY></HTML>
  1210.  
  1211. + -- --=[Checking cookie attributes on 2.16.186.97...
  1212.  
  1213. + -- --=[Checking for ASP.NET Detailed Errors on 2.16.186.97...
  1214. RUNNING BRUTE FORCE
  1215. ====================================================================================
  1216. __________ __ ____ ___
  1217. \______ \_______ __ ___/ |_ ____ \ \/ /
  1218. | | _/\_ __ \ | \ __\/ __ \ \ /
  1219. | | \ | | \/ | /| | \ ___/ / \
  1220. |______ / |__| |____/ |__| \___ >___/\ \
  1221. \/ \/ \_/
  1222.  
  1223. + -- --=[BruteX v1.7 by 1N3
  1224. + -- --=[http://crowdshield.com
  1225.  
  1226.  
  1227. ################################### Running Port Scan ##############################
  1228.  
  1229. Starting Nmap 7.60 ( https://nmap.org ) at 2018-01-08 12:18 EST
  1230. Nmap scan report for a2-16-186-97.deploy.akamaitechnologies.com (2.16.186.97)
  1231. Host is up (0.12s latency).
  1232. Not shown: 23 filtered ports, 1 closed port
  1233. Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
  1234. PORT STATE SERVICE
  1235. 80/tcp open http
  1236. 443/tcp open https
  1237.  
  1238. Nmap done: 1 IP address (1 host up) scanned in 2.61 seconds
  1239.  
  1240. ################################### Running Brute Force ############################
  1241.  
  1242. + -- --=[Port 21 closed... skipping.
  1243. + -- --=[Port 22 closed... skipping.
  1244. + -- --=[Port 23 closed... skipping.
  1245. + -- --=[Port 25 closed... skipping.
  1246. + -- --=[Port 80 opened... running tests...
  1247. Hydra v8.6 (c) 2017 by van Hauser/THC - Please do not use in military or secret service organizations, or for illegal purposes.
  1248.  
  1249. Hydra (http://www.thc.org/thc-hydra) starting at 2018-01-08 12:18:36
  1250. [DATA] max 1 task per 1 server, overall 1 task, 1496 login tries (l:34/p:44), ~1496 tries per task
  1251. [DATA] attacking http-get://2.16.186.97:80//
  1252. [STATUS] 136.00 tries/min, 136 tries in 00:01h, 1360 to do in 00:11h, 1 active
  1253. [STATUS] 137.33 tries/min, 412 tries in 00:03h, 1084 to do in 00:08h, 1 active
  1254. [STATUS] 137.00 tries/min, 959 tries in 00:07h, 537 to do in 00:04h, 1 active
  1255. 1 of 1 target completed, 0 valid passwords found
  1256. Hydra (http://www.thc.org/thc-hydra) finished at 2018-01-08 12:29:32
  1257. + -- --=[Port 110 closed... skipping.
  1258. + -- --=[Port 139 closed... skipping.
  1259. + -- --=[Port 162 closed... skipping.
  1260. + -- --=[Port 389 closed... skipping.
  1261. + -- --=[Port 443 opened... running tests...
  1262. Hydra v8.6 (c) 2017 by van Hauser/THC - Please do not use in military or secret service organizations, or for illegal purposes.
  1263.  
  1264. Hydra (http://www.thc.org/thc-hydra) starting at 2018-01-08 12:29:32
  1265. [DATA] max 1 task per 1 server, overall 1 task, 1496 login tries (l:34/p:44), ~1496 tries per task
  1266. [DATA] attacking http-gets://2.16.186.97:443//
  1267. [STATUS] 88.00 tries/min, 88 tries in 00:01h, 1408 to do in 00:17h, 1 active
  1268. [STATUS] 89.00 tries/min, 267 tries in 00:03h, 1229 to do in 00:14h, 1 active
  1269. [STATUS] 88.43 tries/min, 619 tries in 00:07h, 877 to do in 00:10h, 1 active
  1270. [STATUS] 88.50 tries/min, 1062 tries in 00:12h, 434 to do in 00:05h, 1 active
  1271. 1 of 1 target completed, 0 valid passwords found
  1272. Hydra (http://www.thc.org/thc-hydra) finished at 2018-01-08 12:46:27
  1273. #######################################################################################################################################
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!