· 9 years ago · Sep 12, 2016, 12:34 AM
1 _____ _____
2 / ____\ _ _ _______ / ____\
3 | | \| | | | ___ | | | \| ___ ___
4 | |____ | | | | | / | | | |____ / _ \ / __\
5 \____ \| |__ __ __| | |/ /| |_ __ _ \____ \| |_| | / \
6 | | _ \| _\| _ | | / | | | / | // | | ___/||
7 |\____| | | | ||/ | \| | |_ / | |//| |// |\____| | \__/| \__/
8 \_____/|_| |_|_/||____|_______|__/ |__/ \_____/ \___/ \___/
9
10
11OpSilence
12
13Target:abc12.com
14By:ShadowSec
15
16
17 Domain Name: ABC12.COM
18 Registrar: GODADDY.COM, LLC
19 Sponsoring Registrar IANA ID: 146
20 Whois Server: whois.godaddy.com
21 Referral URL: http://www.godaddy.com
22 Name Server: EDNS01.GRAY.TV
23 Name Server: EDNS02.GRAY.TV
24 Name Server: EDNS03.GRAY.TV
25 Name Server: EDNS04.GRAY.TV
26 Status: clientDeleteProhibited https://icann.org/epp#clientDeleteProhibited
27 Status: clientRenewProhibited https://icann.org/epp#clientRenewProhibited
28 Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited
29 Status: clientUpdateProhibited https://icann.org/epp#clientUpdateProhibited
30 Updated Date: 15-jan-2015
31 Creation Date: 06-nov-1998
32 Expiration Date: 05-nov-2017
33
34
35Domain Name: ABC12.COM
36Registry Domain ID: 3589092_DOMAIN_COM-VRSN
37Registrar WHOIS Server: whois.godaddy.com
38Registrar URL: http://www.godaddy.com
39Update Date: 2015-01-15T15:36:32Z
40Creation Date: 1998-11-06T05:00:00Z
41Registrar Registration Expiration Date: 2017-11-05T05:00:00Z
42Registrar: GoDaddy.com, LLC
43Registrar IANA ID: 146
44Registrar Abuse Contact Email: abuse@godaddy.com
45Registrar Abuse Contact Phone: +1.4806242505
46Domain Status: clientTransferProhibited http://www.icann.org/epp#clientTransferProhibited
47Domain Status: clientUpdateProhibited http://www.icann.org/epp#clientUpdateProhibited
48Domain Status: clientRenewProhibited http://www.icann.org/epp#clientRenewProhibited
49Domain Status: clientDeleteProhibited http://www.icann.org/epp#clientDeleteProhibited
50Registry Registrant ID: Not Available From Registry
51Registrant Name: Vance Luke
52Registrant Organization: Gray Television
53Registrant Street: 1801 Halstead Blvd
54Registrant Street: 2nd Floor
55Registrant City: Tallahassee
56Registrant State/Province: Florida
57Registrant Postal Code: 32309
58Registrant Country: US
59Registrant Phone: +1.8505588777
60Registrant Phone Ext:
61Registrant Fax:
62Registrant Fax Ext:
63Registrant Email: dnsadmin@gray.tv
64Registry Admin ID: Not Available From Registry
65Admin Name: Vance Luke
66Admin Organization: Gray Television
67Admin Street: 1801 Halstead Blvd
68Admin Street: 2nd Floor
69Admin City: Tallahassee
70Admin State/Province: Florida
71Admin Postal Code: 32309
72Admin Country: US
73Admin Phone: +1.8505588777
74Admin Phone Ext:
75Admin Fax:
76Admin Fax Ext:
77Admin Email: dnsadmin@gray.tv
78Registry Tech ID: Not Available From Registry
79Tech Name: Vance Luke
80Tech Organization: Gray Television
81Tech Street: 1801 Halstead Blvd
82Tech Street: 2nd Floor
83Tech City: Tallahassee
84Tech State/Province: Florida
85Tech Postal Code: 32309
86Tech Country: US
87Tech Phone: +1.8505588777
88Tech Phone Ext:
89Tech Fax:
90Tech Fax Ext:
91Tech Email: dnsadmin@gray.tv
92Name Server: EDNS01.GRAY.TV
93Name Server: EDNS03.GRAY.TV
94Name Server: EDNS04.GRAY.TV
95Name Server: EDNS02.GRAY.TV
96
97
98Host's addresses:
99__________________
100
101abc12.com. 3585 IN A 208.80.56.11
102
103
104Name Servers:
105______________
106
107edns01.gray.tv. 172542 IN A 65.112.137.52
108edns03.gray.tv. 3342 IN A 38.101.200.21
109edns04.gray.tv. 3342 IN A 38.101.200.21
110edns02.gray.tv. 3342 IN A 38.101.204.2
111
112
113Mail (MX) Servers:
114___________________
115
116mx.gray.tv. 600 IN A 65.112.137.170
117mx5.gray.tv. 600 IN A 199.44.253.170
118
119http://abc12.com/ [301]
120http://abc12.com [301] Apache, Country[UNITED STATES][US], HTTPServer[Apache], IP[208.80.56.11], RedirectLocation[http://www.abc12.com/], UncommonHeaders[x-server-name], Via-Proxy[1.1 va-c1-r10-u27-b1:3128 (squid)]
121URL : http://abc12.com
122Status : 301
123 Apache ---------------------------------------------------------------------
124 Description: The Apache HTTP Server Project is an effort to develop and
125 maintain an open-source HTTP server for modern operating
126 systems including UNIX and Windows NT. The goal of this
127 project is to provide a secure, efficient and extensible
128 server that provides HTTP services in sync with the current
129 HTTP standards.
130 Website : http://httpd.apache.org/
131
132 Country --------------------------------------------------------------------
133 Description: Shows the country the IPv4 address belongs to. This uses
134 the GeoIP IP2Country database from
135 http://software77.net/geo-ip/. Instructions on updating the
136 database are in the plugin comments.
137 String : UNITED STATES
138 Module : US
139
140 HTTPServer -----------------------------------------------------------------
141 Description: HTTP server header string. This plugin also attempts to
142 identify the operating system from the server header.
143 String : Apache (from server string)
144
145 IP -------------------------------------------------------------------------
146 Description: IP address of the target, if available.
147 String : 208.80.56.11
148
149 RedirectLocation -----------------------------------------------------------
150 Description: HTTP Server string location. used with http-status 301 and
151 302
152 String : http://www.abc12.com/ (from location)
153
154 UncommonHeaders ------------------------------------------------------------
155 Description: Uncommon HTTP server headers. The blacklist includes all
156 the standard headers and many non standard but common ones.
157 Interesting but fairly common headers should have their own
158 plugins, eg. x-powered-by, server and x-aspnet-version.
159 Info about headers can be found at www.http-stats.com
160 String : x-server-name (from headers)
161
162 Via-Proxy ------------------------------------------------------------------
163 Description: This plugin extracts the proxy server details from the Via
164 param of the HTTP header.
165 String : 1.1 va-c1-r10-u27-b1:3128 (squid)
166
167http://www.abc12.com/ [200]
168http://www.abc12.com/ [200] AddThis, Apache, Cookies[__llnwmob,click_mobile], Country[UNITED STATES][US], Email[fccinfo@fcc.gov,jayne.e.berklich@abc12.com], Google-API[ajax/libs/jquery/1.8.1/jquery.min.js], Google-Analytics[UA-45647629-22], HTML5, HTTPServer[Apache], IP[69.164.35.224], JQuery, Meta-Author[WJRT], OpenGraphProtocol, PoweredBy[Clickability], Script[Javascript,Javascript1.0,Javascript1.1,Javascript1.2,Javascript1.3,Javascript1.4,Javascript1.5,Javascript1.6,Javascript1.7,Javascript1.8,Javascript1.9,application/ld+json,text/javascript], Title[Flint, Michigan News, Weather, Sports | ABC12 WJRT], UncommonHeaders[x-server-name], Via-Proxy[1.1 la-c1-r1-u28-b2:3128 (squid)], X-UA-Compatible[IE=9]
169URL : http://www.abc12.com/
170Status : 200
171 AddThis --------------------------------------------------------------------
172 Description: AddThis is a free way to boost traffic back to your site by
173 making it easier for visitors to share your content. -
174 Homepage: http://www.addthis.com/
175
176 Apache ---------------------------------------------------------------------
177 Description: The Apache HTTP Server Project is an effort to develop and
178 maintain an open-source HTTP server for modern operating
179 systems including UNIX and Windows NT. The goal of this
180 project is to provide a secure, efficient and extensible
181 server that provides HTTP services in sync with the current
182 HTTP standards.
183 Website : http://httpd.apache.org/
184
185 Cookies --------------------------------------------------------------------
186 Description: Display the names of cookies in the HTTP headers. The
187 values are not returned to save on space.
188 String : click_mobile
189 String : __llnwmob
190
191 Country --------------------------------------------------------------------
192 Description: Shows the country the IPv4 address belongs to. This uses
193 the GeoIP IP2Country database from
194 http://software77.net/geo-ip/. Instructions on updating the
195 database are in the plugin comments.
196 String : UNITED STATES
197 Module : US
198
199 Email ----------------------------------------------------------------------
200 Description: Extract email addresses. Find valid email address and
201 syntactically invalid email addresses from mailto: link
202 tags. We match syntactically invalid links containing
203 mailto: to catch anti-spam email addresses, eg. bob at
204 gmail.com. This uses the simplified email regular
205 expression from
206 http://www.regular-expressions.info/email.html for valid
207 email add
208 String : fccinfo@fcc.gov,jayne.e.berklich@abc12.com
209 String : fccinfo@fcc.gov
210
211 Google-API -----------------------------------------------------------------
212 Description: This plugin identifies references to Google API in
213 <script>.
214 String : ajax/libs/jquery/1.8.1/jquery.min.js
215
216 Google-Analytics -----------------------------------------------------------
217 Description: This plugin identifies the Google Analytics account.
218 Website : http://www.google.com/analytics/
219 Account : UA-45647629-22
220
221 HTML5 ----------------------------------------------------------------------
222 Description: HTML version 5, detected by the doctype declaration
223
224 HTTPServer -----------------------------------------------------------------
225 Description: HTTP server header string. This plugin also attempts to
226 identify the operating system from the server header.
227 String : Apache (from server string)
228
229 IP -------------------------------------------------------------------------
230 Description: IP address of the target, if available.
231 String : 69.164.35.224
232
233 JQuery ---------------------------------------------------------------------
234 Description: A fast, concise, JavaScript that simplifies how to traverse
235 HTML documents, handle events, perform animations, and add
236 AJAX. - Homepage: http://jquery.com/
237
238 Meta-Author ----------------------------------------------------------------
239 Description: This plugin retrieves the author name from the meta name
240 tag - info:
241 http://www.webmarketingnow.com/tips/meta-tags-uncovered.html
242 #author
243
244 String : WJRT
245
246 OpenGraphProtocol ----------------------------------------------------------
247 Description: The Open Graph protocol enables you to integrate your Web
248 pages into the social graph. It is currently designed for
249 Web pages representing profiles of real-world things .
250 things like movies, sports teams, celebrities, and
251 restaurants. Including Open Graph tags on your Web page,
252 makes your page equivalent to a Facebook Page.
253
254 PoweredBy ------------------------------------------------------------------
255 Description: This plugin identifies instances of 'Powered by x' text and
256 attempts to extract the value for x.
257 String : Clickability
258
259 Script ---------------------------------------------------------------------
260 Description: This plugin detects instances of script HTML elements and
261 returns the script language/type.
262 String : Javascript,Javascript1.0,Javascript1.1,Javascript1.2,Javascript1.3,Javascript1.4,Javascript1.5,Javascript1.6,Javascript1.7,Javascript1.8,Javascript1.9,application/ld+json,text/javascript
263
264 Title ----------------------------------------------------------------------
265 Description: The HTML page title
266 String : Flint, Michigan News, Weather, Sports | ABC12 WJRT (from page title)
267
268 UncommonHeaders ------------------------------------------------------------
269 Description: Uncommon HTTP server headers. The blacklist includes all
270 the standard headers and many non standard but common ones.
271 Interesting but fairly common headers should have their own
272 plugins, eg. x-powered-by, server and x-aspnet-version.
273 Info about headers can be found at www.http-stats.com
274 String : x-server-name (from headers)
275
276 Via-Proxy ------------------------------------------------------------------
277 Description: This plugin extracts the proxy server details from the Via
278 param of the HTTP header.
279 String : 1.1 la-c1-r1-u28-b2:3128 (squid)
280
281 X-UA-Compatible ------------------------------------------------------------
282 Description: This plugin retrieves the X-UA-Compatible value from the
283 HTTP header and meta http-equiv tag. - More Info:
284 http://msdn.microsoft.com/en-us/library/cc817574.aspx
285 String : IE=9
286
287
288[+] Emails found:
289------------------
290Kevin.j.wilson@abc12.com
291jessica.dupnack@abc12.com
292ABC12news@abc12.com
293jayne.e.hodak@abc12.com
294abc12news@abc12.com
295jayne.e.berklich@abc12.com
296ABC12pgm@abc12.com
297pix@abc12.com
298pete.veto@abc12.com
299
300[+] Hosts found in search engines:
301------------------------------------
302[-] Resolving hostnames IPs...
30369.164.34.128:www.abc12.com
304
305
30612.36.138.243 att.abc12.com
30764.199.12.210 mail.abc12.com
308
309Subnets found (may want to probe here using nmap or unicornscan):
310 12.36.138.0-255 : 1 hostnames found.
311 64.199.12.0-255 : 1 hostnames found.
312
313
314Checking for HTTP-Loadbalancing [Diff]: FOUND
315< X-Server-Name: va-c1-r3-u33-b2
316> X-Server-Name: va-c1-r7-u31-b2
317< Age: 7
318> Age: 43
319< Via: 1.1 va-c1-r8-u35-b1:3128 (squid)
320> Via: 1.1 va-c1-r1-u24-b2:3128 (squid)
321
322abc12.com does Load-balancing. Found via Methods: HTTP[Date] HTTP[Diff]
323
324Scanning abc12.com (208.80.56.11) [100 ports]
325Discovered open port 80/tcp on 208.80.56.11
326Completed SYN Stealth Scan at 13:13, 2.17s elapsed (100 total ports)
327Initiating Service scan at 13:13
328Scanning 1 service on abc12.com (208.80.56.11)
329Completed Service scan at 13:13, 6.11s elapsed (1 service on 1 host)
330Initiating OS detection (try #1) against abc12.com (208.80.56.11)
331Retrying OS detection (try #2) against abc12.com (208.80.56.11)
332Initiating Traceroute at 13:13
333Completed Traceroute at 13:13, 3.02s elapsed
334Initiating Parallel DNS resolution of 13 hosts. at 13:13
335Completed Parallel DNS resolution of 13 hosts. at 13:13, 0.18s elapsed
336NSE: Script scanning 208.80.56.11.
337Initiating NSE at 13:13
338Completed NSE at 13:13, 1.41s elapsed
339Initiating NSE at 13:13
340Completed NSE at 13:13, 0.00s elapsed
341Nmap scan report for abc12.com (208.80.56.11)
342Host is up (0.037s latency).
343rDNS record for 208.80.56.11: 208-80-56-11.clickability.com
344Not shown: 98 filtered ports
345PORT STATE SERVICE VERSION
34680/tcp open http Apache httpd
347|_http-favicon: Unknown favicon MD5: EAAFFC60CE04EE57CD00EDCF47A63800
348| http-methods:
349| Supported Methods: GET HEAD POST TRACE OPTIONS
350|_ Potentially risky methods: TRACE
351| http-robots.txt: 2 disallowed entries
352|_/search /searchresults
353|_http-server-header: Apache
354| http-title: Flint, Michigan News, Weather, Sports | ABC12 WJRT
355|_Requested resource was http://www.abc12.com/
356443/tcp closed https
357Device type: firewall
358Running (JUST GUESSING): F5 Networks TMOS 11.4.X (88%)
359OS CPE: cpe:/o:f5:tmos:11.4
360Aggressive OS guesses: F5 BIG-IP AFM firewall (88%)
361No exact OS matches for host (test conditions non-ideal).
362Uptime guess: 36.226 days (since Sun Apr 10 07:48:04 2016)
363Network Distance: 14 hops
364TCP Sequence Prediction: Difficulty=258 (Good luck!)
365IP ID Sequence Generation: Randomized
366
367TRACEROUTE (using port 443/tcp)
368HOP RTT ADDRESS
369
37011 41.92 ms cr02-1-4.iad3.netdc.com (65.97.48.186)
37112 33.53 ms cr01-1-1.iad3.netdc.com (65.97.56.253)
37213 43.81 ms 65.97.57.126
37314 34.32 ms 208-80-56-11.clickability.com (208.80.56.11)
374
375
376
377 [ ] URL (ENTERED): http://abc12.com
378 [!] URL (FINAL): http://www.abc12.com/
379 [!] Response Code: 301 Moved Permanently
380 [ ] Server: Apache
381 [ ] Vary: Accept-Encoding
382 [ ] X-Server-Name: la-c1-r3-u18-b1
383 [ ] Content-Type: text/html;charset=utf-8
384 [ ] Via: 1.1 la-c1-r6-u22-b1:3128 (squid)
385 [ ] Age: 6
386 [ ] Date: Mon, 16 May 2016 17:13:17 GMT
387 [ ] Last-Modified: Mon, 16 May 2016 17:12:24 GMT
388 [ ] Content-Length: 101057
389 [ ] Connection: close
390 [ ] Set-Cookie: __llnwmob=0
391 [ ] Data (MD5): 92b2e951c0290b60032dd4ddd2a7753e