Anonymous Operation Izsrael

###################################################################################
###################################################
Hostname www.ifeelgood.co.il ISP 012 Smile Communications LTD.
(AS9116)
Continent Asia Flag
IL
Country Israel Country Code IL (ISR)
Region Unknown Local time 23 Mar 2018 01:24 IST
City Unknown Latitude 31.5
IP Address 80.179.142.111 Longitude 34.75
###################################################################################
###################################################
HostIP:80.179.142.111
HostName:ifeelgood.co.il
Gathered Inet-whois information for 80.179.142.111

-----------------------------------------------------------------------------------
--------------------------------------------------
inetnum: 80.179.141.64 - 80.179.142.255

netname: GOLDENLINES-CO-LOCATION
descr: Please Send Abuse/SPAM complaints To Abuse@012.net.il
country: IL
admin-c: DR5299-RIPE
tech-c: DR5299-RIPE
status: ASSIGNED PA
mnt-by: AS9116-MNT
mnt-by: AS5486-MNT
created: 2017-06-06T09:26:33Z
last-modified: 2017-06-06T09:26:33Z
source: RIPE # Filtered
role: DNS REG

remarks: Hostmaster and LIR
remarks: 012 Smile Communications Ltd.
address: Hasivim 25 Petach-Tikva,Israel
nic-hdl: DR5299-RIPE
admin-c: PT5956-RIPE
admin-c: AT14340-RIPE
admin-c: HAI18-RIPE
admin-c: GE1901-RIPE
admin-c: ASH73-RIPE
admin-c: IK2932-RIPE
admin-c: ENT11-RIPE
tech-c: PT5956-RIPE
tech-c: HAI18-RIPE
tech-c: GE1901-RIPE
tech-c: IK2932-RIPE
tech-c: ENT11-RIPE
mnt-by: AS9116-MNT
mnt-by: PARTNERCOM-MNT
created: 2002-09-19T08:35:05Z
source: RIPE # Filtered
abuse-mailbox: abuse@012.net.il
% Information related to '80.179.142.0/24AS9116'

route: 80.179.142.0/24
descr: Golden Lines
origin: AS9116
mnt-by: AS9116-MNT
created: 2005-06-07T17:23:50Z
source: RIPE
% This query was served by the RIPE Database Query Service version 1.91.1
(BLAARKOP)
Gathered Inic-whois information for ifeelgood.co.il

-----------------------------------------------------------------------------------
----------------------------------------------------
domain: ifeelgood.co.il
descr: Yanir Levin Ltd.

descr: P.O.Box 22836
descr: Tel Aviv
descr: 61227
descr: Israel
phone: +972 3 5446364
fax-no: +972 3 5446366
e-mail: 1 AT seoweb.co.il
admin-c: IS-YL1952-IL
tech-c: IS-ID1078-IL
zone-c: IS-ID1078-IL
nserver: ns1.shivyon.co.il
validity: 17-01-2019
DNSSEC: unsigned
status: Transfer Locked
changed: domain-registrar AT isoc.org.il 20100117 (Assigned)
person: Yanir Levin

address: Yanir Levin Ltd.
address: P.O.Box 22836
address: Tel Aviv
address: 61227
address: Israel
phone: +972 3 5446364
fax-no: +972 3 5446366
nic-hdl: IS-YL1952-IL
changed: domain-registrar AT isoc.org.il 20100117
person: Interspace Domreg

address: Interspace Ltd.
address: Netanya
address: 42505
address: Israel
phone: +972 73 2224444
fax-no: +972 73 2224440
e-mail: domreg AT interspace.net
nic-hdl: IS-ID1078-IL
changed: Managing Registrar 20070110
registrar name: InterSpace Ltd

registrar info: http://www.internic.co.il
% Rights to the data above are restricted by copyright.
Gathered Netcraft information for ifeelgood.co.il

-----------------------------------------------------------------------------------
---------------------------------------------------
Retrieving Netcraft.com information for ifeelgood.co.il

Netcraft.com Information gathered
Gathered Subdomain information for ifeelgood.co.il

-----------------------------------------------------------------------------------
---------------------------------------------------
Searching Google.com:80...
Searching Altavista.com:80...
Found 0 possible subdomain(s) for host ifeelgood.co.il, Searched 0 pages containing
0 results
Gathered E-Mail information for ifeelgood.co.il

-----------------------------------------------------------------------------------
--------------------------------------------------
Searching Google.com:80...
Searching Altavista.com:80...
Found 0 E-Mail(s) for host ifeelgood.co.il, Searched 0 pages containing 0 results
Gathered TCP Port information for 80.179.142.111

-----------------------------------------------------------------------------------
--------------------------------------------------
Port State
21/tcp open
53/tcp open
80/tcp open
110/tcp open
143/tcp open
Portscan Finished: Scanned 150 ports, 135 ports were in state closed
###################################################################################
####################################################
[i] Scanning Site: http://ifeelgood.co.il
B A S I C I N F O
===================================================================================
===================================================
[+] Site Title: Ifeelgood ‫האתר המקיף לבריאות הנפש‬

[+] IP address: 80.179.142.111
[+] Web Server: nginx
[+] CMS: WordPress
[+] Cloudflare: Not Detected
[+] Robots File: Could NOT Find robots.txt!
W H O I S L O O K U P
===================================================================================
===================================================
% The data in the WHOIS database of the .il registry is provided

% by ISOC-IL for information purposes, and to assist persons in
% obtaining information about or related to a domain name
% registration record. ISOC-IL does not guarantee its accuracy.
% By submitting a WHOIS query, you agree that you will use this
% Data only for lawful purposes and that, under no circumstances
% will you use this Data to: (1) allow, enable, or otherwise
% support the transmission of mass unsolicited, commercial
% advertising or solicitations via e-mail (spam);
% or (2) enable high volume, automated, electronic processes that
% apply to ISOC-IL (or its systems).
% ISOC-IL reserves the right to modify these terms at any time.
% By submitting this query, you agree to abide by this policy.
query: ifeelgood.co.il
reg-name: ifeelgood
descr: Yanir Levin Ltd.

descr: P.O.Box 22836
descr: Tel Aviv
descr: 61227
descr: Israel
phone: +972 3 5446364
fax-no: +972 3 5446366
admin-c: IS-YL1952-IL
tech-c: IS-ID1078-IL
zone-c: IS-ID1078-IL
validity: 17-01-2019
DNSSEC: unsigned
status: Transfer Locked
changed: domain-registrar AT isoc.org.il 20100117 (Assigned)
person: Yanir Levin
address: Yanir Levin Ltd.
address: Tel Aviv
address: 61227
address: Israel
phone: +972 3 5446364
fax-no: +972 3 5446366
nic-hdl: IS-YL1952-IL
changed: domain-registrar AT isoc.org.il 20100117
person: Interspace Domreg

address: Interspace Ltd.
address: Netanya
address: 42505
address: Israel
phone: +972 73 2224444
fax-no: +972 73 2224440
e-mail: domreg AT interspace.net
nic-hdl: IS-ID1078-IL
registrar name: InterSpace Ltd

registrar info: http://www.internic.co.il
% Rights to the data above are restricted by copyright.
G E O I P L O O K U P
===================================================================================
=================================================
[i] IP Address: 80.179.142.111

[i] Country: IL
[i] State: N/A
[i] City: N/A
[i] Latitude: 31.500000
[i] Longitude: 34.750000
H T T P H E A D E R S
===================================================================================
==================================================
[i] HTTP/1.1 301 Moved Permanently

[i] Server: nginx
[i] Date: Thu, 22 Mar 2018 23:27:29 GMT
[i] Content-Type: text/html; charset=iso-8859-1
[i] Content-Length: 235
[i] Connection: close
[i] Location: http://www.ifeelgood.co.il/
[i] X-Rocket-Nginx-Bypass: No
[i] HTTP/1.1 200 OK
[i] Server: nginx
[i] Date: Thu, 22 Mar 2018 23:27:31 GMT
[i] Content-Type: text/html; charset=UTF-8
[i] Connection: close
[i] Vary: Accept-Encoding
[i] X-Powered-By: PHP/5.2.17
[i] X-Pingback: http://www.ifeelgood.co.il/xmlrpc.php
[i] Vary: Accept-Encoding,User-Agent
[i] X-Rocket-Nginx-Bypass: No
D N S L O O K U P
===================================================================================
=================================================
;; Truncated, retrying in TCP mode.

ifeelgood.co.il. 14400 IN SOA ns1.spd.co.il. hostmaster.ifeelgood.co.il.
2016061501 14400 3600 1209600 86400
ifeelgood.co.il. 14400 IN NS ns2.spd.co.il.
ifeelgood.co.il. 14400 IN NS ns1.spd.co.il.
ifeelgood.co.il. 14400 IN A 80.179.142.111
ifeelgood.co.il. 14400 IN MX 10 mailgw2.spd.co.il.
ifeelgood.co.il. 14400 IN TXT "v=spf1 a mx ip4:80.179.142.111 ~all"
S U B N E T C A L C U L A T I O N
===================================================================================
===================================================
=
Address = 80.179.142.111
Network = 80.179.142.111 / 32
Netmask = 255.255.255.255
Broadcast = not needed on Point-to-Point links
Wildcard Mask = 0.0.0.0
Hosts Bits = 0
Max. Hosts = 1 (2^0 - 0)
Host Range = { 80.179.142.111 - 80.179.142.111 }
N M A P P O R T S C A N
===================================================================================
====================================================
Starting Nmap 7.01 ( https://nmap.org ) at 2018-03-22 23:27 UTC

Nmap scan report for ifeelgood.co.il (80.179.142.111)
Host is up (0.15s latency).
rDNS record for 80.179.142.111: yanir.spd.co.il
PORT STATE SERVICE VERSION
21/tcp open ftp ProFTPD
22/tcp filtered ssh
23/tcp closed telnet
25/tcp open smtp Exim smtpd
80/tcp open http nginx
110/tcp open pop3 Dovecot DirectAdmin pop3d
143/tcp open imap Dovecot imapd
443/tcp open ssl/http nginx
445/tcp closed microsoft-ds
3389/tcp closed ms-wbt-server
Service detection performed. Please report any incorrect results at

https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 17.08 seconds
###################################################################################
####################################################
Original* ifeelgood.co.il 80.179.142.111 NS:ns1.spd.co.il
MX:mailgw2.spd.co.il
Subdomain ifeel.good.co.il 148.251.90.173 NS:dns.live4all.co.il
Subdomain ifeelgoo.d.co.il 37.19.112.17
Various ifeelgood.co-il.com 209.15.13.134 NS:ns1.dnslink.com

###################################################################################
##################################################
Ip Address Status Type Domain Name Server
---------- ------ ---- ----------- ------
80.179.142.111 200 host ftp.ifeelgood.co.il nginx
127.0.0.1 host localhost.ifeelgood.co.il
80.179.142.111 200 host mail.ifeelgood.co.il nginx
80.179.142.111 200 host pop.ifeelgood.co.il nginx
80.179.142.111 200 host smtp.ifeelgood.co.il nginx
80.179.142.111 200 host www.ifeelgood.co.il nginx
###################################################################################
####################################################
===================================================================================
===================================================
RUNNING NSLOOKUP
===================================================================================
===================================================
Server: 10.211.254.254
Address: 10.211.254.254#53
Non-authoritative answer:
Name: ifeelgood.co.il
Address: 80.179.142.111
ifeelgood.co.il has address 80.179.142.111

ifeelgood.co.il mail is handled by 10 mailgw2.spd.co.il.
===================================================================================
====================================================
CHECKING OS FINGERPRINT
===================================================================================
===================================================
Xprobe2 v.0.3 Copyright (c) 2002-2005 fyodor@o0o.nu, ofir@sys-security.com,

meder@o0o.nu
[+] Target is ifeelgood.co.il

[+] Loading modules.
[+] Following modules are loaded:
[x] [1] ping:icmp_ping - ICMP echo discovery module
[x] [2] ping:tcp_ping - TCP-based ping discovery module
[x] [3] ping:udp_ping - UDP-based ping discovery module
[x] [4] infogather:ttl_calc - TCP and UDP based TTL distance calculation
[x] [5] infogather:portscan - TCP and UDP PortScanner
[x] [6] fingerprint:icmp_echo - ICMP Echo request fingerprinting module
[x] [7] fingerprint:icmp_tstamp - ICMP Timestamp request fingerprinting module
[x] [8] fingerprint:icmp_amask - ICMP Address mask request fingerprinting module
[x] [9] fingerprint:icmp_port_unreach - ICMP port unreachable fingerprinting
module
[x] [10] fingerprint:tcp_hshake - TCP Handshake fingerprinting module
[x] [11] fingerprint:tcp_rst - TCP RST fingerprinting module
[x] [12] fingerprint:smb - SMB fingerprinting module
[x] [13] fingerprint:snmp - SNMPv2c fingerprinting module
[+] 13 modules registered
[+] Initializing scan engine
[+] Running scan engine
[-] ping:tcp_ping module: no closed/open TCP ports known on 80.179.142.111. Module
test failed
[-] ping:udp_ping module: no closed/open UDP ports known on 80.179.142.111. Module
test failed
[-] No distance calculation. 80.179.142.111 appears to be dead or no ports known
[+] Host: 80.179.142.111 is up (Guess probability: 50%)
[+] Target: 80.179.142.111 is alive. Round-Trip Time: 1.01962 sec
[+] Selected safe Round-Trip Time value is: 2.03925 sec
[-] fingerprint:tcp_hshake Module execution aborted (no open TCP ports known)
[-] fingerprint:smb need either TCP port 139 or 445 to run
[+] Primary guess:
[+] Host 80.179.142.111 Running OS: (Guess probability: 88%)
[+] Other guesses:
[+] Cleaning up scan engine
[+] Modules deinitialized
[+] Execution completed.
===================================================================================
===================================================
GATHERING WHOIS INFO
===================================================================================
===================================================
% The data in the WHOIS database of the .il registry is provided

% by ISOC-IL for information purposes, and to assist persons in
% obtaining information about or related to a domain name
% registration record. ISOC-IL does not guarantee its accuracy.
% By submitting a WHOIS query, you agree that you will use this
% Data only for lawful purposes and that, under no circumstances
% will you use this Data to: (1) allow, enable, or otherwise
% support the transmission of mass unsolicited, commercial
% advertising or solicitations via e-mail (spam);
% or (2) enable high volume, automated, electronic processes that
% apply to ISOC-IL (or its systems).
% ISOC-IL reserves the right to modify these terms at any time.
% By submitting this query, you agree to abide by this policy.
query: ifeelgood.co.il
reg-name: ifeelgood
descr: [*] ifeelgood.co.il:21 - Sending Backdoor Command

[-] ifeelgood.co.il:21 - Not backdoored
[*] Exploit completed, but no session was created.
+ -- --=[Port 22 closed... skipping.
+ -- --=[Port 53 opened... running tests...
Starting Nmap 7.60 ( https://nmap.org ) at 2018-03-22 19:38 EDT


53/tcp filtered domain
Warning: OSScan results may be unreliable because we could not find at least 1 open
and 1 closed port
Device type: firewall|general purpose
Running: Linux 2.4.X|2.6.X, ISS embedded
OS CPE: cpe:/o:linux:linux_kernel:2.4.18 cpe:/h:iss:proventia_gx3002
cpe:/o:linux:linux_kernel:2.6.22
OS details: ISS Proventia GX3002 firewall (Linux 2.4.18), Linux 2.6.22 (Debian 4.0)
Host script results:

| dns-brute:
| DNS Brute-force hostnames:
| host.co.il - 148.251.90.173
| development.co.il - 46.101.238.24
| svn.co.il - 159.65.118.35
| mysql.co.il - 216.239.32.21
| mysql.co.il - 216.239.34.21
| mysql.co.il - 216.239.36.21
| mysql.co.il - 216.239.38.21
| http.co.il - 212.150.243.210
| news.co.il - 188.166.109.104
| test.co.il - 127.0.0.1
| noc.co.il - 96.31.35.145
| images.co.il - 67.23.177.200
| test1.co.il - 192.185.236.196
| info.co.il - 104.31.92.2
| info.co.il - 104.31.93.2
| info.co.il - 2400:cb00:2048:1:0:0:681f:5c02
| info.co.il - 2400:cb00:2048:1:0:0:681f:5d02
| dns.co.il - 82.80.253.15
| ns1.co.il - 178.32.55.171
| internet.co.il - 95.175.32.10
| ns2.co.il - 92.222.209.88
| intra.co.il - 62.219.78.158
| download.co.il - 148.251.90.173
| ntp.co.il - 107.154.156.178
| ntp.co.il - 107.154.163.178
| intranet.co.il - 194.90.1.109
| test2.co.il - 209.88.192.216
| ops.co.il - 108.167.133.37
| erp.co.il - 69.163.219.179
| testing.co.il - 192.117.125.106
| upload.co.il - 192.185.139.151
| owa.co.il - 212.29.214.195
| pbx.co.il - 185.18.204.26
| exchange.co.il - 181.215.116.38
| vnc.co.il - 194.90.1.109
| voip.co.il - 212.179.240.8
| secure.co.il - 62.219.17.162
| linux.co.il - 81.218.80.235
| server.co.il - 148.251.90.173
| shop.co.il - 188.166.109.104
| local.co.il - 173.212.236.162
| sip.co.il - 213.8.172.5
| log.co.il - 82.80.201.26
| manage.co.il - 192.117.172.13
| mobile.co.il - 182.50.132.56
| monitor.co.il - 194.90.1.109
| mta.co.il - 212.199.167.22
| adserver.co.il - 195.128.177.33
| alpha.co.il - 52.19.144.59
| alpha.co.il - 54.154.75.176
| app.co.il - 34.242.176.33
| apps.co.il - 72.52.4.122
| beta.co.il - 185.70.251.47
| blog.co.il - 212.143.60.51
| firewall.co.il - 62.219.67.17
| web.co.il - 192.115.21.75
| forum.co.il - 62.219.11.147
| ftp.co.il - 198.23.57.32
| sql.co.il - 192.254.237.210
| whois.co.il - 109.74.198.188
| squid.co.il - 23.99.97.249
| git.co.il - 81.218.229.200
| ssh.co.il - 81.218.229.185
| www2.co.il - 64.90.49.227
| ssl.co.il - 82.80.253.21
| help.co.il - 82.80.209.181
| stage.co.il - 52.58.94.54
| chat.co.il - 95.175.47.103
| citrix.co.il - 165.160.13.20
| citrix.co.il - 165.160.15.20
| cms.co.il - 194.90.203.76
| corp.co.il - 204.93.178.102
| crs.co.il - 136.243.93.246
| cvs.co.il - 194.90.8.80
| demo.co.il - 212.235.14.43
|_ dev.co.il - 80.179.11.157
TRACEROUTE (using proto 1/icmp)

HOP RTT ADDRESS
1 ... 30
OS and Service detection performed. Please report any incorrect results at

===================================================================================
====================================================
CHECKING FOR WAF
===================================================================================
===================================================
^ ^
_ __ _ ____ _ __ _ _ ____
///7/ /.' \ / __////7/ /,' \ ,' \ / __/
| V V // o // _/ | V V // 0 // 0 // _/
|_n_,'/_n_//_/ |_n_,' \_,' \_,'/_/
<
...'
WAFW00F - Web Application Firewall Detection Tool
By Sandro Gauci && Wendel G. Henrique
Checking http://ifeelgood.co.il
Generic Detection results:
The site http://ifeelgood.co.il seems to be behind a WAF or some sort of security
solution
Reason: The server returned a different response code when a string trigged the
blacklist.
Normal response code is "301", while the response code to an attack is "302"
Number of requests: 11
===================================================================================
===================================================
GATHERING HTTP INFO
===================================================================================
===================================================
__ ______ _____
\ \/ / ___|_ _|
\ /\___ \ | |
/ \ ___) || |
/_/\_|____/ |_|
+ -- --=[Cross-Site Tracer v1.3 by 1N3 @ CrowdShield

+ -- --=[Target: ifeelgood.co.il:80
===================================================================================
==================================================
CHECKING HTTP HEADERS
===================================================================================
==================================================
+ -- --=[Checking if X-Content options are enabled on ifeelgood.co.il...
+ -- --=[Checking if X-Frame options are enabled on ifeelgood.co.il...
+ -- --=[Checking if X-XSS-Protection header is enabled on ifeelgood.co.il...
+ -- --=[Checking HTTP methods on ifeelgood.co.il...
+ -- --=[Checking if TRACE method is enabled on ifeelgood.co.il...
+ -- --=[Checking for META tags on ifeelgood.co.il...
+ -- --=[Checking for open proxy on ifeelgood.co.il...

<html>Nginx is functioning normally</html>
+ -- --=[Enumerating software on ifeelgood.co.il...

Server: nginx
+ -- --=[Checking if Strict-Transport-Security is enabled on ifeelgood.co.il...
+ -- --=[Checking for Flash cross-domain policy on ifeelgood.co.il...

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>301 Moved Permanently</title>
</head><body>
<h1>Moved Permanently</h1>
<p>The document has moved <a
href="http://www.ifeelgood.co.il/crossdomain.xml">here</a>.</p>
</body></html>
+ -- --=[Checking for Silverlight cross-domain policy on ifeelgood.co.il...

<html><head>
</head><body>
href="http://www.ifeelgood.co.il/clientaccesspolicy.xml">here</a>.</p>
</body></html>
+ -- --=[Checking for HTML5 cross-origin resource sharing on ifeelgood.co.il...
+ -- --=[Retrieving robots.txt on ifeelgood.co.il...

<html><head>
</head><body>
href="http://www.ifeelgood.co.il/robots.txt">here</a>.</p>
</body></html>
+ -- --=[Retrieving sitemap.xml on ifeelgood.co.il...

<html><head>
</head><body>
href="http://www.ifeelgood.co.il/sitemap.xml">here</a>.</p>
</body></html>
+ -- --=[Checking cookie attributes on ifeelgood.co.il...
+ -- --=[Checking for ASP.NET Detailed Errors on ifeelgood.co.il...
===================================================================================
====================================================
SAVING SCREENSHOTS
===================================================================================
====================================================
[+] Screenshot saved to
/usr/share/sniper/loot/ifeelgood.co.il/screenshots/ifeelgood.co.il-port80.jpg


110/tcp filtered pop3
and 1 closed port
Network Distance: 1 hop
TRACEROUTE (using port 443/tcp)

HOP RTT ADDRESS
1 701.21 ms yanir.spd.co.il (80.179.142.111)

===================================================================================
===================================================
CHECKING FOR WAF
===================================================================================
===================================================
^ ^
_ __ _ ____ _ __ _ _ ____
///7/ /.' \ / __////7/ /,' \ ,' \ / __/
| V V // o // _/ | V V // 0 // 0 // _/
|_n_,'/_n_//_/ |_n_,' \_,' \_,'/_/
<
...'
Checking https://ifeelgood.co.il
The site https://ifeelgood.co.il seems to be behind a WAF or some sort of security
solution
Reason: The server returned a different response code when a string trigged the
blacklist.
Normal response code is "404", while the response code to an attack is "302"
===================================================================================
=================================================
GATHERING HTTP INFO
===================================================================================
=================================================
===================================================================================
================================================
CHECKING HTTP HEADERS
===================================================================================
================================================
+ -- --=[Checking if X-Content options are enabled on ifeelgood.co.il...
+ -- --=[Checking if X-Frame options are enabled on ifeelgood.co.il...
+ -- --=[Checking if X-XSS-Protection header is enabled on ifeelgood.co.il...
+ -- --=[Checking HTTP methods on ifeelgood.co.il...
+ -- --=[Checking if TRACE method is enabled on ifeelgood.co.il...
+ -- --=[Checking for META tags on ifeelgood.co.il...
+ -- --=[Checking for open proxy on ifeelgood.co.il...
+ -- --=[Enumerating software on ifeelgood.co.il...

server: nginx
+ -- --=[Checking if Strict-Transport-Security is enabled on ifeelgood.co.il...
+ -- --=[Checking for Flash cross-domain policy on ifeelgood.co.il...

<html><head>
<title>404 Not Found</title>
</head><body>
<h1>Not Found</h1>
<p>The requested URL /crossdomain.xml was not found on this server.</p>
<p>Additionally, a 404 Not Found
error was encountered while trying to use an ErrorDocument to handle the
request.</p>
</body></html>
+ -- --=[Checking for Silverlight cross-domain policy on ifeelgood.co.il...

<html><head>
</head><body>
<h1>Not Found</h1>
<p>The requested URL /clientaccesspolicy.xml was not found on this server.</p>
request.</p>
</body></html>
+ -- --=[Checking for HTML5 cross-origin resource sharing on ifeelgood.co.il...
+ -- --=[Retrieving robots.txt on ifeelgood.co.il...

<html><head>
</head><body>
<h1>Not Found</h1>
<p>The requested URL /robots.txt was not found on this server.</p>
request.</p>
</body></html>
+ -- --=[Retrieving sitemap.xml on ifeelgood.co.il...

<html><head>
</head><body>
<h1>Not Found</h1>
<p>The requested URL /sitemap.xml was not found on this server.</p>
request.</p>
</body></html>
+ -- --=[Checking cookie attributes on ifeelgood.co.il...
+ -- --=[Checking for ASP.NET Detailed Errors on ifeelgood.co.il...

request.</p>
request.</p>
===================================================================================
===================================================
GATHERING SSL/TLS INFO
===================================================================================
===================================================
AVAILABLE PLUGINS
-----------------
PluginHSTS
PluginCertInfo
PluginOpenSSLCipherSuites
PluginSessionRenegotiation
PluginChromeSha1Deprecation
PluginHeartbleed
PluginSessionResumption
PluginCompression
CHECKING HOST(S) AVAILABILITY
-----------------------------------------------------------------------------------
---------------------------------------------------
ifeelgood.co.il:443 => 80.179.142.111:443
SCAN RESULTS FOR IFEELGOOD.CO.IL:443 - 80.179.142.111:443
-----------------------------------------------------------------------------------
---------------------------------------------------
* Deflate Compression:
OK - Compression disabled
* Session Renegotiation:
Client-initiated Renegotiations: OK - Rejected
Secure Renegotiation: OK - Supported
* Certificate - Content:
SHA1 Fingerprint: f06c27af6a2bb1913392b7926445a9259d73731e
Common Name: localhost
Issuer: localhost
Serial Number: C9C86319C823F93B
Not Before: Mar 8 07:53:03 2016 GMT
Not After: Jul 24 07:53:03 2043 GMT
Signature Algorithm: sha1WithRSAEncryption
Public Key Algorithm: rsaEncryption
Key Size: 2048 bit
Exponent: 65537 (0x10001)
* Certificate - Trust:
Hostname Validation: FAILED - Certificate does NOT match
ifeelgood.co.il
Google CA Store (09/2015): FAILED - Certificate is NOT Trusted: self
signed certificate
Java 6 CA Store (Update 65): FAILED - Certificate is NOT Trusted: self
signed certificate
Microsoft CA Store (09/2015): FAILED - Certificate is NOT Trusted: self
signed certificate
Apple CA Store (OS X 10.10.5): FAILED - Certificate is NOT Trusted: self
signed certificate
Mozilla NSS CA Store (09/2015): FAILED - Certificate is NOT Trusted: self
signed certificate
Certificate Chain Received: ['localhost', 'COMODO High-Assurance
Secure Server CA', 'AddTrust External CA Root', 'GlobalSign Root CA', 'thawte
Primary Root CA', 'VeriSign Class 3 Secure Server CA - G3', 'VeriSign Class 3
Public Primary Certification Authority - G5']
* Certificate - OCSP Stapling:

NOT SUPPORTED - Server did not send back an OCSP response.
* Session Resumption:
With Session IDs: OK - Supported (5 successful, 0 failed, 0
errors, 5 total attempts).
With TLS Session Tickets: OK - Supported
* SSLV2 Cipher Suites:

Server rejected all cipher suites.
* SSLV3 Cipher Suites:

Server rejected all cipher suites.
SCAN COMPLETED IN 17.60 S
-----------------------------------------------------------------------------------
---------------------------------------------------
Version: 1.11.11-static
OpenSSL 1.0.2-chacha (1.0.2g-dev)
Connected to 80.179.142.111
Testing SSL server ifeelgood.co.il on port 443 using SNI name ifeelgood.co.il
TLS Fallback SCSV:

Server supports TLS Fallback SCSV
TLS renegotiation:
Secure session renegotiation supported
TLS Compression:
Compression disabled
Heartbleed:
TLS 1.2 not vulnerable to heartbleed
Supported Server Cipher(s):

Preferred TLSv1.2 128 bits ECDHE-RSA-AES128-GCM-SHA256 Curve P-256 DHE 256
Accepted TLSv1.2 256 bits ECDHE-RSA-AES256-GCM-SHA384 Curve P-256 DHE 256
Accepted TLSv1.2 128 bits DHE-RSA-AES128-GCM-SHA256 DHE 2048 bits
Accepted TLSv1.2 256 bits DHE-RSA-AES256-GCM-SHA384 DHE 2048 bits
Accepted TLSv1.2 128 bits ECDHE-RSA-AES128-SHA256 Curve P-256 DHE 256
Accepted TLSv1.2 128 bits ECDHE-RSA-AES128-SHA Curve P-256 DHE 256
Accepted TLSv1.2 256 bits ECDHE-RSA-AES256-SHA384 Curve P-256 DHE 256
Accepted TLSv1.2 128 bits DHE-RSA-AES128-SHA256 DHE 2048 bits
Accepted TLSv1.2 128 bits DHE-RSA-AES128-SHA DHE 2048 bits
Accepted TLSv1.2 256 bits DHE-RSA-AES256-SHA256 DHE 2048 bits
Accepted TLSv1.2 112 bits ECDHE-RSA-DES-CBC3-SHA Curve P-256 DHE 256
Accepted TLSv1.2 128 bits AES128-GCM-SHA256
Accepted TLSv1.2 256 bits AES256-GCM-SHA384
Accepted TLSv1.2 128 bits AES128-SHA256
Accepted TLSv1.2 256 bits AES256-SHA256
Accepted TLSv1.2 128 bits AES128-SHA
Accepted TLSv1.2 256 bits DHE-RSA-CAMELLIA256-SHA DHE 2048 bits
Accepted TLSv1.2 256 bits CAMELLIA256-SHA
Accepted TLSv1.2 112 bits DES-CBC3-SHA
Preferred TLSv1.1 128 bits ECDHE-RSA-AES128-SHA Curve P-256 DHE 256
Preferred TLSv1.0 128 bits ECDHE-RSA-AES128-SHA Curve P-256 DHE 256
SSL Certificate:
Signature Algorithm: sha1WithRSAEncryption
RSA Key Strength: 2048
Subject: localhost
Issuer: localhost
Not valid before: Mar 8 07:53:03 2016 GMT

Not valid after: Jul 24 07:53:03 2043 GMT
===================================================================================
==================================================
SAVING SCREENSHOTS
===================================================================================
=================================================
[+] Screenshot saved to
/usr/share/sniper/loot/ifeelgood.co.il/screenshots/ifeelgood.co.il-port443.jpg
^ ^
_ __ _ ____ _ __ _ _ ____
///7/ /.' \ / __////7/ /,' \ ,' \ / __/
| V V // o // _/ | V V // 0 // 0 // _/
|_n_,'/_n_//_/ |_n_,' \_,' \_,'/_/
<
...'
Checking http://ifeelgood.co.il:8080
No WAF detected by the generic detection
__ ______ _____
\ \/ / ___|_ _|
\ /\___ \ | |
/ \ ___) || |
/_/\_|____/ |_|
+ -- --=[Cross-Site Tracer v1.3 by 1N3 @ CrowdShield

+ -- --=[Target: ifeelgood.co.il:8080
+ -- --=[Site not vulnerable to Cross-Site Tracing!
+ -- --=[Site not vulnerable to Host Header Injection!
+ -- --=[Site vulnerable to Cross-Frame Scripting!
+ -- --=[Site vulnerable to Clickjacking!
HTTP/1.1 400 Bad Request
Date: Thu, 22 Mar 2018 23:52:32 GMT
Server: Apache/6.6.6
Content-Length: 347
Connection: close
Content-Type: text/html; charset=iso-8859-1

<html><head>
<title>400 Bad Request</title>
</head><body>
<h1>Bad Request</h1>
<p>Your browser sent a request that this server could not understand.<br />
</p>
<p>Additionally, a 400 Bad Request
request.</p>
</body></html>
HTTP/1.1 400 Bad Request

Date: Thu, 22 Mar 2018 23:52:36 GMT
Server: Apache/6.6.6
Content-Length: 347
Connection: close
Content-Type: text/html; charset=iso-8859-1

<html><head>
<title>400 Bad Request</title>
</head><body>
<h1>Bad Request</h1>
<p>Your browser sent a request that this server could not understand.<br />
</p>
<p>Additionally, a 400 Bad Request
request.</p>
</body></html>
Version: 1.11.11-static
OpenSSL 1.0.2-chacha (1.0.2g-dev)
Connected to 80.179.142.111
Testing SSL server ifeelgood.co.il on port 8080 using SNI name ifeelgood.co.il
TLS Fallback SCSV:

Server does not support TLS Fallback SCSV
TLS renegotiation:
Session renegotiation not supported
TLS Compression:
Compression disabled
Heartbleed:
Supported Server Cipher(s):


8080/tcp filtered http-proxy
and 1 closed port
TRACEROUTE (using proto 1/icmp)

HOP RTT ADDRESS
1 ... 30

Call trans opt: received. 2-19-98 13:24:18 REC:Loc
=[ metasploit v4.16.45-dev ]
+ -- --=[ 1744 exploits - 1000 auxiliary - 302 post ]
+ -- --=[ 529 payloads - 40 encoders - 10 nops ]
+ -- --=[ Free Metasploit Pro trial: http://r-7.co/trymsp ]
RHOST => ifeelgood.co.il

[-] WAR file not found
[*] Auxiliary module execution completed
RHOSTS => ifeelgood.co.il
[!] RHOST is not a valid option for this module. Did you mean RHOSTS?
RHOST => ifeelgood.co.il
RPORT => 8080
[*] Scanned 1 of 1 hosts (100% complete)
[*] Attempting to connect to 80.179.142.111:8080
[+] No File(s) found
[*] http://80.179.142.111:8080/admin/j_security_check - Checking
j_security_check...
[*] http://80.179.142.111:8080/admin/j_security_check - Server returned: 404
[-] http://80.179.142.111:8080/admin/j_security_check - Unable to enumerate users
with this URI
[-] http://80.179.142.111:8080 - Authorization not requested
[-] Exploit aborted due to failure: not-found: The target server fingerprint
"Apache/6.6.6" does not match "(?-mix:Apache.*(Coyote|Tomcat))", use 'set
FingerprintCheck false' to disable this check.
USERNAME => tomcat
PASSWORD => tomcat
[-] Exploit aborted due to failure: not-found: The target server fingerprint
"Apache/6.6.6" does not match "(?-mix:Apache.*(Coyote|Tomcat))", use 'set
FingerprintCheck false' to disable this check.
===================================================================================
===============================================
RUNNING JEXBOSS
===================================================================================
================================================
* --- JexBoss: Jboss verify and EXploitation Tool --- *

| * And others Java Deserialization Vulnerabilities * |
| |
| @author: João Filho Matos Figueiredo |
| @contact: joaomatosf@gmail.com |
| |
| @update: https://github.com/joaomatosf/jexboss |
#______________________________________________________#
@version: 1.2.4
* Checking for updates in: http://joaomatosf.com/rnp/releases.txt **
** Checking Host: http://ifeelgood.co.il:8080 **
[*] Checking admin-console: [ REDIRECT ]

* The server sent a redirect to: http://www.ifeelgood.co.il/
[*] Checking Struts2: [ OK ]

[*] Checking Servlet Deserialization: [ OK ]
[*] Checking Application Deserialization: [ OK ]
[*] Checking Jenkins: [ OK ]
[*] Checking web-console: [ OK ]
[*] Checking jmx-console: [ REDIRECT ]
* The server sent a redirect to: http://www.ifeelgood.co.il/
[*] Checking JMXInvokerServlet: [ OK ]
* Results:
The server is not vulnerable to bugs tested ... :D
* Info: review, suggestions, updates, etc:

https://github.com/joaomatosf/jexboss
* DONATE: Please consider making a donation to help improve this tool,

* Bitcoin Address: 14x4niEpfp7CegBYr3tTzTn4h6DAnDCD9C

###################################################################################
####################################################
_[ - ]::---------------------------------------------------------------------------
-----------------------------------
|_[ + ] [ 8 / 100 ]-[19:49:50] [ - ]
|_[ + ] Target:: [ http://www.ifeelgood.co.il/?p=597 ]
|_[ + ] Exploit::
|_[ + ] Information Server:: HTTP/1.1 200 OK, Server: nginx X-Powered-By:
PHP/5.2.17, IP:80.179.142.111:80
|_[ + ] More details:: / - / , ISP:
|_[ + ] Found:: UNIDENTIFIED
_[ - ]::---------------------------------------------------------------------------
-----------------------------------
|_[ + ] [ 9 / 100 ]-[19:49:55] [ - ]
|_[ + ] Exploit::
PHP/5.2.17, IP:80.179.142.111:80
_[ - ]::---------------------------------------------------------------------------
-----------------------------------
|_[ + ] [ 10 / 100 ]-[19:50:02] [ - ]
|_[ + ] Exploit::
PHP/5.2.17, IP:80.179.142.111:80
|_[ + ] ERROR CONECTION:: Operation timed out after 5000 milliseconds with 38112
bytes received
_[ - ]::---------------------------------------------------------------------------
-----------------------------------
|_[ + ] [ 11 / 100 ]-[19:50:07] [ - ]
|_[ + ] Exploit::
PHP/5.2.17, IP:80.179.142.111:80
_[ - ]::---------------------------------------------------------------------------
-----------------------------------
|_[ + ] [ 12 / 100 ]-[19:50:10] [ - ]
|_[ + ] Exploit::
|_[ + ] Information Server:: HTTP/1.1 302 Found, Server: nginx ,
IP:80.179.142.111:80
_[ - ]::---------------------------------------------------------------------------
-----------------------------------
|_[ + ] [ 13 / 100 ]-[19:50:16] [ - ]
|_[ + ] Exploit::
PHP/5.2.17, IP:80.179.142.111:80
_[ - ]::---------------------------------------------------------------------------
-----------------------------------
|_[ + ] [ 14 / 100 ]-[19:50:21] [ - ]
|_[ + ] Exploit::
PHP/5.2.17, IP:80.179.142.111:80
_[ - ]::---------------------------------------------------------------------------
-----------------------------------
|_[ + ] [ 15 / 100 ]-[19:50:26] [ - ]
|_[ + ] Exploit::
PHP/5.2.17, IP:80.179.142.111:80
_[ - ]::---------------------------------------------------------------------------
-----------------------------------
|_[ + ] [ 16 / 100 ]-[19:50:32] [ - ]
|_[ + ] Exploit::
PHP/5.2.17, IP:80.179.142.111:80
_[ - ]::---------------------------------------------------------------------------
-----------------------------------
|_[ + ] [ 17 / 100 ]-[19:50:37] [ - ]
|_[ + ] Exploit::
PHP/5.2.17, IP:80.179.142.111:80
_[ - ]::---------------------------------------------------------------------------
-----------------------------------
|_[ + ] [ 18 / 100 ]-[19:50:42] [ - ]
|_[ + ] Exploit::
PHP/5.2.17, IP:80.179.142.111:80
_[ - ]::---------------------------------------------------------------------------
-----------------------------------
|_[ + ] [ 19 / 100 ]-[19:50:48] [ - ]
|_[ + ] Exploit::
PHP/5.2.17, IP:80.179.142.111:80
_[ - ]::---------------------------------------------------------------------------
-----------------------------------
|_[ + ] [ 20 / 100 ]-[19:50:54] [ - ]
|_[ + ] Exploit::
PHP/5.2.17, IP:80.179.142.111:80
_[ - ]::---------------------------------------------------------------------------
-----------------------------------
|_[ + ] [ 21 / 100 ]-[19:50:59] [ - ]
|_[ + ] Exploit::
PHP/5.2.17, IP:80.179.142.111:80
_[ - ]::---------------------------------------------------------------------------
-----------------------------------
|_[ + ] [ 22 / 100 ]-[19:51:04] [ - ]
|_[ + ] Exploit::
PHP/5.2.17, IP:80.179.142.111:80
_[ - ]::---------------------------------------------------------------------------
-----------------------------------
|_[ + ] [ 23 / 100 ]-[19:51:11] [ - ]
|_[ + ] Exploit::
PHP/5.2.17, IP:80.179.142.111:80
bytes received
_[ - ]::---------------------------------------------------------------------------
-----------------------------------
|_[ + ] [ 24 / 100 ]-[19:51:17] [ - ]
|_[ + ] Exploit::
PHP/5.2.17, IP:80.179.142.111:80
_[ - ]::---------------------------------------------------------------------------
-----------------------------------
|_[ + ] [ 25 / 100 ]-[19:51:22] [ - ]
|_[ + ] Exploit::
PHP/5.2.17, IP:80.179.142.111:80
_[ - ]::---------------------------------------------------------------------------
-----------------------------------
|_[ + ] [ 26 / 100 ]-[19:51:30] [ - ]
|_[ + ] Exploit::
PHP/5.2.17, IP:80.179.142.111:80
_[ - ]::---------------------------------------------------------------------------
-----------------------------------
|_[ + ] [ 27 / 100 ]-[19:51:35] [ - ]
|_[ + ] Exploit::
PHP/5.2.17, IP:80.179.142.111:80
_[ - ]::---------------------------------------------------------------------------
-----------------------------------
|_[ + ] [ 28 / 100 ]-[19:51:40] [ - ]
|_[ + ] Exploit::
PHP/5.2.17, IP:80.179.142.111:80
_[ - ]::---------------------------------------------------------------------------
-----------------------------------
|_[ + ] [ 29 / 100 ]-[19:51:46] [ - ]
|_[ + ] Exploit::
PHP/5.2.17, IP:80.179.142.111:80
_[ - ]::---------------------------------------------------------------------------
-----------------------------------
|_[ + ] [ 30 / 100 ]-[19:51:51] [ - ]
|_[ + ] Exploit::
PHP/5.2.17, IP:80.179.142.111:80
_[ - ]::---------------------------------------------------------------------------
-----------------------------------
|_[ + ] [ 31 / 100 ]-[19:51:57] [ - ]
|_[ + ] Exploit::
PHP/5.2.17, IP:80.179.142.111:80
_[ - ]::---------------------------------------------------------------------------
-----------------------------------
|_[ + ] [ 32 / 100 ]-[19:52:02] [ - ]
|_[ + ] Exploit::
PHP/5.2.17, IP:80.179.142.111:80
_[ - ]::---------------------------------------------------------------------------
-----------------------------------
|_[ + ] [ 33 / 100 ]-[19:52:04] [ - ]
|_[ + ] Target:: [ http://www.ifeelgood.co.il/?page_id=161 ]
|_[ + ] Exploit::
IP:80.179.142.111:80
_[ - ]::---------------------------------------------------------------------------
-----------------------------------
|_[ + ] [ 34 / 100 ]-[19:52:10] [ - ]
|_[ + ] Exploit::
PHP/5.2.17, IP:80.179.142.111:80
_[ - ]::---------------------------------------------------------------------------
-----------------------------------
|_[ + ] [ 35 / 100 ]-[19:52:16] [ - ]
|_[ + ] Exploit::
PHP/5.2.17, IP:80.179.142.111:80
_[ - ]::---------------------------------------------------------------------------
-----------------------------------
|_[ + ] [ 36 / 100 ]-[19:52:21] [ - ]
|_[ + ] Exploit::
PHP/5.2.17, IP:80.179.142.111:80
_[ - ]::---------------------------------------------------------------------------
-----------------------------------
|_[ + ] [ 37 / 100 ]-[19:52:27] [ - ]
|_[ + ] Exploit::
PHP/5.2.17, IP:80.179.142.111:80
_[ - ]::---------------------------------------------------------------------------
-----------------------------------
|_[ + ] [ 38 / 100 ]-[19:52:33] [ - ]
|_[ + ] Exploit::
PHP/5.2.17, IP:80.179.142.111:80
bytes received
_[ - ]::---------------------------------------------------------------------------
-----------------------------------
|_[ + ] [ 39 / 100 ]-[19:52:38] [ - ]
|_[ + ] Exploit::
PHP/5.2.17, IP:80.179.142.111:80
_[ - ]::---------------------------------------------------------------------------
-----------------------------------
|_[ + ] [ 40 / 100 ]-[19:52:44] [ - ]
|_[ + ] Exploit::
PHP/5.2.17, IP:80.179.142.111:80
_[ - ]::---------------------------------------------------------------------------
-----------------------------------
|_[ + ] [ 41 / 100 ]-[19:52:49] [ - ]
|_[ + ] Exploit::
PHP/5.2.17, IP:80.179.142.111:80
_[ - ]::---------------------------------------------------------------------------
-----------------------------------
|_[ + ] [ 42 / 100 ]-[19:52:55] [ - ]
|_[ + ] Exploit::
PHP/5.2.17, IP:80.179.142.111:80
_[ - ]::---------------------------------------------------------------------------
-----------------------------------
|_[ + ] [ 43 / 100 ]-[19:53:01] [ - ]
|_[ + ] Exploit::
PHP/5.2.17, IP:80.179.142.111:80
_[ - ]::---------------------------------------------------------------------------
-----------------------------------
|_[ + ] [ 44 / 100 ]-[19:53:06] [ - ]
|_[ + ] Exploit::
PHP/5.2.17, IP:80.179.142.111:80
_[ - ]::---------------------------------------------------------------------------
-----------------------------------
|_[ + ] [ 45 / 100 ]-[19:53:13] [ - ]
|_[ + ] Exploit::
PHP/5.2.17, IP:80.179.142.111:80
_[ - ]::---------------------------------------------------------------------------
-----------------------------------
|_[ + ] [ 46 / 100 ]-[19:53:21] [ - ]
|_[ + ] Exploit::
PHP/5.2.17, IP:80.179.142.111:80
bytes received
_[ - ]::---------------------------------------------------------------------------
-----------------------------------
|_[ + ] [ 47 / 100 ]-[19:53:28] [ - ]
|_[ + ] Exploit::
PHP/5.2.17, IP:80.179.142.111:80
bytes received
_[ - ]::---------------------------------------------------------------------------
-----------------------------------
|_[ + ] [ 48 / 100 ]-[19:53:34] [ - ]
|_[ + ] Exploit::
PHP/5.2.17, IP:80.179.142.111:80
bytes received
_[ - ]::---------------------------------------------------------------------------
-----------------------------------
|_[ + ] [ 49 / 100 ]-[19:53:40] [ - ]
|_[ + ] Exploit::
PHP/5.2.17, IP:80.179.142.111:80
_[ - ]::---------------------------------------------------------------------------
-----------------------------------
|_[ + ] [ 50 / 100 ]-[19:53:45] [ - ]
|_[ + ] Exploit::
PHP/5.2.17, IP:80.179.142.111:80
_[ - ]::---------------------------------------------------------------------------
-----------------------------------
|_[ + ] [ 51 / 100 ]-[19:53:53] [ - ]
|_[ + ] Exploit::
PHP/5.2.17, IP:80.179.142.111:80
bytes received
_[ - ]::---------------------------------------------------------------------------
-----------------------------------
|_[ + ] [ 52 / 100 ]-[19:53:59] [ - ]
|_[ + ] Exploit::
PHP/5.2.17, IP:80.179.142.111:80
_[ - ]::---------------------------------------------------------------------------
-----------------------------------
|_[ + ] [ 53 / 100 ]-[19:54:06] [ - ]
|_[ + ] Exploit::
PHP/5.2.17, IP:80.179.142.111:80
_[ - ]::---------------------------------------------------------------------------
-----------------------------------
|_[ + ] [ 54 / 100 ]-[19:54:11] [ - ]
|_[ + ] Exploit::
PHP/5.2.17, IP:80.179.142.111:80
_[ - ]::---------------------------------------------------------------------------
-----------------------------------
|_[ + ] [ 55 / 100 ]-[19:54:19] [ - ]
|_[ + ] Exploit::
PHP/5.2.17, IP:80.179.142.111:80
bytes received
_[ - ]::---------------------------------------------------------------------------
-----------------------------------
|_[ + ] [ 56 / 100 ]-[19:54:24] [ - ]
|_[ + ] Exploit::
PHP/5.2.17, IP:80.179.142.111:80
_[ - ]::---------------------------------------------------------------------------
-----------------------------------
|_[ + ] [ 57 / 100 ]-[19:54:31] [ - ]
|_[ + ] Exploit::
PHP/5.2.17, IP:80.179.142.111:80
_[ - ]::---------------------------------------------------------------------------
-----------------------------------
|_[ + ] [ 58 / 100 ]-[19:54:37] [ - ]
|_[ + ] Exploit::
PHP/5.2.17, IP:80.179.142.111:80
bytes received
_[ - ]::---------------------------------------------------------------------------
-----------------------------------
|_[ + ] [ 59 / 100 ]-[19:54:43] [ - ]
|_[ + ] Exploit::
PHP/5.2.17, IP:80.179.142.111:80
_[ - ]::---------------------------------------------------------------------------
-----------------------------------
|_[ + ] [ 60 / 100 ]-[19:54:53] [ - ]
|_[ + ] Exploit::
PHP/5.2.17, IP:80.179.142.111:80
bytes received
_[ - ]::---------------------------------------------------------------------------
-----------------------------------
|_[ + ] [ 61 / 100 ]-[19:54:59] [ - ]
|_[ + ] Exploit::
PHP/5.2.17, IP:80.179.142.111:80
bytes received
_[ - ]::---------------------------------------------------------------------------
-----------------------------------
|_[ + ] [ 62 / 100 ]-[19:55:05] [ - ]
|_[ + ] Exploit::
PHP/5.2.17, IP:80.179.142.111:80
_[ - ]::---------------------------------------------------------------------------
-----------------------------------
|_[ + ] [ 63 / 100 ]-[19:55:11] [ - ]
|_[ + ] Exploit::
PHP/5.2.17, IP:80.179.142.111:80
_[ - ]::---------------------------------------------------------------------------
-----------------------------------
|_[ + ] [ 64 / 100 ]-[19:55:18] [ - ]
|_[ + ] Exploit::
PHP/5.2.17, IP:80.179.142.111:80
_[ - ]::---------------------------------------------------------------------------
-----------------------------------
|_[ + ] [ 65 / 100 ]-[19:55:23] [ - ]
|_[ + ] Exploit::
PHP/5.2.17, IP:80.179.142.111:80
_[ - ]::---------------------------------------------------------------------------
-----------------------------------
|_[ + ] [ 66 / 100 ]-[19:55:27] [ - ]
|_[ + ] Exploit::
PHP/5.2.17, IP:80.179.142.111:80
_[ - ]::---------------------------------------------------------------------------
-----------------------------------
|_[ + ] [ 67 / 100 ]-[19:55:33] [ - ]
|_[ + ] Target:: [ http://www.ifeelgood.co.il/?p=13&cpage=1 ]
|_[ + ] Exploit::
PHP/5.2.17, IP:80.179.142.111:80
_[ - ]::---------------------------------------------------------------------------
-----------------------------------
|_[ + ] [ 68 / 100 ]-[19:55:38] [ - ]
|_[ + ] Exploit::
PHP/5.2.17, IP:80.179.142.111:80
_[ - ]::---------------------------------------------------------------------------
-----------------------------------
|_[ + ] [ 69 / 100 ]-[19:55:44] [ - ]
|_[ + ] Exploit::
PHP/5.2.17, IP:80.179.142.111:80
bytes received
_[ - ]::---------------------------------------------------------------------------
-----------------------------------
|_[ + ] [ 70 / 100 ]-[19:55:51] [ - ]
|_[ + ] Exploit::
PHP/5.2.17, IP:80.179.142.111:80
_[ - ]::---------------------------------------------------------------------------
-----------------------------------
|_[ + ] [ 71 / 100 ]-[19:55:57] [ - ]
|_[ + ] Exploit::
PHP/5.2.17, IP:80.179.142.111:80
_[ - ]::---------------------------------------------------------------------------
-----------------------------------
|_[ + ] [ 72 / 100 ]-[19:56:02] [ - ]
|_[ + ] Exploit::
PHP/5.2.17, IP:80.179.142.111:80
_[ - ]::---------------------------------------------------------------------------
-----------------------------------
|_[ + ] [ 73 / 100 ]-[19:56:09] [ - ]
|_[ + ] Exploit::
PHP/5.2.17, IP:80.179.142.111:80
_[ - ]::---------------------------------------------------------------------------
-----------------------------------
|_[ + ] [ 74 / 100 ]-[19:56:14] [ - ]
|_[ + ] Exploit::
PHP/5.2.17, IP:80.179.142.111:80
_[ - ]::---------------------------------------------------------------------------
-----------------------------------
|_[ + ] [ 75 / 100 ]-[19:56:19] [ - ]
|_[ + ] Exploit::
PHP/5.2.17, IP:80.179.142.111:80
_[ - ]::---------------------------------------------------------------------------
-----------------------------------
|_[ + ] [ 76 / 100 ]-[19:56:25] [ - ]
|_[ + ] Exploit::
PHP/5.2.17, IP:80.179.142.111:80
_[ - ]::---------------------------------------------------------------------------
-----------------------------------
|_[ + ] [ 77 / 100 ]-[19:56:31] [ - ]
|_[ + ] Exploit::
PHP/5.2.17, IP:80.179.142.111:80
_[ - ]::---------------------------------------------------------------------------
-----------------------------------
|_[ + ] [ 78 / 100 ]-[19:56:37] [ - ]
|_[ + ] Exploit::
PHP/5.2.17, IP:80.179.142.111:80
_[ - ]::---------------------------------------------------------------------------
-----------------------------------
|_[ + ] [ 79 / 100 ]-[19:56:43] [ - ]
|_[ + ] Exploit::
PHP/5.2.17, IP:80.179.142.111:80
_[ - ]::---------------------------------------------------------------------------
-----------------------------------
|_[ + ] [ 80 / 100 ]-[19:56:49] [ - ]
|_[ + ] Exploit::
PHP/5.2.17, IP:80.179.142.111:80
_[ - ]::---------------------------------------------------------------------------
-----------------------------------
|_[ + ] [ 81 / 100 ]-[19:56:55] [ - ]
|_[ + ] Exploit::
PHP/5.2.17, IP:80.179.142.111:80
bytes received
_[ - ]::---------------------------------------------------------------------------
-----------------------------------
|_[ + ] [ 82 / 100 ]-[19:57:02] [ - ]
|_[ + ] Exploit::
PHP/5.2.17, IP:80.179.142.111:80
_[ - ]::---------------------------------------------------------------------------
-----------------------------------
|_[ + ] [ 83 / 100 ]-[19:57:08] [ - ]
|_[ + ] Exploit::
PHP/5.2.17, IP:80.179.142.111:80
bytes received
_[ - ]::---------------------------------------------------------------------------
-----------------------------------
|_[ + ] [ 84 / 100 ]-[19:57:14] [ - ]
|_[ + ] Exploit::
PHP/5.2.17, IP:80.179.142.111:80
_[ - ]::---------------------------------------------------------------------------
-----------------------------------
|_[ + ] [ 85 / 100 ]-[19:57:22] [ - ]
|_[ + ] Exploit::
PHP/5.2.17, IP:80.179.142.111:80
_[ - ]::---------------------------------------------------------------------------
-----------------------------------
|_[ + ] [ 86 / 100 ]-[19:57:27] [ - ]
|_[ + ] Exploit::
PHP/5.2.17, IP:80.179.142.111:80
_[ - ]::---------------------------------------------------------------------------
-----------------------------------
|_[ + ] [ 87 / 100 ]-[19:57:31] [ - ]
|_[ + ] Target:: [ http://www.ifeelgood.co.il/?cat=1 ]
|_[ + ] Exploit::
IP:80.179.142.111:80
_[ - ]::---------------------------------------------------------------------------
-----------------------------------
|_[ + ] [ 88 / 100 ]-[19:57:37] [ - ]
|_[ + ] Target:: [ http://www.ifeelgood.co.il/?tag=cbt ]
|_[ + ] Exploit::
PHP/5.2.17, IP:80.179.142.111:80
_[ - ]::---------------------------------------------------------------------------
-----------------------------------
|_[ + ] [ 89 / 100 ]-[19:57:42] [ - ]
|_[ + ] Exploit::
PHP/5.2.17, IP:80.179.142.111:80
_[ - ]::---------------------------------------------------------------------------
-----------------------------------
|_[ + ] [ 90 / 100 ]-[19:57:48] [ - ]
|_[ + ] Exploit::
PHP/5.2.17, IP:80.179.142.111:80
_[ - ]::---------------------------------------------------------------------------
-----------------------------------
|_[ + ] [ 91 / 100 ]-[19:57:54] [ - ]
|_[ + ] Target:: [ http://www.ifeelgood.co.il/?tag=‫] סימפטומים‬
|_[ + ] Exploit::
PHP/5.2.17, IP:80.179.142.111:80
_[ - ]::---------------------------------------------------------------------------
-----------------------------------
|_[ + ] [ 92 / 100 ]-[19:58:00] [ - ]
|_[ + ] Target:: [ http://www.ifeelgood.co.il/?tag=‫] פאניקה‬
|_[ + ] Exploit::
PHP/5.2.17, IP:80.179.142.111:80
_[ - ]::---------------------------------------------------------------------------
-----------------------------------
|_[ + ] [ 93 / 100 ]-[19:58:06] [ - ]
|_[ + ] Target:: [ http://www.ifeelgood.co.il/?tag=‫] לחץ‬
|_[ + ] Exploit::
PHP/5.2.17, IP:80.179.142.111:80
_[ - ]::---------------------------------------------------------------------------
-----------------------------------
|_[ + ] [ 94 / 100 ]-[19:58:12] [ - ]
|_[ + ] Target:: [ http://www.ifeelgood.co.il/?tag=‫] פחדים‬
|_[ + ] Exploit::
PHP/5.2.17, IP:80.179.142.111:80
_[ - ]::---------------------------------------------------------------------------
-----------------------------------
|_[ + ] [ 95 / 100 ]-[19:58:20] [ - ]
|_[ + ] Exploit::
PHP/5.2.17, IP:80.179.142.111:80
bytes received
_[ - ]::---------------------------------------------------------------------------
-----------------------------------
|_[ + ] [ 96 / 100 ]-[19:58:26] [ - ]
|_[ + ] Target:: [ http://www.ifeelgood.co.il/?paged=4 ]
|_[ + ] Exploit::
PHP/5.2.17, IP:80.179.142.111:80
bytes received
_[ - ]::---------------------------------------------------------------------------
-----------------------------------
|_[ + ] [ 97 / 100 ]-[19:58:32] [ - ]
|_[ + ] Target:: [ http://www.ifeelgood.co.il/?tag=‫] משפחה‬
|_[ + ] Exploit::
PHP/5.2.17, IP:80.179.142.111:80
_[ - ]::---------------------------------------------------------------------------
-----------------------------------
|_[ + ] [ 98 / 100 ]-[19:58:38] [ - ]
|_[ + ] Target:: [ http://www.ifeelgood.co.il/?paged=2 ]
|_[ + ] Exploit::
PHP/5.2.17, IP:80.179.142.111:80
_[ - ]::---------------------------------------------------------------------------
-----------------------------------
|_[ + ] [ 99 / 100 ]-[19:58:43] [ - ]
|_[ + ] Exploit::
PHP/5.2.17, IP:80.179.142.111:80
[ INFO ] [ Shutting down ]

[ INFO ] [ End of process INURLBR at [22-03-2018 19:58:43]
[ INFO ] [ TOTAL FILTERED VALUES ]:: [ 0 ]
[ INFO ] [ OUTPUT FILE ]:: [ /usr/share/sniper/output/inurlbr-
ifeelgood.co.il.txt ]
|
___________________________________________________________________________________
______
\
___________________________________________________________________________________
______/


110/tcp filtered pop3
and 1 closed port
Network Distance: 1 hop
TRACEROUTE (using port 443/tcp)

HOP RTT ADDRESS
1 979.19 ms yanir.spd.co.il (80.179.142.111)

===================================================================================
===================================================
CHECKING FOR WAF
===================================================================================
===================================================
###################################################################################
###################################################
[+] URL: http://ifeelgood.co.il/
[+] Started: Thu Mar 22 19:53:53 2018
[+] Interesting header: SERVER: nginx

[+] Interesting header: X-ROCKET-NGINX-BYPASS: No
[+] WordPress version 2.8.4 (Released on 2009-08-12) identified from meta

generator, links opml
[!] 27 vulnerabilities identified from the version number
[!] Title: WordPress 2.5 - 3.3.1 XSS in swfupload

Reference: https://wpvulndb.com/vulnerabilities/5999
Reference: http://seclists.org/fulldisclosure/2012/Nov/51
[i] Fixed in: 3.3.2
[!] Title: WordPress 1.5.1 - 3.5 XMLRPC Pingback API Internal/External Port
Scanning
Reference: https://github.com/FireFart/WordpressPingbackPortScanner
Reference: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0235
[i] Fixed in: 3.5.1
[!] Title: WordPress 1.5.1 - 3.5 XMLRPC pingback additional issues

Reference: http://lab.onsec.ru/2013/01/wordpress-xmlrpc-pingback-
additional.html
[!] Title: WordPress 2.0 - 3.0.1 wp-includes/comment.php Bypass Spam Restrictions

[i] Fixed in: 3.0.2
[!] Title: WordPress 2.0 - 3.0.1 Multiple Cross-Site Scripting (XSS) in

request_filesystem_credentials()
[i] Fixed in: 3.0.2
[!] Title: WordPress 2.0 - 3.0.1 Cross-Site Scripting (XSS) in wp-admin/plugins.php

[i] Fixed in: 3.0.2
[!] Title: WordPress 2.0 - 3.0.1 wp-includes/capabilities.php Remote Authenticated

Administrator Delete Action Bypass
[i] Fixed in: 3.0.2
[!] Title: WordPress 2.0 - 3.0 Remote Authenticated Administrator Add Action Bypass
[i] Fixed in: 3.0
[!] Title: WordPress 2.0.3 - 3.9.1 (except 3.7.4 / 3.8.4) CSRF Token Brute Forcing
Reference: https://core.trac.wordpress.org/changeset/29384
[i] Fixed in: 3.9.2
[!] Title: WordPress <= 4.0 - Long Password Denial of Service (DoS)
Reference: http://www.behindthefirewalls.com/2014/11/wordpress-denial-of-
service-responsible-disclosure.html
Reference: https://wordpress.org/news/2014/11/wordpress-4-0-1/
Reference:
https://www.rapid7.com/db/modules/auxiliary/dos/http/wordpress_long_password_dos
Reference: https://www.exploit-db.com/exploits/35413/
Reference: https://www.exploit-db.com/exploits/35414/
[i] Fixed in: 4.0.1
[!] Title: WordPress <= 4.0 - Server Side Request Forgery (SSRF)
Reference: http://www.securityfocus.com/bid/71234/
[i] Fixed in: 4.0.1
[!] Title: WordPress <= 4.4.2 - SSRF Bypass using Octal & Hexedecimal IP addresses
Reference: https://codex.wordpress.org/Version_4.5
Reference:
https://github.com/WordPress/WordPress/commit/af9f0520875eda686fd13a427fd3914d7aded
049
[i] Fixed in: 4.5
[!] Title: WordPress 2.6.0-4.5.2 - Unauthorized Category Removal from Post

Reference:
https://github.com/WordPress/WordPress/commit/6d05c7521baa980c4efec411feca5e7fab6f3
07c
[i] Fixed in: 4.5.3
[!] Title: WordPress 2.5-4.6 - Authenticated Stored Cross-Site Scripting via Image
Filename
Reference: https://wordpress.org/news/2016/09/wordpress-4-6-1-security-and-
maintenance-release/
Reference:
https://github.com/WordPress/WordPress/commit/c9e60dab176635d4bfaaf431c0ea891e4726d
6e0
Reference:
https://sumofpwn.nl/advisory/2016/persistent_cross_site_scripting_vulnerability_in_
wordpress_due_to_unsafe_processing_of_file_names.html
Reference: http://seclists.org/fulldisclosure/2016/Sep/6
[i] Fixed in: 4.6.1
[!] Title: WordPress 2.8-4.6 - Path Traversal in Upgrade Package Uploader

Reference:
https://github.com/WordPress/WordPress/commit/54720a14d85bc1197ded7cb09bd3ea790caa0
b6e
[i] Fixed in: 4.6.1
[!] Title: WordPress <= 4.7 - Post via Email Checks mail.example.com by Default
Reference:
https://github.com/WordPress/WordPress/commit/061e8788814ac87706d8b95688df276fe3c85
96a
[i] Fixed in: 4.7.1
[!] Title: WordPress 2.8-4.7 - Accessibility Mode Cross-Site Request Forgery (CSRF)
Reference:
https://github.com/WordPress/WordPress/commit/03e5c0314aeffe6b27f4b98fef842bf0fb00c
733
[i] Fixed in: 4.7.1
[!] Title: WordPress 2.8.1-4.7.2 - Control Characters in Redirect URL Validation

Reference:
https://github.com/WordPress/WordPress/commit/288cd469396cfe7055972b457eb589cea51ce
40e
[i] Fixed in: 4.7.3
[!] Title: WordPress 2.3-4.8.3 - Host Header Injection in Password Reset

Reference: https://exploitbox.io/vuln/WordPress-Exploit-4-7-Unauth-Password-
Reset-0day-CVE-2017-8295.html
Reference: http://blog.dewhurstsecurity.com/2017/05/04/exploitbox-wordpress-
security-advisories.html
Reference: https://core.trac.wordpress.org/ticket/25239
[!] Title: WordPress 2.7.0-4.7.4 - Insufficient Redirect Validation

Reference:
https://github.com/WordPress/WordPress/commit/76d77e927bb4d0f87c7262a50e28d84e01fd2
b11
[i] Fixed in: 4.7.5
[!] Title: WordPress 2.5.0-4.7.4 - Post Meta Data Values Improper Handling in XML-
RPC
Reference:
https://github.com/WordPress/WordPress/commit/3d95e3ae816f4d7c638f40d3e936a4be19724
381
[i] Fixed in: 4.7.5
[!] Title: WordPress 2.5.0-4.7.4 - Filesystem Credentials Dialog CSRF

Reference:
https://github.com/WordPress/WordPress/commit/38347d7c580be4cdd8476e4bbc653d5c79ed9
b67
Reference:
https://sumofpwn.nl/advisory/2016/cross_site_request_forgery_in_wordpress_connectio
n_information.html
[i] Fixed in: 4.7.5
[!] Title: WordPress 2.3.0-4.8.1 - $wpdb->prepare() potential SQL Injection

Reference:
https://github.com/WordPress/WordPress/commit/70b21279098fc973eae803693c0705a548128
e48
Reference:
https://github.com/WordPress/WordPress/commit/fc930d3daed1c3acef010d04acc2c5de93cd1
8ec
[i] Fixed in: 4.8.2
[!] Title: WordPress 2.3.0-4.7.4 - Authenticated SQL injection

Reference: https://medium.com/websec/wordpress-sqli-bbb2afcc8e94
Reference:
https://github.com/WordPress/WordPress/commit/70b21279098fc973eae803693c0705a548128
e48
[i] Fixed in: 4.7.5
[!] Title: WordPress <= 4.8.2 - $wpdb->prepare() Weakness

Reference: https://wordpress.org/news/2017/10/wordpress-4-8-3-security-release/
Reference:
https://github.com/WordPress/WordPress/commit/a2693fd8602e3263b5925b9d799ddd5772021
67d
Reference: https://twitter.com/ircmaxell/status/923662170092638208
Reference: https://blog.ircmaxell.com/2017/10/disclosure-wordpress-wpdb-sql-
injection-technical.html
[i] Fixed in: 4.8.3
[!] Title: WordPress 1.5.0-4.9 - RSS and Atom Feed Escaping

Reference:
https://github.com/WordPress/WordPress/commit/f1de7e42df29395c3314bf85bff3d1f4f9054
1de
[i] Fixed in: 4.9.1
[!] Title: WordPress <= 4.9.4 - Application Denial of Service (DoS) (unpatched)
Reference: https://baraktawily.blogspot.fr/2018/02/how-to-dos-29-of-world-wide-
websites.html
Reference: https://github.com/quitten/doser.py
Reference: https://thehackernews.com/2018/02/wordpress-dos-exploit.html
[+] WordPress theme in use: blogger - v1.2
[+] Name: blogger - v1.2

| Location: http://ifeelgood.co.il/wp-content/themes/blogger/
| Readme: http://ifeelgood.co.il/wp-content/themes/blogger/README.txt
| Style URL: http://ifeelgood.co.il/wp-content/themes/blogger/style.css
| Referenced style.css: http://www.ifeelgood.co.il/wp-
content/themes/blogger/style.css
| Theme Name: Wp-Them.es Blogger
| Description: WordPress Theme with theme options menu by <a href="http://www.wp-
them.es">Wp-Them.es</a>. <br /...
| Author: Wp-Them.es
| Author URI: http://www.wp-them.es
[+] Enumerating plugins from passive detection ...

[+] No plugins found
[+] Finished: Thu Mar 22 19:59:54 2018

[+] Requests Done: 353
[+] Memory used: 42.246 MB
[+] Elapsed time: 00:06:00
###################################################################################
####################################################
Scan date: 22-3-2018 19:39:30

===================================================================================
=================================================
| [*] http://ifeelgood.co.il/ redirected to http://abuse.spd.co.il/
| [*] New target is: http://abuse.spd.co.il/
===================================================================================
==================================================
| Domain: http://abuse.spd.co.il/
| Server: Apache/6.6.6
| IP: 192.116.109.20
===================================================================================
===================================================
|
| Directory check:
===================================================================================
=================================================
|
| File check:
| [+] CODE: 200 URL: http://abuse.spd.co.il/error/HTTP_NOT_FOUND.html.var
| [+] CODE: 200 URL: http://abuse.spd.co.il/index.php
| [+] CODE: 200 URL: http://abuse.spd.co.il/squirrelmail/src/read_body.php
===================================================================================
===================================================
|
| Check robots.txt:
|
| Check sitemap.xml:
===================================================================================
====================================================
|
| Crawler Started:
| Plugin name: E-mail Detection v.1.1 Loaded.
| Plugin name: phpinfo() Disclosure v.1 Loaded.
| Plugin name: External Host Detect v.1.2 Loaded.
| Plugin name: FCKeditor upload test v.1 Loaded.
| Plugin name: Upload Form Detect v.1.1 Loaded.
| Plugin name: Code Disclosure v.1.1 Loaded.
| Plugin name: Timthumb <= 1.32 vulnerability v.1 Loaded.
| Plugin name: Web Backdoor Disclosure v.1.1 Loaded.
| [+] Crawling finished, 7 URL's found!
|
| E-mails:
| [+] E-mail Found: webmaster@abuse.spd.co.il
| [+] E-mail Found: johndoe@mail.spd.co.il
|
| PHPinfo() Disclosure:
|
| External hosts:
| [+] External Host Found: http://www.sPD.co.il
|
| FCKeditor File Upload:
|
| File Upload Forms:
|
| Source Code Disclosure:
|
| Timthumb:
|
| Web Backdoors:
|
| Ignored Files:
===================================================================================
==================================================
| Dynamic tests:
| Plugin name: Learning New Directories v.1.2 Loaded.
| Plugin name: FCKedior tests v.1.1 Loaded.
| Plugin name: Timthumb <= 1.32 vulnerability v.1 Loaded.
| Plugin name: Find Backup Files v.1.2 Loaded.
| Plugin name: Blind SQL-injection tests v.1.3 Loaded.
| Plugin name: Local File Include tests v.1.1 Loaded.
| Plugin name: PHP CGI Argument Injection v.1.1 Loaded.
| Plugin name: Remote Command Execution tests v.1.1 Loaded.
| Plugin name: Remote File Include tests v.1.2 Loaded.
| Plugin name: SQL-injection tests v.1.2 Loaded.
| Plugin name: Cross-Site Scripting tests v.1.2 Loaded.
| Plugin name: Web Shell Finder v.1.3 Loaded.
| [+] 2 New directories added
|
| FCKeditor tests:
|
| Timthumb < 1.33 vulnerability:

|
| Backup Files:
|
| Blind SQL Injection:

|
| Local File Include:

|
| PHP CGI Argument Injection:

|
| Remote Command Execution:

|
| Remote File Include:

|
| SQL Injection:
|
| Cross-Site Scripting (XSS):

|
| Web Shell Finder:

===================================================================================
====================================================
| Static tests:
| Plugin name: Local File Include tests v.1.1 Loaded.
| Plugin name: Remote Command Execution tests v.1.1 Loaded.
| Plugin name: Remote File Include tests v.1.1 Loaded.
|
| Local File Include:

|
| Remote Command Execution:

|
| Remote File Include:

===================================================================================
====================================================
###################################################################################
###################################################
-----------------------------------------------------------------------------------
--------------------------------------------------
+ Target IP: 80.179.142.111
+ Target Hostname: ifeelgood.co.il
+ Target Port: 80
+ Start Time: 2018-03-22 19:28:58 (GMT-4)
-----------------------------------------------------------------------------------
--------------------------------------------------
+ Server: nginx
+ The anti-clickjacking X-Frame-Options header is not present.
+ The X-XSS-Protection header is not defined. This header can hint to the user
agent to protect against some forms of XSS
+ Uncommon header 'x-rocket-nginx-bypass' found, with contents: No
+ The X-Content-Type-Options header is not set. This could allow the user agent to
render the content of the site in a different fashion to the MIME type
+ Root page / redirects to: http://abuse.spd.co.il
+ No CGI Directories found (use '-C all' to force check all possible dirs)
+ Retrieved x-powered-by header: PHP/5.6.30
+ Uncommon header 'link' found, with contents: <http://a-d-marhiv.co.il/wp-json/>;
rel="https://api.w.org/"
+ Uncommon header 'x-robots-tag' found, with contents: noindex, nofollow
+ Uncommon header 'x-ob_mode' found, with contents: 1
+ Uncommon header 'x-permitted-cross-domain-policies' found, with contents: none
+ Server leaks inodes via ETags, header found with file /phpMyAdmin/ChangeLog,
fields: 0x7336 0x546c7e43a1040
+ OSVDB-3092: /phpMyAdmin/ChangeLog: phpMyAdmin is for managing MySQL databases,
and should be protected or limited to authorized hosts.
+ /wp-content/plugins/akismet/readme.txt: The WordPress Akismet plugin 'Tested up
to' version usually matches the WordPress version
+ OSVDB-3092: /license.txt: License file found may identify site software.
+ /phpMyAdmin/: phpMyAdmin directory found
+ 7661 requests: 8 error(s) and 14 item(s) reported on remote host
+ End Time: 2018-03-22 21:10:35 (GMT-4) (6097 seconds)
-----------------------------------------------------------------------------------
----------------------------------------------------
###################################################################################
####################################################
Anonymous Operation Izsrael USA JTSEC full
recon 2018 #6

Anonymous Operation Izsrael

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Anonymous Operation Izsrael

Uploaded by

Copyright:

Available Formats

###################################################################################

Gathered Inet-whois information for 80.179.142.111

inetnum: 80.179.141.64 - 80.179.142.255

role: DNS REG

% Information related to '80.179.142.0/24AS9116'

Gathered Inic-whois information for ifeelgood.co.il

descr: Yanir Levin Ltd.

person: Yanir Levin

person: Interspace Domreg

registrar name: InterSpace Ltd

% Rights to the data above are restricted by copyright.

Gathered Netcraft information for ifeelgood.co.il

Retrieving Netcraft.com information for ifeelgood.co.il

Gathered Subdomain information for ifeelgood.co.il

Gathered E-Mail information for ifeelgood.co.il

Gathered TCP Port information for 80.179.142.111

[+] Site Title: Ifeelgood ‫האתר המקיף לבריאות הנפש‬

% The data in the WHOIS database of the .il registry is provided

descr: Yanir Levin Ltd.

person: Interspace Domreg

registrar name: InterSpace Ltd

% Rights to the data above are restricted by copyright.

[i] IP Address: 80.179.142.111

[i] HTTP/1.1 301 Moved Permanently

;; Truncated, retrying in TCP mode.

Starting Nmap 7.01 ( https://nmap.org ) at 2018-03-22 23:27 UTC

Service detection performed. Please report any incorrect results at

Subdomain ifeel.good.co.il 148.251.90.173 NS:dns.live4all.co.il

Subdomain ifeelgoo.d.co.il 37.19.112.17

Various ifeelgood.co-il.com 209.15.13.134 NS:ns1.dnslink.com

ifeelgood.co.il has address 80.179.142.111

Xprobe2 v.0.3 Copyright (c) 2002-2005 fyodor@o0o.nu, ofir@sys-security.com,

[+] Target is ifeelgood.co.il

% The data in the WHOIS database of the .il registry is provided

descr: [*] ifeelgood.co.il:21 - Sending Backdoor Command

Starting Nmap 7.60 ( https://nmap.org ) at 2018-03-22 19:38 EDT

PORT STATE SERVICE VERSION

Host script results:

TRACEROUTE (using proto 1/icmp)

OS and Service detection performed. Please report any incorrect results at

WAFW00F - Web Application Firewall Detection Tool

By Sandro Gauci && Wendel G. Henrique

+ -- --=[Cross-Site Tracer v1.3 by 1N3 @ CrowdShield

+ -- --=[Checking if X-Frame options are enabled on ifeelgood.co.il...

+ -- --=[Checking if X-XSS-Protection header is enabled on ifeelgood.co.il...

+ -- --=[Checking HTTP methods on ifeelgood.co.il...

+ -- --=[Checking if TRACE method is enabled on ifeelgood.co.il...

+ -- --=[Checking for META tags on ifeelgood.co.il...

+ -- --=[Checking for open proxy on ifeelgood.co.il...

+ -- --=[Enumerating software on ifeelgood.co.il...

+ -- --=[Checking if Strict-Transport-Security is enabled on ifeelgood.co.il...

+ -- --=[Checking for Flash cross-domain policy on ifeelgood.co.il...

+ -- --=[Checking for Silverlight cross-domain policy on ifeelgood.co.il...

+ -- --=[Checking for HTML5 cross-origin resource sharing on ifeelgood.co.il...

+ -- --=[Retrieving robots.txt on ifeelgood.co.il...

+ -- --=[Retrieving sitemap.xml on ifeelgood.co.il...

+ -- --=[Checking cookie attributes on ifeelgood.co.il...

+ -- --=[Checking for ASP.NET Detailed Errors on ifeelgood.co.il...

Starting Nmap 7.60 ( https://nmap.org ) at 2018-03-22 19:45 EDT

PORT STATE SERVICE VERSION

TRACEROUTE (using port 443/tcp)

OS and Service detection performed. Please report any incorrect results at

WAFW00F - Web Application Firewall Detection Tool

By Sandro Gauci && Wendel G. Henrique

Checking Host: http://ifeelgood.co.il:8080