beatzaplenty/autorecon
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fresh autorecon run

Browse Source
This commit is contained in:
beatzaplenty committed 2026-04-14 17:49:38 +10:00
1 parent c8f17a17e6
commit 3c3a192c79
1252 files changed
+4574573 -1993899
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

results/report.md/nextcloud.lan.ddnsgeek.com/Patterns.md
+2 -2
View File
@@ -1,6 +1,6 @@
Matched Pattern: powered-by: PHP/8.3.30
CVE Identified: CVE-2003-1418
Identified HTTP Server: Apache/2.4.66 (Debian)
CVE Identified: CVE-2003-1418
results/report.md/nextcloud.lan.ddnsgeek.com/Port Scans/PortScan - All TCP Ports.md
+53 -55
View File
@@ -5,12 +5,11 @@ nmap -vv --reason -Pn -T4 -sV -sC --version-all -A --osscan-guess -p- -oN "/root
[/root/results/nextcloud.lan.ddnsgeek.com/scans/_full_tcp_nmap.txt](file:///root/results/nextcloud.lan.ddnsgeek.com/scans/_full_tcp_nmap.txt):
```
# Nmap 7.98 scan initiated Sun Apr 5 08:11:07 2026 as: /usr/lib/nmap/nmap -vv --reason -Pn -T4 -sV -sC --version-all -A --osscan-guess -p- -oN /root/results/nextcloud.lan.ddnsgeek.com/scans/_full_tcp_nmap.txt -oX /root/results/nextcloud.lan.ddnsgeek.com/scans/xml/_full_tcp_nmap.xml nextcloud.lan.ddnsgeek.com
Increasing send delay for 167.179.167.166 from 0 to 5 due to 11 out of 22 dropped probes since last increase.
# Nmap 7.99 scan initiated Tue Apr 14 03:48:29 2026 as: /usr/lib/nmap/nmap -vv --reason -Pn -T4 -sV -sC --version-all -A --osscan-guess -p- -oN /root/results/nextcloud.lan.ddnsgeek.com/scans/_full_tcp_nmap.txt -oX /root/results/nextcloud.lan.ddnsgeek.com/scans/xml/_full_tcp_nmap.xml nextcloud.lan.ddnsgeek.com
Nmap scan report for nextcloud.lan.ddnsgeek.com (167.179.167.166)
Host is up, received user-set (0.020s latency).
Host is up, received user-set (0.015s latency).
rDNS record for 167.179.167.166: 167-179-167-166.a7b3a7.bne.nbn.aussiebb.net
Scanned at 2026-04-05 08:11:21 UTC for 16892s
Scanned at 2026-04-14 03:48:34 UTC for 1107s
Not shown: 65531 filtered tcp ports (no-response)
PORT STATE SERVICE REASON VERSION
80/tcp open http syn-ack ttl 55 Golang net/http server (Go-IPFS json-rpc or InfluxDB API)
@@ -18,22 +17,26 @@ PORT STATE SERVICE REASON VERSION
| http-methods:
|_ Supported Methods: GET HEAD POST OPTIONS
443/tcp open ssl/http syn-ack ttl 55 Golang net/http server (Go-IPFS json-rpc or InfluxDB API)
|_http-server-header: Apache/2.4.66 (Debian)
| http-robots.txt: 1 disallowed entry
|_/
|_ssl-date: TLS randomness does not represent time
| http-methods:
|_ Supported Methods: GET HEAD POST OPTIONS
| ssl-cert: Subject: commonName=nextcloud.lan.ddnsgeek.com
| Subject Alternative Name: DNS:nextcloud.lan.ddnsgeek.com
| Issuer: commonName=R12/organizationName=Let's Encrypt/countryName=US
| Issuer: commonName=R13/organizationName=Let's Encrypt/countryName=US
| Public Key type: rsa
| Public Key bits: 4096
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2026-02-09T19:02:37
| Not valid after: 2026-05-10T19:02:36
| MD5: 1238 93af a1bb d72b 58cc 04da ce8f 39a3
| SHA-1: 0a0a 3103 f4a5 94ce bd08 4e19 38a0 3ee8 3bea 02d5
| SHA-256: af41 2c3f b7bf 6ee9 68ff 4449 2627 0604 6d6c 04c9 069f 11d9 8366 47fe 7a22 d02d
| Not valid before: 2026-04-10T22:57:14
| Not valid after: 2026-07-09T22:57:13
| MD5: 3e9f 313a b74d 382e 83fc 5f1a 5a53 e40b
| SHA-1: 1937 4753 629c 2c83 886f ec53 de7e 0a3c de34 7039
| SHA-256: 3c52 054a efae 0d1d 5cf0 8226 e0ae 7ad0 478a 8c85 f5e7 a963 0ddd 072d d9c5 d129
| -----BEGIN CERTIFICATE-----
| MIIGGDCCBQCgAwIBAgISBs84fOBMHD0zq0Oj2DfRjS1QMA0GCSqGSIb3DQEBCwUA
| MIIGDTCCBPWgAwIBAgISBrmm2MmqMNL/bqguwka5v7ahMA0GCSqGSIb3DQEBCwUA
| MDMxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQwwCgYDVQQD
| EwNSMTIwHhcNMjYwMjA5MTkwMjM3WhcNMjYwNTEwMTkwMjM2WjAlMSMwIQYDVQQD
| EwNSMTMwHhcNMjYwNDEwMjI1NzE0WhcNMjYwNzA5MjI1NzEzWjAlMSMwIQYDVQQD
| ExpuZXh0Y2xvdWQubGFuLmRkbnNnZWVrLmNvbTCCAiIwDQYJKoZIhvcNAQEBBQAD
| ggIPADCCAgoCggIBAMfZPcsjUERAyRB3mvCx+kUJE/5gKelvulMMV3uCdil8yiop
| 3CgXHNN1E/9hsK8/gueXU1AbcpNUrHP1clNlrMku+GuwAQF4+eulJdycXM8UBOB4
@@ -46,47 +49,43 @@ PORT STATE SERVICE REASON VERSION
| DP6kmO7mCGRRQmxu1Ui6hZjIWEa2VJ6epueY7GtrEmsVulna+uq+jz2vI/uk99EF
| H2NZuc/65i67UAjUllYA/58dTcC6kX6/WO5CTRsCzkhY0cCY2xGrs2i6bok50TzQ
| 90IlIpa4IK19uDunxb6i7BFY/m56lmpKkYcyNflBCOrPtBSkVpUe45skVVdRAgMB
| AAGjggIyMIICLjAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0lBBYwFAYIKwYBBQUHAwEG
| CCsGAQUFBwMCMAwGA1UdEwEB/wQCMAAwHQYDVR0OBBYEFC+nSeC+N1jWPCU+PH6S
| tjduDIpsMB8GA1UdIwQYMBaAFAC1KfItjm8x6JtMrXg++tzpDNHSMDMGCCsGAQUF
| BwEBBCcwJTAjBggrBgEFBQcwAoYXaHR0cDovL3IxMi5pLmxlbmNyLm9yZy8wJQYD
| VR0RBB4wHIIabmV4dGNsb3VkLmxhbi5kZG5zZ2Vlay5jb20wEwYDVR0gBAwwCjAI
| BgZngQwBAgEwLgYDVR0fBCcwJTAjoCGgH4YdaHR0cDovL3IxMi5jLmxlbmNyLm9y
| Zy84MS5jcmwwggEMBgorBgEEAdZ5AgQCBIH9BIH6APgAfgDjI43yjaKI4KrgrPD6
| kMmF8La/9dKlJ7AB/BxEWMS26AAAAZxD/lXDAAgAAAUAMg4sIQQDAEcwRQIgIrCy
| dkG2OA3k+ot4xDhxRpcnzkBKHTNZylHElvVz0J8CIQDfJueLeCcVjYrFxFfiBC7H
| /0xdjUSIP0UwZKmWxao/TwB2ABaDLavwqSUPD/A6pUX/yL/II9CHS/YEKSf45x8z
| E/X6AAABnEP+XTYAAAQDAEcwRQIhAPkHxBF88NswLBzx2jqn1RenJotA4rFrNQM9
| 1Eof/yZ7AiAHL5k+cqEy/GJ/5eSrDYLr7HCgFBZBE5FHYlXfQ/l32DANBgkqhkiG
| 9w0BAQsFAAOCAQEAlW2wfkaVWzbyhttsFH2ZuSqGY2PMi4UzJWCkokkB2fPG16Ky
| +EvvTkkkj+U39fkyDqc44jCWJ1cvM5KP6YNyit2w+dhzicllKsO5OJeOQF49EZuC
| jBxyK2AHJzOVUOpTSeaeWjRH6eVgq8ebnwxrN1APCKRhb99SRgfF5SttfVl9CHt+
| qlimvDKxX7/PeXz+PW3KAI/DOTBF7mjZUUvIRZLr2Tv7AXtl27fbfpEtXhlBVsdy
| 2JtMrKu0qbfxfWeOr1uD69WWsPkgWZ8HHP+7VibHwyXUuc7FmHuxDQCtWFNkj9rm
| lZr6d0LRlE/gU6T/SDixaqBbYR7VEOEMYhL0SA==
| AAGjggInMIICIzAOBgNVHQ8BAf8EBAMCBaAwEwYDVR0lBAwwCgYIKwYBBQUHAwEw
| DAYDVR0TAQH/BAIwADAdBgNVHQ4EFgQUL6dJ4L43WNY8JT48fpK2N24MimwwHwYD
| VR0jBBgwFoAU56ufDywzoFPTXk94yLKEDjvWkjMwMwYIKwYBBQUHAQEEJzAlMCMG
| CCsGAQUFBzAChhdodHRwOi8vcjEzLmkubGVuY3Iub3JnLzAlBgNVHREEHjAcghpu
| ZXh0Y2xvdWQubGFuLmRkbnNnZWVrLmNvbTATBgNVHSAEDDAKMAgGBmeBDAECATAu
| BgNVHR8EJzAlMCOgIaAfhh1odHRwOi8vcjEzLmMubGVuY3Iub3JnLzM0LmNybDCC
| AQsGCisGAQQB1nkCBAIEgfwEgfkA9wB2AMIxfldFGaNF7n843rKQQevHwiFaIr9/
| 1bWtdprZDlLNAAABnXnSsysAAAQDAEcwRQIgFjRX18ymII+LUj3/mn40hTZc54+w
| uO66VcsD1AWz0xECIQC1XYnN8iIHf+gMkzrZSl57qZMxDvxAj0KIEL+kcIuDqwB9
| AKgmy+MKxjUSRlM/4GXxTxnZbhkIE8Qd2W15ALMSPFUnAAABnXnStdkACAAABQAG
| ZqdVBAMARjBEAiBzQI9gfXwLedWIC3sx8xgjoyD3p0Rf06uIVv7UE/IfsgIgOTTu
| GGd5gH4MWw7AmXB7oBWiZWcnJvR+gzq1RhHFtuwwDQYJKoZIhvcNAQELBQADggEB
| AG9ivSu820MYLxWacjStBZN9tZoJl6rI3E52h7pl70JXUFQ7hFr8SN0SCU9/Iz+L
| wDdrqUGC3T5lr5NeTqW1hRnsErVFGe8DygcQDEZyAwR6mi7ym1h3VwWJ+2y09We5
| euyyem+7J8l2KeaJMJZaboi9rKjp/D6nl8a7aUxD/k2WrcPfwI2pok7o+QVaHTzo
| oXUSiiowm5lU2Ir6WmDDShBc3Ddql9siUjULVqt5bUcTXXvrS2X8xItKS+Zz+J6N
| 3f6xHKzt8YFlHAoKYuRh1E7K/uKsBQ6oNEAv/fN7GJHuxbb9HHAwZJe+DTnCAPws
| 84ceLvP0DzJN/Socs95sKb4=
|_-----END CERTIFICATE-----
|_ssl-date: TLS randomness does not represent time
|_http-server-header: Apache/2.4.66 (Debian)
| http-title: Login \xE2\x80\x93 Nextcloud
|_Requested resource was https://nextcloud.lan.ddnsgeek.com/index.php/login
| http-methods:
|_ Supported Methods: GET HEAD POST OPTIONS
| http-robots.txt: 1 disallowed entry
|_/
20001/tcp closed microsan reset ttl 57
51413/tcp open tcpwrapped syn-ack ttl 56
Device type: general purpose
Running (JUST GUESSING): Linux 4.X (88%)
OS CPE: cpe:/o:linux:linux_kernel:4
Running (JUST GUESSING): Linux 5.X (86%)
OS CPE: cpe:/o:linux:linux_kernel:5.4
OS fingerprint not ideal because: Didn't receive UDP response. Please try again with -sSU
Aggressive OS guesses: Linux 4.19 - 5.15 (88%)
Aggressive OS guesses: Linux 5.4 (86%)
No exact OS matches for host (test conditions non-ideal).
TCP/IP fingerprint:
SCAN(V=7.98%E=4%D=4/5%OT=80%CT=20001%CU=%PV=N%DS=8%DC=T%G=N%TM=69D25B25%P=x86_64-pc-linux-gnu)
SEQ(SP=101%GCD=1%ISR=10F%TI=Z%TS=A)
SEQ(SP=FF%GCD=1%ISR=105%TI=Z%TS=A)
SCAN(V=7.99%E=4%D=4/14%OT=80%CT=20001%CU=%PV=N%DS=8%DC=T%G=N%TM=69DDBD65%P=x86_64-pc-linux-gnu)
SEQ(SP=105%GCD=1%ISR=10A%TI=Z%TS=A)
SEQ(SP=106%GCD=1%ISR=10A%TI=Z%TS=A)
OPS(O1=M5B4ST11NW7%O2=M5B4ST11NW7%O3=M5B4NNT11NW7%O4=M5B4ST11NW7%O5=M5B4ST11NW7%O6=M5B4ST11)
WIN(W1=FE88%W2=FE88%W3=FE88%W4=FE88%W5=FE88%W6=FE88)
ECN(R=Y%DF=Y%TG=40%W=FAF0%O=M5B4NNSNW7%CC=Y%Q=)
ECN(R=N)
T1(R=Y%DF=Y%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
@@ -94,28 +93,27 @@ T4(R=N)
T5(R=N)
T6(R=N)
T7(R=N)
T7(R=Y%DF=Y%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(R=N)
IE(R=N)
Uptime guess: 17.135 days (since Thu Mar 19 09:37:52 2026)
Uptime guess: 49.687 days (since Mon Feb 23 11:37:19 2026)
Network Distance: 8 hops
TCP Sequence Prediction: Difficulty=255 (Good luck!)
TCP Sequence Prediction: Difficulty=261 (Good luck!)
IP ID Sequence Generation: All zeros
TRACEROUTE (using port 20001/tcp)
HOP RTT ADDRESS
1 0.06 ms 10.216.0.161
2 0.43 ms 10.216.35.12
3 0.87 ms 10.216.32.1
4 0.46 ms lo0-0.gw1.syd1.au.linode.com (172.105.160.101)
5 4.04 ms as4764.syd.edgeix.net.au (202.77.88.3)
6 11.67 ms 10.241.1.187
7 12.61 ms 10.241.2.71
8 15.61 ms 167-179-167-166.a7b3a7.bne.nbn.aussiebb.net (167.179.167.166)
1 0.29 ms 10.216.0.161
2 0.45 ms 10.216.35.12
3 0.81 ms 10.216.32.1
4 0.30 ms lo0-0.gw1.syd1.au.linode.com (172.105.160.101)
5 2.91 ms as4764.syd.edgeix.net.au (202.77.88.3)
6 11.60 ms 10.241.1.185
7 12.32 ms 10.241.2.71
8 13.79 ms 167-179-167-166.a7b3a7.bne.nbn.aussiebb.net (167.179.167.166)
Read data files from: /usr/share/nmap
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Sun Apr 5 12:52:53 2026 -- 1 IP address (1 host up) scanned in 16914.51 seconds
# Nmap done at Tue Apr 14 04:07:01 2026 -- 1 IP address (1 host up) scanned in 1146.43 seconds
```
results/report.md/nextcloud.lan.ddnsgeek.com/Port Scans/PortScan - Top 100 UDP Ports.md
+16 -14
View File
@@ -5,34 +5,36 @@ nmap -vv --reason -Pn -T4 -sU -A --top-ports 100 -oN "/root/results/nextcloud.la
[/root/results/nextcloud.lan.ddnsgeek.com/scans/_top_100_udp_nmap.txt](file:///root/results/nextcloud.lan.ddnsgeek.com/scans/_top_100_udp_nmap.txt):
```
# Nmap 7.98 scan initiated Sun Apr 5 08:11:26 2026 as: /usr/lib/nmap/nmap -vv --reason -Pn -T4 -sU -A --top-ports 100 -oN /root/results/nextcloud.lan.ddnsgeek.com/scans/_top_100_udp_nmap.txt -oX /root/results/nextcloud.lan.ddnsgeek.com/scans/xml/_top_100_udp_nmap.xml nextcloud.lan.ddnsgeek.com
# Nmap 7.99 scan initiated Tue Apr 14 03:48:57 2026 as: /usr/lib/nmap/nmap -vv --reason -Pn -T4 -sU -A --top-ports 100 -oN /root/results/nextcloud.lan.ddnsgeek.com/scans/_top_100_udp_nmap.txt -oX /root/results/nextcloud.lan.ddnsgeek.com/scans/xml/_top_100_udp_nmap.xml nextcloud.lan.ddnsgeek.com
Nmap scan report for nextcloud.lan.ddnsgeek.com (167.179.167.166)
Host is up, received user-set.
Host is up, received user-set (0.49s latency).
rDNS record for 167.179.167.166: 167-179-167-166.a7b3a7.bne.nbn.aussiebb.net
Scanned at 2026-04-05 08:11:43 UTC for 1412s
Scanned at 2026-04-14 03:49:03 UTC for 1563s
All 100 scanned ports on nextcloud.lan.ddnsgeek.com (167.179.167.166) are in ignored states.
Not shown: 100 open|filtered udp ports (no-response)
Too many fingerprints match this host to give specific OS details
TCP/IP fingerprint:
SCAN(V=7.98%E=4%D=4/5%OT=%CT=%CU=%PV=N%G=N%TM=69D21EC4%P=x86_64-pc-linux-gnu)
SCAN(V=7.99%E=4%D=4/14%OT=%CT=%CU=%PV=N%DS=9%DC=T%G=N%TM=69DDBF4B%P=x86_64-pc-linux-gnu)
SEQ()
U1(R=N)
IE(R=N)
Network Distance: 9 hops
TRACEROUTE (using proto 1/icmp)
HOP RTT ADDRESS
1 0.06 ms 10.216.0.161
2 0.22 ms 10.216.35.11
3 2.48 ms 10.216.32.2
4 0.28 ms lo0-0.gw1.syd1.au.linode.com (172.105.160.101)
5 4.58 ms as4764.syd.edgeix.net.au (202.77.88.3)
6 11.64 ms 10.241.1.187
7 12.71 ms 10.241.2.71
8 ... 30
HOP RTT ADDRESS
1 0.10 ms 10.216.0.161
2 0.19 ms 10.216.35.12
3 1.05 ms 10.216.32.2
4 0.35 ms lo0-0.gw1.syd1.au.linode.com (172.105.160.101)
5 2.01 ms as4764.syd.edgeix.net.au (202.77.88.3)
6 11.69 ms 10.241.1.185
7 14.80 ms 10.241.2.26
8 ...
9 494.82 ms 167-179-167-166.a7b3a7.bne.nbn.aussiebb.net (167.179.167.166)
Read data files from: /usr/share/nmap
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Sun Apr 5 08:35:17 2026 -- 1 IP address (1 host up) scanned in 1438.42 seconds
# Nmap done at Tue Apr 14 04:15:07 2026 -- 1 IP address (1 host up) scanned in 1570.71 seconds
```
results/report.md/nextcloud.lan.ddnsgeek.com/Port Scans/PortScan - Top TCP Ports.md
+74 -28
View File
@@ -5,12 +5,13 @@ nmap -vv --reason -Pn -T4 -sV -sC --version-all -A --osscan-guess -oN "/root/res
[/root/results/nextcloud.lan.ddnsgeek.com/scans/_quick_tcp_nmap.txt](file:///root/results/nextcloud.lan.ddnsgeek.com/scans/_quick_tcp_nmap.txt):
```
# Nmap 7.98 scan initiated Sun Apr 5 08:08:23 2026 as: /usr/lib/nmap/nmap -vv --reason -Pn -T4 -sV -sC --version-all -A --osscan-guess -oN /root/results/nextcloud.lan.ddnsgeek.com/scans/_quick_tcp_nmap.txt -oX /root/results/nextcloud.lan.ddnsgeek.com/scans/xml/_quick_tcp_nmap.xml nextcloud.lan.ddnsgeek.com
Increasing send delay for 167.179.167.166 from 0 to 5 due to 11 out of 25 dropped probes since last increase.
# Nmap 7.99 scan initiated Tue Apr 14 03:46:59 2026 as: /usr/lib/nmap/nmap -vv --reason -Pn -T4 -sV -sC --version-all -A --osscan-guess -oN /root/results/nextcloud.lan.ddnsgeek.com/scans/_quick_tcp_nmap.txt -oX /root/results/nextcloud.lan.ddnsgeek.com/scans/xml/_quick_tcp_nmap.xml nextcloud.lan.ddnsgeek.com
adjust_timeouts2: packet supposedly had rtt of -182735 microseconds. Ignoring time.
adjust_timeouts2: packet supposedly had rtt of -182735 microseconds. Ignoring time.
Nmap scan report for nextcloud.lan.ddnsgeek.com (167.179.167.166)
Host is up, received user-set (0.019s latency).
Host is up, received user-set (0.021s latency).
rDNS record for 167.179.167.166: 167-179-167-166.a7b3a7.bne.nbn.aussiebb.net
Scanned at 2026-04-05 08:10:26 UTC for 270s
Scanned at 2026-04-14 03:47:56 UTC for 61s
Not shown: 998 filtered tcp ports (no-response)
PORT STATE SERVICE REASON VERSION
80/tcp open http syn-ack ttl 55 Golang net/http server (Go-IPFS json-rpc or InfluxDB API)
@@ -18,54 +19,99 @@ PORT STATE SERVICE REASON VERSION
|_ Supported Methods: GET HEAD POST OPTIONS
|_http-title: Did not follow redirect to https://nextcloud.lan.ddnsgeek.com/
443/tcp open ssl/http syn-ack ttl 55 Golang net/http server (Go-IPFS json-rpc or InfluxDB API)
| ssl-cert: Subject: commonName=nextcloud.lan.ddnsgeek.com
| Subject Alternative Name: DNS:nextcloud.lan.ddnsgeek.com
| Issuer: commonName=R13/organizationName=Let's Encrypt/countryName=US
| Public Key type: rsa
| Public Key bits: 4096
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2026-04-10T22:57:14
| Not valid after: 2026-07-09T22:57:13
| MD5: 3e9f 313a b74d 382e 83fc 5f1a 5a53 e40b
| SHA-1: 1937 4753 629c 2c83 886f ec53 de7e 0a3c de34 7039
| SHA-256: 3c52 054a efae 0d1d 5cf0 8226 e0ae 7ad0 478a 8c85 f5e7 a963 0ddd 072d d9c5 d129
| -----BEGIN CERTIFICATE-----
| MIIGDTCCBPWgAwIBAgISBrmm2MmqMNL/bqguwka5v7ahMA0GCSqGSIb3DQEBCwUA
| MDMxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQwwCgYDVQQD
| EwNSMTMwHhcNMjYwNDEwMjI1NzE0WhcNMjYwNzA5MjI1NzEzWjAlMSMwIQYDVQQD
| ExpuZXh0Y2xvdWQubGFuLmRkbnNnZWVrLmNvbTCCAiIwDQYJKoZIhvcNAQEBBQAD
| ggIPADCCAgoCggIBAMfZPcsjUERAyRB3mvCx+kUJE/5gKelvulMMV3uCdil8yiop
| 3CgXHNN1E/9hsK8/gueXU1AbcpNUrHP1clNlrMku+GuwAQF4+eulJdycXM8UBOB4
| HkWO/CljSna1EZQlPx4FhDLMSki2uLP9mgNOM1/lBQ1qPG3B3EXLKOqGlEQ/zOjg
| /gyPEBxjWA3bYZZN4oiaFHnA32ontFN7CQ7COeCJCnRpr2zAUvpRO5U5uH2cfApt
| 4gha9FQSgAj6lAqFGDrRDLqUl1oGY4HM5DWDhYiYnJ/n34hDRoWOt1D02PpCjNQf
| O4CDs+6udQN7zBNQBZiSBEtpGnQn73EFeElRvoGqZMrQFJa6/VEle+oJxdQL5JIv
| yeqILlfJqlMgAiM4rItUKl9hTtWOfTuPCGbtPx7qDG6gdD2CDxdgPfPBseiKU6DV
| sbHAs6aAv17982O0FIf4LE7vSmkVSpzafYRXdx/F5I6Zi+t7SlsC+l7cZiYMAyfU
| DP6kmO7mCGRRQmxu1Ui6hZjIWEa2VJ6epueY7GtrEmsVulna+uq+jz2vI/uk99EF
| H2NZuc/65i67UAjUllYA/58dTcC6kX6/WO5CTRsCzkhY0cCY2xGrs2i6bok50TzQ
| 90IlIpa4IK19uDunxb6i7BFY/m56lmpKkYcyNflBCOrPtBSkVpUe45skVVdRAgMB
| AAGjggInMIICIzAOBgNVHQ8BAf8EBAMCBaAwEwYDVR0lBAwwCgYIKwYBBQUHAwEw
| DAYDVR0TAQH/BAIwADAdBgNVHQ4EFgQUL6dJ4L43WNY8JT48fpK2N24MimwwHwYD
| VR0jBBgwFoAU56ufDywzoFPTXk94yLKEDjvWkjMwMwYIKwYBBQUHAQEEJzAlMCMG
| CCsGAQUFBzAChhdodHRwOi8vcjEzLmkubGVuY3Iub3JnLzAlBgNVHREEHjAcghpu
| ZXh0Y2xvdWQubGFuLmRkbnNnZWVrLmNvbTATBgNVHSAEDDAKMAgGBmeBDAECATAu
| BgNVHR8EJzAlMCOgIaAfhh1odHRwOi8vcjEzLmMubGVuY3Iub3JnLzM0LmNybDCC
| AQsGCisGAQQB1nkCBAIEgfwEgfkA9wB2AMIxfldFGaNF7n843rKQQevHwiFaIr9/
| 1bWtdprZDlLNAAABnXnSsysAAAQDAEcwRQIgFjRX18ymII+LUj3/mn40hTZc54+w
| uO66VcsD1AWz0xECIQC1XYnN8iIHf+gMkzrZSl57qZMxDvxAj0KIEL+kcIuDqwB9
| AKgmy+MKxjUSRlM/4GXxTxnZbhkIE8Qd2W15ALMSPFUnAAABnXnStdkACAAABQAG
| ZqdVBAMARjBEAiBzQI9gfXwLedWIC3sx8xgjoyD3p0Rf06uIVv7UE/IfsgIgOTTu
| GGd5gH4MWw7AmXB7oBWiZWcnJvR+gzq1RhHFtuwwDQYJKoZIhvcNAQELBQADggEB
| AG9ivSu820MYLxWacjStBZN9tZoJl6rI3E52h7pl70JXUFQ7hFr8SN0SCU9/Iz+L
| wDdrqUGC3T5lr5NeTqW1hRnsErVFGe8DygcQDEZyAwR6mi7ym1h3VwWJ+2y09We5
| euyyem+7J8l2KeaJMJZaboi9rKjp/D6nl8a7aUxD/k2WrcPfwI2pok7o+QVaHTzo
| oXUSiiowm5lU2Ir6WmDDShBc3Ddql9siUjULVqt5bUcTXXvrS2X8xItKS+Zz+J6N
| 3f6xHKzt8YFlHAoKYuRh1E7K/uKsBQ6oNEAv/fN7GJHuxbb9HHAwZJe+DTnCAPws
| 84ceLvP0DzJN/Socs95sKb4=
|_-----END CERTIFICATE-----
| http-methods:
|_ Supported Methods: GET HEAD POST OPTIONS
| http-robots.txt: 1 disallowed entry
|_/
|_ssl-date: TLS randomness does not represent time
|_http-server-header: Apache/2.4.66 (Debian)
| http-title: Login \xE2\x80\x93 Nextcloud
|_Requested resource was https://nextcloud.lan.ddnsgeek.com/index.php/login
| http-robots.txt: 1 disallowed entry
|_/
|_http-server-header: Apache/2.4.66 (Debian)
|_ssl-date: TLS randomness does not represent time
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running (JUST GUESSING): Linux 5.X (89%)
Running (JUST GUESSING): Linux 5.X (91%)
OS CPE: cpe:/o:linux:linux_kernel:5.4
OS fingerprint not ideal because: Missing a closed TCP port so results incomplete
Aggressive OS guesses: Linux 5.4 (89%)
Aggressive OS guesses: Linux 5.4 (91%)
No exact OS matches for host (test conditions non-ideal).
TCP/IP fingerprint:
SCAN(V=7.98%E=4%D=4/5%OT=80%CT=%CU=%PV=N%DS=8%DC=T%G=N%TM=69D21A01%P=x86_64-pc-linux-gnu)
SEQ(SP=101%GCD=1%ISR=10C%TI=Z%TS=A)
SEQ(SP=103%GCD=1%ISR=10C%TI=Z%TS=A)
OPS(O1=M5B4ST11NW7%O2=M5B4ST11NW7%O3=NNT11%O4=M5B4ST11NW7%O5=M5B4ST11NW7%O6=M5B4ST11)
WIN(W1=FE88%W2=FE88%W3=9AE%W4=FE88%W5=FE88%W6=FE88)
SCAN(V=7.99%E=4%D=4/14%OT=80%CT=%CU=%PV=N%DS=8%DC=T%G=N%TM=69DDB929%P=x86_64-pc-linux-gnu)
SEQ(SP=100%GCD=1%ISR=10F%TI=Z%TS=A)
SEQ(SP=106%GCD=1%ISR=10C%TI=Z%TS=A)
OPS(O1=M5B4ST11NW7%O2=M5B4ST11NW7%O3=M5B4NNT11NW7%O4=M5B4ST11NW7%O5=M5B4ST11NW7%O6=M5B4ST11)
WIN(W1=FE88%W2=FE88%W3=FE88%W4=FE88%W5=FE88%W6=FE88)
ECN(R=N)
T1(R=Y%DF=Y%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T6(R=Y%DF=Y%TG=40%W=FE88%S=O%A=O%F=AS%O=M5B4ST11NW7%RD=0%Q=)
U1(R=N)
IE(R=N)
Uptime guess: 16.942 days (since Thu Mar 19 09:37:52 2026)
Uptime guess: 49.675 days (since Mon Feb 23 11:37:20 2026)
Network Distance: 8 hops
TCP Sequence Prediction: Difficulty=259 (Good luck!)
TCP Sequence Prediction: Difficulty=256 (Good luck!)
IP ID Sequence Generation: All zeros
TRACEROUTE (using port 80/tcp)
TRACEROUTE (using port 443/tcp)
HOP RTT ADDRESS
1 0.34 ms 10.216.0.161
2 0.42 ms 10.216.35.11
3 4.77 ms 10.216.32.1
4 0.37 ms lo0-0.gw2.syd1.au.linode.com (172.105.160.102)
5 3.72 ms as4764.syd.edgeix.net.au (202.77.88.3)
6 11.80 ms 10.241.1.187
7 12.53 ms 10.241.2.71
8 14.18 ms 167-179-167-166.a7b3a7.bne.nbn.aussiebb.net (167.179.167.166)
1 0.15 ms 10.216.0.161
2 0.45 ms 10.216.35.12
3 0.91 ms 10.216.32.2
4 0.43 ms lo0-0.gw1.syd1.au.linode.com (172.105.160.101)
5 2.04 ms as4764.syd.edgeix.net.au (202.77.88.3)
6 11.71 ms 10.241.1.187
7 12.56 ms 10.241.2.71
8 13.90 ms 167-179-167-166.a7b3a7.bne.nbn.aussiebb.net (167.179.167.166)
Read data files from: /usr/share/nmap
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Sun Apr 5 08:14:57 2026 -- 1 IP address (1 host up) scanned in 402.48 seconds
# Nmap done at Tue Apr 14 03:48:57 2026 -- 1 IP address (1 host up) scanned in 230.95 seconds
```
results/report.md/nextcloud.lan.ddnsgeek.com/Services/Service - tcp-443-http/Curl Robots.md
+1 -2
View File
@@ -8,7 +8,7 @@ curl -sSikf https://nextcloud.lan.ddnsgeek.com:443/robots.txt
HTTP/2 200
accept-ranges: bytes
content-type: text/plain; charset=utf-8
date: Sun, 05 Apr 2026 08:15:05 GMT
date: Tue, 14 Apr 2026 03:48:59 GMT
etag: "1a-64e41fd0d5664"
last-modified: Mon, 30 Mar 2026 18:26:25 GMT
referrer-policy: no-referrer
@@ -23,5 +23,4 @@ content-length: 26
User-agent: *
Disallow: /
```
results/report.md/nextcloud.lan.ddnsgeek.com/Services/Service - tcp-443-http/Curl.md
+6 -7
View File
@@ -6,18 +6,18 @@ curl -sSik https://nextcloud.lan.ddnsgeek.com:443/
```
HTTP/2 302
content-security-policy: default-src 'self'; script-src 'self' 'nonce-0UjAoEIy1Rabnj72oZ1MOexz4/Jo1zf+kWHhit5OsFg='; style-src 'self' 'unsafe-inline'; frame-src *; img-src * data: blob:; font-src 'self' data:; media-src *; connect-src *; object-src 'none'; base-uri 'self';
content-security-policy: default-src 'self'; script-src 'self' 'nonce-dPrOadKHeACGSW0T3+sYeu/ZJfuEvLOXAGkQZNN2WNo='; style-src 'self' 'unsafe-inline'; frame-src *; img-src * data: blob:; font-src 'self' data:; media-src *; connect-src *; object-src 'none'; base-uri 'self';
content-type: text/html; charset=UTF-8
date: Sun, 05 Apr 2026 08:15:07 GMT
date: Tue, 14 Apr 2026 03:48:59 GMT
location: https://nextcloud.lan.ddnsgeek.com/index.php/login
referrer-policy: no-referrer
server: Apache/2.4.66 (Debian)
set-cookie: ocexfs76yoe2=e967eb027dcffbc8de5b9970ea4f1d49; path=/; secure; HttpOnly; SameSite=Lax
set-cookie: oc_sessionPassphrase=Qe9VfIvKEADVVKypzMAh9bod76L%2BO9pllh2SFfHSV9qilitYJE4V6f0E2h8mXiocS%2F9WjZgYB5qZJFhGfKXnNlbkJ7UL9%2FPeJVKhCuXEOVCJ4nhjMBP3igQmb%2BAiBYKm; path=/; secure; HttpOnly; SameSite=Lax
set-cookie: ocexfs76yoe2=e967eb027dcffbc8de5b9970ea4f1d49; path=/; secure; HttpOnly; SameSite=Lax
set-cookie: ocexfs76yoe2=9e45361fa989bdb4c67c4ff553384b13; path=/; secure; HttpOnly; SameSite=Lax
set-cookie: oc_sessionPassphrase=y8j7u7X8JXPxNFeCmTzyiB3t78UaqwatD6dRDbon5UtfgbUaAUQCHqIrPaj9u8G0tXXFSw35R55svDq%2Fe4Z7wEJQO2MQPPRIxUt5OCbB9eGx2NI6G0Wrdbha4m5s52bg; path=/; secure; HttpOnly; SameSite=Lax
set-cookie: ocexfs76yoe2=9e45361fa989bdb4c67c4ff553384b13; path=/; secure; HttpOnly; SameSite=Lax
set-cookie: __Host-nc_sameSiteCookielax=true; path=/; httponly;secure; expires=Fri, 31-Dec-2100 23:59:59 GMT; SameSite=lax
set-cookie: __Host-nc_sameSiteCookiestrict=true; path=/; httponly;secure; expires=Fri, 31-Dec-2100 23:59:59 GMT; SameSite=strict
set-cookie: ocexfs76yoe2=e967eb027dcffbc8de5b9970ea4f1d49; path=/; secure; HttpOnly; SameSite=Lax
set-cookie: ocexfs76yoe2=9e45361fa989bdb4c67c4ff553384b13; path=/; secure; HttpOnly; SameSite=Lax
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
@@ -28,5 +28,4 @@ x-xss-protection: 1; mode=block
content-length: 0
```
results/report.md/nextcloud.lan.ddnsgeek.com/Services/Service - tcp-443-http/Directory Buster.md
+11 -10
View File
@@ -290,28 +290,28 @@ Configuration {
unique: false,
response_size_limit: 4194304,
}
401 GET 2l 12w 75c https://nextcloud.lan.ddnsgeek.com/index.php/apps/dashboard
401 GET 2l 12w 75c https://nextcloud.lan.ddnsgeek.com/index.php/apps/files
401 GET 2l 12w 75c https://nextcloud.lan.ddnsgeek.com/index.php/apps/logreader
401 GET 2l 12w 75c https://nextcloud.lan.ddnsgeek.com/index.php/apps/photos
401 GET 2l 12w 75c https://nextcloud.lan.ddnsgeek.com/index.php/apps/dashboard
200 GET 494l 1557w 31067c https://nextcloud.lan.ddnsgeek.com/index.php/apps/files_pdfviewer
401 GET 2l 12w 75c https://nextcloud.lan.ddnsgeek.com/index.php/apps/activity
401 GET 2l 12w 75c https://nextcloud.lan.ddnsgeek.com/index.php/apps/files
401 GET 2l 12w 75c https://nextcloud.lan.ddnsgeek.com/index.php/apps/photos
200 GET 93l 341w 16047c https://nextcloud.lan.ddnsgeek.com/index.php/login
401 GET 2l 12w 75c https://nextcloud.lan.ddnsgeek.com/.well-known/caldav
401 GET 2l 12w 75c https://nextcloud.lan.ddnsgeek.com/.well-known/carddav
401 GET 2l 12w 75c https://nextcloud.lan.ddnsgeek.com/index.php/settings/user/security
401 GET 2l 12w 75c https://nextcloud.lan.ddnsgeek.com/.well-known/caldav.txt
401 GET 2l 12w 75c https://nextcloud.lan.ddnsgeek.com/.well-known/caldav
401 GET 2l 12w 75c https://nextcloud.lan.ddnsgeek.com/.well-known/carddav.txt
401 GET 2l 12w 75c https://nextcloud.lan.ddnsgeek.com/.well-known/carddav.html
401 GET 2l 12w 75c https://nextcloud.lan.ddnsgeek.com/.well-known/caldav.txt
401 GET 2l 12w 75c https://nextcloud.lan.ddnsgeek.com/.well-known/caldav.html
401 GET 2l 12w 75c https://nextcloud.lan.ddnsgeek.com/.well-known/carddav.php
401 GET 2l 12w 75c https://nextcloud.lan.ddnsgeek.com/index.php/settings/user/security
401 GET 2l 12w 75c https://nextcloud.lan.ddnsgeek.com/.well-known/carddav.html
401 GET 2l 12w 75c https://nextcloud.lan.ddnsgeek.com/.well-known/caldav.php
401 GET 2l 12w 75c https://nextcloud.lan.ddnsgeek.com/.well-known/carddav.asp
401 GET 2l 12w 75c https://nextcloud.lan.ddnsgeek.com/.well-known/caldav.asp
401 GET 2l 12w 75c https://nextcloud.lan.ddnsgeek.com/.well-known/carddav.php
401 GET 2l 12w 75c https://nextcloud.lan.ddnsgeek.com/.well-known/caldav.aspx
401 GET 2l 12w 75c https://nextcloud.lan.ddnsgeek.com/.well-known/caldav.jsp
401 GET 2l 12w 75c https://nextcloud.lan.ddnsgeek.com/.well-known/carddav.asp
401 GET 2l 12w 75c https://nextcloud.lan.ddnsgeek.com/.well-known/carddav.aspx
401 GET 2l 12w 75c https://nextcloud.lan.ddnsgeek.com/.well-known/carddav.jsp
401 GET 2l 12w 75c https://nextcloud.lan.ddnsgeek.com/.well-known/caldav.jsp
200 GET 6l 12w 281c https://nextcloud.lan.ddnsgeek.com/.well-known/security.txt
200 GET 1l 5w 77c https://nextcloud.lan.ddnsgeek.com/cron.php
200 GET 12l 31w 331c https://nextcloud.lan.ddnsgeek.com/index.html
@@ -320,5 +320,6 @@ Configuration {
200 GET 1l 1w 170c https://nextcloud.lan.ddnsgeek.com/status.php
200 GET 0l 0w 0c https://nextcloud.lan.ddnsgeek.com/version.php
200 GET 661l 5535w 34520c https://nextcloud.lan.ddnsgeek.com/COPYING
404 GET 0l 0w 64c https://nextcloud.lan.ddnsgeek.com/spreadsheets.aspx
```
results/report.md/nextcloud.lan.ddnsgeek.com/Services/Service - tcp-443-http/Known Security.md
+6 -7
View File
@@ -9,16 +9,16 @@ HTTP/2 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: default-src 'none';base-uri 'none';manifest-src 'self';frame-ancestors 'none'
content-type: text/plain;charset=UTF-8
date: Sun, 05 Apr 2026 08:15:04 GMT
date: Tue, 14 Apr 2026 03:48:59 GMT
feature-policy: autoplay 'none';camera 'none';fullscreen 'none';geolocation 'none';microphone 'none';payment 'none'
referrer-policy: no-referrer
server: Apache/2.4.66 (Debian)
set-cookie: ocexfs76yoe2=0e51bcf9950c6c3c1daa59f041984726; path=/; secure; HttpOnly; SameSite=Lax
set-cookie: oc_sessionPassphrase=wMD2r4bjh3qzFmpNL0NjJILFcgpYM7BaIp9xoMpv24WNwSUdpi3tOs5%2FTjqdmUplkJf6bjitdDnd3ItEf4g2yfB7kyCENUGFDsaqdH23YmQe7xumvAbfzZt5w0IdtZc4; path=/; secure; HttpOnly; SameSite=Lax
set-cookie: ocexfs76yoe2=0e51bcf9950c6c3c1daa59f041984726; path=/; secure; HttpOnly; SameSite=Lax
set-cookie: ocexfs76yoe2=fae5003f49421836c006ef3a07b86baa; path=/; secure; HttpOnly; SameSite=Lax
set-cookie: oc_sessionPassphrase=%2FsEu5b1GCprHfK4f4G35q%2FYyZ0cTW5%2BFXoWXNvx2ic1CWYPc9VzXGnmHhsyieg5UF8kR5aPq6S2Ia0fAZTCy7VVj1WXwcAeEWMWHQk%2BG%2Fd048AQRTf9OZm0AJLUpO45u; path=/; secure; HttpOnly; SameSite=Lax
set-cookie: ocexfs76yoe2=fae5003f49421836c006ef3a07b86baa; path=/; secure; HttpOnly; SameSite=Lax
set-cookie: __Host-nc_sameSiteCookielax=true; path=/; httponly;secure; expires=Fri, 31-Dec-2100 23:59:59 GMT; SameSite=lax
set-cookie: __Host-nc_sameSiteCookiestrict=true; path=/; httponly;secure; expires=Fri, 31-Dec-2100 23:59:59 GMT; SameSite=strict
set-cookie: ocexfs76yoe2=0e51bcf9950c6c3c1daa59f041984726; path=/; secure; HttpOnly; SameSite=Lax
set-cookie: ocexfs76yoe2=fae5003f49421836c006ef3a07b86baa; path=/; secure; HttpOnly; SameSite=Lax
strict-transport-security: max-age=15552000; includeSubDomains; preload
vary: Accept-Encoding
x-content-type-options: nosniff
@@ -26,7 +26,7 @@ x-frame-options: SAMEORIGIN
x-nextcloud-well-known: 1
x-permitted-cross-domain-policies: none
x-powered-by: PHP/8.3.30
x-request-id: lt7eKRvu1nrKBoKkjBte
x-request-id: hjzokHPO2YT8KgfP9CM3
x-robots-tag: noindex, nofollow
x-xss-protection: 1; mode=block
@@ -36,5 +36,4 @@ Acknowledgments: https://hackerone.com/nextcloud/thanks
Acknowledgments: https://github.com/nextcloud/security-advisories/security/advisories
Policy: https://hackerone.com/nextcloud
Preferred-Languages: en
```
results/report.md/nextcloud.lan.ddnsgeek.com/Services/Service - tcp-443-http/Nmap HTTP.md
+145 -94
View File
@@ -5,50 +5,88 @@ nmap -vv --reason -Pn -T4 -sV -p 443 --script="banner,(http* or ssl*) and not (b
[/root/results/nextcloud.lan.ddnsgeek.com/scans/tcp443/tcp_443_https_nmap.txt](file:///root/results/nextcloud.lan.ddnsgeek.com/scans/tcp443/tcp_443_https_nmap.txt):
```
# Nmap 7.98 scan initiated Sun Apr 5 08:16:04 2026 as: /usr/lib/nmap/nmap -vv --reason -Pn -T4 -sV -p 443 "--script=banner,(http* or ssl*) and not (brute or broadcast or dos or external or http-slowloris* or fuzzer)" -oN /root/results/nextcloud.lan.ddnsgeek.com/scans/tcp443/tcp_443_https_nmap.txt -oX /root/results/nextcloud.lan.ddnsgeek.com/scans/tcp443/xml/tcp_443_https_nmap.xml nextcloud.lan.ddnsgeek.com
# Nmap 7.99 scan initiated Tue Apr 14 03:49:00 2026 as: /usr/lib/nmap/nmap -vv --reason -Pn -T4 -sV -p 443 "--script=banner,(http* or ssl*) and not (brute or broadcast or dos or external or http-slowloris* or fuzzer)" -oN /root/results/nextcloud.lan.ddnsgeek.com/scans/tcp443/tcp_443_https_nmap.txt -oX /root/results/nextcloud.lan.ddnsgeek.com/scans/tcp443/xml/tcp_443_https_nmap.xml nextcloud.lan.ddnsgeek.com
Nmap scan report for nextcloud.lan.ddnsgeek.com (167.179.167.166)
Host is up, received user-set (0.026s latency).
Host is up, received user-set (0.014s latency).
rDNS record for 167.179.167.166: 167-179-167-166.a7b3a7.bne.nbn.aussiebb.net
Scanned at 2026-04-05 08:16:23 UTC for 705s
Scanned at 2026-04-14 03:49:13 UTC for 503s
PORT STATE SERVICE REASON VERSION
443/tcp open ssl/http syn-ack ttl 55 Golang net/http server (Go-IPFS json-rpc or InfluxDB API)
| http-waf-detect: IDS/IPS/WAF detected:
|_nextcloud.lan.ddnsgeek.com:443/?p4yl04d3=<script>alert(document.cookie)</script>
|_http-dombased-xss: Couldn't find any DOM based XSS.
|_http-server-header: Apache/2.4.66 (Debian)
| http-headers:
| Cache-Control: no-cache, no-store, must-revalidate
| Content-Length: 16047
| Content-Security-Policy: default-src 'none';base-uri 'none';manifest-src 'self';script-src 'nonce-UD/+8Gehnjv7KV5meNGH9n+8Zuy7Mo93L8fvPTLG4rg=';script-src-elem 'strict-dynamic' 'nonce-UD/+8Gehnjv7KV5meNGH9n+8Zuy7Mo93L8fvPTLG4rg=';style-src 'self' 'unsafe-inline';img-src 'self' data: blob: https://*.tile.openstreetmap.org;font-src 'self' data:;connect-src 'self';media-src 'self';frame-src 'self';frame-ancestors 'self';form-action 'self'
| Content-Type: text/html; charset=UTF-8
| Date: Sun, 05 Apr 2026 08:19:52 GMT
| Feature-Policy: autoplay 'self';camera 'none';fullscreen 'self';geolocation 'none';microphone 'none';payment 'none'
| Referrer-Policy: same-origin
| Server: Apache/2.4.66 (Debian)
| Set-Cookie: ocexfs76yoe2=ec8e4644674a95fc3c6b23b49c28df1f; path=/; secure; HttpOnly; SameSite=Lax
| Set-Cookie: oc_sessionPassphrase=vaA75gLRczK4PR19LRVIdeCUbAH2eyCr84lwC0J%2FRs%2FAJzlQYpiLdt%2BxMWrssNRkSjTrifW2r%2Fg0sWzn7Cact8Zw3rXzotR6z4WBk4sSNdwp4UgXFlUAwNHKCMEVwmfq; path=/; secure; HttpOnly; SameSite=Lax
| Set-Cookie: ocexfs76yoe2=ec8e4644674a95fc3c6b23b49c28df1f; path=/; secure; HttpOnly; SameSite=Lax
| Set-Cookie: __Host-nc_sameSiteCookielax=true; path=/; httponly;secure; expires=Fri, 31-Dec-2100 23:59:59 GMT; SameSite=lax
| Set-Cookie: __Host-nc_sameSiteCookiestrict=true; path=/; httponly;secure; expires=Fri, 31-Dec-2100 23:59:59 GMT; SameSite=strict
| Set-Cookie: ocexfs76yoe2=ec8e4644674a95fc3c6b23b49c28df1f; path=/; secure; HttpOnly; SameSite=Lax
| Set-Cookie: ocexfs76yoe2=ec8e4644674a95fc3c6b23b49c28df1f; path=/; secure; HttpOnly; SameSite=Lax
| Strict-Transport-Security: max-age=15552000; includeSubDomains; preload
| X-Content-Type-Options: nosniff
| X-Frame-Options: SAMEORIGIN
| X-Permitted-Cross-Domain-Policies: none
| X-Powered-By: PHP/8.3.30
| X-Request-Id: 8l0zCl9BZ2uwysWABFY8
| X-Robots-Tag: noindex, nofollow
| X-Xss-Protection: 1; mode=block
| Connection: close
|
|_ (Request type: HEAD)
| http-title: Login \xE2\x80\x93 Nextcloud
|_Requested resource was https://nextcloud.lan.ddnsgeek.com/index.php/login
| http-vhosts:
| 127 names had status 404
|_auth.lan.ddnsgeek.com : 200
|_http-feed: Couldn't find any feeds.
|_http-jsonp-detection: Couldn't find any JSONP endpoints.
|_http-wordpress-users: [Error] Wordpress installation was not found. We couldn't find wp-login.php
|_http-csrf: Couldn't find any CSRF vulnerabilities.
| ssl-cert: Subject: commonName=nextcloud.lan.ddnsgeek.com
| Subject Alternative Name: DNS:nextcloud.lan.ddnsgeek.com
| Issuer: commonName=R13/organizationName=Let's Encrypt/countryName=US
| Public Key type: rsa
| Public Key bits: 4096
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2026-04-10T22:57:14
| Not valid after: 2026-07-09T22:57:13
| MD5: 3e9f 313a b74d 382e 83fc 5f1a 5a53 e40b
| SHA-1: 1937 4753 629c 2c83 886f ec53 de7e 0a3c de34 7039
| SHA-256: 3c52 054a efae 0d1d 5cf0 8226 e0ae 7ad0 478a 8c85 f5e7 a963 0ddd 072d d9c5 d129
| -----BEGIN CERTIFICATE-----
| MIIGDTCCBPWgAwIBAgISBrmm2MmqMNL/bqguwka5v7ahMA0GCSqGSIb3DQEBCwUA
| MDMxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQwwCgYDVQQD
| EwNSMTMwHhcNMjYwNDEwMjI1NzE0WhcNMjYwNzA5MjI1NzEzWjAlMSMwIQYDVQQD
| ExpuZXh0Y2xvdWQubGFuLmRkbnNnZWVrLmNvbTCCAiIwDQYJKoZIhvcNAQEBBQAD
| ggIPADCCAgoCggIBAMfZPcsjUERAyRB3mvCx+kUJE/5gKelvulMMV3uCdil8yiop
| 3CgXHNN1E/9hsK8/gueXU1AbcpNUrHP1clNlrMku+GuwAQF4+eulJdycXM8UBOB4
| HkWO/CljSna1EZQlPx4FhDLMSki2uLP9mgNOM1/lBQ1qPG3B3EXLKOqGlEQ/zOjg
| /gyPEBxjWA3bYZZN4oiaFHnA32ontFN7CQ7COeCJCnRpr2zAUvpRO5U5uH2cfApt
| 4gha9FQSgAj6lAqFGDrRDLqUl1oGY4HM5DWDhYiYnJ/n34hDRoWOt1D02PpCjNQf
| O4CDs+6udQN7zBNQBZiSBEtpGnQn73EFeElRvoGqZMrQFJa6/VEle+oJxdQL5JIv
| yeqILlfJqlMgAiM4rItUKl9hTtWOfTuPCGbtPx7qDG6gdD2CDxdgPfPBseiKU6DV
| sbHAs6aAv17982O0FIf4LE7vSmkVSpzafYRXdx/F5I6Zi+t7SlsC+l7cZiYMAyfU
| DP6kmO7mCGRRQmxu1Ui6hZjIWEa2VJ6epueY7GtrEmsVulna+uq+jz2vI/uk99EF
| H2NZuc/65i67UAjUllYA/58dTcC6kX6/WO5CTRsCzkhY0cCY2xGrs2i6bok50TzQ
| 90IlIpa4IK19uDunxb6i7BFY/m56lmpKkYcyNflBCOrPtBSkVpUe45skVVdRAgMB
| AAGjggInMIICIzAOBgNVHQ8BAf8EBAMCBaAwEwYDVR0lBAwwCgYIKwYBBQUHAwEw
| DAYDVR0TAQH/BAIwADAdBgNVHQ4EFgQUL6dJ4L43WNY8JT48fpK2N24MimwwHwYD
| VR0jBBgwFoAU56ufDywzoFPTXk94yLKEDjvWkjMwMwYIKwYBBQUHAQEEJzAlMCMG
| CCsGAQUFBzAChhdodHRwOi8vcjEzLmkubGVuY3Iub3JnLzAlBgNVHREEHjAcghpu
| ZXh0Y2xvdWQubGFuLmRkbnNnZWVrLmNvbTATBgNVHSAEDDAKMAgGBmeBDAECATAu
| BgNVHR8EJzAlMCOgIaAfhh1odHRwOi8vcjEzLmMubGVuY3Iub3JnLzM0LmNybDCC
| AQsGCisGAQQB1nkCBAIEgfwEgfkA9wB2AMIxfldFGaNF7n843rKQQevHwiFaIr9/
| 1bWtdprZDlLNAAABnXnSsysAAAQDAEcwRQIgFjRX18ymII+LUj3/mn40hTZc54+w
| uO66VcsD1AWz0xECIQC1XYnN8iIHf+gMkzrZSl57qZMxDvxAj0KIEL+kcIuDqwB9
| AKgmy+MKxjUSRlM/4GXxTxnZbhkIE8Qd2W15ALMSPFUnAAABnXnStdkACAAABQAG
| ZqdVBAMARjBEAiBzQI9gfXwLedWIC3sx8xgjoyD3p0Rf06uIVv7UE/IfsgIgOTTu
| GGd5gH4MWw7AmXB7oBWiZWcnJvR+gzq1RhHFtuwwDQYJKoZIhvcNAQELBQADggEB
| AG9ivSu820MYLxWacjStBZN9tZoJl6rI3E52h7pl70JXUFQ7hFr8SN0SCU9/Iz+L
| wDdrqUGC3T5lr5NeTqW1hRnsErVFGe8DygcQDEZyAwR6mi7ym1h3VwWJ+2y09We5
| euyyem+7J8l2KeaJMJZaboi9rKjp/D6nl8a7aUxD/k2WrcPfwI2pok7o+QVaHTzo
| oXUSiiowm5lU2Ir6WmDDShBc3Ddql9siUjULVqt5bUcTXXvrS2X8xItKS+Zz+J6N
| 3f6xHKzt8YFlHAoKYuRh1E7K/uKsBQ6oNEAv/fN7GJHuxbb9HHAwZJe+DTnCAPws
| 84ceLvP0DzJN/Socs95sKb4=
|_-----END CERTIFICATE-----
|_http-wordpress-enum: Nothing found amongst the top 100 resources,use --script-args search-limit=<number|all> for deeper analysis)
| http-useragent-tester:
| Status for browser useragent: 200
| Redirected To: https://nextcloud.lan.ddnsgeek.com/index.php/login
| Allowed User Agents:
| Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)
| lwp-trivial
| libcurl-agent/1.0
| PHP/
| Python-urllib/2.5
| GT::WWW
| Snoopy
| MFC_Tear_Sample
| HTTP::Lite
| PHPCrawl
| URI::Fetch
| Zend_Http_Client
| http client
| PECL::HTTP
| Wget/1.13.4 (linux-gnu)
| WWW-Mechanize/1.34
| Change in Status Code:
|_ libwww: 404
| ssl-enum-ciphers:
| TLSv1.2:
| ciphers:
@@ -69,27 +107,27 @@ PORT STATE SERVICE REASON VERSION
| TLS_AKE_WITH_CHACHA20_POLY1305_SHA256 (X25519MLKEM768) - A
| cipher preference: server
|_ least strength: A
|_http-wordpress-enum: Nothing found amongst the top 100 resources,use --script-args search-limit=<number|all> for deeper analysis)
| http-errors:
| Spidering limited to: maxpagecount=40; withinhost=nextcloud.lan.ddnsgeek.com
| Found the following error pages:
|
| Error Code: 404
|_ http://nextcloud.lan.ddnsgeek.com:443/
|_http-referer-checker: Couldn't find any cross-domain scripts.
|_ssl-date: TLS randomness does not represent time
|_http-litespeed-sourcecode-download: Request with null byte did not work. This web server might not be vulnerable
| http-referer-checker:
| Spidering limited to: maxpagecount=30
| https://nextcloud.lan.ddnsgeek.com:443/dist/core-common.js?v=e80d16a8-0
| https://nextcloud.lan.ddnsgeek.com:443/dist/core-login.js?v=e80d16a8-0
| https://nextcloud.lan.ddnsgeek.com:443/apps/theming/js/theming.js?v=e80d16a8-0
|_ https://nextcloud.lan.ddnsgeek.com:443/dist/core-main.js?v=e80d16a8-0
|_http-fetch: Please enter the complete path of the directory to save data in.
| http-sitemap-generator:
| Directory structure:
| /index.php/
| Other: 1
| Longest directory structure:
| Depth: 1
| Dir: /index.php/
| Total files found (by extension):
|_ Other: 1
|_http-date: Sun, 05 Apr 2026 08:20:00 GMT; -6s from local time.
| http-waf-detect: IDS/IPS/WAF detected:
|_nextcloud.lan.ddnsgeek.com:443/?p4yl04d3=<script>alert(document.cookie)</script>
| http-methods:
|_ Supported Methods: GET HEAD POST OPTIONS
|_http-malware-host: Host appears to be clean
| http-vhosts:
| auth.lan.ddnsgeek.com : 200
|_127 names had status 404
|_http-feed: Couldn't find any feeds.
|_http-date: Tue, 14 Apr 2026 03:52:41 GMT; -3s from local time.
|_http-jsonp-detection: Couldn't find any JSONP endpoints.
|_http-devframework: Couldn't determine the underlying framework or CMS. Try increasing 'httpspider.maxpagecount' value to spider more pages.
|_http-server-header: Apache/2.4.66 (Debian)
|_http-stored-xss: Couldn't find any stored XSS vulnerabilities.
| http-security-headers:
| Strict_Transport_Security:
| Header: Strict-Transport-Security: max-age=15552000; includeSubDomains; preload
@@ -103,7 +141,7 @@ PORT STATE SERVICE REASON VERSION
| Header: X-Content-Type-Options: nosniff
| Description: Will prevent the browser from MIME-sniffing a response away from the declared content-type.
| Content_Security_Policy:
| Header: Content-Security-Policy: default-src 'none';base-uri 'none';manifest-src 'self';script-src 'nonce-UD/+8Gehnjv7KV5meNGH9n+8Zuy7Mo93L8fvPTLG4rg=';script-src-elem 'strict-dynamic' 'nonce-UD/+8Gehnjv7KV5meNGH9n+8Zuy7Mo93L8fvPTLG4rg=';style-src 'self' 'unsafe-inline';img-src 'self' data: blob: https://*.tile.openstreetmap.org;font-src 'self' data:;connect-src 'self';media-src 'self';frame-src 'self';frame-ancestors 'self';form-action 'self'
| Header: Content-Security-Policy: default-src 'none';base-uri 'none';manifest-src 'self';script-src 'nonce-X594h5DgY3hTUT16aMu7aHJx7JGnNKQBMo8qHmmeJz4=';script-src-elem 'strict-dynamic' 'nonce-X594h5DgY3hTUT16aMu7aHJx7JGnNKQBMo8qHmmeJz4=';style-src 'self' 'unsafe-inline';img-src 'self' data: blob: https://*.tile.openstreetmap.org;font-src 'self' data:;connect-src 'self';media-src 'self';frame-src 'self';frame-ancestors 'self';form-action 'self'
| Description: Define the base uri for relative uri.
| Description: Define loading policy for all resources type in case of a resource type dedicated directive is not defined (fallback).
| Description: Define which scripts the protected resource can execute.
@@ -122,39 +160,12 @@ PORT STATE SERVICE REASON VERSION
| Cookies are secured with Secure Flag in HTTPS Connection
| Cache_Control:
|_ Header: Cache-Control: no-cache, no-store, must-revalidate
| http-useragent-tester:
| Status for browser useragent: 200
| Redirected To: https://nextcloud.lan.ddnsgeek.com/index.php/login
| Allowed User Agents:
| Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)
| libwww
| lwp-trivial
| libcurl-agent/1.0
| PHP/
| Python-urllib/2.5
| GT::WWW
| Snoopy
| MFC_Tear_Sample
| HTTP::Lite
| PHPCrawl
| URI::Fetch
| Zend_Http_Client
| http client
| PECL::HTTP
| Wget/1.13.4 (linux-gnu)
|_ WWW-Mechanize/1.34
|_http-chrono: Request times for /index.php/login; avg: 3919.89ms; min: 1656.25ms; max: 10499.33ms
|_http-stored-xss: Couldn't find any stored XSS vulnerabilities.
|_http-drupal-enum: Nothing found amongst the top 100 resources,use --script-args number=<number|all> for deeper analysis)
|_http-csrf: Couldn't find any CSRF vulnerabilities.
|_http-mobileversion-checker: No mobile version detected.
|_http-php-version: Logo query returned unknown hash e473773cc5b8b9dc08c846c0dc434c15
|_http-litespeed-sourcecode-download: Request with null byte did not work. This web server might not be vulnerable
| http-methods:
|_ Supported Methods: GET HEAD POST OPTIONS
|_ssl-date: TLS randomness does not represent time
|_http-devframework: Couldn't determine the underlying framework or CMS. Try increasing 'httpspider.maxpagecount' value to spider more pages.
| http-enum:
|_ /robots.txt: Robots file
|_http-comments-displayer: Couldn't find any comments.
|_http-chrono: Request times for /index.php/login; avg: 2458.85ms; min: 1703.33ms; max: 3689.52ms
|_http-drupal-enum: Nothing found amongst the top 100 resources,use --script-args number=<number|all> for deeper analysis)
|_http-mobileversion-checker: No mobile version detected.
| http-traceroute:
| Status Code
| Hop #1: 404
@@ -176,11 +187,51 @@ PORT STATE SERVICE REASON VERSION
| Hop #1
| Hop #2: https://nextcloud.lan.ddnsgeek.com/index.php/login
|_ Hop #3: https://nextcloud.lan.ddnsgeek.com/index.php/login
|_http-malware-host: Host appears to be clean
|_http-wordpress-users: [Error] Wordpress installation was not found. We couldn't find wp-login.php
| http-php-version: Logo query returned unknown hash 7209a04a90229576f2e4ff38710cbbd5
| Credits query returned unknown hash 7209a04a90229576f2e4ff38710cbbd5
|_Version from header x-powered-by: PHP/8.3.30
| http-sitemap-generator:
| Directory structure:
| /index.php/
| Other: 1
| Longest directory structure:
| Depth: 1
| Dir: /index.php/
| Total files found (by extension):
|_ Other: 1
| http-headers:
| Cache-Control: no-cache, no-store, must-revalidate
| Content-Length: 16047
| Content-Security-Policy: default-src 'none';base-uri 'none';manifest-src 'self';script-src 'nonce-X594h5DgY3hTUT16aMu7aHJx7JGnNKQBMo8qHmmeJz4=';script-src-elem 'strict-dynamic' 'nonce-X594h5DgY3hTUT16aMu7aHJx7JGnNKQBMo8qHmmeJz4=';style-src 'self' 'unsafe-inline';img-src 'self' data: blob: https://*.tile.openstreetmap.org;font-src 'self' data:;connect-src 'self';media-src 'self';frame-src 'self';frame-ancestors 'self';form-action 'self'
| Content-Type: text/html; charset=UTF-8
| Date: Tue, 14 Apr 2026 03:52:32 GMT
| Feature-Policy: autoplay 'self';camera 'none';fullscreen 'self';geolocation 'none';microphone 'none';payment 'none'
| Referrer-Policy: same-origin
| Server: Apache/2.4.66 (Debian)
| Set-Cookie: ocexfs76yoe2=d6e07917a213bb55c27a45dc41105050; path=/; secure; HttpOnly; SameSite=Lax
| Set-Cookie: oc_sessionPassphrase=iqjM5ZelDa7FDYnEagm7YKi4xAYxY%2By8HsYpzip6EAIve%2Fcaq75I8p1eNvhJHnoBu6bc3eJ3eRe2BYmlguMWP2cXiG2GI4pZRqf%2F3ml0UkUEyZZ%2B1Fbc78rWd%2B%2Fr1SzL; path=/; secure; HttpOnly; SameSite=Lax
| Set-Cookie: ocexfs76yoe2=d6e07917a213bb55c27a45dc41105050; path=/; secure; HttpOnly; SameSite=Lax
| Set-Cookie: __Host-nc_sameSiteCookielax=true; path=/; httponly;secure; expires=Fri, 31-Dec-2100 23:59:59 GMT; SameSite=lax
| Set-Cookie: __Host-nc_sameSiteCookiestrict=true; path=/; httponly;secure; expires=Fri, 31-Dec-2100 23:59:59 GMT; SameSite=strict
| Set-Cookie: ocexfs76yoe2=d6e07917a213bb55c27a45dc41105050; path=/; secure; HttpOnly; SameSite=Lax
| Set-Cookie: ocexfs76yoe2=d6e07917a213bb55c27a45dc41105050; path=/; secure; HttpOnly; SameSite=Lax
| Strict-Transport-Security: max-age=15552000; includeSubDomains; preload
| X-Content-Type-Options: nosniff
| X-Frame-Options: SAMEORIGIN
| X-Permitted-Cross-Domain-Policies: none
| X-Powered-By: PHP/8.3.30
| X-Request-Id: StUWwRgKsFOpX9ZPeriD
| X-Robots-Tag: noindex, nofollow
| X-Xss-Protection: 1; mode=block
| Connection: close
|
|_ (Request type: HEAD)
| http-title: Login \xE2\x80\x93 Nextcloud
|_Requested resource was https://nextcloud.lan.ddnsgeek.com/index.php/login
|_http-errors: Couldn't find any error pages.
Read data files from: /usr/share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Sun Apr 5 08:28:09 2026 -- 1 IP address (1 host up) scanned in 727.15 seconds
# Nmap done at Tue Apr 14 03:57:36 2026 -- 1 IP address (1 host up) scanned in 517.53 seconds
```
results/report.md/nextcloud.lan.ddnsgeek.com/Services/Service - tcp-443-http/SSL Scan.md
+52 -52
View File
@@ -6,7 +6,7 @@ sslscan --show-certificate --no-colour nextcloud.lan.ddnsgeek.com:443 2>&1
```
Version: 2.1.5
OpenSSL 3.5.3 16 Sep 2025
OpenSSL 3.5.5 27 Jan 2026
Connected to 167.179.167.166
@@ -56,9 +56,9 @@ TLSv1.2 128 bits x25519
SSL Certificate:
Certificate blob:
-----BEGIN CERTIFICATE-----
MIIGGDCCBQCgAwIBAgISBs84fOBMHD0zq0Oj2DfRjS1QMA0GCSqGSIb3DQEBCwUA
MIIGDTCCBPWgAwIBAgISBrmm2MmqMNL/bqguwka5v7ahMA0GCSqGSIb3DQEBCwUA
MDMxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQwwCgYDVQQD
EwNSMTIwHhcNMjYwMjA5MTkwMjM3WhcNMjYwNTEwMTkwMjM2WjAlMSMwIQYDVQQD
EwNSMTMwHhcNMjYwNDEwMjI1NzE0WhcNMjYwNzA5MjI1NzEzWjAlMSMwIQYDVQQD
ExpuZXh0Y2xvdWQubGFuLmRkbnNnZWVrLmNvbTCCAiIwDQYJKoZIhvcNAQEBBQAD
ggIPADCCAgoCggIBAMfZPcsjUERAyRB3mvCx+kUJE/5gKelvulMMV3uCdil8yiop
3CgXHNN1E/9hsK8/gueXU1AbcpNUrHP1clNlrMku+GuwAQF4+eulJdycXM8UBOB4
@@ -71,31 +71,31 @@ sbHAs6aAv17982O0FIf4LE7vSmkVSpzafYRXdx/F5I6Zi+t7SlsC+l7cZiYMAyfU
DP6kmO7mCGRRQmxu1Ui6hZjIWEa2VJ6epueY7GtrEmsVulna+uq+jz2vI/uk99EF
H2NZuc/65i67UAjUllYA/58dTcC6kX6/WO5CTRsCzkhY0cCY2xGrs2i6bok50TzQ
90IlIpa4IK19uDunxb6i7BFY/m56lmpKkYcyNflBCOrPtBSkVpUe45skVVdRAgMB
AAGjggIyMIICLjAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0lBBYwFAYIKwYBBQUHAwEG
CCsGAQUFBwMCMAwGA1UdEwEB/wQCMAAwHQYDVR0OBBYEFC+nSeC+N1jWPCU+PH6S
tjduDIpsMB8GA1UdIwQYMBaAFAC1KfItjm8x6JtMrXg++tzpDNHSMDMGCCsGAQUF
BwEBBCcwJTAjBggrBgEFBQcwAoYXaHR0cDovL3IxMi5pLmxlbmNyLm9yZy8wJQYD
VR0RBB4wHIIabmV4dGNsb3VkLmxhbi5kZG5zZ2Vlay5jb20wEwYDVR0gBAwwCjAI
BgZngQwBAgEwLgYDVR0fBCcwJTAjoCGgH4YdaHR0cDovL3IxMi5jLmxlbmNyLm9y
Zy84MS5jcmwwggEMBgorBgEEAdZ5AgQCBIH9BIH6APgAfgDjI43yjaKI4KrgrPD6
kMmF8La/9dKlJ7AB/BxEWMS26AAAAZxD/lXDAAgAAAUAMg4sIQQDAEcwRQIgIrCy
dkG2OA3k+ot4xDhxRpcnzkBKHTNZylHElvVz0J8CIQDfJueLeCcVjYrFxFfiBC7H
/0xdjUSIP0UwZKmWxao/TwB2ABaDLavwqSUPD/A6pUX/yL/II9CHS/YEKSf45x8z
E/X6AAABnEP+XTYAAAQDAEcwRQIhAPkHxBF88NswLBzx2jqn1RenJotA4rFrNQM9
1Eof/yZ7AiAHL5k+cqEy/GJ/5eSrDYLr7HCgFBZBE5FHYlXfQ/l32DANBgkqhkiG
9w0BAQsFAAOCAQEAlW2wfkaVWzbyhttsFH2ZuSqGY2PMi4UzJWCkokkB2fPG16Ky
+EvvTkkkj+U39fkyDqc44jCWJ1cvM5KP6YNyit2w+dhzicllKsO5OJeOQF49EZuC
jBxyK2AHJzOVUOpTSeaeWjRH6eVgq8ebnwxrN1APCKRhb99SRgfF5SttfVl9CHt+
qlimvDKxX7/PeXz+PW3KAI/DOTBF7mjZUUvIRZLr2Tv7AXtl27fbfpEtXhlBVsdy
2JtMrKu0qbfxfWeOr1uD69WWsPkgWZ8HHP+7VibHwyXUuc7FmHuxDQCtWFNkj9rm
lZr6d0LRlE/gU6T/SDixaqBbYR7VEOEMYhL0SA==
AAGjggInMIICIzAOBgNVHQ8BAf8EBAMCBaAwEwYDVR0lBAwwCgYIKwYBBQUHAwEw
DAYDVR0TAQH/BAIwADAdBgNVHQ4EFgQUL6dJ4L43WNY8JT48fpK2N24MimwwHwYD
VR0jBBgwFoAU56ufDywzoFPTXk94yLKEDjvWkjMwMwYIKwYBBQUHAQEEJzAlMCMG
CCsGAQUFBzAChhdodHRwOi8vcjEzLmkubGVuY3Iub3JnLzAlBgNVHREEHjAcghpu
ZXh0Y2xvdWQubGFuLmRkbnNnZWVrLmNvbTATBgNVHSAEDDAKMAgGBmeBDAECATAu
BgNVHR8EJzAlMCOgIaAfhh1odHRwOi8vcjEzLmMubGVuY3Iub3JnLzM0LmNybDCC
AQsGCisGAQQB1nkCBAIEgfwEgfkA9wB2AMIxfldFGaNF7n843rKQQevHwiFaIr9/
1bWtdprZDlLNAAABnXnSsysAAAQDAEcwRQIgFjRX18ymII+LUj3/mn40hTZc54+w
uO66VcsD1AWz0xECIQC1XYnN8iIHf+gMkzrZSl57qZMxDvxAj0KIEL+kcIuDqwB9
AKgmy+MKxjUSRlM/4GXxTxnZbhkIE8Qd2W15ALMSPFUnAAABnXnStdkACAAABQAG
ZqdVBAMARjBEAiBzQI9gfXwLedWIC3sx8xgjoyD3p0Rf06uIVv7UE/IfsgIgOTTu
GGd5gH4MWw7AmXB7oBWiZWcnJvR+gzq1RhHFtuwwDQYJKoZIhvcNAQELBQADggEB
AG9ivSu820MYLxWacjStBZN9tZoJl6rI3E52h7pl70JXUFQ7hFr8SN0SCU9/Iz+L
wDdrqUGC3T5lr5NeTqW1hRnsErVFGe8DygcQDEZyAwR6mi7ym1h3VwWJ+2y09We5
euyyem+7J8l2KeaJMJZaboi9rKjp/D6nl8a7aUxD/k2WrcPfwI2pok7o+QVaHTzo
oXUSiiowm5lU2Ir6WmDDShBc3Ddql9siUjULVqt5bUcTXXvrS2X8xItKS+Zz+J6N
3f6xHKzt8YFlHAoKYuRh1E7K/uKsBQ6oNEAv/fN7GJHuxbb9HHAwZJe+DTnCAPws
84ceLvP0DzJN/Socs95sKb4=
-----END CERTIFICATE-----
Version: 2
Serial Number: 06:cf:38:7c:e0:4c:1c:3d:33:ab:43:a3:d8:37:d1:8d:2d:50
Serial Number: 06:b9:a6:d8:c9:aa:30:d2:ff:6e:a8:2e:c2:46:b9:bf:b6:a1
Signature Algorithm: sha256WithRSAEncryption
Issuer: /C=US/O=Let's Encrypt/CN=R12
Not valid before: Feb 9 19:02:37 2026 GMT
Not valid after: May 10 19:02:36 2026 GMT
Issuer: /C=US/O=Let's Encrypt/CN=R13
Not valid before: Apr 10 22:57:14 2026 GMT
Not valid after: Jul 9 22:57:13 2026 GMT
Subject: /CN=nextcloud.lan.ddnsgeek.com
Public Key Algorithm: NULL
RSA Public Key: (4096 bit)
@@ -141,48 +141,48 @@ lZr6d0LRlE/gU6T/SDixaqBbYR7VEOEMYhL0SA==
X509v3 Key Usage: critical
Digital Signature, Key Encipherment
X509v3 Extended Key Usage:
TLS Web Server Authentication, TLS Web Client Authentication
TLS Web Server Authentication
X509v3 Basic Constraints: critical
CA:FALSE
X509v3 Subject Key Identifier:
2F:A7:49:E0:BE:37:58:D6:3C:25:3E:3C:7E:92:B6:37:6E:0C:8A:6C
X509v3 Authority Key Identifier:
00:B5:29:F2:2D:8E:6F:31:E8:9B:4C:AD:78:3E:FA:DC:E9:0C:D1:D2
E7:AB:9F:0F:2C:33:A0:53:D3:5E:4F:78:C8:B2:84:0E:3B:D6:92:33
Authority Information Access:
CA Issuers - URI:http://r12.i.lencr.org/
CA Issuers - URI:http://r13.i.lencr.org/
X509v3 Subject Alternative Name:
DNS:nextcloud.lan.ddnsgeek.com
X509v3 Certificate Policies:
Policy: 2.23.140.1.2.1
X509v3 CRL Distribution Points:
Full Name:
URI:http://r12.c.lencr.org/81.crl
URI:http://r13.c.lencr.org/34.crl
CT Precertificate SCTs:
Signed Certificate Timestamp:
Version : v1 (0x0)
Log ID : E3:23:8D:F2:8D:A2:88:E0:AA:E0:AC:F0:FA:90:C9:85:
F0:B6:BF:F5:D2:A5:27:B0:01:FC:1C:44:58:C4:B6:E8
Timestamp : Feb 9 20:01:07.523 2026 GMT
Extensions: 00:00:05:00:32:0E:2C:21
Signature : ecdsa-with-SHA256
30:45:02:20:22:B0:B2:76:41:B6:38:0D:E4:FA:8B:78:
C4:38:71:46:97:27:CE:40:4A:1D:33:59:CA:51:C4:96:
F5:73:D0:9F:02:21:00:DF:26:E7:8B:78:27:15:8D:8A:
C5:C4:57:E2:04:2E:C7:FF:4C:5D:8D:44:88:3F:45:30:
64:A9:96:C5:AA:3F:4F
Signed Certificate Timestamp:
Version : v1 (0x0)
Log ID : 16:83:2D:AB:F0:A9:25:0F:0F:F0:3A:A5:45:FF:C8:BF:
C8:23:D0:87:4B:F6:04:29:27:F8:E7:1F:33:13:F5:FA
Timestamp : Feb 9 20:01:09.430 2026 GMT
Log ID : C2:31:7E:57:45:19:A3:45:EE:7F:38:DE:B2:90:41:EB:
C7:C2:21:5A:22:BF:7F:D5:B5:AD:76:9A:D9:0E:52:CD
Timestamp : Apr 10 23:55:44.811 2026 GMT
Extensions: none
Signature : ecdsa-with-SHA256
30:45:02:21:00:F9:07:C4:11:7C:F0:DB:30:2C:1C:F1:
DA:3A:A7:D5:17:A7:26:8B:40:E2:B1:6B:35:03:3D:D4:
4A:1F:FF:26:7B:02:20:07:2F:99:3E:72:A1:32:FC:62:
7F:E5:E4:AB:0D:82:EB:EC:70:A0:14:16:41:13:91:47:
62:55:DF:43:F9:77:D8
30:45:02:20:16:34:57:D7:CC:A6:20:8F:8B:52:3D:FF:
9A:7E:34:85:36:5C:E7:8F:B0:B8:EE:BA:55:CB:03:D4:
05:B3:D3:11:02:21:00:B5:5D:89:CD:F2:22:07:7F:E8:
0C:93:3A:D9:4A:5E:7B:A9:93:31:0E:FC:40:8F:42:88:
10:BF:A4:70:8B:83:AB
Signed Certificate Timestamp:
Version : v1 (0x0)
Log ID : A8:26:CB:E3:0A:C6:35:12:46:53:3F:E0:65:F1:4F:19:
D9:6E:19:08:13:C4:1D:D9:6D:79:00:B3:12:3C:55:27
Timestamp : Apr 10 23:55:45.497 2026 GMT
Extensions: 00:00:05:00:06:66:A7:55
Signature : ecdsa-with-SHA256
30:44:02:20:73:40:8F:60:7D:7C:0B:79:D5:88:0B:7B:
31:F3:18:23:A3:20:F7:A7:44:5F:D3:AB:88:56:FE:D4:
13:F2:1F:B2:02:20:39:34:EE:18:67:79:80:7E:0C:5B:
0E:C0:99:70:7B:A0:15:A2:65:67:27:26:F4:7E:83:3A:
B5:46:11:C5:B6:EC
Verify m:
unable to get local issuer certificate
@@ -192,10 +192,10 @@ RSA Key Strength: 4096
Subject: nextcloud.lan.ddnsgeek.com
Altnames: DNS:nextcloud.lan.ddnsgeek.com
Issuer: R12
Issuer: R13
Not valid before: Feb 9 19:02:37 2026 GMT
Not valid after: May 10 19:02:36 2026 GMT
Not valid before: Apr 10 22:57:14 2026 GMT
Not valid after: Jul 9 22:57:13 2026 GMT
```
results/report.md/nextcloud.lan.ddnsgeek.com/Services/Service - tcp-443-http/nikto.md
+22 -3
View File
@@ -5,6 +5,25 @@ nikto -ask=no -Tuning=x4567890ac -nointeractive -host https://nextcloud.lan.ddns
[/root/results/nextcloud.lan.ddnsgeek.com/scans/tcp443/tcp_443_https_nikto.txt](file:///root/results/nextcloud.lan.ddnsgeek.com/scans/tcp443/tcp_443_https_nikto.txt):
```
perl: warning: Setting locale failed.
perl: warning: Please check that your locale settings:
LANGUAGE = (unset),
LC_ALL = (unset),
LC_CTYPE = (unset),
LC_NUMERIC = "en_AU.UTF-8",
LC_COLLATE = (unset),
LC_TIME = "en_AU.UTF-8",
LC_MESSAGES = (unset),
LC_MONETARY = "en_AU.UTF-8",
LC_ADDRESS = "en_AU.UTF-8",
LC_IDENTIFICATION = "en_AU.UTF-8",
LC_MEASUREMENT = "en_AU.UTF-8",
LC_PAPER = "en_AU.UTF-8",
LC_TELEPHONE = "en_AU.UTF-8",
LC_NAME = "en_AU.UTF-8",
LANG = "en_US.UTF-8"
are supported and installed on your system.
perl: warning: Falling back to a fallback locale ("en_US.UTF-8").
- Nikto v2.6.0
---------------------------------------------------------------------------
+ Your Nikto installation is out of date.
@@ -16,14 +35,14 @@ nikto -ask=no -Tuning=x4567890ac -nointeractive -host https://nextcloud.lan.ddns
CN: nextcloud.lan.ddnsgeek.com
SAN: nextcloud.lan.ddnsgeek.com
Ciphers: TLS_AES_128_GCM_SHA256
Issuer: /C=US/O=Let's Encrypt/CN=R12
Issuer: /C=US/O=Let's Encrypt/CN=R13
+ Platform: Linux/Unix
+ Start Time: 2026-04-05 08:16:11 (GMT0)
+ Start Time: 2026-04-14 03:52:13 (GMT0)
---------------------------------------------------------------------------
+ Server: Apache/2.4.66 (Debian)
+ [999986] /: Retrieved x-powered-by header: PHP/8.3.30.
+ No CGI Directories found (use '-C all' to force check all possible dirs). CGI tests skipped.
+ [999100] /index.php/login: Uncommon header(s) 'x-request-id' found, with contents: cM0SfixyCyb80zOKJ4nJ.
+ [999100] /index.php/login: Uncommon header(s) 'x-request-id' found, with contents: hSKOqZhlTxLkZaK3GvPG.
+ [600625] PHP/8.3.30 appears to be outdated (current is at least 8.5.1).
+ [013587] /: Suggested security header missing: permissions-policy. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Permissions-Policy
+ [999984] /index.html: Server may leak inodes via ETags, header found with file /index.html, inode: 14b, size: 64e41fd0d4aac, mtime: gzip. See: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-1418
results/report.md/nextcloud.lan.ddnsgeek.com/Services/Service - tcp-443-http/whatweb.md
+12 -24
View File
@@ -109,18 +109,18 @@ Detected Plugins:
HTTP Headers:
HTTP/1.1 302 Found
Content-Length: 0
Content-Security-Policy: default-src 'self'; script-src 'self' 'nonce-jBF4PW7Nahz7qJf01Ql5+OPaeNUN0RV0T/nfH+WBIPA='; style-src 'self' 'unsafe-inline'; frame-src *; img-src * data: blob:; font-src 'self' data:; media-src *; connect-src *; object-src 'none'; base-uri 'self';
Content-Security-Policy: default-src 'self'; script-src 'self' 'nonce-eJJaUYSl69LnzUT5f2oen13g5dGL7ymBpryYUsbS1rM='; style-src 'self' 'unsafe-inline'; frame-src *; img-src * data: blob:; font-src 'self' data:; media-src *; connect-src *; object-src 'none'; base-uri 'self';
Content-Type: text/html; charset=UTF-8
Date: Sun, 05 Apr 2026 08:25:23 GMT
Date: Tue, 14 Apr 2026 03:52:32 GMT
Location: https://nextcloud.lan.ddnsgeek.com/index.php/login
Referrer-Policy: no-referrer
Server: Apache/2.4.66 (Debian)
Set-Cookie: ocexfs76yoe2=0502aeb89f6be80bb391a1abfd08525d; path=/; secure; HttpOnly; SameSite=Lax
Set-Cookie: oc_sessionPassphrase=yh7PzM6DWTY7HEAttA9lvgWmmVxOQ2YDkL19S3w0zOHt8ozOqNco9XLM%2BLiTUrNHJXssRgYZ67HAiDcpGTK7cKtYBZ6wm%2BCEvIefKrgsn9h0UPRGcc0FGFf%2B6kNtvkvn; path=/; secure; HttpOnly; SameSite=Lax
Set-Cookie: ocexfs76yoe2=0502aeb89f6be80bb391a1abfd08525d; path=/; secure; HttpOnly; SameSite=Lax
Set-Cookie: ocexfs76yoe2=6bc4aff492fef3b2af03c81e29e9a0e3; path=/; secure; HttpOnly; SameSite=Lax
Set-Cookie: oc_sessionPassphrase=5pTvnvYZRBKLnd46XMg0XJgoZATFmwg0xpb9U1MWOfbLENZfrRG142BX4xAg7bm56hCNDQECmNcTK4g1NdWTqtlGZEsFXybcLKF2X9emXfyh%2BvINw27UVedM9bAdvRzR; path=/; secure; HttpOnly; SameSite=Lax
Set-Cookie: ocexfs76yoe2=6bc4aff492fef3b2af03c81e29e9a0e3; path=/; secure; HttpOnly; SameSite=Lax
Set-Cookie: __Host-nc_sameSiteCookielax=true; path=/; httponly;secure; expires=Fri, 31-Dec-2100 23:59:59 GMT; SameSite=lax
Set-Cookie: __Host-nc_sameSiteCookiestrict=true; path=/; httponly;secure; expires=Fri, 31-Dec-2100 23:59:59 GMT; SameSite=strict
Set-Cookie: ocexfs76yoe2=0502aeb89f6be80bb391a1abfd08525d; path=/; secure; HttpOnly; SameSite=Lax
Set-Cookie: ocexfs76yoe2=6bc4aff492fef3b2af03c81e29e9a0e3; path=/; secure; HttpOnly; SameSite=Lax
Strict-Transport-Security: max-age=15552000; includeSubDomains; preload
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
@@ -136,21 +136,9 @@ Title : ,Login – Nextcloud
IP : 167.179.167.166
Country : NEW ZEALAND, NZ
Summary : Apache[2.4.66], Cookies[ocexfs76yoe2], HTML5, HTTPServer[Debian Linux][Apache/2.4.66 (Debian)], HttpOnly[ocexfs76yoe2], Open-Graph-Protocol[website], PHP[8.3.30], Script, Strict-Transport-Security[max-age=15552000; includeSubDomains; preload], UncommonHeaders[content-security-policy,feature-policy,referrer-policy,x-content-type-options,x-permitted-cross-domain-policies,x-request-id,x-robots-tag], X-Frame-Options[SAMEORIGIN], X-Powered-By[PHP/8.3.30], X-XSS-Protection[1; mode=block]
Summary : Cookies[ocexfs76yoe2], HTML5, HTTPServer[Debian Linux][Apache/2.4.66 (Debian)], HttpOnly[ocexfs76yoe2], Open-Graph-Protocol[website], PHP[8.3.30], Script, Strict-Transport-Security[max-age=15552000; includeSubDomains; preload], UncommonHeaders[content-security-policy,feature-policy,referrer-policy,x-content-type-options,x-permitted-cross-domain-policies,x-request-id,x-robots-tag], X-Frame-Options[SAMEORIGIN], X-Powered-By[PHP/8.3.30], X-XSS-Protection[1; mode=block]
Detected Plugins:
[ Apache ]
The Apache HTTP Server Project is an effort to develop and
maintain an open-source HTTP server for modern operating
systems including UNIX and Windows NT. The goal of this
project is to provide a secure, efficient and extensible
server that provides HTTP services in sync with the current
HTTP standards.
Version : 2.4.66 (from HTTP Server Header)
Google Dorks: (3)
Website : http://httpd.apache.org/
[ Cookies ]
Display the names of cookies in the HTTP headers. The
values are not returned to save on space.
@@ -243,20 +231,20 @@ HTTP Headers:
HTTP/1.1 200 OK
Cache-Control: no-cache, no-store, must-revalidate
Content-Encoding: gzip
Content-Length: 5803
Content-Security-Policy: default-src 'none';base-uri 'none';manifest-src 'self';script-src 'nonce-E/y++JVhUAGMmgbdxDsI7DMjrWvCSk3K8sBFlL2CjXM=';script-src-elem 'strict-dynamic' 'nonce-E/y++JVhUAGMmgbdxDsI7DMjrWvCSk3K8sBFlL2CjXM=';style-src 'self' 'unsafe-inline';img-src 'self' data: blob: https://*.tile.openstreetmap.org;font-src 'self' data:;connect-src 'self';media-src 'self';frame-src 'self';frame-ancestors 'self';form-action 'self'
Content-Length: 5801
Content-Security-Policy: default-src 'none';base-uri 'none';manifest-src 'self';script-src 'nonce-SVXVLb4Re1+OOOXuQ3YRupmmoh1cwSYDPAn4J796nvU=';script-src-elem 'strict-dynamic' 'nonce-SVXVLb4Re1+OOOXuQ3YRupmmoh1cwSYDPAn4J796nvU=';style-src 'self' 'unsafe-inline';img-src 'self' data: blob: https://*.tile.openstreetmap.org;font-src 'self' data:;connect-src 'self';media-src 'self';frame-src 'self';frame-ancestors 'self';form-action 'self'
Content-Type: text/html; charset=UTF-8
Date: Sun, 05 Apr 2026 08:28:23 GMT
Date: Tue, 14 Apr 2026 03:53:08 GMT
Feature-Policy: autoplay 'self';camera 'none';fullscreen 'self';geolocation 'none';microphone 'none';payment 'none'
Referrer-Policy: same-origin
Server: Apache/2.4.66 (Debian)
Set-Cookie: ocexfs76yoe2=0502aeb89f6be80bb391a1abfd08525d; path=/; secure; HttpOnly; SameSite=Lax
Set-Cookie: ocexfs76yoe2=6bc4aff492fef3b2af03c81e29e9a0e3; path=/; secure; HttpOnly; SameSite=Lax
Strict-Transport-Security: max-age=15552000; includeSubDomains; preload
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-Permitted-Cross-Domain-Policies: none
X-Powered-By: PHP/8.3.30
X-Request-Id: hQlveGNuRyEf5cb7mJIq
X-Request-Id: xJN1PJW80BokVwJXwvnU
X-Robots-Tag: noindex, nofollow
X-Xss-Protection: 1; mode=block
Connection: close
results/report.md/nextcloud.lan.ddnsgeek.com/Services/Service - tcp-80-http/Curl Robots.md
+1 -1
View File
@@ -7,7 +7,7 @@ curl -sSikf http://nextcloud.lan.ddnsgeek.com:80/robots.txt
```
HTTP/1.1 301 Moved Permanently
Location: https://nextcloud.lan.ddnsgeek.com/robots.txt
Date: Sun, 05 Apr 2026 08:15:01 GMT
Date: Tue, 14 Apr 2026 03:48:58 GMT
Content-Length: 17
Moved Permanently
results/report.md/nextcloud.lan.ddnsgeek.com/Services/Service - tcp-80-http/Curl.md
+1 -1
View File
@@ -7,7 +7,7 @@ curl -sSik http://nextcloud.lan.ddnsgeek.com:80/
```
HTTP/1.1 301 Moved Permanently
Location: https://nextcloud.lan.ddnsgeek.com/
Date: Sun, 05 Apr 2026 08:15:01 GMT
Date: Tue, 14 Apr 2026 03:48:59 GMT
Content-Length: 17
Moved Permanently
results/report.md/nextcloud.lan.ddnsgeek.com/Services/Service - tcp-80-http/Directory Buster.md
+20 -13
View File
@@ -290,49 +290,53 @@ Configuration {
unique: false,
response_size_limit: 4194304,
}
401 GET 2l 12w 75c https://nextcloud.lan.ddnsgeek.com/index.php/apps/dashboard
401 GET 2l 12w 75c https://nextcloud.lan.ddnsgeek.com/index.php/apps/logreader
401 GET 2l 12w 75c https://nextcloud.lan.ddnsgeek.com/index.php/apps/photos
401 GET 2l 12w 75c https://nextcloud.lan.ddnsgeek.com/index.php/apps/files
200 GET 494l 1557w 31067c https://nextcloud.lan.ddnsgeek.com/index.php/apps/files_pdfviewer
401 GET 2l 12w 75c https://nextcloud.lan.ddnsgeek.com/index.php/apps/dashboard
401 GET 2l 12w 75c https://nextcloud.lan.ddnsgeek.com/index.php/apps/photos
401 GET 2l 12w 75c https://nextcloud.lan.ddnsgeek.com/index.php/apps/logreader
401 GET 2l 12w 75c https://nextcloud.lan.ddnsgeek.com/index.php/apps/activity
200 GET 93l 341w 16047c https://nextcloud.lan.ddnsgeek.com/index.php/login
401 GET 2l 12w 75c https://nextcloud.lan.ddnsgeek.com/.well-known/caldav
401 GET 2l 12w 75c https://nextcloud.lan.ddnsgeek.com/.well-known/carddav
401 GET 2l 12w 75c https://nextcloud.lan.ddnsgeek.com/.well-known/caldav.txt
401 GET 2l 12w 75c https://nextcloud.lan.ddnsgeek.com/index.php/settings/user/security
401 GET 2l 12w 75c https://nextcloud.lan.ddnsgeek.com/.well-known/caldav.txt
401 GET 2l 12w 75c https://nextcloud.lan.ddnsgeek.com/.well-known/carddav.txt
401 GET 2l 12w 75c https://nextcloud.lan.ddnsgeek.com/.well-known/carddav.html
401 GET 2l 12w 75c https://nextcloud.lan.ddnsgeek.com/.well-known/caldav.html
401 GET 2l 12w 75c https://nextcloud.lan.ddnsgeek.com/.well-known/carddav.php
401 GET 2l 12w 75c https://nextcloud.lan.ddnsgeek.com/.well-known/caldav.php
401 GET 2l 12w 75c https://nextcloud.lan.ddnsgeek.com/.well-known/carddav.asp
401 GET 2l 12w 75c https://nextcloud.lan.ddnsgeek.com/.well-known/carddav.php
401 GET 2l 12w 75c https://nextcloud.lan.ddnsgeek.com/.well-known/caldav.asp
401 GET 2l 12w 75c https://nextcloud.lan.ddnsgeek.com/.well-known/carddav.aspx
401 GET 2l 12w 75c https://nextcloud.lan.ddnsgeek.com/.well-known/carddav.asp
401 GET 2l 12w 75c https://nextcloud.lan.ddnsgeek.com/.well-known/caldav.aspx
401 GET 2l 12w 75c https://nextcloud.lan.ddnsgeek.com/.well-known/carddav.jsp
401 GET 2l 12w 75c https://nextcloud.lan.ddnsgeek.com/.well-known/caldav.jsp
401 GET 2l 12w 75c https://nextcloud.lan.ddnsgeek.com/.well-known/carddav.aspx
401 GET 2l 12w 75c https://nextcloud.lan.ddnsgeek.com/.well-known/carddav.jsp
200 GET 6l 12w 281c https://nextcloud.lan.ddnsgeek.com/.well-known/security.txt
200 GET 1l 5w 77c https://nextcloud.lan.ddnsgeek.com/cron.php
200 GET 12l 31w 331c https://nextcloud.lan.ddnsgeek.com/index.html
404 GET 0l 0w 64c https://nextcloud.lan.ddnsgeek.com/inetsrv.php
404 GET 0l 0w 64c https://nextcloud.lan.ddnsgeek.com/information.txt
404 GET 0l 0w 64c https://nextcloud.lan.ddnsgeek.com/inf.html
404 GET 0l 0w 64c https://nextcloud.lan.ddnsgeek.com/informer
500 GET 2l 11w 72c https://nextcloud.lan.ddnsgeek.com/public.php
200 GET 2l 4w 26c https://nextcloud.lan.ddnsgeek.com/robots.txt
200 GET 1l 1w 170c https://nextcloud.lan.ddnsgeek.com/status.php
200 GET 0l 0w 0c https://nextcloud.lan.ddnsgeek.com/version.php
301 GET 1l 2w 17c http://nextcloud.lan.ddnsgeek.com/] => https://nextcloud.lan.ddnsgeek.com/]
301 GET 1l 2w 17c http://nextcloud.lan.ddnsgeek.com/[ => https://nextcloud.lan.ddnsgeek.com/[
301 GET 1l 2w 17c http://nextcloud.lan.ddnsgeek.com/[.txt => https://nextcloud.lan.ddnsgeek.com/[.txt
301 GET 1l 2w 17c http://nextcloud.lan.ddnsgeek.com/] => https://nextcloud.lan.ddnsgeek.com/]
301 GET 1l 2w 17c http://nextcloud.lan.ddnsgeek.com/[.html => https://nextcloud.lan.ddnsgeek.com/[.html
301 GET 1l 2w 17c http://nextcloud.lan.ddnsgeek.com/].txt => https://nextcloud.lan.ddnsgeek.com/].txt
301 GET 1l 2w 17c http://nextcloud.lan.ddnsgeek.com/].html => https://nextcloud.lan.ddnsgeek.com/].html
301 GET 1l 2w 17c http://nextcloud.lan.ddnsgeek.com/[.html => https://nextcloud.lan.ddnsgeek.com/[.html
301 GET 1l 2w 17c http://nextcloud.lan.ddnsgeek.com/[.php => https://nextcloud.lan.ddnsgeek.com/[.php
301 GET 1l 2w 17c http://nextcloud.lan.ddnsgeek.com/].php => https://nextcloud.lan.ddnsgeek.com/].php
301 GET 1l 2w 17c http://nextcloud.lan.ddnsgeek.com/].asp => https://nextcloud.lan.ddnsgeek.com/].asp
301 GET 1l 2w 17c http://nextcloud.lan.ddnsgeek.com/[.asp => https://nextcloud.lan.ddnsgeek.com/[.asp
301 GET 1l 2w 17c http://nextcloud.lan.ddnsgeek.com/].php => https://nextcloud.lan.ddnsgeek.com/].php
301 GET 1l 2w 17c http://nextcloud.lan.ddnsgeek.com/[.aspx => https://nextcloud.lan.ddnsgeek.com/[.aspx
301 GET 1l 2w 17c http://nextcloud.lan.ddnsgeek.com/].asp => https://nextcloud.lan.ddnsgeek.com/].asp
301 GET 1l 2w 17c http://nextcloud.lan.ddnsgeek.com/[.jsp => https://nextcloud.lan.ddnsgeek.com/[.jsp
301 GET 1l 2w 17c http://nextcloud.lan.ddnsgeek.com/].aspx => https://nextcloud.lan.ddnsgeek.com/].aspx
301 GET 1l 2w 17c http://nextcloud.lan.ddnsgeek.com/].jsp => https://nextcloud.lan.ddnsgeek.com/].jsp
301 GET 1l 2w 17c http://nextcloud.lan.ddnsgeek.com/[.jsp => https://nextcloud.lan.ddnsgeek.com/[.jsp
301 GET 1l 2w 17c http://nextcloud.lan.ddnsgeek.com/plain] => https://nextcloud.lan.ddnsgeek.com/plain]
301 GET 1l 2w 17c http://nextcloud.lan.ddnsgeek.com/plain].txt => https://nextcloud.lan.ddnsgeek.com/plain].txt
301 GET 1l 2w 17c http://nextcloud.lan.ddnsgeek.com/plain].html => https://nextcloud.lan.ddnsgeek.com/plain].html
@@ -348,5 +352,8 @@ Configuration {
301 GET 1l 2w 17c http://nextcloud.lan.ddnsgeek.com/quote].aspx => https://nextcloud.lan.ddnsgeek.com/quote].aspx
301 GET 1l 2w 17c http://nextcloud.lan.ddnsgeek.com/quote].jsp => https://nextcloud.lan.ddnsgeek.com/quote].jsp
200 GET 661l 5535w 34520c https://nextcloud.lan.ddnsgeek.com/COPYING
404 GET 0l 0w 64c https://nextcloud.lan.ddnsgeek.com/cnn.html
404 GET 0l 0w 64c https://nextcloud.lan.ddnsgeek.com/crisis
404 GET 0l 0w 64c https://nextcloud.lan.ddnsgeek.com/counter1.txt
```
results/report.md/nextcloud.lan.ddnsgeek.com/Services/Service - tcp-80-http/Known Security.md
+1 -1
View File
@@ -7,7 +7,7 @@ curl -sSikf http://nextcloud.lan.ddnsgeek.com:80/.well-known/security.txt
```
HTTP/1.1 301 Moved Permanently
Location: https://nextcloud.lan.ddnsgeek.com/.well-known/security.txt
Date: Sun, 05 Apr 2026 08:15:01 GMT
Date: Tue, 14 Apr 2026 03:48:59 GMT
Content-Length: 17
Moved Permanently
results/report.md/nextcloud.lan.ddnsgeek.com/Services/Service - tcp-80-http/Nmap HTTP.md
+25 -44
View File
@@ -5,33 +5,25 @@ nmap -vv --reason -Pn -T4 -sV -p 80 --script="banner,(http* or ssl*) and not (br
[/root/results/nextcloud.lan.ddnsgeek.com/scans/tcp80/tcp_80_http_nmap.txt](file:///root/results/nextcloud.lan.ddnsgeek.com/scans/tcp80/tcp_80_http_nmap.txt):
```
# Nmap 7.98 scan initiated Sun Apr 5 08:15:02 2026 as: /usr/lib/nmap/nmap -vv --reason -Pn -T4 -sV -p 80 "--script=banner,(http* or ssl*) and not (brute or broadcast or dos or external or http-slowloris* or fuzzer)" -oN /root/results/nextcloud.lan.ddnsgeek.com/scans/tcp80/tcp_80_http_nmap.txt -oX /root/results/nextcloud.lan.ddnsgeek.com/scans/tcp80/xml/tcp_80_http_nmap.xml nextcloud.lan.ddnsgeek.com
# Nmap 7.99 scan initiated Tue Apr 14 03:48:59 2026 as: /usr/lib/nmap/nmap -vv --reason -Pn -T4 -sV -p 80 "--script=banner,(http* or ssl*) and not (brute or broadcast or dos or external or http-slowloris* or fuzzer)" -oN /root/results/nextcloud.lan.ddnsgeek.com/scans/tcp80/tcp_80_http_nmap.txt -oX /root/results/nextcloud.lan.ddnsgeek.com/scans/tcp80/xml/tcp_80_http_nmap.xml nextcloud.lan.ddnsgeek.com
Nmap scan report for nextcloud.lan.ddnsgeek.com (167.179.167.166)
Host is up, received user-set (0.015s latency).
Host is up, received user-set (0.024s latency).
rDNS record for 167.179.167.166: 167-179-167-166.a7b3a7.bne.nbn.aussiebb.net
Scanned at 2026-04-05 08:15:16 UTC for 1235s
Scanned at 2026-04-14 03:49:06 UTC for 823s
Bug in http-security-headers: no string output.
PORT STATE SERVICE REASON VERSION
80/tcp open http syn-ack ttl 55 Golang net/http server (Go-IPFS json-rpc or InfluxDB API)
|_http-dombased-xss: Couldn't find any DOM based XSS.
| http-traceroute:
| Status Code
| Hop #1: 301
| Hop #2: 301
| Hop #3: 404
| content-type
| Hop #1
| Hop #2
| Hop #3: text/plain; charset=utf-8
| content-length
| Hop #1: 17
| Hop #2: 17
| Hop #3: 19
| location
| Hop #1: https://nextcloud.lan.ddnsgeek.com/
| Hop #2: https://nextcloud.lan.ddnsgeek.com/
|_ Hop #3
|_http-feed: Couldn't find any feeds.
| http-vhosts:
|_128 names had status 308
|_http-mobileversion-checker: No mobile version detected.
|_http-wordpress-enum: Nothing found amongst the top 100 resources,use --script-args search-limit=<number|all> for deeper analysis)
|_http-referer-checker: Couldn't find any cross-domain scripts.
| http-methods:
|_ Supported Methods: GET HEAD POST OPTIONS
|_http-jsonp-detection: Couldn't find any JSONP endpoints.
|_http-errors: Couldn't find any error pages.
| http-useragent-tester:
| Status for browser useragent: 200
| Redirected To: https://nextcloud.lan.ddnsgeek.com/index.php/login
@@ -53,37 +45,26 @@ PORT STATE SERVICE REASON VERSION
| PECL::HTTP
| Wget/1.13.4 (linux-gnu)
|_ WWW-Mechanize/1.34
| http-methods:
|_ Supported Methods: GET HEAD POST OPTIONS
|_http-csrf: Couldn't find any CSRF vulnerabilities.
|_http-title: Did not follow redirect to https://nextcloud.lan.ddnsgeek.com/
|_http-malware-host: Host appears to be clean
|_http-stored-xss: Couldn't find any stored XSS vulnerabilities.
|_http-date: Sun, 05 Apr 2026 08:16:39 GMT; -2m03s from local time.
|_http-referer-checker: Couldn't find any cross-domain scripts.
|_http-chrono: Request times for /; avg: 900.47ms; min: 649.96ms; max: 1155.19ms
|_http-date: Tue, 14 Apr 2026 03:52:20 GMT; -3s from local time.
|_http-litespeed-sourcecode-download: Request with null byte did not work. This web server might not be vulnerable
|_http-csrf: Couldn't find any CSRF vulnerabilities.
|_http-comments-displayer: Couldn't find any comments.
|_http-fetch: Please enter the complete path of the directory to save data in.
| http-headers:
| Location: https://nextcloud.lan.ddnsgeek.com/
| Date: Sun, 05 Apr 2026 08:18:48 GMT
| Date: Tue, 14 Apr 2026 03:52:32 GMT
| Content-Length: 17
| Connection: close
|
|_ (Request type: GET)
|_http-wordpress-enum: Nothing found amongst the top 100 resources,use --script-args search-limit=<number|all> for deeper analysis)
|_http-jsonp-detection: Couldn't find any JSONP endpoints.
|_http-errors: Couldn't find any error pages.
|_http-litespeed-sourcecode-download: Request with null byte did not work. This web server might not be vulnerable
|_http-mobileversion-checker: No mobile version detected.
|_http-comments-displayer: Couldn't find any comments.
|_http-fetch: Please enter the complete path of the directory to save data in.
| http-vhosts:
| 126 names had status 308
| news.lan.ddnsgeek.com : 404
|_intra.lan.ddnsgeek.com : 404
|_http-malware-host: Host appears to be clean
|_http-drupal-enum: Nothing found amongst the top 100 resources,use --script-args number=<number|all> for deeper analysis)
|_http-wordpress-users: [Error] Wordpress installation was not found. We couldn't find wp-login.php
|_http-feed: Couldn't find any feeds.
|_http-drupal-enum: Nothing found amongst the top 100 resources,use --script-args number=<number|all> for deeper analysis)
|_http-title: Did not follow redirect to https://nextcloud.lan.ddnsgeek.com/
|_http-devframework: Couldn't determine the underlying framework or CMS. Try increasing 'httpspider.maxpagecount' value to spider more pages.
|_http-chrono: Request times for /; avg: 1469.81ms; min: 1340.59ms; max: 1702.87ms
|_http-dombased-xss: Couldn't find any DOM based XSS.
| http-sitemap-generator:
| Directory structure:
| Longest directory structure:
@@ -94,6 +75,6 @@ PORT STATE SERVICE REASON VERSION
Read data files from: /usr/share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Sun Apr 5 08:35:52 2026 -- 1 IP address (1 host up) scanned in 1251.73 seconds
# Nmap done at Tue Apr 14 04:02:49 2026 -- 1 IP address (1 host up) scanned in 831.14 seconds
```
results/report.md/nextcloud.lan.ddnsgeek.com/Services/Service - tcp-80-http/Virtual Host Enumeration.md
+94336 -20485
View File
File diff suppressed because it is too large. Load diff
results/report.md/nextcloud.lan.ddnsgeek.com/Services/Service - tcp-80-http/nikto.md
+23 -4
View File
@@ -5,6 +5,25 @@ nikto -ask=no -Tuning=x4567890ac -nointeractive -host http://nextcloud.lan.ddnsg
[/root/results/nextcloud.lan.ddnsgeek.com/scans/tcp80/tcp_80_http_nikto.txt](file:///root/results/nextcloud.lan.ddnsgeek.com/scans/tcp80/tcp_80_http_nikto.txt):
```
perl: warning: Setting locale failed.
perl: warning: Please check that your locale settings:
LANGUAGE = (unset),
LC_ALL = (unset),
LC_CTYPE = (unset),
LC_NUMERIC = "en_AU.UTF-8",
LC_COLLATE = (unset),
LC_TIME = "en_AU.UTF-8",
LC_MESSAGES = (unset),
LC_MONETARY = "en_AU.UTF-8",
LC_ADDRESS = "en_AU.UTF-8",
LC_IDENTIFICATION = "en_AU.UTF-8",
LC_MEASUREMENT = "en_AU.UTF-8",
LC_PAPER = "en_AU.UTF-8",
LC_TELEPHONE = "en_AU.UTF-8",
LC_NAME = "en_AU.UTF-8",
LANG = "en_US.UTF-8"
are supported and installed on your system.
perl: warning: Falling back to a fallback locale ("en_US.UTF-8").
- Nikto v2.6.0
---------------------------------------------------------------------------
+ Your Nikto installation is out of date.
@@ -12,20 +31,20 @@ nikto -ask=no -Tuning=x4567890ac -nointeractive -host http://nextcloud.lan.ddnsg
+ Target Hostname: nextcloud.lan.ddnsgeek.com
+ Target Port: 80
+ Platform: Unknown
+ Start Time: 2026-04-05 08:16:04 (GMT0)
+ Start Time: 2026-04-14 03:52:12 (GMT0)
---------------------------------------------------------------------------
+ Server: No banner retrieved
+ No CGI Directories found (use '-C all' to force check all possible dirs). CGI tests skipped.
+ [013587] /: Suggested security header missing: referrer-policy. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy
+ [013587] /: Suggested security header missing: x-content-type-options. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Content-Type-Options
+ [013587] /: Suggested security header missing: content-security-policy. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP
+ [013587] /: Suggested security header missing: strict-transport-security. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security
+ [013587] /: Suggested security header missing: content-security-policy. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP
+ [013587] /: Suggested security header missing: permissions-policy. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Permissions-Policy
+ [999979] http://100.100.100.200/latest/meta-data/: IP address found in the 'location' header. The IP is "100.100.100.200". See: https://portswigger.net/kb/issues/00600300_private-ip-addresses-disclosed
+ [007342] /: X-Frame-Options header is deprecated and was replaced with the Content-Security-Policy HTTP header with the frame-ancestors directive. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/X-Frame-Options
+ [007352] /: The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type. See: https://www.netsparker.com/web-vulnerability-scanner/vulnerabilities/missing-content-type-header/
+ 7900 requests: 16 errors and 8 items reported on the remote host
+ End Time: 2026-04-05 08:47:41 (GMT0) (1897 seconds)
+ 7901 requests: 17 errors and 8 items reported on the remote host
+ End Time: 2026-04-14 04:10:32 (GMT0) (1100 seconds)
---------------------------------------------------------------------------
+ 1 host(s) tested
results/report.md/nextcloud.lan.ddnsgeek.com/Services/Service - tcp-80-http/whatweb.md
+20 -139
View File
@@ -23,7 +23,7 @@ Detected Plugins:
HTTP Headers:
HTTP/1.1 301 Moved Permanently
Location: https://nextcloud.lan.ddnsgeek.com/
Date: Sun, 05 Apr 2026 08:19:27 GMT
Date: Tue, 14 Apr 2026 03:52:32 GMT
Content-Length: 17
Connection: close
@@ -33,9 +33,21 @@ Title : <None>
IP : 167.179.167.166
Country : NEW ZEALAND, NZ
Summary : Cookies[__Host-nc_sameSiteCookielax,__Host-nc_sameSiteCookiestrict,oc_sessionPassphrase,ocexfs76yoe2], HTTPServer[Debian Linux][Apache/2.4.66 (Debian)], HttpOnly[__Host-nc_sameSiteCookielax,__Host-nc_sameSiteCookiestrict,oc_sessionPassphrase,ocexfs76yoe2], PHP[8.3.30], RedirectLocation[https://nextcloud.lan.ddnsgeek.com/index.php/login], Strict-Transport-Security[max-age=15552000; includeSubDomains; preload], UncommonHeaders[content-security-policy,referrer-policy,x-content-type-options,x-permitted-cross-domain-policies,x-robots-tag], X-Frame-Options[SAMEORIGIN], X-Powered-By[PHP/8.3.30], X-XSS-Protection[1; mode=block]
Summary : Apache[2.4.66], Cookies[__Host-nc_sameSiteCookielax,__Host-nc_sameSiteCookiestrict,oc_sessionPassphrase,ocexfs76yoe2], HTTPServer[Debian Linux][Apache/2.4.66 (Debian)], HttpOnly[__Host-nc_sameSiteCookielax,__Host-nc_sameSiteCookiestrict,oc_sessionPassphrase,ocexfs76yoe2], PHP[8.3.30], RedirectLocation[https://nextcloud.lan.ddnsgeek.com/index.php/login], Strict-Transport-Security[max-age=15552000; includeSubDomains; preload], UncommonHeaders[content-security-policy,referrer-policy,x-content-type-options,x-permitted-cross-domain-policies,x-robots-tag], X-Frame-Options[SAMEORIGIN], X-Powered-By[PHP/8.3.30], X-XSS-Protection[1; mode=block]
Detected Plugins:
[ Apache ]
The Apache HTTP Server Project is an effort to develop and
maintain an open-source HTTP server for modern operating
systems including UNIX and Windows NT. The goal of this
project is to provide a secure, efficient and extensible
server that provides HTTP services in sync with the current
HTTP standards.
Version : 2.4.66 (from HTTP Server Header)
Google Dorks: (3)
Website : http://httpd.apache.org/
[ Cookies ]
Display the names of cookies in the HTTP headers. The
values are not returned to save on space.
@@ -119,18 +131,18 @@ Detected Plugins:
HTTP Headers:
HTTP/1.1 302 Found
Content-Length: 0
Content-Security-Policy: default-src 'self'; script-src 'self' 'nonce-FGzDOrcXLc9zPk8VixPSWXyY4A9tblc9Ze4kMyv+2aw='; style-src 'self' 'unsafe-inline'; frame-src *; img-src * data: blob:; font-src 'self' data:; media-src *; connect-src *; object-src 'none'; base-uri 'self';
Content-Security-Policy: default-src 'self'; script-src 'self' 'nonce-rkyirdVep768GdPpEXSgC7GFEMCCbw6RZpDc3XgFOSc='; style-src 'self' 'unsafe-inline'; frame-src *; img-src * data: blob:; font-src 'self' data:; media-src *; connect-src *; object-src 'none'; base-uri 'self';
Content-Type: text/html; charset=UTF-8
Date: Sun, 05 Apr 2026 08:19:48 GMT
Date: Tue, 14 Apr 2026 03:52:44 GMT
Location: https://nextcloud.lan.ddnsgeek.com/index.php/login
Referrer-Policy: no-referrer
Server: Apache/2.4.66 (Debian)
Set-Cookie: ocexfs76yoe2=affd533eb58b675e17ca401e417639b0; path=/; secure; HttpOnly; SameSite=Lax
Set-Cookie: oc_sessionPassphrase=yrnjr3kTg5BYogPZrxShkmXeTE8dkyeIKMDcnI6OlDMjnWEovYLupGYoV79IoPWumbrliRho5HBAGcWNtAuiz4%2F0w9aVsB8cO2JPviTZ6IyP6VgHAnbiy%2FLVpH3UVqiU; path=/; secure; HttpOnly; SameSite=Lax
Set-Cookie: ocexfs76yoe2=affd533eb58b675e17ca401e417639b0; path=/; secure; HttpOnly; SameSite=Lax
Set-Cookie: ocexfs76yoe2=e4ff6575096afea6ffc5acd05509889b; path=/; secure; HttpOnly; SameSite=Lax
Set-Cookie: oc_sessionPassphrase=W1ESLvg%2F4WA5EtFcH7xU0gLAWmXD4ZMLT2MZwdfwdHJ0PrBVCKeJqrPe0nxR66ABf0mMyZgZDo7Tu%2FoK8cT1SsTCWJh48injAN4K2UiqelCIQnr9e93jMrLq9vlmyY%2B4; path=/; secure; HttpOnly; SameSite=Lax
Set-Cookie: ocexfs76yoe2=e4ff6575096afea6ffc5acd05509889b; path=/; secure; HttpOnly; SameSite=Lax
Set-Cookie: __Host-nc_sameSiteCookielax=true; path=/; httponly;secure; expires=Fri, 31-Dec-2100 23:59:59 GMT; SameSite=lax
Set-Cookie: __Host-nc_sameSiteCookiestrict=true; path=/; httponly;secure; expires=Fri, 31-Dec-2100 23:59:59 GMT; SameSite=strict
Set-Cookie: ocexfs76yoe2=affd533eb58b675e17ca401e417639b0; path=/; secure; HttpOnly; SameSite=Lax
Set-Cookie: ocexfs76yoe2=e4ff6575096afea6ffc5acd05509889b; path=/; secure; HttpOnly; SameSite=Lax
Strict-Transport-Security: max-age=15552000; includeSubDomains; preload
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
@@ -140,137 +152,6 @@ HTTP Headers:
X-Xss-Protection: 1; mode=block
Connection: close
WhatWeb report for https://nextcloud.lan.ddnsgeek.com/index.php/login
Status : 200 OK
Title : ,Login – Nextcloud
IP : 167.179.167.166
Country : NEW ZEALAND, NZ
Summary : Apache[2.4.66], Cookies[ocexfs76yoe2], HTML5, HTTPServer[Debian Linux][Apache/2.4.66 (Debian)], HttpOnly[ocexfs76yoe2], Open-Graph-Protocol[website], PHP[8.3.30], Script, Strict-Transport-Security[max-age=15552000; includeSubDomains; preload], UncommonHeaders[content-security-policy,feature-policy,referrer-policy,x-content-type-options,x-permitted-cross-domain-policies,x-request-id,x-robots-tag], X-Frame-Options[SAMEORIGIN], X-Powered-By[PHP/8.3.30], X-XSS-Protection[1; mode=block]
Detected Plugins:
[ Apache ]
The Apache HTTP Server Project is an effort to develop and
maintain an open-source HTTP server for modern operating
systems including UNIX and Windows NT. The goal of this
project is to provide a secure, efficient and extensible
server that provides HTTP services in sync with the current
HTTP standards.
Version : 2.4.66 (from HTTP Server Header)
Google Dorks: (3)
Website : http://httpd.apache.org/
[ Cookies ]
Display the names of cookies in the HTTP headers. The
values are not returned to save on space.
String : ocexfs76yoe2
[ HTML5 ]
HTML version 5, detected by the doctype declaration
[ HTTPServer ]
HTTP server header string. This plugin also attempts to
identify the operating system from the server header.
OS : Debian Linux
String : Apache/2.4.66 (Debian) (from server string)
[ HttpOnly ]
If the HttpOnly flag is included in the HTTP set-cookie
response header and the browser supports it then the cookie
cannot be accessed through client side script - More Info:
http://en.wikipedia.org/wiki/HTTP_cookie
String : ocexfs76yoe2
[ Open-Graph-Protocol ]
The Open Graph protocol enables you to integrate your Web
pages into the social graph. It is currently designed for
Web pages representing profiles of real-world things .
things like movies, sports teams, celebrities, and
restaurants. Including Open Graph tags on your Web page,
makes your page equivalent to a Facebook Page.
Version : website
[ PHP ]
PHP is a widely-used general-purpose scripting language
that is especially suited for Web development and can be
embedded into HTML. This plugin identifies PHP errors,
modules and versions and extracts the local file path and
username if present.
Version : 8.3.30
Google Dorks: (3)
Website : http://www.php.net/
[ Script ]
This plugin detects instances of script HTML elements and
returns the script language/type.
[ Strict-Transport-Security ]
Strict-Transport-Security is an HTTP header that restricts
a web browser from accessing a website without the security
of the HTTPS protocol.
String : max-age=15552000; includeSubDomains; preload
[ UncommonHeaders ]
Uncommon HTTP server headers. The blacklist includes all
the standard headers and many non standard but common ones.
Interesting but fairly common headers should have their own
plugins, eg. x-powered-by, server and x-aspnet-version.
Info about headers can be found at www.http-stats.com
String : content-security-policy,feature-policy,referrer-policy,x-content-type-options,x-permitted-cross-domain-policies,x-request-id,x-robots-tag (from headers)
[ X-Frame-Options ]
This plugin retrieves the X-Frame-Options value from the
HTTP header. - More Info:
http://msdn.microsoft.com/en-us/library/cc288472%28VS.85%29.
aspx
String : SAMEORIGIN
[ X-Powered-By ]
X-Powered-By HTTP header
String : PHP/8.3.30 (from x-powered-by string)
[ X-XSS-Protection ]
This plugin retrieves the X-XSS-Protection value from the
HTTP header. - More Info:
http://msdn.microsoft.com/en-us/library/cc288472%28VS.85%29.
aspx
String : 1; mode=block
HTTP Headers:
HTTP/1.1 200 OK
Cache-Control: no-cache, no-store, must-revalidate
Content-Encoding: gzip
Content-Length: 5801
Content-Security-Policy: default-src 'none';base-uri 'none';manifest-src 'self';script-src 'nonce-yOG1PxBMIFP1f74ch3smft3R4lRE5UCTbgBUiKnBJNU=';script-src-elem 'strict-dynamic' 'nonce-yOG1PxBMIFP1f74ch3smft3R4lRE5UCTbgBUiKnBJNU=';style-src 'self' 'unsafe-inline';img-src 'self' data: blob: https://*.tile.openstreetmap.org;font-src 'self' data:;connect-src 'self';media-src 'self';frame-src 'self';frame-ancestors 'self';form-action 'self'
Content-Type: text/html; charset=UTF-8
Date: Sun, 05 Apr 2026 08:25:30 GMT
Feature-Policy: autoplay 'self';camera 'none';fullscreen 'self';geolocation 'none';microphone 'none';payment 'none'
Referrer-Policy: same-origin
Server: Apache/2.4.66 (Debian)
Set-Cookie: ocexfs76yoe2=affd533eb58b675e17ca401e417639b0; path=/; secure; HttpOnly; SameSite=Lax
Strict-Transport-Security: max-age=15552000; includeSubDomains; preload
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-Permitted-Cross-Domain-Policies: none
X-Powered-By: PHP/8.3.30
X-Request-Id: HGFDRAOx21eCKoMjPMZh
X-Robots-Tag: noindex, nofollow
X-Xss-Protection: 1; mode=block
Connection: close
```