_ _ ____ _ _ ____ _| || |_ / ___| |__ ___ ___| |_/ ___| ___ ___ |_ .. _| | _| '_ \ / _ \/ __| __\___ \ / _ \/ __| |_ _| |_| | | | | (_) \__ \ |_ ___) | __/ (__ |_||_| \____|_| |_|\___/|___/\__|____/ \___|\___| _ _ ____ _ _ ____ ____ _ _ _ _| || |_ / ___| |__ ___ ___| |_/ ___| ___ ___ | _ \ __ _| | _(_)___| |_ __ _ _ __ |_ .. _| | _| '_ \ / _ \/ __| __\___ \ / _ \/ __| | |_) / _` | |/ / / __| __/ _` | '_ \ |_ _| |_| | | | | (_) \__ \ |_ ___) | __/ (__ | __/ (_| | <| \__ \ || (_| | | | | |_||_| \____|_| |_|\___/|___/\__|____/ \___|\___| |_| \__,_|_|\_\_|___/\__\__,_|_| |_| zameen.com possible exploits [i] Total Subdomains Found : 7 [+] Subdomain: api6.zameen.com [-] IP: 52.17.95.46 [+] Subdomain: uae.zameen.com [-] IP: 72.32.201.11 [+] Subdomain: signature.zameen.com [-] IP: 52.16.154.103 [+] Subdomain: facebook.zameen.com [-] IP: 78.47.98.254 [+] Subdomain: mail.zameen.com [-] IP: 72.32.201.11 [+] Subdomain: alerts.zameen.com [-] IP: 52.49.118.208 [+] Subdomain: agency.zameen.com [-] IP: 52.31.254.172 https://profolio.zameen.com/javascript/calendar/bgiframe.js https://profolio.zameen.com/javascript/mapbox-gl.js https://zameen.com/HomeFinance/Pakistan-Mortgages.php https://www.zameen.com/profolio/index.php ADMINS LOGIN PAGE: http://signature.zameen.com HTTP: -> The remote web server contains web pages that are protected by 'Basic' authentication over cleartext. PHP: -> Unsupported version of PHP was detected. Installed version 5.3.29 End of support date 2014/08/14 Latest versions 7.1.x / 7.2.x / 7.3.x -> PHP expose_php Information Disclosure The PHP install on the remote server is configured in a way that allows disclosure of potentially sensitive information to an attacker through a special URL. Such a URL triggers an Easter egg built into PHP itself. rDNS record for 52.16.154.103: ec2-52-16-154-103.eu-west-1.compute.amazonaws.com Not shown: 997 filtered ports PORT STATE SERVICE VERSION 80/tcp open http Apache httpd 2.2.31 ((Amazon)) |_http-server-header: Apache/2.2.31 (Amazon) | vulscan: VulDB - https://vuldb.com: | [122889] Apache HTTP Server up to 2.2.31/2.4.23 mod_userdir HTTP Response Splitting privilege escalation | [134248] Apache Archiva up to 2.2.3 Artifact Upload directory traversal | [134247] Apache Archiva up to 2.2.3 Artifact Upload directory traversal | [106777] Apache HTTP Server up to 2.2.34/2.4.27 Limit Directive ap_limit_section HTTP Request information disclosure | [103520] Apache HTTP Server up to 2.2.33/2.4.26 mod_auth_digest Authorization Header memory corruption | [102698] Apache HTTP Server up to 2.2.32/2.4.25 mod_mime Content-Type memory corruption | [102690] Apache HTTP Server up to 2.2.32/2.4.25 mod_ssl ap_hook_process_connection() denial of service | [102689] Apache HTTP Server up to 2.2.32/2.4.25 ap_get_basic_auth_pw weak authentication | [12291] Apache Struts up to 2.2.3 DebuggingInterceptor privilege escalation | [64485] Apache Struts up to 2.2.3.0 privilege escalation | [64457] Apache Struts up to 2.2.3.0 cross site scripting | [60352] Apache Struts up to 2.2.3 memory corruption | [59902] Apache Struts up to 2.2.3 Interfaces unknown vulnerability | [4528] Apache Struts up to 2.2.3 DebuggingInterceptor privilege escalation | [4527] Apache Struts up to 2.2.3 ExceptionDelegator cross site scripting | [4512] Apache Struts up to 2.2.3 CookieInterceptor privilege escalation | [42102] Apache 'mod_proxy_http' 2.2.9 for Unix Timeout Handling Information Disclosure Vulnerability | [27237] Apache HTTP Server 2.2.6, 2.0.61 and 1.3.39 'mod_status' Cross-Site Scripting Vulnerability Apache Http Server CVE Name CVSS CVE-2019-3878 libapache2-mod-auth-mellon – security update 6.8 CVE-2019-0227 Apache Axis 1.4 - Remote Code Execution 5.4 CVE-2019-0220 Apache HTTP Server 安全漏洞 5 CVE-2019-0217 Apache HTTP Server 竞争条件问题漏洞 6 CVE-2019-0215 Apache HTTP Server 访问控制错误漏洞 6 CVE-2019-0211 Apache HTTP Server Local Privilege Escalation Exploit 7.2 CVE-2019-0197 Apache HTTP Server 安全漏洞 4.9 CVE-2019-0196 Apache httpd 安全漏洞 5 CVE-2019-0190 Apache HTTP Server 安全漏洞 5 CVE-2019-0186 Apache Pluto 3.0.0 / 3.0.1 - Persistent Cross-Site Scripting 4.3 CVE-2018-8021 Apache Superset < 0.23 - Remote Code Execution BY: #GhostSec #GhostSecPakistan CREDIT: @sec420x @ghostsecpak