- Nikto v2.6.0 --------------------------------------------------------------------------- + Target IP: 172.66.0.42 + Target Hostname: jsdetailtint.com + Target Port: 80 + Platform: Windows + Start Time: 2026-07-27 21:41:45 (GMT-4) --------------------------------------------------------------------------- + Server: cloudflare + [999986] /: Retrieved x-powered-by header: Next.js. + [999106] /: Cloudflare detected via cf-ray header. Recommend proxying via Burp or mitmproxy to avoid TLS fingerprint blocks. See: https://github.com/sullo/nikto/wiki/Using-a-Proxy + [999100] /cgi.cgi/: Uncommon header(s) 'refresh' found, with contents: 0;url=/cgi.cgi. + No CGI Directories found (use '-C all' to force check all possible dirs). CGI tests skipped. + [999996] /robots.txt: contains 2 entries which should be manually viewed. See: https://developer.mozilla.org/en-US/docs/Glossary/Robots.txt + [740000] Multiple index files found (all unique): /index.aspx, /default.htm, /index.jhtml, /index.xml, /index.cgi, /index.pl, /default.asp, /default.aspx, /index.htm, /index.jsp, /index.do, /index.cfm, /index.shtml, /index.asp. + [800264] /: cloudflare - Cloudflare detected via banner. Recommend proxying via Burp or mitmproxy to avoid TLS fingerprint blocks if not already proxying. + [000023] /scripts/samples/details.idc: NT ODBC Remote Compromise. See: http://attrition.org/security/advisory/individual/rfp/rfp.9901.nt_odbc + [000024] /_vti_bin/shtml.exe: Attackers may be able to crash FrontPage by requesting a DOS device, like shtml.exe/aux.htm -- a DoS was not attempted. See: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0709 + [000039] /cgi-bin/wrap: Allows viewing of directories. + [000043] /guestbook/guestbookdat: PHP-Gastebuch 1.60 Beta reveals sensitive information about its configuration. + [000044] /guestbook/pwd: PHP-Gastebuch 1.60 Beta reveals the md5 hash of the admin password. + [000054] /global.inc: PHP-Survey's include file should not be available via the web. Configure the web server to ignore .inc files or change this to global.inc.php. See: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-0614 + [000078] /getaccess: This may be an indication that the server is running getAccess for SSO. + [000092] /cfdocs/expeval/openfile.cfm: Can use to expose the system/server path. + [000109] /vgn/performance/TMT: Vignette CMS admin/maintenance script available. + [000110] /vgn/performance/TMT/Report: Vignette CMS admin/maintenance script available. + [000111] /vgn/performance/TMT/Report/XML: Vignette CMS admin/maintenance script available. + [000112] /vgn/performance/TMT/reset: Vignette CMS admin/maintenance script available. + [000113] /vgn/ppstats: Vignette CMS admin/maintenance script available. + [000114] /vgn/previewer: Vignette CMS admin/maintenance script available. + [000115] /vgn/record/previewer: Vignette CMS admin/maintenance script available. + [000116] /vgn/stylepreviewer: Vignette CMS admin/maintenance script available. + [000117] /vgn/vr/Deleting: Vignette CMS admin/maintenance script available. + [000118] /vgn/vr/Editing: Vignette CMS admin/maintenance script available. + [000119] /vgn/vr/Saving: Vignette CMS admin/maintenance script available. + [000120] /vgn/vr/Select: Vignette CMS admin/maintenance script available. + [000121] /scripts/iisadmin/bdir.htr: This default script shows host info, may allow file browsing and buffer a overrun in the Chunked Encoding data transfer mechanism, request /scripts/iisadmin/bdir.htr??c:\. See: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/MS02-028 + [000122] /scripts/iisadmin/ism.dll: Allows you to mount a brute force attack on passwords. + [000123] /scripts/tools/ctss.idc: This CGI allows remote users to view and modify SQL DB contents, server paths, docroot and more. + [000124] /bigconf.cgi: BigIP Configuration CGI. + [000126] /blah_badfile.shtml: Allaire ColdFusion allows JSP source viewed through a vulnerable SSI call. + [000128] /vgn/style: Vignette server may reveal system information through this file. See: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0401 + [000130] /SiteServer/Admin/commerce/foundation/domain.asp: Displays known domains of which that server is involved. See: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1769 + [000131] /SiteServer/Admin/commerce/foundation/driver.asp: Displays a list of installed ODBC drivers. See: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1769 + [000132] /SiteServer/Admin/commerce/foundation/DSN.asp: Displays all DSNs configured for selected ODBC drivers. See: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1769 + [000133] /SiteServer/admin/findvserver.asp: Gives a list of installed Site Server components. See: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1769 + [000134] /SiteServer/Admin/knowledge/dsmgr/default.asp: Used to view current search catalog configurations. + [000140] /clusterframe.jsp: Macromedia JRun 4 build 61650 remote administration interface is vulnerable to several XSS attacks. + [000142] /bb-dnbd/faxsurvey: This may allow arbitrary command execution. + [000143] /cartcart.cgi: If this is Dansie Shopping Cart 3.0.8 or earlier, it contains a backdoor to allow attackers to execute arbitrary commands. + [000144] /scripts/Carello/Carello.dll: Carello 1.3 may allow commands to be executed on the server by replacing hidden form elements. This could not be tested by Nikto. See: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-0614 + [000145] /scripts/tools/dsnform.exe: Allows creation of ODBC Data Source. + [000146] /scripts/tools/dsnform: Allows creation of ODBC Data Source. + [000147] /SiteServer/Admin/knowledge/dsmgr/users/GroupManager.asp: Microsoft Site Server script used to create, modify, and potentially delete LDAP users and groups. See: https://securitytracker.com/id/1003420 + [000148] /SiteServer/Admin/knowledge/dsmgr/users/UserManager.asp: Microsoft Site Server used to create, modify, and potentially delete LDAP users and groups. See: https://securitytracker.com/id/1003420 + [000150] /readme.eml: Remote server may be infected with the Nimda virus. + [000151] /scripts/httpodbc.dll: Possible IIS backdoor found. + [000164] /PDG_Cart/order.log: PDG Commerce log found. See: http://zodi.com/cgi-bin/shopper.cgi?display=intro&template=Intro/commerce.html + [000180] /ows/restricted%2eshow: OWS may allow restricted files to be viewed by replacing a character with its encoded equivalent. + [000186] /officescan/cgi/cgiChkMasterPwd.exe: Trend Micro Officescan allows you to skip the login page and access some CGI programs directly. See: https://web.archive.org/web/20030607054822/http://support.microsoft.com/support/exchange/content/whitepapers/owaguide.doc + [000199] /pbserver/pbserver.dll: This may contain a buffer overflow. See: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2000/MS00-094 + [000205] /scripts/cpshost.dll: Posting acceptor possibly allows you to upload files. + [000207] /upload.asp: An ASP page that allows attackers to upload files to server. + [000208] /uploadn.asp: An ASP page that allows attackers to upload files to server. + [000209] /uploadx.asp: An ASP page that allows attackers to upload files to server. + [000210] /wa.exe: An ASP page that allows attackers to upload files to server. + [000215] /vgn/ac/data: Vignette CMS admin/maintenance script available. + [000216] /vgn/ac/delete: Vignette CMS admin/maintenance script available. + [000217] /vgn/ac/edit: Vignette CMS admin/maintenance script available. + [000218] /vgn/ac/esave: Vignette CMS admin/maintenance script available. + [000219] /vgn/ac/fsave: Vignette CMS admin/maintenance script available. + [000220] /vgn/ac/index: Vignette CMS admin/maintenance script available. + [000221] /vgn/asp/MetaDataUpdate: Vignette CMS admin/maintenance script available. + [000222] /vgn/asp/previewer: Vignette CMS admin/maintenance script available. + [000223] /vgn/asp/status: Vignette CMS admin/maintenance script available. + [000224] /vgn/asp/style: Vignette CMS admin/maintenance script available. + [000225] /vgn/errors: Vignette CMS admin/maintenance script available. + [000226] /vgn/jsp/controller: Vignette CMS admin/maintenance script available. + [000227] /vgn/jsp/errorpage: Vignette CMS admin/maintenance script available. + [000228] /vgn/jsp/initialize: Vignette CMS admin/maintenance script available. + [000229] /vgn/jsp/jspstatus: Vignette CMS admin/maintenance script available. + [000230] /vgn/jsp/jspstatus56: Vignette CMS admin/maintenance script available. + [000231] /vgn/jsp/metadataupdate: Vignette CMS admin/maintenance script available. + [000232] /vgn/jsp/previewer: Vignette CMS admin/maintenance script available. + [000233] /vgn/jsp/style: Vignette CMS admin/maintenance script available. + [000234] /vgn/legacy/edit: Vignette CMS admin/maintenance script available. + [000235] /vgn/login: Vignette server may allow user enumeration based on the login attempts to this file. + [000239] /forum/admin/wwforum.mdb: Web Wiz Forums password database found. See: https://seclists.org/bugtraq/2003/Apr/238 + [000240] /fpdb/shop.mdb: MetaCart2 is an ASP shopping cart. The database of customers is available via the web. See: https://packetstormsecurity.com/files/32406/xmas.txt.html + [000241] /guestbook/admin/o12guest.mdb: Ocean12 ASP Guestbook Manager allows download of SQL database which contains admin password. See: https://www.exploit-db.com/exploits/22484 + [000242] /midicart.mdb: MIDICART database is available for browsing. This should not be allowed via the web server. See: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1432 + [000243] /MIDICART/midicart.mdb: MIDICART database is available for browsing. This should not be allowed via the web server. See: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1432 + [000244] /mpcsoftweb_guestbook/database/mpcsoftweb_guestdata.mdb: MPCSoftWeb Guest Book passwords retrieved. See: https://www.exploit-db.com/exploits/22513 + Scan terminated: 0 errors and 83 items reported on the remote host + End Time: 2026-07-27 21:42:46 (GMT-4) (61 seconds) --------------------------------------------------------------------------- + 1 host(s) tested