Plesk Parallels Panel Version psa v10.2.0_build1011110331.18 os_RedHat el6 Report via Acunetix (Interim | In Progress)

Interim Report via Paros Desktop, Report via Burp Suite Pro 1.4.1, RHEL6 Target Analysis for CPanelReport for Windows Server
Loading
Acunetix Website Audit

24 September, 2011
Plesk Parallels Panel Version psa v10.2.0_build1011110331.18 os_RedHat el6 Report
Generated by Acunetix WVS Reporter (v7.0 Build 20110920)
Scan of https://Plesk Parallels Panel Version psa v10.2.0_build1011110331.18 os_RedHat el6:8443/
Scan details
Scan information
Starttime9/24/2011 2:26:03 PM
Finish time9/24/2011 3:20:59 PM
Scan time54 minutes, 56 seconds
ProfileDefault
Server information
ResponsiveTrue
Server bannersw-cp-server
Server OSUnknown
Server technologies 
Threat level
Acunetix Threat Level 3
One or more high-severity type vulnerabilities have been discovered by the scanner. A malicious user can exploit these vulnerabilities and compromise the backend database and/or deface your website.
Alerts distribution
Total alerts found26
High1
 
Medium3
 
Low5
 
Informational17
 
Knowledge base
List of open TCP ports

Open Port 22 / ssh
Port Banner:
SSH-2.0-OpenSSH_5.3



Open Port 21 / ftp
Port Banner:
ProFTPD 1.3.3c Server (ProFTPD) [50.97.148.210]



Open Port 53 / domain
No port banner available.

Open Port 80 / http
Port Banner:
HTTP/1.1 200 OK: Sat, 24 Sep 2011 14:24:56 GMT: ApacheModified: Sat, 24 Sep 2011 12:13:32 GMT: "2071-27d6-4adaedab43300"Ranges: bytesLength: 10198: closeType: text/html

<!DOCTYPE ...
Acunetix Website Audit2


Open Port 106 / pop3pw
Port Banner:
poppassd hello, who are you?



Open Port 110 / pop3
Port Banner:
+OK Hello there. <17942.1316874296@localhost.localdomain>



Open Port 143 / imap
Port Banner:
* OK [CAPABILITY IMAP4rev1 UIDPLUS CHILDREN NAMESPACE THREAD=ORDEREDSUBJECT THREAD=REFERENCES SORT QUOTA IDLE ACL ACL2=UNION STARTTLS] Courier-IMAP ready. Copyright 1998-2004 Double Precision, Inc. See COPYING for distribution information.



Open Port 443 / https
Port Banner:
<HTML>
<HEAD>
<TITLE>400 Bad Request</TITLE>
</HEAD>
<BODY>
<H1>Bad Request</H1> browser sent a request that this server could not understand.
<P> sent malformed Host header
<P>
<HR>
<ADDRESS> Server at nosedivesailing.com
</ADDRESS>
...


Open Port 465 / smtps
No port banner available.

Open Port 993 / imaps
No port banner available.

Open Port 995 / pop3s
No port banner available.

Open Port 3306 / mysql
Port Banner:
F
DNS server running
A DNS server is running on UDP port 53.
DNS server running on TCP
A DNS server is running on TCP port 53.
FTP server running
An FTP server is running on TCP port 21.
IMAP server running
An IMAP server is running on TCP port 143.
Whois lookup
Whois result for IP address 50.97.148.210:
Acunetix Website Audit3
% This is the RIPE Database query service.
% The objects are in RPSL format.
%
% The RIPE Database is subject to Terms and Conditions.
% See http://www.ripe.net/db/support/db-terms-conditions.pdf

% Note: this output has been filtered.
% To receive output for a database update, use the "-B" flag.

% Information related to '0.0.0.0 - 255.255.255.255'
: 0.0.0.0 - 255.255.255.255: IANA-BLK: The whole IPv4 address space: EU # Country is really world wide: ORG-IANA1-RIPEc: IANA1-RIPEc: IANA1-RIPE: ALLOCATED UNSPECIFIED: The country is really worldwide.: This address space is assigned at various other places in: the world and might therefore not be in the RIPE database.by: RIPE-NCC-HM-MNTlower: RIPE-NCC-HM-MNTroutes: RIPE-NCC-RPSL-MNT: RIPE # Filtered
: ORG-IANA1-RIPEname: Internet Assigned Numbers Authoritytype: IANA: see http://www.iana.org: The IANA allocates IP addresses and AS number blocks to RIRs: see http://www.iana.org/ipaddress/ip-addresses.htm: and http://www.iana.org/assignments/as-numbersmail: bitbucket@ripe.netc: IANA1-RIPEc: IANA1-RIPEref: RIPE-NCC-HM-MNTby: RIPE-NCC-HM-MNT: RIPE # Filtered
: Internet Assigned Numbers Authority: see http://www.iana.org.mail: bitbucket@ripe.netc: IANA1-RIPEc: IANA1-RIPEhdl: IANA1-RIPE: For more information on IANA services: go to IANA web site at http://www.iana.org.by: RIPE-NCC-MNT: RIPE # Filtered



POP3 server running
A POP3 server is running on TCP port 110.
SSH server running
A SSH server is running on TCP port 22.
SSH server information:
Server key fingerprint: 61a1ceca0a253ba1cc41ba43e9078c53 version: SSH2 algorithm client to server: AES128 CTR algorithm server to client: AES128 CTR algorithm client to server: HMAC with SHA-256 digest algorithm server to client: HMAC with SHA-256 digest key algorithm: Certificate is signed using RSA digital signature with MD2 digest
SSL server running [443]

A SSL2 server is running on TCP port 443.




SSL server information:

Version: SSL2,SSL3,TLS1


Certificate:

:
Country Name: US
State Or Province Name: Virginia
Locality Name: Herndon
Organization Name: Parallels
Organizational Unit Name: Parallels Panel
Common Name: Parallels Panel:
Country Name: US
State Or Province Name: Virginia
Locality Name: Herndon
Organization Name: Parallels
Acunetix Website Audit4
Organizational Unit Name: Parallels Panel
Common Name: Parallels Panel
version: 1 number: 4e7d480d print: 440e783632f21b4b162208187c4c470d ID: 1.2.840.113549.1.1.5 start: Fri Sep 23 22:01:33 CDT 2011 end: Sat Sep 22 22:01:33 CDT 2012 in: 364 days



A SSL3 server is running on TCP port 443.




SSL server information:

Version: SSL2,SSL3,TLS1
Ciphers suported:
- SSL3_CK_RSA_RC4_40_MD5(OpenSSL ciphername: EXP-RC4-MD5, Protocol version: SSLv3, Key Exchange: RSA(512), Autentication: RSA, Symmetric encryption method: RC4(40), Message authentication code: MD5, export) - Low strength
- SSL3_CK_RSA_RC4_128_MD5(OpenSSL ciphername: RC4-MD5, Protocol version: SSLv3, Key Exchange: RSA, Autentication: RSA, Symmetric encryption method: RC4(128), Message authentication code: MD5) - High strength
- SSL3_CK_RSA_RC4_128_SHA(OpenSSL ciphername: RC4-SHA, Protocol version: SSLv3, Key Exchange: RSA, Autentication: RSA, Symmetric encryption method: RC4(128), Message authentication code: SHA1) - High strength
- SSL3_CK_RSA_RC2_40_MD5(OpenSSL ciphername: EXP-RC2-CBC-MD5, Protocol version: SSLv3, Key Exchange: RSA(512), Autentication: RSA, Symmetric encryption method: RC2(40), Message authentication code: MD5, export) - Low strength
- SSL3_CK_RSA_DES_40_CBC_SHA(OpenSSL ciphername: EXP-DES-CBC-SHA, Protocol version: SSLv3, Key Exchange: RSA(512), Autentication: RSA, Symmetric encryption method: DES(40), Message authentication code: SHA1, export) - Low strength
- SSL3_CK_RSA_DES_64_CBC_SHA(OpenSSL ciphername: DES-CBC-SHA, Protocol version: SSLv3, Key Exchange: RSA, Autentication: RSA, Symmetric encryption method: DES(56), Message authentication code: SHA1) - Low strength
- SSL3_CK_RSA_DES_192_CBC3_SHA(OpenSSL ciphername: DES-CBC3-SHA, Protocol version: SSLv3, Key Exchange: RSA, Autentication: RSA, Symmetric encryption method: 3DES(168), Message authentication code: SHA1) - High strength
- SSL3_CK_EDH_RSA_DES_40_CBC_SHA(OpenSSL ciphername: EXP-EDH-RSA-DES-CBC-SHA, Protocol version: SSLv3, Key Exchange: DH(512), Autentication: RSA, Symmetric encryption method: DES(40), Message authentication code: SHA1, export) - Low strength
- SSL3_CK_EDH_RSA_DES_64_CBC_SHA(OpenSSL ciphername: EDH-RSA-DES-CBC-SHA, Protocol version: SSLv3, Key Exchange: DH, Autentication: RSA, Symmetric encryption method: DES(56), Message authentication code: SHA1) - Low strength
- SSL3_CK_EDH_RSA_DES_192_CBC3_SHA(OpenSSL ciphername: EDH-RSA-DES-CBC3-SHA, Protocol version: SSLv3, Key Exchange: DH, Autentication: RSA, Symmetric encryption method: 3DES(168), Message authentication code: SHA1) - High strength



Certificate:

:
Country Name: US
State Or Province Name: Virginia
Locality Name: Herndon
Organization Name: Parallels
Organizational Unit Name: Parallels Panel
Common Name: Parallels Panel:
Country Name: US
State Or Province Name: Virginia
Locality Name: Herndon
Organization Name: Parallels
Organizational Unit Name: Parallels Panel
Common Name: Parallels Panel
version: 1 number: 4e7d480d print: 440e783632f21b4b162208187c4c470d ID: 1.2.840.113549.1.1.5 start: Fri Sep 23 22:01:33 CDT 2011 end: Sat Sep 22 22:01:33
Acunetix Website Audit5
CDT 2012 in: 364 days



A TLS1 server is running on TCP port 443.




SSL server information:

Version: SSL2,SSL3,TLS1
Ciphers suported:
- TLS1_CK_RSA_EXPORT_WITH_RC4_40_MD5(OpenSSL ciphername: EXP-RC4-MD5, Protocol version: TLSv1, Key Exchange: RSA(512), Autentication: RSA, Symmetric encryption method: RC4(40), Message authentication code: MD5, export) - Low strength
- TLS1_CK_RSA_WITH_RC4_128_MD5(OpenSSL ciphername: RC4-MD5, Protocol version: TLSv1, Key Exchange: RSA, Autentication: RSA, Symmetric encryption method: RC4(128), Message authentication code: MD5) - High strength
- TLS1_CK_RSA_WITH_RC4_128_SHA(OpenSSL ciphername: RC4-SHA, Protocol version: TLSv1, Key Exchange: RSA, Autentication: RSA, Symmetric encryption method: RC4(128), Message authentication code: SHA1) - High strength
- TLS1_CK_RSA_EXPORT_WITH_RC2_CBC_40_MD5(OpenSSL ciphername: EXP-RC2-CBC-MD5, Protocol version: TLSv1, Key Exchange: RSA(512), Autentication: RSA, Symmetric encryption method: RC2(40), Message authentication code: MD5, export) - Low strength
- TLS1_CK_RSA_EXPORT_WITH_DES40_CBC_SHA(OpenSSL ciphername: EXP-DES-CBC-SHA, Protocol version: TLSv1, Key Exchange: RSA(512), Autentication: RSA, Symmetric encryption method: DES(40), Message authentication code: SHA1, export) - Low strength
- TLS1_CK_RSA_WITH_DES_CBC_SHA(OpenSSL ciphername: DES-CBC-SHA, Protocol version: TLSv1, Key Exchange: RSA, Autentication: RSA, Symmetric encryption method: DES(56), Message authentication code: SHA1) - Low strength
- TLS1_CK_RSA_WITH_3DES_EDE_CBC_SHA(OpenSSL ciphername: DES-CBC3-SHA, Protocol version: TLSv1, Key Exchange: RSA, Autentication: RSA, Symmetric encryption method: 3DES(168), Message authentication code: SHA1) - High strength
- TLS1_CK_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA(OpenSSL ciphername: EXP-EDH-RSA-DES-CBC-SHA, Protocol version: TLSv1, Key Exchange: DH(512), Autentication: RSA, Symmetric encryption method: DES(40), Message authentication code: SHA1, export) - Low strength
- TLS1_CK_DHE_RSA_WITH_DES_CBC_SHA(OpenSSL ciphername: EDH-RSA-DES-CBC-SHA, Protocol version: TLSv1, Key Exchange: DH, Autentication: RSA, Symmetric encryption method: DES(56), Message authentication code: SHA1) - Low strength
- TLS1_CK_DHE_RSA_WITH_3DES_EDE_CBC_SHA(OpenSSL ciphername: EDH-RSA-DES-CBC3-SHA, Protocol version: TLSv1, Key Exchange: DH, Autentication: RSA, Symmetric encryption method: 3DES(168), Message authentication code: SHA1) - High strength
- TLS1_CK_RSA_WITH_AES_128_CBC_SHA(OpenSSL ciphername: AES128-SHA, Protocol version: TLSv1, Key Exchange: RSA, Autentication: RSA, Symmetric encryption method: AES(128), Message authentication code: SHA1) - High strength
- TLS1_CK_DHE_RSA_WITH_AES_128_CBC_SHA(OpenSSL ciphername: DHE-RSA-AES128-SHA, Protocol version: TLSv1, Key Exchange: DH, Autentication: RSA, Symmetric encryption method: AES(128), Message authentication code: SHA1) - High strength
- TLS1_CK_RSA_WITH_AES_256_CBC_SHA(OpenSSL ciphername: AES256-SHA, Protocol version: TLSv1, Key Exchange: RSA, Autentication: RSA, Symmetric encryption method: AES(256), Message authentication code: SHA1) - High strength
- TLS1_CK_DHE_RSA_WITH_AES_256_CBC_SHA(OpenSSL ciphername: DHE-RSA-AES256-SHA, Protocol version: TLSv1, Key Exchange: DH, Autentication: RSA, Symmetric encryption method: AES(256), Message authentication code: SHA1) - High strength
- TLS1_CK_RSA_WITH_CAMELLIA_128_CBC_SHA(OpenSSL ciphername: n/a, Protocol version: TLSv1, Key Exchange: RSA, Autentication: RSA, Symmetric encryption method: Camellia(128), Message authentication code: SHA1) - High strength
- TLS1_CK_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA(OpenSSL ciphername: n/a, Protocol version: TLSv1, Key Exchange: DH, Autentication: RSA, Symmetric encryption method: Camellia(128), Message authentication code: SHA1) - High strength
- TLS1_CK_RSA_WITH_CAMELLIA_256_CBC_SHA(OpenSSL ciphername: n/a, Protocol version: TLSv1, Key Exchange: RSA, Autentication: RSA, Symmetric encryption method: Camellia(256), Message authentication code: SHA1) - High strength
- TLS1_CK_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA(OpenSSL ciphername: n/a, Protocol version: TLSv1, Key Exchange: DH, Autentication: RSA, Symmetric encryption method: Camellia(256), Message authentication code: SHA1) -
Acunetix Website Audit6
High strength
- TLS1_CK_RSA_WITH_SEED_CBC_SHA(OpenSSL ciphername: n/a, Protocol version: TLSv1, Key Exchange: RSA, Autentication: RSA, Symmetric encryption method: SEED(128), Message authentication code: SHA1) - High strength
- TLS1_CK_DHE_RSA_WITH_SEED_CBC_SHA(OpenSSL ciphername: n/a, Protocol version: TLSv1, Key Exchange: DH, Autentication: RSA, Symmetric encryption method: SEED(128), Message authentication code: SHA1) - High strength



Certificate:

:
Country Name: US
State Or Province Name: Virginia
Locality Name: Herndon
Organization Name: Parallels
Organizational Unit Name: Parallels Panel
Common Name: Parallels Panel:
Country Name: US
State Or Province Name: Virginia
Locality Name: Herndon
Organization Name: Parallels
Organizational Unit Name: Parallels Panel
Common Name: Parallels Panel
version: 1 number: 4e7d480d print: 440e783632f21b4b162208187c4c470d ID: 1.2.840.113549.1.1.5 start: Fri Sep 23 22:01:33 CDT 2011 end: Sat Sep 22 22:01:33 CDT 2012 in: 364 days

List of file extensions
File extensions can provide information on what technologies are being used on this website.
List of file extensions detected:


php3 => 6 file(s)
js => 12 file(s)
php => 3 file(s)
htc => 1 file(s)
ico => 1 file(s)
css => 23 file(s)
gif => 1004 file(s)
png => 109 file(s)
html => 1 file(s)
asp => 1 file(s)
jsp => 2 file(s)
aspx => 1 file(s)
admin => 1 file(s)
reseller => 1 file(s)
List of files with inputs
These files have at least one input (GET or POST).


/ - 1 inputs
/javascript/chk.js.php - 1 inputs
/login_up.php3 - 2 inputs
/get_password.php - 1 inputs
/smb/account/create-subscription - 1 inputs
/admin/home - 1 inputs
/admin/customer/list - 2 inputs
/admin/reseller/list - 2 inputs
/admin/reseller/tools/id/3 - 1 inputs
/admin/reseller/personal-info - 1 inputs
Acunetix Website Audit7
/admin/reseller/login-info - 1 inputs
/admin/domain/list - 1 inputs
/admin/subscription/list - 2 inputs
/admin/subscription/login - 1 inputs
/admin/customer-service-plan/list - 1 inputs
/admin/server/tools - 1 inputs
/admin/server/settings - 1 inputs
/admin/health - 1 inputs
/admin/health/index - 1 inputs
/plesk/modules - 1 inputs
/plesk/admin-info - 1 inputs
/plesk/admin-password - 1 inputs
/plesk/client@2/domain@1/hosting/file-manager - 1 inputs
/plesk/reseller@3/preferences - 1 inputs
List of external hosts
These hosts were linked from this website but they were not scanned because they are not listed in the list of hosts allowed.(Settings->Scanners settings->Scanner->List of hosts allowed).


www.parallels.com
Alerts summary
 
SSL 2.0 deprecated protocol
AffectsVariations
Server1
 
 
SSL weak ciphers
AffectsVariations
Server2
 
 
TLS1/SSLv3 Renegotiation Vulnerability
AffectsVariations
Web Server1
 
 
Login page password-guessing attack
AffectsVariations
/login_up.php31
 
 
Session Cookie without HttpOnly flag set
AffectsVariations
/2
 
 
Session Cookie without Secure flag set
AffectsVariations
/2
 
Acunetix Website Audit8
 
Broken links
AffectsVariations
/account1
/account/power-mode-logout1
/javascript1
/javascript/main.leie7.fixes.js1
/plesk1
/skins1
/skins/default1
/skins/default/css1
/skins/default/css/admin1
/skins/default/css/common1
/skins/default/css/customer1
/skins/default/plesk1
/skins/default/plesk/css1
/skins/default/plesk/css/left1
/skins/default/plesk/css/main1
/skins/default/plesk/css/top1
 
 
GHDB: Plesk login page
AffectsVariations
/login.php31
 
Acunetix Website Audit9
Alert details
SSL 2.0 deprecated protocol
 
SeverityHigh
TypeConfiguration
Reported by moduleScripting (ssl_ping.script)
Description
The remote service encrypts traffic using an old deprecated protocol with known weaknesses.
Impact
An attacker may be able to exploit these issues to conduct man-in-the-middle attacks or decrypt communications between the affected service and clients.
Recommendation
Disable SSL 2.0 and use SSL 3.0 or TLS 1.0 instead.
Affected items
Server
Details
The SSL server (port: 443) encrypts traffic using an old deprecated protocol (SSL 2.0) with known weaknesses.
SSL weak ciphers
 
SeverityMedium
TypeConfiguration
Reported by moduleScripting (ssl_ping.script)
Description
The remote host supports the use of SSL ciphers that offer either weak encryption or no encryption at all.
Impact
 
Recommendation
Reconfigure the affected application to avoid use of weak ciphers.
Affected items
Server
Details
Weak SSL ciphers (TLS1 on port 443):

TLS1_CK_RSA_EXPORT_WITH_RC4_40_MD5 - Low strength
TLS1_CK_RSA_EXPORT_WITH_RC2_CBC_40_MD5 - Low strength
TLS1_CK_RSA_EXPORT_WITH_DES40_CBC_SHA - Low strength
TLS1_CK_RSA_WITH_DES_CBC_SHA - Low strength
TLS1_CK_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA - Low strength
TLS1_CK_DHE_RSA_WITH_DES_CBC_SHA - Low strength
Acunetix Website Audit10
Server
Details
Weak SSL ciphers (SSL3 on port 443):

SSL3_CK_RSA_RC4_40_MD5 - Low strength
SSL3_CK_RSA_RC2_40_MD5 - Low strength
SSL3_CK_RSA_DES_40_CBC_SHA - Low strength
SSL3_CK_RSA_DES_64_CBC_SHA - Low strength
SSL3_CK_EDH_RSA_DES_40_CBC_SHA - Low strength
SSL3_CK_EDH_RSA_DES_64_CBC_SHA - Low strength
TLS1/SSLv3 Renegotiation Vulnerability
 
SeverityMedium
TypeConfiguration
Reported by moduleTLS1_SSL3_Renegotiation
Description
A vulnerability in the way SSL and TLS protocols allow renegotiation requests may allow an attacker to inject plaintext into an application protocol stream. This could result in a situation where the attacker may be able to issue commands to the server that appear to be coming from a legitimate source. This issue affects SSL version 3.0 and newer and TLS version 1.0 and newer.
Impact
A remote, unauthenticated attacker may be able to inject an arbitrary amount of chosen plaintext into the beginning of the application protocol stream. This could allow and attacker to issue HTTP requests, or take action impersonating the user, among other consequences.
Recommendation
Users should contact vendors for specific patch information.
Affected items
Web Server
Details
No details are available.
Login page password-guessing attack
 
SeverityLow
TypeValidation
Reported by moduleScripting (Html_Authentication_Audit.script)
Description
A common threat web developers face is a password-guessing attack known as a brute force attack. A brute-force attack is an attempt to discover a password by systematically trying every possible combination of letters, numbers, and symbols until you discover the one correct combination that works.

This login page doesn't have any protection against password-guessing attacks (brute force attacks). It's recommended to implement some type of account lockout after a defined number of incorrect password attempts. Consult Web references for more information about fixing this problem.
Impact
An attacker may attempt to discover a weak password by systematically trying every possible combination of letters, numbers, and symbols until it discovers the one correct combination that works.
Acunetix Website Audit11
Recommendation
It's recommended to implement some type of account lockout after a defined number of incorrect password attempts.
Affected items
/login_up.php3
Details
The scanner tested 10 invalid credentials and no account lockout was detected.
Request
POST /login_up.php3 HTTP/1.1
Content-Length: 53
Content-Type: application/x-www-form-urlencoded
Host: Plesk Parallels Panel Version psa v10.2.0_build1011110331.18 os_RedHat el6:8443
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)
Accept: */*

locale_id=default&login_name=cpJD667j&passwd=ZPGubZ7Z
Response
HTTP/1.1 200 OK
Expires: Fri, 28 May 1999 00:00:00 GMT
Last-Modified: Sat, 24 Sep 2011 14:28:10 GMT
Cache-Control: no-store, no-cache, must-revalidate
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
P3P: CP="NON COR CURa ADMa OUR NOR UNI COM NAV STA"
Content-Type: text/html; charset=utf-8
X-Plesk: PSA-Key/PLSK016479390000
Date: Sat, 24 Sep 2011 14:28:14 GMT
Server: sw-cp-server
Content-Length: 5607
Session Cookie without HttpOnly flag set
 
SeverityLow
TypeInformational
Reported by moduleCrawler
Description
This session cookie doesn't have the HTTPOnly flag set. When a cookie is set with the HTTPOnly flag, it instructs the browser that the cookie can only be accessed by the server and not by client-side scripts. This is an important security protection for session cookies.
Impact
None
Recommendation
If possible, you should set the HTTPOnly flag for this cookie.
Affected items
/
Details
Cookie name: "PHPSESSID"
Cookie domain: "Plesk Parallels Panel Version psa v10.2.0_build1011110331.18 os_RedHat el6"
Request
GET / HTTP/1.1
Acunetix Website Audit12
Pragma: no-cache
Cookie: PHPSESSID=2164ae932854bc55b185e0e22ab867d3; locale=en-US
Host: Plesk Parallels Panel Version psa v10.2.0_build1011110331.18 os_RedHat el6:8443
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)
Response
HTTP/1.1 303 See Other
Expires: Mon, 24 Oct 2011 14:25:10 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: max-age=2592000
Cache-Control: post-check=0, pre-check=0
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Last-Modified: Sat, 24 Sep 2011 14:25:11 GMT
P3P: CP="NON COR CURa ADMa OUR NOR UNI COM NAV STA"
Pragma: no-cache
Content-Type: text/html; charset=utf-8
Location: https://Plesk Parallels Panel Version psa v10.2.0_build1011110331.18 os_RedHat el6:8443/smb/
Content-Length: 0
Date: Sat, 24 Sep 2011 14:25:11 GMT
Server: sw-cp-server
/
Details
Cookie name: "PHPSESSID"
Cookie domain: "Plesk Parallels Panel Version psa v10.2.0_build1011110331.18 os_RedHat el6"
Request
GET / HTTP/1.1
Pragma: no-cache
Cookie: PHPSESSID=2164ae932854bc55b185e0e22ab867d3; locale=en-US
Host: Plesk Parallels Panel Version psa v10.2.0_build1011110331.18 os_RedHat el6:8443
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)
Accept: */*
Response
HTTP/1.1 303 See Other
Expires: Mon, 24 Oct 2011 14:25:10 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: max-age=2592000
Cache-Control: post-check=0, pre-check=0
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Last-Modified: Sat, 24 Sep 2011 14:25:11 GMT
P3P: CP="NON COR CURa ADMa OUR NOR UNI COM NAV STA"
Pragma: no-cache
Content-Type: text/html; charset=utf-8
Location: https://Plesk Parallels Panel Version psa v10.2.0_build1011110331.18 os_RedHat el6:8443/smb/
Content-Length: 0
Date: Sat, 24 Sep 2011 14:25:11 GMT
Server: sw-cp-server
Session Cookie without Secure flag set
 
SeverityLow
TypeInformational
Reported by moduleCrawler
Description
This session cookie doesn't have the Secure flag set. When a cookie is set with the Secure flag, it instructs the browser that the cookie can only be accessed over secure SSL channels. This is an important security protection for session
Acunetix Website Audit13
cookies.
Impact
None
Recommendation
If possible, you should set the Secure flag for this cookie.
Affected items
/
Details
Cookie name: "PHPSESSID"
Cookie domain: "Plesk Parallels Panel Version psa v10.2.0_build1011110331.18 os_RedHat el6"
Request
GET / HTTP/1.1
Pragma: no-cache
Cookie: PHPSESSID=2164ae932854bc55b185e0e22ab867d3; locale=en-US
Host: Plesk Parallels Panel Version psa v10.2.0_build1011110331.18 os_RedHat el6:8443
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)
Accept: */*
Response
HTTP/1.1 303 See Other
Expires: Mon, 24 Oct 2011 14:25:10 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: max-age=2592000
Cache-Control: post-check=0, pre-check=0
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Last-Modified: Sat, 24 Sep 2011 14:25:11 GMT
P3P: CP="NON COR CURa ADMa OUR NOR UNI COM NAV STA"
Pragma: no-cache
Content-Type: text/html; charset=utf-8
Location: https://Plesk Parallels Panel Version psa v10.2.0_build1011110331.18 os_RedHat el6:8443/smb/
Content-Length: 0
Date: Sat, 24 Sep 2011 14:25:11 GMT
Server: sw-cp-server
/
Details
Cookie name: "PHPSESSID"
Cookie domain: "Plesk Parallels Panel Version psa v10.2.0_build1011110331.18 os_RedHat el6"
Request
GET / HTTP/1.1
Pragma: no-cache
Cookie: PHPSESSID=2164ae932854bc55b185e0e22ab867d3; locale=en-US
Host: Plesk Parallels Panel Version psa v10.2.0_build1011110331.18 os_RedHat el6:8443
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)
Accept: */*
Response
HTTP/1.1 303 See Other
Expires: Mon, 24 Oct 2011 14:25:10 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: max-age=2592000
Cache-Control: post-check=0, pre-check=0
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Last-Modified: Sat, 24 Sep 2011 14:25:11 GMT
Acunetix Website Audit14
P3P: CP="NON COR CURa ADMa OUR NOR UNI COM NAV STA"
Pragma: no-cache
Content-Type: text/html; charset=utf-8
Location: https://Plesk Parallels Panel Version psa v10.2.0_build1011110331.18 os_RedHat el6:8443/smb/
Content-Length: 0
Date: Sat, 24 Sep 2011 14:25:11 GMT
Broken links
 
SeverityInformational
TypeInformational
Reported by moduleCrawler
Description
A broken link refers to any link that should take you to a document, image or webpage, that actually results in an error. This page was linked from the website but it is inaccessible.
Impact
Problems navigating the site.
Recommendation
Remove the links to this file or make it accessible.
Affected items
/account
Details
No details are available.
Request
GET /account HTTP/1.1
Pragma: no-cache
Referer: https://Plesk Parallels Panel Version psa v10.2.0_build1011110331.18 os_RedHat el6:8443/
Cookie: PHPSESSID=2164ae932854bc55b185e0e22ab867d3; locale=en-US
Host: Plesk Parallels Panel Version psa v10.2.0_build1011110331.18 os_RedHat el6:8443
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)
Accept: */*
Response
HTTP/1.1 404 Not Found
Content-Type: text/html
Content-Length: 345
Date: Sat, 24 Sep 2011 14:25:29 GMT
Server: sw-cp-server
/account/power-mode-logout
Details
No details are available.
Request
GET /account/power-mode-logout HTTP/1.1
Pragma: no-cache
Referer: https://Plesk Parallels Panel Version psa v10.2.0_build1011110331.18 os_RedHat el6:8443/
Cookie: PHPSESSID=2164ae932854bc55b185e0e22ab867d3; locale=en-US
Host: Plesk Parallels Panel Version psa v10.2.0_build1011110331.18 os_RedHat el6:8443
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)
Accept: */*
Response
Acunetix Website Audit15
HTTP/1.1 404 Not Found
Content-Type: text/html
Content-Length: 345
Date: Sat, 24 Sep 2011 14:25:29 GMT
Server: sw-cp-server
/javascript
Details
No details are available.
Request
GET /javascript/ HTTP/1.1
Pragma: no-cache
Referer: https://Plesk Parallels Panel Version psa v10.2.0_build1011110331.18 os_RedHat el6:8443/javascript/
Cookie: PHPSESSID=2164ae932854bc55b185e0e22ab867d3; locale=en-US
Host: Plesk Parallels Panel Version psa v10.2.0_build1011110331.18 os_RedHat el6:8443
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)
Accept: */*
Response
HTTP/1.1 404 Not Found
Expires: Mon, 24 Oct 2011 14:25:17 GMT
Cache-Control: max-age=2592000
Content-Type: text/html
Content-Length: 345
Date: Sat, 24 Sep 2011 14:25:17 GMT
Server: sw-cp-server
/javascript/main.leie7.fixes.js
Details
No details are available.
Request
GET /javascript/main.leie7.fixes.js HTTP/1.1
Pragma: no-cache
Referer: https://Plesk Parallels Panel Version psa v10.2.0_build1011110331.18 os_RedHat el6:8443/
Cookie: PHPSESSID=2164ae932854bc55b185e0e22ab867d3; locale=en-US
Host: Plesk Parallels Panel Version psa v10.2.0_build1011110331.18 os_RedHat el6:8443
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)
Accept: */*
Response
HTTP/1.1 404 Not Found
Content-Type: text/html
Content-Length: 345
Date: Sat, 24 Sep 2011 14:25:17 GMT
Server: sw-cp-server
/plesk
Details
No details are available.
Request
GET /plesk HTTP/1.1
Pragma: no-cache
Referer: https://Plesk Parallels Panel Version psa v10.2.0_build1011110331.18 os_RedHat el6:8443/
Cookie: PHPSESSID=2164ae932854bc55b185e0e22ab867d3; locale=en-US
Host: Plesk Parallels Panel Version psa v10.2.0_build1011110331.18 os_RedHat el6:8443
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)
Accept: */*
Acunetix Website Audit16
Response
HTTP/1.1 404 Not Found
Content-Type: text/html
Content-Length: 345
Date: Sat, 24 Sep 2011 14:25:26 GMT
Server: sw-cp-server
/skins
Details
No details are available.
Request
GET /skins/ HTTP/1.1
Pragma: no-cache
Referer: https://Plesk Parallels Panel Version psa v10.2.0_build1011110331.18 os_RedHat el6:8443/skins/
Cookie: PHPSESSID=2164ae932854bc55b185e0e22ab867d3; locale=en-US
Host: Plesk Parallels Panel Version psa v10.2.0_build1011110331.18 os_RedHat el6:8443
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)
Accept: */*
Response
HTTP/1.1 404 Not Found
Expires: Mon, 24 Oct 2011 14:25:17 GMT
Cache-Control: max-age=2592000
Content-Type: text/html
Content-Length: 345
Date: Sat, 24 Sep 2011 14:25:17 GMT
Server: sw-cp-server
/skins/default
Details
No details are available.
Request
GET /skins/default/ HTTP/1.1
Pragma: no-cache
Referer: https://Plesk Parallels Panel Version psa v10.2.0_build1011110331.18 os_RedHat el6:8443/skins/default/
Cookie: PHPSESSID=2164ae932854bc55b185e0e22ab867d3; locale=en-US
Host: Plesk Parallels Panel Version psa v10.2.0_build1011110331.18 os_RedHat el6:8443
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)
Accept: */*
Response
HTTP/1.1 404 Not Found
Expires: Mon, 24 Oct 2011 14:25:17 GMT
Cache-Control: max-age=2592000
Content-Type: text/html
Content-Length: 345
Date: Sat, 24 Sep 2011 14:25:17 GMT
Server: sw-cp-server
/skins/default/css
Details
No details are available.
Request
GET /skins/default/css/ HTTP/1.1
Pragma: no-cache
Referer: https://Plesk Parallels Panel Version psa v10.2.0_build1011110331.18 os_RedHat el6:8443/skins/default/css/
Cookie: PHPSESSID=2164ae932854bc55b185e0e22ab867d3; locale=en-US
Host: Plesk Parallels Panel Version psa v10.2.0_build1011110331.18 os_RedHat el6:8443
Connection: Keep-alive
Acunetix Website Audit17
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)
Response
HTTP/1.1 404 Not Found
Expires: Mon, 24 Oct 2011 14:25:17 GMT
Cache-Control: max-age=2592000
Content-Type: text/html
Content-Length: 345
Date: Sat, 24 Sep 2011 14:25:17 GMT
Server: sw-cp-server
/skins/default/css/admin
Details
No details are available.
Request
GET /skins/default/css/admin/ HTTP/1.1
Pragma: no-cache
Referer: https://Plesk Parallels Panel Version psa v10.2.0_build1011110331.18 os_RedHat el6:8443/skins/default/css/admin/
Cookie: PHPSESSID=2164ae932854bc55b185e0e22ab867d3; locale=en-US
Host: Plesk Parallels Panel Version psa v10.2.0_build1011110331.18 os_RedHat el6:8443
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)
Accept: */*
Response
HTTP/1.1 404 Not Found
Expires: Mon, 24 Oct 2011 14:25:34 GMT
Cache-Control: max-age=2592000
Content-Type: text/html
Content-Length: 345
Date: Sat, 24 Sep 2011 14:25:34 GMT
Server: sw-cp-server
/skins/default/css/common
Details
No details are available.
Request
GET /skins/default/css/common/ HTTP/1.1
Pragma: no-cache
Referer: https://Plesk Parallels Panel Version psa v10.2.0_build1011110331.18 os_RedHat el6:8443/skins/default/css/common/
Cookie: PHPSESSID=2164ae932854bc55b185e0e22ab867d3; locale=en-US
Host: Plesk Parallels Panel Version psa v10.2.0_build1011110331.18 os_RedHat el6:8443
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)
Accept: */*
Response
HTTP/1.1 404 Not Found
Expires: Mon, 24 Oct 2011 14:25:17 GMT
Cache-Control: max-age=2592000
Content-Type: text/html
Content-Length: 345
Date: Sat, 24 Sep 2011 14:25:17 GMT
Server: sw-cp-server
/skins/default/css/customer
Details
No details are available.
Request
GET /skins/default/css/customer/ HTTP/1.1
Acunetix Website Audit18
Pragma: no-cache
Referer: https://Plesk Parallels Panel Version psa v10.2.0_build1011110331.18 os_RedHat el6:8443/skins/default/css/customer/
Cookie: PHPSESSID=2164ae932854bc55b185e0e22ab867d3; locale=en-US
Host: Plesk Parallels Panel Version psa v10.2.0_build1011110331.18 os_RedHat el6:8443
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)
Response
HTTP/1.1 404 Not Found
Expires: Mon, 24 Oct 2011 14:25:17 GMT
Cache-Control: max-age=2592000
Content-Type: text/html
Content-Length: 345
Date: Sat, 24 Sep 2011 14:25:17 GMT
Server: sw-cp-server
/skins/default/plesk
Details
No details are available.
Request
GET /skins/default/plesk/ HTTP/1.1
Pragma: no-cache
Referer: https://Plesk Parallels Panel Version psa v10.2.0_build1011110331.18 os_RedHat el6:8443/skins/default/plesk/
Cookie: PHPSESSID=2164ae932854bc55b185e0e22ab867d3; locale=en-US
Host: Plesk Parallels Panel Version psa v10.2.0_build1011110331.18 os_RedHat el6:8443
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)
Accept: */*
Response
HTTP/1.1 404 Not Found
Expires: Mon, 24 Oct 2011 14:25:17 GMT
Cache-Control: max-age=2592000
Content-Type: text/html
Content-Length: 345
Date: Sat, 24 Sep 2011 14:25:17 GMT
Server: sw-cp-server
/skins/default/plesk/css
Details
No details are available.
Request
GET /skins/default/plesk/css/ HTTP/1.1
Pragma: no-cache
Referer: https://Plesk Parallels Panel Version psa v10.2.0_build1011110331.18 os_RedHat el6:8443/skins/default/plesk/css/
Cookie: PHPSESSID=2164ae932854bc55b185e0e22ab867d3; locale=en-US
Host: Plesk Parallels Panel Version psa v10.2.0_build1011110331.18 os_RedHat el6:8443
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)
Accept: */*
Response
HTTP/1.1 404 Not Found
Expires: Mon, 24 Oct 2011 14:25:34 GMT
Cache-Control: max-age=2592000
Content-Type: text/html
Content-Length: 345
Date: Sat, 24 Sep 2011 14:25:34 GMT
Server: sw-cp-server
Acunetix Website Audit19
/skins/default/plesk/css/left
Details
No details are available.
Request
GET /skins/default/plesk/css/left/ HTTP/1.1
Pragma: no-cache
Referer: https://Plesk Parallels Panel Version psa v10.2.0_build1011110331.18 os_RedHat el6:8443/skins/default/plesk/css/left/
Cookie: PHPSESSID=2164ae932854bc55b185e0e22ab867d3; locale=en-US
Host: Plesk Parallels Panel Version psa v10.2.0_build1011110331.18 os_RedHat el6:8443
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)
Accept: */*
Response
HTTP/1.1 404 Not Found
Expires: Mon, 24 Oct 2011 14:25:34 GMT
Cache-Control: max-age=2592000
Content-Type: text/html
Content-Length: 345
Date: Sat, 24 Sep 2011 14:25:34 GMT
Server: sw-cp-server
/skins/default/plesk/css/main
Details
No details are available.
Request
GET /skins/default/plesk/css/main/ HTTP/1.1
Pragma: no-cache
Referer: https://Plesk Parallels Panel Version psa v10.2.0_build1011110331.18 os_RedHat el6:8443/skins/default/plesk/css/main/
Cookie: PHPSESSID=2164ae932854bc55b185e0e22ab867d3; locale=en-US
Host: Plesk Parallels Panel Version psa v10.2.0_build1011110331.18 os_RedHat el6:8443
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)
Accept: */*
Response
HTTP/1.1 404 Not Found
Expires: Mon, 24 Oct 2011 14:25:34 GMT
Cache-Control: max-age=2592000
Content-Type: text/html
Content-Length: 345
Date: Sat, 24 Sep 2011 14:25:34 GMT
Server: sw-cp-server
/skins/default/plesk/css/top
Details
No details are available.
Request
GET /skins/default/plesk/css/top/ HTTP/1.1
Pragma: no-cache
Referer: https://Plesk Parallels Panel Version psa v10.2.0_build1011110331.18 os_RedHat el6:8443/skins/default/plesk/css/top/
Cookie: PHPSESSID=2164ae932854bc55b185e0e22ab867d3; locale=en-US
Host: Plesk Parallels Panel Version psa v10.2.0_build1011110331.18 os_RedHat el6:8443
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)
Accept: */*
Response
HTTP/1.1 404 Not Found
Expires: Mon, 24 Oct 2011 14:25:34 GMT
Acunetix Website Audit20
Cache-Control: max-age=2592000
Content-Type: text/html
Content-Length: 345
Date: Sat, 24 Sep 2011 14:25:34 GMT
GHDB: Plesk login page
 
SeverityInformational
TypeInformational
Reported by moduleGHDB
Description

The description for this alert is contributed by the GHDB community, it may contain inappropriate language.

Category : Advisories and Vulnerabilities

Plesk is a multi platform control panel solution for hosting. More information: hxxp://www.swsoft.com/plesk/ Vulnerability: PLESK 7.5 Reload (and lower) & PLESK 7.6 for M$ Windows path passing and disclosure] Discovered By: GuanYu

The Google Hacking Database (GHDB) appears courtesy of the Google Hacking community.
Impact
Not available. Check description.
Recommendation
Not available. Check description.
Affected items
/login.php3
Details
We found
inurl:+:8443/login.php3
Request
GET /login.php3 HTTP/1.1
Pragma: no-cache
Referer: https://Plesk Parallels Panel Version psa v10.2.0_build1011110331.18 os_RedHat el6:8443/
Cookie: PHPSESSID=2164ae932854bc55b185e0e22ab867d3; locale=en-US
Host: Plesk Parallels Panel Version psa v10.2.0_build1011110331.18 os_RedHat el6:8443
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)
Accept: */*
Response
HTTP/1.1 303 See Other
Last-Modified: Sat, 24 Sep 2011 14:25:11 GMT
Cache-Control: post-check=0, pre-check=0
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
P3P: CP="NON COR CURa ADMa OUR NOR UNI COM NAV STA"
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Pragma: no-cache
Content-Type: text/html; charset=utf-8
Location: https://Plesk Parallels Panel Version psa v10.2.0_build1011110331.18 os_RedHat el6:8443/login.php3
Content-Length: 0
Date: Sat, 24 Sep 2011 14:25:11 GMT
Server: sw-cp-server
Acunetix Website Audit21