Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-03-28 10:25 PDT
Nmap scan report for 192.168.230.2
Host is up (0.0012s latency).
Not shown: 995 closed tcp ports (reset)
PORT     STATE SERVICE    VERSION
22/tcp   open  ssh        OpenSSH 9.9 (protocol 2.0)
| ssh-hostkey: 
|   256 19:eb:fd:8b:1b:b4:3a:fc:08:1e:2c:3d:81:5c:c5:5c (ECDSA)
|_  256 32:74:1a:50:1a:1f:b9:17:24:5c:26:c6:38:a4:45:28 (ED25519)
53/tcp   open  domain     dnsmasq 2.90
| dns-nsid: 
|_  bind.version: dnsmasq-2.90
443/tcp  open  ssl/http   mini_httpd 1.30 26Oct2018
|_ssl-date: TLS randomness does not represent time
|_http-title: Site doesn't have a title (text/html; charset=UTF-8).
|_http-server-header: mini_httpd/1.30 26Oct2018
| ssl-cert: Subject: commonName=bologna
| Not valid before: 2024-10-01T03:49:11
|_Not valid after:  2034-09-29T03:49:11
3128/tcp open  http-proxy Squid http proxy 6.12
| http-open-proxy: Potentially OPEN proxy.
|_Methods supported: GET HEAD
|_http-server-header: squid/6.12
|_http-title: ERROR: The requested URL could not be retrieved
8080/tcp open  http       ShellInABox
|_http-title: Shell In A Box
No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ).
TCP/IP fingerprint:
OS:SCAN(V=7.94SVN%E=4%D=3/28%OT=22%CT=1%CU=39727%PV=Y%DS=3%DC=T%G=Y%TM=67E6
OS:DC90%P=x86_64-pc-linux-gnu)SEQ(SP=106%GCD=1%ISR=107%TI=Z%CI=Z%II=I%TS=A)
OS:OPS(O1=M564ST11NW7%O2=M564ST11NW7%O3=M564NNT11NW7%O4=M564ST11NW7%O5=M564
OS:ST11NW7%O6=M564ST11)WIN(W1=FB28%W2=FB28%W3=FB28%W4=FB28%W5=FB28%W6=FB28)
OS:ECN(R=Y%DF=Y%T=41%W=FD5C%O=M564NNSNW7%CC=Y%Q=)T1(R=Y%DF=Y%T=41%S=O%A=S+%
OS:F=AS%RD=0%Q=)T2(R=N)T3(R=N)T4(R=Y%DF=Y%T=41%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T
OS:5(R=Y%DF=Y%T=41%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=41%W=0%S=A%A=
OS:Z%F=R%O=%RD=0%Q=)T7(R=Y%DF=Y%T=41%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)U1(R=Y%DF
OS:=N%T=41%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N%T=41
OS:%CD=S)

Network Distance: 3 hops

TRACEROUTE (using port 80/tcp)
HOP RTT     ADDRESS
-   Hops 1-2 are the same as for 192.168.230.30
3   1.42 ms 192.168.230.2

Nmap scan report for 192.168.230.5
Host is up (0.0015s latency).
Not shown: 981 closed tcp ports (reset)
PORT     STATE SERVICE       VERSION
21/tcp   open  ftp           Microsoft ftpd
| ftp-syst: 
|_  SYST: Windows_NT
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
| 02-09-25  07:17PM                 7340 adm-pfx.zip
| 02-09-25  07:31PM                 2986 cpmichael.pfx
| 09-30-24  09:18PM       <DIR>          custerr
| 12-04-24  09:52PM       <DIR>          ftproot
| 03-09-25  02:40PM       <DIR>          history
| 10-08-24  08:08PM       <DIR>          logs
| 09-30-24  09:19PM       <DIR>          temp
| 02-06-25  11:02PM       <DIR>          web_resources
|_02-03-25  10:00PM       <DIR>          wwwroot
22/tcp   open  ssh           (protocol 2.0)
| fingerprint-strings: 
|   NULL: 
|_    SSH-2.0-OpenSSH_for_Windows_9.8 Win32-OpenSSH-GitHub
53/tcp   open  domain        Simple DNS Plus
80/tcp   open  http          Microsoft IIS httpd 10.0
|_http-server-header: Microsoft-IIS/10.0
| http-methods: 
|_  Potentially risky methods: TRACE
|_http-title: Steve's Crazy Pizza
88/tcp   open  kerberos-sec  Microsoft Windows Kerberos (server time: 2025-03-28 17:25:59Z)
135/tcp  open  msrpc         Microsoft Windows RPC
139/tcp  open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: pizza.loco, Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=CRAZY.pizza.loco
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:CRAZY.pizza.loco
| Not valid before: 2024-10-09T03:01:27
|_Not valid after:  2025-10-09T03:01:27
|_ssl-date: 2025-03-28T17:29:39+00:00; -4s from scanner time.
443/tcp  open  ssl/http      Microsoft IIS httpd 10.0
|_ssl-date: 2025-03-28T17:29:39+00:00; -5s from scanner time.
|_http-title: Steve's Crazy Pizza
| http-methods: 
|_  Potentially risky methods: TRACE
| tls-alpn: 
|   h2
|_  http/1.1
|_http-server-header: Microsoft-IIS/10.0
| ssl-cert: Subject: commonName=pizza-CRAZY-CA
| Not valid before: 2024-10-09T02:56:25
|_Not valid after:  2029-10-09T03:06:24
445/tcp  open  microsoft-ds  Windows Server 2016 Standard 14393 microsoft-ds (workgroup: PIZZA)
464/tcp  open  kpasswd5?
593/tcp  open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp  open  ssl/ldap      Microsoft Windows Active Directory LDAP (Domain: pizza.loco, Site: Default-First-Site-Name)
|_ssl-date: 2025-03-28T17:29:39+00:00; -4s from scanner time.
| ssl-cert: Subject: commonName=CRAZY.pizza.loco
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:CRAZY.pizza.loco
| Not valid before: 2024-10-09T03:01:27
|_Not valid after:  2025-10-09T03:01:27
3268/tcp open  ldap          Microsoft Windows Active Directory LDAP (Domain: pizza.loco, Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=CRAZY.pizza.loco
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:CRAZY.pizza.loco
| Not valid before: 2024-10-09T03:01:27
|_Not valid after:  2025-10-09T03:01:27
|_ssl-date: 2025-03-28T17:29:39+00:00; -5s from scanner time.
3269/tcp open  ssl/ldap      Microsoft Windows Active Directory LDAP (Domain: pizza.loco, Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=CRAZY.pizza.loco
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:CRAZY.pizza.loco
| Not valid before: 2024-10-09T03:01:27
|_Not valid after:  2025-10-09T03:01:27
|_ssl-date: 2025-03-28T17:29:39+00:00; -4s from scanner time.
3306/tcp open  mysql         MariaDB (unauthorized)
3389/tcp open  ms-wbt-server Microsoft Terminal Services
| rdp-ntlm-info: 
|   Target_Name: PIZZA
|   NetBIOS_Domain_Name: PIZZA
|   NetBIOS_Computer_Name: CRAZY
|   DNS_Domain_Name: pizza.loco
|   DNS_Computer_Name: CRAZY.pizza.loco
|   DNS_Tree_Name: pizza.loco
|   Product_Version: 10.0.14393
|_  System_Time: 2025-03-28T17:28:51+00:00
|_ssl-date: 2025-03-28T17:29:39+00:00; -5s from scanner time.
| ssl-cert: Subject: commonName=CRAZY.pizza.loco
| Not valid before: 2025-02-28T07:00:47
|_Not valid after:  2025-08-30T07:00:47
8080/tcp open  http          Apache httpd 2.4.23 ((Win32) OpenSSL/1.0.2h PHP/5.5.38)
|_http-server-header: Apache/2.4.23 (Win32) OpenSSL/1.0.2h PHP/5.5.38
|_http-open-proxy: Proxy might be redirecting requests
|_http-title: Pizza Loco Marriage Registration System :: Home Page
8443/tcp open  http          Apache httpd 2.4.23 ((Win32) OpenSSL/1.0.2h PHP/5.5.38)
|_http-server-header: Apache/2.4.23 (Win32) OpenSSL/1.0.2h PHP/5.5.38
|_http-title: Pizza Loco Marriage Registration System :: Home Page
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port22-TCP:V=7.94SVN%I=7%D=3/28%Time=67E6DBAB%P=x86_64-pc-linux-gnu%r(N
SF:ULL,36,"SSH-2\.0-OpenSSH_for_Windows_9\.8\x20Win32-OpenSSH-GitHub\r\n");
Device type: general purpose
Running: Microsoft Windows 2016
OS CPE: cpe:/o:microsoft:windows_server_2016
OS details: Microsoft Windows Server 2016 build 10586 - 14393
Network Distance: 4 hops
Service Info: Host: CRAZY; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb-os-discovery: 
|   OS: Windows Server 2016 Standard 14393 (Windows Server 2016 Standard 6.3)
|   Computer name: CRAZY
|   NetBIOS computer name: CRAZY\x00
|   Domain name: pizza.loco
|   Forest name: pizza.loco
|   FQDN: CRAZY.pizza.loco
|_  System time: 2025-03-28T10:28:52-07:00
| smb2-time: 
|   date: 2025-03-28T17:29:08
|_  start_date: 2025-03-28T03:58:09
|_clock-skew: mean: 41m55s, deviation: 2h12m49s, median: -5s
| smb-security-mode: 
|   account_used: <blank>
|   authentication_level: user
|   challenge_response: supported
|_  message_signing: required
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled and required

TRACEROUTE (using port 23/tcp)
HOP RTT     ADDRESS
-   Hops 1-3 are the same as for 192.168.230.30
4   1.88 ms 192.168.230.5

Nmap scan report for 192.168.230.30
Host is up (0.0015s latency).
Not shown: 991 closed tcp ports (reset)
PORT      STATE    SERVICE         VERSION
21/tcp    open     ftp             vsftpd 3.0.5
| ftp-syst: 
|   STAT: 
| FTP server status:
|      Connected to 192.168.220.21
|      Logged in as ftp
|      TYPE: ASCII
|      No session bandwidth limit
|      Session timeout in seconds is 300
|      Control connection is plain text
|      Data connections will be plain text
|      At session startup, client count was 2
|      vsFTPd 3.0.5 - secure, fast, stable
|_End of status
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
| dr-xr-xr-x    2 0        0               6 May 16  2022 afs
| lrwxrwxrwx    1 0        0               7 May 16  2022 bin -> usr/bin
| dr-xr-xr-x    5 0        0            4096 Nov 03 03:46 boot
| drwxr-xr-x    5 0        0             175 Jan 31 23:48 data
| drwxr-xr-x   19 0        0            3320 Mar 28 03:59 dev
| drwxr-xr-x  143 0        0            8192 Mar 28 03:59 etc
| drwxr-xr-x  248 0        0            8192 Mar 28 15:48 home
| lrwxrwxrwx    1 0        0               7 May 16  2022 lib -> usr/lib
| lrwxrwxrwx    1 0        0               9 May 16  2022 lib64 -> usr/lib64
| drwxr-xr-x    2 0        0               6 May 16  2022 media
| drwxr-xr-x    3 0        0              19 Oct 22 20:49 mnt
| drwx------    3 977      975            78 Feb 03 07:12 nonexistent
| drwxr-xr-x    2 0        0               6 May 16  2022 opt
| dr-xr-xr-x  301 0        0               0 Mar 28 03:59 proc
| dr-xr-x---   18 0        0            4096 Mar 14 00:40 root
| drwxr-xr-x   46 0        0            1360 Mar 28 17:19 run
| lrwxrwxrwx    1 0        0               8 May 16  2022 sbin -> usr/sbin
| drwxr-xr-x    2 0        0               6 May 16  2022 srv
| dr-xr-xr-x   13 0        0               0 Mar 28 03:59 sys
| drwxrwxrwt   16 0        0            4096 Mar 28 17:25 tmp [NSE: writeable]
|_Only 20 shown. Use --script-args ftp-anon.maxlist=-1 to see all.
22/tcp    open     ssh             OpenSSH 8.7 (protocol 2.0)
| ssh-hostkey: 
|   256 37:88:fb:d7:af:5d:6d:4f:b2:91:b9:70:98:cd:df:cf (ECDSA)
|_  256 a8:8c:4e:cd:de:0a:d3:df:8e:26:d9:83:dc:65:7d:7a (ED25519)
80/tcp    open     http            nginx 1.20.1
| http-git: 
|   192.168.230.30:80/.git/
|     Git repository found!
|     Repository description: Unnamed repository; edit this file 'description' to name the...
|     Remotes:
|_      git@oven.pizza.loco:CrazyPizza/PizzaShop.git
|_http-server-header: nginx/1.20.1
|_http-title: Steve's Crazy Pizza Parlor
111/tcp   open     rpcbind         2-4 (RPC #100000)
| rpcinfo: 
|   program version    port/proto  service
|   100000  2,3,4        111/tcp   rpcbind
|   100000  2,3,4        111/udp   rpcbind
|   100000  3,4          111/tcp6  rpcbind
|_  100000  3,4          111/udp6  rpcbind
3306/tcp  open     mysql           MySQL 8.0.36
| mysql-info: 
|   Protocol: 10
|   Version: 8.0.36
|   Thread ID: 2736
|   Capabilities flags: 65535
|   Some Capabilities: Support41Auth, LongPassword, Speaks41ProtocolOld, ConnectWithDatabase, InteractiveClient, SupportsTransactions, SupportsLoadDataLocal, DontAllowDatabaseTableColumn, IgnoreSigpipes, IgnoreSpaceBeforeParenthesis, FoundRows, SupportsCompression, LongColumnFlag, SwitchToSSLAfterHandshake, Speaks41ProtocolNew, ODBCClient, SupportsAuthPlugins, SupportsMultipleStatments, SupportsMultipleResults
|   Status: Autocommit
|   Salt: \x1D;\x0F\x7FX24H|ytpVwBU\x0CO\x1D/
|_  Auth Plugin Name: caching_sha2_password
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: commonName=MySQL_Server_8.0.36_Auto_Generated_Server_Certificate
| Not valid before: 2024-11-03T05:03:03
|_Not valid after:  2034-11-01T05:03:03
9000/tcp  open     cslistener?
9009/tcp  open     rtsp
|_rtsp-methods: ERROR: Script execution failed (use -d to debug)
| fingerprint-strings: 
|   FourOhFourRequest: 
|     HTTP/1.0 404 Not Found
|     Date: Fri, 28 Mar 2025 17:26:09 GMT
|     Connection: Close
|     There is no handle /nice%20ports%2C/Tri%6Eity.txt%2ebak
|     /ping for health checks.
|     /replicas_status for more sophisticated health checks.
|     Send queries from your program with POST method or GET /?query=...
|     clickhouse-client:
|     interactive data analysis:
|     clickhouse-client
|     batch query processing:
|     clickhouse-client --query='SELECT 1' > result
|     clickhouse-client < query > result
|   GetRequest: 
|     HTTP/1.0 200 OK
|     Date: Fri, 28 Mar 2025 17:26:09 GMT
|     Connection: Close
|     Content-Type: text/html; charset=UTF-8
|     X-ClickHouse-Summary: {"elapsed_ns":"1041892"}
|   HTTPOptions: 
|     HTTP/1.0 500 Internal Server Error
|     Date: Fri, 28 Mar 2025 17:26:09 GMT
|     Connection: Close
|     X-ClickHouse-Exception-Code: 1000
|     X-ClickHouse-Summary: {"elapsed_ns":"1575968"}
|     Poco::Exception. Code: 1000, e.code() = 0, Not found: endpoint (version 25.1.2.3 (official build))
|   RTSPRequest: 
|     RTSP/1.0 500 Internal Server Error
|     Date: Fri, 28 Mar 2025 17:26:09 GMT
|     Connection: Close
|     X-ClickHouse-Exception-Code: 1000
|     X-ClickHouse-Summary: {"elapsed_ns":"226545"}
|     Poco::Exception. Code: 1000, e.code() = 0, Not found: endpoint (version 25.1.2.3 (official build))
|   SIPOptions: 
|     SIP/2.0 500 Internal Server Error
|     Date: Fri, 28 Mar 2025 17:26:09 GMT
|     Connection: Close
|     X-ClickHouse-Exception-Code: 1000
|     X-ClickHouse-Summary: {"elapsed_ns":"189963"}
|_    Poco::Exception. Code: 1000, e.code() = 0, Not found: endpoint (version 25.1.2.3 (official build))
9090/tcp  open     ssl/zeus-admin?
|_ssl-date: TLS randomness does not represent time
| fingerprint-strings: 
|   GetRequest, HTTPOptions: 
|     HTTP/1.1 400 Bad request
|     Content-Type: text/html; charset=utf8
|     Transfer-Encoding: chunked
|     X-DNS-Prefetch-Control: off
|     Referrer-Policy: no-referrer
|     X-Content-Type-Options: nosniff
|     Cross-Origin-Resource-Policy: same-origin
|     X-Frame-Options: sameorigin
|     <!DOCTYPE html>
|     <html>
|     <head>
|     <title>
|     request
|     </title>
|     <meta http-equiv="Content-Type" content="text/html; charset=utf-8">
|     <meta name="viewport" content="width=device-width, initial-scale=1.0">
|     <style>
|     body {
|     margin: 0;
|     font-family: "RedHatDisplay", "Open Sans", Helvetica, Arial, sans-serif;
|     font-size: 12px;
|     line-height: 1.66666667;
|     color: #333333;
|     background-color: #f5f5f5;
|     border: 0;
|     vertical-align: middle;
|_    font-weight: 300;
| ssl-cert: Subject: commonName=milano.pizza.loco/organizationName=1bf3ac453c074b3c90f30d99b1ddd324/countryName=US
| Subject Alternative Name: DNS:milano.pizza.loco, DNS:localhost, IP Address:127.0.0.1
| Not valid before: 2025-01-28T07:34:46
|_Not valid after:  2026-02-27T07:34:46
65389/tcp filtered unknown
2 services unrecognized despite returning data. If you know the service/version, please submit the following fingerprints at https://nmap.org/cgi-bin/submit.cgi?new-service :
==============NEXT SERVICE FINGERPRINT (SUBMIT INDIVIDUALLY)==============
SF-Port9009-TCP:V=7.94SVN%I=7%D=3/28%Time=67E6DBB7%P=x86_64-pc-linux-gnu%r
SF:(GetRequest,A7,"HTTP/1\.0\x20200\x20OK\r\nDate:\x20Fri,\x2028\x20Mar\x2
SF:02025\x2017:26:09\x20GMT\r\nConnection:\x20Close\r\nContent-Type:\x20te
SF:xt/html;\x20charset=UTF-8\r\nX-ClickHouse-Summary:\x20{\"elapsed_ns\":\
SF:"1041892\"}\r\n\r\nOk\.\n")%r(HTTPOptions,114,"HTTP/1\.0\x20500\x20Inte
SF:rnal\x20Server\x20Error\r\nDate:\x20Fri,\x2028\x20Mar\x202025\x2017:26:
SF:09\x20GMT\r\nConnection:\x20Close\r\nX-ClickHouse-Exception-Code:\x2010
SF:00\r\nX-ClickHouse-Summary:\x20{\"elapsed_ns\":\"1575968\"}\r\n\r\nPoco
SF:::Exception\.\x20Code:\x201000,\x20e\.code\(\)\x20=\x200,\x20Not\x20fou
SF:nd:\x20endpoint\x20\(version\x2025\.1\.2\.3\x20\(official\x20build\)\)\
SF:n")%r(RTSPRequest,113,"RTSP/1\.0\x20500\x20Internal\x20Server\x20Error\
SF:r\nDate:\x20Fri,\x2028\x20Mar\x202025\x2017:26:09\x20GMT\r\nConnection:
SF:\x20Close\r\nX-ClickHouse-Exception-Code:\x201000\r\nX-ClickHouse-Summa
SF:ry:\x20{\"elapsed_ns\":\"226545\"}\r\n\r\nPoco::Exception\.\x20Code:\x2
SF:01000,\x20e\.code\(\)\x20=\x200,\x20Not\x20found:\x20endpoint\x20\(vers
SF:ion\x2025\.1\.2\.3\x20\(official\x20build\)\)\n")%r(FourOhFourRequest,1
SF:EF,"HTTP/1\.0\x20404\x20Not\x20Found\r\nDate:\x20Fri,\x2028\x20Mar\x202
SF:025\x2017:26:09\x20GMT\r\nConnection:\x20Close\r\n\r\nThere\x20is\x20no
SF:\x20handle\x20/nice%20ports%2C/Tri%6Eity\.txt%2ebak\n\nUse\x20/\x20or\x
SF:20/ping\x20for\x20health\x20checks\.\nOr\x20/replicas_status\x20for\x20
SF:more\x20sophisticated\x20health\x20checks\.\n\nSend\x20queries\x20from\
SF:x20your\x20program\x20with\x20POST\x20method\x20or\x20GET\x20/\?query=\
SF:.\.\.\n\nUse\x20clickhouse-client:\n\nFor\x20interactive\x20data\x20ana
SF:lysis:\n\x20\x20\x20\x20clickhouse-client\n\nFor\x20batch\x20query\x20p
SF:rocessing:\n\x20\x20\x20\x20clickhouse-client\x20--query='SELECT\x201'\
SF:x20>\x20result\n\x20\x20\x20\x20clickhouse-client\x20<\x20query\x20>\x2
SF:0result\n")%r(SIPOptions,112,"SIP/2\.0\x20500\x20Internal\x20Server\x20
SF:Error\r\nDate:\x20Fri,\x2028\x20Mar\x202025\x2017:26:09\x20GMT\r\nConne
SF:ction:\x20Close\r\nX-ClickHouse-Exception-Code:\x201000\r\nX-ClickHouse
SF:-Summary:\x20{\"elapsed_ns\":\"189963\"}\r\n\r\nPoco::Exception\.\x20Co
SF:de:\x201000,\x20e\.code\(\)\x20=\x200,\x20Not\x20found:\x20endpoint\x20
SF:\(version\x2025\.1\.2\.3\x20\(official\x20build\)\)\n");
==============NEXT SERVICE FINGERPRINT (SUBMIT INDIVIDUALLY)==============
SF-Port9090-TCP:V=7.94SVN%T=SSL%I=7%D=3/28%Time=67E6DBE5%P=x86_64-pc-linux
SF:-gnu%r(GetRequest,DB1,"HTTP/1\.1\x20400\x20Bad\x20request\r\nContent-Ty
SF:pe:\x20text/html;\x20charset=utf8\r\nTransfer-Encoding:\x20chunked\r\nX
SF:-DNS-Prefetch-Control:\x20off\r\nReferrer-Policy:\x20no-referrer\r\nX-C
SF:ontent-Type-Options:\x20nosniff\r\nCross-Origin-Resource-Policy:\x20sam
SF:e-origin\r\nX-Frame-Options:\x20sameorigin\r\n\r\n29\r\n<!DOCTYPE\x20ht
SF:ml>\n<html>\n<head>\n\x20\x20\x20\x20<title>\r\nb\r\nBad\x20request\r\n
SF:c2c\r\n</title>\n\x20\x20\x20\x20<meta\x20http-equiv=\"Content-Type\"\x
SF:20content=\"text/html;\x20charset=utf-8\">\n\x20\x20\x20\x20<meta\x20na
SF:me=\"viewport\"\x20content=\"width=device-width,\x20initial-scale=1\.0\
SF:">\n\x20\x20\x20\x20<style>\n\tbody\x20{\n\x20\x20\x20\x20\x20\x20\x20\
SF:x20\x20\x20\x20\x20margin:\x200;\n\x20\x20\x20\x20\x20\x20\x20\x20\x20\
SF:x20\x20\x20font-family:\x20\"RedHatDisplay\",\x20\"Open\x20Sans\",\x20H
SF:elvetica,\x20Arial,\x20sans-serif;\n\x20\x20\x20\x20\x20\x20\x20\x20\x2
SF:0\x20\x20\x20font-size:\x2012px;\n\x20\x20\x20\x20\x20\x20\x20\x20\x20\
SF:x20\x20\x20line-height:\x201\.66666667;\n\x20\x20\x20\x20\x20\x20\x20\x
SF:20\x20\x20\x20\x20color:\x20#333333;\n\x20\x20\x20\x20\x20\x20\x20\x20\
SF:x20\x20\x20\x20background-color:\x20#f5f5f5;\n\x20\x20\x20\x20\x20\x20\
SF:x20\x20}\n\x20\x20\x20\x20\x20\x20\x20\x20img\x20{\n\x20\x20\x20\x20\x2
SF:0\x20\x20\x20\x20\x20\x20\x20border:\x200;\n\x20\x20\x20\x20\x20\x20\x2
SF:0\x20\x20\x20\x20\x20vertical-align:\x20middle;\n\x20\x20\x20\x20\x20\x
SF:20\x20\x20}\n\x20\x20\x20\x20\x20\x20\x20\x20h1\x20{\n\x20\x20\x20\x20\
SF:x20\x20\x20\x20\x20\x20\x20\x20font-weight:\x20300;\n\x20\x20\x20\x20\x
SF:20\x20\x20\x20}\n\x20\x20\x20\x20\x20\x20\x20\x20p\x20")%r(HTTPOptions,
SF:DB1,"HTTP/1\.1\x20400\x20Bad\x20request\r\nContent-Type:\x20text/html;\
SF:x20charset=utf8\r\nTransfer-Encoding:\x20chunked\r\nX-DNS-Prefetch-Cont
SF:rol:\x20off\r\nReferrer-Policy:\x20no-referrer\r\nX-Content-Type-Option
SF:s:\x20nosniff\r\nCross-Origin-Resource-Policy:\x20same-origin\r\nX-Fram
SF:e-Options:\x20sameorigin\r\n\r\n29\r\n<!DOCTYPE\x20html>\n<html>\n<head
SF:>\n\x20\x20\x20\x20<title>\r\nb\r\nBad\x20request\r\nc2c\r\n</title>\n\
SF:x20\x20\x20\x20<meta\x20http-equiv=\"Content-Type\"\x20content=\"text/h
SF:tml;\x20charset=utf-8\">\n\x20\x20\x20\x20<meta\x20name=\"viewport\"\x2
SF:0content=\"width=device-width,\x20initial-scale=1\.0\">\n\x20\x20\x20\x
SF:20<style>\n\tbody\x20{\n\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x2
SF:0margin:\x200;\n\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20font-fa
SF:mily:\x20\"RedHatDisplay\",\x20\"Open\x20Sans\",\x20Helvetica,\x20Arial
SF:,\x20sans-serif;\n\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20font-
SF:size:\x2012px;\n\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20line-he
SF:ight:\x201\.66666667;\n\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20
SF:color:\x20#333333;\n\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20bac
SF:kground-color:\x20#f5f5f5;\n\x20\x20\x20\x20\x20\x20\x20\x20}\n\x20\x20
SF:\x20\x20\x20\x20\x20\x20img\x20{\n\x20\x20\x20\x20\x20\x20\x20\x20\x20\
SF:x20\x20\x20border:\x200;\n\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\
SF:x20vertical-align:\x20middle;\n\x20\x20\x20\x20\x20\x20\x20\x20}\n\x20\
SF:x20\x20\x20\x20\x20\x20\x20h1\x20{\n\x20\x20\x20\x20\x20\x20\x20\x20\x2
SF:0\x20\x20\x20font-weight:\x20300;\n\x20\x20\x20\x20\x20\x20\x20\x20}\n\
SF:x20\x20\x20\x20\x20\x20\x20\x20p\x20");
No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ).
TCP/IP fingerprint:
OS:SCAN(V=7.94SVN%E=4%D=3/28%OT=21%CT=1%CU=34257%PV=Y%DS=4%DC=T%G=Y%TM=67E6
OS:DC90%P=x86_64-pc-linux-gnu)SEQ(SP=107%GCD=1%ISR=10E%TI=Z%CI=Z%TS=A)SEQ(S
OS:P=107%GCD=1%ISR=10E%TI=Z%CI=Z%II=I%TS=A)SEQ(SP=107%GCD=2%ISR=10E%TI=Z%CI
OS:=Z%II=I%TS=A)OPS(O1=M564ST11NW7%O2=M564ST11NW7%O3=M564NNT11NW7%O4=M564ST
OS:11NW7%O5=M564ST11NW7%O6=M564ST11)WIN(W1=8040%W2=8040%W3=8040%W4=8040%W5=
OS:8040%W6=8040)ECN(R=Y%DF=Y%T=41%W=8160%O=M564NNSNW7%CC=Y%Q=)T1(R=Y%DF=Y%T
OS:=41%S=O%A=S+%F=AS%RD=0%Q=)T2(R=N)T3(R=N)T4(R=Y%DF=Y%T=41%W=0%S=A%A=Z%F=R
OS:%O=%RD=0%Q=)T5(R=Y%DF=Y%T=41%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=
OS:41%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T7(R=N)U1(R=Y%DF=N%T=41%IPL=164%UN=0%RIPL=
OS:G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N%T=41%CD=S)

Network Distance: 4 hops
Service Info: OS: Unix

TRACEROUTE (using port 443/tcp)
HOP RTT     ADDRESS
1   0.57 ms 192.168.220.1
2   0.43 ms 192.168.220.10
3   1.12 ms 172.16.0.2
4   1.59 ms 192.168.230.30

Nmap scan report for 192.168.230.44
Host is up (0.0016s latency).
Not shown: 989 closed tcp ports (reset)
PORT      STATE SERVICE       VERSION
22/tcp    open  ssh           OpenSSH 8.2p1 Ubuntu 4ubuntu0.11 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 c7:a8:8f:d8:58:0b:0e:e5:3b:7f:80:0b:60:ab:20:30 (RSA)
|   256 7e:06:8c:5f:c2:dd:3b:1c:52:1b:a2:19:54:2d:68:9d (ECDSA)
|_  256 60:23:9c:9c:52:fe:12:fe:a8:9d:89:3b:1c:6f:d1:79 (ED25519)
80/tcp    open  http          nginx (reverse proxy)
|_http-title: 404 Not Found
443/tcp   open  ssl/http      nginx (reverse proxy)
|_http-title: 404 Not Found
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: commonName=Kubernetes Ingress Controller Fake Certificate/organizationName=Acme Co
| Subject Alternative Name: DNS:ingress.local
| Not valid before: 2025-03-28T12:42:04
|_Not valid after:  2026-03-28T12:42:04
5000/tcp  open  http          Docker Registry (API: 2.0)
|_http-title: Site doesn't have a title.
5001/tcp  open  http          Docker Registry (API: 2.0)
|_http-title: Site doesn't have a title.
5002/tcp  open  http          Docker Registry (API: 2.0)
|_http-title: Site doesn't have a title.
5003/tcp  open  http          Docker Registry (API: 2.0)
|_http-title: Site doesn't have a title.
5004/tcp  open  http          Docker Registry (API: 2.0)
|_http-title: Site doesn't have a title.
8181/tcp  open  http          nginx (reverse proxy)
|_http-title: 404 Not Found
8443/tcp  open  ssl/https-alt
|_http-title: Site doesn't have a title.
| ssl-cert: Subject: organizationName=nil2
| Subject Alternative Name: DNS:ingress-nginx-controller-admission, DNS:ingress-nginx-controller-admission.ingress-nginx.svc
| Not valid before: 2024-11-27T05:48:52
|_Not valid after:  2124-11-03T05:48:52
| fingerprint-strings: 
|   FourOhFourRequest, GetRequest, HTTPOptions: 
|     HTTP/1.0 400 Bad Request
|     Date: Fri, 28 Mar 2025 17:26:16 GMT
|     Content-Length: 0
|   GenericLines, Help, Kerberos, LDAPSearchReq, LPDString, RTSPRequest, SIPOptions, SSLSessionReq, TLSSessionReq, TerminalServerCookie: 
|     HTTP/1.1 400 Bad Request
|     Content-Type: text/plain; charset=utf-8
|     Connection: close
|_    Request
30000/tcp open  ssh           (protocol 2.0)
| fingerprint-strings: 
|   NULL: 
|_    SSH-2.0-Go
| ssh-hostkey: 
|_  4096 38:fb:d0:08:68:7f:36:c0:05:9a:1d:40:30:bc:46:26 (RSA)
2 services unrecognized despite returning data. If you know the service/version, please submit the following fingerprints at https://nmap.org/cgi-bin/submit.cgi?new-service :
==============NEXT SERVICE FINGERPRINT (SUBMIT INDIVIDUALLY)==============
SF-Port8443-TCP:V=7.94SVN%T=SSL%I=7%D=3/28%Time=67E6DBB8%P=x86_64-pc-linux
SF:-gnu%r(GetRequest,54,"HTTP/1\.0\x20400\x20Bad\x20Request\r\nDate:\x20Fr
SF:i,\x2028\x20Mar\x202025\x2017:26:16\x20GMT\r\nContent-Length:\x200\r\n\
SF:r\n")%r(HTTPOptions,54,"HTTP/1\.0\x20400\x20Bad\x20Request\r\nDate:\x20
SF:Fri,\x2028\x20Mar\x202025\x2017:26:16\x20GMT\r\nContent-Length:\x200\r\
SF:n\r\n")%r(FourOhFourRequest,54,"HTTP/1\.0\x20400\x20Bad\x20Request\r\nD
SF:ate:\x20Fri,\x2028\x20Mar\x202025\x2017:26:16\x20GMT\r\nContent-Length:
SF:\x200\r\n\r\n")%r(GenericLines,67,"HTTP/1\.1\x20400\x20Bad\x20Request\r
SF:\nContent-Type:\x20text/plain;\x20charset=utf-8\r\nConnection:\x20close
SF:\r\n\r\n400\x20Bad\x20Request")%r(RTSPRequest,67,"HTTP/1\.1\x20400\x20B
SF:ad\x20Request\r\nContent-Type:\x20text/plain;\x20charset=utf-8\r\nConne
SF:ction:\x20close\r\n\r\n400\x20Bad\x20Request")%r(Help,67,"HTTP/1\.1\x20
SF:400\x20Bad\x20Request\r\nContent-Type:\x20text/plain;\x20charset=utf-8\
SF:r\nConnection:\x20close\r\n\r\n400\x20Bad\x20Request")%r(SSLSessionReq,
SF:67,"HTTP/1\.1\x20400\x20Bad\x20Request\r\nContent-Type:\x20text/plain;\
SF:x20charset=utf-8\r\nConnection:\x20close\r\n\r\n400\x20Bad\x20Request")
SF:%r(TerminalServerCookie,67,"HTTP/1\.1\x20400\x20Bad\x20Request\r\nConte
SF:nt-Type:\x20text/plain;\x20charset=utf-8\r\nConnection:\x20close\r\n\r\
SF:n400\x20Bad\x20Request")%r(TLSSessionReq,67,"HTTP/1\.1\x20400\x20Bad\x2
SF:0Request\r\nContent-Type:\x20text/plain;\x20charset=utf-8\r\nConnection
SF::\x20close\r\n\r\n400\x20Bad\x20Request")%r(Kerberos,67,"HTTP/1\.1\x204
SF:00\x20Bad\x20Request\r\nContent-Type:\x20text/plain;\x20charset=utf-8\r
SF:\nConnection:\x20close\r\n\r\n400\x20Bad\x20Request")%r(LPDString,67,"H
SF:TTP/1\.1\x20400\x20Bad\x20Request\r\nContent-Type:\x20text/plain;\x20ch
SF:arset=utf-8\r\nConnection:\x20close\r\n\r\n400\x20Bad\x20Request")%r(LD
SF:APSearchReq,67,"HTTP/1\.1\x20400\x20Bad\x20Request\r\nContent-Type:\x20
SF:text/plain;\x20charset=utf-8\r\nConnection:\x20close\r\n\r\n400\x20Bad\
SF:x20Request")%r(SIPOptions,67,"HTTP/1\.1\x20400\x20Bad\x20Request\r\nCon
SF:tent-Type:\x20text/plain;\x20charset=utf-8\r\nConnection:\x20close\r\n\
SF:r\n400\x20Bad\x20Request");
==============NEXT SERVICE FINGERPRINT (SUBMIT INDIVIDUALLY)==============
SF-Port30000-TCP:V=7.94SVN%I=7%D=3/28%Time=67E6DBB2%P=x86_64-pc-linux-gnu%
SF:r(NULL,C,"SSH-2\.0-Go\r\n");
No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ).
TCP/IP fingerprint:
OS:SCAN(V=7.94SVN%E=4%D=3/28%OT=22%CT=1%CU=44249%PV=Y%DS=4%DC=T%G=Y%TM=67E6
OS:DC90%P=x86_64-pc-linux-gnu)SEQ(SP=100%GCD=1%ISR=10E%TI=Z%CI=Z%II=I%TS=A)
OS:SEQ(SP=100%GCD=2%ISR=10E%TI=Z%CI=Z%II=I%TS=A)OPS(O1=M564ST11NW7%O2=M564S
OS:T11NW7%O3=M564NNT11NW7%O4=M564ST11NW7%O5=M564ST11NW7%O6=M564ST11)WIN(W1=
OS:FB28%W2=FB28%W3=FB28%W4=FB28%W5=FB28%W6=FB28)ECN(R=Y%DF=Y%T=41%W=FD5C%O=
OS:M564NNSNW7%CC=Y%Q=)T1(R=Y%DF=Y%T=41%S=O%A=S+%F=AS%RD=0%Q=)T2(R=N)T3(R=N)
OS:T4(R=Y%DF=Y%T=41%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T5(R=Y%DF=Y%T=41%W=0%S=Z%A=S
OS:+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=41%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T7(R=Y%DF=
OS:Y%T=41%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)U1(R=Y%DF=N%T=41%IPL=164%UN=0%RIPL=G
OS:%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N%T=41%CD=S)

Network Distance: 4 hops
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE (using port 3389/tcp)
HOP RTT     ADDRESS
-   Hops 1-3 are the same as for 192.168.230.30
4   1.65 ms 192.168.230.44

Nmap scan report for 192.168.230.70
Host is up (0.0014s latency).
Not shown: 995 closed tcp ports (reset)
PORT    STATE SERVICE     VERSION
22/tcp  open  ssh         OpenSSH 9.9 (protocol 2.0)
| ssh-hostkey: 
|   256 07:f2:29:2a:90:5a:ab:ff:6b:ed:b2:2b:ca:87:ba:f0 (ECDSA)
|_  256 b7:69:f9:19:f9:42:ad:58:1f:6c:56:73:e7:f6:7e:2b (ED25519)
80/tcp  open  http        Node.js (Express middleware)
|_http-title: Pizza.CCTV
139/tcp open  netbios-ssn Samba smbd 4.6.2
445/tcp open  netbios-ssn Samba smbd 4.6.2
995/tcp open  pop3s?
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port995-TCP:V=7.94SVN%I=7%D=3/28%Time=67E6DBB2%P=x86_64-pc-linux-gnu%r(
SF:NULL,C55E,"P\xcc\xb4\xcc\xbf\xcd\x80\xcc\x9a\xcd\x90\xcd\x9d\xcd\x8a\xc
SF:c\x95\xcd\x91\xcc\xbf\xcd\x90\xcc\x9a\xcc\x8d\xcc\x8d\xcc\x8a\xcc\x9b\x
SF:cc\xa6\xcc\x9c\xcc\x99\xcd\x99\xcc\xa4\xcc\x9e\xcc\xa0\xcc\x9e\xcc\xa2\
SF:xcc\x9f\xcc\xa6\xcc\x96\xcd\x8eL\xcc\xb4\xcd\x9b\xcc\x82\xcc\x94\xcd\x8
SF:6\xcc\x8e\xcc\x83\xcc\x92\xcc\x8b\xcd\x92\xcd\x91\xcd\x8c\xcc\x8a\xcd\x
SF:84\xcc\x93\xcd\x84\xcc\xb3\xcc\x9d\xcc\xaa\xcd\x8d\xcc\xa2\xcd\x85\xcc\
SF:x98\xcc\xa7\xcd\x8d\xcc\xb2\xcd\x87\xcd\x99\xcc\xb3E\xcc\xb7\xcd\x84\xc
SF:c\x8c\xcc\x8a\xcc\x81\xcc\xbf\xcc\x8f\xcd\x84\xcd\x97\xcc\x9a\xcc\x90\x
SF:cd\x9d\xcd\x9d\xcd\x8b\xcc\x8e\xcd\x9d\xcc\x88\xcc\xa0\xcd\x9c\xcc\xba\
SF:xcc\x97\xcd\x95\xcd\x89\xcc\xac\xcc\x96\xcc\xba\xcc\x9e\xcc\xa4\xcd\x88
SF:\xcc\xad\xcd\x8d\xcd\x88\xcc\xbcA\xcc\xb4\xcc\xbf\xcc\x93\xcc\x84\xcc\x
SF:84\xcc\x8f\xcd\xa0\xcc\xaf\xcd\x96\xcd\x99\xcc\x9e\xcc\xa2\xcc\x97\xcc\
SF:x97\xcd\x8d\xcc\xa9\xcc\x9f\xcd\x9c\xcd\x94\xcd\x94\xcc\xacS\xcc\xb8\xc
SF:c\x87\xcd\x83\xcc\x88\xcd\xa0\xcd\x81\xcc\x8b\xcd\x8c\xcd\x8a\xcc\x9a\x
SF:cc\x8f\xcd\x90\xcd\x81\xcc\xbb\xcc\x98\xcd\x87\xcd\x87\xcc\xb2\xcc\xaaE
SF:\xcc\xb6\xcc\xbe\xcc\xbb\xcc\xbb\xcc\xa2\xcc\xa3\xcc\xa4\xcc\xa1\xcd\x8
SF:5\xcc\x98\xcc\xb2\xcd\x99\x20\xcc\xb6\xcc\x92\xcd\x9d\xcc\xadL\xcc\xb6\
SF:xcc\x93\xcc\x88\xcc\x8f\xcd\x8b\xcc\x85\xcc\xab\xcc\x9f\xcc\x99\xcc\x99
SF:\xcc\xa5\xcd\x88\xcc\x9f\xcd\x93\xcc\xbc\xcc\xa3E\xcc\xb5\xcd\x8c\xcc\x
SF:95\xcd\x80\xcd\x80\xcc\x82\xcd\x8a\xcc\x85\xcd\x8b\xcc\x8f\xcc\x9a\xcc\
SF:x99\xcc\xb2\xcd\x85\xcc\x9fT\xcc\xb7\xcc\x81\xcd\x8c\xcd\x92\xcd\xa0\xc
SF:d\x86\xcc\x91\xcc\x81\xcc\x9d\xcc\xb3\xcc\x9f\xcd\x89\xcc\x9e\xcd\x99\x
SF:cd\x85\xcc\x9d\xcc\xba\xcd\x9c\xcc\xa8\xcc\xb2\xcc\x98\x20\xcc\xb8\xcc\
SF:x8f\xcc\x80\xcc\x8d\xcc\x8f\xcc\x81\xcc\x92\xcd\x8b\xcc\x9a\xcc\x8e\xcc
SF:\x83\xcd\x9d\xcd\x81\xcc\x80\xcd\x97\xcc\xae\xcc\x9f\xcd\x88\xcc\xa3\xc
SF:c\xac\xcc\xac\xcd\x9a\xcd\x85\xcc\xa1\xcc\x9f\xcc\x9f\xcc\xad\xcc\xbb\x
SF:cc\xacM\xcc\xb8\xcc\x91\xcd\x8a\xcc\x81\xcd\x84\xcd\x96\xcc\x9c\xcc\x9f
SF:E\xcc\xb8\xcd\x84\xcd\x83\xcc\x89\xcd\x84\xcd\x8b\xcd\x84\xcc\x80\xcd\x
SF:86\xcd\x81\xcd\x80\xcc\x93\xcc\xbd\xcd\x93\xcd\x99\xcc\xa2\xcc\xa8\xcd\
SF:x85\xcc\xb3\x20\xcc\xb6\xcd\x9d\xcd\x9d\xcd\x80\xcc\x95\xcc\x85\xcd\x90
SF:\xcd\x91\xcd\x92\xcc\x95\xcd\x83\xcc\x8c\xcd\x90\xcd\x98\xcc\x86\xcd\x8
SF:4\xcc\x95\xcd\xa0\xcc\x9d\xcc\xaf\xcc\xad\xcc\xa8\xcc\x9f\xcc\xb9\xcc\x
SF:b3\xcc\x9e\xcc\xb1E\xcc\xb6\xcd\x97\xcd\x98\xcd\x92\xcc\x8a\xcc\x93\xcc
SF:\x85\xcd\x98\xcd\x98\xcc\xa0S\xcc\xb4\xcd\x8c\xcc\x93\xcc\x9d\xcd\x96\x
SF:cd\x93\xcc\xa1\xcc\xa8\xcc\xab\xcd\x87\xcd\x9c\xcc\xb9\xcd\x96\xcc\xbc\
SF:xcd\x87\xcc\xa9\xcc\xba\xcd\x87C\xcc\xb5\xcc\x95\xcd\x92\xcc\x8f\xcd\x9
SF:8\xcc\x8f\xcd\x8a\xcd\x90\xcc\x94\xcc\x88\xcc\xbf\xcd\x80\xcd\x9b\xcd\x
SF:84\xcc\xbe\xcd\x8c\xcc\xba\xcd\x94\xcc\xa7\xcc\x9e\xcc\x99\xcc\xaf\xcc\
SF:xb0\xcc\xb2\xcc\xbb\xcc\xad\xcc\xa1\xcc\x9cA\xcc\xb5\xcc\x80\xcd\x84\xc
SF:c\x85\xcc\x90\xcc\xa6\xcd\x89\xcd\x99\xcc\xaf\xcc\x9dP\xcc\xb6\xcc\x80\
SF:xcc\x8a\xcc\x8f\xcc\x87\xcc\x80\xcc\x94\xcc\x8b\xcd\x8b\xcc\x89\xcc\xbd
SF:\xcc\x95\xcd\xa0\xcc\x95\xcd\x8b\xcd\x87\xcc\x9e\xcc\xa0\xcd\x88\xcc\x9
SF:f\xcc\xa3\xcd\x8e\xcc\xa4\xcc\xa5E\xcc\xb6\xcc\x88\xcd\x9b\xcc\x95\xcc\
SF:x8d\xcd\x98\xcc\x9c\xcc\xad\xcc\x99\xcc\xb0\xcc\xac\xcc\xbc\xcc\xba\xcd
SF:\x9c\xcc\xb0\xcd\x8e\xcc\xb3P\xcc\xb4\xcc\xbf\xcd\x80\xcc\x9a\xcd\x90\x
SF:cd\x9d\xcd\x8a\xcc\x95\xcd\x91\xcc\xbf\xcd\x90\xcc\x9a\xcc\x8d\xcc\x8d\
SF:xcc\x8a\xcc\x9b\xcc\xa6\xcc\x9c\xcc\x99\xcd\x99\xcc\xa4\xcc\x9e\xcc\xa0
SF:\xcc\x9e\xcc\xa2\xcc\x9f\xcc\xa6\xcc\x96\xcd\x8eL\xcc\xb4\xcd\x9b\xcc\x
SF:82\xcc\x94\xcd\x86\xcc\x8e\xcc\x83\xcc\x92\xcc\x8b\xcd\x92\xcd\x91\xcd\
SF:x8c\xcc\x8a\xcd\x84\xcc\x93\xcd\x84\xcc\xb3\xcc\x9d\xcc\xaa\xcd\x8d\xcc
SF:\xa2");
No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ).
TCP/IP fingerprint:
OS:SCAN(V=7.94SVN%E=4%D=3/28%OT=22%CT=1%CU=42155%PV=Y%DS=4%DC=T%G=Y%TM=67E6
OS:DC90%P=x86_64-pc-linux-gnu)SEQ(SP=107%GCD=1%ISR=10A%TI=Z%CI=Z%TS=A)SEQ(S
OS:P=107%GCD=1%ISR=10A%TI=Z%CI=Z%II=I%TS=A)OPS(O1=M564ST11NW7%O2=M564ST11NW
OS:7%O3=M564NNT11NW7%O4=M564ST11NW7%O5=M564ST11NW7%O6=M564ST11)WIN(W1=FB28%
OS:W2=FB28%W3=FB28%W4=FB28%W5=FB28%W6=FB28)ECN(R=Y%DF=Y%T=41%W=FD5C%O=M564N
OS:NSNW7%CC=Y%Q=)T1(R=Y%DF=Y%T=41%S=O%A=S+%F=AS%RD=0%Q=)T2(R=N)T3(R=N)T4(R=
OS:Y%DF=Y%T=41%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T5(R=Y%DF=Y%T=41%W=0%S=Z%A=S+%F=A
OS:R%O=%RD=0%Q=)T6(R=Y%DF=Y%T=41%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T7(R=Y%DF=Y%T=4
OS:1%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)U1(R=Y%DF=N%T=41%IPL=164%UN=0%RIPL=G%RID=
OS:G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N%T=41%CD=S)

Network Distance: 4 hops

Host script results:
|_nbstat: NetBIOS name: LAQUILA, NetBIOS user: <unknown>, NetBIOS MAC: <unknown> (unknown)
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled but not required
|_clock-skew: -1s
| smb2-time: 
|   date: 2025-03-28T17:29:15
|_  start_date: N/A

TRACEROUTE (using port 443/tcp)
HOP RTT     ADDRESS
-   Hops 1-2 are the same as for 192.168.230.30
3   ...
4   1.56 ms 192.168.230.70

Nmap scan report for 192.168.230.88
Host is up (0.0016s latency).
Not shown: 992 closed tcp ports (reset)
PORT     STATE SERVICE       VERSION
80/tcp   open  http          Werkzeug/3.1.3 Python/3.13.1
|_http-server-header: Werkzeug/3.1.3 Python/3.13.1
| fingerprint-strings: 
|   GetRequest: 
|     HTTP/1.1 200 OK
|     Server: Werkzeug/3.1.3 Python/3.13.1
|     Date: Fri, 28 Mar 2025 17:26:11 GMT
|     Content-Type: text/html; charset=utf-8
|     Content-Length: 2715
|     Connection: close
|     <!DOCTYPE html>
|     <html lang="en">
|     <head>
|     <meta charset="UTF-8">
|     <meta name="viewport" content="width=device-width, initial-scale=1.0">
|     <title>SCP Pizza POS</title>
|     <link href="https://cdn.jsdelivr.net/npm/bootstrap@5.3.0/dist/css/bootstrap.min.css" rel="stylesheet">
|     </head>
|     <body class="bg-dark text-light">
|     <div class="container mt-5">
|     class="text-center"><b>S</b>teve's <b>Crazy</b> <b>Pizza</b> P.O.S</h1>
|     <div class="row" id="menu">
|     <!-- Menu items will be loaded here -->
|     </div>
|     </div>
|     <script>
|     document.addEventListener("DOMContentLoaded", function() {
|     fetch("/menu")
|     .then(response => response.json())
|   HTTPOptions: 
|     HTTP/1.1 200 OK
|     Server: Werkzeug/3.1.3 Python/3.13.1
|     Date: Fri, 28 Mar 2025 17:26:11 GMT
|     Content-Type: text/html; charset=utf-8
|     Allow: HEAD, GET, OPTIONS
|     Content-Length: 0
|     Connection: close
|   RTSPRequest: 
|     <!DOCTYPE HTML>
|     <html lang="en">
|     <head>
|     <meta charset="utf-8">
|     <title>Error response</title>
|     </head>
|     <body>
|     <h1>Error response</h1>
|     <p>Error code: 400</p>
|     <p>Message: Bad request version ('RTSP/1.0').</p>
|     <p>Error code explanation: 400 - Bad request syntax or unsupported method.</p>
|     </body>
|_    </html>
|_http-title: SCP Pizza POS
111/tcp  open  rpcbind       2-4 (RPC #100000)
| rpcinfo: 
|   program version    port/proto  service
|   100000  2,3,4        111/tcp   rpcbind
|   100000  2,3,4        111/tcp6  rpcbind
|   100000  2,3,4        111/udp   rpcbind
|   100000  2,3,4        111/udp6  rpcbind
|   100003  2,3         2049/udp   nfs
|   100003  2,3         2049/udp6  nfs
|   100003  2,3,4       2049/tcp   nfs
|   100003  2,3,4       2049/tcp6  nfs
|   100005  1,2,3       2049/tcp   mountd
|   100005  1,2,3       2049/tcp6  mountd
|   100005  1,2,3       2049/udp   mountd
|   100005  1,2,3       2049/udp6  mountd
|   100021  1,2,3,4     2049/tcp   nlockmgr
|   100021  1,2,3,4     2049/tcp6  nlockmgr
|   100021  1,2,3,4     2049/udp   nlockmgr
|   100021  1,2,3,4     2049/udp6  nlockmgr
|   100024  1           2049/tcp   status
|   100024  1           2049/tcp6  status
|   100024  1           2049/udp   status
|_  100024  1           2049/udp6  status
135/tcp  open  msrpc         Microsoft Windows RPC
139/tcp  open  netbios-ssn   Microsoft Windows netbios-ssn
445/tcp  open  microsoft-ds  Windows Server 2019 Standard 17763 microsoft-ds
2049/tcp open  nlockmgr      1-4 (RPC #100021)
3389/tcp open  ms-wbt-server Microsoft Terminal Services
|_ssl-date: 2025-03-28T17:29:40+00:00; -4s from scanner time.
| rdp-ntlm-info: 
|   Target_Name: PIZZA
|   NetBIOS_Domain_Name: PIZZA
|   NetBIOS_Computer_Name: PRATO
|   DNS_Domain_Name: pizza.loco
|   DNS_Computer_Name: PRATO.pizza.loco
|   DNS_Tree_Name: pizza.loco
|   Product_Version: 10.0.17763
|_  System_Time: 2025-03-28T17:29:05+00:00
| ssl-cert: Subject: commonName=PRATO.pizza.loco
| Not valid before: 2025-01-30T17:02:30
|_Not valid after:  2025-08-01T17:02:30
5000/tcp open  upnp?
| fingerprint-strings: 
|   GetRequest: 
|     HTTP/1.1 200 OK
|     Server: Werkzeug/3.1.3 Python/3.13.1
|     Date: Fri, 28 Mar 2025 17:26:16 GMT
|     Content-Type: text/html; charset=utf-8
|     Content-Length: 2715
|     Connection: close
|     <!DOCTYPE html>
|     <html lang="en">
|     <head>
|     <meta charset="UTF-8">
|     <meta name="viewport" content="width=device-width, initial-scale=1.0">
|     <title>SCP Pizza POS</title>
|     <link href="https://cdn.jsdelivr.net/npm/bootstrap@5.3.0/dist/css/bootstrap.min.css" rel="stylesheet">
|     </head>
|     <body class="bg-dark text-light">
|     <div class="container mt-5">
|     class="text-center"><b>S</b>teve's <b>Crazy</b> <b>Pizza</b> P.O.S</h1>
|     <div class="row" id="menu">
|     <!-- Menu items will be loaded here -->
|     </div>
|     </div>
|     <script>
|     document.addEventListener("DOMContentLoaded", function() {
|     fetch("/menu")
|     .then(response => response.json())
|   RTSPRequest: 
|     <!DOCTYPE HTML>
|     <html lang="en">
|     <head>
|     <meta charset="utf-8">
|     <title>Error response</title>
|     </head>
|     <body>
|     <h1>Error response</h1>
|     <p>Error code: 400</p>
|     <p>Message: Bad request version ('RTSP/1.0').</p>
|     <p>Error code explanation: 400 - Bad request syntax or unsupported method.</p>
|     </body>
|_    </html>
2 services unrecognized despite returning data. If you know the service/version, please submit the following fingerprints at https://nmap.org/cgi-bin/submit.cgi?new-service :
==============NEXT SERVICE FINGERPRINT (SUBMIT INDIVIDUALLY)==============
SF-Port80-TCP:V=7.94SVN%I=7%D=3/28%Time=67E6DBB8%P=x86_64-pc-linux-gnu%r(G
SF:etRequest,B4A,"HTTP/1\.1\x20200\x20OK\r\nServer:\x20Werkzeug/3\.1\.3\x2
SF:0Python/3\.13\.1\r\nDate:\x20Fri,\x2028\x20Mar\x202025\x2017:26:11\x20G
SF:MT\r\nContent-Type:\x20text/html;\x20charset=utf-8\r\nContent-Length:\x
SF:202715\r\nConnection:\x20close\r\n\r\n<!DOCTYPE\x20html>\n<html\x20lang
SF:=\"en\">\n<head>\n\x20\x20\x20\x20<meta\x20charset=\"UTF-8\">\n\x20\x20
SF:\x20\x20<meta\x20name=\"viewport\"\x20content=\"width=device-width,\x20
SF:initial-scale=1\.0\">\n\x20\x20\x20\x20<title>SCP\x20Pizza\x20POS</titl
SF:e>\n\x20\x20\x20\x20<link\x20href=\"https://cdn\.jsdelivr\.net/npm/boot
SF:strap@5\.3\.0/dist/css/bootstrap\.min\.css\"\x20rel=\"stylesheet\">\n</
SF:head>\n<body\x20class=\"bg-dark\x20text-light\">\n\x20\x20\x20\x20<div\
SF:x20class=\"container\x20mt-5\">\n\x20\x20\x20\x20\x20\x20\x20\x20<h1\x2
SF:0class=\"text-center\"><b>S</b>teve's\x20<b>Crazy</b>\x20<b>Pizza</b>\x
SF:20P\.O\.S</h1>\n\x20\x20\x20\x20\x20\x20\x20\x20<div\x20class=\"row\"\x
SF:20id=\"menu\">\n\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20<!--\x2
SF:0Menu\x20items\x20will\x20be\x20loaded\x20here\x20-->\n\x20\x20\x20\x20
SF:\x20\x20\x20\x20</div>\n\x20\x20\x20\x20</div>\n\x20\x20\x20\x20\n\x20\
SF:x20\x20\x20<script>\n\x20\x20\x20\x20\x20\x20\x20\x20document\.addEvent
SF:Listener\(\"DOMContentLoaded\",\x20function\(\)\x20{\n\x20\x20\x20\x20\
SF:x20\x20\x20\x20\x20\x20\x20\x20fetch\(\"/menu\"\)\n\x20\x20\x20\x20\x20
SF:\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\.then\(response\x20=>\x20r
SF:esponse\.json\(\)\)\n\x20\x20\x20\x20\x20\x20\x20")%r(HTTPOptions,C7,"H
SF:TTP/1\.1\x20200\x20OK\r\nServer:\x20Werkzeug/3\.1\.3\x20Python/3\.13\.1
SF:\r\nDate:\x20Fri,\x2028\x20Mar\x202025\x2017:26:11\x20GMT\r\nContent-Ty
SF:pe:\x20text/html;\x20charset=utf-8\r\nAllow:\x20HEAD,\x20GET,\x20OPTION
SF:S\r\nContent-Length:\x200\r\nConnection:\x20close\r\n\r\n")%r(RTSPReque
SF:st,16C,"<!DOCTYPE\x20HTML>\n<html\x20lang=\"en\">\n\x20\x20\x20\x20<hea
SF:d>\n\x20\x20\x20\x20\x20\x20\x20\x20<meta\x20charset=\"utf-8\">\n\x20\x
SF:20\x20\x20\x20\x20\x20\x20<title>Error\x20response</title>\n\x20\x20\x2
SF:0\x20</head>\n\x20\x20\x20\x20<body>\n\x20\x20\x20\x20\x20\x20\x20\x20<
SF:h1>Error\x20response</h1>\n\x20\x20\x20\x20\x20\x20\x20\x20<p>Error\x20
SF:code:\x20400</p>\n\x20\x20\x20\x20\x20\x20\x20\x20<p>Message:\x20Bad\x2
SF:0request\x20version\x20\('RTSP/1\.0'\)\.</p>\n\x20\x20\x20\x20\x20\x20\
SF:x20\x20<p>Error\x20code\x20explanation:\x20400\x20-\x20Bad\x20request\x
SF:20syntax\x20or\x20unsupported\x20method\.</p>\n\x20\x20\x20\x20</body>\
SF:n</html>\n");
==============NEXT SERVICE FINGERPRINT (SUBMIT INDIVIDUALLY)==============
SF-Port5000-TCP:V=7.94SVN%I=7%D=3/28%Time=67E6DBBD%P=x86_64-pc-linux-gnu%r
SF:(GetRequest,B4A,"HTTP/1\.1\x20200\x20OK\r\nServer:\x20Werkzeug/3\.1\.3\
SF:x20Python/3\.13\.1\r\nDate:\x20Fri,\x2028\x20Mar\x202025\x2017:26:16\x2
SF:0GMT\r\nContent-Type:\x20text/html;\x20charset=utf-8\r\nContent-Length:
SF:\x202715\r\nConnection:\x20close\r\n\r\n<!DOCTYPE\x20html>\n<html\x20la
SF:ng=\"en\">\n<head>\n\x20\x20\x20\x20<meta\x20charset=\"UTF-8\">\n\x20\x
SF:20\x20\x20<meta\x20name=\"viewport\"\x20content=\"width=device-width,\x
SF:20initial-scale=1\.0\">\n\x20\x20\x20\x20<title>SCP\x20Pizza\x20POS</ti
SF:tle>\n\x20\x20\x20\x20<link\x20href=\"https://cdn\.jsdelivr\.net/npm/bo
SF:otstrap@5\.3\.0/dist/css/bootstrap\.min\.css\"\x20rel=\"stylesheet\">\n
SF:</head>\n<body\x20class=\"bg-dark\x20text-light\">\n\x20\x20\x20\x20<di
SF:v\x20class=\"container\x20mt-5\">\n\x20\x20\x20\x20\x20\x20\x20\x20<h1\
SF:x20class=\"text-center\"><b>S</b>teve's\x20<b>Crazy</b>\x20<b>Pizza</b>
SF:\x20P\.O\.S</h1>\n\x20\x20\x20\x20\x20\x20\x20\x20<div\x20class=\"row\"
SF:\x20id=\"menu\">\n\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20<!--\
SF:x20Menu\x20items\x20will\x20be\x20loaded\x20here\x20-->\n\x20\x20\x20\x
SF:20\x20\x20\x20\x20</div>\n\x20\x20\x20\x20</div>\n\x20\x20\x20\x20\n\x2
SF:0\x20\x20\x20<script>\n\x20\x20\x20\x20\x20\x20\x20\x20document\.addEve
SF:ntListener\(\"DOMContentLoaded\",\x20function\(\)\x20{\n\x20\x20\x20\x2
SF:0\x20\x20\x20\x20\x20\x20\x20\x20fetch\(\"/menu\"\)\n\x20\x20\x20\x20\x
SF:20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\.then\(response\x20=>\x2
SF:0response\.json\(\)\)\n\x20\x20\x20\x20\x20\x20\x20")%r(RTSPRequest,16C
SF:,"<!DOCTYPE\x20HTML>\n<html\x20lang=\"en\">\n\x20\x20\x20\x20<head>\n\x
SF:20\x20\x20\x20\x20\x20\x20\x20<meta\x20charset=\"utf-8\">\n\x20\x20\x20
SF:\x20\x20\x20\x20\x20<title>Error\x20response</title>\n\x20\x20\x20\x20<
SF:/head>\n\x20\x20\x20\x20<body>\n\x20\x20\x20\x20\x20\x20\x20\x20<h1>Err
SF:or\x20response</h1>\n\x20\x20\x20\x20\x20\x20\x20\x20<p>Error\x20code:\
SF:x20400</p>\n\x20\x20\x20\x20\x20\x20\x20\x20<p>Message:\x20Bad\x20reque
SF:st\x20version\x20\('RTSP/1\.0'\)\.</p>\n\x20\x20\x20\x20\x20\x20\x20\x2
SF:0<p>Error\x20code\x20explanation:\x20400\x20-\x20Bad\x20request\x20synt
SF:ax\x20or\x20unsupported\x20method\.</p>\n\x20\x20\x20\x20</body>\n</htm
SF:l>\n");
Device type: general purpose
Running: Microsoft Windows 2019
OS details: Microsoft Windows Server 2019
Network Distance: 4 hops
Service Info: OSs: Windows, Windows Server 2008 R2 - 2012; CPE: cpe:/o:microsoft:windows

Host script results:
|_clock-skew: mean: 1h23m59s, deviation: 3h07m59s, median: -5s
| smb-security-mode: 
|   account_used: guest
|   authentication_level: user
|   challenge_response: supported
|_  message_signing: disabled (dangerous, but default)
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled but not required
| smb-os-discovery: 
|   OS: Windows Server 2019 Standard 17763 (Windows Server 2019 Standard 6.3)
|   Computer name: PRATO
|   NetBIOS computer name: PRATO\x00
|   Domain name: pizza.loco
|   Forest name: pizza.loco
|   FQDN: PRATO.pizza.loco
|_  System time: 2025-03-28T10:29:13-07:00
| smb2-time: 
|   date: 2025-03-28T17:29:12
|_  start_date: N/A

TRACEROUTE (using port 443/tcp)
HOP RTT     ADDRESS
-   Hops 1-3 are the same as for 192.168.230.30
4   1.56 ms 192.168.230.88

Nmap scan report for 192.168.230.97
Host is up (0.0015s latency).
Not shown: 998 closed tcp ports (reset)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 5.1p1 Debian 5ubuntu1 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   1024 94:92:50:69:d5:7c:1c:52:03:3b:1c:e8:64:88:a8:d5 (DSA)
|_  2048 ec:d9:64:da:6a:26:21:f1:24:af:37:56:18:c2:64:8b (RSA)
80/tcp open  http    Apache httpd 2.2.11 ((Ubuntu) PHP/5.2.6-3ubuntu4.6 with Suhosin-Patch mod_python/3.3.1 Python/2.6.2)
|_http-title: anzio.pizza.loco
|_http-favicon: Drupal CMS
|_http-server-header: Apache/2.2.11 (Ubuntu) PHP/5.2.6-3ubuntu4.6 with Suhosin-Patch mod_python/3.3.1 Python/2.6.2
| http-robots.txt: 38 disallowed entries (15 shown)
| /database/ /includes/ /misc/ /modules/ /sites/ /themes/ 
| /scripts/ /updates/ /profiles/ /xmlrpc.php /cron.php /update.php 
|_/install.php /INSTALL.txt /INSTALL.mysql.txt
Device type: general purpose
Running: Linux 2.6.X
OS CPE: cpe:/o:linux:linux_kernel:2.6
OS details: Linux 2.6.13 - 2.6.32
Network Distance: 4 hops
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE (using port 443/tcp)
HOP RTT     ADDRESS
-   Hops 1-3 are the same as for 192.168.230.30
4   1.54 ms 192.168.230.97

Nmap scan report for 192.168.230.133
Host is up (0.0015s latency).
Not shown: 992 closed tcp ports (reset)
PORT     STATE SERVICE         VERSION
22/tcp   open  ssh             OpenSSH for_Windows_8.1 (protocol 2.0)
| ssh-hostkey: 
|   3072 8c:6e:8f:6a:59:d4:36:d9:89:ec:85:82:a3:37:09:ec (RSA)
|   256 9e:c4:c6:0b:0f:b8:ff:85:d5:d7:64:00:d3:0c:dc:2f (ECDSA)
|_  256 4d:da:cf:b7:53:be:83:de:d1:fb:6d:af:b1:01:c4:63 (ED25519)
80/tcp   open  http            ADMP
|_http-title: ManageEngine - ADManager Plus
| fingerprint-strings: 
|   GetRequest: 
|     HTTP/1.1 200 
|     Set-Cookie: JSESSIONIDADMP=B5C13B334F74076B7CB846DE6D475CF2; Path=/; HttpOnly
|     Cache-Control: no-cache, no-store
|     Pragma: no-cache
|     Expires: Thu, 01 Jan 1970 00:00:00 GMT
|     X-Content-Type-Options: nosniff
|     Set-Cookie: admpcsrf=1ce510ef-7e66-4ed0-bd4f-e0e6169429f3;path=/;priority=high
|     Set-Cookie: _zcsr_tmp=1ce510ef-7e66-4ed0-bd4f-e0e6169429f3;path=/;SameSite=Strict;priority=high
|     vary: accept-encoding
|     Content-Type: text/html;charset=UTF-8
|     Date: Fri, 28 Mar 2025 17:26:17 GMT
|     Connection: close
|     Server: ADMP
|     <!DOCTYPE html>
|     <html><head>
|     <meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1"><title>ManageEngine - ADManager Plus</title>
|     <script type="text/javascript" src="/js/framework/jsencrypt.min.js?v=9684888"></script><script>self.insideAppsPane=true;</script>
|     <script language="Java
|   HTTPOptions: 
|     HTTP/1.1 200 
|     Set-Cookie: JSESSIONIDADMP=9FD410F5BB4041941CA2461CE41EB85D; Path=/; HttpOnly
|     Cache-Control: no-cache, no-store
|     Pragma: no-cache
|     Expires: Thu, 01 Jan 1970 00:00:00 GMT
|     X-Content-Type-Options: nosniff
|     Set-Cookie: admpcsrf=ab60e801-9bf6-415a-a7f0-e1bfe70666c6;path=/;priority=high
|     Set-Cookie: _zcsr_tmp=ab60e801-9bf6-415a-a7f0-e1bfe70666c6;path=/;SameSite=Strict;priority=high
|     vary: accept-encoding
|     Content-Type: text/html;charset=UTF-8
|     Date: Fri, 28 Mar 2025 17:26:17 GMT
|     Connection: close
|     Server: ADMP
|     <!DOCTYPE html>
|     <html><head>
|     <meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1"><title>ManageEngine - ADManager Plus</title>
|     <script type="text/javascript" src="/js/framework/jsencrypt.min.js?v=9684888"></script><script>self.insideAppsPane=true;</script>
|_    <script language="Java
|_http-server-header: ADMP
135/tcp  open  msrpc           Microsoft Windows RPC
139/tcp  open  netbios-ssn     Microsoft Windows netbios-ssn
445/tcp  open  microsoft-ds?
2179/tcp open  vmrdp?
3389/tcp open  ms-wbt-server   Microsoft Terminal Services
|_ssl-date: 2025-03-28T17:29:39+00:00; -4s from scanner time.
| rdp-ntlm-info: 
|   Target_Name: PIZZA
|   NetBIOS_Domain_Name: PIZZA
|   NetBIOS_Computer_Name: PALERMO
|   DNS_Domain_Name: pizza.loco
|   DNS_Computer_Name: palermo.pizza.loco
|   DNS_Tree_Name: pizza.loco
|   Product_Version: 10.0.20348
|_  System_Time: 2025-03-28T17:28:56+00:00
| ssl-cert: Subject: commonName=palermo.pizza.loco
| Not valid before: 2025-01-27T04:23:54
|_Not valid after:  2025-07-29T04:23:54
8888/tcp open  sun-answerbook?
| fingerprint-strings: 
|   GetRequest: 
|     HTTP/1.1 200 OK
|     Cache-Control: private
|     Expires: Thu, 01 Jan 1970 00:00:00 GMT
|     Set-Cookie: adscsrf=ab5d2cf9-e810-4d07-8d4f-771fd0851b65;path=/;priority=high
|     Set-Cookie: _zcsr_tmp=ab5d2cf9-e810-4d07-8d4f-771fd0851b65;path=/;SameSite=Strict;priority=high
|     Set-Cookie: JSESSIONIDADSSP=414DA70E518EDEB6C268EA7984CE3AD8; Path=/; HttpOnly
|     Content-Type: text/html;charset=UTF-8
|     Content-Length: 259
|     Date: Fri, 28 Mar 2025 17:26:24 GMT
|     Connection: close
|     <!-- $Id$ -->
|     <html>
|     <head>
|     <META HTTP-EQUIV="CACHE-CONTROL" CONTENT="NO-CACHE">
|     <META HTTP-EQUIV="PRAGMA" CONTENT="NO-CACHE">
|     <META HTTP-EQUIV="Expires" CONTENT="0">
|     <script>
|     location.href = 'showLogin.cc' + location.search;
|     </script>
|     </head>
|     </html>
|   HTTPOptions: 
|     HTTP/1.1 500 Internal Server Error
|     Cache-Control: private
|     Expires: Thu, 01 Jan 1970 00:00:00 GMT
|     X-Content-Type-Options: nosniff
|     X-XSS-Protection: 1
|     X-Frame-Options: SAMEORIGIN
|     Set-Cookie: JSESSIONIDADSSP=87868D0F7EB9346ABAB625F01015FDA2; Path=/; HttpOnly
|     Content-Type: text/html;charset=UTF-8
|     Content-Length: 4244
|     Date: Fri, 28 Mar 2025 17:26:25 GMT
|     Connection: close
|     <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
|     <html>
|     <head>
|     <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
|     <meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1">
|     <link REL="SHORTCUT ICON" HREF='&#x2f;images&#x2f;adssp_favicon.ico'>
|     <title>ADSelfService Plus</title>
|     <script language="JavaScript" src="/js/form-util.js?build=6201"></script>
|_    <script language="JavaScript" src="/js/CommonUtil.j
2 services unrecognized despite returning data. If you know the service/version, please submit the following fingerprints at https://nmap.org/cgi-bin/submit.cgi?new-service :
==============NEXT SERVICE FINGERPRINT (SUBMIT INDIVIDUALLY)==============
SF-Port80-TCP:V=7.94SVN%I=7%D=3/28%Time=67E6DBBE%P=x86_64-pc-linux-gnu%r(G
SF:etRequest,2000,"HTTP/1\.1\x20200\x20\r\nSet-Cookie:\x20JSESSIONIDADMP=B
SF:5C13B334F74076B7CB846DE6D475CF2;\x20Path=/;\x20HttpOnly\r\nCache-Contro
SF:l:\x20no-cache,\x20no-store\r\nPragma:\x20no-cache\r\nExpires:\x20Thu,\
SF:x2001\x20Jan\x201970\x2000:00:00\x20GMT\r\nX-Content-Type-Options:\x20n
SF:osniff\r\nSet-Cookie:\x20admpcsrf=1ce510ef-7e66-4ed0-bd4f-e0e6169429f3;
SF:path=/;priority=high\r\nSet-Cookie:\x20_zcsr_tmp=1ce510ef-7e66-4ed0-bd4
SF:f-e0e6169429f3;path=/;SameSite=Strict;priority=high\r\nvary:\x20accept-
SF:encoding\r\nContent-Type:\x20text/html;charset=UTF-8\r\nDate:\x20Fri,\x
SF:2028\x20Mar\x202025\x2017:26:17\x20GMT\r\nConnection:\x20close\r\nServe
SF:r:\x20ADMP\r\n\r\n<!DOCTYPE\x20html>\n<html><head>\n<meta\x20charset=\"
SF:utf-8\"><meta\x20http-equiv=\"X-UA-Compatible\"\x20content=\"IE=edge\">
SF:<meta\x20name=\"viewport\"\x20content=\"width=device-width,\x20initial-
SF:scale=1\"><title>ManageEngine\x20-\x20ADManager\x20Plus</title>\n<scrip
SF:t\x20type=\"text/javascript\"\x20src=\"/js/framework/jsencrypt\.min\.js
SF:\?v=9684888\"></script><script>self\.insideAppsPane=true;</script>\n<sc
SF:ript\x20language=\"Java")%r(HTTPOptions,2000,"HTTP/1\.1\x20200\x20\r\nS
SF:et-Cookie:\x20JSESSIONIDADMP=9FD410F5BB4041941CA2461CE41EB85D;\x20Path=
SF:/;\x20HttpOnly\r\nCache-Control:\x20no-cache,\x20no-store\r\nPragma:\x2
SF:0no-cache\r\nExpires:\x20Thu,\x2001\x20Jan\x201970\x2000:00:00\x20GMT\r
SF:\nX-Content-Type-Options:\x20nosniff\r\nSet-Cookie:\x20admpcsrf=ab60e80
SF:1-9bf6-415a-a7f0-e1bfe70666c6;path=/;priority=high\r\nSet-Cookie:\x20_z
SF:csr_tmp=ab60e801-9bf6-415a-a7f0-e1bfe70666c6;path=/;SameSite=Strict;pri
SF:ority=high\r\nvary:\x20accept-encoding\r\nContent-Type:\x20text/html;ch
SF:arset=UTF-8\r\nDate:\x20Fri,\x2028\x20Mar\x202025\x2017:26:17\x20GMT\r\
SF:nConnection:\x20close\r\nServer:\x20ADMP\r\n\r\n<!DOCTYPE\x20html>\n<ht
SF:ml><head>\n<meta\x20charset=\"utf-8\"><meta\x20http-equiv=\"X-UA-Compat
SF:ible\"\x20content=\"IE=edge\"><meta\x20name=\"viewport\"\x20content=\"w
SF:idth=device-width,\x20initial-scale=1\"><title>ManageEngine\x20-\x20ADM
SF:anager\x20Plus</title>\n<script\x20type=\"text/javascript\"\x20src=\"/j
SF:s/framework/jsencrypt\.min\.js\?v=9684888\"></script><script>self\.insi
SF:deAppsPane=true;</script>\n<script\x20language=\"Java");
==============NEXT SERVICE FINGERPRINT (SUBMIT INDIVIDUALLY)==============
SF-Port8888-TCP:V=7.94SVN%I=7%D=3/28%Time=67E6DBC5%P=x86_64-pc-linux-gnu%r
SF:(GetRequest,2CA,"HTTP/1\.1\x20200\x20OK\r\nCache-Control:\x20private\r\
SF:nExpires:\x20Thu,\x2001\x20Jan\x201970\x2000:00:00\x20GMT\r\nSet-Cookie
SF::\x20adscsrf=ab5d2cf9-e810-4d07-8d4f-771fd0851b65;path=/;priority=high\
SF:r\nSet-Cookie:\x20_zcsr_tmp=ab5d2cf9-e810-4d07-8d4f-771fd0851b65;path=/
SF:;SameSite=Strict;priority=high\r\nSet-Cookie:\x20JSESSIONIDADSSP=414DA7
SF:0E518EDEB6C268EA7984CE3AD8;\x20Path=/;\x20HttpOnly\r\nContent-Type:\x20
SF:text/html;charset=UTF-8\r\nContent-Length:\x20259\r\nDate:\x20Fri,\x202
SF:8\x20Mar\x202025\x2017:26:24\x20GMT\r\nConnection:\x20close\r\n\r\n<!--
SF:\x20\$Id\$\x20-->\n<html>\n<head>\n\t<META\x20HTTP-EQUIV=\"CACHE-CONTRO
SF:L\"\x20CONTENT=\"NO-CACHE\">\n\t<META\x20HTTP-EQUIV=\"PRAGMA\"\x20CONTE
SF:NT=\"NO-CACHE\">\n\t<META\x20HTTP-EQUIV=\"Expires\"\x20CONTENT=\"0\">\n
SF:\t<script>\n\t\tlocation\.href\x20=\x20'showLogin\.cc'\x20\+\x20locatio
SF:n\.search;\n\t</script>\n</head>\n</html>\n")%r(HTTPOptions,1212,"HTTP/
SF:1\.1\x20500\x20Internal\x20Server\x20Error\r\nCache-Control:\x20private
SF:\r\nExpires:\x20Thu,\x2001\x20Jan\x201970\x2000:00:00\x20GMT\r\nX-Conte
SF:nt-Type-Options:\x20nosniff\r\nX-XSS-Protection:\x201\r\nX-Frame-Option
SF:s:\x20SAMEORIGIN\r\nSet-Cookie:\x20JSESSIONIDADSSP=87868D0F7EB9346ABAB6
SF:25F01015FDA2;\x20Path=/;\x20HttpOnly\r\nContent-Type:\x20text/html;char
SF:set=UTF-8\r\nContent-Length:\x204244\r\nDate:\x20Fri,\x2028\x20Mar\x202
SF:025\x2017:26:25\x20GMT\r\nConnection:\x20close\r\n\r\n\n\n<!DOCTYPE\x20
SF:html\x20PUBLIC\x20\"-//W3C//DTD\x20XHTML\x201\.0\x20Transitional//EN\"\
SF:x20\"http://www\.w3\.org/TR/xhtml1/DTD/xhtml1-transitional\.dtd\">\n<ht
SF:ml>\n<head>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n<meta\x20http-equiv=
SF:\"Content-Type\"\x20content=\"text/html;\x20charset=UTF-8\">\n<meta\x20
SF:http-equiv=\"X-UA-Compatible\"\x20content=\"IE=edge,chrome=1\">\n\n<lin
SF:k\x20REL=\"SHORTCUT\x20ICON\"\x20HREF='&#x2f;images&#x2f;adssp_favicon\
SF:.ico'>\n<title>ADSelfService\x20Plus</title>\n<script\x20language=\"Jav
SF:aScript\"\x20src=\"/js/form-util\.js\?build=6201\"></script>\n<script\x
SF:20language=\"JavaScript\"\x20src=\"/js/CommonUtil\.j");
No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ).
TCP/IP fingerprint:
OS:SCAN(V=7.94SVN%E=4%D=3/28%OT=22%CT=1%CU=31318%PV=Y%DS=4%DC=T%G=Y%TM=67E6
OS:DC90%P=x86_64-pc-linux-gnu)SEQ(SP=102%GCD=1%ISR=109%TI=I%CI=I%II=I%SS=S%
OS:TS=A)OPS(O1=M5B4NW8ST11%O2=M5B4NW8ST11%O3=M5B4NW8NNT11%O4=M5B4NW8ST11%O5
OS:=M5B4NW8ST11%O6=M5B4ST11)WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=
OS:FFDC)ECN(R=Y%DF=Y%T=81%W=FFFF%O=M5B4NW8NNS%CC=Y%Q=)T1(R=Y%DF=Y%T=81%S=O%
OS:A=S+%F=AS%RD=0%Q=)T2(R=Y%DF=Y%T=81%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)T3(R=Y%DF
OS:=Y%T=81%W=0%S=Z%A=O%F=AR%O=%RD=0%Q=)T4(R=Y%DF=Y%T=81%W=0%S=A%A=O%F=R%O=%
OS:RD=0%Q=)T5(R=Y%DF=Y%T=81%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=81%W
OS:=0%S=A%A=O%F=R%O=%RD=0%Q=)T7(R=Y%DF=Y%T=81%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
OS:U1(R=Y%DF=N%T=81%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%D
OS:FI=N%T=81%CD=Z)

Network Distance: 4 hops
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled but not required
|_clock-skew: mean: -4s, deviation: 0s, median: -4s
| smb2-time: 
|   date: 2025-03-28T17:29:18
|_  start_date: N/A

TRACEROUTE (using port 443/tcp)
HOP RTT     ADDRESS
-   Hops 1-3 are the same as for 192.168.230.30
4   1.65 ms 192.168.230.133

Nmap scan report for 192.168.230.215
Host is up (0.0015s latency).
Not shown: 994 closed tcp ports (reset)
PORT     STATE SERVICE       VERSION
22/tcp   open  ssh           OpenSSH for_Windows_8.1 (protocol 2.0)
| ssh-hostkey: 
|   3072 34:4c:6f:7a:04:0d:d4:cf:9b:25:3c:3f:d5:db:0d:39 (RSA)
|   256 42:1f:aa:6f:a3:7b:9a:37:f7:51:ae:50:2c:3f:99:52 (ECDSA)
|_  256 40:b8:be:37:a9:72:61:02:f7:93:a8:a3:0f:b6:67:71 (ED25519)
80/tcp   open  http          Microsoft IIS httpd 10.0
|_http-title: Chat GuidedPizzaToppings
|_http-server-header: Microsoft-IIS/10.0
135/tcp  open  msrpc         Microsoft Windows RPC
139/tcp  open  netbios-ssn   Microsoft Windows netbios-ssn
445/tcp  open  microsoft-ds?
3389/tcp open  ms-wbt-server Microsoft Terminal Services
| rdp-ntlm-info: 
|   Target_Name: PIZZA
|   NetBIOS_Domain_Name: PIZZA
|   NetBIOS_Computer_Name: PISA
|   DNS_Domain_Name: pizza.loco
|   DNS_Computer_Name: pisa.pizza.loco
|   DNS_Tree_Name: pizza.loco
|   Product_Version: 10.0.20348
|_  System_Time: 2025-03-28T17:29:01+00:00
|_ssl-date: 2025-03-28T17:29:39+00:00; -5s from scanner time.
| ssl-cert: Subject: commonName=pisa.pizza.loco
| Not valid before: 2025-02-01T03:35:54
|_Not valid after:  2025-08-03T03:35:54
No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ).
TCP/IP fingerprint:
OS:SCAN(V=7.94SVN%E=4%D=3/28%OT=22%CT=1%CU=38160%PV=Y%DS=4%DC=T%G=Y%TM=67E6
OS:DC90%P=x86_64-pc-linux-gnu)SEQ(SP=103%GCD=1%ISR=10F%TI=I%CI=I%II=I%SS=S%
OS:TS=A)OPS(O1=M5B4NW8ST11%O2=M5B4NW8ST11%O3=M5B4NW8NNT11%O4=M5B4NW8ST11%O5
OS:=M5B4NW8ST11%O6=M5B4ST11)WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=
OS:FFDC)ECN(R=Y%DF=Y%T=81%W=FFFF%O=M5B4NW8NNS%CC=Y%Q=)T1(R=Y%DF=Y%T=81%S=O%
OS:A=S+%F=AS%RD=0%Q=)T2(R=Y%DF=Y%T=81%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)T3(R=Y%DF
OS:=Y%T=81%W=0%S=Z%A=O%F=AR%O=%RD=0%Q=)T4(R=Y%DF=Y%T=81%W=0%S=A%A=O%F=R%O=%
OS:RD=0%Q=)T5(R=Y%DF=Y%T=81%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=81%W
OS:=0%S=A%A=O%F=R%O=%RD=0%Q=)T7(R=Y%DF=Y%T=81%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
OS:U1(R=Y%DF=N%T=81%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%D
OS:FI=N%T=81%CD=Z)

Network Distance: 4 hops
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
|_clock-skew: mean: -5s, deviation: 0s, median: -5s
| smb2-time: 
|   date: 2025-03-28T17:29:25
|_  start_date: N/A
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled but not required

TRACEROUTE (using port 443/tcp)
HOP RTT     ADDRESS
-   Hops 1-2 are the same as for 192.168.230.30
3   ...
4   1.64 ms 192.168.230.215

Nmap scan report for 192.168.230.235
Host is up (0.0015s latency).
Not shown: 996 closed tcp ports (reset)
PORT     STATE SERVICE       VERSION
22/tcp   open  ssh           OpenSSH 9.0 (protocol 2.0)
| ssh-hostkey: 
|   256 b4:80:76:5e:79:19:d0:69:04:b6:19:ef:ec:f6:ca:74 (ECDSA)
|_  256 93:58:24:4f:7a:25:49:f3:b1:32:06:d5:57:a7:52:28 (ED25519)
80/tcp   open  http          Apache httpd 2.4.59 ((Fedora Linux) OpenSSL/3.0.9)
| http-title: Welcome to Steve's Crazy Pizza - Steve's Crazy Pizza
|_Requested resource was http://192.168.230.235/pr/
|_http-server-header: Apache/2.4.59 (Fedora Linux) OpenSSL/3.0.9
443/tcp  open  ssl/http      Apache httpd 2.4.59 ((Fedora Linux) OpenSSL/3.0.9)
|_ssl-date: TLS randomness does not represent time
| http-methods: 
|_  Potentially risky methods: TRACE
|_http-title: Test Page for the HTTP Server on Fedora
| ssl-cert: Subject: commonName=ragusa/organizationName=Unspecified/countryName=US
| Subject Alternative Name: DNS:ragusa
| Not valid before: 2024-10-03T04:46:24
|_Not valid after:  2025-10-03T04:46:24
|_http-server-header: Apache/2.4.59 (Fedora Linux) OpenSSL/3.0.9
| tls-alpn: 
|_  http/1.1
3389/tcp open  ms-wbt-server xrdp
No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ).
TCP/IP fingerprint:
OS:SCAN(V=7.94SVN%E=4%D=3/28%OT=22%CT=1%CU=38255%PV=Y%DS=4%DC=T%G=Y%TM=67E6
OS:DC90%P=x86_64-pc-linux-gnu)SEQ(SP=104%GCD=1%ISR=10B%TI=Z%CI=Z%TS=A)SEQ(S
OS:P=104%GCD=1%ISR=10B%TI=Z%CI=Z%II=I%TS=A)OPS(O1=M564ST11NW7%O2=M564ST11NW
OS:7%O3=M564NNT11NW7%O4=M564ST11NW7%O5=M564ST11NW7%O6=M564ST11)WIN(W1=8040%
OS:W2=8040%W3=8040%W4=8040%W5=8040%W6=8040)ECN(R=Y%DF=Y%T=41%W=8160%O=M564N
OS:NSNW7%CC=Y%Q=)T1(R=Y%DF=Y%T=41%S=O%A=S+%F=AS%RD=0%Q=)T2(R=N)T3(R=N)T4(R=
OS:Y%DF=Y%T=41%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T5(R=Y%DF=Y%T=41%W=0%S=Z%A=S+%F=A
OS:R%O=%RD=0%Q=)T6(R=Y%DF=Y%T=41%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T7(R=Y%DF=Y%T=4
OS:1%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)U1(R=Y%DF=N%T=41%IPL=164%UN=0%RIPL=G%RID=
OS:G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N%T=41%CD=S)

Network Distance: 4 hops

TRACEROUTE (using port 23/tcp)
HOP RTT     ADDRESS
-   Hops 1-3 are the same as for 192.168.230.30
4   1.58 ms 192.168.230.235

Post-scan script results:
| clock-skew: 
|   41m55s: 
|     192.168.230.5
|     192.168.230.215
|_    192.168.230.88
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 256 IP addresses (10 hosts up) scanned in 238.82 seconds