4 ms·

> Apache/2.4.6 (CentOS) OpenSSL/1.0.1e-fips mod_fcgid/2.3.9 PHP/5.4.16 mod_python/3.5.0- Python/2.7.5 Eek! I wouldn't trust them with my data if I was a bank.

> Apache/2.4.6 (CentOS) OpenSSL/1.0.1e-fips mod_fcgid/2.3.9 PHP/5.4.16 mod_python/3.5.0- Python/2.7.5 Eek! I wouldn't trust them with my data if I was a bank. They haven't updated their server since 2013. All of the versions listed in that header have major vulns. This is a disaster waiting to happen.

boybd 7y ago
https://banclist.com/?=PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C10000 https://banclist.com/?=PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C100... Heh, no joke :P
- deleted 7y ago
  [deleted]
etcet 7y ago
Most, if not all, of those versions are the latest provided by CentOS 7. They backport security patches, see https://access.redhat.com/security/updates/backporting https://access.redhat.com/security/updates/backporting
netsectoday 7y ago
They really have no clue what they are doing... No security headers and their SSL is insecure. Someone needs to tell them to shut their servers down right now. Directly from their website: "Patrick Brown - Chief Technology Officer. Mr. Brown is the co-founder of Eye Candy Creative, a highly successful technology and marketing company." So their CTO is a marketing guy. No wonder they suck.
- hathawsh 7y ago
  Yikes, Qualys SSL Labs gives them a grade of C. They may be vulnerable to a POODLE attack. They probably should disable SSL 3 support to protect their customers. https://www.ssllabs.com/ssltest/analyze.html?d=banclist.com https://www.ssllabs.com/ssltest/analyze.html?d=banclist.com
avip 7y ago
It seems dir listing is not properly disabled https://banclist.com/app/webroot/img/ https://banclist.com/app/webroot/img/
- dflock 7y ago
  It it now, by the look of it.
  - avip 7y ago
    Not an expert but I don't think it's considered good practice to expose your directory structure like that. It should have been 404 or redirection to /home.
- deleted 7y ago
  [deleted]
carlosdp 7y ago
It doesn't sound like they hold any really sensitive data though, at least not any customer data.

boybd 7y ago

https://banclist.com/?=PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C10000 https://banclist.com/?=PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C100... Heh, no joke :P

deleted 7y ago
[deleted]

etcet 7y ago

Most, if not all, of those versions are the latest provided by CentOS 7. They backport security patches, see https://access.redhat.com/security/updates/backporting https://access.redhat.com/security/updates/backporting

netsectoday 7y ago

They really have no clue what they are doing... No security headers and their SSL is insecure. Someone needs to tell them to shut their servers down right now. Directly from their website: "Patrick Brown - Chief Technology Officer. Mr. Brown is the co-founder of Eye Candy Creative, a highly successful technology and marketing company." So their CTO is a marketing guy. No wonder they suck.

hathawsh 7y ago
Yikes, Qualys SSL Labs gives them a grade of C. They may be vulnerable to a POODLE attack. They probably should disable SSL 3 support to protect their customers. https://www.ssllabs.com/ssltest/analyze.html?d=banclist.com https://www.ssllabs.com/ssltest/analyze.html?d=banclist.com

avip 7y ago

It seems dir listing is not properly disabled https://banclist.com/app/webroot/img/ https://banclist.com/app/webroot/img/

dflock 7y ago
It it now, by the look of it.
- avip 7y ago
  Not an expert but I don't think it's considered good practice to expose your directory structure like that. It should have been 404 or redirection to /home.
deleted 7y ago
[deleted]

carlosdp 7y ago

It doesn't sound like they hold any really sensitive data though, at least not any customer data.