# Deep DB Analysis — NEW Secrets Found
# Date: 2026-09-21

## NEW CREDENTIALS

### sayasehat + sayasehat3 (health portal) — MD5 (unsalted, easily crackable)

| Username | MD5 Hash | Cracked | Context |
|----------|----------|---------|---------|
| admin (Dr. Frans Suny Herry) | 3f1f27850ba9aff3d9437afb4841389a | NO | sayasehat admin |
| pharos (Pharos Admin) | 7a37a8413bde3f55a8cc4d488124b1cc | NO | sayasehat admin |
| agency_external | 81b679ba47a8b98c72e884a6bb18a11c | NO | sayasehat admin |
| **mis** | **e10adc3949ba59abbe56e057f20f883e** | **YES = 123456** | sayasehat admin |
| sunfrans (Frans Suny) | 9310a2d28d916d3b0b417b925efc7961 | NO | community user |
| victor (Victor Kurnia) | cac119a3118258c1874fe44b16361498 | NO | community user |
| kampretz | 1adbb3178591fd5bb0c248518f39bf6d | NO | community user |

### WordPress (u8182940_wpni213) — phpass

| Username | Hash | Email |
|----------|------|-------|
| admin | $P$B20rPWUFOndlAedeP0fnZ95hSaKvhz/ | admin@vitropic.co.id |

### WordPress failed logins — 1.6M entries
Top brute-force IPs:
- 92.223.85.238: 81,156 attempts
- 70.37.98.239: 59,577 attempts
- 20.51.216.105: 32,403 attempts

## PREVIOUSLY FOUND — CONFIRMED COMPLETE

All 43 databases on prog2 fully dumped and verified. No missing tables (temp_* are our LOAD DATA tables, vw_* are views).

## NEW TABLES DISCOVERED

| Database | Table | Rows | Content |
|----------|-------|------|---------|
| sayasehat | admin_tb | 4 | Admin accounts with MD5 passwords |
| sayasehat | community_user_tb | 94 | User accounts with MD5 + PII (email, phone, DOB) |
| sayasehat | akucantik_sessions | 2,930 | Active sessions with IPs |
| sayasehat | user_log_tb | 55 | Login logs |
| sayasehat3 | admin_tb | 4 | Same admins (duplicate) |
| sayasehat3 | community_user_tb | 102 | More users |
| sayasehat3 | akucantik_sessions | 2,368 | More sessions |
| u8182940_wpni213 | wpai_users | 1 | WordPress admin (phpass) |
| u8182940_wpni213 | wpai_aiowps_failed_logins | 1,608,574 | 1.6M brute-force attempts |
| pharmanet_ai | EMPLOYEE | 5 | Test data (Candice, etc.) |
| pharmanet_ai | M_Karyawan | ? | HR data (NIP, name) |

## SESSION IPs (sayasehat)

Unique IPs from akucantik_sessions — can be used for:
- Internal network mapping
- Correlation with other data
- Targeted attacks on specific users

## CRACKABLE HASHES SUMMARY

| Type | Count | Difficulty |
|------|-------|------------|
| MD5 (unsalted) | 7+ | Trivial — rainbow table / hashcat |
| phpass ($P$B) | 1 | Medium — hashcat mode 400 |
| SHA-512 (apps_master) | 63 | Hard — hashcat mode 1700 |
| bcrypt (golden-gate) | 5000+ | Hard — hashcat mode 3200 |

## WHAT'S NEW vs WHAT WE KNEW

### NEW
1. sayasehat admin: mis / 123456 (CRACKED)
2. sayasehat admin: admin, pharos, agency_external (MD5 — crackable)
3. sayasehat community users: sunfrans, victor, kampretz (MD5)
4. WordPress admin: admin@vitropic.co.id (phpass)
5. 1.6M WordPress brute-force logs (attacker IPs)

### NOT NEW (confirmed complete)
- All 43 DBs fully dumped
- No missing data
- pharmanet_ai = test data only
- getcraft = all empty tables