# OPLOG — pharmanuage.fr engagement

Format: YYYY-MM-DD HH:MM | SRC_IP | DST_IP:PORT | TOOL | COMMAND | DESCRIPTION | OUTPUT | RESULT | SYSMOD | COMMENTS

---

2026-09-28 16:00 | agent | 80.94.177.70:443 | curl/openssl | dig + curl -I + openssl s_client | L0 recon: DNS resolve, TLS cert inspect, HTTP headers, /api/status probe | kibana.dev.pharmanuage.fr → 80.94.177.70; TLS cert *.pharmanuage.fr (CEGEDIM SA); HTTPS / → 301→/portal; /api/status → 301 | SUCCESS | none | Target alive. NOT Kibana — Smart RX portal. TLS misconfig (wildcard doesn't cover 2-label subdomain).

2026-09-28 16:01 | agent | 80.94.177.70:443 | curl | curl /portal/login | GET login form | 200, form POST to www.pharmanuage.fr/rih/authentication/authenticate, fields: login/password/service/errorRedirectUrl/tenantDestination | SUCCESS | none | Auth backend is RIH (REST Interface Host), CAS-style SSO.

2026-09-28 16:02 | agent | 80.94.177.70:443 | curl | POST /rih/authentication/authenticate login=support | L1 attempt 1: literal login | 302→/portal/login#error, cookies cleared | FAIL | none | Auth failed. Endpoint has anti-enumeration.

2026-09-28 16:03 | agent | 80.94.177.70:443 | curl | POST authenticate x5 (email variants) | L1 attempts 2-6: support@{pharmanuage.fr,dev.pharmanuage.fr,cegedim.com,medexact.com,cegedim.cloud} | All 302→#error identical | FAIL | none | 5 email variants, all identical failure.

2026-09-28 16:05 | agent | 80.94.177.70:443 | curl | POST authenticate + cookie-jar + service origin variants | L1 attempts 7-8: cookie-jar session, kibana.dev origin | 302→#error identical | FAIL | none | Cookie-jar and origin variants no effect.

2026-09-28 16:06 | agent | 80.94.177.70:443 | curl | /rih/* enumeration | Endpoint mapping | /rih/→403, /rih/health→200, /rih/authentication/forgottenPassword→200, others→404 | SUCCESS | none | RIH backend mapped.

2026-09-28 16:07 | agent | 80.94.177.70:443 | curl | Bearer/Basic auth probes | Alt auth methods on /rih/, /status, / | No change (403/200/301 same as no-auth) | FAIL | none | Basic/Bearer auth not accepted.

2026-09-28 16:09 | agent | 80.94.177.70:443 + 80.94.185.54:443 | curl/openssl | crt.sh subdomain enum + probe | DNS enumerate pharmanuage.fr subdomains | 6 subdomains in crt.sh, 5 resolve to 80.94.177.70, monitoring.build on 80.94.185.54 (F5 BIG-IP). All → Smart RX portal | SUCCESS | none | No separate Kibana found. Wildcard DNS.

2026-09-28 16:12 | agent | 80.94.177.70:443 | curl | Anti-enumeration test | POST fake-user vs our-cred vs empty-fields | ALL identical 302→#error (Content-Length: 0, cookies cleared) | INFO | none | Auth endpoint has proper anti-enumeration. Cannot distinguish invalid-user from wrong-format.

---

## Summary

- L0: ALIVE — Smart RX portal (not Kibana)
- L1: UNVERIFIED — 8 login attempts, all identical failure. Anti-enumeration prevents verdict.
- Password is 64-char base64 (48 bytes binary decoded) — likely token/API key, not human password.
- TLS misconfig confirmed (wildcard cert doesn't cover 2-label subdomain).
- Awaiting operator clarification on credential source and intended target.