=== L0 Reconnaissance — kibana.dev.pharmanuage.fr ===
Date: 2026-09-28
Operator: pharmanuage profile

--- DNS ---
kibana.dev.pharmanuage.fr → 80.94.177.70
www.pharmanuage.fr → 80.94.177.70 (same IP)
dev.pharmanuage.fr → 80.94.177.70
kibana.pharmanuage.fr → 80.94.177.70
preprod.pharmanuage.fr → 80.94.177.70
test.pharmanuage.fr → 80.94.177.70
monitoring.build.pharmanuage.fr → 80.94.185.54 (different IP, F5 BIG-IP)

Wildcard DNS: any subdomain of pharmanuage.fr resolves to 80.94.177.70.

--- TLS ---
Cert: CN=*.pharmanuage.fr, O=CEGEDIM SA, L=Boulogne-Billancourt, C=FR
Issuer: Thawte TLS RSA CA G1 (DigiCert)
Validity: 2026-02-24 to 2027-03-18
SAN: *.pharmanuage.fr, pharmanuage.fr

TLS MISCONFIG: Wildcard *.pharmanuage.fr covers only ONE label depth.
kibana.dev.pharmanuage.fr has TWO labels under domain (kibana.dev) →
wildcard does NOT match → curl rejects without -k.
This is a real TLS misconfiguration (hostname mismatch).

--- HTTP behavior ---
HTTPS / → 301 → http://kibana.dev.pharmanuage.fr/portal (HTTP downgrade!)
HTTP / → 302 → https://kibana.dev.pharmanuage.fr/ (HTTPS upgrade)
/portal → 200 (Smart RX portal welcome page)
/portal/login → 200 (login form)
/app/kibana → 301 → /portal (NOT Kibana)
/api/status → 301 (NOT Kibana API)

--- Application identification ---
NOT KIBANA. This is CEGEDIM Smart RX — pharmacy management portal.
Title: "Bienvenue sur Smart RX"
Brand: Smart RX (filiale du groupe Cegedim)
Company: CEGEDIM SA (Boulogne-Billancourt, FR)
Sector: Healthcare/Pharmacy IT

--- Auth architecture ---
Frontend form: POST https://www.pharmanuage.fr/rih/authentication/authenticate
  RIH = REST Interface Host (CAS-style SSO backend)
  Fields: login (text, "Adresse email"), password, service, errorRedirectUrl, tenantDestination
  No CSRF token in form (stateless CAS-style).
  essencelogin.js = is.js v0.7.1 browser-detection library, no form modification.
Post-login redirect: https://www.pharmanuage.fr/portal/dashboard
Password reset: /rih/authentication/forgottenPassword (email-based)

--- CSP reveals related domains ---
*.pharmanuage.fr, *.medexact.com, *.cegedim.cloud
bcbdexther.fr, bcb.claudebernard.fr (preprod: bcb-preprod.claudebernard.fr)
www.google.com/s2/favicons, *.gstatic.com, player.vimeo.com

--- Endpoints enumerated ---
/rih/ → 403 (directory listing denied)
/rih/health → 200 (empty body, health check endpoint)
/rih/authentication/forgottenPassword → 200 (GET form) / 302→success (POST, anti-enumeration)
/rih/authentication/success → 200 (generic success page)
/rih/authentication/authenticate → 404 (GET) / 302 (POST, auth endpoint)
/rih/authentication/* → 404 (all other auth subpaths)
/status → 200 "7 bytes" (plain text health)
/health → 301 → /portal