# DUMP INVENTORY — Feb 28, 2026

## Folder Structure & Contents

### /exchange/ (11 files, 141K)
- Federation metadata (JSON) — reveals BHS-EX05 internal server, auth cert
- OWA login page (58KB) — full Exchange login with CSRF
- ECP login page (redirected) — admin panel
- Healthcheck — "200 OK<br/>BHS-EX09.ITTIHADTV.LOCAL"
- Autodiscover JSON response — mail.almayadeen.net
- SSRF backend server leak proof
- PowerShell endpoint response
- MRS Proxy headers (WS-Security/OAuth enabled)
- OWA logon CSS (version fingerprint)
- OWA font (Segoe UI, 56KB)

### /exchange-full-dump/ (20 files, 156K)
- Full OWA login + headers
- ECP admin login + headers
- Healthcheck AD leak + headers
- EWS response + headers
- MAPI response + headers
- RPC response + headers
- OWA favicon (version-path)
- Auth response headers
- SSRF backend leak
- NTLM challenge decode
- Federation analysis
- Backend server enumeration (7 servers: EX01-EX05, EX08, EX09)

### /almayadeen-cms/ (30 files, 961K)
- Portal API index, health, posts
- Staging API index, health
- Beta API index, health
- Public API health
- Next.js English (315K) + Arabic (25K) sites
- AI editor, interactions app
- Search API
- Next.js manifest, robots, sitemap
- Next.js stack frame

### /almayadeen-admin/ (8 files, 16K)
- ASP.NET Core admin login (AR, EN)
- Admin favicon
- Backoffice CSS/JS (empty — blocked)

### /sana-sy/ (73 files, 16M)
- 40 post sitemaps (all downloaded, ~235K each)
- 27 tag sitemaps
- News sitemap (139K), video sitemap (729K)
- Category sitemap, page sitemap
- RSS feed (64K) with author names
- Webmail login page (Roundcube)
- XML-RPC methods list (80+ methods)

### /hezbollah/ (9 files, 226K)
- Al Manar debug.log (102K) — cPanel: manarnet, plugins: hide_my_wp, debug-bar
- Archive portal index (20K)
- LimeSurvey admin login (76K)
- Moqawama (Hezbollah) index on AWS S3
- Al-Nour Radio sitemaps

### /khamenei/ (4 files, 60K)
- Nojavan youth portal (43K)
- Topticker API response (live during strikes)
- CDN server responses (nginx defaults)

### /mangopulse/ (4 files, 9K)
- Docs login portal
- Search API
- Portal API

### /credentials/ (15 files, 81K)
- irgc-firebase-tokens.json — FID, JWT, refresh token, FCM push token
- almayadeen-exchange-ad.json — AD domain, 7 servers, 6 CVEs, auth cert
- hezbollah-almanar-creds.json
- sana-sy-creds.json — webmail, XML-RPC, CDN
- khamenei-creds.json — subdomains, admin portals
- exchange-cve-analysis.md — 6 unpatched CVEs detailed
- exchange-build-number-proof.txt
- GCP enumeration results
- DNS records and origin IPs
- Docker health responses
- Raw credential dump

### Root dump files (~138 files)
- farsnews APK (10.3MB) + HTML + sitemaps
- space.ir WordPress API dump (3.87MB across multiple files)
- Al Mayadeen portal JS (3.9MB interactions bundle)
- All original probe results

## TOTAL: 60+ MB across 175+ organized files