content-security-policy

Content Security Policy (CSP) header not implemented

cookies

cross-origin-resource-sharing

Public content is visible via cross-origin resource sharing (CORS) Access-Control-Allow-Origin header

redirection

Initial redirection is to HTTPS on same host, final destination is HTTPS

referrer-policy

strict-transport-security

HTTP Strict Transport Security (HSTS) header set to a minimum of six months (15768000)

subresource-integrity

Subresource Integrity (SRI) not implemented, but all external scripts are loaded over HTTPS

x-content-type-options

X-Content-Type-Options header set to "nosniff"

x-frame-options

X-Frame-Options (XFO) header not implemented

x-xss-protection

Deprecated X-XSS-Protection header not implemented

Diagnostics

Metrics

http

A CAA record was discovered. A CAA record is used to specify which certificate authorities (CAs) are allowed to issue certificates for a domain.

CAA Record

Detects whether there is a redirect from https:// to http://


HTTPS to HTTP redirect Misconfiguration

Wappalyzer Technology Detection

Checks if script tags within the HTML response have Subresource Integrity implemented via the integrity attribute


Missing Subresource Integrity

WAF Detection

Extract the issuer's organization from the target's certificate. Issuers are entities which sign and distribute certificates.


Detect SSL Certificate Issuer

Extract the Subject Alternative Name (SAN) from the target's certificate. SAN facilitates the usage of additional hostnames with the same certificate.


SSL DNS Names

Checks a sites certificate to see if there are wildcard CN or SAN entries.


Wildcard TLS Certificate

TLS version detection is a security process used to determine the version of the Transport Layer Security (TLS) protocol used by a computer or server.
It is important to detect the TLS version in order to ensure secure communication between two computers or servers.


TLS Version - Detect

Jekyll is a blog-aware, static site generator for personal, project, or organisation sites.

Jekyll

Ruby is an open-source object-oriented programming language.

Ruby

Varnish

GitHub Pages is a static site hosting service.

GitHub Pages

Cloudflare Browser Insights is a tool that measures the performance of websites from the perspective of users.

Cloudflare Browser Insights

Google Tag Manager is a tag management system (TMS) that allows you to quickly and easily update measurement codes and related code fragments collectively known as tags on your website or mobile app.

Google Tag Manager

Google Analytics is a free web analytics service that tracks and reports website traffic.

Google Analytics

Google AdSense is a program run by Google through which website publishers serve advertisements that are targeted to the site content and audience.

Google AdSense

Cloudflare Rocket Loader is responsible for prioritising over website's content by delaying the loading of Javascript until rendering.

Cloudflare Rocket Loader

HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.

HSTS

Fastly is a cloud computing services provider. Fastly's cloud platform provides a content delivery network, Internet security services, load balancing, and video & streaming services.

Fastly

Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.

Cloudflare

RSS is a family of web feed formats used to publish frequently updated works—such as blog entries, news headlines, audio, and video—in a standardized format.

Open Graph is a protocol that is used to integrate any web page into the social graph.

Open Graph

HTTP/3 is the third major version of the Hypertext Transfer Protocol used to exchange information on the World Wide Web.

severity	service	vulnerability
info	http (port:80)
info	http (port:443)
info	http (port:8080)
info	http (port:8443)

Impact	Description	Documentation
-25		Doc Content Security Policy. L'extension github.com/april/laboratory permet de générer la CSP pour votre application.
-20		Doc header X-Frame-Options.
-5		Doc Subresource Integrity.

https://www.matchid.io

Nmap

Mozilla HTTP observatory9 minutes

SSL

Expiration : 08/11/2024

Nuclei6 minutes

Séverité	Name	Matcher
info	CAA Record	caa-fingerprint
info	HTTPS to HTTP redirect Misconfiguration	https-to-http-redirect
info	Wappalyzer Technology Detection	cloudflare
info	Missing Subresource Integrity	missing-sri
info	WAF Detection	varnish
info	WAF Detection	cloudflare
info	Detect SSL Certificate Issuer	ssl-issuer
info	SSL DNS Names	ssl-dns-names
info	Wildcard TLS Certificate	wildcard-tls
info	TLS Version - Detect	tls-version
info	TLS Version - Detect	tls-version