WE DO IT ALL! – We Do It All
HTTPS
ZIEL_ANALYSE
makofalltrades.us
IP: 192.0.78.24
ASN: AS2635
Ein umfassender Sicherheits- und Netzwerkanalysebericht für makofalltrades.us. Server: nginx. Gehostet in US.
- Hauptport
- 443
- Scan-Zeit
- Teilbarer Bericht-Link
- https://sechttp.com/scan/makofalltrades.us
Detaillierte Sicherheitsanalyse
Angriffspfad- und DDoS-Schutzanalyse
Angreifer
L4-Verkehr
L7-Verkehr
AS2635 (nginx POP)
L4 verteidigt
L7 umgangen
L4 blockiert
L7-Verkehr
Ihr Server
Verteidigungsübersicht
Während nginx robusten Schutz gegen Angriffe der Schicht 4 (Netzwerkebene) bietet, bleibt Ihr Server potenziell anfällig für ausgeklügelte Angriffe der Schicht 7 (Anwendungsebene), die Standard-CDN-Abwehrmechanismen umgehen können. Zusätzliche WAF-Regeln und anwendungsspezifische Sicherheitsmaßnahmen werden empfohlen.
Schicht-4-Verteidigung
nginx bietet robusten Schutz gegen SYN-Flood, UDP-Verstärkung und volumetrische Angriffe an der Netzwerkgrenze.
Schicht-7-Schwachstellen
Anwendungsangriffe, die auf 1 offengelegte API-Endpunkte abzielen, erfordern zusätzliche WAF-Regeln und Ratenbegrenzung.
Offenlegung von Serverinformationen
LOWINFO-001
Beschreibung
Der Server gibt seinen Softwaretyp preis: nginx. Dies kann Angreifern helfen, potenzielle Schwachstellen zu identifizieren.
Empfehlung
Konfigurieren Sie Ihren Webserver so, dass der Server-Header ausgeblendet oder geändert wird, um die Offenlegung von Informationen zu verhindern.
Fehlender X-Frame-Options-Header
MEDIUMSEC-002
Beschreibung
Die Website ist nicht gegen Clickjacking-Angriffe geschützt.
Empfehlung
Fügen Sie den X-Frame-Options-Header mit dem Wert 'DENY' oder 'SAMEORIGIN' hinzu, um Clickjacking zu verhindern.
Offenlegung sensibler Informationen in JavaScript
HIGHJS-001
Beschreibung
Es wurden 23 potenziell sensible Variablen im clientseitigen JavaScript-Code gefunden.
Empfehlung
Überprüfen und entfernen Sie sensible Informationen aus dem clientseitigen Code. Verwenden Sie Umgebungsvariablen und serverseitige Verarbeitung für sensible Daten.
root@sechttp: /var/log/fuzz
root@sechttp : ~ $
> [Code: 200]
/wp-admin/admin-ajax.php [SENSIBLE DATENLECK]
[+] Scan abgeschlossen. Gefunden 1 potenzielle Lecks.
root@sechttp : ~ $
Ergebnisse des Port-Scans
| Port | Dienst | Status | Version |
|---|---|---|---|
| 80 | HTTP | GESCHLOSSEN | - |
| 443 | HTTPS | OFFEN | TLS 1.3 |
| 22 | SSH | GEFILTERT | - |
| 3306 | MySQL | GESCHLOSSEN | - |
HTTP-Header-Analyse
date:
Thu, 11 Sep 2025 16:34:52 GMT
link:
<https://wp.me/gh8B8>; rel=shortlink
vary:
Accept-Encoding, accept, content-type, cookie
x-ac:
20.bur _bur HIT
server:
nginx
alt-svc:
clear
x-hacker:
Want root? Visit join.a8c.com/hacker and mention this header.
connection:
keep-alive
host-header:
WordPress.com
content-type:
text/html; charset=UTF-8
server-timing:
a8c-cdn, dc;desc=bur, cache;desc=HIT;dur=1.0
transfer-encoding:
chunked
strict-transport-security:
max-age=31536000
ASN-Informationen
ASN: AS2635
IP-Adresse: 192.0.78.24
Netzwerkpräfix: 192.0.78.0/24
Organisation: AUTOMATTIC
Land:
🇺🇸 US
Name: AUTOMATTIC
Upstream-Anbieter (21)
AS3356
LEVEL3
Level 3 Parent, LLC
🇺🇸 US
upstream
AS1299
TWELVE99
Arelion, f/k/a Telia Carrier
🇸🇪 SE
upstream
AS2914
NTT-DATA-2914
NTT America, Inc.
🇺🇸 US
upstream
AS6939
HURRICANE
Hurricane Electric LLC
🇺🇸 US
upstream
AS30844
LIQUID-AS
Liquid Telecommunications Ltd
🇬🇧 GB
upstream
AS6461
ZAYO-6461
Zayo Bandwidth
🇺🇸 US
upstream
AS9583
SIFY-AS-IN
Sify Limited
🇮🇳 IN
upstream
AS7195
EDGEUNO S.A.S
EDGEUNO S.A.S
🇨🇴 CO
upstream
AS7922
COMCAST-7922
Comcast Cable Communications, LLC
🇺🇸 US
upstream
AS37100
SEACOM-AS
SEACOM Limited
🇲🇺 MU
upstream
AS133296
WEBWERKS-AS-IN
Web Werks India Pvt. Ltd.
🇮🇳 IN
upstream
AS4
ISI-AS
University of Southern California
🇺🇸 US
upstream
AS3356
LEVEL3
Level 3 Parent, LLC
🇺🇸 US
upstream
AS1299
TWELVE99
Arelion, f/k/a Telia Carrier
🇸🇪 SE
upstream
AS2914
NTT-DATA-2914
NTT America, Inc.
🇺🇸 US
upstream
AS6939
HURRICANE
Hurricane Electric LLC
🇺🇸 US
upstream
AS30844
LIQUID-AS
Liquid Telecommunications Ltd
🇬🇧 GB
upstream
AS9583
SIFY-AS-IN
Sify Limited
🇮🇳 IN
upstream
AS7195
EDGEUNO S.A.S
EDGEUNO S.A.S
🇨🇴 CO
upstream
AS37100
SEACOM-AS
SEACOM Limited
🇲🇺 MU
upstream
AS133296
WEBWERKS-AS-IN
Web Werks India Pvt. Ltd.
🇮🇳 IN
upstream
Internet-Austauschpunkte (52)
🇺🇸
Equinix Dallas
US
100 Gbps
Bandwidth
🇺🇸
Equinix San Jose
US
20 Gbps
Bandwidth
🇩🇪
DE-CIX Frankfurt
DE
100 Gbps
Bandwidth
🇬🇧
LINX LON1
GB
100 Gbps
Bandwidth
🇺🇸
Equinix Ashburn
US
100 Gbps
Bandwidth
🇺🇸
Equinix Chicago
US
100 Gbps
Bandwidth
🇺🇸
Equinix New York
US
10 Gbps
Bandwidth
🇭🇰
Equinix Hong Kong
HK
10 Gbps
Bandwidth
🇳🇱
NL-ix
NL
20 Gbps
Bandwidth
🇳🇱
AMS-IX
NL
20 Gbps
Bandwidth
🇯🇵
Equinix Tokyo
JP
10 Gbps
Bandwidth
🇯🇵
BBIX Tokyo
JP
10 Gbps
Bandwidth
🇦🇺
MegaIX Sydney
AU
10 Gbps
Bandwidth
🇦🇺
MegaIX Melbourne
AU
10 Gbps
Bandwidth
🇦🇺
MegaIX Brisbane
AU
10 Gbps
Bandwidth
🇳🇿
MegaIX Auckland
NZ
10 Gbps
Bandwidth
🇺🇸
Equinix Miami
US
10 Gbps
Bandwidth
🇺🇸
SIX Seattle
US
100 Gbps
Bandwidth
🇺🇸
Any2West
US
10 Gbps
Bandwidth
🇧🇷
IX.br (PTT.br) São Paulo
BR
100 Gbps
Bandwidth
🇸🇬
Equinix Singapore
SG
100 Gbps
Bandwidth
🇸🇬
BBIX Singapore
SG
10 Gbps
Bandwidth
🇺🇸
Digital Realty Atlanta
US
20 Gbps
Bandwidth
🇺🇸
FL-IX
US
100 Gbps
Bandwidth
🇪🇸
ESpanix Madrid Lower LAN
ES
10 Gbps
Bandwidth
🇦🇹
VIX
AT
30 Gbps
Bandwidth
🇿🇦
NAPAfrica IX Johannesburg
ZA
100 Gbps
Bandwidth
🇪🇸
DE-CIX Madrid
ES
10 Gbps
Bandwidth
🇯🇵
JPNAP Tokyo
JP
10 Gbps
Bandwidth
🇯🇵
JPNAP Osaka
JP
10 Gbps
Bandwidth
🇸🇪
Netnod Stockholm GREEN -- MTU1500
SE
10 Gbps
Bandwidth
🇺🇸
DE-CIX New York
US
10 Gbps
Bandwidth
🇸🇪
Netnod Stockholm BLUE -- MTU1500
SE
10 Gbps
Bandwidth
🇺🇸
Any2Denver
US
10 Gbps
Bandwidth
🇫🇷
France-IX Paris
FR
100 Gbps
Bandwidth
🇮🇹
MIX-IT
IT
20 Gbps
Bandwidth
🇭🇰
HKIX
HK
10 Gbps
Bandwidth
🇨🇦
TorIX
CA
20 Gbps
Bandwidth
🇺🇸
NYIIX New York
US
10 Gbps
Bandwidth
🇺🇸
Equinix Ashburn
US
100 Gbps
Bandwidth
🇺🇸
Any2West
US
10 Gbps
Bandwidth
🇮🇳
DE-CIX Mumbai
IN
10 Gbps
Bandwidth
🇦🇺
NSW-IX
AU
10 Gbps
Bandwidth
🇺🇸
CIX-ATL
US
100 Gbps
Bandwidth
🇭🇺
BiX
HU
10 Gbps
Bandwidth
🇯🇵
JPIX OSAKA
JP
10 Gbps
Bandwidth
🇯🇵
JPIX TOKYO
JP
10 Gbps
Bandwidth
🇺🇸
ChIX
US
100 Gbps
Bandwidth
🇮🇳
WSNL-IX
IN
10 Gbps
Bandwidth
🇳🇱
Speed-IX
NL
10 Gbps
Bandwidth
🇺🇸
DE-CIX Dallas
US
100 Gbps
Bandwidth
🇺🇸
DE-CIX Chicago
US
10 Gbps
Bandwidth
JavaScript-Analyse
Security Analysis Alert
Client-side code analysis has identified potential security vulnerabilities and information disclosure risks.
Offengelegte JavaScript-Variablen
Variables exposed in client-side code that may contain sensitive information
# Security Assessment: Variable Exposure Analysis
LEAK
key
t
Risk: Information disclosure via client-side exposure
LEAK
url
t
Risk: Information disclosure via client-side exposure
LEAK
code
n
Risk: Information disclosure via client-side exposure
LEAK
email
l
Risk: Information disclosure via client-side exposure
LEAK
token
t
Risk: Information disclosure via client-side exposure
LEAK
domain
+o)}var r,i;return o},i=function(t,e,n){var o=encodeURIComponent(
Risk: Information disclosure via client-side exposure
LEAK
mailto
+r;case
Risk: Information disclosure via client-side exposure
LEAK
signal
l
Risk: Information disclosure via client-side exposure
LEAK
e.email
icons/mail.svg
Risk: Information disclosure via client-side exposure
LEAK
avatarUrl
d
Risk: Information disclosure via client-side exposure
LEAK
cell_phone
l
Risk: Information disclosure via client-side exposure
LEAK
home_phone
l
Risk: Information disclosure via client-side exposure
LEAK
profileUrl
n
Risk: Information disclosure via client-side exposure
LEAK
work_phone
l
Risk: Information disclosure via client-side exposure
LEAK
recordEvent
function
Risk: Information disclosure via client-side exposure
LEAK
e.cell_phone
icons/mobile-phone.svg
Risk: Information disclosure via client-side exposure
LEAK
e.home_phone
icons/home-phone.svg
Risk: Information disclosure via client-side exposure
LEAK
e.work_phone
icons/work-phone.svg
Risk: Information disclosure via client-side exposure
LEAK
onMissingKey
null
Risk: Information disclosure via client-side exposure
LEAK
onKeyDownTextarea
a
Risk: Information disclosure via client-side exposure
LEAK
handleNumberKeyPress
a
Risk: Information disclosure via client-side exposure
LEAK
generateStyleVariables
t
Risk: Information disclosure via client-side exposure
LEAK
signalAliasUserGeneral
function
Risk: Information disclosure via client-side exposure
Total: 23 exposed variables found
API-Domänenanalyse
External API domains discovered in client-side code
EXTERNAL_API_DOMAIN
s.gravatar.com
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
api.gravatar.com
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
gravatar.com
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
0.gravatar.com
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
pixel.wp.com
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
github.com
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
Entdeckte API-Endpunkte
API endpoints identified through static analysis of client-side code
GET
/wp-admin/admin-ajax.php
Active
Endpoint discovered via client-side code analysis
JavaScript-Ressourcen
JavaScript files loaded by the application
JS
https://s0.wp.com/wp-content/plugins/gutenberg-core/v20.6.0/build/hooks/index.min.js?m=1744959081i&ver=84e753e2b66eb7028d38
JS
https://s0.wp.com/wp-content/plugins/gutenberg-core/v20.6.0/build/i18n/index.min.js?m=1744959081i&ver=bd5a2533e717a1043151
JS
https://s1.wp.com/wp-content/js/rlt-proxy.js?m=1720530689i
JS
https://s1.wp.com/wp-content/plugins/gutenberg-core/v20.6.0/build-module/block-library/navigation/view.min.js?ver=38dd13322236f359c8a9
JS
https://s2.wp.com/wp-content/mu-plugins/jetpack-plugin/moon/jetpack_vendor/automattic/jetpack-forms/dist/modules/form/view.js?ver=15.1-a.0
JS
//0.gravatar.com/js/hovercards/hovercards.min.js?ver=202536924dcd77a86c6f1d3698ec27fc5da92b28585ddad3ee636c0397cf312193b2a1
JS
https://s2.wp.com/wp-content/mu-plugins/gravatar-hovercards/wpgroho.js?m=1610363240i
JS
https://s1.wp.com/wp-includes/js/dist/vendor/wp-polyfill.min.js?m=1744646400i
JS
https://s2.wp.com/wp-content/mu-plugins/jetpack-plugin/moon/jetpack_vendor/automattic/jetpack-forms/dist/blocks/view.js?m=1757006095i&minify=false&ver=5082ee0cbdcde811f7c1
JS
https://s2.wp.com/wp-content/mu-plugins/jetpack-plugin/moon/_inc/blocks/business-hours/view.js?m=1725888675i&minify=false&ver=15.1-a.0
JS
//stats.wp.com/w.js?68
JS
/wp-content/js/bilmur.min.js?i=15&m=202536
JS
"https://s0.wp.com/wp-content/plugins/gutenberg-core/v20.6.0/build/hooks/index.min.js?m=1744959081i&ver=84e753e2b66eb7028d38"
JS
"https://s0.wp.com/wp-content/plugins/gutenberg-core/v20.6.0/build/i18n/index.min.js?m=1744959081i&ver=bd5a2533e717a1043151"
JS
'https://s1.wp.com/wp-content/js/rlt-proxy.js?m=1720530689i'
JS
"https://s1.wp.com/wp-content/plugins/gutenberg-core/v20.6.0/build-module/block-library/navigation/view.min.js?ver=38dd13322236f359c8a9"
JS
"https://s2.wp.com/wp-content/mu-plugins/jetpack-plugin/moon/jetpack_vendor/automattic/jetpack-forms/dist/modules/form/view.js?ver=15.1-a.0"
JS
"//0.gravatar.com/js/hovercards/hovercards.min.js?ver=202536924dcd77a86c6f1d3698ec27fc5da92b28585ddad3ee636c0397cf312193b2a1"
JS
'https://s2.wp.com/wp-content/mu-plugins/gravatar-hovercards/wpgroho.js?m=1610363240i'
JS
'https://s1.wp.com/wp-includes/js/dist/vendor/wp-polyfill.min.js?m=1744646400i'
JS
"https://s2.wp.com/wp-content/mu-plugins/jetpack-plugin/moon/jetpack_vendor/automattic/jetpack-forms/dist/blocks/view.js?m=1757006095i&minify=false&ver=5082ee0cbdcde811f7c1"
JS
"https://s2.wp.com/wp-content/mu-plugins/jetpack-plugin/moon/_inc/blocks/business-hours/view.js?m=1725888675i&minify=false&ver=15.1-a.0"
JS
"//stats.wp.com/w.js?68"
JS
"/wp-content/js/bilmur.min.js?i=15&m=202536"
Sicherheitsempfehlungen
- • Avoid exposing sensitive variables in client-side code
- • Implement proper API authentication and rate limiting
- • Use environment variables for sensitive configuration
- • Regularly audit client-side code for information leaks
- • Minimize the amount of sensitive data processed on the client side
Historische Scan-Aufzeichnungen (1)
We Do It All
65/100
4 issues