Deglingo Scout — Outil d'analyse Sorare SO7

HTTPS

ZIEL_ANALYSE

scout.deglingosorare.com

IP: 0.0.0.0

ASN: AS0

Ein umfassender Sicherheits- und Netzwerkanalysebericht für scout.deglingosorare.com. Server: cloudflare.

Hauptport: 443
Scan-Zeit: 4/12/2026, 7:26:36 PM
Teilbarer Bericht-Link: https://sechttp.com/scan/scout.deglingosorare.com

Detaillierte Sicherheitsanalyse

Angriffspfad- und DDoS-Schutzanalyse

Angreifer

L4-Verkehr

L7-Verkehr

AS0 (cloudflare POP)

L4 verteidigt

L7 umgangen

L4 blockiert

L7-Verkehr

Ihr Server

Verteidigungsübersicht

Während cloudflare robusten Schutz gegen Angriffe der Schicht 4 (Netzwerkebene) bietet, bleibt Ihr Server potenziell anfällig für ausgeklügelte Angriffe der Schicht 7 (Anwendungsebene), die Standard-CDN-Abwehrmechanismen umgehen können. Zusätzliche WAF-Regeln und anwendungsspezifische Sicherheitsmaßnahmen werden empfohlen.

Schicht-4-Verteidigung

cloudflare bietet robusten Schutz gegen SYN-Flood, UDP-Verstärkung und volumetrische Angriffe an der Netzwerkgrenze.

Schicht-7-Schwachstellen

Anwendungsangriffe, die auf 9 offengelegte API-Endpunkte abzielen, erfordern zusätzliche WAF-Regeln und Ratenbegrenzung.

Offenlegung von Serverinformationen

LOW

INFO-001

Beschreibung

Der Server gibt seinen Softwaretyp preis: cloudflare. Dies kann Angreifern helfen, potenzielle Schwachstellen zu identifizieren.

Empfehlung

Konfigurieren Sie Ihren Webserver so, dass der Server-Header ausgeblendet oder geändert wird, um die Offenlegung von Informationen zu verhindern.

Fehlender oder ungültiger HSTS-Header

MEDIUM

SEC-001

Beschreibung

Der Strict-Transport-Security-Header ist nicht richtig konfiguriert, wodurch die Website anfällig für Man-in-the-Middle-Angriffe ist.

Empfehlung

Implementieren Sie HSTS, indem Sie den Strict-Transport-Security-Header mit einem geeigneten max-age-Wert hinzufügen, um HTTPS-Verbindungen zu erzwingen.

Fehlender X-Frame-Options-Header

MEDIUM

SEC-002

Beschreibung

Die Website ist nicht gegen Clickjacking-Angriffe geschützt.

Empfehlung

Fügen Sie den X-Frame-Options-Header mit dem Wert 'DENY' oder 'SAMEORIGIN' hinzu, um Clickjacking zu verhindern.

Offenlegung sensibler Informationen in JavaScript

HIGH

JS-001

Beschreibung

Es wurden 30 potenziell sensible Variablen im clientseitigen JavaScript-Code gefunden.

Empfehlung

Überprüfen und entfernen Sie sensible Informationen aus dem clientseitigen Code. Verwenden Sie Umgebungsvariablen und serverseitige Verarbeitung für sensible Daten.

root@sechttp: /var/log/fuzz

 root@sechttp : ~ $ 
 >  [Code: 200]  
/api/sorare/cards [SENSIBLE DATENLECK]  
 >  [Code: 403]  
/api/sorare/cards?rawq=%7BcurrentUser%7Bslug%20nickname%7D%7D  [VERBOTEN] 
 >  [Code: 404]  
/api/sorare/cards?rawq=%7BcurrentUser%7Bslug%20nickname%20cards(first%3A50%2Csport%3AFOOTBALL)%7Bnodes%7Bslug%20name%20rarityTyped%20pictureUrl%20power%20cardEditionName%20...%20on%20Card%7Bplayer%7Bslug%20displayName%20position%7D%7D%7DpageInfo%7BhasNextPage%20endCursor%7D%7D%7D%7D   
 >  [Code: 200]  
/api/sorare/cards?rawq=query(%24a%3AString!)%7BcurrentUser%7Bcards(first%3A50%2Csport%3AFOOTBALL%2Cafter%3A%24a)%7Bnodes%7Bslug%20name%20rarityTyped%20pictureUrl%20power%20cardEditionName%20...%20on%20Card%7Bplayer%7Bslug%20displayName%20position%7D%7D%7DpageInfo%7BhasNextPage%20endCursor%7D%7D%7D%7D&vars=${encodeURIComponent(JSON.stringify({a:u}))} [SENSIBLE DATENLECK]  
 >  [Code: 403]  
/data/players.json  [VERBOTEN] 
 >  [Code: 404]  
/data/teams.json   
 >  [Code: 200]  
/data/fixtures.json [SENSIBLE DATENLECK]  
 >  [Code: 403]  
/data/club_logos.json  [VERBOTEN] 
 >  [Code: 404]  
/data/match_events.json   
 [+] Scan abgeschlossen. Gefunden 3 potenzielle Lecks. 
root@sechttp:~$

Ergebnisse des Port-Scans

   Port Dienst Status Version 
HTTP  GESCHLOSSEN   -  
HTTPS  OFFEN   TLS 1.3  
SSH  GEFILTERT   -  
MySQL  GESCHLOSSEN   -  
  

Port	Dienst	Status	Version
80	HTTP	GESCHLOSSEN	-
443	HTTPS	OFFEN	TLS 1.3
22	SSH	GEFILTERT	-
3306	MySQL	GESCHLOSSEN	-

HTTP-Header-Analyse

nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800} 
date: Sun, 12 Apr 2026 19:26:26 GMT 
link: <https://fonts.googleapis.com>; rel="preconnect" 
cf-ray: 9eb49f679994cba0-LAX 
server: cloudflare 
alt-svc: h3=":443"; ma=86400 
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=BNaY4IYs9ZJHNr5%2B%2F%2BQKf8XJ5mfFQO1R%2BgSnE7on5ClIKKyhxVBhSSum%2Fg3dpMpz4wCcG%2FAtMRX92QFyUqn%2B2aTiSdm4g6uCB34KsmXwGl1ULexHw3%2BSe27PsznAdcPieH0ZwncUnC0roFg%3D"}]} 
connection: keep-alive 
content-type: text/html; charset=utf-8 
cache-control: public, max-age=0, must-revalidate 
server-timing: cfCacheStatus;desc="DYNAMIC", cfEdge;dur=16,cfOrigin;dur=37 
cf-cache-status: DYNAMIC 
referrer-policy: strict-origin-when-cross-origin 
transfer-encoding: chunked 
x-content-type-options: nosniff 
access-control-allow-origin: * 

Derzeit in der Testphase

Peering-Informationen werden analysiert.

Derzeit in der Testphase

Daten zu Internet-Austauschpunkten werden gesammelt.

JavaScript-Analyse

Security Analysis Alert

Client-side code analysis has identified potential security vulnerabilities and information disclosure risks.

Offengelegte JavaScript-Variablen

30 Found

Variables exposed in client-side code that may contain sensitive information

# Security Assessment: Variable Exposure Analysis
 
LEAK
 
key
 g 

Risk: Information disclosure via client-side exposure
 
LEAK
 
url
 e 

Risk: Information disclosure via client-side exposure
 
LEAK
 
code
 e 

Risk: Information disclosure via client-side exposure
 
LEAK
 
side
 e 

Risk: Information disclosure via client-side exposure
 
LEAK
 
OAuth
 state 

Risk: Information disclosure via client-side exposure
 
LEAK
 
gwKey
 l 

Risk: Information disclosure via client-side exposure
 
LEAK
 
Upside
 as 

Risk: Information disclosure via client-side exposure
 
LEAK
 
altKey
 0 

Risk: Information disclosure via client-side exposure
 
LEAK
 
colKey
 t 

Risk: Information disclosure via client-side exposure
 
LEAK
 
upside
 lots 

Risk: Information disclosure via client-side exposure
 
LEAK
 
clientX
 0 

Risk: Information disclosure via client-side exposure
 
LEAK
 
clientY
 0 

Risk: Information disclosure via client-side exposure
 
LEAK
 
ctrlKey
 0 

Risk: Information disclosure via client-side exposure
 
LEAK
 
keyCode
 0 

Risk: Information disclosure via client-side exposure
 
LEAK
 
metaKey
 0 

Risk: Information disclosure via client-side exposure
 
LEAK
 
charCode
 function 

Risk: Information disclosure via client-side exposure
 
LEAK
 
gwNumber
 c 

Risk: Information disclosure via client-side exposure
 
LEAK
 
shiftKey
 0 

Risk: Information disclosure via client-side exposure
 
LEAK
 
endDateStr
 d 

Risk: Information disclosure via client-side exposure
 
LEAK
 
pictureUrl
 e 

Risk: Information disclosure via client-side exposure
 
LEAK
 
cacheSignal
 function 

Risk: Information disclosure via client-side exposure
 
LEAK
 
startDateStr
 u 

Risk: Information disclosure via client-side exposure
 
LEAK
 
aa_possession
 20 

Risk: Information disclosure via client-side exposure
 
LEAK
 
displayNumber
 r 

Risk: Information disclosure via client-side exposure
 
LEAK
 
sorare_pro_url
 t 

Risk: Information disclosure via client-side exposure
 
LEAK
 
O.aa_possession
 20 

Risk: Information disclosure via client-side exposure
 
LEAK
 
addEventListener
 function 

Risk: Information disclosure via client-side exposure
 
LEAK
 
sorare_stellar_url
 t 

Risk: Information disclosure via client-side exposure
 
LEAK
 
stellar_shiny_jersey_number
 20 

Risk: Information disclosure via client-side exposure
 
LEAK
 
Ve.stellar_shiny_jersey_number
 20 

Risk: Information disclosure via client-side exposure
 
Total: 30 exposed variables found

API-Domänenanalyse

9 Domains

External API domains discovered in client-side code

EXTERNAL_API_DOMAIN

react.dev

Reachable

HTTPS Enabled

Security Note:

External API domains should be validated for proper authentication and rate limiting

EXTERNAL_API_DOMAIN

flagcdn.com

Reachable

HTTPS Enabled

Security Note:

External API domains should be validated for proper authentication and rate limiting

EXTERNAL_API_DOMAIN

deglingo-fight-counter.damien-gheza.workers.dev

Reachable

HTTPS Enabled

Security Note:

External API domains should be validated for proper authentication and rate limiting

EXTERNAL_API_DOMAIN

sorare.pxf.io

Reachable

HTTPS Enabled

Security Note:

External API domains should be validated for proper authentication and rate limiting

EXTERNAL_API_DOMAIN

scout.deglingosorare.com

Reachable

HTTPS Enabled

Security Note:

External API domains should be validated for proper authentication and rate limiting

EXTERNAL_API_DOMAIN

sorare.com

Reachable

HTTPS Enabled

Security Note:

External API domains should be validated for proper authentication and rate limiting

EXTERNAL_API_DOMAIN

assets.sorare.com

Reachable

HTTPS Enabled

Security Note:

External API domains should be validated for proper authentication and rate limiting

EXTERNAL_API_DOMAIN

cloudflareinsights.com

Reachable

HTTPS Enabled

Security Note:

External API domains should be validated for proper authentication and rate limiting

EXTERNAL_API_DOMAIN

github.com

Reachable

HTTPS Enabled

Security Note:

External API domains should be validated for proper authentication and rate limiting

Entdeckte API-Endpunkte

9 Routes

API endpoints identified through static analysis of client-side code

GET /api/sorare/cards

Active