Timuçin Orhon | UI/UX Designer | Web Designer | Adwords Specialist | E-Commerce
HTTPS
ANÁLISIS_OBJETIVO
www.timucinorhon.com
IP: 34.149.87.45
ASN: AS396982
Un informe completo de análisis de seguridad y red para www.timucinorhon.com. Servidor: Pepyaka. Alojado en US.
- Puerto Principal
- 443
- Tiempo de Escaneo
- Enlace de Informe Compartible
- https://sechttp.com/scan/www.timucinorhon.com
Análisis de Seguridad Detallado
Análisis de Ruta de Ataque y Defensa contra DDoS
Atacante
Tráfico L4
Tráfico L7
AS396982 (Pepyaka POP)
L4 Defendido
L7 Evadido
L4 Bloqueado
Tráfico L7
Su Servidor
Resumen de Defensa
Aunque Pepyaka proporciona una protección robusta contra ataques de capa 4 (nivel de red), su servidor sigue siendo potencialmente vulnerable a ataques sofisticados de capa 7 (nivel de aplicación) que pueden eludir las defensas estándar de CDN. Se recomiendan reglas WAF adicionales y medidas de seguridad en el lado de la aplicación.
Defensa de Capa 4
Pepyaka proporciona una protección robusta contra inundaciones SYN, amplificación UDP y ataques volumétricos en el borde de la red.
Vulnerabilidades de Capa 7
Los ataques de capa de aplicación dirigidos a puntos finales de API expuestos de 2 requieren reglas WAF adicionales y limitación de velocidad.
Divulgación de Información del Servidor
LOWINFO-001
Descripción
El servidor está divulgando su tipo de software: Pepyaka. Esto puede ayudar a los atacantes a identificar vulnerabilidades potenciales.
Recomendación
Configure su servidor web para ocultar o modificar el encabezado Server para evitar la divulgación de información.
Encabezado X-Frame-Options Faltante
MEDIUMSEC-002
Descripción
El sitio no está protegido contra ataques de clickjacking.
Recomendación
Agregue el encabezado X-Frame-Options con el valor 'DENY' o 'SAMEORIGIN' para prevenir el clickjacking.
Exposición de Información Sensible en JavaScript
HIGHJS-001
Descripción
Se encontraron 235 variables potencialmente sensibles expuestas en el código JavaScript del lado del cliente.
Recomendación
Revise y elimine la información sensible del código del lado del cliente. Use variables de entorno y procesamiento del lado del servidor para datos sensibles.
root@sechttp: /var/log/fuzz
root@sechttp : ~ $
> [Code: 200]
/api/wix-sm/v1/members/${e}/role [FUGA SENSIBLE]
> [Code: 403]
https://panorama.wixapps.net/api/v1/bulklog [PROHIBIDO]
[+] Escaneo completado. Encontrado 1 fugas potenciales.
root@sechttp : ~ $
Resultados del Escaneo de Puertos
| Puerto | Servicio | Estado | Versión |
|---|---|---|---|
| 80 | HTTP | CERRADO | - |
| 443 | HTTPS | ABIERTO | TLS 1.3 |
| 22 | SSH | FILTRADO | - |
| 3306 | MySQL | CERRADO | - |
Análisis de Encabezados HTTP
age:
11
via:
1.1 google
date:
Thu, 11 Sep 2025 16:35:54 GMT
etag:
W/"94bd9c8d95ff5aa233c987d495788714"
link:
<https://static.parastorage.com/>; rel=preconnect; crossorigin;,<https://static.parastorage.com/>; rel=preconnect;,<https://static.wixstatic.com/>; rel=preconnect; crossorigin;,<https://static.wixstatic.com/>; rel=preconnect;,<https://siteassets.parastorage.com>; rel=preconnect; crossorigin;,
vary:
Accept-Encoding
server:
Pepyaka
alt-svc:
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-cache:
HIT
x-seen-by:
yvSunuo/8ld62ehjr5B7kA==
set-cookie:
ssr-caching=cache#desc=miss#varnish=miss_hit#dc#desc=fastly_g; max-age=20
x-served-by:
cache-lax-kwhp1940098-LAX
content-type:
text/html; charset=UTF-8
accept-ranges:
bytes
cache-control:
public,max-age=0,must-revalidate
glb-x-seen-by:
bS8wRlGzu0Hc+WrYuHB8QIg44yfcdCMJRkBoQ1h6Vjc=
server-timing:
cache;desc=miss, varnish;desc=miss_hit, dc;desc=fastly_g
content-length:
748425
html-cacheable:
true
content-language:
en
x-wix-request-id:
1757608554.477435193897125831
x-content-type-options:
nosniff
strict-transport-security:
max-age=86400
Información ASN
ASN: AS396982
Dirección IP: 34.149.87.45
Prefijo de Red: 34.148.0.0/14
Organización: GOOGLE-CLOUD-PLATFORM
País:
🇺🇸 US
Nombre: GOOGLE-CLOUD-PLATFORM
Proveedores Ascendentes (3)
AS15169
GOOGLE
Google LLC
🇺🇸 US
upstream
AS19527
GOOGLE-2
Google LLC
🇺🇸 US
upstream
AS15169
GOOGLE
Google LLC
🇺🇸 US
upstream
Puntos de Intercambio de Internet (4)
🇸🇦
SAIX Saudi Arabia Riyadh
SA
100 Gbps
Bandwidth
🇸🇦
center3 IX Jeddah
SA
20 Gbps
Bandwidth
🇸🇦
SAIX Saudi Arabia Riyadh
SA
100 Gbps
Bandwidth
🇸🇦
center3 IX Jeddah
SA
20 Gbps
Bandwidth
Análisis de JavaScript
Security Analysis Alert
Client-side code analysis has identified potential security vulnerabilities and information disclosure risks.
Variables de JavaScript Expuestas
Variables exposed in client-side code that may contain sensitive information
# Security Assessment: Variable Exposure Analysis
LEAK
URL
.concat(t)),n}return Bt(t,e),t}(Ht),Gt=function(e){function t(t,r){var n=e.call(this,t.message,{cause:t})||this;return r&&(n.stack=Ut(n.stack,
Risk: Information disclosure via client-side exposure
LEAK
key
function
Risk: Information disclosure via client-side exposure
LEAK
url
"//frog.wix.com/bolt-performance?src=72&evid="+evid+"&appName="+fedOpsAppName+"&is_rollout="+is_rollout+"&is_sav_rollout="+is_sav_rollout+"&is_dac_rollout="+is_dac_rollout+"&dc="+site.dc+"&msid="+site...
Risk: Information disclosure via client-side exposure
LEAK
TEST
test
Risk: Information disclosure via client-side exposure
LEAK
code
Client
Risk: Information disclosure via client-side exposure
LEAK
keys
function
Risk: Information disclosure via client-side exposure
LEAK
msId
n
Risk: Information disclosure via client-side exposure
LEAK
msid
+site.metaSiteId+
Risk: Information disclosure via client-side exposure
LEAK
side
a
Risk: Information disclosure via client-side exposure
LEAK
sign
n
Risk: Information disclosure via client-side exposure
LEAK
appId
e
Risk: Information disclosure via client-side exposure
LEAK
keyBy
function
Risk: Information disclosure via client-side exposure
LEAK
keyOf
function
Risk: Information disclosure via client-side exposure
LEAK
toKey
function
Risk: Information disclosure via client-side exposure
LEAK
DESIGN
design_data
Risk: Information disclosure via client-side exposure
LEAK
MOBILE
return
Risk: Information disclosure via client-side exposure
LEAK
Mobile
mobile
Risk: Information disclosure via client-side exposure
LEAK
Number
[sechttp]
Risk: Information disclosure via client-side exposure
LEAK
SIGNUP
register
Risk: Information disclosure via client-side exposure
LEAK
altKey
0
Risk: Information disclosure via client-side exposure
LEAK
assign
function
Risk: Information disclosure via client-side exposure
LEAK
client
.concat(e));return o.meter(
Risk: Information disclosure via client-side exposure
LEAK
codeAt
N3
Risk: Information disclosure via client-side exposure
LEAK
cookie
r
Risk: Information disclosure via client-side exposure
LEAK
decode
C
Risk: Information disclosure via client-side exposure
LEAK
domain
kt
Risk: Information disclosure via client-side exposure
LEAK
encode
R
Risk: Information disclosure via client-side exposure
LEAK
inpUrl
vt
Risk: Information disclosure via client-side exposure
LEAK
keyFor
function
Risk: Information disclosure via client-side exposure
LEAK
lcpUrl
i
Risk: Information disclosure via client-side exposure
LEAK
SIGN_UP
signupTPA
Risk: Information disclosure via client-side exposure
LEAK
baseUrl
t
Risk: Information disclosure via client-side exposure
LEAK
clientX
0
Risk: Information disclosure via client-side exposure
LEAK
clientY
0
Risk: Information disclosure via client-side exposure
LEAK
ctrlKey
0
Risk: Information disclosure via client-side exposure
LEAK
decoder
a
Risk: Information disclosure via client-side exposure
LEAK
encoder
null
Risk: Information disclosure via client-side exposure
LEAK
fastKey
function
Risk: Information disclosure via client-side exposure
LEAK
findKey
function
Risk: Information disclosure via client-side exposure
LEAK
keyCode
0
Risk: Information disclosure via client-side exposure
LEAK
mapKeys
function
Risk: Information disclosure via client-side exposure
LEAK
metaKey
0
Risk: Information disclosure via client-side exposure
LEAK
ownKeys
n
Risk: Information disclosure via client-side exposure
LEAK
pageUrl
i
Risk: Information disclosure via client-side exposure
LEAK
release
g
Risk: Information disclosure via client-side exposure
LEAK
signbit
function
Risk: Information disclosure via client-side exposure
LEAK
siteUrl
e
Risk: Information disclosure via client-side exposure
LEAK
unicode
e
Risk: Information disclosure via client-side exposure
LEAK
BAD_CODE
EMAIL_VERIFICATION_FAILED
Risk: Information disclosure via client-side exposure
LEAK
PASSWORD
31fff8fc-ea95-43ac-95c5-902497125b90
Risk: Information disclosure via client-side exposure
LEAK
baseURLs
t
Risk: Information disclosure via client-side exposure
LEAK
charCode
function
Risk: Information disclosure via client-side exposure
LEAK
clientId
_wixCIDX
Risk: Information disclosure via client-side exposure
LEAK
endpoint
<empty_value>
Risk: Information disclosure via client-side exposure
LEAK
envFetch
r
Risk: Information disclosure via client-side exposure
LEAK
fetchApi
i
Risk: Information disclosure via client-side exposure
LEAK
getAppId
D
Risk: Information disclosure via client-side exposure
LEAK
isMobile
s
Risk: Information disclosure via client-side exposure
LEAK
password
VLa
Risk: Information disclosure via client-side exposure
LEAK
r.SIGNUP
register
Risk: Information disclosure via client-side exposure
LEAK
shiftKey
0
Risk: Information disclosure via client-side exposure
LEAK
testMode
y
Risk: Information disclosure via client-side exposure
LEAK
u.MOBILE
MOBILE
Risk: Information disclosure via client-side exposure
LEAK
EmailLink
EmailLink
Risk: Information disclosure via client-side exposure
LEAK
PhoneLink
PhoneLink
Risk: Information disclosure via client-side exposure
LEAK
client_id
h
Risk: Information disclosure via client-side exposure
LEAK
codePoint
c
Risk: Information disclosure via client-side exposure
LEAK
editorKey
t
Risk: Information disclosure via client-side exposure
LEAK
i.SIGN_UP
signupTPA
Risk: Information disclosure via client-side exposure
LEAK
iframeUrl
[XSS working]
Risk: Information disclosure via client-side exposure
LEAK
parsedUrl
h
Risk: Information disclosure via client-side exposure
LEAK
sessionId
Yr
Risk: Information disclosure via client-side exposure
LEAK
toUnicode
function
Risk: Information disclosure via client-side exposure
LEAK
updateURL
function
Risk: Information disclosure via client-side exposure
LEAK
CODE_LOGIN
editor-members-code-login
Risk: Information disclosure via client-side exposure
LEAK
EMAIL_LINK
EmailLink
Risk: Information disclosure via client-side exposure
LEAK
PHONE_LINK
PhoneLink
Risk: Information disclosure via client-side exposure
LEAK
R.PASSWORD
31fff8fc-ea95-43ac-95c5-902497125b90
Risk: Information disclosure via client-side exposure
LEAK
baseClient
o
Risk: Information disclosure via client-side exposure
LEAK
c.BAD_CODE
EMAIL_VERIFICATION_FAILED
Risk: Information disclosure via client-side exposure
LEAK
codePoints
function
Risk: Information disclosure via client-side exposure
LEAK
deviceInfo
m
Risk: Information disclosure via client-side exposure
LEAK
deviceType
e
Risk: Information disclosure via client-side exposure
LEAK
httpClient
Mr
Risk: Information disclosure via client-side exposure
LEAK
pageNumber
r
Risk: Information disclosure via client-side exposure
LEAK
requestUrl
n
Risk: Information disclosure via client-side exposure
LEAK
session_id
+site.sessionId+
Risk: Information disclosure via client-side exposure
LEAK
CODE_SIGNUP
members-code-signup
Risk: Information disclosure via client-side exposure
LEAK
DEVELOPMENT
development
Risk: Information disclosure via client-side exposure
LEAK
codePointAt
function
Risk: Information disclosure via client-side exposure
LEAK
credentials
include
Risk: Information disclosure via client-side exposure
LEAK
csmCacheKey
t
Risk: Information disclosure via client-side exposure
LEAK
environment
P
Risk: Information disclosure via client-side exposure
LEAK
fileRepoUrl
t
Risk: Information disclosure via client-side exposure
LEAK
pageJsonUrl
y
Risk: Information disclosure via client-side exposure
LEAK
relativeUrl
_
Risk: Information disclosure via client-side exposure
LEAK
s.EmailLink
EmailLink
Risk: Information disclosure via client-side exposure
LEAK
s.PhoneLink
PhoneLink
Risk: Information disclosure via client-side exposure
LEAK
sessionTime
o
Risk: Information disclosure via client-side exposure
LEAK
status_code
n
Risk: Information disclosure via client-side exposure
LEAK
urlMappings
e
Risk: Information disclosure via client-side exposure
LEAK
urlOverride
E
Risk: Information disclosure via client-side exposure
LEAK
ACCESS_DENID
-19956
Risk: Information disclosure via client-side exposure
LEAK
CODE_INVALID
EMAIL_VERIFICATION_REQUIRED
Risk: Information disclosure via client-side exposure
LEAK
DESIGN_QUERY
designQuery
Risk: Information disclosure via client-side exposure
LEAK
DOMTokenList
1
Risk: Information disclosure via client-side exposure
LEAK
MOBILE_HINTS
mobile_hints
Risk: Information disclosure via client-side exposure
LEAK
VERIFY_TOKEN
apply-session-token
Risk: Information disclosure via client-side exposure
LEAK
a.EMAIL_LINK
EmailLink
Risk: Information disclosure via client-side exposure
LEAK
a.PHONE_LINK
PhoneLink
Risk: Information disclosure via client-side exposure
LEAK
compositeKey
function
Risk: Information disclosure via client-side exposure
LEAK
deviceMemory
navigator
Risk: Information disclosure via client-side exposure
LEAK
getPublicUrl
function
Risk: Information disclosure via client-side exposure
LEAK
getSessionId
function
Risk: Information disclosure via client-side exposure
LEAK
getWindowUrl
n
Risk: Information disclosure via client-side exposure
LEAK
isServerSide
1
Risk: Information disclosure via client-side exposure
LEAK
mediaRootUrl
t
Risk: Information disclosure via client-side exposure
LEAK
stdDeviation
${e}
Risk: Information disclosure via client-side exposure
LEAK
wixBiSession
Mt
Risk: Information disclosure via client-side exposure
LEAK
EXPIRED_TOKEN
expiredTokenTPA
Risk: Information disclosure via client-side exposure
LEAK
SVGNumberList
0
Risk: Information disclosure via client-side exposure
LEAK
SlideVertical
600
Risk: Information disclosure via client-side exposure
LEAK
clientSpecMap
a
Risk: Information disclosure via client-side exposure
LEAK
enableTestApi
n
Risk: Information disclosure via client-side exposure
LEAK
fromCodePoint
function
Risk: Information disclosure via client-side exposure
LEAK
getSvgBaseUrl
e
Risk: Information disclosure via client-side exposure
LEAK
isUrlMigrated
o
Risk: Information disclosure via client-side exposure
LEAK
mainGridAppId
l
Risk: Information disclosure via client-side exposure
LEAK
moduleRepoUrl
n
Risk: Information disclosure via client-side exposure
LEAK
siteAssetsUrl
n
Risk: Information disclosure via client-side exposure
LEAK
t.environment
500
Risk: Information disclosure via client-side exposure
LEAK
urlMappingKey
e
Risk: Information disclosure via client-side exposure
LEAK
ClientRectList
0
Risk: Information disclosure via client-side exposure
LEAK
DEFAULT_SIGNUP
members-default-signup
Risk: Information disclosure via client-side exposure
LEAK
GET_VIEWER_API
getViewerApi
Risk: Information disclosure via client-side exposure
LEAK
RESET_PASSWORD
resetPasswordTPA
Risk: Information disclosure via client-side exposure
LEAK
WRONG_PASSWORD
-17005
Risk: Information disclosure via client-side exposure
LEAK
authentication
e
Risk: Information disclosure via client-side exposure
LEAK
c.ACCESS_DENID
-19956
Risk: Information disclosure via client-side exposure
LEAK
c.CODE_INVALID
EMAIL_VERIFICATION_REQUIRED
Risk: Information disclosure via client-side exposure
LEAK
clientTopology
t
Risk: Information disclosure via client-side exposure
LEAK
staticMediaUrl
r
Risk: Information disclosure via client-side exposure
LEAK
urlFormatModel
p
Risk: Information disclosure via client-side exposure
LEAK
wixCodePageIds
u
Risk: Information disclosure via client-side exposure
LEAK
FORGOT_PASSWORD
forgotPasswordTPA
Risk: Information disclosure via client-side exposure
LEAK
MozPrintableKey
Unidentified
Risk: Information disclosure via client-side exposure
LEAK
URLSearchParams
R
Risk: Information disclosure via client-side exposure
LEAK
createObjectURL
[sechttp]
Risk: Information disclosure via client-side exposure
LEAK
decodeDotInKeys
a
Risk: Information disclosure via client-side exposure
LEAK
decodedBodySize
t
Risk: Information disclosure via client-side exposure
LEAK
encodeDotInKeys
f
Risk: Information disclosure via client-side exposure
LEAK
externalBaseUrl
n
Risk: Information disclosure via client-side exposure
LEAK
getMetadataKeys
function
Risk: Information disclosure via client-side exposure
LEAK
i.EXPIRED_TOKEN
expiredTokenTPA
Risk: Information disclosure via client-side exposure
LEAK
isPremiumDomain
l
Risk: Information disclosure via client-side exposure
LEAK
loadEnvironment
r
Risk: Information disclosure via client-side exposure
LEAK
loadModuleByUrl
[sechttp]
Risk: Information disclosure via client-side exposure
LEAK
longTasksNumber
s
Risk: Information disclosure via client-side exposure
LEAK
r.SlideVertical
600
Risk: Information disclosure via client-side exposure
LEAK
revokeObjectURL
[sechttp]
Risk: Information disclosure via client-side exposure
LEAK
viewerSessionId
p
Risk: Information disclosure via client-side exposure
LEAK
PASSWORD_RESETED
-19973
Risk: Information disclosure via client-side exposure
LEAK
addEventListener
t
Risk: Information disclosure via client-side exposure
LEAK
c.WRONG_PASSWORD
-17005
Risk: Information disclosure via client-side exposure
LEAK
clientSideRender
s
Risk: Information disclosure via client-side exposure
LEAK
currentParsedUrl
p
Risk: Information disclosure via client-side exposure
LEAK
encodeValuesOnly
f
Risk: Information disclosure via client-side exposure
LEAK
i.RESET_PASSWORD
resetPasswordTPA
Risk: Information disclosure via client-side exposure
LEAK
r.GET_VIEWER_API
getViewerApi
Risk: Information disclosure via client-side exposure
LEAK
siteAssetsClient
Lr
Risk: Information disclosure via client-side exposure
LEAK
updatePageNumber
t
Risk: Information disclosure via client-side exposure
LEAK
ACCESS_RESTRICTED
accessRestrictedTPA
Risk: Information disclosure via client-side exposure
LEAK
GET_CLIENT_WORKER
get-client-worker
Risk: Information disclosure via client-side exposure
LEAK
VERIFICATION_CODE
verification-code
Risk: Information disclosure via client-side exposure
LEAK
i.FORGOT_PASSWORD
forgotPasswordTPA
Risk: Information disclosure via client-side exposure
LEAK
isClientSdkOnSite
b
Risk: Information disclosure via client-side exposure
LEAK
mobileActionsMenu
o
Risk: Information disclosure via client-side exposure
LEAK
publicEnvironment
P
Risk: Information disclosure via client-side exposure
LEAK
sentryEnvironment
l
Risk: Information disclosure via client-side exposure
LEAK
EMAIL_CONFIRMATION
emailConfirmationTPA
Risk: Information disclosure via client-side exposure
LEAK
EMAIL_NOT_PROVIDED
-18880
Risk: Information disclosure via client-side exposure
LEAK
INIT_DS_VIEWER_API
init_ds_viewerApi
Risk: Information disclosure via client-side exposure
LEAK
MOBILE_HINTS_QUERY
mobileHintsQuery
Risk: Information disclosure via client-side exposure
LEAK
WRONG_AUTH_DETAILS
-19976
Risk: Information disclosure via client-side exposure
LEAK
c.PASSWORD_RESETED
-19973
Risk: Information disclosure via client-side exposure
LEAK
fl.MozPrintableKey
Unidentified
Risk: Information disclosure via client-side exposure
LEAK
getOwnMetadataKeys
function
Risk: Information disclosure via client-side exposure
LEAK
persistentEndpoint
this
Risk: Information disclosure via client-side exposure
LEAK
relativeEncodedUrl
o
Risk: Information disclosure via client-side exposure
LEAK
accessTokensHandler
c
Risk: Information disclosure via client-side exposure
LEAK
calcPublicModuleUrl
e
Risk: Information disclosure via client-side exposure
LEAK
clientModuleFetcher
[XSS working]
Risk: Information disclosure via client-side exposure
LEAK
i.ACCESS_RESTRICTED
accessRestrictedTPA
Risk: Information disclosure via client-side exposure
LEAK
r.GET_CLIENT_WORKER
get-client-worker
Risk: Information disclosure via client-side exposure
LEAK
siteAssetsServerUrl
n
Risk: Information disclosure via client-side exposure
LEAK
c.EMAIL_NOT_PROVIDED
-18880
Risk: Information disclosure via client-side exposure
LEAK
c.WRONG_AUTH_DETAILS
-19976
Risk: Information disclosure via client-side exposure
LEAK
exports.DOMTokenList
1
Risk: Information disclosure via client-side exposure
LEAK
i.EMAIL_CONFIRMATION
emailConfirmationTPA
Risk: Information disclosure via client-side exposure
LEAK
r.INIT_DS_VIEWER_API
init_ds_viewerApi
Risk: Information disclosure via client-side exposure
LEAK
siteAssetsRouterUrls
s
Risk: Information disclosure via client-side exposure
LEAK
stylableMetadataURLs
JSON
Risk: Information disclosure via client-side exposure
LEAK
AUTHENTICATION_FAILED
-19976
Risk: Information disclosure via client-side exposure
LEAK
CLIENT_AUTH_FORBIDDEN
-19974
Risk: Information disclosure via client-side exposure
LEAK
clientSpecMapSupplier
r
Risk: Information disclosure via client-side exposure
LEAK
exports.SVGNumberList
<empty_value>
Risk: Information disclosure via client-side exposure
LEAK
processedEventEntries
u
Risk: Information disclosure via client-side exposure
LEAK
EXISTING_EMAIL_ACCOUNT
-19995
Risk: Information disclosure via client-side exposure
LEAK
exports.ClientRectList
<empty_value>
Risk: Information disclosure via client-side exposure
LEAK
reportPlatformEndEvent
x
Risk: Information disclosure via client-side exposure
LEAK
staticHTMLComponentUrl
p
Risk: Information disclosure via client-side exposure
LEAK
SWITCH_MOBILE_VIEW_MODE
SwitchMobileViewMode
Risk: Information disclosure via client-side exposure
LEAK
c.AUTHENTICATION_FAILED
-19976
Risk: Information disclosure via client-side exposure
LEAK
c.CLIENT_AUTH_FORBIDDEN
-19974
Risk: Information disclosure via client-side exposure
LEAK
c.EXISTING_EMAIL_ACCOUNT
-19995
Risk: Information disclosure via client-side exposure
LEAK
reportAsyncWithCustomKey
function
Risk: Information disclosure via client-side exposure
LEAK
COOKIE_CONSENT_DISALLOWED
new
Risk: Information disclosure via client-side exposure
LEAK
a.SWITCH_MOBILE_VIEW_MODE
SwitchMobileViewMode
Risk: Information disclosure via client-side exposure
LEAK
requiredBrowserNativeApis
[XSS working]
Risk: Information disclosure via client-side exposure
LEAK
supportsNativeBrowserApis
[sechttp]
Risk: Information disclosure via client-side exposure
LEAK
specificEnvFeaturesLoaders
Lt
Risk: Information disclosure via client-side exposure
LEAK
ONLY_UNIQUE_SAVED_URL_ERROR
ONLY_UNIQUE_SAVED_URL_ERROR
Risk: Information disclosure via client-side exposure
LEAK
RESET_PASSWORD_TOKEN_EXPIRED
-19972
Risk: Information disclosure via client-side exposure
LEAK
c.RESET_PASSWORD_TOKEN_EXPIRED
-19972
Risk: Information disclosure via client-side exposure
LEAK
disableStaticPagesUrlHierarchy
u
Risk: Information disclosure via client-side exposure
LEAK
ONLY_UNIQUE_PUBLISHED_URL_ERROR
ONLY_UNIQUE_PUBLISHED_URL_ERROR
Risk: Information disclosure via client-side exposure
LEAK
NEW_RESET_PASSWORD_TOKEN_EXPIRED
EXPIRED_JWT_TOKEN
Risk: Information disclosure via client-side exposure
LEAK
getIframeUrlForOldBrowserMessage
[sechttp]
Risk: Information disclosure via client-side exposure
LEAK
c.NEW_RESET_PASSWORD_TOKEN_EXPIRED
EXPIRED_JWT_TOKEN
Risk: Information disclosure via client-side exposure
LEAK
DS_PENDING_REQUIREMENTS_viewerManagerByRefApi
ds_pending_requirements_viewerManagerByRefApi
Risk: Information disclosure via client-side exposure
LEAK
DS_PENDING_REQUIREMENTS_viewerManagerFontsApi
ds_pending_requirements_viewerManagerFontsApi
Risk: Information disclosure via client-side exposure
LEAK
r.DS_PENDING_REQUIREMENTS_viewerManagerByRefApi
ds_pending_requirements_viewerManagerByRefApi
Risk: Information disclosure via client-side exposure
LEAK
r.DS_PENDING_REQUIREMENTS_viewerManagerFontsApi
ds_pending_requirements_viewerManagerFontsApi
Risk: Information disclosure via client-side exposure
LEAK
DS_PENDING_REQUIREMENTS_viewerManagerUpdateStatusApi
ds_pending_requirements_viewerManagerUpdateStatusApi
Risk: Information disclosure via client-side exposure
LEAK
r.DS_PENDING_REQUIREMENTS_viewerManagerUpdateStatusApi
ds_pending_requirements_viewerManagerUpdateStatusApi
Risk: Information disclosure via client-side exposure
Total: 235 exposed variables found
Análisis de Dominios API
External API domains discovered in client-side code
EXTERNAL_API_DOMAIN
schema.org
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
www.timucinorhon.com
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
github.com
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
rock.mit-license.org
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
panorama.wixapps.net
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
sled.wix.dev
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
bo.wix.com
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
www.wix.com
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
static.parastorage.com
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
frog.wix.com
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
pages.parastorage.com
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
mths.be
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
lodash.com
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
openjsf.org
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
underscorejs.org
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
npms.io
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
reactjs.org
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
Puntos Finales de API Descubiertos
API endpoints identified through static analysis of client-side code
GET
/api/wix-sm/v1/members/${e}/role
Active
Endpoint discovered via client-side code analysis
GET
https://panorama.wixapps.net/api/v1/bulklog
Active
Endpoint discovered via client-side code analysis
Recursos de JavaScript
JavaScript files loaded by the application
JS
https://static.parastorage.com/unpkg/core-js-bundle@3.2.1/minified.js
JS
https://static.parastorage.com/unpkg/focus-within-polyfill@5.0.9/dist/focus-within-polyfill.js
JS
https://browser.sentry-cdn.com/7.120.3/modulemetadata.es5.min.js
JS
https://static.parastorage.com/services/wix-thunderbolt/dist/thunderbolt-commons.e8600c82.bundle.min.js
JS
https://static.parastorage.com/services/wix-thunderbolt/dist/main.6d00e8a0.bundle.min.js
JS
https://static.parastorage.com/services/wix-thunderbolt/dist/main.renderer.f600e767.bundle.min.js
JS
https://static.parastorage.com/unpkg/lodash@4.17.21/lodash.min.js
JS
https://static.parastorage.com/unpkg/react@18.3.1/umd/react.production.min.js
JS
https://static.parastorage.com/unpkg/react-dom@18.3.1/umd/react-dom.production.min.js
JS
https://static.parastorage.com/services/wix-thunderbolt/dist/browser-deprecation.bundle.es5.js
JS
https://static.parastorage.com/services/tag-manager-client/1.1028.0/siteTags.bundle.min.js
JS
"https://static.parastorage.com/unpkg/core-js-bundle@3.2.1/minified.js"
JS
"https://static.parastorage.com/unpkg/focus-within-polyfill@5.0.9/dist/focus-within-polyfill.js"
JS
"https://browser.sentry-cdn.com/7.120.3/modulemetadata.es5.min.js"
JS
"https://static.parastorage.com/services/wix-thunderbolt/dist/thunderbolt-commons.e8600c82.bundle.min.js"
JS
"https://static.parastorage.com/services/wix-thunderbolt/dist/main.6d00e8a0.bundle.min.js"
JS
"https://static.parastorage.com/services/wix-thunderbolt/dist/main.renderer.f600e767.bundle.min.js"
JS
"https://static.parastorage.com/unpkg/lodash@4.17.21/lodash.min.js"
JS
"https://static.parastorage.com/unpkg/react@18.3.1/umd/react.production.min.js"
JS
"https://static.parastorage.com/unpkg/react-dom@18.3.1/umd/react-dom.production.min.js"
JS
"https://static.parastorage.com/services/wix-thunderbolt/dist/browser-deprecation.bundle.es5.js"
JS
"https://static.parastorage.com/services/tag-manager-client/1.1028.0/siteTags.bundle.min.js"
Recomendaciones de Seguridad
- • Avoid exposing sensitive variables in client-side code
- • Implement proper API authentication and rate limiting
- • Use environment variables for sensitive configuration
- • Regularly audit client-side code for information leaks
- • Minimize the amount of sensitive data processed on the client side
Registros de Escaneos Históricos (1)
Timuçin Orhon is a UI/UX Designer, Web Designer, Graphic Designer, Google Adwords Specialist, Social Media Manager, E-Commerce Consultant from Kafa Tasarım. Timuçin Orhon
65/100
4 issues