Timuçin Orhon | UI/UX Designer | Web Designer | Adwords Specialist | E-Commerce
HTTPS
ANALYSE_CIBLE
www.timucinorhon.com
IP : 34.149.87.45
ASN : AS396982
Un rapport complet d'analyse de sécurité et de réseau pour www.timucinorhon.com. Serveur : Pepyaka. Hébergé en US.
- Port principal
- 443
- Temps de scan
- Lien de rapport partageable
- https://sechttp.com/scan/www.timucinorhon.com
Analyse de sécurité détaillée
Analyse des chemins d'attaque et de défense contre les DDoS
Attaquant
Trafic L4
Trafic L7
AS396982 (Pepyaka POP)
L4 défendu
L7 contourné
L4 bloqué
Trafic L7
Votre serveur
Résumé de la défense
Bien que Pepyaka offre une protection robuste contre les attaques de couche 4 (niveau réseau), votre serveur reste potentiellement vulnérable aux attaques sophistiquées de couche 7 (niveau application) qui peuvent contourner les défenses CDN standard. Des règles WAF supplémentaires et des mesures de sécurité côté application sont recommandées.
Défense de couche 4
Pepyaka fournit une protection robuste contre les inondations SYN, l'amplification UDP et les attaques volumétriques à la périphérie du réseau.
Vulnérabilités de couche 7
Les attaques de couche application ciblant les points d'accès API exposés de 2 nécessitent des règles WAF supplémentaires et une limitation de débit.
Divulgation d'informations sur le serveur
LOWINFO-001
Description
Le serveur divulgue son type de logiciel : Pepyaka. Cela peut aider les attaquants à identifier des vulnérabilités potentielles.
Recommandation
Configurez votre serveur web pour masquer ou modifier l'en-tête Server afin d'éviter la divulgation d'informations.
En-tête X-Frame-Options manquant
MEDIUMSEC-002
Description
Le site n'est pas protégé contre les attaques de clickjacking.
Recommandation
Ajoutez l'en-tête X-Frame-Options avec la valeur 'DENY' ou 'SAMEORIGIN' pour empêcher le clickjacking.
Exposition d'informations sensibles dans JavaScript
HIGHJS-001
Description
Trouvé 235 variables potentiellement sensibles exposées dans le code JavaScript côté client.
Recommandation
Examinez et supprimez les informations sensibles du code côté client. Utilisez des variables d'environnement et un traitement côté serveur pour les données sensibles.
root@sechttp: /var/log/fuzz
root@sechttp : ~ $
> [Code: 200]
/api/wix-sm/v1/members/${e}/role [FUITE SENSIBLE]
> [Code: 403]
https://panorama.wixapps.net/api/v1/bulklog [INTERDIT]
[+] Scan terminé. Trouvé 1 fuites potentielles.
root@sechttp : ~ $
Résultats du scan de ports
| Port | Service | Statut | Version |
|---|---|---|---|
| 80 | HTTP | FERMÉ | - |
| 443 | HTTPS | OUVERT | TLS 1.3 |
| 22 | SSH | FILTRÉ | - |
| 3306 | MySQL | FERMÉ | - |
Analyse des en-têtes HTTP
age:
11
via:
1.1 google
date:
Thu, 11 Sep 2025 16:35:54 GMT
etag:
W/"94bd9c8d95ff5aa233c987d495788714"
link:
<https://static.parastorage.com/>; rel=preconnect; crossorigin;,<https://static.parastorage.com/>; rel=preconnect;,<https://static.wixstatic.com/>; rel=preconnect; crossorigin;,<https://static.wixstatic.com/>; rel=preconnect;,<https://siteassets.parastorage.com>; rel=preconnect; crossorigin;,
vary:
Accept-Encoding
server:
Pepyaka
alt-svc:
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-cache:
HIT
x-seen-by:
yvSunuo/8ld62ehjr5B7kA==
set-cookie:
ssr-caching=cache#desc=miss#varnish=miss_hit#dc#desc=fastly_g; max-age=20
x-served-by:
cache-lax-kwhp1940098-LAX
content-type:
text/html; charset=UTF-8
accept-ranges:
bytes
cache-control:
public,max-age=0,must-revalidate
glb-x-seen-by:
bS8wRlGzu0Hc+WrYuHB8QIg44yfcdCMJRkBoQ1h6Vjc=
server-timing:
cache;desc=miss, varnish;desc=miss_hit, dc;desc=fastly_g
content-length:
748425
html-cacheable:
true
content-language:
en
x-wix-request-id:
1757608554.477435193897125831
x-content-type-options:
nosniff
strict-transport-security:
max-age=86400
Informations ASN
ASN: AS396982
Adresse IP: 34.149.87.45
Préfixe réseau: 34.148.0.0/14
Organisation: GOOGLE-CLOUD-PLATFORM
Pays:
🇺🇸 US
Nom: GOOGLE-CLOUD-PLATFORM
Fournisseurs en amont (3)
AS15169
GOOGLE
Google LLC
🇺🇸 US
upstream
AS19527
GOOGLE-2
Google LLC
🇺🇸 US
upstream
AS15169
GOOGLE
Google LLC
🇺🇸 US
upstream
Points d'échange Internet (4)
🇸🇦
SAIX Saudi Arabia Riyadh
SA
100 Gbps
Bandwidth
🇸🇦
center3 IX Jeddah
SA
20 Gbps
Bandwidth
🇸🇦
SAIX Saudi Arabia Riyadh
SA
100 Gbps
Bandwidth
🇸🇦
center3 IX Jeddah
SA
20 Gbps
Bandwidth
Analyse JavaScript
Security Analysis Alert
Client-side code analysis has identified potential security vulnerabilities and information disclosure risks.
Variables JavaScript exposées
Variables exposed in client-side code that may contain sensitive information
# Security Assessment: Variable Exposure Analysis
LEAK
URL
.concat(t)),n}return Bt(t,e),t}(Ht),Gt=function(e){function t(t,r){var n=e.call(this,t.message,{cause:t})||this;return r&&(n.stack=Ut(n.stack,
Risk: Information disclosure via client-side exposure
LEAK
key
function
Risk: Information disclosure via client-side exposure
LEAK
url
"//frog.wix.com/bolt-performance?src=72&evid="+evid+"&appName="+fedOpsAppName+"&is_rollout="+is_rollout+"&is_sav_rollout="+is_sav_rollout+"&is_dac_rollout="+is_dac_rollout+"&dc="+site.dc+"&msid="+site...
Risk: Information disclosure via client-side exposure
LEAK
TEST
test
Risk: Information disclosure via client-side exposure
LEAK
code
Client
Risk: Information disclosure via client-side exposure
LEAK
keys
function
Risk: Information disclosure via client-side exposure
LEAK
msId
n
Risk: Information disclosure via client-side exposure
LEAK
msid
+site.metaSiteId+
Risk: Information disclosure via client-side exposure
LEAK
side
a
Risk: Information disclosure via client-side exposure
LEAK
sign
n
Risk: Information disclosure via client-side exposure
LEAK
appId
e
Risk: Information disclosure via client-side exposure
LEAK
keyBy
function
Risk: Information disclosure via client-side exposure
LEAK
keyOf
function
Risk: Information disclosure via client-side exposure
LEAK
toKey
function
Risk: Information disclosure via client-side exposure
LEAK
DESIGN
design_data
Risk: Information disclosure via client-side exposure
LEAK
MOBILE
return
Risk: Information disclosure via client-side exposure
LEAK
Mobile
mobile
Risk: Information disclosure via client-side exposure
LEAK
Number
[sechttp]
Risk: Information disclosure via client-side exposure
LEAK
SIGNUP
register
Risk: Information disclosure via client-side exposure
LEAK
altKey
0
Risk: Information disclosure via client-side exposure
LEAK
assign
function
Risk: Information disclosure via client-side exposure
LEAK
client
.concat(e));return o.meter(
Risk: Information disclosure via client-side exposure
LEAK
codeAt
N3
Risk: Information disclosure via client-side exposure
LEAK
cookie
r
Risk: Information disclosure via client-side exposure
LEAK
decode
C
Risk: Information disclosure via client-side exposure
LEAK
domain
kt
Risk: Information disclosure via client-side exposure
LEAK
encode
R
Risk: Information disclosure via client-side exposure
LEAK
inpUrl
vt
Risk: Information disclosure via client-side exposure
LEAK
keyFor
function
Risk: Information disclosure via client-side exposure
LEAK
lcpUrl
i
Risk: Information disclosure via client-side exposure
LEAK
SIGN_UP
signupTPA
Risk: Information disclosure via client-side exposure
LEAK
baseUrl
t
Risk: Information disclosure via client-side exposure
LEAK
clientX
0
Risk: Information disclosure via client-side exposure
LEAK
clientY
0
Risk: Information disclosure via client-side exposure
LEAK
ctrlKey
0
Risk: Information disclosure via client-side exposure
LEAK
decoder
a
Risk: Information disclosure via client-side exposure
LEAK
encoder
null
Risk: Information disclosure via client-side exposure
LEAK
fastKey
function
Risk: Information disclosure via client-side exposure
LEAK
findKey
function
Risk: Information disclosure via client-side exposure
LEAK
keyCode
0
Risk: Information disclosure via client-side exposure
LEAK
mapKeys
function
Risk: Information disclosure via client-side exposure
LEAK
metaKey
0
Risk: Information disclosure via client-side exposure
LEAK
ownKeys
n
Risk: Information disclosure via client-side exposure
LEAK
pageUrl
i
Risk: Information disclosure via client-side exposure
LEAK
release
g
Risk: Information disclosure via client-side exposure
LEAK
signbit
function
Risk: Information disclosure via client-side exposure
LEAK
siteUrl
e
Risk: Information disclosure via client-side exposure
LEAK
unicode
e
Risk: Information disclosure via client-side exposure
LEAK
BAD_CODE
EMAIL_VERIFICATION_FAILED
Risk: Information disclosure via client-side exposure
LEAK
PASSWORD
31fff8fc-ea95-43ac-95c5-902497125b90
Risk: Information disclosure via client-side exposure
LEAK
baseURLs
t
Risk: Information disclosure via client-side exposure
LEAK
charCode
function
Risk: Information disclosure via client-side exposure
LEAK
clientId
_wixCIDX
Risk: Information disclosure via client-side exposure
LEAK
endpoint
<empty_value>
Risk: Information disclosure via client-side exposure
LEAK
envFetch
r
Risk: Information disclosure via client-side exposure
LEAK
fetchApi
i
Risk: Information disclosure via client-side exposure
LEAK
getAppId
D
Risk: Information disclosure via client-side exposure
LEAK
isMobile
s
Risk: Information disclosure via client-side exposure
LEAK
password
VLa
Risk: Information disclosure via client-side exposure
LEAK
r.SIGNUP
register
Risk: Information disclosure via client-side exposure
LEAK
shiftKey
0
Risk: Information disclosure via client-side exposure
LEAK
testMode
y
Risk: Information disclosure via client-side exposure
LEAK
u.MOBILE
MOBILE
Risk: Information disclosure via client-side exposure
LEAK
EmailLink
EmailLink
Risk: Information disclosure via client-side exposure
LEAK
PhoneLink
PhoneLink
Risk: Information disclosure via client-side exposure
LEAK
client_id
h
Risk: Information disclosure via client-side exposure
LEAK
codePoint
c
Risk: Information disclosure via client-side exposure
LEAK
editorKey
t
Risk: Information disclosure via client-side exposure
LEAK
i.SIGN_UP
signupTPA
Risk: Information disclosure via client-side exposure
LEAK
iframeUrl
[XSS working]
Risk: Information disclosure via client-side exposure
LEAK
parsedUrl
h
Risk: Information disclosure via client-side exposure
LEAK
sessionId
Yr
Risk: Information disclosure via client-side exposure
LEAK
toUnicode
function
Risk: Information disclosure via client-side exposure
LEAK
updateURL
function
Risk: Information disclosure via client-side exposure
LEAK
CODE_LOGIN
editor-members-code-login
Risk: Information disclosure via client-side exposure
LEAK
EMAIL_LINK
EmailLink
Risk: Information disclosure via client-side exposure
LEAK
PHONE_LINK
PhoneLink
Risk: Information disclosure via client-side exposure
LEAK
R.PASSWORD
31fff8fc-ea95-43ac-95c5-902497125b90
Risk: Information disclosure via client-side exposure
LEAK
baseClient
o
Risk: Information disclosure via client-side exposure
LEAK
c.BAD_CODE
EMAIL_VERIFICATION_FAILED
Risk: Information disclosure via client-side exposure
LEAK
codePoints
function
Risk: Information disclosure via client-side exposure
LEAK
deviceInfo
m
Risk: Information disclosure via client-side exposure
LEAK
deviceType
e
Risk: Information disclosure via client-side exposure
LEAK
httpClient
Mr
Risk: Information disclosure via client-side exposure
LEAK
pageNumber
r
Risk: Information disclosure via client-side exposure
LEAK
requestUrl
n
Risk: Information disclosure via client-side exposure
LEAK
session_id
+site.sessionId+
Risk: Information disclosure via client-side exposure
LEAK
CODE_SIGNUP
members-code-signup
Risk: Information disclosure via client-side exposure
LEAK
DEVELOPMENT
development
Risk: Information disclosure via client-side exposure
LEAK
codePointAt
function
Risk: Information disclosure via client-side exposure
LEAK
credentials
include
Risk: Information disclosure via client-side exposure
LEAK
csmCacheKey
t
Risk: Information disclosure via client-side exposure
LEAK
environment
P
Risk: Information disclosure via client-side exposure
LEAK
fileRepoUrl
t
Risk: Information disclosure via client-side exposure
LEAK
pageJsonUrl
y
Risk: Information disclosure via client-side exposure
LEAK
relativeUrl
_
Risk: Information disclosure via client-side exposure
LEAK
s.EmailLink
EmailLink
Risk: Information disclosure via client-side exposure
LEAK
s.PhoneLink
PhoneLink
Risk: Information disclosure via client-side exposure
LEAK
sessionTime
o
Risk: Information disclosure via client-side exposure
LEAK
status_code
n
Risk: Information disclosure via client-side exposure
LEAK
urlMappings
e
Risk: Information disclosure via client-side exposure
LEAK
urlOverride
E
Risk: Information disclosure via client-side exposure
LEAK
ACCESS_DENID
-19956
Risk: Information disclosure via client-side exposure
LEAK
CODE_INVALID
EMAIL_VERIFICATION_REQUIRED
Risk: Information disclosure via client-side exposure
LEAK
DESIGN_QUERY
designQuery
Risk: Information disclosure via client-side exposure
LEAK
DOMTokenList
1
Risk: Information disclosure via client-side exposure
LEAK
MOBILE_HINTS
mobile_hints
Risk: Information disclosure via client-side exposure
LEAK
VERIFY_TOKEN
apply-session-token
Risk: Information disclosure via client-side exposure
LEAK
a.EMAIL_LINK
EmailLink
Risk: Information disclosure via client-side exposure
LEAK
a.PHONE_LINK
PhoneLink
Risk: Information disclosure via client-side exposure
LEAK
compositeKey
function
Risk: Information disclosure via client-side exposure
LEAK
deviceMemory
navigator
Risk: Information disclosure via client-side exposure
LEAK
getPublicUrl
function
Risk: Information disclosure via client-side exposure
LEAK
getSessionId
function
Risk: Information disclosure via client-side exposure
LEAK
getWindowUrl
n
Risk: Information disclosure via client-side exposure
LEAK
isServerSide
1
Risk: Information disclosure via client-side exposure
LEAK
mediaRootUrl
t
Risk: Information disclosure via client-side exposure
LEAK
stdDeviation
${e}
Risk: Information disclosure via client-side exposure
LEAK
wixBiSession
Mt
Risk: Information disclosure via client-side exposure
LEAK
EXPIRED_TOKEN
expiredTokenTPA
Risk: Information disclosure via client-side exposure
LEAK
SVGNumberList
0
Risk: Information disclosure via client-side exposure
LEAK
SlideVertical
600
Risk: Information disclosure via client-side exposure
LEAK
clientSpecMap
a
Risk: Information disclosure via client-side exposure
LEAK
enableTestApi
n
Risk: Information disclosure via client-side exposure
LEAK
fromCodePoint
function
Risk: Information disclosure via client-side exposure
LEAK
getSvgBaseUrl
e
Risk: Information disclosure via client-side exposure
LEAK
isUrlMigrated
o
Risk: Information disclosure via client-side exposure
LEAK
mainGridAppId
l
Risk: Information disclosure via client-side exposure
LEAK
moduleRepoUrl
n
Risk: Information disclosure via client-side exposure
LEAK
siteAssetsUrl
n
Risk: Information disclosure via client-side exposure
LEAK
t.environment
500
Risk: Information disclosure via client-side exposure
LEAK
urlMappingKey
e
Risk: Information disclosure via client-side exposure
LEAK
ClientRectList
0
Risk: Information disclosure via client-side exposure
LEAK
DEFAULT_SIGNUP
members-default-signup
Risk: Information disclosure via client-side exposure
LEAK
GET_VIEWER_API
getViewerApi
Risk: Information disclosure via client-side exposure
LEAK
RESET_PASSWORD
resetPasswordTPA
Risk: Information disclosure via client-side exposure
LEAK
WRONG_PASSWORD
-17005
Risk: Information disclosure via client-side exposure
LEAK
authentication
e
Risk: Information disclosure via client-side exposure
LEAK
c.ACCESS_DENID
-19956
Risk: Information disclosure via client-side exposure
LEAK
c.CODE_INVALID
EMAIL_VERIFICATION_REQUIRED
Risk: Information disclosure via client-side exposure
LEAK
clientTopology
t
Risk: Information disclosure via client-side exposure
LEAK
staticMediaUrl
r
Risk: Information disclosure via client-side exposure
LEAK
urlFormatModel
p
Risk: Information disclosure via client-side exposure
LEAK
wixCodePageIds
u
Risk: Information disclosure via client-side exposure
LEAK
FORGOT_PASSWORD
forgotPasswordTPA
Risk: Information disclosure via client-side exposure
LEAK
MozPrintableKey
Unidentified
Risk: Information disclosure via client-side exposure
LEAK
URLSearchParams
R
Risk: Information disclosure via client-side exposure
LEAK
createObjectURL
[sechttp]
Risk: Information disclosure via client-side exposure
LEAK
decodeDotInKeys
a
Risk: Information disclosure via client-side exposure
LEAK
decodedBodySize
t
Risk: Information disclosure via client-side exposure
LEAK
encodeDotInKeys
f
Risk: Information disclosure via client-side exposure
LEAK
externalBaseUrl
n
Risk: Information disclosure via client-side exposure
LEAK
getMetadataKeys
function
Risk: Information disclosure via client-side exposure
LEAK
i.EXPIRED_TOKEN
expiredTokenTPA
Risk: Information disclosure via client-side exposure
LEAK
isPremiumDomain
l
Risk: Information disclosure via client-side exposure
LEAK
loadEnvironment
r
Risk: Information disclosure via client-side exposure
LEAK
loadModuleByUrl
[sechttp]
Risk: Information disclosure via client-side exposure
LEAK
longTasksNumber
s
Risk: Information disclosure via client-side exposure
LEAK
r.SlideVertical
600
Risk: Information disclosure via client-side exposure
LEAK
revokeObjectURL
[sechttp]
Risk: Information disclosure via client-side exposure
LEAK
viewerSessionId
p
Risk: Information disclosure via client-side exposure
LEAK
PASSWORD_RESETED
-19973
Risk: Information disclosure via client-side exposure
LEAK
addEventListener
t
Risk: Information disclosure via client-side exposure
LEAK
c.WRONG_PASSWORD
-17005
Risk: Information disclosure via client-side exposure
LEAK
clientSideRender
s
Risk: Information disclosure via client-side exposure
LEAK
currentParsedUrl
p
Risk: Information disclosure via client-side exposure
LEAK
encodeValuesOnly
f
Risk: Information disclosure via client-side exposure
LEAK
i.RESET_PASSWORD
resetPasswordTPA
Risk: Information disclosure via client-side exposure
LEAK
r.GET_VIEWER_API
getViewerApi
Risk: Information disclosure via client-side exposure
LEAK
siteAssetsClient
Lr
Risk: Information disclosure via client-side exposure
LEAK
updatePageNumber
t
Risk: Information disclosure via client-side exposure
LEAK
ACCESS_RESTRICTED
accessRestrictedTPA
Risk: Information disclosure via client-side exposure
LEAK
GET_CLIENT_WORKER
get-client-worker
Risk: Information disclosure via client-side exposure
LEAK
VERIFICATION_CODE
verification-code
Risk: Information disclosure via client-side exposure
LEAK
i.FORGOT_PASSWORD
forgotPasswordTPA
Risk: Information disclosure via client-side exposure
LEAK
isClientSdkOnSite
b
Risk: Information disclosure via client-side exposure
LEAK
mobileActionsMenu
o
Risk: Information disclosure via client-side exposure
LEAK
publicEnvironment
P
Risk: Information disclosure via client-side exposure
LEAK
sentryEnvironment
l
Risk: Information disclosure via client-side exposure
LEAK
EMAIL_CONFIRMATION
emailConfirmationTPA
Risk: Information disclosure via client-side exposure
LEAK
EMAIL_NOT_PROVIDED
-18880
Risk: Information disclosure via client-side exposure
LEAK
INIT_DS_VIEWER_API
init_ds_viewerApi
Risk: Information disclosure via client-side exposure
LEAK
MOBILE_HINTS_QUERY
mobileHintsQuery
Risk: Information disclosure via client-side exposure
LEAK
WRONG_AUTH_DETAILS
-19976
Risk: Information disclosure via client-side exposure
LEAK
c.PASSWORD_RESETED
-19973
Risk: Information disclosure via client-side exposure
LEAK
fl.MozPrintableKey
Unidentified
Risk: Information disclosure via client-side exposure
LEAK
getOwnMetadataKeys
function
Risk: Information disclosure via client-side exposure
LEAK
persistentEndpoint
this
Risk: Information disclosure via client-side exposure
LEAK
relativeEncodedUrl
o
Risk: Information disclosure via client-side exposure
LEAK
accessTokensHandler
c
Risk: Information disclosure via client-side exposure
LEAK
calcPublicModuleUrl
e
Risk: Information disclosure via client-side exposure
LEAK
clientModuleFetcher
[XSS working]
Risk: Information disclosure via client-side exposure
LEAK
i.ACCESS_RESTRICTED
accessRestrictedTPA
Risk: Information disclosure via client-side exposure
LEAK
r.GET_CLIENT_WORKER
get-client-worker
Risk: Information disclosure via client-side exposure
LEAK
siteAssetsServerUrl
n
Risk: Information disclosure via client-side exposure
LEAK
c.EMAIL_NOT_PROVIDED
-18880
Risk: Information disclosure via client-side exposure
LEAK
c.WRONG_AUTH_DETAILS
-19976
Risk: Information disclosure via client-side exposure
LEAK
exports.DOMTokenList
1
Risk: Information disclosure via client-side exposure
LEAK
i.EMAIL_CONFIRMATION
emailConfirmationTPA
Risk: Information disclosure via client-side exposure
LEAK
r.INIT_DS_VIEWER_API
init_ds_viewerApi
Risk: Information disclosure via client-side exposure
LEAK
siteAssetsRouterUrls
s
Risk: Information disclosure via client-side exposure
LEAK
stylableMetadataURLs
JSON
Risk: Information disclosure via client-side exposure
LEAK
AUTHENTICATION_FAILED
-19976
Risk: Information disclosure via client-side exposure
LEAK
CLIENT_AUTH_FORBIDDEN
-19974
Risk: Information disclosure via client-side exposure
LEAK
clientSpecMapSupplier
r
Risk: Information disclosure via client-side exposure
LEAK
exports.SVGNumberList
<empty_value>
Risk: Information disclosure via client-side exposure
LEAK
processedEventEntries
u
Risk: Information disclosure via client-side exposure
LEAK
EXISTING_EMAIL_ACCOUNT
-19995
Risk: Information disclosure via client-side exposure
LEAK
exports.ClientRectList
<empty_value>
Risk: Information disclosure via client-side exposure
LEAK
reportPlatformEndEvent
x
Risk: Information disclosure via client-side exposure
LEAK
staticHTMLComponentUrl
p
Risk: Information disclosure via client-side exposure
LEAK
SWITCH_MOBILE_VIEW_MODE
SwitchMobileViewMode
Risk: Information disclosure via client-side exposure
LEAK
c.AUTHENTICATION_FAILED
-19976
Risk: Information disclosure via client-side exposure
LEAK
c.CLIENT_AUTH_FORBIDDEN
-19974
Risk: Information disclosure via client-side exposure
LEAK
c.EXISTING_EMAIL_ACCOUNT
-19995
Risk: Information disclosure via client-side exposure
LEAK
reportAsyncWithCustomKey
function
Risk: Information disclosure via client-side exposure
LEAK
COOKIE_CONSENT_DISALLOWED
new
Risk: Information disclosure via client-side exposure
LEAK
a.SWITCH_MOBILE_VIEW_MODE
SwitchMobileViewMode
Risk: Information disclosure via client-side exposure
LEAK
requiredBrowserNativeApis
[XSS working]
Risk: Information disclosure via client-side exposure
LEAK
supportsNativeBrowserApis
[sechttp]
Risk: Information disclosure via client-side exposure
LEAK
specificEnvFeaturesLoaders
Lt
Risk: Information disclosure via client-side exposure
LEAK
ONLY_UNIQUE_SAVED_URL_ERROR
ONLY_UNIQUE_SAVED_URL_ERROR
Risk: Information disclosure via client-side exposure
LEAK
RESET_PASSWORD_TOKEN_EXPIRED
-19972
Risk: Information disclosure via client-side exposure
LEAK
c.RESET_PASSWORD_TOKEN_EXPIRED
-19972
Risk: Information disclosure via client-side exposure
LEAK
disableStaticPagesUrlHierarchy
u
Risk: Information disclosure via client-side exposure
LEAK
ONLY_UNIQUE_PUBLISHED_URL_ERROR
ONLY_UNIQUE_PUBLISHED_URL_ERROR
Risk: Information disclosure via client-side exposure
LEAK
NEW_RESET_PASSWORD_TOKEN_EXPIRED
EXPIRED_JWT_TOKEN
Risk: Information disclosure via client-side exposure
LEAK
getIframeUrlForOldBrowserMessage
[sechttp]
Risk: Information disclosure via client-side exposure
LEAK
c.NEW_RESET_PASSWORD_TOKEN_EXPIRED
EXPIRED_JWT_TOKEN
Risk: Information disclosure via client-side exposure
LEAK
DS_PENDING_REQUIREMENTS_viewerManagerByRefApi
ds_pending_requirements_viewerManagerByRefApi
Risk: Information disclosure via client-side exposure
LEAK
DS_PENDING_REQUIREMENTS_viewerManagerFontsApi
ds_pending_requirements_viewerManagerFontsApi
Risk: Information disclosure via client-side exposure
LEAK
r.DS_PENDING_REQUIREMENTS_viewerManagerByRefApi
ds_pending_requirements_viewerManagerByRefApi
Risk: Information disclosure via client-side exposure
LEAK
r.DS_PENDING_REQUIREMENTS_viewerManagerFontsApi
ds_pending_requirements_viewerManagerFontsApi
Risk: Information disclosure via client-side exposure
LEAK
DS_PENDING_REQUIREMENTS_viewerManagerUpdateStatusApi
ds_pending_requirements_viewerManagerUpdateStatusApi
Risk: Information disclosure via client-side exposure
LEAK
r.DS_PENDING_REQUIREMENTS_viewerManagerUpdateStatusApi
ds_pending_requirements_viewerManagerUpdateStatusApi
Risk: Information disclosure via client-side exposure
Total: 235 exposed variables found
Analyse des domaines API
External API domains discovered in client-side code
EXTERNAL_API_DOMAIN
schema.org
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
www.timucinorhon.com
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
github.com
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
rock.mit-license.org
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
panorama.wixapps.net
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
sled.wix.dev
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
bo.wix.com
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
www.wix.com
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
static.parastorage.com
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
frog.wix.com
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
pages.parastorage.com
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
mths.be
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
lodash.com
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
openjsf.org
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
underscorejs.org
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
npms.io
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
reactjs.org
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
Points d'accès API découverts
API endpoints identified through static analysis of client-side code
GET
/api/wix-sm/v1/members/${e}/role
Active
Endpoint discovered via client-side code analysis
GET
https://panorama.wixapps.net/api/v1/bulklog
Active
Endpoint discovered via client-side code analysis
Ressources JavaScript
JavaScript files loaded by the application
JS
https://static.parastorage.com/unpkg/core-js-bundle@3.2.1/minified.js
JS
https://static.parastorage.com/unpkg/focus-within-polyfill@5.0.9/dist/focus-within-polyfill.js
JS
https://browser.sentry-cdn.com/7.120.3/modulemetadata.es5.min.js
JS
https://static.parastorage.com/services/wix-thunderbolt/dist/thunderbolt-commons.e8600c82.bundle.min.js
JS
https://static.parastorage.com/services/wix-thunderbolt/dist/main.6d00e8a0.bundle.min.js
JS
https://static.parastorage.com/services/wix-thunderbolt/dist/main.renderer.f600e767.bundle.min.js
JS
https://static.parastorage.com/unpkg/lodash@4.17.21/lodash.min.js
JS
https://static.parastorage.com/unpkg/react@18.3.1/umd/react.production.min.js
JS
https://static.parastorage.com/unpkg/react-dom@18.3.1/umd/react-dom.production.min.js
JS
https://static.parastorage.com/services/wix-thunderbolt/dist/browser-deprecation.bundle.es5.js
JS
https://static.parastorage.com/services/tag-manager-client/1.1028.0/siteTags.bundle.min.js
JS
"https://static.parastorage.com/unpkg/core-js-bundle@3.2.1/minified.js"
JS
"https://static.parastorage.com/unpkg/focus-within-polyfill@5.0.9/dist/focus-within-polyfill.js"
JS
"https://browser.sentry-cdn.com/7.120.3/modulemetadata.es5.min.js"
JS
"https://static.parastorage.com/services/wix-thunderbolt/dist/thunderbolt-commons.e8600c82.bundle.min.js"
JS
"https://static.parastorage.com/services/wix-thunderbolt/dist/main.6d00e8a0.bundle.min.js"
JS
"https://static.parastorage.com/services/wix-thunderbolt/dist/main.renderer.f600e767.bundle.min.js"
JS
"https://static.parastorage.com/unpkg/lodash@4.17.21/lodash.min.js"
JS
"https://static.parastorage.com/unpkg/react@18.3.1/umd/react.production.min.js"
JS
"https://static.parastorage.com/unpkg/react-dom@18.3.1/umd/react-dom.production.min.js"
JS
"https://static.parastorage.com/services/wix-thunderbolt/dist/browser-deprecation.bundle.es5.js"
JS
"https://static.parastorage.com/services/tag-manager-client/1.1028.0/siteTags.bundle.min.js"
Recommandations de sécurité
- • Avoid exposing sensitive variables in client-side code
- • Implement proper API authentication and rate limiting
- • Use environment variables for sensitive configuration
- • Regularly audit client-side code for information leaks
- • Minimize the amount of sensitive data processed on the client side
Historique des scans (1)
Timuçin Orhon is a UI/UX Designer, Web Designer, Graphic Designer, Google Adwords Specialist, Social Media Manager, E-Commerce Consultant from Kafa Tasarım. Timuçin Orhon
65/100
4 issues