Agence de communication digitale à Montpellier | Citron Noir
HTTPS
ターゲット分析
citronnoir.com
IP： 0.0.0.0
ASN： AS0
citronnoir.comの包括的なセキュリティおよびネットワーク分析レポート。サーバー：Apache。
- 主要ポート
- 443
- スキャン時間
- 共有可能なレポートリンク
- https://sechttp.com/scan/citronnoir.com
詳細なセキュリティ分析
攻撃経路およびDDoS防御分析
攻撃者
L4トラフィック
L7トラフィック
AS0 (Apache POP)
L4防御済み
L7回避
L4ブロック済み
L7トラフィック
あなたのサーバー
防御概要
Apacheはレイヤー4（ネットワークレベル）の攻撃に対して強固な保護を提供しますが、標準的なCDN防御を回避する可能性のある高度なレイヤー7（アプリケーションレベル）の攻撃に対して、サーバーは依然として脆弱である可能性があります。追加のWAFルールとアプリケーション側のセキュリティ対策が推奨されます。
レイヤー4防御
Apache ネットワークエッジでSYNフラッド、UDP増幅、およびボリュメトリック攻撃に対する強固な保護を提供します。
レイヤー7の脆弱性
0の公開されたAPIエンドポイントを標的とするアプリケーションレベルの攻撃には、追加のWAFルールとレート制限が必要です。
サーバー情報開示
LOWINFO-001
説明
サーバーがそのソフトウェアタイプを公開しています：Apache。これにより、攻撃者が潜在的な脆弱性を特定するのに役立つ可能性があります。
推奨事項
サーバーヘッダーを非表示または変更するようにウェブサーバーを構成して、情報開示を防ぎます。
JavaScriptでの機密情報露出
HIGHJS-001
説明
クライアント側のJavaScriptコードで49個の潜在的に機密な変数が公開されています。
推奨事項
クライアント側のコードから機密情報を確認して削除します。機密データには環境変数とサーバー側処理を使用します。
現在テスト中
このスキャンにはファジングデータがありません。
ポートスキャンの結果
| ポート | サービス | ステータス | バージョン |
|---|---|---|---|
| 80 | HTTP | クローズ | - |
| 443 | HTTPS | オープン | TLS 1.3 |
| 22 | SSH | フィルタリング済み | - |
| 3306 | MySQL | クローズ | - |
HTTPヘッダー分析
date:
Sun, 12 Apr 2026 11:52:50 GMT
vary:
X-FORWARDED-PROTO,Accept-Encoding
server:
Apache
expires:
Sun, 12 Apr 2026 11:52:50 GMT
upgrade:
h2
connection:
Upgrade
content-type:
text/html; charset=UTF-8
cache-control:
max-age=0
last-modified:
Sun, 12 Apr 2026 10:09:21 GMT
referrer-policy:
strict-origin-when-cross-origin
x-frame-options:
SAMEORIGIN
transfer-encoding:
chunked
permissions-policy:
geolocation=(), microphone=(), camera=()
x-content-type-options:
nosniff
content-security-policy:
default-src 'self' https: data: blob:; img-src 'self' https: data:; font-src 'self' https: data:; script-src 'self' https: 'unsafe-inline' 'unsafe-eval'; style-src 'self' https: 'unsafe-inline'
strict-transport-security:
max-age=63072000; includeSubDomains; preload
現在テスト中
ピアリング情報が分析中です。
現在テスト中
インターネットエクスチェンジデータが収集中です。
JavaScript分析
Security Analysis Alert
Client-side code analysis has identified potential security vulnerabilities and information disclosure risks.
公開されたJavaScript変数
Variables exposed in client-side code that may contain sensitive information
# Security Assessment: Variable Exposure Analysis
LEAK
key
stop
Risk: Information disclosure via client-side exposure
LEAK
url
[XSS working]
Risk: Information disclosure via client-side exposure
LEAK
devel
true
Risk: Information disclosure via client-side exposure
LEAK
Number
r
Risk: Information disclosure via client-side exposure
LEAK
access
function
Risk: Information disclosure via client-side exposure
LEAK
author
Jack
Risk: Information disclosure via client-side exposure
LEAK
_assign
[XSS working]
Risk: Information disclosure via client-side exposure
LEAK
fromURL
[sechttp]
Risk: Information disclosure via client-side exposure
LEAK
ownKeys
[sechttp]
Risk: Information disclosure via client-side exposure
LEAK
release
function
Risk: Information disclosure via client-side exposure
LEAK
_fromURL
[sechttp]
Risk: Information disclosure via client-side exposure
LEAK
addEvent
[sechttp]
Risk: Information disclosure via client-side exposure
LEAK
endPoint
Opacity
Risk: Information disclosure via client-side exposure
LEAK
getNewKey
function
Risk: Information disclosure via client-side exposure
LEAK
keysIndex
e
Risk: Information disclosure via client-side exposure
LEAK
nodeValue
n
Risk: Information disclosure via client-side exposure
LEAK
wrapInner
function
Risk: Information disclosure via client-side exposure
LEAK
nearestKey
[sechttp]
Risk: Information disclosure via client-side exposure
LEAK
statusCode
function
Risk: Information disclosure via client-side exposure
LEAK
targetTest
function
Risk: Information disclosure via client-side exposure
LEAK
originalKey
e
Risk: Information disclosure via client-side exposure
LEAK
mobileStatus
[XSS working]
Risk: Information disclosure via client-side exposure
LEAK
_toPropertyKey
[sechttp]
Risk: Information disclosure via client-side exposure
LEAK
addEventListener
function
Risk: Information disclosure via client-side exposure
LEAK
_getDecoratorsApi
[sechttp]
Risk: Information disclosure via client-side exposure
LEAK
AccessibleMegaMenu
[sechttp]
Risk: Information disclosure via client-side exposure
LEAK
boundingClientRect
targetRect
Risk: Information disclosure via client-side exposure
LEAK
_setKeyframeDefaults
[sechttp]
Risk: Information disclosure via client-side exposure
LEAK
_classPrivateFieldGet
[sechttp]
Risk: Information disclosure via client-side exposure
LEAK
_classPrivateFieldSet
[sechttp]
Risk: Information disclosure via client-side exposure
LEAK
getBoundingClientRect
[sechttp]
Risk: Information disclosure via client-side exposure
LEAK
__classPrivateFieldGet
[sechttp]
Risk: Information disclosure via client-side exposure
LEAK
__classPrivateFieldSet
[sechttp]
Risk: Information disclosure via client-side exposure
LEAK
_classPrivateMethodGet
[sechttp]
Risk: Information disclosure via client-side exposure
LEAK
_classPrivateMethodSet
[sechttp]
Risk: Information disclosure via client-side exposure
LEAK
_checkPrivateRedeclaration
[sechttp]
Risk: Information disclosure via client-side exposure
LEAK
_classPrivateFieldInitSpec
[sechttp]
Risk: Information disclosure via client-side exposure
LEAK
_classPrivateFieldLooseKey
[sechttp]
Risk: Information disclosure via client-side exposure
LEAK
_classPrivateFieldLooseBase
[sechttp]
Risk: Information disclosure via client-side exposure
LEAK
_classPrivateMethodInitSpec
[sechttp]
Risk: Information disclosure via client-side exposure
LEAK
_classStaticPrivateMethodGet
[sechttp]
Risk: Information disclosure via client-side exposure
LEAK
_classStaticPrivateMethodSet
[sechttp]
Risk: Information disclosure via client-side exposure
LEAK
_classCheckPrivateStaticAccess
[sechttp]
Risk: Information disclosure via client-side exposure
LEAK
_classStaticPrivateFieldSpecGet
[sechttp]
Risk: Information disclosure via client-side exposure
LEAK
_classStaticPrivateFieldSpecSet
[sechttp]
Risk: Information disclosure via client-side exposure
LEAK
getKeyframedConstructorFunction
function
Risk: Information disclosure via client-side exposure
LEAK
_classPrivateFieldDestructureSet
[sechttp]
Risk: Information disclosure via client-side exposure
LEAK
_classStaticPrivateFieldDestructureSet
[sechttp]
Risk: Information disclosure via client-side exposure
LEAK
_classCheckPrivateStaticFieldDescriptor
[sechttp]
Risk: Information disclosure via client-side exposure
Total: 49 exposed variables found
APIドメイン分析
External API domains discovered in client-side code
EXTERNAL_API_DOMAIN
api.websitecarbon.com
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
websitecarbon.com
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
gsap.com
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
www.apache.org
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
jquery.com
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
github.com
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
adobe.com
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
blogs.adobe.com
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
code.jquery.com
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
raw.github.com
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
flickity.metafizzy.co
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
bit.ly
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
w3c.github.io
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
JavaScriptリソース
JavaScript files loaded by the application
JS
https://citronnoir.com/wp-includes/js/jquery/jquery.min.js?ver=3.7.1
JS
https://unpkg.com/website-carbon-badges@1.1.3/b.min.js
JS
https://citronnoir.com/wp-content/plugins/wp-seopress/assets/js/seopress-cookies.min.js?ver=9.6
JS
https://citronnoir.com/wp-content/plugins/wp-seopress/assets/js/seopress-cookies-ajax.min.js?ver=9.6
JS
https://citronnoir.com/wp-content/plugins/motionpage/assets/js/gsap/gsap.min.js?ver=3.13.0
JS
https://citronnoir.com/wp-content/plugins/motionpage/assets/js/gsap/SplitText.min.js?ver=3.13.0
JS
https://citronnoir.com/wp-content/plugins/motionpage/assets/js/gsap/ScrollTrigger.min.js?ver=3.13.0
JS
https://citronnoir.com/wp-content/plugins/oxyextras/components/assets/accessible-megamenu.js?ver=1.0.0
JS
https://citronnoir.com/wp-content/plugins/oxyextras/components/assets/megamenu-init.js?ver=1.0.2
JS
https://citronnoir.com/wp-content/plugins/oxyextras/components/assets/countUp.js?ver=2.9.0
JS
https://citronnoir.com/wp-content/plugins/oxyextras/components/assets/flickity/flickity.pkgd.min.js?ver=2.2.1
JS
https://citronnoir.com/wp-content/plugins/oxyextras/components/assets/lottie-player.min.js?ver=1.0.1
JS
https://citronnoir.com/wp-content/plugins/oxyextras/components/assets/lottie-interactivity.js?ver=1.0.0
JS
https://citronnoir.com/wp-content/plugins/oxyextras/components/assets/intersectionobserver.js?ver=1.0.0
JS
https://citronnoir.com/wp-content/plugins/oxyextras/components/assets/lottie-init.js?ver=1.0.1
JS
https://citronnoir.com/wp-content/plugins/oxyextras/components/assets/flickity/flickity-init-4.js?ver=2.3.4
JS
https://citronnoir.com/wp-content/plugins/wp-rocket/assets/js/lazyload/17.8.3/lazyload.min.js
JS
"https://citronnoir.com/wp-includes/js/jquery/jquery.min.js?ver=3.7.1"
JS
"https://unpkg.com/website-carbon-badges@1.1.3/b.min.js"
JS
"https://citronnoir.com/wp-content/plugins/wp-seopress/assets/js/seopress-cookies.min.js?ver=9.6"
JS
"https://citronnoir.com/wp-content/plugins/wp-seopress/assets/js/seopress-cookies-ajax.min.js?ver=9.6"
JS
"https://citronnoir.com/wp-content/plugins/motionpage/assets/js/gsap/gsap.min.js?ver=3.13.0"
JS
"https://citronnoir.com/wp-content/plugins/motionpage/assets/js/gsap/SplitText.min.js?ver=3.13.0"
JS
"https://citronnoir.com/wp-content/plugins/motionpage/assets/js/gsap/ScrollTrigger.min.js?ver=3.13.0"
JS
"https://citronnoir.com/wp-content/plugins/oxyextras/components/assets/accessible-megamenu.js?ver=1.0.0"
JS
"https://citronnoir.com/wp-content/plugins/oxyextras/components/assets/megamenu-init.js?ver=1.0.2"
JS
"https://citronnoir.com/wp-content/plugins/oxyextras/components/assets/countUp.js?ver=2.9.0"
JS
"https://citronnoir.com/wp-content/plugins/oxyextras/components/assets/flickity/flickity.pkgd.min.js?ver=2.2.1"
JS
"https://citronnoir.com/wp-content/plugins/oxyextras/components/assets/lottie-player.min.js?ver=1.0.1"
JS
"https://citronnoir.com/wp-content/plugins/oxyextras/components/assets/lottie-interactivity.js?ver=1.0.0"
JS
"https://citronnoir.com/wp-content/plugins/oxyextras/components/assets/intersectionobserver.js?ver=1.0.0"
JS
"https://citronnoir.com/wp-content/plugins/oxyextras/components/assets/lottie-init.js?ver=1.0.1"
JS
"https://citronnoir.com/wp-content/plugins/oxyextras/components/assets/flickity/flickity-init-4.js?ver=2.3.4"
JS
"https://citronnoir.com/wp-content/plugins/wp-rocket/assets/js/lazyload/17.8.3/lazyload.min.js"
セキュリティ推奨事項
- • Avoid exposing sensitive variables in client-side code
- • Implement proper API authentication and rate limiting
- • Use environment variables for sensitive configuration
- • Regularly audit client-side code for information leaks
- • Minimize the amount of sensitive data processed on the client side
履歴スキャンレコード (1)
Agence de communication digitale à Montpellier. Citron Noir vous accompagne dans l'optimisation de votre stratégie de communication digitale.
65/100
4 issues