Recette de cuisine : 63 000 recettes de cuisine française et du monde
HTTPS
ターゲット分析
cuisine.journaldesfemmes.fr
IP： 0.0.0.0
ASN： AS0
cuisine.journaldesfemmes.frの包括的なセキュリティおよびネットワーク分析レポート。
- 主要ポート
- 443
- スキャン時間
- 共有可能なレポートリンク
- https://sechttp.com/scan/cuisine.journaldesfemmes.fr
詳細なセキュリティ分析
攻撃経路およびDDoS防御分析
攻撃者
L4トラフィック
L7トラフィック
AS0 (Unknown POP)
L4防御済み
L7回避
L4ブロック済み
L7トラフィック
あなたのサーバー
防御概要
Unknownはレイヤー4（ネットワークレベル）の攻撃に対して強固な保護を提供しますが、標準的なCDN防御を回避する可能性のある高度なレイヤー7（アプリケーションレベル）の攻撃に対して、サーバーは依然として脆弱である可能性があります。追加のWAFルールとアプリケーション側のセキュリティ対策が推奨されます。
レイヤー4防御
Unknown ネットワークエッジでSYNフラッド、UDP増幅、およびボリュメトリック攻撃に対する強固な保護を提供します。
レイヤー7の脆弱性
5の公開されたAPIエンドポイントを標的とするアプリケーションレベルの攻撃には、追加のWAFルールとレート制限が必要です。
HSTSヘッダーの欠如または無効
MEDIUMSEC-001
説明
Strict-Transport-Securityヘッダーが正しく構成されておらず、サイトが中間者攻撃に対して脆弱です。
推奨事項
適切なmax-age値を持つStrict-Transport-Securityヘッダーを追加して、HTTPS接続を強制することでHSTSを実装します。
JavaScriptでの機密情報露出
HIGHJS-001
説明
クライアント側のJavaScriptコードで66個の潜在的に機密な変数が公開されています。
推奨事項
クライアント側のコードから機密情報を確認して削除します。機密データには環境変数とサーバー側処理を使用します。
root@sechttp: /var/log/fuzz
root@sechttp : ~ $
> [Code: 200]
/api/microforum/avis/?id= [機密漏洩]
> [Code: 403]
/api/microforum/avis/ [禁止]
> [Code: 404]
/api/tagconf/ > [Code: 200]
/api/block/ [機密漏洩]
> [Code: 403]
/api/contentconf/ [禁止]
[+] スキャン完了。発見されたもの： 2 潜在的な漏洩。
root@sechttp : ~ $
ポートスキャンの結果
| ポート | サービス | ステータス | バージョン |
|---|---|---|---|
| 80 | HTTP | クローズ | - |
| 443 | HTTPS | オープン | TLS 1.3 |
| 22 | SSH | フィルタリング済み | - |
| 3306 | MySQL | クローズ | - |
HTTPヘッダー分析
date:
Sun, 12 Apr 2026 17:31:06 GMT
pragma:
no-cache
expires:
Sun, 12 Apr 2026 17:31:06 GMT
x-ccm-lm:
1776014563
connection:
keep-alive
x-served-by:
lxc-varnish-jdf-04
content-type:
text/html; charset=UTF-8
cache-control:
max-age=0, no-cache
last-modified:
Sun, 12 Apr 2026 17:26:28 GMT
content-length:
229085
x-ccm-cache-tag:
jdf_ctag_91
x-frame-options:
sameorigin
x-www-served-by:
vm_k8s_prod_21
content-language:
fr
x-cache-esi-debug:
Forwarded
content-security-policy:
frame-ancestors 'self'
現在テスト中
ピアリング情報が分析中です。
現在テスト中
インターネットエクスチェンジデータが収集中です。
JavaScript分析
Security Analysis Alert
Client-side code analysis has identified potential security vulnerabilities and information disclosure risks.
公開されたJavaScript変数
Variables exposed in client-side code that may contain sensitive information
# Security Assessment: Variable Exposure Analysis
LEAK
API
,e)});else{console.warn(
Risk: Information disclosure via client-side exposure
LEAK
dev
null
Risk: Information disclosure via client-side exposure
LEAK
key
getTranslation
Risk: Information disclosure via client-side exposure
LEAK
url
/api/contentconf/
Risk: Information disclosure via client-side exposure
LEAK
code
MODULE_NOT_FOUND
Risk: Information disclosure via client-side exposure
LEAK
keys
n
Risk: Information disclosure via client-side exposure
LEAK
test
\x3c!--@MOD:widget@{
Risk: Information disclosure via client-side exposure
LEAK
email
void
Risk: Information disclosure via client-side exposure
LEAK
keyup
1
Risk: Information disclosure via client-side exposure
LEAK
token
t
Risk: Information disclosure via client-side exposure
LEAK
COOKIE
D, dd M yy
Risk: Information disclosure via client-side exposure
LEAK
access
function
Risk: Information disclosure via client-side exposure
LEAK
author
o
Risk: Information disclosure via client-side exposure
LEAK
client
+e.clientId+
Risk: Information disclosure via client-side exposure
LEAK
domain
null
Risk: Information disclosure via client-side exposure
LEAK
getUrl
function
Risk: Information disclosure via client-side exposure
LEAK
mailto
redac
Risk: Information disclosure via client-side exposure
LEAK
baseUrl
//
Risk: Information disclosure via client-side exposure
LEAK
dataKey
data-channelId
Risk: Information disclosure via client-side exposure
LEAK
fileAPI
+E);var T,S=(j||C)&&!E;!1!==t.iframe&&(t.iframe||S)?t.closeKeepAlive?e.get(t.closeKeepAlive,function(){T=N(y)}):T=N(y):T=(j||C)&&E?M(y):e.ajax(t),p.removeData(
Risk: Information disclosure via client-side exposure
LEAK
keyCode
e
Risk: Information disclosure via client-side exposure
LEAK
keydown
1
Risk: Information disclosure via client-side exposure
LEAK
sitekey
6LfcECcUAAAAANw9v7LQYqYsrkQmseAxos7r8wQP
Risk: Information disclosure via client-side exposure
LEAK
urlHash
window
Risk: Information disclosure via client-side exposure
LEAK
_doKeyUp
function
Risk: Information disclosure via client-side exposure
LEAK
_keydown
function
Risk: Information disclosure via client-side exposure
LEAK
adDomain
null
Risk: Information disclosure via client-side exposure
LEAK
b.domain
<empty_value>
Risk: Information disclosure via client-side exposure
LEAK
charCode
e
Risk: Information disclosure via client-side exposure
LEAK
clientId
breakingnews
Risk: Information disclosure via client-side exposure
LEAK
keypress
function
Risk: Information disclosure via client-side exposure
LEAK
shareUrl
encodeURIComponent
Risk: Information disclosure via client-side exposure
LEAK
snapItem
s
Risk: Information disclosure via client-side exposure
LEAK
urlLabel
m
Risk: Information disclosure via client-side exposure
LEAK
_isNumber
function
Risk: Information disclosure via client-side exposure
LEAK
_keyEvent
function
Risk: Information disclosure via client-side exposure
LEAK
i.keydown
_keydown
Risk: Information disclosure via client-side exposure
LEAK
wrapInner
function
Risk: Information disclosure via client-side exposure
LEAK
_doKeyDown
function
Risk: Information disclosure via client-side exposure
LEAK
_onKeyDown
function
Risk: Information disclosure via client-side exposure
LEAK
b.clientId
<empty_value>
Risk: Information disclosure via client-side exposure
LEAK
contentUrl
a
Risk: Information disclosure via client-side exposure
LEAK
statusCode
function
Risk: Information disclosure via client-side exposure
LEAK
_doKeyPress
function
Risk: Information disclosure via client-side exposure
LEAK
_tabKeydown
function
Risk: Information disclosure via client-side exposure
LEAK
credentials
include
Risk: Information disclosure via client-side exposure
LEAK
facebookUrl
a
Risk: Information disclosure via client-side exposure
LEAK
numberFormat
null
Risk: Information disclosure via client-side exposure
LEAK
pinterestUrl
a
Risk: Information disclosure via client-side exposure
LEAK
_panelKeyDown
function
Risk: Information disclosure via client-side exposure
LEAK
_panelKeydown
function
Risk: Information disclosure via client-side exposure
LEAK
defaultDomain
fc
Risk: Information disclosure via client-side exposure
LEAK
getPublicPath
function
Risk: Information disclosure via client-side exposure
LEAK
maxRatingKeys
100
Risk: Information disclosure via client-side exposure
LEAK
urlParameters
window
Risk: Information disclosure via client-side exposure
LEAK
getResourceUrl
function
Risk: Information disclosure via client-side exposure
LEAK
numberOfMonths
1
Risk: Information disclosure via client-side exposure
LEAK
storageKeyName
ccmratings
Risk: Information disclosure via client-side exposure
LEAK
ratingKeysToDrop
90
Risk: Information disclosure via client-side exposure
LEAK
jPaginationNumber
paginationNumber
Risk: Information disclosure via client-side exposure
LEAK
pinterestMediaUrl
a
Risk: Information disclosure via client-side exposure
LEAK
_getNumberOfMonths
function
Risk: Information disclosure via client-side exposure
LEAK
_closeOnClickOutside
function
Risk: Information disclosure via client-side exposure
LEAK
_intersectsWithSides
function
Risk: Information disclosure via client-side exposure
LEAK
defaultOptions.dataKey
data-channelId
Risk: Information disclosure via client-side exposure
LEAK
getUrlForExternalResource
function
Risk: Information disclosure via client-side exposure
Total: 66 exposed variables found
APIドメイン分析
External API domains discovered in client-side code
EXTERNAL_API_DOMAIN
jqueryui.com
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
astatic.ccmbg.com
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
assets-sourcemaps.s3.prod.ccmbg.net
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
www.ccmbenchmark.com
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
fonts.googleapis.com
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
www.linternaute.com
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
www.qlf.linternaute.com
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
www.local.linternaute.com
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
www.journaldunet.com
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
www.qlf.journaldunet.com
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
www.local.journaldunet.com
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
www.facebook.com
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
e.infogram.com
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
p.ccmbg.com
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
static.ccmbg.com
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
cdn.jsdelivr.net
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
発見されたAPIエンドポイント
API endpoints identified through static analysis of client-side code
GET
/api/microforum/avis/?id=
Active
Endpoint discovered via client-side code analysis
GET
/api/microforum/avis/
Active
Endpoint discovered via client-side code analysis
GET
/api/tagconf/
Active
Endpoint discovered via client-side code analysis
GET
/api/block/
Active
Endpoint discovered via client-side code analysis
GET
/api/contentconf/
Active
Endpoint discovered via client-side code analysis
JavaScriptリソース
JavaScript files loaded by the application
JS
https://html5shim.googlecode.com/svn/trunk/html5.js
JS
https://ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js
JS
https://ajax.googleapis.com/ajax/libs/jqueryui/1.12.1/jquery-ui.min.js
JS
https://astatic.ccmbg.com/ccmcms_journaldesfemmes/dist/app/js/commons.5af8960e3444b75866cb.js
JS
https://astatic.ccmbg.com/ccmcms_journaldesfemmes/dist/app/js/app.03ad5c43ca7eb1f08c37.js
JS
https://astatic.ccmbg.com/ccmcms_journaldesfemmes/dist/app/js/start.bbf62f01cfd525f576e9.js
JS
"https://html5shim.googlecode.com/svn/trunk/html5.js"
JS
"https://ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js"
JS
"https://ajax.googleapis.com/ajax/libs/jqueryui/1.12.1/jquery-ui.min.js"
JS
"https://astatic.ccmbg.com/ccmcms_journaldesfemmes/dist/app/js/commons.5af8960e3444b75866cb.js"
JS
"https://astatic.ccmbg.com/ccmcms_journaldesfemmes/dist/app/js/app.03ad5c43ca7eb1f08c37.js"
JS
"https://astatic.ccmbg.com/ccmcms_journaldesfemmes/dist/app/js/start.bbf62f01cfd525f576e9.js"
セキュリティ推奨事項
- • Avoid exposing sensitive variables in client-side code
- • Implement proper API authentication and rate limiting
- • Use environment variables for sensitive configuration
- • Regularly audit client-side code for information leaks
- • Minimize the amount of sensitive data processed on the client side
履歴スキャンレコード (1)
65/100
4 issues