Deglingo Scout — Outil d'analyse Sorare SO7

HTTPS

DOEL_ANALYSE

scout.deglingosorare.com

IP: 0.0.0.0

ASN: AS0

Een uitgebreid beveiligings- en netwerkanalyserapport voor scout.deglingosorare.com. Server: cloudflare.

Primaire Poort: 443
Scantijd: 4/12/2026, 7:26:36 PM
Deelbare Rapportlink: https://sechttp.com/scan/scout.deglingosorare.com

Gedetailleerde Beveiligingsanalyse

Aanvalspad & DDoS-verdedigingsanalyse

Aanvaller

L4-verkeer

L7-verkeer

AS0 (cloudflare POP)

L4 Verdedigd

L7 Omzeild

L4 Geblokkeerd

L7-verkeer

Uw Server

Verdedigingsoverzicht

Hoewel cloudflare robuuste bescherming biedt tegen Layer 4 (netwerklaag) aanvallen, blijft uw server mogelijk kwetsbaar voor geavanceerde Layer 7 (toepassingslaag) aanvallen die standaard CDN-verdedigingen kunnen omzeilen. Aanvullende WAF-regels en beveiligingsmaatregelen aan de applicatiekant worden aanbevolen.

Laag 4 Verdediging

cloudflare Biedt robuuste bescherming tegen SYN-flood, UDP-versterking en volumetrische aanvallen aan de netwerkrand.

Laag 7 Kwetsbaarheden

Aanvallen op de toepassingslaag die gericht zijn op 9 blootgestelde API-eindpunten vereisen aanvullende WAF-regels en snelheidsbeperking.

Openbaarmaking Serverinformatie

LOW

INFO-001

Beschrijving

De server maakt zijn softwaretype bekend: cloudflare. Dit kan aanvallers helpen potentiële kwetsbaarheden te identificeren.

Aanbeveling

Configureer uw webserver om de Server-header te verbergen of aan te passen om openbaarmaking van informatie te voorkomen.

Ontbrekende of Ongeldige HSTS Header

MEDIUM

SEC-001

Beschrijving

De Strict-Transport-Security header is niet correct geconfigureerd, waardoor de site kwetsbaar is voor man-in-the-middle aanvallen.

Aanbeveling

Implementeer HSTS door de Strict-Transport-Security header toe te voegen met een geschikte max-age waarde om HTTPS-verbindingen af te dwingen.

Ontbrekende X-Frame-Options Header

MEDIUM

SEC-002

Beschrijving

De site is niet beschermd tegen clickjacking-aanvallen.

Aanbeveling

Voeg de X-Frame-Options header toe met de waarde 'DENY' of 'SAMEORIGIN' om clickjacking te voorkomen.

Blootstelling Gevoelige Informatie in JavaScript

HIGH

JS-001

Beschrijving

Gevonden 30 mogelijk gevoelige variabelen blootgesteld in client-side JavaScript-code.

Aanbeveling

Controleer en verwijder gevoelige informatie uit client-side code. Gebruik omgevingsvariabelen en server-side verwerking voor gevoelige gegevens.

root@sechttp: /var/log/fuzz

 root@sechttp : ~ $ 
 >  [Code: 200]  
/api/sorare/cards [GEVOELIG LEK]  
 >  [Code: 403]  
/api/sorare/cards?rawq=%7BcurrentUser%7Bslug%20nickname%7D%7D  [VERBODEN] 
 >  [Code: 404]  
/api/sorare/cards?rawq=%7BcurrentUser%7Bslug%20nickname%20cards(first%3A50%2Csport%3AFOOTBALL)%7Bnodes%7Bslug%20name%20rarityTyped%20pictureUrl%20power%20cardEditionName%20...%20on%20Card%7Bplayer%7Bslug%20displayName%20position%7D%7D%7DpageInfo%7BhasNextPage%20endCursor%7D%7D%7D%7D   
 >  [Code: 200]  
/api/sorare/cards?rawq=query(%24a%3AString!)%7BcurrentUser%7Bcards(first%3A50%2Csport%3AFOOTBALL%2Cafter%3A%24a)%7Bnodes%7Bslug%20name%20rarityTyped%20pictureUrl%20power%20cardEditionName%20...%20on%20Card%7Bplayer%7Bslug%20displayName%20position%7D%7D%7DpageInfo%7BhasNextPage%20endCursor%7D%7D%7D%7D&vars=${encodeURIComponent(JSON.stringify({a:u}))} [GEVOELIG LEK]  
 >  [Code: 403]  
/data/players.json  [VERBODEN] 
 >  [Code: 404]  
/data/teams.json   
 >  [Code: 200]  
/data/fixtures.json [GEVOELIG LEK]  
 >  [Code: 403]  
/data/club_logos.json  [VERBODEN] 
 >  [Code: 404]  
/data/match_events.json   
 [+] Scan voltooid. Gevonden 3 potentiële lekken. 
root@sechttp:~$

Poortscanresultaten

   Poort Dienst Status Versie 
HTTP  GESLOTEN   -  
HTTPS  OPEN   TLS 1.3  
SSH  GEFILTERD   -  
MySQL  GESLOTEN   -  
  

Poort	Dienst	Status	Versie
80	HTTP	GESLOTEN	-
443	HTTPS	OPEN	TLS 1.3
22	SSH	GEFILTERD	-
3306	MySQL	GESLOTEN	-

HTTP Headers Analyse

nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800} 
date: Sun, 12 Apr 2026 19:26:26 GMT 
link: <https://fonts.googleapis.com>; rel="preconnect" 
cf-ray: 9eb49f679994cba0-LAX 
server: cloudflare 
alt-svc: h3=":443"; ma=86400 
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=BNaY4IYs9ZJHNr5%2B%2F%2BQKf8XJ5mfFQO1R%2BgSnE7on5ClIKKyhxVBhSSum%2Fg3dpMpz4wCcG%2FAtMRX92QFyUqn%2B2aTiSdm4g6uCB34KsmXwGl1ULexHw3%2BSe27PsznAdcPieH0ZwncUnC0roFg%3D"}]} 
connection: keep-alive 
content-type: text/html; charset=utf-8 
cache-control: public, max-age=0, must-revalidate 
server-timing: cfCacheStatus;desc="DYNAMIC", cfEdge;dur=16,cfOrigin;dur=37 
cf-cache-status: DYNAMIC 
referrer-policy: strict-origin-when-cross-origin 
transfer-encoding: chunked 
x-content-type-options: nosniff 
access-control-allow-origin: * 

Momenteel in Test

Peeringinformatie wordt geanalyseerd.

Momenteel in Test

Internet Exchange gegevens worden verzameld.

JavaScript Analyse

Security Analysis Alert

Client-side code analysis has identified potential security vulnerabilities and information disclosure risks.

Blootgestelde JavaScript Variabelen

30 Found

Variables exposed in client-side code that may contain sensitive information

# Security Assessment: Variable Exposure Analysis
 
LEAK
 
key
 g 

Risk: Information disclosure via client-side exposure
 
LEAK
 
url
 e 

Risk: Information disclosure via client-side exposure
 
LEAK
 
code
 e 

Risk: Information disclosure via client-side exposure
 
LEAK
 
side
 e 

Risk: Information disclosure via client-side exposure
 
LEAK
 
OAuth
 state 

Risk: Information disclosure via client-side exposure
 
LEAK
 
gwKey
 l 

Risk: Information disclosure via client-side exposure
 
LEAK
 
Upside
 as 

Risk: Information disclosure via client-side exposure
 
LEAK
 
altKey
 0 

Risk: Information disclosure via client-side exposure
 
LEAK
 
colKey
 t 

Risk: Information disclosure via client-side exposure
 
LEAK
 
upside
 lots 

Risk: Information disclosure via client-side exposure
 
LEAK
 
clientX
 0 

Risk: Information disclosure via client-side exposure
 
LEAK
 
clientY
 0 

Risk: Information disclosure via client-side exposure
 
LEAK
 
ctrlKey
 0 

Risk: Information disclosure via client-side exposure
 
LEAK
 
keyCode
 0 

Risk: Information disclosure via client-side exposure
 
LEAK
 
metaKey
 0 

Risk: Information disclosure via client-side exposure
 
LEAK
 
charCode
 function 

Risk: Information disclosure via client-side exposure
 
LEAK
 
gwNumber
 c 

Risk: Information disclosure via client-side exposure
 
LEAK
 
shiftKey
 0 

Risk: Information disclosure via client-side exposure
 
LEAK
 
endDateStr
 d 

Risk: Information disclosure via client-side exposure
 
LEAK
 
pictureUrl
 e 

Risk: Information disclosure via client-side exposure
 
LEAK
 
cacheSignal
 function 

Risk: Information disclosure via client-side exposure
 
LEAK
 
startDateStr
 u 

Risk: Information disclosure via client-side exposure
 
LEAK
 
aa_possession
 20 

Risk: Information disclosure via client-side exposure
 
LEAK
 
displayNumber
 r 

Risk: Information disclosure via client-side exposure
 
LEAK
 
sorare_pro_url
 t 

Risk: Information disclosure via client-side exposure
 
LEAK
 
O.aa_possession
 20 

Risk: Information disclosure via client-side exposure
 
LEAK
 
addEventListener
 function 

Risk: Information disclosure via client-side exposure
 
LEAK
 
sorare_stellar_url
 t 

Risk: Information disclosure via client-side exposure
 
LEAK
 
stellar_shiny_jersey_number
 20 

Risk: Information disclosure via client-side exposure
 
LEAK
 
Ve.stellar_shiny_jersey_number
 20 

Risk: Information disclosure via client-side exposure
 
Total: 30 exposed variables found

API Domein Analyse

9 Domains

External API domains discovered in client-side code

EXTERNAL_API_DOMAIN

react.dev

Reachable

HTTPS Enabled

Security Note:

External API domains should be validated for proper authentication and rate limiting

EXTERNAL_API_DOMAIN

flagcdn.com

Reachable

HTTPS Enabled

Security Note:

External API domains should be validated for proper authentication and rate limiting

EXTERNAL_API_DOMAIN

deglingo-fight-counter.damien-gheza.workers.dev

Reachable

HTTPS Enabled

Security Note:

External API domains should be validated for proper authentication and rate limiting

EXTERNAL_API_DOMAIN

sorare.pxf.io

Reachable

HTTPS Enabled

Security Note:

External API domains should be validated for proper authentication and rate limiting

EXTERNAL_API_DOMAIN

scout.deglingosorare.com

Reachable

HTTPS Enabled

Security Note:

External API domains should be validated for proper authentication and rate limiting

EXTERNAL_API_DOMAIN

sorare.com

Reachable

HTTPS Enabled

Security Note:

External API domains should be validated for proper authentication and rate limiting

EXTERNAL_API_DOMAIN

assets.sorare.com

Reachable

HTTPS Enabled

Security Note:

External API domains should be validated for proper authentication and rate limiting

EXTERNAL_API_DOMAIN

cloudflareinsights.com

Reachable

HTTPS Enabled

Security Note:

External API domains should be validated for proper authentication and rate limiting

EXTERNAL_API_DOMAIN

github.com

Reachable

HTTPS Enabled

Security Note:

External API domains should be validated for proper authentication and rate limiting

Ontdekte API Eindpunten

9 Routes

API endpoints identified through static analysis of client-side code

GET /api/sorare/cards

Active