Scouts de Argentina

HTTPS

DOEL_ANALYSE

scouts.org.ar

IP: 0.0.0.0

ASN: AS0

Een uitgebreid beveiligings- en netwerkanalyserapport voor scouts.org.ar. Server: cloudflare.

Primaire Poort: 443
Scantijd: 4/12/2026, 7:29:50 PM
Deelbare Rapportlink: https://sechttp.com/scan/scouts.org.ar

Gedetailleerde Beveiligingsanalyse

Aanvalspad & DDoS-verdedigingsanalyse

Aanvaller

L4-verkeer

L7-verkeer

AS0 (cloudflare POP)

L4 Verdedigd

L7 Omzeild

L4 Geblokkeerd

L7-verkeer

Uw Server

Verdedigingsoverzicht

Hoewel cloudflare robuuste bescherming biedt tegen Layer 4 (netwerklaag) aanvallen, blijft uw server mogelijk kwetsbaar voor geavanceerde Layer 7 (toepassingslaag) aanvallen die standaard CDN-verdedigingen kunnen omzeilen. Aanvullende WAF-regels en beveiligingsmaatregelen aan de applicatiekant worden aanbevolen.

Laag 4 Verdediging

cloudflare Biedt robuuste bescherming tegen SYN-flood, UDP-versterking en volumetrische aanvallen aan de netwerkrand.

Laag 7 Kwetsbaarheden

Aanvallen op de toepassingslaag die gericht zijn op 3 blootgestelde API-eindpunten vereisen aanvullende WAF-regels en snelheidsbeperking.

Openbaarmaking Serverinformatie

LOW

INFO-001

Beschrijving

De server maakt zijn softwaretype bekend: cloudflare. Dit kan aanvallers helpen potentiële kwetsbaarheden te identificeren.

Aanbeveling

Configureer uw webserver om de Server-header te verbergen of aan te passen om openbaarmaking van informatie te voorkomen.

Ontbrekende X-Frame-Options Header

MEDIUM

SEC-002

Beschrijving

De site is niet beschermd tegen clickjacking-aanvallen.

Aanbeveling

Voeg de X-Frame-Options header toe met de waarde 'DENY' of 'SAMEORIGIN' om clickjacking te voorkomen.

Blootstelling Gevoelige Informatie in JavaScript

HIGH

JS-001

Beschrijving

Gevonden 43 mogelijk gevoelige variabelen blootgesteld in client-side JavaScript-code.

Aanbeveling

Controleer en verwijder gevoelige informatie uit client-side code. Gebruik omgevingsvariabelen en server-side verwerking voor gevoelige gegevens.

root@sechttp: /var/log/fuzz

 root@sechttp : ~ $ 
 >  [Code: 200]  
/v1/conversations/${e}/messages [GEVOELIG LEK]  
 >  [Code: 403]  
/v1/conversations  [VERBODEN] 
 >  [Code: 404]  
https://viewer.quick.bot/api   
 [+] Scan voltooid. Gevonden 1 potentiële lekken. 
root@sechttp:~$

Poortscanresultaten

   Poort Dienst Status Versie 
HTTP  GESLOTEN   -  
HTTPS  OPEN   TLS 1.3  
SSH  GEFILTERD   -  
MySQL  GESLOTEN   -  
  

Poort	Dienst	Status	Versie
80	HTTP	GESLOTEN	-
443	HTTPS	OPEN	TLS 1.3
22	SSH	GEFILTERD	-
3306	MySQL	GESLOTEN	-

HTTP Headers Analyse

age: 1 
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800} 
date: Sun, 12 Apr 2026 19:29:36 GMT 
link: <https://scouts.org.ar/wp-json/>; rel="https://api.w.org/", <https://scouts.org.ar/wp-json/wp/v2/pages/2>; rel="alternate"; title="JSON"; type="application/json", <https://scouts.org.ar/>; rel=shortlink 
vary: Accept-Encoding,User-Agent 
cf-ray: 9eb4a40b1cc6cb92-LAX 
server: cloudflare 
alt-svc: h3=":443"; ma=86400 
expires: Sun, 12 Apr 2026 19:29:34 GMT 
x-cache: HIT 
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=oy5XnTtjTOtcVpLd4eRbgAhT%2FqnIdfVUzzpO8QEC%2FxaAwNpC4dMJkYAy7gnM8kOwvA7eKxU3xAb3Oo%2BWJj1CA6WaHJxZDqow%2BM9xdNKs4ePm5UlucAEh1goUVP7I0Nyg"}]} 
connection: keep-alive 
content-type: text/html; charset=UTF-8 
cache-control: max-age=0 
server-timing: cfCacheStatus;desc="DYNAMIC", cfEdge;dur=16,cfOrigin;dur=284 
cf-cache-status: DYNAMIC 
transfer-encoding: chunked 
permissions-policy: private-state-token-redemption=(self "https://www.google.com" "https://www.gstatic.com" "https://recaptcha.net" "https://challenges.cloudflare.com" "https://hcaptcha.com"), private-state-token-issuance=(self "https://www.google.com" "https://www.gstatic.com" "https://recaptcha.net" "https://challenges.cloudflare.com" "https://hcaptcha.com") 
strict-transport-security: max-age=15552000; includeSubDomains 

Momenteel in Test

Peeringinformatie wordt geanalyseerd.

Momenteel in Test

Internet Exchange gegevens worden verzameld.

JavaScript Analyse

Security Analysis Alert

Client-side code analysis has identified potential security vulnerabilities and information disclosure risks.

Blootgestelde JavaScript Variabelen

43 Found

Variables exposed in client-side code that may contain sensitive information

# Security Assessment: Variable Exposure Analysis
 
LEAK
 
key
 t 

Risk: Information disclosure via client-side exposure
 
LEAK
 
url
 e 

Risk: Information disclosure via client-side exposure
 
LEAK
 
code
 r 

Risk: Information disclosure via client-side exposure
 
LEAK
 
keys
 e 

Risk: Information disclosure via client-side exposure
 
LEAK
 
sign
 e 

Risk: Information disclosure via client-side exposure
 
LEAK
 
phone
 n 

Risk: Information disclosure via client-side exposure
 
LEAK
 
token
 t 

Risk: Information disclosure via client-side exposure
 
LEAK
 
access
 function 

Risk: Information disclosure via client-side exposure
 
LEAK
 
altKey
 0 

Risk: Information disclosure via client-side exposure
 
LEAK
 
clientX
 0 

Risk: Information disclosure via client-side exposure
 
LEAK
 
clientY
 0 

Risk: Information disclosure via client-side exposure
 
LEAK
 
cookies
 [XSS working] 

Risk: Information disclosure via client-side exposure
 
LEAK
 
ctrlKey
 0 

Risk: Information disclosure via client-side exposure
 
LEAK
 
keyCode
 0 

Risk: Information disclosure via client-side exposure
 
LEAK
 
metaKey
 0 

Risk: Information disclosure via client-side exposure
 
LEAK
 
test_id
 r 

Risk: Information disclosure via client-side exposure
 
LEAK
 
charCode
 function 

Risk: Information disclosure via client-side exposure
 
LEAK
 
et_email
 s 

Risk: Information disclosure via client-side exposure
 
LEAK
 
publicId
 e 

Risk: Information disclosure via client-side exposure
 
LEAK
 
shiftKey
 0 

Risk: Information disclosure via client-side exposure
 
LEAK
 
nodeValue
 n 

Risk: Information disclosure via client-side exposure
 
LEAK
 
onKeyDown
 e 

Risk: Information disclosure via client-side exposure
 
LEAK
 
sessionId
 w 

Risk: Information disclosure via client-side exposure
 
LEAK
 
wrapInner
 function 

Risk: Information disclosure via client-side exposure
 
LEAK
 
bytesToHex
 function 

Risk: Information disclosure via client-side exposure
 
LEAK
 
keySplines
 0.2 0.2 0.4 0.8;0.2 0.2 0.4 0.8;0.2 0.2 0.4 0.8 

Risk: Information disclosure via client-side exposure
 
LEAK
 
statusCode
 function 

Risk: Information disclosure via client-side exposure
 
LEAK
 
tokenStart
 o 

Risk: Information disclosure via client-side exposure
 
LEAK
 
tokenLength
 i 

Risk: Information disclosure via client-side exposure
 
LEAK
 
bytesToWords
 function 

Risk: Information disclosure via client-side exposure
 
LEAK
 
onMissingKey
 null 

Risk: Information disclosure via client-side exposure
 
LEAK
 
updateStyles
 function 

Risk: Information disclosure via client-side exposure
 
LEAK
 
bytesToBase64
 function 

Risk: Information disclosure via client-side exposure
 
LEAK
 
bytesToString
 function 

Risk: Information disclosure via client-side exposure
 
LEAK
 
isTouchDevice
 function 

Risk: Information disclosure via client-side exposure
 
LEAK
 
toggleKeydown
 function 

Risk: Information disclosure via client-side exposure
 
LEAK
 
MozPrintableKey
 Unidentified 

Risk: Information disclosure via client-side exposure
 
LEAK
 
isMobilePreview
 s 

Risk: Information disclosure via client-side exposure
 
LEAK
 
clientSideAction
 g 

Risk: Information disclosure via client-side exposure
 
LEAK
 
et_pb_ab_test_id
 e 

Risk: Information disclosure via client-side exposure
 
LEAK
 
clientSideActions
 p 

Risk: Information disclosure via client-side exposure
 
LEAK
 
wt.MozPrintableKey
 Unidentified 

Risk: Information disclosure via client-side exposure
 
LEAK
 
callbackHandlerNumberCounter
 function 

Risk: Information disclosure via client-side exposure
 
Total: 43 exposed variables found

API Domein Analyse

29 Domains

External API domains discovered in client-side code

EXTERNAL_API_DOMAIN

www.dynamicdrive.com

Reachable

HTTPS Enabled

Security Note: