Bienvenue ! | La Boutique Scoute
HTTPS
TARGET_ANALYSIS
laboutiquescoute.com
IP: 0.0.0.0
ASN: AS0
A comprehensive security and network analysis report for laboutiquescoute.com. Server: Apache.
- Primary Port
- 443
- Scan Time
- Shareable Report Link
- https://sechttp.com/scan/laboutiquescoute.com
Detailed Security Analysis
Attack Path & DDoS Defense Analysis
Attacker
L4 Traffic
L7 Traffic
AS0 (Apache POP)
L4 Defended
L7 Bypassed
L4 Blocked
L7 Traffic
Your Server
Defense Summary
While Apache provides robust protection against Layer 4 (network-level) attacks, your server remains potentially vulnerable to sophisticated Layer 7 (application-level) attacks that can bypass standard CDN defenses. Additional WAF rules and application-side security measures are recommended.
Layer 4 Defense
Apache provides robust SYN flood, UDP amplification, and volumetric attack protection at the network edge.
Layer 7 Vulnerabilities
Application-layer attacks targeting 0 exposed API endpoints require additional WAF rules and rate limiting.
Server Information Disclosure
LOWINFO-001
Description
The server is disclosing its software type: Apache. This can help attackers identify potential vulnerabilities.
Recommendation
Configure your web server to hide or modify the Server header to prevent information disclosure.
Missing or Invalid HSTS Header
MEDIUMSEC-001
Description
The Strict-Transport-Security header is not properly configured, leaving the site vulnerable to man-in-the-middle attacks.
Recommendation
Implement HSTS by adding the Strict-Transport-Security header with a proper max-age value to force HTTPS connections.
Sensitive Information Exposure in JavaScript
HIGHJS-001
Description
Found 89 potentially sensitive variables exposed in client-side JavaScript code.
Recommendation
Review and remove sensitive information from client-side code. Use environment variables and server-side processing for sensitive data.
Currently Testing
No fuzzing data available for this scan.
Port Scan Results
| Port | Service | Status | Version |
|---|---|---|---|
| 80 | HTTP | CLOSED | - |
| 443 | HTTPS | OPEN | TLS 1.3 |
| 22 | SSH | FILTERED | - |
| 3306 | MySQL | CLOSED | - |
HTTP Headers Analysis
date:
Sun, 12 Apr 2026 19:25:31 GMT
vary:
Accept-Encoding
server:
Apache
expires:
Sun, 19 Nov 1978 05:00:00 GMT
connection:
close
x-generator:
Drupal 9 (https://www.drupal.org)
content-type:
text/html; charset=UTF-8
cache-control:
must-revalidate, no-cache, private
x-drupal-cache:
HIT
x-frame-options:
SAMEORIGIN
x-ua-compatible:
IE=edge
content-language:
fr
transfer-encoding:
chunked
permissions-policy:
interest-cohort=()
x-content-type-options:
nosniff, nosniff
x-drupal-dynamic-cache:
UNCACHEABLE
Currently Testing
Peering information is being analyzed.
Currently Testing
Internet Exchange data is being collected.
JavaScript Analysis
Security Analysis Alert
Client-side code analysis has identified potential security vulnerabilities and information disclosure risks.
Exposed JavaScript Variables
Variables exposed in client-side code that may contain sensitive information
# Security Assessment: Variable Exposure Analysis
LEAK
URL
, link.href);
}
});
}
// Fonction appelée lorsqu
Risk: Information disclosure via client-side exposure
LEAK
key
[XSS working]
Risk: Information disclosure via client-side exposure
LEAK
url
e
Risk: Information disclosure via client-side exposure
LEAK
code
this
Risk: Information disclosure via client-side exposure
LEAK
clsid
D27CDB6E
Risk: Information disclosure via client-side exposure
LEAK
devis
, error);
});
},
});
}
async function addQuoteToCart(id_devis, id_doc_line, article_id, event) {
if (isNaN(id_devis)) {
console.error(
Risk: Information disclosure via client-side exposure
LEAK
email
document
Risk: Information disclosure via client-side exposure
LEAK
token
new
Risk: Information disclosure via client-side exposure
LEAK
access
function
Risk: Information disclosure via client-side exposure
LEAK
assign
[sechttp]
Risk: Information disclosure via client-side exposure
LEAK
domain
+u:
Risk: Information disclosure via client-side exposure
LEAK
getUrl
[sechttp]
Risk: Information disclosure via client-side exposure
LEAK
keyNum
[XSS working]
Risk: Information disclosure via client-side exposure
LEAK
newUrl
[XSS working]
Risk: Information disclosure via client-side exposure
LEAK
number
this
Risk: Information disclosure via client-side exposure
LEAK
baseURL
e
Risk: Information disclosure via client-side exposure
LEAK
baseUrl
[XSS working]
Risk: Information disclosure via client-side exposure
LEAK
blobUrl
[XSS working]
Risk: Information disclosure via client-side exposure
LEAK
cartUrl
[XSS working]
Risk: Information disclosure via client-side exposure
LEAK
code_pr
code_pr
Risk: Information disclosure via client-side exposure
LEAK
keyword
keyword
Risk: Information disclosure via client-side exposure
LEAK
metaURL
[XSS working]
Risk: Information disclosure via client-side exposure
LEAK
nextKey
[XSS working]
Risk: Information disclosure via client-side exposure
LEAK
ownKeys
function
Risk: Information disclosure via client-side exposure
LEAK
release
function
Risk: Information disclosure via client-side exposure
LEAK
caracKey
[XSS working]
Risk: Information disclosure via client-side exposure
LEAK
isNumber
function
Risk: Information disclosure via client-side exposure
LEAK
password
[XSS working]
Risk: Information disclosure via client-side exposure
LEAK
urlParts
[XSS working]
Risk: Information disclosure via client-side exposure
LEAK
url_cart
[XSS working]
Risk: Information disclosure via client-side exposure
LEAK
code_pays
[XSS working]
Risk: Information disclosure via client-side exposure
LEAK
id_client
id_client
Risk: Information disclosure via client-side exposure
LEAK
image_url
no_img_path
Risk: Information disclosure via client-side exposure
LEAK
telephone
document
Risk: Information disclosure via client-side exposure
LEAK
urlParams
[XSS working]
Risk: Information disclosure via client-side exposure
LEAK
wrapInner
function
Risk: Information disclosure via client-side exposure
LEAK
articleUrl
[XSS working]
Risk: Information disclosure via client-side exposure
LEAK
codepostal
${item?.adresse?.code_postal}
Risk: Information disclosure via client-side exposure
LEAK
currentURL
[XSS working]
Risk: Information disclosure via client-side exposure
LEAK
emailInput
[XSS working]
Risk: Information disclosure via client-side exposure
LEAK
htmlDecode
function
Risk: Information disclosure via client-side exposure
LEAK
lineNumber
this
Risk: Information disclosure via client-side exposure
LEAK
statusCode
function
Risk: Information disclosure via client-side exposure
LEAK
testMarker
[XSS working]
Risk: Information disclosure via client-side exposure
LEAK
absoluteUrl
[XSS working]
Risk: Information disclosure via client-side exposure
LEAK
byteNumbers
[XSS working]
Risk: Information disclosure via client-side exposure
LEAK
clientInfos
null
Risk: Information disclosure via client-side exposure
LEAK
code_barres
search
Risk: Information disclosure via client-side exposure
LEAK
code_coupon
[XSS working]
Risk: Information disclosure via client-side exposure
LEAK
code_postal
code_postal
Risk: Information disclosure via client-side exposure
LEAK
credentials
same-origin
Risk: Information disclosure via client-side exposure
LEAK
newPassword
<empty_value>
Risk: Information disclosure via client-side exposure
LEAK
columnNumber
this
Risk: Information disclosure via client-side exposure
LEAK
envoyerDevis
[sechttp]
Risk: Information disclosure via client-side exposure
LEAK
isValidEmail
[XSS working]
Risk: Information disclosure via client-side exposure
LEAK
new_password
this
Risk: Information disclosure via client-side exposure
LEAK
phone_number
phone_number
Risk: Information disclosure via client-side exposure
LEAK
tarif_client
[XSS working]
Risk: Information disclosure via client-side exposure
LEAK
url_products
[XSS working]
Risk: Information disclosure via client-side exposure
LEAK
Authorization
"Basic "+btoa(h+":"+m)}var v=s(e.baseURL,e.url)
Risk: Information disclosure via client-side exposure
LEAK
accessibility
false
Risk: Information disclosure via client-side exposure
LEAK
viewDetailUrl
[XSS working]
Risk: Information disclosure via client-side exposure
LEAK
comment_client
comment_client
Risk: Information disclosure via client-side exposure
LEAK
deletedFileKey
'deleted_file_' + articleId + '_' + optionId
Risk: Information disclosure via client-side exposure
LEAK
detailUrlHover
[XSS working]
Risk: Information disclosure via client-side exposure
LEAK
devisComponent
[sechttp]
Risk: Information disclosure via client-side exposure
LEAK
updatePassword
function
Risk: Information disclosure via client-side exposure
LEAK
urlParsingNode
[XSS working]
Risk: Information disclosure via client-side exposure
LEAK
validateStatus
function
Risk: Information disclosure via client-side exposure
LEAK
xsrfCookieName
XSRF-TOKEN
Risk: Information disclosure via client-side exposure
LEAK
configuratorUrl
[XSS working]
Risk: Information disclosure via client-side exposure
LEAK
confirmPassword
<empty_value>
Risk: Information disclosure via client-side exposure
LEAK
currentPassword
<empty_value>
Risk: Information disclosure via client-side exposure
LEAK
passwordConfirm
[XSS working]
Risk: Information disclosure via client-side exposure
LEAK
current_password
this
Risk: Information disclosure via client-side exposure
LEAK
productSearchUrl
[XSS working]
Risk: Information disclosure via client-side exposure
LEAK
storeCountNumber
[XSS working]
Risk: Information disclosure via client-side exposure
LEAK
code_postal_birth
code_postal_birth
Risk: Information disclosure via client-side exposure
LEAK
enableKeyboardNav
true
Risk: Information disclosure via client-side exposure
LEAK
isURLSearchParams
function
Risk: Information disclosure via client-side exposure
LEAK
authorized_country
[XSS working]
Risk: Information disclosure via client-side exposure
LEAK
productsDetailsUrl
[XSS working]
Risk: Information disclosure via client-side exposure
LEAK
conditionnementKeys
[XSS working]
Risk: Information disclosure via client-side exposure
LEAK
openMagasineSidebar
[sechttp]
Risk: Information disclosure via client-side exposure
LEAK
checkConfirmPassword
[XSS working]
Risk: Information disclosure via client-side exposure
LEAK
isStandardBrowserEnv
function
Risk: Information disclosure via client-side exposure
LEAK
phone_number_required
[XSS working]
Risk: Information disclosure via client-side exposure
LEAK
rightSideOfExpression
s
Risk: Information disclosure via client-side exposure
LEAK
checkMaxLengthTypeNumber
[sechttp]
Risk: Information disclosure via client-side exposure
Total: 89 exposed variables found
API Domain Analysis
External API domains discovered in client-side code
EXTERNAL_API_DOMAIN
www.drupal.org
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
github.com
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
opensource.org
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
i.test
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
igorlino.github.io
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
www.opensource.org
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
en.wikipedia.org
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
developer.mozilla.org
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
www.example.com
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
self.zoomContainer
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
self.overWindow
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
this.scrollTop
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
self.zoomTintImage.attr
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
alpinejs.dev
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
console.log
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
geo.api.gouv.fr
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
this.article.selectedPoint
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
JavaScript Resources
JavaScript files loaded by the application
JS
/core/misc/touchevents-test.js?v=9.4.4
JS
/core/assets/vendor/jquery/jquery.min.js?v=3.6.0
JS
/core/misc/polyfills/element.matches.js?v=9.4.4
JS
/core/misc/polyfills/object.assign.js?v=9.4.4
JS
/core/assets/vendor/once/once.min.js?v=1.0.1
JS
/core/assets/vendor/jquery-once/jquery.once.min.js?v=2.2.3
JS
/core/misc/drupalSettingsLoader.js?v=9.4.4
JS
/sites/default/files/languages/fr_MiCkiu9kucgiZDjufaQ1SN5N1FyY4FxxodEK3ynQAWw.js?tapp2t
JS
/core/misc/drupal.js?v=9.4.4
JS
/core/misc/drupal.init.js?v=9.4.4
JS
/core/misc/debounce.js?v=9.4.4
JS
/core/misc/announce.js?v=9.4.4
JS
/core/misc/message.js?v=9.4.4
JS
/core/misc/jquery.once.bc.js?v=9.4.4
JS
/themes/theme-lm-ecommerce/js/config-slick.js?v=9.4.4
JS
/themes/theme-lm-ecommerce/js/scripts.js?v=9.4.4
JS
/themes/theme-lm-ecommerce/lib/slick/slick.min.js?v=9.4.4
JS
/themes/theme-custom-e-claireur/js/base.js?v=9.4.4
JS
/modules/contrib/cookies/js/cookiesjsr.conf.js?v=9.4.4
JS
https://cdn.jsdelivr.net/gh/jfeltkamp/cookiesjsr@1/dist/cookiesjsr-preloader.min.js
JS
/modules/lundimatin-blocks/assets/js/jquery.fancybox-plus.js?v=9.4.4
JS
/modules/lundimatin-blocks/assets/js/jquery.ez-plus.js?v=9.4.4
JS
/modules/lundimatin-blocks/assets/dist/main.js?v=9.4.4
JS
/modules/lundimatin-blocks/assets/js/products.js?v=9.4.4
JS
/modules/lundimatin-blocks/assets/js/account.js?v=9.4.4
JS
/modules/lundimatin-blocks/assets/js/cart.js?v=9.4.4
JS
/modules/lundimatin-blocks/assets/js/orders.js?v=9.4.4
JS
/modules/lundimatin-blocks/assets/js/quotes.js?v=9.4.4
JS
/modules/lundimatin-blocks/assets/js/configurator.js?v=9.4.4
JS
"/core/misc/touchevents-test.js?v=9.4.4"
JS
"/core/assets/vendor/jquery/jquery.min.js?v=3.6.0"
JS
"/core/misc/polyfills/element.matches.js?v=9.4.4"
JS
"/core/misc/polyfills/object.assign.js?v=9.4.4"
JS
"/core/assets/vendor/once/once.min.js?v=1.0.1"
JS
"/core/assets/vendor/jquery-once/jquery.once.min.js?v=2.2.3"
JS
"/core/misc/drupalSettingsLoader.js?v=9.4.4"
JS
"/sites/default/files/languages/fr_MiCkiu9kucgiZDjufaQ1SN5N1FyY4FxxodEK3ynQAWw.js?tapp2t"
JS
"/core/misc/drupal.js?v=9.4.4"
JS
"/core/misc/drupal.init.js?v=9.4.4"
JS
"/core/misc/debounce.js?v=9.4.4"
JS
"/core/misc/announce.js?v=9.4.4"
JS
"/core/misc/message.js?v=9.4.4"
JS
"/core/misc/jquery.once.bc.js?v=9.4.4"
JS
"/themes/theme-lm-ecommerce/js/config-slick.js?v=9.4.4"
JS
"/themes/theme-lm-ecommerce/js/scripts.js?v=9.4.4"
JS
"/themes/theme-lm-ecommerce/lib/slick/slick.min.js?v=9.4.4"
JS
"/themes/theme-custom-e-claireur/js/base.js?v=9.4.4"
JS
"/modules/contrib/cookies/js/cookiesjsr.conf.js?v=9.4.4"
JS
"https://cdn.jsdelivr.net/gh/jfeltkamp/cookiesjsr@1/dist/cookiesjsr-preloader.min.js"
JS
"/modules/lundimatin-blocks/assets/js/jquery.fancybox-plus.js?v=9.4.4"
JS
"/modules/lundimatin-blocks/assets/js/jquery.ez-plus.js?v=9.4.4"
JS
"/modules/lundimatin-blocks/assets/dist/main.js?v=9.4.4"
JS
"/modules/lundimatin-blocks/assets/js/products.js?v=9.4.4"
JS
"/modules/lundimatin-blocks/assets/js/account.js?v=9.4.4"
JS
"/modules/lundimatin-blocks/assets/js/cart.js?v=9.4.4"
JS
"/modules/lundimatin-blocks/assets/js/orders.js?v=9.4.4"
JS
"/modules/lundimatin-blocks/assets/js/quotes.js?v=9.4.4"
JS
"/modules/lundimatin-blocks/assets/js/configurator.js?v=9.4.4"
Security Recommendations
- • Avoid exposing sensitive variables in client-side code
- • Implement proper API authentication and rate limiting
- • Use environment variables for sensitive configuration
- • Regularly audit client-side code for information leaks
- • Minimize the amount of sensitive data processed on the client side
Historical Scan Records (1)
No description found
65/100
4 issues