Scouts de Argentina

HTTPS

TARGET_ANALYSIS

scouts.org.ar

IP: 0.0.0.0

ASN: AS0

A comprehensive security and network analysis report for scouts.org.ar. Server: cloudflare.

Primary Port: 443
Scan Time: 4/12/2026, 7:29:50 PM
Shareable Report Link: https://sechttp.com/scan/scouts.org.ar

Detailed Security Analysis

Attack Path & DDoS Defense Analysis

Attacker

L4 Traffic

L7 Traffic

AS0 (cloudflare POP)

L4 Defended

L7 Bypassed

L4 Blocked

L7 Traffic

Your Server

Defense Summary

While cloudflare provides robust protection against Layer 4 (network-level) attacks, your server remains potentially vulnerable to sophisticated Layer 7 (application-level) attacks that can bypass standard CDN defenses. Additional WAF rules and application-side security measures are recommended.

Layer 4 Defense

cloudflare provides robust SYN flood, UDP amplification, and volumetric attack protection at the network edge.

Layer 7 Vulnerabilities

Application-layer attacks targeting 3 exposed API endpoints require additional WAF rules and rate limiting.

Server Information Disclosure

LOW

INFO-001

Description

The server is disclosing its software type: cloudflare. This can help attackers identify potential vulnerabilities.

Recommendation

Configure your web server to hide or modify the Server header to prevent information disclosure.

Missing X-Frame-Options Header

MEDIUM

SEC-002

Description

The site is not protected against clickjacking attacks.

Recommendation

Add the X-Frame-Options header with value 'DENY' or 'SAMEORIGIN' to prevent clickjacking.

Sensitive Information Exposure in JavaScript

HIGH

JS-001

Description

Found 43 potentially sensitive variables exposed in client-side JavaScript code.

Recommendation

Review and remove sensitive information from client-side code. Use environment variables and server-side processing for sensitive data.

root@sechttp: /var/log/fuzz

 root@sechttp : ~ $ 
 >  [Code: 200]  
/v1/conversations/${e}/messages [SENSITIVE LEAK]  
 >  [Code: 403]  
/v1/conversations  [FORBIDDEN] 
 >  [Code: 404]  
https://viewer.quick.bot/api   
 [+] Scan complete. Found 1 potential leaks. 
root@sechttp:~$

Port Scan Results

   Port Service Status Version 
HTTP  CLOSED   -  
HTTPS  OPEN   TLS 1.3  
SSH  FILTERED   -  
MySQL  CLOSED   -  
  

Port	Service	Status	Version
80	HTTP	CLOSED	-
443	HTTPS	OPEN	TLS 1.3
22	SSH	FILTERED	-
3306	MySQL	CLOSED	-

HTTP Headers Analysis

age: 1 
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800} 
date: Sun, 12 Apr 2026 19:29:36 GMT 
link: <https://scouts.org.ar/wp-json/>; rel="https://api.w.org/", <https://scouts.org.ar/wp-json/wp/v2/pages/2>; rel="alternate"; title="JSON"; type="application/json", <https://scouts.org.ar/>; rel=shortlink 
vary: Accept-Encoding,User-Agent 
cf-ray: 9eb4a40b1cc6cb92-LAX 
server: cloudflare 
alt-svc: h3=":443"; ma=86400 
expires: Sun, 12 Apr 2026 19:29:34 GMT 
x-cache: HIT 
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=oy5XnTtjTOtcVpLd4eRbgAhT%2FqnIdfVUzzpO8QEC%2FxaAwNpC4dMJkYAy7gnM8kOwvA7eKxU3xAb3Oo%2BWJj1CA6WaHJxZDqow%2BM9xdNKs4ePm5UlucAEh1goUVP7I0Nyg"}]} 
connection: keep-alive 
content-type: text/html; charset=UTF-8 
cache-control: max-age=0 
server-timing: cfCacheStatus;desc="DYNAMIC", cfEdge;dur=16,cfOrigin;dur=284 
cf-cache-status: DYNAMIC 
transfer-encoding: chunked 
permissions-policy: private-state-token-redemption=(self "https://www.google.com" "https://www.gstatic.com" "https://recaptcha.net" "https://challenges.cloudflare.com" "https://hcaptcha.com"), private-state-token-issuance=(self "https://www.google.com" "https://www.gstatic.com" "https://recaptcha.net" "https://challenges.cloudflare.com" "https://hcaptcha.com") 
strict-transport-security: max-age=15552000; includeSubDomains 

Currently Testing

Peering information is being analyzed.

Currently Testing

Internet Exchange data is being collected.

JavaScript Analysis

Security Analysis Alert

Client-side code analysis has identified potential security vulnerabilities and information disclosure risks.

Exposed JavaScript Variables

43 Found

Variables exposed in client-side code that may contain sensitive information

# Security Assessment: Variable Exposure Analysis
 
LEAK
 
key
 t 

Risk: Information disclosure via client-side exposure
 
LEAK
 
url
 e 

Risk: Information disclosure via client-side exposure
 
LEAK
 
code
 r 

Risk: Information disclosure via client-side exposure
 
LEAK
 
keys
 e 

Risk: Information disclosure via client-side exposure
 
LEAK
 
sign
 e 

Risk: Information disclosure via client-side exposure
 
LEAK
 
phone
 n 

Risk: Information disclosure via client-side exposure
 
LEAK
 
token
 t 

Risk: Information disclosure via client-side exposure
 
LEAK
 
access
 function 

Risk: Information disclosure via client-side exposure
 
LEAK
 
altKey
 0 

Risk: Information disclosure via client-side exposure
 
LEAK
 
clientX
 0 

Risk: Information disclosure via client-side exposure
 
LEAK
 
clientY
 0 

Risk: Information disclosure via client-side exposure
 
LEAK
 
cookies
 [XSS working] 

Risk: Information disclosure via client-side exposure
 
LEAK
 
ctrlKey
 0 

Risk: Information disclosure via client-side exposure
 
LEAK
 
keyCode
 0 

Risk: Information disclosure via client-side exposure
 
LEAK
 
metaKey
 0 

Risk: Information disclosure via client-side exposure
 
LEAK
 
test_id
 r 

Risk: Information disclosure via client-side exposure
 
LEAK
 
charCode
 function 

Risk: Information disclosure via client-side exposure
 
LEAK
 
et_email
 s 

Risk: Information disclosure via client-side exposure
 
LEAK
 
publicId
 e 

Risk: Information disclosure via client-side exposure
 
LEAK
 
shiftKey
 0 

Risk: Information disclosure via client-side exposure
 
LEAK
 
nodeValue
 n 

Risk: Information disclosure via client-side exposure
 
LEAK
 
onKeyDown
 e 

Risk: Information disclosure via client-side exposure
 
LEAK
 
sessionId
 w 

Risk: Information disclosure via client-side exposure
 
LEAK
 
wrapInner
 function 

Risk: Information disclosure via client-side exposure
 
LEAK
 
bytesToHex
 function 

Risk: Information disclosure via client-side exposure
 
LEAK
 
keySplines
 0.2 0.2 0.4 0.8;0.2 0.2 0.4 0.8;0.2 0.2 0.4 0.8 

Risk: Information disclosure via client-side exposure
 
LEAK
 
statusCode
 function 

Risk: Information disclosure via client-side exposure
 
LEAK
 
tokenStart
 o 

Risk: Information disclosure via client-side exposure
 
LEAK
 
tokenLength
 i 

Risk: Information disclosure via client-side exposure
 
LEAK
 
bytesToWords
 function 

Risk: Information disclosure via client-side exposure
 
LEAK
 
onMissingKey
 null 

Risk: Information disclosure via client-side exposure
 
LEAK
 
updateStyles
 function 

Risk: Information disclosure via client-side exposure
 
LEAK
 
bytesToBase64
 function 

Risk: Information disclosure via client-side exposure
 
LEAK
 
bytesToString
 function 

Risk: Information disclosure via client-side exposure
 
LEAK
 
isTouchDevice
 function 

Risk: Information disclosure via client-side exposure
 
LEAK
 
toggleKeydown
 function 

Risk: Information disclosure via client-side exposure
 
LEAK
 
MozPrintableKey
 Unidentified 

Risk: Information disclosure via client-side exposure
 
LEAK
 
isMobilePreview
 s 

Risk: Information disclosure via client-side exposure
 
LEAK
 
clientSideAction
 g 

Risk: Information disclosure via client-side exposure
 
LEAK
 
et_pb_ab_test_id
 e 

Risk: Information disclosure via client-side exposure
 
LEAK
 
clientSideActions
 p 

Risk: Information disclosure via client-side exposure
 
LEAK
 
wt.MozPrintableKey
 Unidentified 

Risk: Information disclosure via client-side exposure
 
LEAK
 
callbackHandlerNumberCounter
 function 

Risk: Information disclosure via client-side exposure
 
Total: 43 exposed variables found

API Domain Analysis

29 Domains

External API domains discovered in client-side code

EXTERNAL_API_DOMAIN

www.dynamicdrive.com

Reachable

HTTPS Enabled

Security Note: