xjpvictor's Blog | 小老鼠，上灯台，两只耳朵竖起来
HTTPS
目标分析
blog.xjpvictor.info
IP： 192.81.130.130
ASN： AS63949
针对blog.xjpvictor.info的全面安全与网络分析报告。服务器：nginx。 托管在SG。
- 主要端口
- 443
- 扫描时间
- 可分享的报告链接
- https://sechttp.com/scan/blog.xjpvictor.info
详细安全分析
攻击路径与DDoS防御分析
攻击者
L4流量
L7流量
AS63949 (nginx POP节点)
L4已防御
L7已绕过
L4已阻止
L7流量
您的服务器
防御摘要
虽然nginx对第4层（网络层）攻击提供了强大的保护，但您的服务器仍可能容易受到绕过标准CDN防御的复杂第7层（应用层）攻击。建议添加额外的WAF规则和应用端安全措施。
第4层防御
nginx 在网络边缘提供强大的SYN洪泛、UDP放大和容量攻击保护。
第7层漏洞
针对0暴露的API端点的应用层攻击需要额外的WAF规则和速率限制。
服务器信息泄露
LOWINFO-001
描述
服务器正在泄露其软件类型：nginx。这可能帮助攻击者识别潜在漏洞。
建议
配置您的Web服务器以隐藏或修改Server头，以防止信息泄露。
缺少X-Frame-Options头
MEDIUMSEC-002
描述
网站未受到点击劫持攻击的保护。
建议
添加值为'DENY'或'SAMEORIGIN'的X-Frame-Options头，以防止点击劫持。
JavaScript中的敏感信息暴露
HIGHJS-001
描述
在客户端JavaScript代码中发现27个潜在敏感变量暴露。
建议
审查并移除客户端代码中的敏感信息。使用环境变量和服务器端处理敏感数据。
正在测试
本次扫描无模糊测试数据。
端口扫描结果
| 端口 | 服务 | 状态 | 版本 |
|---|---|---|---|
| 80 | HTTP | 关闭 | - |
| 443 | HTTPS | 开放 | TLS 1.3 |
| 22 | SSH | 过滤 | - |
| 3306 | MySQL | 关闭 | - |
HTTP头分析
date:
Fri, 01 Aug 2025 00:16:03 GMT
vary:
Accept-Encoding, Accept-Encoding, Cookie
pragma:
cache
server:
nginx
expires:
Tue, 05 Aug 2025 20:49:43 GMT
connection:
keep-alive
content-type:
text/html; charset=UTF-8
cache-control:
max-age=604800
transfer-encoding:
chunked
x-content-type-options:
nosniff
strict-transport-security:
max-age=31536000; includeSubDomains; preload
ASN信息
ASN: AS63949
IP地址: 192.81.130.130
网络前缀: 192.81.128.0/21
组织: AKAMAI-LINODE-AP
国家:
🇸🇬 SG
名称: AKAMAI-LINODE-AP
上游提供商 (10)
AS20940
AKAMAI-ASN1
Akamai International B.V.
🇳🇱 NL
upstream
AS6939
HURRICANE
Hurricane Electric LLC
🇺🇸 US
upstream
AS9498
BBIL-AP
BHARTI Airtel Ltd.
🇮🇳 IN
upstream
AS174
COGENT-174
Cogent Communications
🇺🇸 US
upstream
AS32787
PROLEXIC-TECHNOLOGIES-DDOS-MITIGATION-NETWORK
Akamai Technologies, Inc.
🇺🇸 US
upstream
AS20940
AKAMAI-ASN1
Akamai International B.V.
🇳🇱 NL
upstream
AS6939
HURRICANE
Hurricane Electric LLC
🇺🇸 US
upstream
AS9498
BBIL-AP
BHARTI Airtel Ltd.
🇮🇳 IN
upstream
AS174
COGENT-174
Cogent Communications
🇺🇸 US
upstream
AS32787
PROLEXIC-TECHNOLOGIES-DDOS-MITIGATION-NETWORK
Akamai Technologies, Inc.
🇺🇸 US
upstream
互联网交换点 (26)
🇩🇪
DE-CIX Frankfurt
DE
300 Gbps
Bandwidth
🇩🇪
DE-CIX Frankfurt
DE
300 Gbps
Bandwidth
🇺🇸
DE-CIX New York
US
50 Gbps
Bandwidth
🇺🇸
NYIIX New York
US
100 Gbps
Bandwidth
🇸🇬
Equinix Singapore
SG
100 Gbps
Bandwidth
🇺🇸
Equinix Dallas
US
100 Gbps
Bandwidth
🇬🇧
LINX LON1
GB
100 Gbps
Bandwidth
🇬🇧
LONAP
GB
100 Gbps
Bandwidth
🇯🇵
BBIX Tokyo
JP
100 Gbps
Bandwidth
🇺🇸
Equinix San Jose
US
100 Gbps
Bandwidth
🇺🇸
SFMIX
US
100 Gbps
Bandwidth
🇨🇦
TorIX
CA
100 Gbps
Bandwidth
🇮🇳
DE-CIX Mumbai
IN
20 Gbps
Bandwidth
🇦🇺
Equinix Sydney
AU
20 Gbps
Bandwidth
🇺🇸
Any2West
US
100 Gbps
Bandwidth
🇩🇪
DE-CIX Munich
DE
10 Gbps
Bandwidth
🇩🇪
DE-CIX Hamburg
DE
10 Gbps
Bandwidth
🇩🇪
DE-CIX Dusseldorf
DE
10 Gbps
Bandwidth
🇦🇺
EdgeIX - Sydney
AU
100 Gbps
Bandwidth
🇺🇸
CIX-ATL
US
100 Gbps
Bandwidth
🇯🇵
JPIX TOKYO
JP
100 Gbps
Bandwidth
🇸🇬
SGIX
SG
100 Gbps
Bandwidth
🇨🇦
ONIX
CA
100 Gbps
Bandwidth
🇮🇳
NIXI Mumbai
IN
20 Gbps
Bandwidth
🇺🇸
Digital Realty Atlanta
US
100 Gbps
Bandwidth
🇺🇸
DE-CIX Dallas
US
100 Gbps
Bandwidth
JavaScript分析
Security Analysis Alert
Client-side code analysis has identified potential security vulnerabilities and information disclosure risks.
暴露的JavaScript变量
Variables exposed in client-side code that may contain sensitive information
# Security Assessment: Variable Exposure Analysis
LEAK
key
qid
Risk: Information disclosure via client-side exposure
LEAK
url
f
Risk: Information disclosure via client-side exposure
LEAK
client
we
Risk: Information disclosure via client-side exposure
LEAK
cookie
<empty_value>
Risk: Information disclosure via client-side exposure
LEAK
domain
void
Risk: Information disclosure via client-side exposure
LEAK
apiVersion
2.2
Risk: Information disclosure via client-side exposure
LEAK
side_rails
7
Risk: Information disclosure via client-side exposure
LEAK
credentials
include
Risk: Information disclosure via client-side exposure
LEAK
Vi.side_rails
7
Risk: Information disclosure via client-side exposure
LEAK
createScriptURL
b
Risk: Information disclosure via client-side exposure
LEAK
google_ad_client
<empty_value>
Risk: Information disclosure via client-side exposure
LEAK
image_sidebyside
0
Risk: Information disclosure via client-side exposure
LEAK
Do.image_sidebyside
<empty_value>
Risk: Information disclosure via client-side exposure
LEAK
lo.image_sidebyside
<empty_value>
Risk: Information disclosure via client-side exposure
LEAK
pub_control_image_sidebyside
200
Risk: Information disclosure via client-side exposure
LEAK
mobile_banner_image_sidebyside
0
Risk: Information disclosure via client-side exposure
LEAK
Do.pub_control_image_sidebyside
<empty_value>
Risk: Information disclosure via client-side exposure
LEAK
Eo.pub_control_image_sidebyside
200
Risk: Information disclosure via client-side exposure
LEAK
lo.pub_control_image_sidebyside
<empty_value>
Risk: Information disclosure via client-side exposure
LEAK
mo.pub_control_image_sidebyside
200
Risk: Information disclosure via client-side exposure
LEAK
Do.mobile_banner_image_sidebyside
<empty_value>
Risk: Information disclosure via client-side exposure
LEAK
lo.mobile_banner_image_sidebyside
<empty_value>
Risk: Information disclosure via client-side exposure
LEAK
pub_control_image_card_sidebyside
250
Risk: Information disclosure via client-side exposure
LEAK
Do.pub_control_image_card_sidebyside
<empty_value>
Risk: Information disclosure via client-side exposure
LEAK
Eo.pub_control_image_card_sidebyside
250
Risk: Information disclosure via client-side exposure
LEAK
lo.pub_control_image_card_sidebyside
<empty_value>
Risk: Information disclosure via client-side exposure
LEAK
mo.pub_control_image_card_sidebyside
250
Risk: Information disclosure via client-side exposure
Total: 27 exposed variables found
API域名分析
External API domains discovered in client-side code
EXTERNAL_API_DOMAIN
pagead2.googlesyndication.com
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
googleads.g.doubleclick.net
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
adsense.com
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
JavaScript资源
JavaScript files loaded by the application
JS
//pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
JS
https://piwik.onemole.net/showads.js
JS
"//pagead2.googlesyndication.com/pagead/js/adsbygoogle.js"
JS
"https://piwik.onemole.net/showads.js"
安全建议
- • Avoid exposing sensitive variables in client-side code
- • Implement proper API authentication and rate limiting
- • Use environment variables for sensitive configuration
- • Regularly audit client-side code for information leaks
- • Minimize the amount of sensitive data processed on the client side
历史扫描记录 (1)
小老鼠，上灯台，两只耳朵竖起来
65/100
4 issues