Geotrack
HTTPS
目标分析
hida03.geotrack.cloud
IP： 72.60.118.246
ASN： AS47583
针对hida03.geotrack.cloud的全面安全与网络分析报告。服务器：nginx/1.24.0 (Ubuntu)。 托管在DE。
- 主要端口
- 443
- 扫描时间
- 可分享的报告链接
- https://sechttp.com/scan/hida03.geotrack.cloud
详细安全分析
攻击路径与DDoS防御分析
攻击者
L4流量
L7流量
AS47583 (nginx/1.24.0 (Ubuntu) POP节点)
L4已防御
L7已绕过
L4已阻止
L7流量
您的服务器
防御摘要
虽然nginx/1.24.0 (Ubuntu)对第4层（网络层）攻击提供了强大的保护，但您的服务器仍可能容易受到绕过标准CDN防御的复杂第7层（应用层）攻击。建议添加额外的WAF规则和应用端安全措施。
第4层防御
nginx/1.24.0 (Ubuntu) 在网络边缘提供强大的SYN洪泛、UDP放大和容量攻击保护。
第7层漏洞
针对3暴露的API端点的应用层攻击需要额外的WAF规则和速率限制。
服务器信息泄露
LOWINFO-001
描述
服务器正在泄露其软件类型：nginx/1.24.0 (Ubuntu)。这可能帮助攻击者识别潜在漏洞。
建议
配置您的Web服务器以隐藏或修改Server头，以防止信息泄露。
缺少或无效的HSTS头
MEDIUMSEC-001
描述
Strict-Transport-Security头未正确配置，使网站容易受到中间人攻击。
建议
通过添加具有适当max-age值的Strict-Transport-Security头来实现HSTS，强制使用HTTPS连接。
缺少X-Frame-Options头
MEDIUMSEC-002
描述
网站未受到点击劫持攻击的保护。
建议
添加值为'DENY'或'SAMEORIGIN'的X-Frame-Options头，以防止点击劫持。
JavaScript中的敏感信息暴露
HIGHJS-001
描述
在客户端JavaScript代码中发现26个潜在敏感变量暴露。
建议
审查并移除客户端代码中的敏感信息。使用环境变量和服务器端处理敏感数据。
root@sechttp: /var/log/fuzz
root@sechttp : ~ $
> [Code: 200]
https://hida03.geotrack.cloud/api [敏感信息泄露]
> [Code: 403]
/api-keys/:id() [禁止访问]
> [Code: 404]
/api-keys [+] 扫描完成。发现 1 个潜在泄露。
root@sechttp : ~ $
端口扫描结果
| 端口 | 服务 | 状态 | 版本 |
|---|---|---|---|
| 80 | HTTP | 关闭 | - |
| 443 | HTTPS | 开放 | TLS 1.3 |
| 22 | SSH | 过滤 | - |
| 3306 | MySQL | 关闭 | - |
HTTP头分析
date:
Thu, 11 Sep 2025 16:35:14 GMT
server:
nginx/1.24.0 (Ubuntu)
connection:
keep-alive
content-type:
text/html;charset=utf-8
x-powered-by:
Nuxt
content-length:
6110
ASN信息
ASN: AS47583
IP地址: 72.60.118.246
网络前缀: 72.60.112.0/20
组织: AS-HOSTINGER
国家:
🇩🇪 DE
名称: AS-HOSTINGER
上游提供商 (46)
AS174
COGENT-174
Cogent Communications
🇺🇸 US
upstream
AS7195
EDGEUNO S.A.S
EDGEUNO S.A.S
🇨🇴 CO
upstream
AS1299
TWELVE99
Arelion, f/k/a Telia Carrier
🇸🇪 SE
upstream
AS9498
BBIL-AP
BHARTI Airtel Ltd.
🇮🇳 IN
upstream
AS13194
BITE
Bite IP Network
🇱🇹 LT
upstream
AS3356
LEVEL3
Level 3 Parent, LLC
🇺🇸 US
upstream
AS5405
INTERDOTLINK
powered by Inter.link
🇩🇪 DE
upstream
AS12025
IMDC-AS12025
Iron Mountain Data Center
🇺🇸 US
upstream
AS9002
RETN-AS
RETN Limited
🇬🇧 GB
upstream
AS52925
Ascenty Data Centers e Telecomunicai¿½i¿½es S/A
Ascenty Data Centers e Telecomunicai¿½i¿½es S/A
🇧🇷 BR
upstream
AS4800
LINTASARTA-AS-AP
PT Aplikanusa Lintasarta
🇮🇩 ID
upstream
AS133296
WEBWERKS-AS-IN
Web Werks India Pvt. Ltd.
🇮🇳 IN
upstream
AS15085
IMMEDION
Immedion, LLC
🇺🇸 US
upstream
AS2914
NTT-DATA-2914
NTT America, Inc.
🇺🇸 US
upstream
AS50673
Serverius-as
Serverius Holding B.V.
🇳🇱 NL
upstream
AS61323
UKFAST
ANS ACADEMY LIMITED
🇬🇧 GB
upstream
AS2711
SPIRITTEL-AS
Spirit Communications
🇺🇸 US
upstream
AS60068
CDN77
CDN77
🇬🇧 GB
upstream
AS24482
SGGS-AS-AP
SG.GS
🇸🇬 SG
upstream
AS21859
ZEN-ECN
Zenlayer Inc
🇺🇸 US
upstream
AS6939
HURRICANE
Hurricane Electric LLC
🇺🇸 US
upstream
AS9340
INDONET-AS-AP
INDO Internet, PT
🇮🇩 ID
upstream
AS15440
Baltneta
Customers AS
🇱🇹 LT
upstream
AS174
COGENT-174
Cogent Communications
🇺🇸 US
upstream
AS7195
EDGEUNO S.A.S
EDGEUNO S.A.S
🇨🇴 CO
upstream
AS1299
TWELVE99
Arelion, f/k/a Telia Carrier
🇸🇪 SE
upstream
AS9498
BBIL-AP
BHARTI Airtel Ltd.
🇮🇳 IN
upstream
AS13194
BITE
Bite IP Network
🇱🇹 LT
upstream
AS3356
LEVEL3
Level 3 Parent, LLC
🇺🇸 US
upstream
AS5405
INTERDOTLINK
powered by Inter.link
🇩🇪 DE
upstream
AS12025
IMDC-AS12025
Iron Mountain Data Center
🇺🇸 US
upstream
AS9002
RETN-AS
RETN Limited
🇬🇧 GB
upstream
AS52925
Ascenty Data Centers e Telecomunicai¿½i¿½es S/A
Ascenty Data Centers e Telecomunicai¿½i¿½es S/A
🇧🇷 BR
upstream
AS4800
LINTASARTA-AS-AP
PT Aplikanusa Lintasarta
🇮🇩 ID
upstream
AS133296
WEBWERKS-AS-IN
Web Werks India Pvt. Ltd.
🇮🇳 IN
upstream
AS15085
IMMEDION
Immedion, LLC
🇺🇸 US
upstream
AS2914
NTT-DATA-2914
NTT America, Inc.
🇺🇸 US
upstream
AS50673
Serverius-as
Serverius Holding B.V.
🇳🇱 NL
upstream
AS61323
UKFAST
ANS ACADEMY LIMITED
🇬🇧 GB
upstream
AS2711
SPIRITTEL-AS
Spirit Communications
🇺🇸 US
upstream
AS60068
CDN77
CDN77
🇬🇧 GB
upstream
AS24482
SGGS-AS-AP
SG.GS
🇸🇬 SG
upstream
AS21859
ZEN-ECN
Zenlayer Inc
🇺🇸 US
upstream
AS6939
HURRICANE
Hurricane Electric LLC
🇺🇸 US
upstream
AS9340
INDONET-AS-AP
INDO Internet, PT
🇮🇩 ID
upstream
AS15440
Baltneta
Customers AS
🇱🇹 LT
upstream
互联网交换点 (4)
🇮🇳
DE-CIX Mumbai
IN
3 Gbps
Bandwidth
🇮🇳
DE-CIX Mumbai
IN
3 Gbps
Bandwidth
🇱🇹
BALT-IX
LT
10 Gbps
Bandwidth
🇱🇹
BALT-IX
LT
10 Gbps
Bandwidth
JavaScript分析
Security Analysis Alert
Client-side code analysis has identified potential security vulnerabilities and information disclosure risks.
暴露的JavaScript变量
Variables exposed in client-side code that may contain sensitive information
# Security Assessment: Variable Exposure Analysis
LEAK
key
4
Risk: Information disclosure via client-side exposure
LEAK
auth
n
Risk: Information disclosure via client-side exposure
LEAK
apiUrl
https://hida03.geotrack.cloud/api
Risk: Information disclosure via client-side exposure
LEAK
cdnURL
<empty_value>
Risk: Information disclosure via client-side exposure
LEAK
domain
hida03.geotrack.cloud
Risk: Information disclosure via client-side exposure
LEAK
baseURL
pn
Risk: Information disclosure via client-side exposure
LEAK
clientX
e
Risk: Information disclosure via client-side exposure
LEAK
clientY
e
Risk: Information disclosure via client-side exposure
LEAK
ownKeys
t
Risk: Information disclosure via client-side exposure
LEAK
release
function
Risk: Information disclosure via client-side exposure
LEAK
endPoint
Opacity
Risk: Information disclosure via client-side exposure
LEAK
burlywood
#deb887
Risk: Information disclosure via client-side exposure
LEAK
getNewKey
function
Risk: Information disclosure via client-side exposure
LEAK
keysIndex
e
Risk: Information disclosure via client-side exposure
LEAK
renderKey
h
Risk: Information disclosure via client-side exposure
LEAK
nearestKey
[sechttp]
Risk: Information disclosure via client-side exposure
LEAK
statusCode
P
Risk: Information disclosure via client-side exposure
LEAK
credentials
same-origin
Risk: Information disclosure via client-side exposure
LEAK
environment
production
Risk: Information disclosure via client-side exposure
LEAK
o.burlywood
#deb887
Risk: Information disclosure via client-side exposure
LEAK
NUMBER_REGEX
[XSS working]
Risk: Information disclosure via client-side exposure
LEAK
addEventListener
function
Risk: Information disclosure via client-side exposure
LEAK
googleMapsApiKey
AIzaSyBUQMy1dEckaE7BkUQ0eps5dt9zA_6yP6s
Risk: Information disclosure via client-side exposure
LEAK
KeyframedValueProperty
[sechttp]
Risk: Information disclosure via client-side exposure
LEAK
getKeyframedConstructorFunction
function
Risk: Information disclosure via client-side exposure
LEAK
KeyframedMultidimensionalProperty
[sechttp]
Risk: Information disclosure via client-side exposure
Total: 26 exposed variables found
API域名分析
External API domains discovered in client-side code
EXTERNAL_API_DOMAIN
hida03.geotrack.cloud
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
发现的API端点
API endpoints identified through static analysis of client-side code
GET
https://hida03.geotrack.cloud/api
Active
Endpoint discovered via client-side code analysis
GET
/api-keys/:id()
Active
Endpoint discovered via client-side code analysis
GET
/api-keys
Active
Endpoint discovered via client-side code analysis
JavaScript资源
JavaScript files loaded by the application
JS
https://cdn.lordicon.com/lordicon.js
JS
/_nuxt/By1m_uhr.js
JS
"https://cdn.lordicon.com/lordicon.js"
JS
"/_nuxt/By1m_uhr.js"
安全建议
- • Avoid exposing sensitive variables in client-side code
- • Implement proper API authentication and rate limiting
- • Use environment variables for sensitive configuration
- • Regularly audit client-side code for information leaks
- • Minimize the amount of sensitive data processed on the client side
历史扫描记录 (1)
No description found
65/100
4 issues