WE DO IT ALL! – We Do It All
HTTPS
目标分析
makofalltrades.us
IP： 192.0.78.24
ASN： AS2635
针对makofalltrades.us的全面安全与网络分析报告。服务器：nginx。 托管在US。
- 主要端口
- 443
- 扫描时间
- 可分享的报告链接
- https://sechttp.com/scan/makofalltrades.us
详细安全分析
攻击路径与DDoS防御分析
攻击者
L4流量
L7流量
AS2635 (nginx POP节点)
L4已防御
L7已绕过
L4已阻止
L7流量
您的服务器
防御摘要
虽然nginx对第4层（网络层）攻击提供了强大的保护，但您的服务器仍可能容易受到绕过标准CDN防御的复杂第7层（应用层）攻击。建议添加额外的WAF规则和应用端安全措施。
第4层防御
nginx 在网络边缘提供强大的SYN洪泛、UDP放大和容量攻击保护。
第7层漏洞
针对1暴露的API端点的应用层攻击需要额外的WAF规则和速率限制。
服务器信息泄露
LOWINFO-001
描述
服务器正在泄露其软件类型：nginx。这可能帮助攻击者识别潜在漏洞。
建议
配置您的Web服务器以隐藏或修改Server头，以防止信息泄露。
缺少X-Frame-Options头
MEDIUMSEC-002
描述
网站未受到点击劫持攻击的保护。
建议
添加值为'DENY'或'SAMEORIGIN'的X-Frame-Options头，以防止点击劫持。
JavaScript中的敏感信息暴露
HIGHJS-001
描述
在客户端JavaScript代码中发现23个潜在敏感变量暴露。
建议
审查并移除客户端代码中的敏感信息。使用环境变量和服务器端处理敏感数据。
root@sechttp: /var/log/fuzz
root@sechttp : ~ $
> [Code: 200]
/wp-admin/admin-ajax.php [敏感信息泄露]
[+] 扫描完成。发现 1 个潜在泄露。
root@sechttp : ~ $
端口扫描结果
| 端口 | 服务 | 状态 | 版本 |
|---|---|---|---|
| 80 | HTTP | 关闭 | - |
| 443 | HTTPS | 开放 | TLS 1.3 |
| 22 | SSH | 过滤 | - |
| 3306 | MySQL | 关闭 | - |
HTTP头分析
date:
Thu, 11 Sep 2025 16:34:52 GMT
link:
<https://wp.me/gh8B8>; rel=shortlink
vary:
Accept-Encoding, accept, content-type, cookie
x-ac:
20.bur _bur HIT
server:
nginx
alt-svc:
clear
x-hacker:
Want root? Visit join.a8c.com/hacker and mention this header.
connection:
keep-alive
host-header:
WordPress.com
content-type:
text/html; charset=UTF-8
server-timing:
a8c-cdn, dc;desc=bur, cache;desc=HIT;dur=1.0
transfer-encoding:
chunked
strict-transport-security:
max-age=31536000
ASN信息
ASN: AS2635
IP地址: 192.0.78.24
网络前缀: 192.0.78.0/24
组织: AUTOMATTIC
国家:
🇺🇸 US
名称: AUTOMATTIC
上游提供商 (21)
AS3356
LEVEL3
Level 3 Parent, LLC
🇺🇸 US
upstream
AS1299
TWELVE99
Arelion, f/k/a Telia Carrier
🇸🇪 SE
upstream
AS2914
NTT-DATA-2914
NTT America, Inc.
🇺🇸 US
upstream
AS6939
HURRICANE
Hurricane Electric LLC
🇺🇸 US
upstream
AS30844
LIQUID-AS
Liquid Telecommunications Ltd
🇬🇧 GB
upstream
AS6461
ZAYO-6461
Zayo Bandwidth
🇺🇸 US
upstream
AS9583
SIFY-AS-IN
Sify Limited
🇮🇳 IN
upstream
AS7195
EDGEUNO S.A.S
EDGEUNO S.A.S
🇨🇴 CO
upstream
AS7922
COMCAST-7922
Comcast Cable Communications, LLC
🇺🇸 US
upstream
AS37100
SEACOM-AS
SEACOM Limited
🇲🇺 MU
upstream
AS133296
WEBWERKS-AS-IN
Web Werks India Pvt. Ltd.
🇮🇳 IN
upstream
AS4
ISI-AS
University of Southern California
🇺🇸 US
upstream
AS3356
LEVEL3
Level 3 Parent, LLC
🇺🇸 US
upstream
AS1299
TWELVE99
Arelion, f/k/a Telia Carrier
🇸🇪 SE
upstream
AS2914
NTT-DATA-2914
NTT America, Inc.
🇺🇸 US
upstream
AS6939
HURRICANE
Hurricane Electric LLC
🇺🇸 US
upstream
AS30844
LIQUID-AS
Liquid Telecommunications Ltd
🇬🇧 GB
upstream
AS9583
SIFY-AS-IN
Sify Limited
🇮🇳 IN
upstream
AS7195
EDGEUNO S.A.S
EDGEUNO S.A.S
🇨🇴 CO
upstream
AS37100
SEACOM-AS
SEACOM Limited
🇲🇺 MU
upstream
AS133296
WEBWERKS-AS-IN
Web Werks India Pvt. Ltd.
🇮🇳 IN
upstream
互联网交换点 (52)
🇺🇸
Equinix Dallas
US
100 Gbps
Bandwidth
🇺🇸
Equinix San Jose
US
20 Gbps
Bandwidth
🇩🇪
DE-CIX Frankfurt
DE
100 Gbps
Bandwidth
🇬🇧
LINX LON1
GB
100 Gbps
Bandwidth
🇺🇸
Equinix Ashburn
US
100 Gbps
Bandwidth
🇺🇸
Equinix Chicago
US
100 Gbps
Bandwidth
🇺🇸
Equinix New York
US
10 Gbps
Bandwidth
🇭🇰
Equinix Hong Kong
HK
10 Gbps
Bandwidth
🇳🇱
NL-ix
NL
20 Gbps
Bandwidth
🇳🇱
AMS-IX
NL
20 Gbps
Bandwidth
🇯🇵
Equinix Tokyo
JP
10 Gbps
Bandwidth
🇯🇵
BBIX Tokyo
JP
10 Gbps
Bandwidth
🇦🇺
MegaIX Sydney
AU
10 Gbps
Bandwidth
🇦🇺
MegaIX Melbourne
AU
10 Gbps
Bandwidth
🇦🇺
MegaIX Brisbane
AU
10 Gbps
Bandwidth
🇳🇿
MegaIX Auckland
NZ
10 Gbps
Bandwidth
🇺🇸
Equinix Miami
US
10 Gbps
Bandwidth
🇺🇸
SIX Seattle
US
100 Gbps
Bandwidth
🇺🇸
Any2West
US
10 Gbps
Bandwidth
🇧🇷
IX.br (PTT.br) São Paulo
BR
100 Gbps
Bandwidth
🇸🇬
Equinix Singapore
SG
100 Gbps
Bandwidth
🇸🇬
BBIX Singapore
SG
10 Gbps
Bandwidth
🇺🇸
Digital Realty Atlanta
US
20 Gbps
Bandwidth
🇺🇸
FL-IX
US
100 Gbps
Bandwidth
🇪🇸
ESpanix Madrid Lower LAN
ES
10 Gbps
Bandwidth
🇦🇹
VIX
AT
30 Gbps
Bandwidth
🇿🇦
NAPAfrica IX Johannesburg
ZA
100 Gbps
Bandwidth
🇪🇸
DE-CIX Madrid
ES
10 Gbps
Bandwidth
🇯🇵
JPNAP Tokyo
JP
10 Gbps
Bandwidth
🇯🇵
JPNAP Osaka
JP
10 Gbps
Bandwidth
🇸🇪
Netnod Stockholm GREEN -- MTU1500
SE
10 Gbps
Bandwidth
🇺🇸
DE-CIX New York
US
10 Gbps
Bandwidth
🇸🇪
Netnod Stockholm BLUE -- MTU1500
SE
10 Gbps
Bandwidth
🇺🇸
Any2Denver
US
10 Gbps
Bandwidth
🇫🇷
France-IX Paris
FR
100 Gbps
Bandwidth
🇮🇹
MIX-IT
IT
20 Gbps
Bandwidth
🇭🇰
HKIX
HK
10 Gbps
Bandwidth
🇨🇦
TorIX
CA
20 Gbps
Bandwidth
🇺🇸
NYIIX New York
US
10 Gbps
Bandwidth
🇺🇸
Equinix Ashburn
US
100 Gbps
Bandwidth
🇺🇸
Any2West
US
10 Gbps
Bandwidth
🇮🇳
DE-CIX Mumbai
IN
10 Gbps
Bandwidth
🇦🇺
NSW-IX
AU
10 Gbps
Bandwidth
🇺🇸
CIX-ATL
US
100 Gbps
Bandwidth
🇭🇺
BiX
HU
10 Gbps
Bandwidth
🇯🇵
JPIX OSAKA
JP
10 Gbps
Bandwidth
🇯🇵
JPIX TOKYO
JP
10 Gbps
Bandwidth
🇺🇸
ChIX
US
100 Gbps
Bandwidth
🇮🇳
WSNL-IX
IN
10 Gbps
Bandwidth
🇳🇱
Speed-IX
NL
10 Gbps
Bandwidth
🇺🇸
DE-CIX Dallas
US
100 Gbps
Bandwidth
🇺🇸
DE-CIX Chicago
US
10 Gbps
Bandwidth
JavaScript分析
Security Analysis Alert
Client-side code analysis has identified potential security vulnerabilities and information disclosure risks.
暴露的JavaScript变量
Variables exposed in client-side code that may contain sensitive information
# Security Assessment: Variable Exposure Analysis
LEAK
key
t
Risk: Information disclosure via client-side exposure
LEAK
url
t
Risk: Information disclosure via client-side exposure
LEAK
code
n
Risk: Information disclosure via client-side exposure
LEAK
email
l
Risk: Information disclosure via client-side exposure
LEAK
token
t
Risk: Information disclosure via client-side exposure
LEAK
domain
+o)}var r,i;return o},i=function(t,e,n){var o=encodeURIComponent(
Risk: Information disclosure via client-side exposure
LEAK
mailto
+r;case
Risk: Information disclosure via client-side exposure
LEAK
signal
l
Risk: Information disclosure via client-side exposure
LEAK
e.email
icons/mail.svg
Risk: Information disclosure via client-side exposure
LEAK
avatarUrl
d
Risk: Information disclosure via client-side exposure
LEAK
cell_phone
l
Risk: Information disclosure via client-side exposure
LEAK
home_phone
l
Risk: Information disclosure via client-side exposure
LEAK
profileUrl
n
Risk: Information disclosure via client-side exposure
LEAK
work_phone
l
Risk: Information disclosure via client-side exposure
LEAK
recordEvent
function
Risk: Information disclosure via client-side exposure
LEAK
e.cell_phone
icons/mobile-phone.svg
Risk: Information disclosure via client-side exposure
LEAK
e.home_phone
icons/home-phone.svg
Risk: Information disclosure via client-side exposure
LEAK
e.work_phone
icons/work-phone.svg
Risk: Information disclosure via client-side exposure
LEAK
onMissingKey
null
Risk: Information disclosure via client-side exposure
LEAK
onKeyDownTextarea
a
Risk: Information disclosure via client-side exposure
LEAK
handleNumberKeyPress
a
Risk: Information disclosure via client-side exposure
LEAK
generateStyleVariables
t
Risk: Information disclosure via client-side exposure
LEAK
signalAliasUserGeneral
function
Risk: Information disclosure via client-side exposure
Total: 23 exposed variables found
API域名分析
External API domains discovered in client-side code
EXTERNAL_API_DOMAIN
s.gravatar.com
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
api.gravatar.com
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
gravatar.com
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
0.gravatar.com
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
pixel.wp.com
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
github.com
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
发现的API端点
API endpoints identified through static analysis of client-side code
GET
/wp-admin/admin-ajax.php
Active
Endpoint discovered via client-side code analysis
JavaScript资源
JavaScript files loaded by the application
JS
https://s0.wp.com/wp-content/plugins/gutenberg-core/v20.6.0/build/hooks/index.min.js?m=1744959081i&ver=84e753e2b66eb7028d38
JS
https://s0.wp.com/wp-content/plugins/gutenberg-core/v20.6.0/build/i18n/index.min.js?m=1744959081i&ver=bd5a2533e717a1043151
JS
https://s1.wp.com/wp-content/js/rlt-proxy.js?m=1720530689i
JS
https://s1.wp.com/wp-content/plugins/gutenberg-core/v20.6.0/build-module/block-library/navigation/view.min.js?ver=38dd13322236f359c8a9
JS
https://s2.wp.com/wp-content/mu-plugins/jetpack-plugin/moon/jetpack_vendor/automattic/jetpack-forms/dist/modules/form/view.js?ver=15.1-a.0
JS
//0.gravatar.com/js/hovercards/hovercards.min.js?ver=202536924dcd77a86c6f1d3698ec27fc5da92b28585ddad3ee636c0397cf312193b2a1
JS
https://s2.wp.com/wp-content/mu-plugins/gravatar-hovercards/wpgroho.js?m=1610363240i
JS
https://s1.wp.com/wp-includes/js/dist/vendor/wp-polyfill.min.js?m=1744646400i
JS
https://s2.wp.com/wp-content/mu-plugins/jetpack-plugin/moon/jetpack_vendor/automattic/jetpack-forms/dist/blocks/view.js?m=1757006095i&minify=false&ver=5082ee0cbdcde811f7c1
JS
https://s2.wp.com/wp-content/mu-plugins/jetpack-plugin/moon/_inc/blocks/business-hours/view.js?m=1725888675i&minify=false&ver=15.1-a.0
JS
//stats.wp.com/w.js?68
JS
/wp-content/js/bilmur.min.js?i=15&m=202536
JS
"https://s0.wp.com/wp-content/plugins/gutenberg-core/v20.6.0/build/hooks/index.min.js?m=1744959081i&ver=84e753e2b66eb7028d38"
JS
"https://s0.wp.com/wp-content/plugins/gutenberg-core/v20.6.0/build/i18n/index.min.js?m=1744959081i&ver=bd5a2533e717a1043151"
JS
'https://s1.wp.com/wp-content/js/rlt-proxy.js?m=1720530689i'
JS
"https://s1.wp.com/wp-content/plugins/gutenberg-core/v20.6.0/build-module/block-library/navigation/view.min.js?ver=38dd13322236f359c8a9"
JS
"https://s2.wp.com/wp-content/mu-plugins/jetpack-plugin/moon/jetpack_vendor/automattic/jetpack-forms/dist/modules/form/view.js?ver=15.1-a.0"
JS
"//0.gravatar.com/js/hovercards/hovercards.min.js?ver=202536924dcd77a86c6f1d3698ec27fc5da92b28585ddad3ee636c0397cf312193b2a1"
JS
'https://s2.wp.com/wp-content/mu-plugins/gravatar-hovercards/wpgroho.js?m=1610363240i'
JS
'https://s1.wp.com/wp-includes/js/dist/vendor/wp-polyfill.min.js?m=1744646400i'
JS
"https://s2.wp.com/wp-content/mu-plugins/jetpack-plugin/moon/jetpack_vendor/automattic/jetpack-forms/dist/blocks/view.js?m=1757006095i&minify=false&ver=5082ee0cbdcde811f7c1"
JS
"https://s2.wp.com/wp-content/mu-plugins/jetpack-plugin/moon/_inc/blocks/business-hours/view.js?m=1725888675i&minify=false&ver=15.1-a.0"
JS
"//stats.wp.com/w.js?68"
JS
"/wp-content/js/bilmur.min.js?i=15&m=202536"
安全建议
- • Avoid exposing sensitive variables in client-side code
- • Implement proper API authentication and rate limiting
- • Use environment variables for sensitive configuration
- • Regularly audit client-side code for information leaks
- • Minimize the amount of sensitive data processed on the client side
历史扫描记录 (1)
We Do It All
65/100
4 issues