Deglingo Scout — Outil d'analyse Sorare SO7

HTTPS

目标分析

scout.deglingosorare.com

IP： 0.0.0.0

ASN： AS0

针对scout.deglingosorare.com的全面安全与网络分析报告。服务器：cloudflare。

主要端口: 443
扫描时间: 4/12/2026, 7:26:36 PM
可分享的报告链接: https://sechttp.com/scan/scout.deglingosorare.com

详细安全分析

攻击路径与DDoS防御分析

攻击者

L4流量

L7流量

AS0 (cloudflare POP节点)

L4已防御

L7已绕过

L4已阻止

L7流量

您的服务器

防御摘要

虽然cloudflare对第4层（网络层）攻击提供了强大的保护，但您的服务器仍可能容易受到绕过标准CDN防御的复杂第7层（应用层）攻击。建议添加额外的WAF规则和应用端安全措施。

第4层防御

cloudflare 在网络边缘提供强大的SYN洪泛、UDP放大和容量攻击保护。

第7层漏洞

针对9暴露的API端点的应用层攻击需要额外的WAF规则和速率限制。

服务器信息泄露

LOW

INFO-001

描述

服务器正在泄露其软件类型：cloudflare。这可能帮助攻击者识别潜在漏洞。

建议

配置您的Web服务器以隐藏或修改Server头，以防止信息泄露。

缺少或无效的HSTS头

MEDIUM

SEC-001

描述

Strict-Transport-Security头未正确配置，使网站容易受到中间人攻击。

建议

通过添加具有适当max-age值的Strict-Transport-Security头来实现HSTS，强制使用HTTPS连接。

缺少X-Frame-Options头

MEDIUM

SEC-002

描述

网站未受到点击劫持攻击的保护。

建议

添加值为'DENY'或'SAMEORIGIN'的X-Frame-Options头，以防止点击劫持。

JavaScript中的敏感信息暴露

HIGH

JS-001

描述

在客户端JavaScript代码中发现30个潜在敏感变量暴露。

建议

审查并移除客户端代码中的敏感信息。使用环境变量和服务器端处理敏感数据。

root@sechttp: /var/log/fuzz

 root@sechttp : ~ $ 
 >  [Code: 200]  
/api/sorare/cards [敏感信息泄露]  
 >  [Code: 403]  
/api/sorare/cards?rawq=%7BcurrentUser%7Bslug%20nickname%7D%7D  [禁止访问] 
 >  [Code: 404]  
/api/sorare/cards?rawq=%7BcurrentUser%7Bslug%20nickname%20cards(first%3A50%2Csport%3AFOOTBALL)%7Bnodes%7Bslug%20name%20rarityTyped%20pictureUrl%20power%20cardEditionName%20...%20on%20Card%7Bplayer%7Bslug%20displayName%20position%7D%7D%7DpageInfo%7BhasNextPage%20endCursor%7D%7D%7D%7D   
 >  [Code: 200]  
/api/sorare/cards?rawq=query(%24a%3AString!)%7BcurrentUser%7Bcards(first%3A50%2Csport%3AFOOTBALL%2Cafter%3A%24a)%7Bnodes%7Bslug%20name%20rarityTyped%20pictureUrl%20power%20cardEditionName%20...%20on%20Card%7Bplayer%7Bslug%20displayName%20position%7D%7D%7DpageInfo%7BhasNextPage%20endCursor%7D%7D%7D%7D&vars=${encodeURIComponent(JSON.stringify({a:u}))} [敏感信息泄露]  
 >  [Code: 403]  
/data/players.json  [禁止访问] 
 >  [Code: 404]  
/data/teams.json   
 >  [Code: 200]  
/data/fixtures.json [敏感信息泄露]  
 >  [Code: 403]  
/data/club_logos.json  [禁止访问] 
 >  [Code: 404]  
/data/match_events.json   
 [+] 扫描完成。发现 3 个潜在泄露。 
root@sechttp:~$

端口扫描结果

   端口 服务 状态 版本 
HTTP  关闭   -  
HTTPS  开放   TLS 1.3  
SSH  过滤   -  
MySQL  关闭   -  
  

端口	服务	状态	版本
80	HTTP	关闭	-
443	HTTPS	开放	TLS 1.3
22	SSH	过滤	-
3306	MySQL	关闭	-

HTTP头分析

nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800} 
date: Sun, 12 Apr 2026 19:26:26 GMT 
link: <https://fonts.googleapis.com>; rel="preconnect" 
cf-ray: 9eb49f679994cba0-LAX 
server: cloudflare 
alt-svc: h3=":443"; ma=86400 
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=BNaY4IYs9ZJHNr5%2B%2F%2BQKf8XJ5mfFQO1R%2BgSnE7on5ClIKKyhxVBhSSum%2Fg3dpMpz4wCcG%2FAtMRX92QFyUqn%2B2aTiSdm4g6uCB34KsmXwGl1ULexHw3%2BSe27PsznAdcPieH0ZwncUnC0roFg%3D"}]} 
connection: keep-alive 
content-type: text/html; charset=utf-8 
cache-control: public, max-age=0, must-revalidate 
server-timing: cfCacheStatus;desc="DYNAMIC", cfEdge;dur=16,cfOrigin;dur=37 
cf-cache-status: DYNAMIC 
referrer-policy: strict-origin-when-cross-origin 
transfer-encoding: chunked 
x-content-type-options: nosniff 
access-control-allow-origin: * 

正在测试

对等连接信息正在分析。

正在测试

互联网交换点数据正在收集。

JavaScript分析

Security Analysis Alert

Client-side code analysis has identified potential security vulnerabilities and information disclosure risks.

暴露的JavaScript变量

30 Found

Variables exposed in client-side code that may contain sensitive information

# Security Assessment: Variable Exposure Analysis
 
LEAK
 
key
 g 

Risk: Information disclosure via client-side exposure
 
LEAK
 
url
 e 

Risk: Information disclosure via client-side exposure
 
LEAK
 
code
 e 

Risk: Information disclosure via client-side exposure
 
LEAK
 
side
 e 

Risk: Information disclosure via client-side exposure
 
LEAK
 
OAuth
 state 

Risk: Information disclosure via client-side exposure
 
LEAK
 
gwKey
 l 

Risk: Information disclosure via client-side exposure
 
LEAK
 
Upside
 as 

Risk: Information disclosure via client-side exposure
 
LEAK
 
altKey
 0 

Risk: Information disclosure via client-side exposure
 
LEAK
 
colKey
 t 

Risk: Information disclosure via client-side exposure
 
LEAK
 
upside
 lots 

Risk: Information disclosure via client-side exposure
 
LEAK
 
clientX
 0 

Risk: Information disclosure via client-side exposure
 
LEAK
 
clientY
 0 

Risk: Information disclosure via client-side exposure
 
LEAK
 
ctrlKey
 0 

Risk: Information disclosure via client-side exposure
 
LEAK
 
keyCode
 0 

Risk: Information disclosure via client-side exposure
 
LEAK
 
metaKey
 0 

Risk: Information disclosure via client-side exposure
 
LEAK
 
charCode
 function 

Risk: Information disclosure via client-side exposure
 
LEAK
 
gwNumber
 c 

Risk: Information disclosure via client-side exposure
 
LEAK
 
shiftKey
 0 

Risk: Information disclosure via client-side exposure
 
LEAK
 
endDateStr
 d 

Risk: Information disclosure via client-side exposure
 
LEAK
 
pictureUrl
 e 

Risk: Information disclosure via client-side exposure
 
LEAK
 
cacheSignal
 function 

Risk: Information disclosure via client-side exposure
 
LEAK
 
startDateStr
 u 

Risk: Information disclosure via client-side exposure
 
LEAK
 
aa_possession
 20 

Risk: Information disclosure via client-side exposure
 
LEAK
 
displayNumber
 r 

Risk: Information disclosure via client-side exposure
 
LEAK
 
sorare_pro_url
 t 

Risk: Information disclosure via client-side exposure
 
LEAK
 
O.aa_possession
 20 

Risk: Information disclosure via client-side exposure
 
LEAK
 
addEventListener
 function 

Risk: Information disclosure via client-side exposure
 
LEAK
 
sorare_stellar_url
 t 

Risk: Information disclosure via client-side exposure
 
LEAK
 
stellar_shiny_jersey_number
 20 

Risk: Information disclosure via client-side exposure
 
LEAK
 
Ve.stellar_shiny_jersey_number
 20 

Risk: Information disclosure via client-side exposure
 
Total: 30 exposed variables found

API域名分析

9 Domains

External API domains discovered in client-side code

EXTERNAL_API_DOMAIN

react.dev

Reachable

HTTPS Enabled

Security Note: