Timuçin Orhon | UI/UX Designer | Web Designer | Adwords Specialist | E-Commerce
HTTPS
目标分析
www.timucinorhon.com
IP： 34.149.87.45
ASN： AS396982
针对www.timucinorhon.com的全面安全与网络分析报告。服务器：Pepyaka。 托管在US。
- 主要端口
- 443
- 扫描时间
- 可分享的报告链接
- https://sechttp.com/scan/www.timucinorhon.com
详细安全分析
攻击路径与DDoS防御分析
攻击者
L4流量
L7流量
AS396982 (Pepyaka POP节点)
L4已防御
L7已绕过
L4已阻止
L7流量
您的服务器
防御摘要
虽然Pepyaka对第4层（网络层）攻击提供了强大的保护，但您的服务器仍可能容易受到绕过标准CDN防御的复杂第7层（应用层）攻击。建议添加额外的WAF规则和应用端安全措施。
第4层防御
Pepyaka 在网络边缘提供强大的SYN洪泛、UDP放大和容量攻击保护。
第7层漏洞
针对2暴露的API端点的应用层攻击需要额外的WAF规则和速率限制。
服务器信息泄露
LOWINFO-001
描述
服务器正在泄露其软件类型：Pepyaka。这可能帮助攻击者识别潜在漏洞。
建议
配置您的Web服务器以隐藏或修改Server头，以防止信息泄露。
缺少X-Frame-Options头
MEDIUMSEC-002
描述
网站未受到点击劫持攻击的保护。
建议
添加值为'DENY'或'SAMEORIGIN'的X-Frame-Options头，以防止点击劫持。
JavaScript中的敏感信息暴露
HIGHJS-001
描述
在客户端JavaScript代码中发现235个潜在敏感变量暴露。
建议
审查并移除客户端代码中的敏感信息。使用环境变量和服务器端处理敏感数据。
root@sechttp: /var/log/fuzz
root@sechttp : ~ $
> [Code: 200]
/api/wix-sm/v1/members/${e}/role [敏感信息泄露]
> [Code: 403]
https://panorama.wixapps.net/api/v1/bulklog [禁止访问]
[+] 扫描完成。发现 1 个潜在泄露。
root@sechttp : ~ $
端口扫描结果
| 端口 | 服务 | 状态 | 版本 |
|---|---|---|---|
| 80 | HTTP | 关闭 | - |
| 443 | HTTPS | 开放 | TLS 1.3 |
| 22 | SSH | 过滤 | - |
| 3306 | MySQL | 关闭 | - |
HTTP头分析
age:
11
via:
1.1 google
date:
Thu, 11 Sep 2025 16:35:54 GMT
etag:
W/"94bd9c8d95ff5aa233c987d495788714"
link:
<https://static.parastorage.com/>; rel=preconnect; crossorigin;,<https://static.parastorage.com/>; rel=preconnect;,<https://static.wixstatic.com/>; rel=preconnect; crossorigin;,<https://static.wixstatic.com/>; rel=preconnect;,<https://siteassets.parastorage.com>; rel=preconnect; crossorigin;,
vary:
Accept-Encoding
server:
Pepyaka
alt-svc:
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-cache:
HIT
x-seen-by:
yvSunuo/8ld62ehjr5B7kA==
set-cookie:
ssr-caching=cache#desc=miss#varnish=miss_hit#dc#desc=fastly_g; max-age=20
x-served-by:
cache-lax-kwhp1940098-LAX
content-type:
text/html; charset=UTF-8
accept-ranges:
bytes
cache-control:
public,max-age=0,must-revalidate
glb-x-seen-by:
bS8wRlGzu0Hc+WrYuHB8QIg44yfcdCMJRkBoQ1h6Vjc=
server-timing:
cache;desc=miss, varnish;desc=miss_hit, dc;desc=fastly_g
content-length:
748425
html-cacheable:
true
content-language:
en
x-wix-request-id:
1757608554.477435193897125831
x-content-type-options:
nosniff
strict-transport-security:
max-age=86400
ASN信息
ASN: AS396982
IP地址: 34.149.87.45
网络前缀: 34.148.0.0/14
组织: GOOGLE-CLOUD-PLATFORM
国家:
🇺🇸 US
名称: GOOGLE-CLOUD-PLATFORM
上游提供商 (3)
AS15169
GOOGLE
Google LLC
🇺🇸 US
upstream
AS19527
GOOGLE-2
Google LLC
🇺🇸 US
upstream
AS15169
GOOGLE
Google LLC
🇺🇸 US
upstream
互联网交换点 (4)
🇸🇦
SAIX Saudi Arabia Riyadh
SA
100 Gbps
Bandwidth
🇸🇦
center3 IX Jeddah
SA
20 Gbps
Bandwidth
🇸🇦
SAIX Saudi Arabia Riyadh
SA
100 Gbps
Bandwidth
🇸🇦
center3 IX Jeddah
SA
20 Gbps
Bandwidth
JavaScript分析
Security Analysis Alert
Client-side code analysis has identified potential security vulnerabilities and information disclosure risks.
暴露的JavaScript变量
Variables exposed in client-side code that may contain sensitive information
# Security Assessment: Variable Exposure Analysis
LEAK
URL
.concat(t)),n}return Bt(t,e),t}(Ht),Gt=function(e){function t(t,r){var n=e.call(this,t.message,{cause:t})||this;return r&&(n.stack=Ut(n.stack,
Risk: Information disclosure via client-side exposure
LEAK
key
function
Risk: Information disclosure via client-side exposure
LEAK
url
"//frog.wix.com/bolt-performance?src=72&evid="+evid+"&appName="+fedOpsAppName+"&is_rollout="+is_rollout+"&is_sav_rollout="+is_sav_rollout+"&is_dac_rollout="+is_dac_rollout+"&dc="+site.dc+"&msid="+site...
Risk: Information disclosure via client-side exposure
LEAK
TEST
test
Risk: Information disclosure via client-side exposure
LEAK
code
Client
Risk: Information disclosure via client-side exposure
LEAK
keys
function
Risk: Information disclosure via client-side exposure
LEAK
msId
n
Risk: Information disclosure via client-side exposure
LEAK
msid
+site.metaSiteId+
Risk: Information disclosure via client-side exposure
LEAK
side
a
Risk: Information disclosure via client-side exposure
LEAK
sign
n
Risk: Information disclosure via client-side exposure
LEAK
appId
e
Risk: Information disclosure via client-side exposure
LEAK
keyBy
function
Risk: Information disclosure via client-side exposure
LEAK
keyOf
function
Risk: Information disclosure via client-side exposure
LEAK
toKey
function
Risk: Information disclosure via client-side exposure
LEAK
DESIGN
design_data
Risk: Information disclosure via client-side exposure
LEAK
MOBILE
return
Risk: Information disclosure via client-side exposure
LEAK
Mobile
mobile
Risk: Information disclosure via client-side exposure
LEAK
Number
[sechttp]
Risk: Information disclosure via client-side exposure
LEAK
SIGNUP
register
Risk: Information disclosure via client-side exposure
LEAK
altKey
0
Risk: Information disclosure via client-side exposure
LEAK
assign
function
Risk: Information disclosure via client-side exposure
LEAK
client
.concat(e));return o.meter(
Risk: Information disclosure via client-side exposure
LEAK
codeAt
N3
Risk: Information disclosure via client-side exposure
LEAK
cookie
r
Risk: Information disclosure via client-side exposure
LEAK
decode
C
Risk: Information disclosure via client-side exposure
LEAK
domain
kt
Risk: Information disclosure via client-side exposure
LEAK
encode
R
Risk: Information disclosure via client-side exposure
LEAK
inpUrl
vt
Risk: Information disclosure via client-side exposure
LEAK
keyFor
function
Risk: Information disclosure via client-side exposure
LEAK
lcpUrl
i
Risk: Information disclosure via client-side exposure
LEAK
SIGN_UP
signupTPA
Risk: Information disclosure via client-side exposure
LEAK
baseUrl
t
Risk: Information disclosure via client-side exposure
LEAK
clientX
0
Risk: Information disclosure via client-side exposure
LEAK
clientY
0
Risk: Information disclosure via client-side exposure
LEAK
ctrlKey
0
Risk: Information disclosure via client-side exposure
LEAK
decoder
a
Risk: Information disclosure via client-side exposure
LEAK
encoder
null
Risk: Information disclosure via client-side exposure
LEAK
fastKey
function
Risk: Information disclosure via client-side exposure
LEAK
findKey
function
Risk: Information disclosure via client-side exposure
LEAK
keyCode
0
Risk: Information disclosure via client-side exposure
LEAK
mapKeys
function
Risk: Information disclosure via client-side exposure
LEAK
metaKey
0
Risk: Information disclosure via client-side exposure
LEAK
ownKeys
n
Risk: Information disclosure via client-side exposure
LEAK
pageUrl
i
Risk: Information disclosure via client-side exposure
LEAK
release
g
Risk: Information disclosure via client-side exposure
LEAK
signbit
function
Risk: Information disclosure via client-side exposure
LEAK
siteUrl
e
Risk: Information disclosure via client-side exposure
LEAK
unicode
e
Risk: Information disclosure via client-side exposure
LEAK
BAD_CODE
EMAIL_VERIFICATION_FAILED
Risk: Information disclosure via client-side exposure
LEAK
PASSWORD
31fff8fc-ea95-43ac-95c5-902497125b90
Risk: Information disclosure via client-side exposure
LEAK
baseURLs
t
Risk: Information disclosure via client-side exposure
LEAK
charCode
function
Risk: Information disclosure via client-side exposure
LEAK
clientId
_wixCIDX
Risk: Information disclosure via client-side exposure
LEAK
endpoint
<empty_value>
Risk: Information disclosure via client-side exposure
LEAK
envFetch
r
Risk: Information disclosure via client-side exposure
LEAK
fetchApi
i
Risk: Information disclosure via client-side exposure
LEAK
getAppId
D
Risk: Information disclosure via client-side exposure
LEAK
isMobile
s
Risk: Information disclosure via client-side exposure
LEAK
password
VLa
Risk: Information disclosure via client-side exposure
LEAK
r.SIGNUP
register
Risk: Information disclosure via client-side exposure
LEAK
shiftKey
0
Risk: Information disclosure via client-side exposure
LEAK
testMode
y
Risk: Information disclosure via client-side exposure
LEAK
u.MOBILE
MOBILE
Risk: Information disclosure via client-side exposure
LEAK
EmailLink
EmailLink
Risk: Information disclosure via client-side exposure
LEAK
PhoneLink
PhoneLink
Risk: Information disclosure via client-side exposure
LEAK
client_id
h
Risk: Information disclosure via client-side exposure
LEAK
codePoint
c
Risk: Information disclosure via client-side exposure
LEAK
editorKey
t
Risk: Information disclosure via client-side exposure
LEAK
i.SIGN_UP
signupTPA
Risk: Information disclosure via client-side exposure
LEAK
iframeUrl
[XSS working]
Risk: Information disclosure via client-side exposure
LEAK
parsedUrl
h
Risk: Information disclosure via client-side exposure
LEAK
sessionId
Yr
Risk: Information disclosure via client-side exposure
LEAK
toUnicode
function
Risk: Information disclosure via client-side exposure
LEAK
updateURL
function
Risk: Information disclosure via client-side exposure
LEAK
CODE_LOGIN
editor-members-code-login
Risk: Information disclosure via client-side exposure
LEAK
EMAIL_LINK
EmailLink
Risk: Information disclosure via client-side exposure
LEAK
PHONE_LINK
PhoneLink
Risk: Information disclosure via client-side exposure
LEAK
R.PASSWORD
31fff8fc-ea95-43ac-95c5-902497125b90
Risk: Information disclosure via client-side exposure
LEAK
baseClient
o
Risk: Information disclosure via client-side exposure
LEAK
c.BAD_CODE
EMAIL_VERIFICATION_FAILED
Risk: Information disclosure via client-side exposure
LEAK
codePoints
function
Risk: Information disclosure via client-side exposure
LEAK
deviceInfo
m
Risk: Information disclosure via client-side exposure
LEAK
deviceType
e
Risk: Information disclosure via client-side exposure
LEAK
httpClient
Mr
Risk: Information disclosure via client-side exposure
LEAK
pageNumber
r
Risk: Information disclosure via client-side exposure
LEAK
requestUrl
n
Risk: Information disclosure via client-side exposure
LEAK
session_id
+site.sessionId+
Risk: Information disclosure via client-side exposure
LEAK
CODE_SIGNUP
members-code-signup
Risk: Information disclosure via client-side exposure
LEAK
DEVELOPMENT
development
Risk: Information disclosure via client-side exposure
LEAK
codePointAt
function
Risk: Information disclosure via client-side exposure
LEAK
credentials
include
Risk: Information disclosure via client-side exposure
LEAK
csmCacheKey
t
Risk: Information disclosure via client-side exposure
LEAK
environment
P
Risk: Information disclosure via client-side exposure
LEAK
fileRepoUrl
t
Risk: Information disclosure via client-side exposure
LEAK
pageJsonUrl
y
Risk: Information disclosure via client-side exposure
LEAK
relativeUrl
_
Risk: Information disclosure via client-side exposure
LEAK
s.EmailLink
EmailLink
Risk: Information disclosure via client-side exposure
LEAK
s.PhoneLink
PhoneLink
Risk: Information disclosure via client-side exposure
LEAK
sessionTime
o
Risk: Information disclosure via client-side exposure
LEAK
status_code
n
Risk: Information disclosure via client-side exposure
LEAK
urlMappings
e
Risk: Information disclosure via client-side exposure
LEAK
urlOverride
E
Risk: Information disclosure via client-side exposure
LEAK
ACCESS_DENID
-19956
Risk: Information disclosure via client-side exposure
LEAK
CODE_INVALID
EMAIL_VERIFICATION_REQUIRED
Risk: Information disclosure via client-side exposure
LEAK
DESIGN_QUERY
designQuery
Risk: Information disclosure via client-side exposure
LEAK
DOMTokenList
1
Risk: Information disclosure via client-side exposure
LEAK
MOBILE_HINTS
mobile_hints
Risk: Information disclosure via client-side exposure
LEAK
VERIFY_TOKEN
apply-session-token
Risk: Information disclosure via client-side exposure
LEAK
a.EMAIL_LINK
EmailLink
Risk: Information disclosure via client-side exposure
LEAK
a.PHONE_LINK
PhoneLink
Risk: Information disclosure via client-side exposure
LEAK
compositeKey
function
Risk: Information disclosure via client-side exposure
LEAK
deviceMemory
navigator
Risk: Information disclosure via client-side exposure
LEAK
getPublicUrl
function
Risk: Information disclosure via client-side exposure
LEAK
getSessionId
function
Risk: Information disclosure via client-side exposure
LEAK
getWindowUrl
n
Risk: Information disclosure via client-side exposure
LEAK
isServerSide
1
Risk: Information disclosure via client-side exposure
LEAK
mediaRootUrl
t
Risk: Information disclosure via client-side exposure
LEAK
stdDeviation
${e}
Risk: Information disclosure via client-side exposure
LEAK
wixBiSession
Mt
Risk: Information disclosure via client-side exposure
LEAK
EXPIRED_TOKEN
expiredTokenTPA
Risk: Information disclosure via client-side exposure
LEAK
SVGNumberList
0
Risk: Information disclosure via client-side exposure
LEAK
SlideVertical
600
Risk: Information disclosure via client-side exposure
LEAK
clientSpecMap
a
Risk: Information disclosure via client-side exposure
LEAK
enableTestApi
n
Risk: Information disclosure via client-side exposure
LEAK
fromCodePoint
function
Risk: Information disclosure via client-side exposure
LEAK
getSvgBaseUrl
e
Risk: Information disclosure via client-side exposure
LEAK
isUrlMigrated
o
Risk: Information disclosure via client-side exposure
LEAK
mainGridAppId
l
Risk: Information disclosure via client-side exposure
LEAK
moduleRepoUrl
n
Risk: Information disclosure via client-side exposure
LEAK
siteAssetsUrl
n
Risk: Information disclosure via client-side exposure
LEAK
t.environment
500
Risk: Information disclosure via client-side exposure
LEAK
urlMappingKey
e
Risk: Information disclosure via client-side exposure
LEAK
ClientRectList
0
Risk: Information disclosure via client-side exposure
LEAK
DEFAULT_SIGNUP
members-default-signup
Risk: Information disclosure via client-side exposure
LEAK
GET_VIEWER_API
getViewerApi
Risk: Information disclosure via client-side exposure
LEAK
RESET_PASSWORD
resetPasswordTPA
Risk: Information disclosure via client-side exposure
LEAK
WRONG_PASSWORD
-17005
Risk: Information disclosure via client-side exposure
LEAK
authentication
e
Risk: Information disclosure via client-side exposure
LEAK
c.ACCESS_DENID
-19956
Risk: Information disclosure via client-side exposure
LEAK
c.CODE_INVALID
EMAIL_VERIFICATION_REQUIRED
Risk: Information disclosure via client-side exposure
LEAK
clientTopology
t
Risk: Information disclosure via client-side exposure
LEAK
staticMediaUrl
r
Risk: Information disclosure via client-side exposure
LEAK
urlFormatModel
p
Risk: Information disclosure via client-side exposure
LEAK
wixCodePageIds
u
Risk: Information disclosure via client-side exposure
LEAK
FORGOT_PASSWORD
forgotPasswordTPA
Risk: Information disclosure via client-side exposure
LEAK
MozPrintableKey
Unidentified
Risk: Information disclosure via client-side exposure
LEAK
URLSearchParams
R
Risk: Information disclosure via client-side exposure
LEAK
createObjectURL
[sechttp]
Risk: Information disclosure via client-side exposure
LEAK
decodeDotInKeys
a
Risk: Information disclosure via client-side exposure
LEAK
decodedBodySize
t
Risk: Information disclosure via client-side exposure
LEAK
encodeDotInKeys
f
Risk: Information disclosure via client-side exposure
LEAK
externalBaseUrl
n
Risk: Information disclosure via client-side exposure
LEAK
getMetadataKeys
function
Risk: Information disclosure via client-side exposure
LEAK
i.EXPIRED_TOKEN
expiredTokenTPA
Risk: Information disclosure via client-side exposure
LEAK
isPremiumDomain
l
Risk: Information disclosure via client-side exposure
LEAK
loadEnvironment
r
Risk: Information disclosure via client-side exposure
LEAK
loadModuleByUrl
[sechttp]
Risk: Information disclosure via client-side exposure
LEAK
longTasksNumber
s
Risk: Information disclosure via client-side exposure
LEAK
r.SlideVertical
600
Risk: Information disclosure via client-side exposure
LEAK
revokeObjectURL
[sechttp]
Risk: Information disclosure via client-side exposure
LEAK
viewerSessionId
p
Risk: Information disclosure via client-side exposure
LEAK
PASSWORD_RESETED
-19973
Risk: Information disclosure via client-side exposure
LEAK
addEventListener
t
Risk: Information disclosure via client-side exposure
LEAK
c.WRONG_PASSWORD
-17005
Risk: Information disclosure via client-side exposure
LEAK
clientSideRender
s
Risk: Information disclosure via client-side exposure
LEAK
currentParsedUrl
p
Risk: Information disclosure via client-side exposure
LEAK
encodeValuesOnly
f
Risk: Information disclosure via client-side exposure
LEAK
i.RESET_PASSWORD
resetPasswordTPA
Risk: Information disclosure via client-side exposure
LEAK
r.GET_VIEWER_API
getViewerApi
Risk: Information disclosure via client-side exposure
LEAK
siteAssetsClient
Lr
Risk: Information disclosure via client-side exposure
LEAK
updatePageNumber
t
Risk: Information disclosure via client-side exposure
LEAK
ACCESS_RESTRICTED
accessRestrictedTPA
Risk: Information disclosure via client-side exposure
LEAK
GET_CLIENT_WORKER
get-client-worker
Risk: Information disclosure via client-side exposure
LEAK
VERIFICATION_CODE
verification-code
Risk: Information disclosure via client-side exposure
LEAK
i.FORGOT_PASSWORD
forgotPasswordTPA
Risk: Information disclosure via client-side exposure
LEAK
isClientSdkOnSite
b
Risk: Information disclosure via client-side exposure
LEAK
mobileActionsMenu
o
Risk: Information disclosure via client-side exposure
LEAK
publicEnvironment
P
Risk: Information disclosure via client-side exposure
LEAK
sentryEnvironment
l
Risk: Information disclosure via client-side exposure
LEAK
EMAIL_CONFIRMATION
emailConfirmationTPA
Risk: Information disclosure via client-side exposure
LEAK
EMAIL_NOT_PROVIDED
-18880
Risk: Information disclosure via client-side exposure
LEAK
INIT_DS_VIEWER_API
init_ds_viewerApi
Risk: Information disclosure via client-side exposure
LEAK
MOBILE_HINTS_QUERY
mobileHintsQuery
Risk: Information disclosure via client-side exposure
LEAK
WRONG_AUTH_DETAILS
-19976
Risk: Information disclosure via client-side exposure
LEAK
c.PASSWORD_RESETED
-19973
Risk: Information disclosure via client-side exposure
LEAK
fl.MozPrintableKey
Unidentified
Risk: Information disclosure via client-side exposure
LEAK
getOwnMetadataKeys
function
Risk: Information disclosure via client-side exposure
LEAK
persistentEndpoint
this
Risk: Information disclosure via client-side exposure
LEAK
relativeEncodedUrl
o
Risk: Information disclosure via client-side exposure
LEAK
accessTokensHandler
c
Risk: Information disclosure via client-side exposure
LEAK
calcPublicModuleUrl
e
Risk: Information disclosure via client-side exposure
LEAK
clientModuleFetcher
[XSS working]
Risk: Information disclosure via client-side exposure
LEAK
i.ACCESS_RESTRICTED
accessRestrictedTPA
Risk: Information disclosure via client-side exposure
LEAK
r.GET_CLIENT_WORKER
get-client-worker
Risk: Information disclosure via client-side exposure
LEAK
siteAssetsServerUrl
n
Risk: Information disclosure via client-side exposure
LEAK
c.EMAIL_NOT_PROVIDED
-18880
Risk: Information disclosure via client-side exposure
LEAK
c.WRONG_AUTH_DETAILS
-19976
Risk: Information disclosure via client-side exposure
LEAK
exports.DOMTokenList
1
Risk: Information disclosure via client-side exposure
LEAK
i.EMAIL_CONFIRMATION
emailConfirmationTPA
Risk: Information disclosure via client-side exposure
LEAK
r.INIT_DS_VIEWER_API
init_ds_viewerApi
Risk: Information disclosure via client-side exposure
LEAK
siteAssetsRouterUrls
s
Risk: Information disclosure via client-side exposure
LEAK
stylableMetadataURLs
JSON
Risk: Information disclosure via client-side exposure
LEAK
AUTHENTICATION_FAILED
-19976
Risk: Information disclosure via client-side exposure
LEAK
CLIENT_AUTH_FORBIDDEN
-19974
Risk: Information disclosure via client-side exposure
LEAK
clientSpecMapSupplier
r
Risk: Information disclosure via client-side exposure
LEAK
exports.SVGNumberList
<empty_value>
Risk: Information disclosure via client-side exposure
LEAK
processedEventEntries
u
Risk: Information disclosure via client-side exposure
LEAK
EXISTING_EMAIL_ACCOUNT
-19995
Risk: Information disclosure via client-side exposure
LEAK
exports.ClientRectList
<empty_value>
Risk: Information disclosure via client-side exposure
LEAK
reportPlatformEndEvent
x
Risk: Information disclosure via client-side exposure
LEAK
staticHTMLComponentUrl
p
Risk: Information disclosure via client-side exposure
LEAK
SWITCH_MOBILE_VIEW_MODE
SwitchMobileViewMode
Risk: Information disclosure via client-side exposure
LEAK
c.AUTHENTICATION_FAILED
-19976
Risk: Information disclosure via client-side exposure
LEAK
c.CLIENT_AUTH_FORBIDDEN
-19974
Risk: Information disclosure via client-side exposure
LEAK
c.EXISTING_EMAIL_ACCOUNT
-19995
Risk: Information disclosure via client-side exposure
LEAK
reportAsyncWithCustomKey
function
Risk: Information disclosure via client-side exposure
LEAK
COOKIE_CONSENT_DISALLOWED
new
Risk: Information disclosure via client-side exposure
LEAK
a.SWITCH_MOBILE_VIEW_MODE
SwitchMobileViewMode
Risk: Information disclosure via client-side exposure
LEAK
requiredBrowserNativeApis
[XSS working]
Risk: Information disclosure via client-side exposure
LEAK
supportsNativeBrowserApis
[sechttp]
Risk: Information disclosure via client-side exposure
LEAK
specificEnvFeaturesLoaders
Lt
Risk: Information disclosure via client-side exposure
LEAK
ONLY_UNIQUE_SAVED_URL_ERROR
ONLY_UNIQUE_SAVED_URL_ERROR
Risk: Information disclosure via client-side exposure
LEAK
RESET_PASSWORD_TOKEN_EXPIRED
-19972
Risk: Information disclosure via client-side exposure
LEAK
c.RESET_PASSWORD_TOKEN_EXPIRED
-19972
Risk: Information disclosure via client-side exposure
LEAK
disableStaticPagesUrlHierarchy
u
Risk: Information disclosure via client-side exposure
LEAK
ONLY_UNIQUE_PUBLISHED_URL_ERROR
ONLY_UNIQUE_PUBLISHED_URL_ERROR
Risk: Information disclosure via client-side exposure
LEAK
NEW_RESET_PASSWORD_TOKEN_EXPIRED
EXPIRED_JWT_TOKEN
Risk: Information disclosure via client-side exposure
LEAK
getIframeUrlForOldBrowserMessage
[sechttp]
Risk: Information disclosure via client-side exposure
LEAK
c.NEW_RESET_PASSWORD_TOKEN_EXPIRED
EXPIRED_JWT_TOKEN
Risk: Information disclosure via client-side exposure
LEAK
DS_PENDING_REQUIREMENTS_viewerManagerByRefApi
ds_pending_requirements_viewerManagerByRefApi
Risk: Information disclosure via client-side exposure
LEAK
DS_PENDING_REQUIREMENTS_viewerManagerFontsApi
ds_pending_requirements_viewerManagerFontsApi
Risk: Information disclosure via client-side exposure
LEAK
r.DS_PENDING_REQUIREMENTS_viewerManagerByRefApi
ds_pending_requirements_viewerManagerByRefApi
Risk: Information disclosure via client-side exposure
LEAK
r.DS_PENDING_REQUIREMENTS_viewerManagerFontsApi
ds_pending_requirements_viewerManagerFontsApi
Risk: Information disclosure via client-side exposure
LEAK
DS_PENDING_REQUIREMENTS_viewerManagerUpdateStatusApi
ds_pending_requirements_viewerManagerUpdateStatusApi
Risk: Information disclosure via client-side exposure
LEAK
r.DS_PENDING_REQUIREMENTS_viewerManagerUpdateStatusApi
ds_pending_requirements_viewerManagerUpdateStatusApi
Risk: Information disclosure via client-side exposure
Total: 235 exposed variables found
API域名分析
External API domains discovered in client-side code
EXTERNAL_API_DOMAIN
schema.org
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
www.timucinorhon.com
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
github.com
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
rock.mit-license.org
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
panorama.wixapps.net
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
sled.wix.dev
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
bo.wix.com
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
www.wix.com
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
static.parastorage.com
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
frog.wix.com
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
pages.parastorage.com
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
mths.be
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
lodash.com
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
openjsf.org
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
underscorejs.org
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
npms.io
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
EXTERNAL_API_DOMAIN
reactjs.org
Reachable
HTTPS Enabled
Security Note:
External API domains should be validated for proper authentication and rate limiting
发现的API端点
API endpoints identified through static analysis of client-side code
GET
/api/wix-sm/v1/members/${e}/role
Active
Endpoint discovered via client-side code analysis
GET
https://panorama.wixapps.net/api/v1/bulklog
Active
Endpoint discovered via client-side code analysis
JavaScript资源
JavaScript files loaded by the application
JS
https://static.parastorage.com/unpkg/core-js-bundle@3.2.1/minified.js
JS
https://static.parastorage.com/unpkg/focus-within-polyfill@5.0.9/dist/focus-within-polyfill.js
JS
https://browser.sentry-cdn.com/7.120.3/modulemetadata.es5.min.js
JS
https://static.parastorage.com/services/wix-thunderbolt/dist/thunderbolt-commons.e8600c82.bundle.min.js
JS
https://static.parastorage.com/services/wix-thunderbolt/dist/main.6d00e8a0.bundle.min.js
JS
https://static.parastorage.com/services/wix-thunderbolt/dist/main.renderer.f600e767.bundle.min.js
JS
https://static.parastorage.com/unpkg/lodash@4.17.21/lodash.min.js
JS
https://static.parastorage.com/unpkg/react@18.3.1/umd/react.production.min.js
JS
https://static.parastorage.com/unpkg/react-dom@18.3.1/umd/react-dom.production.min.js
JS
https://static.parastorage.com/services/wix-thunderbolt/dist/browser-deprecation.bundle.es5.js
JS
https://static.parastorage.com/services/tag-manager-client/1.1028.0/siteTags.bundle.min.js
JS
"https://static.parastorage.com/unpkg/core-js-bundle@3.2.1/minified.js"
JS
"https://static.parastorage.com/unpkg/focus-within-polyfill@5.0.9/dist/focus-within-polyfill.js"
JS
"https://browser.sentry-cdn.com/7.120.3/modulemetadata.es5.min.js"
JS
"https://static.parastorage.com/services/wix-thunderbolt/dist/thunderbolt-commons.e8600c82.bundle.min.js"
JS
"https://static.parastorage.com/services/wix-thunderbolt/dist/main.6d00e8a0.bundle.min.js"
JS
"https://static.parastorage.com/services/wix-thunderbolt/dist/main.renderer.f600e767.bundle.min.js"
JS
"https://static.parastorage.com/unpkg/lodash@4.17.21/lodash.min.js"
JS
"https://static.parastorage.com/unpkg/react@18.3.1/umd/react.production.min.js"
JS
"https://static.parastorage.com/unpkg/react-dom@18.3.1/umd/react-dom.production.min.js"
JS
"https://static.parastorage.com/services/wix-thunderbolt/dist/browser-deprecation.bundle.es5.js"
JS
"https://static.parastorage.com/services/tag-manager-client/1.1028.0/siteTags.bundle.min.js"
安全建议
- • Avoid exposing sensitive variables in client-side code
- • Implement proper API authentication and rate limiting
- • Use environment variables for sensitive configuration
- • Regularly audit client-side code for information leaks
- • Minimize the amount of sensitive data processed on the client side
历史扫描记录 (1)
Timuçin Orhon is a UI/UX Designer, Web Designer, Graphic Designer, Google Adwords Specialist, Social Media Manager, E-Commerce Consultant from Kafa Tasarım. Timuçin Orhon
65/100
4 issues