content-security-policy

Content Security Policy (CSP) header not implemented

contribute

Contribute.json isn't required on websites that don't belong to Mozilla

cookies

cross-origin-resource-sharing

Content is not visible via cross-origin resource sharing (CORS) files or headers

redirection

Initial redirection is to HTTPS on same host, final destination is HTTPS

referrer-policy

strict-transport-security

HTTP Strict Transport Security (HSTS) header set to a minimum of six months (15768000)

subresource-integrity

Subresource Integrity (SRI) not implemented, but all scripts are loaded from a similar origin

x-content-type-options

X-Content-Type-Options header not implemented

x-frame-options

X-Frame-Options (XFO) header not implemented

x-xss-protection

Deprecated X-XSS-Protection header not implemented

Diagnostics

Metrics

A DNS TXT record was detected. The TXT record lets a domain admin leave notes on a DNS server.

DNS TXT Record Detected

A CAA record was discovered. A CAA record is used to specify which certificate authorities (CAs) are allowed to issue certificates for a domain.

CAA Record

EventListener contains a cross-site scripting vulnerability via the document object model (DOM). An attacker can execute arbitrary script which can then allow theft of cookie-based authentication credentials and launch of  other attacks.

DOM EventListener - Cross-Site Scripting

Some nginx servers have the version on the response header. Useful when you need to find specific CVEs on your targets.

Nginx version detect

Wappalyzer Technology Detection

This template searches for missing HTTP security headers. The impact of these missing headers can vary.


HTTP Missing Security Headers

robots.txt endpoint prober

robots.txt file

WAF Detection

OpenSSH Service - Detect

Extract the issuer's organization from the target's certificate. Issuers are entities which sign and distribute certificates.


Detect SSL Certificate Issuer

Extract the Subject Alternative Name (SAN) from the target's certificate. SAN facilitates the usage of additional hostnames with the same certificate.


SSL DNS Names

TLS version detection is a security process used to determine the version of the Transport Layer Security (TLS) protocol used by a computer or server.
It is important to detect the TLS version in order to ensure secure communication between two computers or servers.


TLS Version - Detect

cw_conversation

_pk_ses.165.3c0a

_pk_id.165.3c0a

TYPO3 is a free and open-source Web content management system written in PHP.

TYPO3 CMS

Sentry is an open-source platform for workflow productivity, aggregating errors from across the stack in real time.

Sentry

PHP is a general-purpose scripting language used for web development.

Vue.js is an open-source model–view–viewmodel JavaScript framework for building user interfaces and single-page applications.

Vue.js

Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.

Nginx

Matomo Analytics is a free and open-source web analytics application, that runs on a PHP/MySQL web-server.

Matomo Analytics

core-js is a modular standard library for JavaScript, with polyfills for cutting-edge ECMAScript features.

core-js

Chatwoot is a customer support tool for instant messaging channels.

Chatwoot

HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.

HSTS

Vite is a rapid development tool for modern web projects.

Vite

Open Graph is a protocol that is used to integrate any web page into the social graph.

name	domain	httpOnly	secure
cw_conversation	mes-aides.1jeune1solution.beta.gouv.fr	❌	❌
_pk_ses.165.3c0a	mes-aides.1jeune1solution.beta.gouv.fr	❌	❌
_pk_id.165.3c0a	mes-aides.1jeune1solution.beta.gouv.fr	❌	❌

flag	country	hostname	ip	city
	France	mes-aides.1jeune1solution.beta.gouv.fr	5.135.137.147	?

https://mes-aides.1jeune1solution.beta.gouv.fr

LightHouse

https://mes-aides.1jeune1solution.beta.gouv.fr/18 minutes

Cookies18 minutes

Scripts tiers18 minutes

Déclaration de mise en accessibilité

Conformité partielle