Vulnerability Scan Result
| Title: | Friday toto 12 million | HardwareZone Forums |
| Description: | What number to buy? |
| IP address | 18.245.162.57 |
| Country | US  |
| AS number | AS16509 |
| Net name | Amazon Inc |
| IP address | 18.245.162.127 |
| Country | US |
| AS number | AS16509 |
| Net name | Amazon Inc |
| IP address | 18.245.162.49 |
| Country | US |
| AS number | AS16509 |
| Net name | Amazon Inc |
| IP address | 18.245.162.59 |
| Country | US |
| AS number | AS16509 |
| Net name | Amazon Inc |
80/tcp | http | Amazon CloudFront httpd |
443/tcp | https | CloudFront |
| Software / Version | Category |
|---|---|
| AppNexus | Advertising |
| Amazon Web Services | PaaS |
| AWS Certificate Manager | SSL/TLS certificate authorities |
| Amazon CloudFront | CDN |
| comScore | Analytics |
| Funding Choices | Cookie compliance |
| Google Publisher Tag | Advertising |
| Google Analytics | Analytics |
| Google Font API | Font scripts |
| HTTP/3 | Miscellaneous |
| jQuery 3.5.1 | JavaScript libraries |
| MooTools | JavaScript frameworks |
| Mustache 2.2.1 | JavaScript frameworks |
| MySQL | Databases |
| Open Graph | Miscellaneous |
| Permutive | Miscellaneous |
| PHP | Programming languages |
| Prebid | Advertising |
| Skimlinks | Affiliate programs |
| Spin.js | JavaScript libraries |
| PWA | Miscellaneous |
| Webpack | Miscellaneous |
| Module Federation | Miscellaneous |
| AMP | JavaScript frameworks |
| Google AdSense | Advertising |
| Google Tag Manager | Tag managers |
| Hotjar | Analytics |
| Outbrain | Widgets, Advertising |
| Quantcast Measure | Analytics |
| HSTS | Security |
| XenForo | Message boards |
Web Application Vulnerabilities
Evidence
| Software / Version | Category |
|---|---|
| AppNexus | Advertising |
| Amazon Web Services | PaaS |
| AWS Certificate Manager | SSL/TLS certificate authorities |
| Amazon CloudFront | CDN |
| comScore | Analytics |
| Funding Choices | Cookie compliance |
| Google Publisher Tag | Advertising |
| Google Analytics | Analytics |
| Google Font API | Font scripts |
| HTTP/3 | Miscellaneous |
| jQuery 3.5.1 | JavaScript libraries |
| MooTools | JavaScript frameworks |
| Mustache 2.2.1 | JavaScript frameworks |
| MySQL | Databases |
| Open Graph | Miscellaneous |
| Permutive | Miscellaneous |
| PHP | Programming languages |
| Prebid | Advertising |
| Skimlinks | Affiliate programs |
| Spin.js | JavaScript libraries |
| PWA | Miscellaneous |
| Webpack | Miscellaneous |
| Module Federation | Miscellaneous |
| AMP | JavaScript frameworks |
| Google AdSense | Advertising |
| Google Tag Manager | Tag managers |
| Hotjar | Analytics |
| Outbrain | Widgets, Advertising |
| Quantcast Measure | Analytics |
| HSTS | Security |
| XenForo | Message boards |
Vulnerability description
We noticed that server software and technology details are exposed, potentially aiding attackers in tailoring specific exploits against identified systems and versions.
Recommendation
We recommend you to eliminate the information which permits the identification of software platform, technology, server and operating system: HTTP server headers, HTML meta information, etc.
Classification
| OWASP Top 10 - 2017 | A6 - Security Misconfiguration |
| OWASP Top 10 - 2021 | A5 - Security Misconfiguration |
Evidence
Vulnerability description
We found the robots.txt on the target server. This file instructs web crawlers what URLs and endpoints of the web application they can visit and crawl. Website administrators often misuse this file while attempting to hide some web pages from the users.
Recommendation
We recommend you to manually review the entries from robots.txt and remove the ones which lead to sensitive locations in the website (ex. administration panels, configuration files, etc).
Classification
| OWASP Top 10 - 2017 | A6 - Security Misconfiguration |
| OWASP Top 10 - 2021 | A5 - Security Misconfiguration |
Vulnerability description
Website is accessible.
Vulnerability description
We have noticed that the server is missing the security.txt file, which is considered a good practice for web security. It provides a standardized way for security researchers and the public to report security vulnerabilities or concerns by outlining the preferred method of contact and reporting procedures.
Recommendation
We recommend you to implement the security.txt file according to the standard, in order to allow researchers or users report any security issues they find, improving the defensive mechanisms of your server.
Classification
| OWASP Top 10 - 2017 | A6 - Security Misconfiguration |
| OWASP Top 10 - 2021 | A5 - Security Misconfiguration |
Infrastructure Vulnerabilities
Evidence
| Domain Queried | DNS Record Type | Description | Value |
|---|---|---|---|
| forums.hardwarezone.com.sg | A | IPv4 address | 18.245.162.57 |
| forums.hardwarezone.com.sg | A | IPv4 address | 18.245.162.49 |
| forums.hardwarezone.com.sg | A | IPv4 address | 18.245.162.127 |
| forums.hardwarezone.com.sg | A | IPv4 address | 18.245.162.59 |
Recommendation
We recommend reviewing all DNS records associated with the domain and identifying and removing unused or obsolete records.
Vulnerability description
OS detection couldn't determine the operating system.
Recommendation
Vulnerability checks are skipped for ports that redirect to another port. We recommend scanning the redirected port directly.
Evidence
| Software / Version | Category |
|---|---|
| XenForo | Message boards |
| MySQL | Databases |
| PHP | Programming languages |
| Amazon Web Services | PaaS |
| MooTools | JavaScript frameworks |
| HSTS | Security |
| Amazon CloudFront | CDN |
| AWS Certificate Manager | SSL/TLS certificate authorities |
| Webpack | Miscellaneous |
| Permutive | Miscellaneous |
| Module Federation | Miscellaneous |
| HTTP/3 | Miscellaneous |
| jQuery 3.5.1 | JavaScript libraries |
| Google Publisher Tag | Advertising |
| Google AdSense | Advertising |
Vulnerability description
We noticed that server software and technology details are exposed, potentially aiding attackers in tailoring specific exploits against identified systems and versions.
Recommendation
We recommend you to eliminate the information which permits the identification of software platform, technology, server and operating system: HTTP server headers, HTML meta information, etc.