Diagnostics

Metrics

ident

http

A CAA record was discovered. A CAA record is used to specify which certificate authorities (CAs) are allowed to issue certificates for a domain.

CAA Record

Allowed Options Method

Setting the XSS-Protection header is deprecated. Setting the header to anything other than `0` can actually introduce an XSS vulnerability.

XSS-Protection Header - Cross-Site Scripting

Some Apache servers have the version on the response header. The OpenSSL version can be also obtained

Apache Detection

FingerprintHub Technology Fingerprint tests run in nuclei.

FingerprintHub Technology Fingerprint

This template searches for missing HTTP security headers. The impact of these missing headers can vary.


HTTP Missing Security Headers

WAF Detection

Extract the issuer's organization from the target's certificate. Issuers are entities which sign and distribute certificates.


Detect SSL Certificate Issuer

Extract the Subject Alternative Name (SAN) from the target's certificate. SAN facilitates the usage of additional hostnames with the same certificate.


SSL DNS Names

TLS version detection is a security process used to determine the version of the Transport Layer Security (TLS) protocol used by a computer or server.
It is important to detect the TLS version in order to ensure secure communication between two computers or servers.


TLS Version - Detect

TypeScript is an open-source language which builds on JavaScript  by adding static type definitions.

TypeScript

Zone.js

Angular is a TypeScript-based open-source web application framework led by the Angular Team at Google.

Angular

Apache is a free and open-source cross-platform web server software.

Apache HTTP Server

HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.

severity	service	vulnerability
info	ident (port:113)
info	http (port:443)

Impact	Description	Documentation
-25	Content Security Policy (CSP) header not implemented	Implement one, see MDN's Content Security Policy (CSP) documentation.
-20	`X-Frame-Options` (XFO) header cannot be recognized.	Documentation for x-frame-options-sameorigin-or-deny

risk	name
Medium (High)	Content Security Policy (CSP) Header Not Set
Medium (Medium)	Multiple X-Frame-Options Header Entries
Low (High)	CSP: X-WebKit-CSP
Low (Medium)	Insufficient Site Isolation Against Spectre Vulnerability
Low (Medium)	Permissions Policy Header Not Set
Informational (High)	Obsolete Content Security Policy (CSP) Header Found
Informational (High)	Sec-Fetch-Dest Header is Missing
Informational (High)	Sec-Fetch-Mode Header is Missing
Informational (High)	Sec-Fetch-Site Header is Missing
Informational (High)	Sec-Fetch-User Header is Missing
Informational (Medium)	Base64 Disclosure
Informational (Medium)	Modern Web Application
Informational (Medium)	Storable and Cacheable Content
Informational (Low)	Information Disclosure - Suspicious Comments
Informational (Low)	Re-examine Cache-control Directives

https://meshabilitations.esante.gouv.fr

Nmap

Mozilla HTTP observatory

SSL

Expiration : 31/03/2026

Scan OWASP6 jours

Nuclei13 jours

Séverité	Name	Matcher
info	CAA Record	caa-fingerprint
info	Allowed Options Method	options-method
info	XSS-Protection Header - Cross-Site Scripting	xss-deprecated-header
info	Apache Detection	apache-detect
info	FingerprintHub Technology Fingerprint	qm-system
info	HTTP Missing Security Headers	referrer-policy
info	HTTP Missing Security Headers	clear-site-data
info	HTTP Missing Security Headers	cross-origin-embedder-policy
info	HTTP Missing Security Headers	cross-origin-opener-policy
info	HTTP Missing Security Headers	cross-origin-resource-policy
info	HTTP Missing Security Headers	content-security-policy
info	HTTP Missing Security Headers	permissions-policy
info	WAF Detection	apachegeneric
info	Detect SSL Certificate Issuer	ssl-issuer
info	SSL DNS Names	ssl-dns-names
info	TLS Version - Detect	tls-version