Diagnostics

Metrics

https

A CAA record was discovered. A CAA record is used to specify which certificate authorities (CAs) are allowed to issue certificates for a domain.

CAA Record

This template searches for missing HTTP security headers. The impact of these missing headers can vary.


HTTP Missing Security Headers

WAF Detection

Extract the issuer's organization from the target's certificate. Issuers are entities which sign and distribute certificates.


Detect SSL Certificate Issuer

Extract the Subject Alternative Name (SAN) from the target's certificate. SAN facilitates the usage of additional hostnames with the same certificate.


SSL DNS Names

Checks a sites certificate to see if there are wildcard CN or SAN entries.


Wildcard TLS Certificate

TLS version detection is a security process used to determine the version of the Transport Layer Security (TLS) protocol used by a computer or server.
It is important to detect the TLS version in order to ensure secure communication between two computers or servers.


TLS Version - Detect

TYPO3 is a free and open-source Web content management system written in PHP.

TYPO3 CMS

Redoc is an open-source tool that generates API documentation from OpenAPI specifications.

ReDoc

TypeScript is an open-source language which builds on JavaScript  by adding static type definitions.

TypeScript

PHP is a general-purpose scripting language used for web development.

Angular is a TypeScript-based open-source web application framework led by the Angular Team at Google.

Angular

React is an open-source JavaScript library for building user interfaces or UI components.

React

Zone.js

MobX

Marked

lit-html is a simple, modern, safe, small and fast HTML templating library for JavaScript.

lit-html

lit-element is a simple base class for creating web components that work in any web page with any framework. lit-element uses lit-html to render into shadow DOM, and adds API to manage properties and attributes.

lit-element

core-js is a modular standard library for JavaScript, with polyfills for cutting-edge ECMAScript features.

core-js

reCAPTCHA is a free service from Google that helps protect websites from spam and abuse.

reCAPTCHA

HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.

HSTS

Webpack is an open-source JavaScript module bundler.

Webpack

Prism is an extensible syntax highlighter.

Prism

Module Federation is a webpack technology for dynamically loading parts of other independently deployed builds.

severity	service	vulnerability
info	https (port:443)

Impact	Description	Documentation
-20	Content Security Policy (CSP) implemented unsafely. This includes `'unsafe-inline'` or `data:` inside `script-src`, overly broad sources such as `https:` inside `object-src` or `script-src`, or not restricting the sources for `object-src` or `script-src`.	Remove `unsafe-inline` and `data:` from `script-src`, overly broad sources from `object-src` and `script-src`, and ensure `object-src` and `script-src` are set.

risk	name
Medium (High)	CSP: Failure to Define Directive with No Fallback
Medium (High)	CSP: Wildcard Directive
Medium (High)	CSP: script-src unsafe-inline
Medium (High)	CSP: style-src unsafe-inline
Low (Medium)	Insufficient Site Isolation Against Spectre Vulnerability
Low (Medium)	Permissions Policy Header Not Set
Low (Medium)	Private IP Disclosure
Low (Low)	Dangerous JS Functions
Low (Low)	Timestamp Disclosure - Unix
Informational (High)	Sec-Fetch-Dest Header is Missing
Informational (High)	Sec-Fetch-Mode Header is Missing
Informational (High)	Sec-Fetch-Site Header is Missing
Informational (High)	Sec-Fetch-User Header is Missing
Informational (Medium)	Base64 Disclosure
Informational (Medium)	Modern Web Application
Informational (Medium)	Storable and Cacheable Content
Informational (Low)	Information Disclosure - Suspicious Comments
Informational (Low)	Re-examine Cache-control Directives

https://portal.api.esante.gouv.fr

Nmap

Mozilla HTTP observatory

SSL

Expiration : 12/07/2025

Scan OWASP6 jours

Nuclei15 jours

Séverité	Name	Matcher
info	CAA Record	caa-fingerprint
info	HTTP Missing Security Headers	referrer-policy
info	HTTP Missing Security Headers	cross-origin-resource-policy
info	HTTP Missing Security Headers	permissions-policy
info	HTTP Missing Security Headers	x-frame-options
info	HTTP Missing Security Headers	x-content-type-options
info	HTTP Missing Security Headers	cross-origin-embedder-policy
info	HTTP Missing Security Headers	cross-origin-opener-policy
info	HTTP Missing Security Headers	content-security-policy
info	HTTP Missing Security Headers	x-permitted-cross-domain-policies
info	HTTP Missing Security Headers	clear-site-data
info	WAF Detection	apachegeneric
info	Detect SSL Certificate Issuer	ssl-issuer
info	SSL DNS Names	ssl-dns-names
info	Wildcard TLS Certificate	wildcard-tls
info	TLS Version - Detect	tls-version