Diagnostics

Metrics

http

https

unknown

ms-lsa

SPF Record - Detection

A DNS TXT record was detected. The TXT record lets a domain admin leave notes on a DNS server.

DNS TXT Record Detected

A CAA record was discovered. A CAA record is used to specify which certificate authorities (CAs) are allowed to issue certificates for a domain.

CAA Record

DNS DMARC - Detect

An NS record was detected. An NS record delegates a subdomain to a set of name servers.

NS Record Detection

An MX record was detected. MX records direct emails to a mail exchange server.

MX Record Detection

Microsoft Azure Domain Tenant ID was detected.

Microsoft Azure Domain Tenant ID - Detect

RDAP (Registration Data Access Protocol) is a standard defined by the IETF to replace the whois protocol
in queries for information about Internet resource records such as domain names, IP addresses, and ASNs.


RDAP WHOIS

Checks if external script and stylesheet tags in the HTML response are missing the Subresource Integrity (SRI) attribute.


Missing Subresource Integrity

Extract the issuer's organization from the target's certificate. Issuers are entities which sign and distribute certificates.


Detect SSL Certificate Issuer

Extract the Subject Alternative Name (SAN) from the target's certificate. SAN facilitates the usage of additional hostnames with the same certificate.


SSL DNS Names

TLS version detection is a security process used to determine the version of the Transport Layer Security (TLS) protocol used by a computer or server.
It is important to detect the TLS version in order to ensure secure communication between two computers or servers.


TLS Version - Detect

bln_challengejs

default-src 'self' sante.fr *.sante.fr *.gouv.fr *.dmcdn.net *.synapse-medicine.com *.twitter.com *.twimg.com *.data.gouv *.rogervoice.com *.googleapis.com *.mapbox.com *.cloudflareinsights.com *.cloudflare.com googletagmanager.com *.googletagmanager.com api-adresse.data.gouv.fr *.google.com vitemadose.gitlab.io *.dailymotion.com *.youtube.com *.soundcloud.com *.c-napps.com gstatic.com *.gstatic.com *.adform.net *.facebook.net *.facebook.com *.snapchat.com *.criteo.com unpkg.com *.fontawesome.com *.newrelic.com *.linkedin.com *.licdn.com *.atlasante.fr bam.eu01.nr-data.net; script-src 'self' sante.fr *.sante.fr *.gouv.fr *.dmcdn.net *.synapse-medicine.com *.twitter.com *.twimg.com *.data.gouv *.rogervoice.com *.googleapis.com *.mapbox.com *.cloudflareinsights.com *.cloudflare.com googletagmanager.com *.googletagmanager.com api-adresse.data.gouv.fr *.google.com vitemadose.gitlab.io *.dailymotion.com *.youtube.com *.soundcloud.com *.c-napps.com gstatic.com *.gstatic.com *.adform.net *.facebook.net *.snapchat.com sc-static.net secure.adnxs.com ads-engagement.presage.io *.criteo.com unpkg.com *.fontawesome.com *.newrelic.com *.linkedin.com *.licdn.com *.atlasante.fr *.ckeditor.com bam.eu01.nr-data.net 'unsafe-inline' 'unsafe-eval'; style-src 'self' sante.fr *.sante.fr *.gouv.fr *.dmcdn.net *.synapse-medicine.com *.twitter.com *.twimg.com *.data.gouv *.rogervoice.com *.googleapis.com *.mapbox.com *.cloudflareinsights.com *.cloudflare.com googletagmanager.com *.googletagmanager.com api-adresse.data.gouv.fr *.google.com vitemadose.gitlab.io *.dailymotion.com *.youtube.com *.soundcloud.com *.c-napps.com gstatic.com *.gstatic.com *.adform.net *.facebook.net unpkg.com *.fontawesome.com *.newrelic.com *.linkedin.com *.licdn.com *.atlasante.fr bam.eu01.nr-data.net 'unsafe-inline'; img-src * data:; media-src *; frame-src *; frame-ancestors *; child-src *; font-src * data:; report-uri /report-csp-violation

HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.

severity	service	vulnerability
info	http (port:80)
info	https (port:443)
info	IIS (port:1027)
info	unknown (port:1028)
info	ms-lsa (port:1029)

Impact	Description	Documentation
-25	Content Security Policy (CSP) header not implemented	Implement one, see MDN's Content Security Policy (CSP) documentation.
-20	`X-Frame-Options` (XFO) header not implemented.	Documentation for x-frame-options-sameorigin-or-deny

risk	name
Medium (High)	Content Security Policy (CSP) Header Not Set
Medium (High)	Sub Resource Integrity Attribute Missing
Medium (Medium)	Missing Anti-clickjacking Header
Low (High)	Strict-Transport-Security Header Not Set
Low (Medium)	Insufficient Site Isolation Against Spectre Vulnerability
Low (Medium)	Permissions Policy Header Not Set
Low (Medium)	X-Content-Type-Options Header Missing
Informational (High)	Sec-Fetch-Dest Header is Missing
Informational (High)	Sec-Fetch-Mode Header is Missing
Informational (High)	Sec-Fetch-Site Header is Missing
Informational (High)	Sec-Fetch-User Header is Missing
Informational (Medium)	Base64 Disclosure
Informational (Medium)	Modern Web Application
Informational (Medium)	Storable and Cacheable Content
Informational (Medium)	Storable but Non-Cacheable Content
Informational (Low)	Re-examine Cache-control Directives

https://sante.fr

Nmap

Mozilla HTTP observatory

SSL

Grade capped to A. HSTS is not offered

Expiration : 02/06/2025

Scan OWASP6 jours

Nuclei13 jours

Séverité	Name	Matcher
info	SPF Record - Detection	spf-record-detect
info	DNS TXT Record Detected	txt-fingerprint
info	CAA Record	caa-fingerprint
info	DNS DMARC - Detect	dmarc-detect
info	NS Record Detection	nameserver-fingerprint
info	MX Record Detection	mx-fingerprint
info	Microsoft Azure Domain Tenant ID - Detect	azure-domain-tenant
info	RDAP WHOIS	rdap-whois
info	RDAP WHOIS	rdap-whois
info	RDAP WHOIS	rdap-whois
info	RDAP WHOIS	rdap-whois
info	RDAP WHOIS	rdap-whois
info	RDAP WHOIS	rdap-whois
info	RDAP WHOIS	rdap-whois
info	RDAP WHOIS	rdap-whois
info	RDAP WHOIS	rdap-whois
info	RDAP WHOIS	rdap-whois
info	RDAP WHOIS	rdap-whois
info	RDAP WHOIS	rdap-whois
info	Missing Subresource Integrity	missing-sri
info	Detect SSL Certificate Issuer	ssl-issuer
info	SSL DNS Names	ssl-dns-names
info	TLS Version - Detect	tls-version
info	TLS Version - Detect	tls-version