default-src 'self' sante.fr *.sante.fr *.gouv.fr *.dmcdn.net *.synapse-medicine.com *.twitter.com *.twimg.com *.data.gouv *.rogervoice.com *.googleapis.com *.mapbox.com *.cloudflareinsights.com *.cloudflare.com googletagmanager.com *.googletagmanager.com api-adresse.data.gouv.fr *.google.com vitemadose.gitlab.io *.dailymotion.com *.youtube.com *.soundcloud.com *.c-napps.com gstatic.com *.gstatic.com *.adform.net *.facebook.net *.facebook.com *.snapchat.com *.criteo.com unpkg.com *.fontawesome.com *.newrelic.com *.linkedin.com *.licdn.com *.atlasante.fr bam.eu01.nr-data.net data.geopf.fr; script-src 'self' sante.fr *.sante.fr *.gouv.fr *.dmcdn.net *.synapse-medicine.com *.twitter.com *.twimg.com *.data.gouv *.rogervoice.com *.googleapis.com *.mapbox.com *.cloudflareinsights.com *.cloudflare.com googletagmanager.com *.googletagmanager.com api-adresse.data.gouv.fr *.google.com vitemadose.gitlab.io *.dailymotion.com *.youtube.com *.soundcloud.com *.c-napps.com gstatic.com *.gstatic.com *.adform.net *.facebook.net *.snapchat.com sc-static.net secure.adnxs.com ads-engagement.presage.io *.criteo.com unpkg.com *.fontawesome.com *.newrelic.com *.linkedin.com *.licdn.com *.atlasante.fr *.ckeditor.com bam.eu01.nr-data.net 'unsafe-inline' 'unsafe-eval'; style-src 'self' sante.fr *.sante.fr *.gouv.fr *.dmcdn.net *.synapse-medicine.com *.twitter.com *.twimg.com *.data.gouv *.rogervoice.com *.googleapis.com *.mapbox.com *.cloudflareinsights.com *.cloudflare.com googletagmanager.com *.googletagmanager.com api-adresse.data.gouv.fr *.google.com vitemadose.gitlab.io *.dailymotion.com *.youtube.com *.soundcloud.com *.c-napps.com gstatic.com *.gstatic.com *.adform.net *.facebook.net unpkg.com *.fontawesome.com *.newrelic.com *.linkedin.com *.licdn.com *.atlasante.fr bam.eu01.nr-data.net 'unsafe-inline'; img-src * data:; media-src *; frame-src *; frame-ancestors *; child-src *; font-src * data:; report-uri /report-csp-violation

Diagnostics

Metrics

smtp

time

whois

domain

http

hosts2-ns

xfer

mit-ml-dev

kerberos-sec

su-mit-tg

dnsix

metagram

newacct

pop3

nntp

msrpc

netbios-ssn

imap

914c-g

anet

ldap

https

snpp

smtps

isakmp

klogin

rtsp

submission

ldapssl

multiling-http

spamassassin

mdbs_daemon

device

ccproxy-http

unknown

accessbuilder

omginitialrefs

ftps

imaps

pop3s

garcon

cadlock

webpush

windows-icfw

surf

exp2

netvenuechat

NFS-or-IIS

ms-lsa

iad2

iad3

netinfo

zincite-a

mtqp

java-or-OTGfileshare

optima-vnet

brvread

kiosk

veracity

kyoceranetdev

syscomlan

fpo-fns

instl_boots

instl_bootc

cognex-insight

cardax

warmspotMgmt

socks

pvuniwien

amt-esd-prot

ansoft-lm-1

cplscrambler-al

ratio-adp

lmsocialserver

rmpp

fnet-remote-ui

dossier

llsurfup-http

catchpole

mysql-cluster

alias

caids-sensor

cajo-discovery

dmidi

nucleus-sand

hotline

lotusnotes

ms-sql-s

ms-sql-m

A CAA record was discovered. A CAA record is used to specify which certificate authorities (CAs) are allowed to issue certificates for a domain.

CAA Record

DNS SaaS Service Detection

Setting the XSS-Protection header is deprecated. Setting the header to anything other than `0` can actually introduce an XSS vulnerability.

XSS-Protection Header - Cross-Site Scripting

This template searches for missing HTTP security headers. The impact of these missing headers can vary.


HTTP Missing Security Headers

Extract the issuer's organization from the target's certificate. Issuers are entities which sign and distribute certificates.


Detect SSL Certificate Issuer

Extract the Subject Alternative Name (SAN) from the target's certificate. SAN facilitates the usage of additional hostnames with the same certificate.


SSL DNS Names

TLS version detection is a security process used to determine the version of the Transport Layer Security (TLS) protocol used by a computer or server.
It is important to detect the TLS version in order to ensure secure communication between two computers or servers.


TLS Version - Detect

___utmvc

visid_incap_3307491

incap_ses_1700_3307491

Drupal is a free and open-source web content management framework.

Drupal

PHP is a general-purpose scripting language used for web development.

Leaflet is the open-source JavaScript library for mobile-friendly interactive maps.

Leaflet

Vue.js is an open-source model–view–viewmodel JavaScript framework for building user interfaces and single-page applications.

Vue.js

Livefyre is a platform that integrates with the social web to boost social interaction.

Livefyre

jQuery UI is a collection of GUI widgets, animated visual effects, and themes implemented with jQuery, Cascading Style Sheets, and HTML.

jQuery UI

jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.

jQuery

core-js is a modular standard library for JavaScript, with polyfills for cutting-edge ECMAScript features.

core-js

Preact is a JavaScript library that describes itself as a fast 3kB alternative to React with the same ES6 API.

Preact

Imperva is a cyber security software and services company for networking, data, and application security.

Imperva

HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.

HSTS

Webpack is an open-source JavaScript module bundler.

Webpack

Open Graph is a protocol that is used to integrate any web page into the social graph.

Open Graph

ZAP warnings logged - see the zap.log file for details

Percentage of responses with status code 2xx

Percentage of responses with status code 3xx

Percentage of responses with status code 4xx

Percentage of endpoints with content type application/javascript

Percentage of endpoints with content type image/png

Percentage of endpoints with content type image/x-icon

Percentage of endpoints with content type text/css

Percentage of endpoints with content type text/html

Percentage of endpoints with content type text/plain

Absence of Anti-CSRF Tokens

CSP: Failure to Define Directive with No Fallback

CSP: Wildcard Directive

CSP: script-src unsafe-eval

CSP: script-src unsafe-inline

CSP: style-src unsafe-inline

Content Security Policy (CSP) Header Not Set

Missing Anti-clickjacking Header

Sub Resource Integrity Attribute Missing

Big Redirect Detected (Potential Sensitive Information Leak)

CSP: Notices

Cookie No HttpOnly Flag

Cookie Without Secure Flag

Cookie without SameSite Attribute

Cross-Origin-Embedder-Policy Header Missing or Invalid

Cross-Origin-Opener-Policy Header Missing or Invalid

Cross-Origin-Resource-Policy Header Missing or Invalid

Permissions Policy Header Not Set

Server Leaks Information via "X-Powered-By" HTTP Response Header Field(s)

Strict-Transport-Security Header Not Set

Timestamp Disclosure - Unix

X-Content-Type-Options Header Missing

Base64 Disclosure

Information Disclosure - Suspicious Comments

Loosely Scoped Cookie

Modern Web Application

Re-examine Cache-control Directives

Retrieved from Cache

Sec-Fetch-Dest Header is Missing

Sec-Fetch-Mode Header is Missing

Sec-Fetch-Site Header is Missing

Sec-Fetch-User Header is Missing

Session Management Response Identified

Storable and Cacheable Content

User Controllable HTML Element Attribute (Potential XSS)

type	url	details
FontAwesome	use.fontawesome.com/relea...	Host fonts directly

flag	country	hostname	ip	city
	États-Unis	sas.sante.fr	45.60.122.134	?
	?	use.fontawesome.com	172.67.142.245	?

https://sas.sante.fr

LightHouse

https://sas.sante.fr/environ 1 heure

Système de design de l'état

Eco-index

GES: 1.54 gramme(s) par visite

Eau : 2.31 cl par visite

Ça veut dire quoi ?

Cookiesenviron 4 heures

Scripts tiersenviron 4 heures

Déclaration de mise en accessibilité

Erreurs 404

name	domain	httpOnly	secure
___utmvc	sas.sante.fr	❌	❌
visid_incap_3307491	.sante.fr	✔️	❌
incap_ses_1700_3307491	.sante.fr	❌	❌