content-security-policy

Content Security Policy (CSP) implemented unsafely. This includes 'unsafe-inline' or data: inside script-src, overly broad sources such as https: inside object-src or script-src, or not restricting the sources for object-src or script-src.

cookies

Cookies set without using the Secure flag, but transmission over HTTP prevented by HSTS

cross-origin-resource-sharing

Content is not visible via cross-origin resource sharing (CORS) files or headers

redirection

Initial redirection is to HTTPS on same host, final destination is HTTPS

referrer-policy

Referrer-Policy header set to "no-referrer", "same-origin", "strict-origin" or "strict-origin-when-cross-origin"

strict-transport-security

HTTP Strict Transport Security (HSTS) header set to a minimum of six months (15768000)

subresource-integrity

Subresource Integrity (SRI) not implemented, but all scripts are loaded from a similar origin

x-content-type-options

X-Content-Type-Options header set to "nosniff"

x-frame-options

X-Frame-Options (XFO) implemented via the CSP frame-ancestors directive

x-xss-protection

Deprecated X-XSS-Protection header set to "1; mode=block"

frame-src 'self'; frame-ancestors 'self'; object-src 'none';

Diagnostics

Metrics

A CAA record was discovered. A CAA record is used to specify which certificate authorities (CAs) are allowed to issue certificates for a domain.

CAA Record

Keycloak 10.0.0 to 18.0.0 contains a cross-site scripting vulnerability via the client-registrations endpoint. On a POST request, the application does not sanitize an unknown attribute name before including it in the error response with a 'Content-Type' of text/hml. Once reflected, the response is interpreted as HTML. This can be performed on any realm present on the Keycloak instance. Since the bug requires Content-Type application/json and is submitted via a POST, there is no common path to exploit that has a user impact.


Keycloak 10.0.0 - 18.0.0 - Cross-Site Scripting

Checks whether cookies in the HTTP response contain the HttpOnly attribute. If the HttpOnly flag is set, it means that the cookie is HTTP-only


Cookies without HttpOnly attribute - Detect

Checks whether cookies in the HTTP response contain the Secure attribute. If the Secure flag is set, it means that the cookie can only be transmitted over HTTPS


Cookies without Secure attribute - Detect

A template to detect HTML Forms in page response.


Form Detection

This template searches for missing HTTP security headers. The impact of these missing headers can vary.


HTTP Missing Security Headers

Keycloak Openid configuration information was detected.

Keycloak OpenID Configuration - Detect

robots.txt endpoint prober

WAF Detection

Extract the issuer's organization from the target's certificate. Issuers are entities which sign and distribute certificates.


Detect SSL Certificate Issuer

Extract the Subject Alternative Name (SAN) from the target's certificate. SAN facilitates the usage of additional hostnames with the same certificate.


SSL DNS Names

TLS version detection is a security process used to determine the version of the Transport Layer Security (TLS) protocol used by a computer or server.
It is important to detect the TLS version in order to ensure secure communication between two computers or servers.


TLS Version - Detect

mod_auth_openidc_state_Od_x-zoyLNjz9cT_qoMiZzrA4Bk

YOMe1h3tgHKNQxhV6V7n5g__

KC_RESTART

AUTH_SESSION_ID_LEGACY

AUTH_SESSION_ID

site detenteurs d arme

TYPO3 is a free and open-source Web content management system written in PHP.

TYPO3 CMS

PHP is a general-purpose scripting language used for web development.

HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.

name	domain	httpOnly	secure
mod_auth_openidc_state_Od_x-zoyLNjz9cT_qoMiZzrA4Bk	sia.detenteurs.interieur.gouv.fr	✔️	✔️
YOMe1h3tgHKNQxhV6V7n5g__	sia.detenteurs.interieur.gouv.fr	❌	❌
KC_RESTART	sia.detenteurs.interieur.gouv.fr	✔️	✔️
AUTH_SESSION_ID_LEGACY	sia.detenteurs.interieur.gouv.fr	✔️	✔️
AUTH_SESSION_ID	sia.detenteurs.interieur.gouv.fr	✔️	✔️

flag	country	hostname	ip	city
	France	sia.detenteurs.interieur.gouv.fr	143.196.253.156	?

https://sia.detenteurs.interieur.gouv.fr

LightHouse

https://sia.detenteurs.interieur.gouv.fr/41 minutes

Système de design de l'état

Eco-index

GES: 1.3 gramme(s) par visite

Eau : 1.95 cl par visite

Ça veut dire quoi ?

Cookiesenviron 1 heure

Scripts tiersenviron 1 heure

Déclaration de mise en accessibilité

Conformité partielle