Website Vulnerability Scanner Report (Light)
Unlock the full capabilities of this scanner
See what the FULL scanner can do
Perform in-depth website scanning and discover high risk vulnerabilities.
Testing areas Light scan Full scan
Website fingerprinting
Version-based vulnerability detection
Common configuration issues
SQL injection
Cross-Site Scripting
Local/Remote File Inclusion
Remote command execution
Discovery of sensitive files
https://accounts.google.com/v3/signin/identifier?dsh=S-
184393639%3A1678977114966193&continue=https%3A%2F%2Ffanyv88.com%3A443%2Fhttps%2Faccounts.google.com%2F&followup=
https%3A%2F%2Ffanyv88.com%3A443%2Fhttps%2Faccounts.google.com%2F&ifkv=AWnogHd9ULJ7Z_TUvhgNUyJ-
WCFUJBGAG41COPti0wnnY_kzYFP8qQ5nHsYVQZ33BCP12W_e6ylgnw&passive=1209600&flowName
=GlifWebSignIn&flowEntry=ServiceLogin
Target added due to a redirect from https://accounts.google.com
Summary
Overall risk level: Risk ratings: Scan information:
Low High: 0 Start time: 2023-03-16 16:31:57 UTC+02
Medium: 0 Finish time: 2023-03-16 16:32:04 UTC+02
Low: 2 Scan duration: 7 sec
Info: 17 Tests performed: 19/19
Scan status: Finished
Findings
Robots.txt file found CONFIRMED
URL
https://accounts.google.com/robots.txt
Details
Risk description:
There is no particular security risk in having a robots.txt file. However, this file is often misused by website administrators to try to hide some
web pages from the users. This should not be considered a security measure because these URLs can be easily read directly from the
1/4
robots.txt file.
Recommendation:
We recommend you to manually review the entries from robots.txt and remove the ones which lead to sensitive locations in the website (ex.
administration panels, configuration files, etc).
References:
https://www.theregister.co.uk/2015/05/19/robotstxt/
Classification:
OWASP Top 10 - 2013 : A5 - Security Misconfiguration
OWASP Top 10 - 2017 : A6 - Security Misconfiguration
Server software and technology found UNCONFIRMED
Software / Version Category
HTTP/3 Miscellaneous
HSTS Security
Details
Risk description:
An attacker could use this information to mount specific attacks against the identified software type and version.
Recommendation:
We recommend you to eliminate the information which permits the identification of software platform, technology, server and operating
system: HTTP server headers, HTML meta information, etc.
References:
https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/01-Information_Gathering/02-
Fingerprint_Web_Server.html
Classification:
OWASP Top 10 - 2013 : A5 - Security Misconfiguration
OWASP Top 10 - 2017 : A6 - Security Misconfiguration
Security.txt file is missing CONFIRMED
URL
Missing: https://accounts.google.com/.well-known/security.txt
Details
Risk description:
We have detected that the server is missing the security.txt file. There is no particular risk in not creating a valid Security.txt file for your
server. However, this file is important because it offers a designated channel for reporting vulnerabilities and security issues.
Recommendation:
We recommend you to implement the security.txt file according to the standard, in order to allow researchers or users report any security
issues they find, improving the defensive mechanisms of your server.
References:
https://securitytxt.org/
Classification:
OWASP Top 10 - 2013 : A5 - Security Misconfiguration
OWASP Top 10 - 2017 : A6 - Security Misconfiguration
Website is accessible.
2/4
Nothing was found for vulnerabilities of server-side software.
Nothing was found for client access policies.
Nothing was found for use of untrusted certificates.
Nothing was found for enabled HTTP debug methods.
Nothing was found for secure communication.
Nothing was found for directory listing.
Nothing was found for missing HTTP header - Strict-Transport-Security.
Nothing was found for missing HTTP header - Content Security Policy.
Nothing was found for missing HTTP header - X-Frame-Options.
Nothing was found for missing HTTP header - X-XSS-Protection.
Nothing was found for missing HTTP header - X-Content-Type-Options.
Nothing was found for missing HTTP header - Referrer.
Nothing was found for domain too loose set for cookies.
Nothing was found for HttpOnly flag of cookie.
Nothing was found for Secure flag of cookie.
Scan coverage information
List of tests performed (19/19)
Checking for website accessibility...
Checking for website technologies...
Checking for vulnerabilities of server-side software...
Checking for client access policies...
Checking for robots.txt file...
Checking for absence of the security.txt file...
Checking for use of untrusted certificates...
3/4
Checking for enabled HTTP debug methods...
Checking for secure communication...
Checking for directory listing...
Checking for missing HTTP header - Strict-Transport-Security...
Checking for missing HTTP header - Content Security Policy...
Checking for missing HTTP header - X-Frame-Options...
Checking for missing HTTP header - X-XSS-Protection...
Checking for missing HTTP header - X-Content-Type-Options...
Checking for missing HTTP header - Referrer...
Checking for domain too loose set for cookies...
Checking for HttpOnly flag of cookie...
Checking for Secure flag of cookie...
Scan parameters
https://accounts.google.com/v3/signin/identifier?dsh=S-
184393639%3A1678977114966193&continue=https%3A%2F%2Ffanyv88.com%3A443%2Fhttps%2Faccounts.google.com%2F&followup=https%3A%2F%2
Website URL: Faccounts.google.com%2F&ifkv=AWnogHd9ULJ7Z_TUvhgNUyJ-
WCFUJBGAG41COPti0wnnY_kzYFP8qQ5nHsYVQZ33BCP12W_e6ylgnw&passive=1209600&flowName=GlifWebSignIn&
flowEntry=ServiceLogin
Scan type: Light
Authentication: False
Scan stats
Unique Injection Points Detected: 1
URLs spidered: 1
Total number of HTTP requests: 9
Average time until a response was
40ms
received:
4/4
