barthreal.ch

HTML metadata

Technology

Server

nginx

jQuery

1.11.3 known XSS (<3.5)

Stack

PHP

Fonts

• Google Fonts

Third-party hosts loaded (4)

• fonts.googleapis.com×2
• ajax.googleapis.com×1
• flatfox.ch×1
• maxcdn.bootstrapcdn.com×1

DNS records live

NS

• ns2.interway.ch
• ns3.interway.ch
• slash.iway.ch

MX

• 20 elba.iway.ch
• 20 malta.iway.ch

Email authentication weak

SPF

v=spf1 a include:spf.iway.ch -all

strict (-all)

DMARC

not published

DKIM

• default: v=DKIM1; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvF0cJkNd49bWTHd4EU272t07wCD9qUQevvJCv6u9ByB9BWOxSaWQM9PrZWtM5q8B6tocHoqPxTrnaMWfADlpQ…

selectors probed

Certificate (current)

Full certificate history on crt.sh ↗

HTTP security headers

Header hygiene 30/100 Checked live page: https://barthreal.ch/

findings

• missing HSTS
• missing Content Security Policy
• missing frame protection
• missing content type protection
• missing Referrer Policy
• missing Permissions Policy

Links to (1)

• flatfox.ch×1

Linked from (1)

• 100pro.ch×1