iwa.it

HTML metadata

Technology

Server

Apache

jQuery

1.11.2 known XSS (<3.5)

Stack

PHP

Fonts

• Google Fonts

Third-party hosts loaded (5)

• farm66.staticflickr.com×24
• apis.google.com×1
• fonts.googleapis.com×1
• i.creativecommons.org×1
• maxcdn.bootstrapcdn.com×1

Social

• youtube

Contact

Email

• amministrazione@iwa.it

DNS records live

NS

• ns13.ueppy.net
• ns14.ueppy.net

MX

Show 7 MX records

• 10 aspmx.l.google.com
• 20 alt1.aspmx.l.google.com
• 20 alt2.aspmx.l.google.com
• 30 aspmx2.googlemail.com
• 30 aspmx3.googlemail.com
• 30 aspmx4.googlemail.com
• 30 aspmx5.googlemail.com

Email authentication weak

SPF

v=spf1 ip4:185.81.0.18 +mx +a +include:authsmtp.com ~all

softfail (~all)

DMARC

not published

DKIM

• default: v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA5Ov4v8ncpGjARNZ2swGKlu+9nU6lSF8BKW2AqjYXaZp1w1dtQLSFkJHg+8NtkDd/meOy9qbQqN4RiM…

selectors probed

Certificate (current)

Full certificate history on crt.sh ↗

HTTP security headers

Header hygiene 30/100 Checked live page: https://www.iwa.it/

findings

• missing HSTS
• missing Content Security Policy
• missing frame protection
• missing content type protection
• missing Referrer Policy
• missing Permissions Policy

Links to (9)

• youtube.com×1
• webaccessibile.org×1
• ueppy.com×1
• staticflickr.com×1
• skillprofiles.eu×1
• paypal.me×1
• italia.it×1
• creativecommons.org×1
• competenzedigitali.org×1

Linked from (5)

• skillprofiles.eu×1
• webaccessibile.org×1
• mariacristinapizzato.it×1
• accessiweb.it×1
• marcomedia.it×1