multiutilitycard.it

HTML metadata

Technology

Server

nginx

jQuery

3.2.1 known XSS (<3.5)

Stack

Java

Contact

Phone

• 03100530215

DNS records live

NS

• ns1-08.azure-dns.com
• ns2-08.azure-dns.net
• ns3-08.azure-dns.org
• ns4-08.azure-dns.info

MX

• 10 relaya.sidera.cloud
• 10 relayc.sidera.it

Verified for

• Microsoft 365

Email authentication partial

SPF

v=spf1 include:spf.emailsignatures365.com include:spf.protection.outlook.com ~all

softfail (~all)

DMARC

v=DMARC1;p=none;rua=mailto:bc268665c7@rua.dmarcprotect.me,mailto:bc268665c7@rua.dmarcprotect.me,mailto:bc268665c7@rua.dmarcprotect.me,mailto:bc268665c7@rua.dmarcprotect.me;ruf=mailto:bc268665c7@ruf.dmarcprotect.me,mailto:bc268665c7@ruf.dmarcprotect.me,mailto:bc268665c7@ruf.dmarcprotect.me,mailto:bc268665c7@ruf.dmarcprotect.me;fo=1;

policy: none (monitoring only)

DKIM

• s1: k=rsa; t=s; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAl9C5RSG29VAShbGu6uTJsiLTqZN2039tYhIk42Oyz9188uNJ7yD9kwHcNRh8mshGjcvFBmOwK1kOTbMF2H…
• s2: k=rsa; t=s; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAn/muq5PCT0Dc0X8RM3NzIrCdRfdpiaGo0vOqOc/94cp+owhYstd6UWeefyLpoq5kCAoMAWxOPaGx9cHMZc…

selectors probed

Certificate (current) wrong cert

Full certificate history on crt.sh ↗

HTTP security headers

Header hygiene 50/100 Checked live page: https://management.multiutilitycard.it/SrCrm/index.jsp

present

• x-frame-options
• x-content-type-options

findings

• missing HSTS
• missing Content Security Policy
• missing Referrer Policy
• missing Permissions Policy

Linked from (1)

• sidera.it×1