See this scan: -http://ayt-wgt.hostingsiteforfree.com
Detected libraries:
jquery - 1.11.2 : (active1) -http://ajax.googleapis.com/ajax/libs/jquery/1.11.2/jquery.min.js
Info: Severity: medium
https://github.com/jquery/jquery/issues/2432
http://blog.jquery.com/2016/01/08/jquery-2-2-and-1-12-released/
(active) - the library was also found to be active by running code
Loading the site failed
Scanner output:
Scanning -http://ayt-wgt.hostingsiteforfree.com …
Status: fail
Script loaded: -http://ajax.googleapis.com/ajax/libs/jquery/1.11.2/jquery.min.js
Script loaded: -http://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
Script loaded: -http://cdnjs.cloudflare.com/ajax/libs/cookieconsent2/1.0.9/cookieconsent.min.js
Script loaded: -https://connect.facebook.net/en_US/all.js *
Script loaded: -https://apis.google.com/js/plusone.js
Script loaded: -http://www.hostinger.nl/static/js/jquery.main.js **
Script loaded: -https://apis.google.com//scs/apps-static//js/k=oz.gapi.nl.dlBwsGFiVAQ.O/m=plusone/rt=j/sv=1/d=1/ed=1/am=AQ/rs=AGLTcCN2iQPLjc-RI1irUd5taK7wIF9B1g/cb=gapi.loaded_0
Detected library: jquery - 1.11.2
Load time: 1995ms
Cerificate Crypto report:
-connect.facebook.net
This is not a Symantec certificate.
Please contact the Certificate Authority for further verification.
Warnings
BEAST
The BEAST attack is not mitigated on this server.
RC4
This server uses the RC4 cipher algorithm which is not secure. Disable the RC4 cipher suite and update the server software to support the Advanced Encryption Standard (AES) cipher algorithm. Contact your web server vendor for assistance.
Chain installation:
2 certificates found: RSA and ECC.
To view each certificate chain, click a tab below.
RSA
ECC
Certificate information
This server uses an Organizationally Validated (OV) certificate. Information about the site owner has been validated by DigiCert Inc to help secure personal and financial information.
Common name:
*.facebook.com
SAN:
*.facebook.com, facebook.com, *.facebook.net, *.fb.com, *.fbcdn.net, *.fbsbx.com, *.m.facebook.com, *.messenger.com, *.xx.fbcdn.net, *.xy.fbcdn.net, *.xz.fbcdn.net, fb.com, messenger.com
Valid from:
2016-Mar-01 00:00:00 GMT
Valid to:
2017-Jun-01 12:00:00 GMT
Certificate status:
Valid
Revocation check method:
OCSP
Organization:
Facebook, Inc.
Organizational unit:
City/locality:
Menlo Park
State/province:
CA
Country:
US
Certificate Transparency:
Enabled
Serial number:
0ae89d732fc11cc2833aecdf94cee5d7
Algorithm type:
SHA256withRSA
Key size:
2048
RSA certificate chainShow details
DigiCert SHA2 High Assurance Server CAIntermediate certificate
*.facebook.comTested certificate
Server configuration
Host name:
xx-fbcdn-shv-01-dfw1.fbcdn.net
Server type:
Not available
IP address:
31.13.66.5
Port number:
443
SSL/TLS compression:
Not Enabled
Heartbeat (extension):
Not Enabled
RC4:
Enabled
OCSP stapling:
Not Enabled
Protocols enabled:
TLS1.2
TLS1.1
TLS1.0
Protocols not enabled:
SSLv3
SSLv2
Vulnerabilities checked:
Heartbleed
Poodle (TLS)
Poodle (SSLv3)
FREAK
BEAST
CRIME
Cipher suites enabled:
TLS_RSA_WITH_RC4_128_MD5 (0x0004)
TLS_RSA_WITH_RC4_128_SHA (0x0005)
TLS_RSA_WITH_3DES_EDE_CBC_SHA (0x000A)
TLS_RSA_WITH_AES_128_CBC_SHA (0x002F)
TLS_RSA_WITH_AES_256_CBC_SHA (0x0035)
TLS_RSA_WITH_AES_128_GCM_SHA256 (0x009C)
TLS_RSA_WITH_AES_256_GCM_SHA384 (0x009D)
TLS_ECDHE_ECDSA_WITH_RC4_128_SHA (0xC007)
TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA (0xC008)
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA (0xC009)
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA (0xC00A)
TLS_ECDHE_RSA_WITH_RC4_128_SHA (0xC011)
TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA (0xC012)
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (0xC013)
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (0xC014)
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 (0xC02B)
TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 (0xC02C)
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (0xC02F)
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (0xC030)
** -http://www.hostinger.nl/
Detected libraries:
jquery - 1.11.2 : (active1) http://ajax.googleapis.com/ajax/libs/jquery/1.11.2/jquery.min.js
Info: Severity: medium
https://github.com/jquery/jquery/issues/2432
http://blog.jquery.com/2016/01/08/jquery-2-2-and-1-12-released/
(active) - the library was also found to be active by running code
1 vulnerable library detected
Insecure IDs tracking: 66% of the trackers on this site could be protecting you from NSA snooping. Tell davidhanzel.com to fix it.
All trackers
At least 6 third parties know you are on this webpage.
-Google
-Google
-Google
-shaaaaaaaaaaaaa.com
-ayt-wgt.hostingsiteforfree.com
-davidhanzel.com -davidhanzel.com
Consider: http://toolbar.netcraft.com/site_report?url=http://davidhanzel.com
hostgator abuse and also vulnerable to DROWn: https://test.drownattack.com/?site=ns8143.hostgator.com
Re crypto report: ns8143.hostgator.com further insecurity…
This is not a Symantec certificate.
Please contact the Certificate Authority for further verification.
Warnings
BEAST
The BEAST attack is not mitigated on this server.
Certificate information
This server uses a Domain Validated (DV) certificate. No information about the site owner has been validated. Data is protected, but exchanging personal or financial information is not recommended.
Common name:
*.hostgator.com
SAN:
*.hostgator.com, hostgator.com
Valid from:
2015-Oct-16 00:00:00 GMT
Valid to:
2018-Oct-15 23:59:59 GMT
Certificate status:
Valid
Revocation check method:
OCSP
Organization:
Organizational unit:
PositiveSSL Wildcard,Hosted by HostGator.com, LLC.,Domain Control Validated
City/locality:
State/province:
Country:
Certificate Transparency:
Not Enabled
Serial number:
19607da086e8a7fe72900982cfed93bf
Algorithm type:
SHA256withRSA
Key size:
2048
Certificate chainShow details
COMODO RSA Certification AuthorityIntermediate certificate
COMODO RSA Domain Validation Secure Server CAIntermediate certificate
*.hostgator.comTested certificate
Server configuration
Host name:
ns8143.hostgator.com
Server type:
nginx/1.8.1
IP address:
192.185.21.110
Port number:
443
SSL/TLS compression:
Not Enabled
Heartbeat (extension):
Enabled
RC4:
Not Enabled
OCSP stapling:
Not Enabled
Protocols enabled:
TLS1.2
TLS1.1
TLS1.0
Protocols not enabled:
SSLv3
SSLv2
polonus (volunteer website security analyst and website error-hunter)