Scan report for "www.aliexpress.com"

  1. Nikto Online
  2. Scan report for "www.aliexpress.com"
Membership level: Free member
Summary

Found

-

Duration

1min 1sec

Date

2024-09-03

IP

-

Report
Nikto SSL scan (max 60 sec) (nikto -host www.aliexpress.com -ssl -maxtime 60)
- Nikto 
---------------------------------------------------------------------------
+ Target IP:          23.204.11.32
+ Target Hostname:    www.aliexpress.com
+ Target Port:        443
---------------------------------------------------------------------------
+ SSL Info:        Subject:  /C=CN/ST=\xE6\xB5\x99\xE6\xB1\x9F\xE7\x9C\x81/L=\xE6\x9D\xAD\xE5\xB7\x9E\xE5\xB8\x82/O=Alibaba Cloud Computing Ltd./CN=ae01.alicdn.com
                   Altnames: ae01.alicdn.com, a.aliexpress.com, acs.aliexpress.com, acs.aliexpress.us, activities.aliexpress.com, aeis.alicdn.com, aelive-ru.alicdn.com, aeliveqa-center.alicdn.com, aeproductsourcesite.alicdn.com, aeu.alicdn.com, ajax.aliexpress.com, api.dos.aliexpress.com, api.m.aliexpress.com, assets.alicdn.com, b.alicdn.com, best.aliexpress.com, brands.aliexpress.com, cdp.aliexpress.com, cn.m.aliexpress.com, connectkeyword.aliexpress.com, desc.aliexpress.com, detect-us-ak.aliexpress-media.com, es.aliexpress.com, feedback.aliexpress.com, fr.aliexpress.com, g.alicdn.com, group.aliexpress.com, gtreu.aliexpress.com, gtrhz.aliexpress.com, gtrru.aliexpress.com, gtrus.aliexpress.com, h5.aliexpress.com, h5.de.aliexpress.com, h5.es.aliexpress.com, h5.fr.aliexpress.com, h5.pl.aliexpress.com, h5.ru.aliexpress.com, h5.th.aliexpress.com, h5.tr.aliexpress.com, he.aliexpress.com, hotproducts.aliexpress.com, i.alicdn.com, ilce.aliexpress.com, img.alicdn.com, is.alicdn.com, ja.aliexpress.com, lazada.alicdn.com, lighthouse.aliexpress.com, login.aliexpress.com, login.aliexpress.us, m.aliexpress.com, m.aliexpress.us, m.ar.aliexpress.com, m.de.aliexpress.com, m.es.aliexpress.com, m.fr.aliexpress.com, m.he.aliexpress.com, m.id.aliexpress.com, m.it.aliexpress.com, m.ja.aliexpress.com, m.ko.aliexpress.com, m.nl.aliexpress.com, m.pl.aliexpress.com, m.pt.aliexpress.com, m.ru.aliexpress.com, m.th.aliexpress.com, m.tr.aliexpress.com, m.vi.aliexpress.com, macc.aliexpress.com, mbest.aliexpress.com, medusa.alicdn.com, message.aliexpress.com, msu.aliexpress.com, my.aliexpress.com, passport.aliexpress.com, pl.aliexpress.com, promotion.aliexpress.com, pt.aliexpress.com, ru.aliexpress.com, s.click.aliexpress.com, sale.aliexpress.com, selection.aliexpress.com, shoppingcart.aliexpress.com, shoppingcart1.aliexpress.com, ssr.aliexpress.com, style.alibaba.com, style.aliexpress.com, tr.aliexpress.com, u.alicdn.com, us-click.aliexpress.com, us.ae.aliexpress.com, us.cobra.aliexpress.com, www.aliexpress.com, www.aliexpress.us
                   Ciphers:  TLS_AES_256_GCM_SHA384
                   Issuer:   /C=US/O=DigiCert Inc/CN=DigiCert TLS RSA SHA256 2020 CA1
+ Start Time:         2024-09-03 21:24:30 (GMT-4)
---------------------------------------------------------------------------
+ Server: Tengine/Aserver
+ /: Cookie ali_apache_id created without the secure flag. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies
+ /: Cookie ali_apache_id created without the httponly flag. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies
+ /: IP address found in the 'ali_apache_id' cookie. The IP is "33.1.222.224".
+ /: Cookie xman_us_f created without the secure flag. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies
+ /: Cookie xman_us_f created without the httponly flag. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies
+ /: Cookie acs_usuc_t created without the secure flag. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies
+ /: Cookie acs_usuc_t created without the httponly flag. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies
+ /: Cookie intl_locale created without the secure flag. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies
+ /: Cookie intl_locale created without the httponly flag. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies
+ /: Cookie aep_usuc_f created without the secure flag. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies
+ /: Cookie aep_usuc_f created without the httponly flag. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies
+ /: Cookie xman_t created without the secure flag. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies
+ /: Cookie intl_common_forever created without the secure flag. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies
+ /: Cookie xman_f created without the secure flag. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies
+ /: Retrieved access-control-allow-origin header: https://hz.aliexpress.com.
+ /: Uncommon header 'eagleeye-traceid' found, with contents: 2101dee017254130705853560e9949.
+ /: Uncommon header 'server-timing' found, with multiple values: (cdn-cache; desc=MISS,edge; dur=65,origin; dur=11,ak_p; desc="1725413070565_398664869_639442909_7597_9104_6_3_-";dur=1,).
+ Root page / redirects to: https://www.aliexpress.us/?gatewayAdapt=glo2usa&_randl_shipto=US
+ /wZ1QQFag.dtd: IP address found in the 'x-akamai-fwd-auth-data' header. The IP is "23.195.36.165". See: https://portswigger.net/kb/issues/00600300_private-ip-addresses-disclosed
+ /wZ1QQFag.dtd: IP address found in the 'x-akamai-fwd-auth-data' header. The IP is "172.96.166.66". See: https://portswigger.net/kb/issues/00600300_private-ip-addresses-disclosed
+ /wZ1QQFag.dtd: Uncommon header 'x-akamai-fwd-auth-data' found, with contents: 1111010483, 23.195.36.165, 1725413070, 172.96.166.66.
+ /wZ1QQFag.dtd: Uncommon header 'x-akamai-fwd-auth-sign' found, with contents: q0B1tV7ZnBqDXFqyMsudROIDUgFC1rrbB55Usxn3eT2n4qlPpr4bBQXvZsLAx4zxmswMEmOZ1ybGNLRaThWd3zPaWmpj2hLHKBy/J1wFBGA=.
+ /wZ1QQFag.dtd: Uncommon header 'x-akamai-fwd-auth-sha' found, with contents: 3706E+ /dz8sxDbS.htaccess: Uncommon header 'x-akamai-transformed' + /wZ1QQFag.htm: Cookie JSESSIONID created without the secure flag. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies
+ /wZ1QQFag.htm: Retrieved x-application-context header: ae-buyer-homepage-f:prod:7001.
+ /wZ1QQFag.htm: Uncommon header 'x-application-context' found, with contents: ae-buyer-homepage-f:prod:7001.
+ /wZ1QQFag.htpasswd: Uncommon header 'x-akamai-transformed' found, with contents: 9 - 0 pmb=mRUM,2.
+ /wZ1QQFag.htpasswd: Uncommon header 'bxpunish' found, with contents: 1.
+ /wZ1QQFag.htpasswd: The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type. See: https://www.netsparker.com/web-vulnerability-scanner/vulnerabilities/missing-content-type-header/
+ /wZ1QQFag.js: Cookie e_id created without the secure flag. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies
+ /wZ1QQFag.js: Cookie e_id created without the httponly flag. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies
+ /wZ1QQFag.js: IP address found in the 'aliaka_real_ip' header. The IP is "172.96.166.66". See: https://portswigger.net/kb/issues/00600300_private-ip-addresses-disclosed
+ /wZ1QQFag.js: IP address found in the 'z_ak_client_ip' header. The IP is "104.117.244.77". See: ht+ /crossdomain.xml contains 10 lines which include the following domains+ /crossdomain.xml contains 10 lines which include the following domains: *.taobao.com *.taohua.com *.aliway.com *.alibaba-inc.com *.etao.com *.tmall.com *.alipay.com *.aliyun.com *.aliloan.com *.taobao.net . See: http://jeremiahgrossman.blogspot.com/2008/05/crossdomainxml-invites-cross-site.html
+ /robots.txt: Cookie XSRF-TOKEN created without the secure flag. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies
+ /robots.txt:X-Frame-Options header is deprecated and has been replaced with the Content-Security-Policy HTTP header with the frame-ancestors directive instead. See: ht+ /robots.txt: Entry '/api/data_homepage.do' is returned a non-forbidden+ /robots.txt: Entry '/api/data_homepage.do' is returned a non-forbidden or redirect HTTP code (200). See: https://portswigger.net/kb/issues/00600600_robots-txt-file
+ /store/*ajax.htm$: Cookie x5secdata created without the secure flag. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies
+ /store/*ajax.htm$: Cookie x5secdata created without the httponly flag. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies
+ /robots.txt: Entry '/store/*ajax.htm$' is returned a non-forbidden or redirect HTTP code (200). See: https://portswigger.net/kb/issues/00600600_robots-txt-file
+ /detail/*Ajax.do$: Cookie ; Domain created without the secure flag. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies
+ /detail/*Ajax.do$: Cookie ; Domain created without the httponly flag. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies
+ /detail/*Ajax.do$: Cookie _mle_tmp_harden0 created without the secure flag. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies
+ /detail/*Ajax.do$: Uncommon header 'resin-trace' found, with contents: ali_resin_trace=ae_cause_refer=other.
+ /robots.txt: Entry '/wholesale.html$' is returned a non-forbidden or redirect HTTP code (200). See: https://portswigger.net/kb/issues/00600600_robots-txt-file
+ /robots.txt: Entry '/store/all-wholesale-products/*/' is returned a non-forbidden or redirect HTTP code (200). See: https://portswigg+ /robots.txt: contains 73 entries which s+ /robots.txt: contains 73 entries which should be manually viewed. See: https://developer.m+ : Server banner changed from 'Tengine/Aserver' to 'AkamaiGHost'.
+ /cgi-bin/cart32.exe: request cart32.exe/cart32clientlist.
+ /cgi-bin/classified.cgi: Check Phrack 55 for info by RFP. See: http://phrack.org/issues/55/7.html#article
+ /cgi-bin/download.cgi: Check info in Phrack 55 by RFP. See: http://phrack.org/issues/55/7.html#article
+ /cgi-bin/flexform.cgi: Check Phrack 55 for info by RFP; allows to append info to writable files. See: http://phrack.org/issues/55/7.html#article
+ /cgi-bin/flexform: Check Phrack 55 for info by RFP; allows to append info to writable files. See: http://phrack.org/issues/55/7.html#article
+ /cgi-bin/lwgate.cgi: Check Phrack 55 for info by RFP. See: http://phrack.org/issues/55/7.html#article
+ /cgi-bin/LWGate.cgi: Check Phrack 55 for info by RFP. See: http://phrack.org/issues/55/7.html#article
+ /cgi-bin/lwgate: Check Phrack 55 for info by RFP. See: http://phrack.org/issues/55/7.html#article
+ /cgi-bin/LWGate: Check Phrack 55 for info by RFP. See: http://phrack.org/issues/55/7.html#article
+ /cgi-bin/perlshop.cgi: v3.1 by ARPAnet.com; check info in Phrack 55 by RFP. See: http://phrack.org/issues/55/7.html#article
+ /_vti_bin/shtml.exe: Attackers may be able to crash FrontPage by requesting a DOS device, like shtml.exe/aux.htm -- a DoS was not attempted. See: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0709
+ /cgi-bin/handler.cgi: Variation of Irix Handler? Has been seen from other CGI scanners.
+ /cgi-bin/finger: finger other users, may be other commands?.
+ /cgi-bin/finger.pl: finger other users, may be other commands?.
+ /cgi-bin/get32.exe: This can allow attackers to execute arbitrary commands remotely.
+ /cgi-bin/gm-authors.cgi: GreyMatter 'password' file, that controls who can post. This contains login and password information and is installed mode 666 by default. See: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-0324 http://www.attrition.org/~jericho/works/security/greymatter.html
+ /cgi-bin/guestbook/passwd: GuestBook r4 from lasource.r2.ru stores the admin password in a plain text file.
+ /cgi-bin/photo/protected/manage.cgi: My Photo Gallery management interface. May allow full access to photo galleries and more. Versions before 3.8 allowed anyone to view contents of any directory on systems.
+ /cgi-bin/wrap.cgi: Allows viewing of directories.
+ /cgi-bin/wrap: Allows viewing of directories.
+ /cgi-bin/visadmin.exe: This CGI allows an attacker to crash the web server. Remove it from the CGI directory.
+ /cgi-bin/html2chtml.cgi: Html2Wml < 0.4.8 access local files via CGI, and more.
+ /cgi-bin/html2wml.cgi: Html2Wml < 0.4.8 access local files via CGI, and more.
+ /cgi-bin/guestbook.cgi: May allow attackers to execute commands as the web daemon.
+ /cgi-bin/guestbook.pl: May allow attackers to execute commands as the web daemon.
+ /cgi-bin/ss: Mediahouse Statistics Server may allow attackers to execute remote commands. Upgrade to the latest version or remove from the CGI directory.
+ /cgi-bin/gH.cgi: Web backdoor by gH.
+ /cgi-bin/gm-cplog.cgi: GreyMatter log file defaults to mode 666 and contains login and passwords used to update the GM site. See: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-0324 http://www.attrition.org/~jericho/works/security/greymatter.html
+ /cgi-bin/gm.cgi: GreyMatter blogger may reveal user IDs/passwords through a gmrightclick-######.reg files (# are numbers), possibly in /archive or other archive location. See: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-0324 http://www.attrition.org/~jericho/works/security/greymatter.html
+ /cgi-bin/AT-admin.cgi: Admin interface.
+ /cgi-bin/auth_data/auth_user_file.txt: The DCShop installation allows credit card numbers to be viewed remotely. See: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-0821 https://packetstormsecurity.com/files/32406/xmas.txt.html
+ /cgi-bin/mt-static/mt-check.cgi: Movable Type weblog diagnostic script found. Reveals docroot path, operating system, Perl version, and modules.
+ /cgi-bin/mt/mt-check.cgi: Movable Type weblog diagnostic script found. Reveals docroot path, operating system, Perl version, and modules.
+ /cgi-bin/banner.cgi: This CGI may allow attackers to read any file on the system.
+ /cgi-bin/bannereditor.cgi: This CGI may allow attackers to read any file on the system.
+ /cgi-bin/architext_query.pl: Versions older than 1.1 of Excite for Web Servers allow attackers to execute arbitrary commands.
+ /cgi-bin/bizdb1-search.cgi: This CGI may allow attackers to execute commands remotely. See: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0287
+ /cgi-bin/blog/: A blog was found. May contain security problems in CGIs, weak passwords, and more.
+ /cgi-bin/blog/mt-load.cgi: Movable Type weblog installation CGI found. May be able to reconfigure or reload.
+ Scan terminated: 0 error(s) and 86 item(s) reported on remote host
+ End Time:           2024-09-03 21:25:31 (GMT-4) (61 seconds)
---------------------------------------------------------------------------
+ 1 host(s) tested
----------------------
+ 1 host(s) tested
Trustpilot
Online Nikto scanner - Online Nikto web server scanner | Product Hunt
Detailed report
Target
www.aliexpress.com
Scan method
Nikto SSL scan (max 60 sec)
Run command
nikto -host www.aliexpress.com -ssl -maxtime 60
Duration
Quick report
Scan date
03 Sep 2024 21:25
Copy scan report
Download report
Remove scan result
$
Total scans
Check ports
API - Scan ID