- Nikto v2.1.6/2.1.

5
+ Target Host: www.pulsain.com
+ Target Port: 443
+ GET Cookie pulsain_session created without the secure flag
+ GET Server leaks inodes via ETags, header found with file /indosat/, fields:
0x57a95188 0x29a
+ GET The Content-Encoding header is set to "deflate" this may mean that the server
is vulnerable to the BREACH attack.
- Nikto v2.1.6/2.1.5
+ Target Host: id.priceprice.com
+ Target Port: 443
+ GET The X-XSS-Protection header is not defined. This header can hint to the user
agent to protect against some forms of XSS
+ GET The site uses SSL and the Strict-Transport-Security HTTP header is not
defined.
+ GET The X-Content-Type-Options header is not set. This could allow the user agent
to render the content of the site in a different fashion to the MIME type
+ GET Cookie kid_f_sid created without the secure flag
+ GET Cookie c_view_mode created without the secure flag
+ GET Cookie c_view_mode created without the httponly flag
- Nikto v2.1.6/2.1.5
- Nikto v2.1.6/2.1.5
+ Target Host: www.opulsa.com
+ Target Port: 443
+ GET Retrieved x-powered-by header: PHP/5.6.32
+ GET The anti-clickjacking X-Frame-Options header is not present.
+ GET The X-XSS-Protection header is not defined. This header can hint to the user
agent to protect against some forms of XSS
+ GET The site uses SSL and the Strict-Transport-Security HTTP header is not
defined.
+ GET The X-Content-Type-Options header is not set. This could allow the user agent
to render the content of the site in a different fashion to the MIME type
+ GET Cookie PHPSESSID created without the secure flag
+ GET Cookie PHPSESSID created without the httponly flag
+ GET The Content-Encoding header is set to "deflate" this may mean that the server
is vulnerable to the BREACH attack.
+ DZSZNJQY Web Server returns a valid response with junk HTTP methods, this may
cause false positives.
- Nikto v2.1.6/2.1.5
+ Target Host: www.opulsa.com
+ Target Port: 443
+ GET The anti-clickjacking X-Frame-Options header is not present.
+ GET The X-XSS-Protection header is not defined. This header can hint to the user
agent to protect against some forms of XSS
+ GET The site uses SSL and the Strict-Transport-Security HTTP header is not
defined.
+ GET The X-Content-Type-Options header is not set. This could allow the user agent
to render the content of the site in a different fashion to the MIME type
- Nikto v2.1.6/2.1.5