Deep SSL Test Report: flexwan.movistar.com.ar

 Start 2026-08-12 13:16:10        -->> 200.49.201.128:443 (flexwan.movistar.com.ar) <<--

 rDNS (200.49.201.128):  flexwan.movistar.com.ar.
 Service detected:       HTTP

 Testing for server implementation bugs 

 No bugs found.

 Testing HTTP header response @ "/" 

 HTTP Status Code             302 Found, redirecting to "fpc/app"
 HTTP clock skew              -1 sec from localtime
 Strict Transport Security    365 days=31536000 s, includeSubDomains
 Public Key Pinning           --
 Server banner                (no "Server" line in header, interesting!)
 Application banner           --
 Cookie(s)                    1 issued: 1/1 secure, 1/1 HttpOnly -- maybe better try target URL of 30x
 Security headers             X-Frame-Options: DENY
                              X-Content-Type-Options: nosniff
                              Content-Security-Policy: object-src 'none';
                                script-src 'self'; frame-src 'self'
                                https://mapserver.fortinet.com/;
                                frame-ancestors 'none'; default-src 'self';
                                style-src 'self' 'unsafe-inline'; img-src
                                'self' data:; script-src-elem 'self'
                                https://ajax.googleapis.com
                                'sha256-SkQm/skonp1yadBr7vmybnOrc+nWWyCxGvvnGkLT3UY=' 
                                sha256-7hC8SSsdl5mN4BVpUMAmfL+oACfzF6vqD1YOKEFIZeY=' 
                                sha256-N4+xr495P2evky8p3j9g0KMzFdaXcGpRK7OPKc8X2rI=' 
                                sha256-VmRWwIkfy8wvBFnJpCPlXQgIgVbs8GvfLZf1sTxdwAY=' 
                                sha256-sas0my9BTcIgbvqtfypZbI50q2+X5b5UeFkIUKxeBdc='
                              Cross-Origin-Opener-Policy: same-origin
                              Cross-Origin-Resource-Policy: same-origin
                              Referrer-Policy: same-origin
 Reverse Proxy banner         --


 Testing vulnerabilities 

 Secure Renegotiation (RFC 5746)           supported (OK)
 Secure Client-Initiated Renegotiation     not vulnerable (OK) -- mitigated (disconnect after 6/10 attempts)
 CRIME, TLS (CVE-2012-4929)                not vulnerable (OK)
 BREACH (CVE-2013-3587)                    no gzip/deflate/compress/br HTTP compression (OK)  - only supplied "/" tested
 POODLE, SSL (CVE-2014-3566)               not vulnerable (OK)
 TLS_FALLBACK_SCSV (RFC 7507)              No fallback possible (OK), no protocol below TLS 1.2 offered
 SWEET32 (CVE-2016-2183, CVE-2016-6329)    not vulnerable (OK)
 FREAK (CVE-2015-0204)                     not vulnerable (OK)
 DROWN (CVE-2016-0800, CVE-2016-0703)      not vulnerable on this host and port (OK)
                                           make sure you don't use this certificate elsewhere with SSLv2 enabled services, see
                                           https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=B8033A0A7E21897123ADB9D9FFA2C9762441FD60B7193CBF1FF9EF1B8B0080D4
 LOGJAM (CVE-2015-4000), experimental      common prime with 2048 bits detected: RFC7919/ffdhe2048 (2048 bits),
                                           but no DH EXPORT ciphers
 BEAST (CVE-2011-3389)                     not vulnerable (OK), no SSL3 or TLS1
 LUCKY13 (CVE-2013-0169), experimental     potentially VULNERABLE, uses obsolete cipher block chaining ciphers with TLS, see server prefs.
 Winshock (CVE-2014-6321), experimental    not vulnerable (OK) - CAMELLIA or ECDHE_RSA GCM ciphers found
 RC4 (CVE-2013-2566, CVE-2015-2808)        no RC4 ciphers detected (OK)


 Done 2026-08-12 13:17:42 [ 101s] -->> 200.49.201.128:443 (flexwan.movistar.com.ar) <<--