Kestrel
tcp/443 tcp/80
Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.
Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.
While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.
Severity: info
Fingerprint: 5733ddf49ff49cd1aad03549239cbd2455fce825f4a7b19a76a5ab1d60b74713
Public Swagger UI/API detected at path: /swagger/index.html - sample paths:
GET /permissions
GET /permissions/{id}
GET /permissions/{id}/events
GET /permissions/{id}/relations
GET /roles
GET /roles/{id}
GET /roles/{id}/events
GET /roles/{id}/relations
GET /users
GET /users/{id}
GET /users/{id}/events
GET /users/{id}/logins
GET /users/{id}/relations
POST /permissions/{id}/actions/{action}
POST /permissions/{id}/changestate
POST /permissions/{id}/relations/{relationName}
POST /roles/{id}/actions/{action}
POST /roles/{id}/changestate
POST /roles/{id}/relations/{relationName}
POST /users/{id}/actions/{action}
POST /users/{id}/changestate
POST /users/{id}/relations/{relationName}
PUT /permissions/{id}/relations/{relationId}
PUT /roles/{id}/relations/{relationId}
PUT /users/{id}/relations/{relationId}
Severity: info
Fingerprint: 5733ddf49ff49cd1f3d88d60dbce8b9d6f76071aed76b25164178d9c2da72572
Public Swagger UI/API detected at path: /swagger/v1/swagger.json - sample paths:
GET /permissions
GET /permissions/{id}
GET /permissions/{id}/events
GET /permissions/{id}/relations
GET /roles
GET /roles/{id}
GET /roles/{id}/events
GET /roles/{id}/relations
GET /users
GET /users/{id}
GET /users/{id}/events
GET /users/{id}/logins
GET /users/{id}/relations
POST /permissions/{id}/actions/{action}
POST /permissions/{id}/changestate
POST /permissions/{id}/relations/{relationName}
POST /roles/{id}/actions/{action}
POST /roles/{id}/changestate
POST /roles/{id}/relations/{relationName}
POST /users/{id}/actions/{action}
POST /users/{id}/changestate
POST /users/{id}/relations/{relationName}
PUT /permissions/{id}/relations/{relationId}
PUT /roles/{id}/relations/{relationId}
PUT /users/{id}/relations/{relationId}
Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.
Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.
While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.
Severity: info
Fingerprint: 5733ddf49ff49cd1aad03549239cbd2455fce825f4a7b19a76a5ab1d60b74713
Public Swagger UI/API detected at path: /swagger/index.html - sample paths:
GET /permissions
GET /permissions/{id}
GET /permissions/{id}/events
GET /permissions/{id}/relations
GET /roles
GET /roles/{id}
GET /roles/{id}/events
GET /roles/{id}/relations
GET /users
GET /users/{id}
GET /users/{id}/events
GET /users/{id}/logins
GET /users/{id}/relations
POST /permissions/{id}/actions/{action}
POST /permissions/{id}/changestate
POST /permissions/{id}/relations/{relationName}
POST /roles/{id}/actions/{action}
POST /roles/{id}/changestate
POST /roles/{id}/relations/{relationName}
POST /users/{id}/actions/{action}
POST /users/{id}/changestate
POST /users/{id}/relations/{relationName}
PUT /permissions/{id}/relations/{relationId}
PUT /roles/{id}/relations/{relationId}
PUT /users/{id}/relations/{relationId}
Open service 13.80.19.74:80 · prod-j1-shield.junecomet.com
2026-01-23 09:11
HTTP/1.1 403 Site Disabled
Content-Length: 1148
Connection: close
Content-Type: text/html
Date: Fri, 23 Jan 2026 09:11:53 GMT
Page title: Web App - Unavailable
<!DOCTYPE html><html><head><title>Web App - Unavailable</title><style type="text/css">html{height:100%;width:100%;}#feature{width:960px;margin:95px auto 0 auto;overflow:auto;}#content{font-family:"Segoe UI";font-weight:normal;font-size:22px;color:#fff;float:left;width:460px;margin-top:68px;margin-left:0px;vertical-align:middle;}#content h1{font-family:"Segoe UI Light";color:#fff;font-weight:normal;font-size:60px;line-height:48pt;width:800px;}p a,p a:visited,p a:active,p a:hover{color:#fff;}</style></head><body bgcolor="#00abec"><div id="feature"><div id="content"><h1 id="unavailable">Error 403 - This web app is stopped.</h1><p id="tryAgain">The web app you have attempted to reach is currently stopped and does not accept any requests. Please try to reload the page or visit it again soon.</p><p id="toAdmin">If you are the web app administrator, please find the common 403 error scenarios and resolution <a href="https://go.microsoft.com/fwlink/?linkid=2095007" target="_blank">here</a>. For further troubleshooting tools and recommendations, please visit <a href="https://portal.azure.com/">Azure Portal</a>.</p></div></div></body></html>
Open service 13.80.19.74:80 · prod-j1-shield.junecomet.com
2026-01-09 18:53
HTTP/1.1 307 Temporary Redirect Content-Length: 0 Connection: close Date: Fri, 09 Jan 2026 18:54:39 GMT Server: Kestrel Location: https://prod-j1-shield.junecomet.com/ X-Powered-By: ASP.NET
Open service 13.80.19.74:443 · prod-j1-shield.junecomet.com
2026-01-09 05:12
HTTP/1.1 404 Not Found Content-Length: 0 Connection: close Date: Fri, 09 Jan 2026 05:13:02 GMT Server: Kestrel X-Powered-By: ASP.NET
Open service 13.80.19.74:443 · prod-j1-shield.junecomet.com
2026-01-02 08:04
HTTP/1.1 404 Not Found Content-Length: 0 Connection: close Date: Fri, 02 Jan 2026 08:04:42 GMT Server: Kestrel X-Powered-By: ASP.NET
Open service 13.80.19.74:80 · prod-j1-shield.junecomet.com
2026-01-02 04:21
HTTP/1.1 307 Temporary Redirect Content-Length: 0 Connection: close Date: Fri, 02 Jan 2026 04:21:15 GMT Server: Kestrel Location: https://prod-j1-shield.junecomet.com/ X-Powered-By: ASP.NET
Open service 13.80.19.74:443 · prod-j1-shield.junecomet.com
2025-12-23 02:29
HTTP/1.1 404 Not Found Content-Length: 0 Connection: close Date: Tue, 23 Dec 2025 02:29:52 GMT Server: Kestrel X-Powered-By: ASP.NET
Open service 13.80.19.74:80 · prod-j1-shield.junecomet.com
2025-12-22 08:06
HTTP/1.1 307 Temporary Redirect Content-Length: 0 Connection: close Date: Mon, 22 Dec 2025 08:06:51 GMT Server: Kestrel Location: https://prod-j1-shield.junecomet.com/ X-Powered-By: ASP.NET