pentestlab.blog Open in urlscan Pro
192.0.78.25 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://pentestlab.blog/2017/05/23/applocker-bypass-rundll32/
Submission: On February 08 via api (February 8th 2024, 3:27:30 pm UTC) from BE — Scanned from DE

Summary HTTP 93 Redirects Links 19 Behaviour Indicators

Summary

This website contacted 11 IPs in 2 countries across 8 domains to perform 93 HTTP transactions. The main IP is 192.0.78.25, located in San Francisco, United States and belongs to AUTOMATTIC, US. The main domain is pentestlab.blog.
TLS certificate: Issued by R3 on January 7th 2024. Valid for: 3 months.

This is the only time pentestlab.blog was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
2	192.0.78.25 192.0.78.25	2635 (AUTOMATTIC) (AUTOMATTIC)
57	192.0.77.32 192.0.77.32	2635 (AUTOMATTIC) (AUTOMATTIC)
13	192.0.72.29 192.0.72.29	2635 (AUTOMATTIC) (AUTOMATTIC)
3	192.0.73.2 192.0.73.2	2635 (AUTOMATTIC) (AUTOMATTIC)
4	192.0.123.248 192.0.123.248	2635 (AUTOMATTIC) (AUTOMATTIC)
5	192.0.76.3 192.0.76.3	2635 (AUTOMATTIC) (AUTOMATTIC)
2	157.240.251.9 157.240.251.9	32934 (FACEBOOK) (FACEBOOK)
1	151.101.64.84 151.101.64.84	54113 (FASTLY) (FASTLY)
1	192.0.78.19 192.0.78.19	2635 (AUTOMATTIC) (AUTOMATTIC)
1 2	157.240.253.35 157.240.253.35	32934 (FACEBOOK) (FACEBOOK)
93	11

2 192.0.78.25 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)

pentestlab.blog	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

57 192.0.77.32 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)
PTR: wordpress.com

s0.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
fonts-api.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
fonts.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
widgets.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 192.0.72.29 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)

pentestlab.files.wordpress.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 192.0.73.2 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)

0.gravatar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 192.0.123.248 (Los Angeles, United States)

ASN2635 (AUTOMATTIC, US)
PTR: polldaddy.com

polldaddy.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 192.0.76.3 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)

stats.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pixel.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 157.240.251.9 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)
PTR: xx-fbcdn-shv-01-fra5.fbcdn.net

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.64.84 (United States)

ASN54113 (FASTLY, US)

api.pinterest.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.0.78.19 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)

r-login.wordpress.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 157.240.253.35 (Frankfurt am Main, Germany) 1 redirects

ASN32934 (FACEBOOK, US)
PTR: edge-star-mini-shv-02-fra5.facebook.com

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
62	wp.com s0.wp.com — Cisco Umbrella Rank: 8186 fonts-api.wp.com — Cisco Umbrella Rank: 16464 stats.wp.com — Cisco Umbrella Rank: 2723 fonts.wp.com — Cisco Umbrella Rank: 17444 widgets.wp.com — Cisco Umbrella Rank: 11869 pixel.wp.com — Cisco Umbrella Rank: 2679	864 KB
14	wordpress.com pentestlab.files.wordpress.com r-login.wordpress.com — Cisco Umbrella Rank: 27867	455 KB
4	polldaddy.com polldaddy.com — Cisco Umbrella Rank: 34574	10 KB
3	gravatar.com 0.gravatar.com — Cisco Umbrella Rank: 8614	9 KB
2	facebook.com 1 redirects www.facebook.com — Cisco Umbrella Rank: 107	3 KB
2	facebook.net connect.facebook.net — Cisco Umbrella Rank: 174	90 KB
2	pentestlab.blog pentestlab.blog	35 KB
1	pinterest.com api.pinterest.com — Cisco Umbrella Rank: 3371	386 B
93	8

	Domain	Requested by
50	s0.wp.com	pentestlab.blog s0.wp.com widgets.wp.com
13	pentestlab.files.wordpress.com	pentestlab.blog
4	pixel.wp.com	pentestlab.blog
4	fonts.wp.com	fonts-api.wp.com
4	polldaddy.com	pentestlab.blog polldaddy.com
3	0.gravatar.com	pentestlab.blog 0.gravatar.com
2	www.facebook.com	1 redirects connect.facebook.net
2	connect.facebook.net	s0.wp.com connect.facebook.net
2	fonts-api.wp.com	pentestlab.blog s0.wp.com
2	pentestlab.blog	s0.wp.com
1	r-login.wordpress.com	pentestlab.blog
1	api.pinterest.com	s0.wp.com
1	widgets.wp.com	pentestlab.blog
1	stats.wp.com	pentestlab.blog
93	14

This site contains links to these domains. Also see Links.

Domain
twitter.com
didierstevens.com
www.didierstevens.com
blog.didierstevens.com
github.com
ikat.ha.cked.net
jtlr.net
pentestlab.wordpress.com
movaxbx.ru
discord.gg
www.facebook.com
wordpress.com
wp.me
en.wordpress.com
subscribe.wordpress.com

Subject Issuer	Validity	Valid
tls.automattic.com R3	`2024-01-07` - `2024-04-06`	3 months	crt.sh
*.wp.com Sectigo ECC Domain Validation Secure Server CA	`2023-11-28` - `2024-12-28`	a year	crt.sh
*.files.wordpress.com Sectigo ECC Domain Validation Secure Server CA	`2023-12-05` - `2025-01-04`	a year	crt.sh
*.gravatar.com Sectigo ECC Domain Validation Secure Server CA	`2023-12-05` - `2025-01-04`	a year	crt.sh
*.polldaddy.com Sectigo RSA Domain Validation Secure Server CA	`2023-11-02` - `2024-12-02`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2023-11-17` - `2024-02-15`	3 months	crt.sh
*.pinterest.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-07-31` - `2024-08-07`	a year	crt.sh
*.wordpress.com Sectigo ECC Domain Validation Secure Server CA	`2023-12-05` - `2025-01-04`	a year	crt.sh

This page contains 4 frames:

Primary Page: https://pentestlab.blog/2017/05/23/applocker-bypass-rundll32/
Frame ID: 7B589F96DDC09CD9D00CA89E8D53B323
Requests: 89 HTTP requests in this frame

Frame: https://widgets.wp.com/likes/master.html?ver=202402081217
Frame ID: 883B035337204208BB56FB9866AC856E
Requests: 3 HTTP requests in this frame

Frame: https://r-login.wordpress.com/remote-login.php?wpcom_remote_login=key&origin=aHR0cHM6Ly9wZW50ZXN0bGFiLmJsb2c%3D&wpcomid=32637504&time=1707406039
Frame ID: 39C725412F86EFB33761DE2D19B41EE4
Requests: 1 HTTP requests in this frame

Frame: https://www.facebook.com/login/?next=https%3A%2F%2Fwww.facebook.com%2Fplugins%2Fpage.php%3Fapp_id%3D249643311490%26channel%3Dhttps%253A%252F%252Fstaticxx.facebook.com%252Fx%252Fconnect%252Fxd_arbiter%252F%253Fversion%253D46%2523cb%253Dfc6aaa340b063f0d2%2526domain%253Dpentestlab.blog%2526is_canvas%253Dfalse%2526origin%253Dhttps%25253A%25252F%25252Fpentestlab.blog%25252Ff44fc44269d080a69%2526relation%253Dparent.parent%26container_width%3D342%26height%3D432%26hide_cover%3Dfalse%26hide_cta%3Dfalse%26href%3Dhttps%253A%252F%252Fwww.facebook.com%252Fpentestlaboratory%252F%26locale%3Den_US%26sdk%3Djoey%26show_facepile%3Dtrue%26small_header%3Dfalse%26tabs%3Dfalse%26width%3D200
Frame ID: 21A90BA0EB11524A55E8E7FDC54658E0
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

AppLocker Bypass – Rundll32 – Penetration Testing Lab

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

<link[^>]+s\d+\.wp\.com
/wp-(?:content|includes)/

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Lodash (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

lodash.*\.js

Page Statistics

93
Requests

96 %
HTTPS

0 %
IPv6

8
Domains

14
Subdomains

11
IPs

2
Countries

1470 kB
Transfer

2842 kB
Size

0
Cookies

19 Outgoing links

These are links going to different origins than the main page.

URL: https://twitter.com/DidierStevens
Title: Didier Stevens

Search URL Search Domain Scan URL

URL: http://didierstevens.com/files/software/cmd-dll_v0_0_4.zip
Title: cmd

Search URL Search Domain Scan URL

URL: http://www.didierstevens.com/files/software/regedit-dll_v0_0_1.zip
Title: registry editor

Search URL Search Domain Scan URL

URL: https://blog.didierstevens.com/?s=cmd
Title: https://blog.didierstevens.com/?s=cmd

Search URL Search Domain Scan URL

URL: https://github.com/fdiskyou/PSShell
Title: https://github.com/fdiskyou/PSShell

Search URL Search Domain Scan URL

URL: http://ikat.ha.cked.net/
Title: http://ikat.ha.cked.net/

Search URL Search Domain Scan URL

URL: http://jtlr.net/2017/05/23/applocker-bypass-rundll32/
Title: AppLocker Bypass – Rundll32 – jtlr.net

Search URL Search Domain Scan URL

URL: https://pentestlab.wordpress.com/
Title: netbiosX

Search URL Search Domain Scan URL

URL: https://movaxbx.ru/2020/10/11/a-deep-dive-into-rundll32-exe/
Title: A Deep Dive Into RUNDLL32.EXE — MOV AX, BX

Search URL Search Domain Scan URL

URL: https://discord.gg/rR6FJBH
Title: Discord

Search URL Search Domain Scan URL

URL: https://www.facebook.com/pentestlaboratory/
Title: Facebook Page

Search URL Search Domain Scan URL

URL: https://wordpress.com/?ref=footer_blog
Title: Blog at WordPress.com.

Search URL Search Domain Scan URL

URL: https://wordpress.com/log-in?redirect_to=https%3A%2F%2Fr-login.wordpress.com%2Fremote-login.php%3Faction%3Dlink%26back%3Dhttps%253A%252F%252Fpentestlab.blog%252F2017%252F05%252F23%252Fapplocker-bypass-rundll32%252F
Title: Log in now.

Search URL Search Domain Scan URL

URL: https://pentestlab.wordpress.com/wp-admin/customize.php?url=https%3A%2F%2Fpentestlab.wordpress.com%2F2017%2F05%2F23%2Fapplocker-bypass-rundll32%2F
Title: Customize

Search URL Search Domain Scan URL

URL: https://wordpress.com/start/
Title: Sign up

Search URL Search Domain Scan URL

URL: https://wp.me/p2cWvm-1FC
Title: Copy shortlink

Search URL Search Domain Scan URL

URL: http://en.wordpress.com/abuse/?report_url=https://pentestlab.blog/2017/05/23/applocker-bypass-rundll32/
Title: Report this content

Search URL Search Domain Scan URL

URL: https://wordpress.com/read/blogs/32637504/posts/6424
Title: View post in Reader

Search URL Search Domain Scan URL

URL: https://subscribe.wordpress.com/
Title: Manage subscriptions

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 92

https://www.facebook.com/v2.3/plugins/page.php?app_id=249643311490&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Dfc6aaa340b063f0d2%26domain%3Dpentestlab.blog%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Fpentestlab.blog%252Ff44fc44269d080a69%26relation%3Dparent.parent&container_width=342&height=432&hide_cover=false&hide_cta=false&href=https%3A%2F%2Fwww.facebook.com%2Fpentestlaboratory%2F&locale=en_US&sdk=joey&show_facepile=true&small_header=false&tabs=false&width=200 HTTP 302
https://www.facebook.com/login/?next=https%3A%2F%2Fwww.facebook.com%2Fplugins%2Fpage.php%3Fapp_id%3D249643311490%26channel%3Dhttps%253A%252F%252Fstaticxx.facebook.com%252Fx%252Fconnect%252Fxd_arbiter%252F%253Fversion%253D46%2523cb%253Dfc6aaa340b063f0d2%2526domain%253Dpentestlab.blog%2526is_canvas%253Dfalse%2526origin%253Dhttps%25253A%25252F%25252Fpentestlab.blog%25252Ff44fc44269d080a69%2526relation%253Dparent.parent%26container_width%3D342%26height%3D432%26hide_cover%3Dfalse%26hide_cta%3Dfalse%26href%3Dhttps%253A%252F%252Fwww.facebook.com%252Fpentestlaboratory%252F%26locale%3Den_US%26sdk%3Djoey%26show_facepile%3Dtrue%26small_header%3Dfalse%26tabs%3Dfalse%26width%3D200

93 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
pentestlab.blog/2017/05/23/applocker-bypass-rundll32/ 161 KB
34 KB 614ms
562ms Document
text/html 192.0.78.25
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://pentestlab.blog/2017/05/23/applocker-bypass-rundll32/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.78.25 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

0f0e7117b66140a992f70a9246331a03c509b04035610e0856ce67d692be9eba

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
content-encoding: br
content-type: text/html; charset=UTF-8
date: Thu, 08 Feb 2024 15:27:19 GMT
host-header: WordPress.com
link: <https://wp.me/p2cWvm-1FC>; rel=shortlink
server: nginx
strict-transport-security: max-age=31536000
vary: Accept-Encoding accept, content-type, cookie
x-ac: 2.hhn _dfw MISS
x-hacker: Want root? Visit join.a8c.com/hacker and mention this header.
x-pingback: https://pentestlab.blog/xmlrpc.php

GET
H2 200 webfont.js Show response
s0.wp.com/wp-content/plugins/custom-fonts/js/ 12 KB
5 KB 72ms
21ms Script
application/javascript 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/wp-content/plugins/custom-fonts/js/webfont.js
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/23/applocker-bypass-rundll32/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: 738223eb8c8c70913bf59775dc575c205070014babc8b174fd3ab8e6082ebe30

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pentestlab.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

x-minify-cache: hit
date: Thu, 08 Feb 2024 15:27:19 GMT
content-encoding: br
x-ac: 2.hhn _dca MISS
x-minify: t
alt-svc: h3=":443"; ma=86400
x-nc: HIT hhn 1
server: nginx
etag: W/12493-1684460879556.3713
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
expires: Wed, 29 May 2024 20:23:52 GMT

GET
H2 200 /
s0.wp.com/_static/ 10 KB
3 KB 62ms
17ms Stylesheet
text/css 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/_static/??-eJxtzEkKgDAMQNELWeOAWBfiWaQNUu0QTIrXF0UQxOWDz4eDlElRMAqErMjnxUWGFYVmsz0GzhFCstkjw45+FrSKEstHpWEu4P/o3Ybv99aVT2Gs+6rrmnbQej0BKWI0fQ==&cssminify=yes
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/23/applocker-bypass-rundll32/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: 376eacb307ddbfb56e702fe1c39363c70218d2e4ac32d7ba96f0403da942a093

Request headers

Referer: https://pentestlab.blog/
Origin: https://pentestlab.blog
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Thu, 08 Feb 2024 15:27:19 GMT
content-encoding: br
x-ac: 2.hhn _dfw BYPASS
last-modified: Wed, 17 Jan 2024 20:39:57 GMT
server: nginx
etag: W/"65a83b1d-27f9"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/css;charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
alt-svc: h3=":443"; ma=86400
expires: Thu, 16 Jan 2025 20:54:31 GMT

GET
H2 200 /
s0.wp.com/_static/ 113 KB
16 KB 63ms
18ms Stylesheet
text/css 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/_static/??-eJylzFsKgCAQQNENlZMkWh/RWtIGsyYLH0W7T9pCn5cLB+6zNodP6BOclK3zEWwuqTHYcgLCxRWTTIDOjmbQdJitJqfDFB6I6SFkJsYK/kFpwf2Dxn3gqlGt6GTfrC8pRjhn&cssminify=yes
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/23/applocker-bypass-rundll32/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: 69f13d95be58a28c857b87ec398f709e23d1c99a21f1ad935a159587460586ad

Request headers

Referer: https://pentestlab.blog/
Origin: https://pentestlab.blog
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Thu, 08 Feb 2024 15:27:19 GMT
content-encoding: br
x-ac: 2.hhn _dfw BYPASS
last-modified: Wed, 07 Feb 2024 23:31:45 GMT
server: nginx
etag: W/"65c412e1-1c292"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/css;charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
alt-svc: h3=":443"; ma=86400
expires: Thu, 06 Feb 2025 23:43:07 GMT

GET
H2 200 /
s0.wp.com/_static/ 15 KB
4 KB 63ms
18ms Stylesheet
text/css 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/_static/??-eJzTLy/QzcxLzilNSS3WzyrWz01NyUxMzUnNTc0rQeEU5CRWphbp5qSmJyZX6uVm5uklFxfr6OPTDpRD5sM02efaGpoZmFkYGRuZGmQBAHPvL0Y=&cssminify=yes
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/23/applocker-bypass-rundll32/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: 3d2c10cf69410c10177fc6e56937d05151b182841fa6aee36f651d587d91fbb8

Request headers

Referer: https://pentestlab.blog/
Origin: https://pentestlab.blog
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Thu, 08 Feb 2024 15:27:19 GMT
content-encoding: br
x-ac: 2.hhn _dfw BYPASS
last-modified: Sun, 19 Dec 2021 04:30:58 GMT
server: nginx
etag: W/"61beb582-3ca1"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/css;charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
alt-svc: h3=":443"; ma=86400
expires: Thu, 14 Mar 2024 19:36:42 GMT

GET
H2 200 /
s0.wp.com/_static/ 52 KB
3 KB 62ms
17ms Stylesheet
text/css 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/_static/??-eJyVzDEOgCAMQNELiQU1Jg7Gs2AlDYpAaInx9ro5O/7hfbiywhTFRYEcKvnIQPXN1RVSa0h4MOxOssVDBXunKoqK34DlDq5F5gb+LIoVH4k/vpyzGYe+03oyw/4AcmU1KQ==&cssminify=yes
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/23/applocker-bypass-rundll32/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: 66f69ace341969d16b2b3709a823e62788c738e6170a9689dbe75b18e48d5453

Request headers

Referer: https://pentestlab.blog/
Origin: https://pentestlab.blog
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Thu, 08 Feb 2024 15:27:19 GMT
content-encoding: br
x-ac: 2.hhn _dfw BYPASS
last-modified: Wed, 26 Jan 2022 12:42:16 GMT
server: nginx
etag: W/"61f141a8-d0bc"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/css;charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
alt-svc: h3=":443"; ma=86400
expires: Thu, 14 Mar 2024 20:18:54 GMT

GET
H2 200 /
s0.wp.com/_static/ 369 B
673 B 64ms
19ms Stylesheet
text/css 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/_static/??/wp-content/mu-plugins/core-compat/wp-mediaelement.css,/wp-content/mu-plugins/wpcom-bbpress-premium-themes.css?m=1432920480j&cssminify=yes
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/23/applocker-bypass-rundll32/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: 9c83b89ab9d2677980617afacb833a74da3050a2d3d711176b500d7922e49ab5

Request headers

Referer: https://pentestlab.blog/
Origin: https://pentestlab.blog
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Thu, 08 Feb 2024 15:27:19 GMT
x-ac: 2.hhn _dfw MISS
last-modified: Fri, 19 May 2023 03:00:34 GMT
server: nginx
etag: "6466e652-171"
access-control-allow-methods: GET, HEAD
content-type: text/css;charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
alt-svc: h3=":443"; ma=86400
content-length: 369
expires: Sat, 09 Nov 2024 15:12:41 GMT

GET
BLOB 200
OK b90a19ec-1282-46a6-a294-bfab767f9b64
https://pentestlab.blog/ 1 KB
0 Other
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://pentestlab.blog/b90a19ec-1282-46a6-a294-bfab767f9b64
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/23/applocker-bypass-rundll32/
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 453cb806084fdabec32e286af2e88899f79022125c2527afffbec507975d2c22

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Content-Length: 1245
Content-Type: text/javascript

GET
H2 200 verbum-comments.css
s0.wp.com/wp-content/mu-plugins/jetpack-mu-wpcom-plugin/sun/vendor/automattic/jetpack-mu-wpcom/src/build/verbum-comments/ 26 KB
4 KB 60ms
18ms Stylesheet
text/css 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/wp-content/mu-plugins/jetpack-mu-wpcom-plugin/sun/vendor/automattic/jetpack-mu-wpcom/src/build/verbum-comments/verbum-comments.css?m=1706127135i&cssminify=yes
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/23/applocker-bypass-rundll32/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: 3a6eca802634248cd9896666cb3a031eabf070b1d11a7ce6bb361b1811cd67a2

Request headers

Referer: https://pentestlab.blog/
Origin: https://pentestlab.blog
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

x-minify-cache: miss
date: Thu, 08 Feb 2024 15:27:19 GMT
content-encoding: br
x-ac: 2.hhn _dfw BYPASS
x-minify: t
alt-svc: h3=":443"; ma=86400
x-nc: HIT hhn 2
server: nginx
etag: W/26497-1706127147597.365
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
expires: Thu, 23 Jan 2025 21:34:34 GMT

GET
H2 200 css
fonts-api.wp.com/ 2 KB
1 KB 80ms
38ms Stylesheet
text/css 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts-api.wp.com/css?family=Open%2BSans%3A400%2C400italic%2C700%2C700italic%7CMontserrat%3A500&subset=latin%2Clatin-ext&ver=6.5-alpha-57492

Requested by

Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/23/applocker-bypass-rundll32/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

ce9e6ace282c0a37d97f7d539a45062a713f4b39582873061c0377552bc1f6c4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pentestlab.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 15:27:19 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-encoding: gzip
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-xss-protection: 0
x-nc: BYPASS hhn 2
last-modified: Thu, 08 Feb 2024 15:27:19 GMT
server: nginx
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding, Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin

GET
H2 200 /
s0.wp.com/_static/ 60 KB
14 KB 60ms
19ms Stylesheet
text/css 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/_static/??-eJzTLy/QTc7PK0nNK9EvyUjNTS3WLyhKzc0szQVx0/JLi/STi4v104BKdBPLU4vzc1P1gAI6+oT1FZdU5oAV2+faGpoZG5gamBsammYBAMXNKeE=&cssminify=yes
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/23/applocker-bypass-rundll32/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: 017bccf545b2ffdfa4d25b1b7a47d847a1c03c00d9a60426cdaed49cf7bbe2da

Request headers

Referer: https://pentestlab.blog/
Origin: https://pentestlab.blog
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Thu, 08 Feb 2024 15:27:19 GMT
content-encoding: br
x-ac: 2.hhn _dfw BYPASS
last-modified: Sun, 19 Dec 2021 04:32:21 GMT
server: nginx
etag: W/"61beb5d5-f188"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/css;charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
alt-svc: h3=":443"; ma=86400
expires: Thu, 14 Mar 2024 19:39:42 GMT

GET
H2 200 /
s0.wp.com/_static/ 3 KB
1 KB 92ms
51ms Stylesheet
text/css 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/_static/??-eJx9zMEKwjAMxvEXsmY9bHgRn6V2MWSmTVla9vpW8LDB8JYf5P/BVlzUXDFXSM0VacTZYMFaQnz/DNYyJJ2boMHGM2E1MI0cxHGvj7hGswuc7xKqE42hsuYD3EsCr//SFZ+i1E+C/rXjN3qku59uo/fjMA3LB+kmT0M=&cssminify=yes
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/23/applocker-bypass-rundll32/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: 70746c461d32b81951f85b1da353e29d43410ae13916ae31b845a0bcbf4e197f

Request headers

Referer: https://pentestlab.blog/
Origin: https://pentestlab.blog
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Thu, 08 Feb 2024 15:27:19 GMT
content-encoding: br
x-ac: 2.hhn _dfw BYPASS
last-modified: Fri, 26 May 2023 15:31:16 GMT
server: nginx
etag: W/"6470d0c4-d2a"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/css;charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
alt-svc: h3=":443"; ma=86400
expires: Sat, 25 May 2024 16:37:56 GMT

GET
H2 200 /
s0.wp.com/_static/ 30 KB
11 KB 60ms
19ms Stylesheet
text/css 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/_static/??-eJyNjcsKAjEMRX/IGsdR1IX4KRLT0nZMkzJpEf/eB27Ejbt74HIO3KojlRakQemuco9ZDKbQKtL1w2BdoKjvHAws4Rw8en9/zyxxSWYL+Ft0zkJgShnZsUa1L/iRtRTKM5s2EFkvyK/DqRyH3WrcDodxv54euNBIXw==&cssminify=yes
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/23/applocker-bypass-rundll32/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: 861af5dd96b652ea4e711b9377e771b5200b235ad71b216dd0ba669e640f0822

Request headers

Referer: https://pentestlab.blog/
Origin: https://pentestlab.blog
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Thu, 08 Feb 2024 15:27:19 GMT
content-encoding: br
x-ac: 2.hhn _dfw BYPASS
last-modified: Mon, 25 Dec 2023 15:49:53 GMT
server: nginx
etag: W/"6589a4a1-769e"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/css;charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
alt-svc: h3=":443"; ma=86400
expires: Tue, 24 Dec 2024 16:05:12 GMT

GET
H2 200 / Show response
s0.wp.com/_static/ 133 KB
44 KB 92ms
51ms Script
application/javascript 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/_static/??-eJx9j01OxDAMhS9ExsCiogvEUUZpYypnEjvYzsDcniAVNCBgZb0fvU+G1xZWYUd2yAZVFioYuqHGbXiB+FkO2W7gqld7aKVvxAYZvcX1tGuwznAkXmHpVBIoluiYQhNz+64Olfjn7uBr8dBU3i6f2RgrPaF9hPmlo172cz3wZylU2nRAf6P9/8VuHc/ISRRid6nRndav8pkSSlM0278ttIDLCTksSmnDAXyqj3fTPM8P0/10m98BNEWIiQ==
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/23/applocker-bypass-rundll32/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: cf75f45164a049900471e9bc171c299121e16f3675651b92ee8ca43dc974d64a

Request headers

Referer: https://pentestlab.blog/
Origin: https://pentestlab.blog
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Thu, 08 Feb 2024 15:27:19 GMT
content-encoding: br
x-ac: 2.hhn _dfw BYPASS
last-modified: Tue, 14 Nov 2023 18:24:32 GMT
server: nginx
etag: W/"6553bb60-2146a"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
alt-svc: h3=":443"; ma=86400
expires: Wed, 13 Nov 2024 18:35:56 GMT

GET
H2 200 web-delivery-module-configuration.png
pentestlab.files.wordpress.com/2017/05/ 86 KB
87 KB 88ms
20ms Image
image/webp 192.0.72.29
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pentestlab.files.wordpress.com/2017/05/web-delivery-module-configuration.png

Requested by

Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/23/applocker-bypass-rundll32/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.72.29 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

527c5d936ae23161fc29fc8bacb85b839f0fa73efae6a4768c5f0b22d9462461

Security Headers

Name	Value
X-Content-Type-Options	nosniff, nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pentestlab.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

x-nc: HIT hhn 29 np
date: Thu, 08 Feb 2024 15:27:19 GMT
x-content-type-options: nosniff, nosniff
last-modified: Sun, 21 May 2017 09:03:38 GMT
server: nginx
x-orig-src: 0_imageresize
vary: Accept, Origin
content-type: image/webp
access-control-allow-origin: https://pentestlab.wordpress.com
access-control-allow-credentials: true
accept-ranges: bytes
alt-svc: h3=":443"; ma=86400
content-length: 88380
expires: Mon, 12 Feb 2024 20:27:14 GMT

GET
H2 200 rundll32-javascript.png
pentestlab.files.wordpress.com/2017/05/ 2 KB
3 KB 87ms
19ms Image
image/webp 192.0.72.29
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pentestlab.files.wordpress.com/2017/05/rundll32-javascript.png

Requested by

Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/23/applocker-bypass-rundll32/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.72.29 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

53cb76dea3b1480782a52394a939d94c16e0725ca75b6226ddda1ff6514644af

Security Headers

Name	Value
X-Content-Type-Options	nosniff, nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pentestlab.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

x-nc: HIT hhn 29 np
date: Thu, 08 Feb 2024 15:27:19 GMT
x-content-type-options: nosniff, nosniff
last-modified: Sun, 21 May 2017 08:51:56 GMT
server: nginx
x-orig-src: 0_imageresize
vary: Accept, Origin
content-type: image/webp
access-control-allow-origin: https://pentestlab.wordpress.com
access-control-allow-credentials: true
accept-ranges: bytes
alt-svc: h3=":443"; ma=86400
content-length: 2420
expires: Wed, 21 Feb 2024 18:20:49 GMT

GET
H2 200 web-delivery-payload.png
pentestlab.files.wordpress.com/2017/05/ 145 KB
146 KB 44ms
44ms Image
image/webp 192.0.72.29
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pentestlab.files.wordpress.com/2017/05/web-delivery-payload.png

Requested by

Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/23/applocker-bypass-rundll32/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.72.29 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

7144da51c13e676115aa2ba938801234efef87990ad67e6bb5180fb4eda05b9a

Security Headers

Name	Value
X-Content-Type-Options	nosniff, nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pentestlab.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

x-nc: HIT hhn 29 np
date: Thu, 08 Feb 2024 15:27:19 GMT
x-content-type-options: nosniff, nosniff
last-modified: Sun, 21 May 2017 09:02:36 GMT
server: nginx
x-orig-src: 0_imageresize
vary: Accept, Origin
content-type: image/webp
access-control-allow-origin: https://pentestlab.wordpress.com
access-control-allow-credentials: true
accept-ranges: bytes
alt-svc: h3=":443"; ma=86400
content-length: 148850
expires: Sun, 10 Mar 2024 05:32:40 GMT

GET
H2 200 hovercards.min.js Show response
0.gravatar.com/js/hovercards/ 13 KB
5 KB 105ms
18ms Script
application/javascript 192.0.73.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://0.gravatar.com/js/hovercards/hovercards.min.js?ver=202406131f6b765e798866d728f95661b78bbf269c86482ffff0fa8c08e18a1a65cc89

Requested by

Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/23/applocker-bypass-rundll32/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.73.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

131f6b765e798866d728f95661b78bbf269c86482ffff0fa8c08e18a1a65cc89

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pentestlab.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 15:27:19 GMT
strict-transport-security: max-age=31536000; includeSubdomains; preload
content-encoding: br
last-modified: Tue, 28 Nov 2023 13:47:28 GMT
server: nginx
etag: W/"6565ef70-329d"
content-type: application/javascript
cache-control: max-age=604800
alt-svc: h3=":443"; ma=86400
expires: Thu, 15 Feb 2024 15:27:19 GMT

GET
H2 200 wpgroho.js Show response
s0.wp.com/wp-content/mu-plugins/gravatar-hovercards/ 655 B
703 B 32ms
28ms Script
application/javascript 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/wp-content/mu-plugins/gravatar-hovercards/wpgroho.js?m=1610363240i
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/23/applocker-bypass-rundll32/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: b6e4492d3b8358a81b80908b1f84e6bd2f64a7a46d48793af99d27bf29f4c2e8

Request headers

Referer: https://pentestlab.blog/
Origin: https://pentestlab.blog
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

x-minify-cache: hit
date: Thu, 08 Feb 2024 15:27:19 GMT
content-encoding: br
x-ac: 2.hhn _dfw BYPASS
x-minify: t
alt-svc: h3=":443"; ma=86400
x-nc: HIT hhn 2
server: nginx
etag: W/1125-1684460931415.6394
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
expires: Thu, 30 May 2024 20:22:44 GMT

GET
H2 200 wpcom-gray-white.png
s0.wp.com/i/logo/ 8 KB
8 KB 18ms
17ms Image
image/png 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s0.wp.com/i/logo/wpcom-gray-white.png
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/23/applocker-bypass-rundll32/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: c0e93b5ebf107af77d9e7d101d186b3b93e9d5ad4fbb6a74e2dea60173cc04f8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pentestlab.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Thu, 08 Feb 2024 15:27:19 GMT
x-ac: 2.hhn _dca MISS
last-modified: Fri, 19 May 2023 01:51:42 GMT
server: nginx
etag: "6466d62e-200b"
access-control-allow-methods: GET, HEAD
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=86400
content-length: 8203
expires: Sat, 09 Nov 2024 15:12:16 GMT

GET
H2 200 / Show response
s0.wp.com/_static/ 32 KB
13 KB 32ms
29ms Script
application/javascript 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/_static/??-eJzTLy/QTc7PK0nNK9EvyClNz8wr1i+uzCtJrMjITM/IAeKS1CJMEWP94uSizIISoOIM5/yiVL2sYh19yo1yKioFmldcDDTOPtfW0MzQ1MTczNLYKAsAj5w/sg==
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/23/applocker-bypass-rundll32/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: de82ba6d47c0b4495e7dc26891a7ef82f1f07730df39a5375343b341c4eec13d

Request headers

Referer: https://pentestlab.blog/
Origin: https://pentestlab.blog
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Thu, 08 Feb 2024 15:27:19 GMT
content-encoding: br
x-ac: 2.hhn _dfw BYPASS
last-modified: Fri, 19 May 2023 01:48:47 GMT
server: nginx
etag: W/"6466d57f-8144"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
alt-svc: h3=":443"; ma=86400
expires: Sat, 09 Nov 2024 15:26:26 GMT

GET
H2 200 /
s0.wp.com/_static/ 180 KB
55 KB 33ms
29ms Stylesheet
text/css 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/_static/??-eJydjsEOwiAQRH9Ium1sWj0Yv4UCIhUWwrI2/r00ab2YePA4uzNvBpYkVMRisEBgkTxbhwSzKUmqx6aBGCFEzd4QKJkjk/FAi0smi4lRe9MoogP8D9s9++HDc6g869VKBFrS3dUGaoLDr8q9z3KVk8m2frKBZzc2Q9PDxM5rUDGkiNVOQOX1e7jKcdHkLEovbjEH2hgyJS/ryjV7DZdubMdjfxrO7fwGx1t9bg==&cssminify=yes
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/23/applocker-bypass-rundll32/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: 9875cce492eeff24686e3a4064adcc13819f77124f97b11b87ce6a574fcaf3be

Request headers

Referer: https://pentestlab.blog/
Origin: https://pentestlab.blog
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Thu, 08 Feb 2024 15:27:19 GMT
content-encoding: br
x-ac: 2.hhn _dfw BYPASS
last-modified: Wed, 07 Feb 2024 23:31:46 GMT
server: nginx
etag: W/"65c412e2-2d046"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/css;charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
alt-svc: h3=":443"; ma=86400
expires: Fri, 07 Feb 2025 00:22:35 GMT

GET
H2 200 / Show response
s0.wp.com/_static/ 60 KB
19 KB 33ms
29ms Script
application/javascript 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/_static/??-eJydkNFqwzAMRX9ojjLyUPow9ilDsZVWiWV7lt3Sv6+7NmOQwsaejK6Ory4XzsnYGAqFAlJN8vXAQcHzQgqflSodMThPuZv1BZ7DM5WEdjFNOicb5bEArQFOFFzMgLVEwVLYbmjQbGGs7F2D81ilnRBpJxRQldrjLgGFrfER3TZIOZK0rCmTcJXbOMWaYVYIeOIDFo7h73/UZk5l5TlYX10j2+aRymRK/tIJb0yfNPKjiI/mBRNaGmNcDMlI7h8G954s5liV/De2Cr/EwoVVqJih6+92qzDlL/iW6F3eXnf9btj3/X6Yr/u4y/0=
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/23/applocker-bypass-rundll32/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: 4dd338d49738b699a41993a965b1e6a8755ef8d0d5252ee3341a2707227580e4

Request headers

Referer: https://pentestlab.blog/
Origin: https://pentestlab.blog
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Thu, 08 Feb 2024 15:27:19 GMT
content-encoding: br
x-ac: 2.hhn _dfw BYPASS
last-modified: Thu, 08 Feb 2024 11:01:40 GMT
server: nginx
etag: W/"65c4b494-f03c"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
alt-svc: h3=":443"; ma=86400
expires: Fri, 07 Feb 2025 11:09:12 GMT

GET
H2 200 lodash.min.js Show response
s0.wp.com/wp-includes/js/dist/vendor/ 69 KB
25 KB 33ms
29ms Script
application/javascript 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/wp-includes/js/dist/vendor/lodash.min.js?m=1690990124i&ver=4.17.21
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/23/applocker-bypass-rundll32/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: 211fdb26a74dac46f2bd297c0f02953de9e69355035cad239d87acf21c5a6a0e

Request headers

Referer: https://pentestlab.blog/
Origin: https://pentestlab.blog
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Thu, 08 Feb 2024 15:27:19 GMT
content-encoding: br
x-ac: 2.hhn _dfw BYPASS
last-modified: Wed, 02 Aug 2023 15:29:04 GMT
server: nginx
etag: W/"64ca7640-115ad"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
alt-svc: h3=":443"; ma=86400
expires: Wed, 18 Dec 2024 12:28:46 GMT

GET
H2 200 / Show response
s0.wp.com/_static/ 127 KB
40 KB 33ms
29ms Script
application/javascript 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/_static/??-eJzTLy/QzcxLzilNSS3WzyrWT8ksLtEvS81LyS/SB0oV5OdUpmXm5ADVpBaV6OVm5ullFevo49FUlJqeClSbWJJfpFtUmleSmZtKjDYku6DK7XNtDc0sLY0sTYwtLbMA5bE9uw==
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/23/applocker-bypass-rundll32/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: 50b14ff286671974963967fd56c5d06430fea5b81ab695665752ae76236828fe

Request headers

Referer: https://pentestlab.blog/
Origin: https://pentestlab.blog
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Thu, 08 Feb 2024 15:27:19 GMT
content-encoding: br
x-ac: 2.hhn _dfw BYPASS
last-modified: Mon, 06 Nov 2023 18:13:39 GMT
server: nginx
etag: W/"65492cd3-1fb8a"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
alt-svc: h3=":443"; ma=86400
expires: Tue, 05 Nov 2024 18:14:12 GMT

GET
H2 200 react.min.js Show response
s0.wp.com/wp-content/plugins/gutenberg-core/v17.6.4/build/vendors/ 10 KB
4 KB 33ms
30ms Script
application/javascript 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/wp-content/plugins/gutenberg-core/v17.6.4/build/vendors/react.min.js?m=1707348690i&ver=18
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/23/applocker-bypass-rundll32/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: a851ac2edc584a3b08c0a057bb2d0c08ac95c4de2cc453e22a2c83305cce3694

Request headers

Referer: https://pentestlab.blog/
Origin: https://pentestlab.blog
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Thu, 08 Feb 2024 15:27:19 GMT
content-encoding: br
x-ac: 2.hhn _dfw BYPASS
last-modified: Wed, 07 Feb 2024 23:31:45 GMT
server: nginx
etag: W/"65c412e1-2884"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
alt-svc: h3=":443"; ma=86400
expires: Thu, 06 Feb 2025 23:43:10 GMT

GET
H2 200 react-dom.min.js Show response
s0.wp.com/wp-content/plugins/gutenberg-core/v17.6.4/build/vendors/ 126 KB
42 KB 33ms
30ms Script
application/javascript 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/wp-content/plugins/gutenberg-core/v17.6.4/build/vendors/react-dom.min.js?m=1707348690i&ver=18
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/23/applocker-bypass-rundll32/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: dbba6c1c59954873629e196b8009f0a8256e66d755f889cf6c8ac4f1164d10c2

Request headers

Referer: https://pentestlab.blog/
Origin: https://pentestlab.blog
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Thu, 08 Feb 2024 15:27:19 GMT
content-encoding: br
x-ac: 2.hhn _dfw BYPASS
last-modified: Wed, 07 Feb 2024 23:31:46 GMT
server: nginx
etag: W/"65c412e2-1f878"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
alt-svc: h3=":443"; ma=86400
expires: Thu, 06 Feb 2025 23:43:10 GMT

GET
H2 200 index.min.js Show response
s0.wp.com/wp-content/plugins/gutenberg-core/v17.6.4/build/hooks/ 4 KB
2 KB 33ms
30ms Script
application/javascript 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/wp-content/plugins/gutenberg-core/v17.6.4/build/hooks/index.min.js?m=1707348690i&ver=3aee234ea7807d8d70bc
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/23/applocker-bypass-rundll32/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: 24004b1763b0275d5a1d9f66f08616a54b95aeec1f0034766bbb479679a82fc3

Request headers

Referer: https://pentestlab.blog/
Origin: https://pentestlab.blog
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Thu, 08 Feb 2024 15:27:19 GMT
content-encoding: br
x-ac: 2.hhn _dfw BYPASS
last-modified: Wed, 07 Feb 2024 23:31:45 GMT
server: nginx
etag: W/"65c412e1-10a6"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
alt-svc: h3=":443"; ma=86400
expires: Thu, 06 Feb 2025 23:43:07 GMT

GET
H2 200 index.min.js Show response
s0.wp.com/wp-content/plugins/gutenberg-core/v17.6.4/build/i18n/ 9 KB
4 KB 33ms
30ms Script
application/javascript 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/wp-content/plugins/gutenberg-core/v17.6.4/build/i18n/index.min.js?m=1707348690i&ver=5baa98e4345eccc97e24
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/23/applocker-bypass-rundll32/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: d743ad07240fdc75d2e2a357b4ff44b334f6d4c53683e31e824aaf61d3bad0c9

Request headers

Referer: https://pentestlab.blog/
Origin: https://pentestlab.blog
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Thu, 08 Feb 2024 15:27:19 GMT
content-encoding: br
x-ac: 2.hhn _dfw BYPASS
last-modified: Wed, 07 Feb 2024 23:31:46 GMT
server: nginx
etag: W/"65c412e2-227d"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
alt-svc: h3=":443"; ma=86400
expires: Thu, 06 Feb 2025 23:43:07 GMT

GET
H2 200 index.min.js Show response
s0.wp.com/wp-content/plugins/gutenberg-core/v17.6.4/build/url/ 8 KB
4 KB 34ms
30ms Script
application/javascript 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/wp-content/plugins/gutenberg-core/v17.6.4/build/url/index.min.js?m=1707348690i&ver=0e4121b969d6c7f2b6e9
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/23/applocker-bypass-rundll32/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: 4184b0f4356e4605d8c0484f48c3e69f4840c601a4b1268f0499534e0e162802

Request headers

Referer: https://pentestlab.blog/
Origin: https://pentestlab.blog
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Thu, 08 Feb 2024 15:27:19 GMT
content-encoding: br
x-ac: 2.hhn _dfw BYPASS
last-modified: Wed, 07 Feb 2024 23:31:45 GMT
server: nginx
etag: W/"65c412e1-2017"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
alt-svc: h3=":443"; ma=86400
expires: Thu, 06 Feb 2025 23:43:10 GMT

GET
H2 200 index.min.js Show response
s0.wp.com/wp-content/plugins/gutenberg-core/v17.6.4/build/api-fetch/ 5 KB
3 KB 34ms
31ms Script
application/javascript 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/wp-content/plugins/gutenberg-core/v17.6.4/build/api-fetch/index.min.js?m=1707348690i&ver=1d1bb669e2c3067cc691
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/23/applocker-bypass-rundll32/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: d6aa645764dc59ae4f0585681381d901f186cae336e44e1fbc8de1c0a529e7ff

Request headers

Referer: https://pentestlab.blog/
Origin: https://pentestlab.blog
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Thu, 08 Feb 2024 15:27:19 GMT
content-encoding: br
x-ac: 2.hhn _dfw MISS
last-modified: Wed, 07 Feb 2024 23:31:46 GMT
server: nginx
etag: W/"65c412e2-155b"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
alt-svc: h3=":443"; ma=86400
expires: Thu, 06 Feb 2025 23:43:10 GMT

GET
H2 200 index.min.js Show response
s0.wp.com/wp-content/plugins/gutenberg-core/v17.6.4/build/autop/ 5 KB
2 KB 34ms
31ms Script
application/javascript 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/wp-content/plugins/gutenberg-core/v17.6.4/build/autop/index.min.js?m=1707348690i&ver=dd02809e92d21384c288
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/23/applocker-bypass-rundll32/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: 499b2afc2ca8c8cd894668ae9c64b89438c8170ecd5251af73215052f5125d1a

Request headers

Referer: https://pentestlab.blog/
Origin: https://pentestlab.blog
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Thu, 08 Feb 2024 15:27:19 GMT
content-encoding: br
x-ac: 2.hhn _dfw BYPASS
last-modified: Wed, 07 Feb 2024 23:31:46 GMT
server: nginx
etag: W/"65c412e2-15ee"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
alt-svc: h3=":443"; ma=86400
expires: Thu, 06 Feb 2025 23:43:10 GMT

GET
H2 200 index.min.js Show response
s0.wp.com/wp-content/plugins/gutenberg-core/v17.6.4/build/blob/ 1 KB
880 B 34ms
31ms Script
application/javascript 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/wp-content/plugins/gutenberg-core/v17.6.4/build/blob/index.min.js?m=1707348690i&ver=94959d5178d135a3f178
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/23/applocker-bypass-rundll32/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: 81d80f7617f35c300905e4d00edab280731bc69dc5a1bb457a3171a296f0c579

Request headers

Referer: https://pentestlab.blog/
Origin: https://pentestlab.blog
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Thu, 08 Feb 2024 15:27:19 GMT
content-encoding: br
x-ac: 2.hhn _dfw BYPASS
last-modified: Wed, 07 Feb 2024 23:31:46 GMT
server: nginx
etag: W/"65c412e2-457"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
alt-svc: h3=":443"; ma=86400
expires: Thu, 06 Feb 2025 23:43:10 GMT

GET
H2 200 index.min.js Show response
s0.wp.com/wp-content/plugins/gutenberg-core/v17.6.4/build/block-serialization-default-parser/ 2 KB
1 KB 34ms
31ms Script
application/javascript 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/wp-content/plugins/gutenberg-core/v17.6.4/build/block-serialization-default-parser/index.min.js?m=1707348690i&ver=ccafd59466e043b1e67a
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/23/applocker-bypass-rundll32/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: d6480caf5f26b15563f969737af7f284bf796de4dd63c8caaa3481fe75d05b80

Request headers

Referer: https://pentestlab.blog/
Origin: https://pentestlab.blog
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Thu, 08 Feb 2024 15:27:19 GMT
content-encoding: br
x-ac: 2.hhn _dfw BYPASS
last-modified: Wed, 07 Feb 2024 23:31:46 GMT
server: nginx
etag: W/"65c412e2-94e"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
alt-svc: h3=":443"; ma=86400
expires: Thu, 06 Feb 2025 23:43:10 GMT

GET
H2 200 index.min.js Show response
s0.wp.com/wp-content/plugins/gutenberg-core/v17.6.4/build/deprecated/ 687 B
776 B 34ms
31ms Script
application/javascript 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/wp-content/plugins/gutenberg-core/v17.6.4/build/deprecated/index.min.js?m=1707348690i&ver=5f56b9106e825b0b4ab3
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/23/applocker-bypass-rundll32/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: fe788e0f7ae46a370ab3eb4f2a404269b1072e56135216713e39502c7dacde59

Request headers

Referer: https://pentestlab.blog/
Origin: https://pentestlab.blog
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Thu, 08 Feb 2024 15:27:19 GMT
content-encoding: br
x-ac: 2.hhn _dfw BYPASS
last-modified: Wed, 07 Feb 2024 23:31:46 GMT
server: nginx
etag: W/"65c412e2-2af"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
alt-svc: h3=":443"; ma=86400
expires: Thu, 06 Feb 2025 23:43:10 GMT

GET
H2 200 index.min.js Show response
s0.wp.com/wp-content/plugins/gutenberg-core/v17.6.4/build/dom/ 12 KB
5 KB 34ms
32ms Script
application/javascript 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/wp-content/plugins/gutenberg-core/v17.6.4/build/dom/index.min.js?m=1707348690i&ver=44e4bca27663d6dfa4f6
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/23/applocker-bypass-rundll32/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: bbc51c7d3315175c9f89d86add8afd37a09671935e0306a1fea6e0189f37901c

Request headers

Referer: https://pentestlab.blog/
Origin: https://pentestlab.blog
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Thu, 08 Feb 2024 15:27:19 GMT
content-encoding: br
x-ac: 2.hhn _dfw BYPASS
last-modified: Wed, 07 Feb 2024 23:31:45 GMT
server: nginx
etag: W/"65c412e1-3036"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
alt-svc: h3=":443"; ma=86400
expires: Thu, 06 Feb 2025 23:43:10 GMT

GET
H2 200 index.min.js Show response
s0.wp.com/wp-content/plugins/gutenberg-core/v17.6.4/build/escape-html/ 1003 B
851 B 35ms
32ms Script
application/javascript 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/wp-content/plugins/gutenberg-core/v17.6.4/build/escape-html/index.min.js?m=1707348690i&ver=fbad781820bda8333f76
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/23/applocker-bypass-rundll32/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: d413a32d4aad316a296461ff801272dc11512f252e5eba70da8e0673c204b235

Request headers

Referer: https://pentestlab.blog/
Origin: https://pentestlab.blog
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Thu, 08 Feb 2024 15:27:19 GMT
content-encoding: br
x-ac: 2.hhn _dfw BYPASS
last-modified: Wed, 07 Feb 2024 23:31:46 GMT
server: nginx
etag: W/"65c412e2-3eb"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
alt-svc: h3=":443"; ma=86400
expires: Thu, 06 Feb 2025 23:43:09 GMT

GET
H2 200 index.min.js Show response
s0.wp.com/wp-content/plugins/gutenberg-core/v17.6.4/build/element/ 11 KB
5 KB 43ms
40ms Script
application/javascript 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/wp-content/plugins/gutenberg-core/v17.6.4/build/element/index.min.js?m=1707348690i&ver=30b6834ec0d0e2c24761
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/23/applocker-bypass-rundll32/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: 6dc63fe3f880324c960483652ea9f872199ad3887e2e072e1925cb167bafa576

Request headers

Referer: https://pentestlab.blog/
Origin: https://pentestlab.blog
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Thu, 08 Feb 2024 15:27:19 GMT
content-encoding: br
x-ac: 2.hhn _dfw BYPASS
last-modified: Wed, 07 Feb 2024 23:31:45 GMT
server: nginx
etag: W/"65c412e1-2dfa"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
alt-svc: h3=":443"; ma=86400
expires: Thu, 06 Feb 2025 23:43:10 GMT

GET
H2 200 index.min.js Show response
s0.wp.com/wp-content/plugins/gutenberg-core/v17.6.4/build/is-shallow-equal/ 1021 B
846 B 44ms
41ms Script
application/javascript 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/wp-content/plugins/gutenberg-core/v17.6.4/build/is-shallow-equal/index.min.js?m=1707348690i&ver=5299ef30233b42ce5199
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/23/applocker-bypass-rundll32/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: d1250ea07224819d007acda104687b92e3a5174adacf12837fc5e9ff14021286

Request headers

Referer: https://pentestlab.blog/
Origin: https://pentestlab.blog
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Thu, 08 Feb 2024 15:27:19 GMT
content-encoding: br
x-ac: 2.hhn _dfw BYPASS
last-modified: Wed, 07 Feb 2024 23:31:45 GMT
server: nginx
etag: W/"65c412e1-3fd"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
alt-svc: h3=":443"; ma=86400
expires: Thu, 06 Feb 2025 23:43:10 GMT

GET
H2 200 index.min.js Show response
s0.wp.com/wp-content/plugins/gutenberg-core/v17.6.4/build/keycodes/ 3 KB
2 KB 44ms
41ms Script
application/javascript 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/wp-content/plugins/gutenberg-core/v17.6.4/build/keycodes/index.min.js?m=1707348690i&ver=54656f44cb3b10270813
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/23/applocker-bypass-rundll32/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: 45a05663a6bbdacc788b036380a0ee4c7b49b7bc498d8a98d8e5748b91e59030

Request headers

Referer: https://pentestlab.blog/
Origin: https://pentestlab.blog
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Thu, 08 Feb 2024 15:27:19 GMT
content-encoding: br
x-ac: 2.hhn _dfw MISS
last-modified: Wed, 07 Feb 2024 23:31:46 GMT
server: nginx
etag: W/"65c412e2-b1b"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
alt-svc: h3=":443"; ma=86400
expires: Thu, 06 Feb 2025 23:43:10 GMT

GET
H2 200 index.min.js Show response
s0.wp.com/wp-content/plugins/gutenberg-core/v17.6.4/build/priority-queue/ 3 KB
2 KB 44ms
42ms Script
application/javascript 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/wp-content/plugins/gutenberg-core/v17.6.4/build/priority-queue/index.min.js?m=1707348690i&ver=c01f24e11b08ca4aff89
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/23/applocker-bypass-rundll32/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: 96e284f53f584411c21ef89fa08219b4188014333413eef9f7de213669c25fa7

Request headers

Referer: https://pentestlab.blog/
Origin: https://pentestlab.blog
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Thu, 08 Feb 2024 15:27:19 GMT
content-encoding: br
x-ac: 2.hhn _dfw BYPASS
last-modified: Wed, 07 Feb 2024 23:31:46 GMT
server: nginx
etag: W/"65c412e2-d06"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
alt-svc: h3=":443"; ma=86400
expires: Thu, 06 Feb 2025 23:43:10 GMT

GET
H2 200 index.min.js Show response
s0.wp.com/wp-content/plugins/gutenberg-core/v17.6.4/build/compose/ 36 KB
13 KB 44ms
42ms Script
application/javascript 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/wp-content/plugins/gutenberg-core/v17.6.4/build/compose/index.min.js?m=1707348690i&ver=454f32655f7e573fedaf
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/23/applocker-bypass-rundll32/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: 330552ee73bfedc67b35584fda8afa0faaf4f23ca42db8baefd7a5b25059c969

Request headers

Referer: https://pentestlab.blog/
Origin: https://pentestlab.blog
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Thu, 08 Feb 2024 15:27:19 GMT
content-encoding: br
x-ac: 2.hhn _dfw BYPASS
last-modified: Wed, 07 Feb 2024 23:31:46 GMT
server: nginx
etag: W/"65c412e2-8f0d"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
alt-svc: h3=":443"; ma=86400
expires: Thu, 06 Feb 2025 23:43:10 GMT

GET
H2 200 index.min.js Show response
s0.wp.com/wp-content/plugins/gutenberg-core/v17.6.4/build/private-apis/ 3 KB
1 KB 44ms
42ms Script
application/javascript 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/wp-content/plugins/gutenberg-core/v17.6.4/build/private-apis/index.min.js?m=1707348690i&ver=52428a68ae244aabb6fb
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/23/applocker-bypass-rundll32/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: 466ce3f481df55d5402c2179fbfff4190e0881d9a94ab5303b4978bb123bd8db

Request headers

Referer: https://pentestlab.blog/
Origin: https://pentestlab.blog
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Thu, 08 Feb 2024 15:27:19 GMT
content-encoding: br
x-ac: 2.hhn _dfw BYPASS
last-modified: Wed, 07 Feb 2024 23:31:46 GMT
server: nginx
etag: W/"65c412e2-ad7"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
alt-svc: h3=":443"; ma=86400
expires: Thu, 06 Feb 2025 23:43:10 GMT

GET
H2 200 index.min.js Show response
s0.wp.com/wp-content/plugins/gutenberg-core/v17.6.4/build/redux-routine/ 9 KB
3 KB 45ms
42ms Script
application/javascript 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/wp-content/plugins/gutenberg-core/v17.6.4/build/redux-routine/index.min.js?m=1707348690i&ver=786aeb57a8ae5605915c
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/23/applocker-bypass-rundll32/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: 97cc56205ee842e64adc7912cb7e86c6b31a90ba065cf46009c09bca05293059

Request headers

Referer: https://pentestlab.blog/
Origin: https://pentestlab.blog
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Thu, 08 Feb 2024 15:27:19 GMT
content-encoding: br
x-ac: 2.hhn _dfw BYPASS
last-modified: Wed, 07 Feb 2024 23:31:46 GMT
server: nginx
etag: W/"65c412e2-2207"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
alt-svc: h3=":443"; ma=86400
expires: Thu, 06 Feb 2025 23:43:10 GMT

GET
H2 200 index.min.js Show response
s0.wp.com/wp-content/plugins/gutenberg-core/v17.6.4/build/data/ 26 KB
9 KB 45ms
43ms Script
application/javascript 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/wp-content/plugins/gutenberg-core/v17.6.4/build/data/index.min.js?m=1707348690i&ver=8cafd24092cef7bf9436
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/23/applocker-bypass-rundll32/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: 81c14677193331d086999b1a5ba914e351f3be194e9fe4dbc6fc7af67808d0a5

Request headers

Referer: https://pentestlab.blog/
Origin: https://pentestlab.blog
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Thu, 08 Feb 2024 15:27:19 GMT
content-encoding: br
x-ac: 2.hhn _dfw BYPASS
last-modified: Wed, 07 Feb 2024 23:31:46 GMT
server: nginx
etag: W/"65c412e2-6808"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
alt-svc: h3=":443"; ma=86400
expires: Thu, 06 Feb 2025 23:43:10 GMT

GET
H2 200 index.min.js Show response
s0.wp.com/wp-content/plugins/gutenberg-core/v17.6.4/build/html-entities/ 791 B
754 B 45ms
43ms Script
application/javascript 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/wp-content/plugins/gutenberg-core/v17.6.4/build/html-entities/index.min.js?m=1707348690i&ver=e9ce7ebd2e4bd93c7be1
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/23/applocker-bypass-rundll32/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: a37ef75bef9c0b9ca67220a826fad8761b880347fbb763c56d38834eb1c5a302

Request headers

Referer: https://pentestlab.blog/
Origin: https://pentestlab.blog
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Thu, 08 Feb 2024 15:27:19 GMT
content-encoding: br
x-ac: 2.hhn _dfw BYPASS
last-modified: Wed, 07 Feb 2024 23:31:46 GMT
server: nginx
etag: W/"65c412e2-317"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
alt-svc: h3=":443"; ma=86400
expires: Thu, 06 Feb 2025 23:43:10 GMT

GET
H2 200 index.min.js Show response
s0.wp.com/wp-content/plugins/gutenberg-core/v17.6.4/build/dom-ready/ 460 B
782 B 45ms
43ms Script
application/javascript 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/wp-content/plugins/gutenberg-core/v17.6.4/build/dom-ready/index.min.js?m=1707348690i&ver=222ad38e3e5e302c8bbf
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/23/applocker-bypass-rundll32/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: 52d995270969aed722e4e20184d2d424f0e1afb1040ef2273549bf0ba7c75d07

Request headers

Referer: https://pentestlab.blog/
Origin: https://pentestlab.blog
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Thu, 08 Feb 2024 15:27:19 GMT
x-ac: 2.hhn _dfw BYPASS
last-modified: Wed, 07 Feb 2024 23:31:46 GMT
server: nginx
etag: "65c412e2-1cc"
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=86400
content-length: 460
expires: Thu, 06 Feb 2025 23:43:09 GMT

GET
H2 200 index.min.js Show response
s0.wp.com/wp-content/plugins/gutenberg-core/v17.6.4/build/a11y/ 2 KB
1 KB 45ms
43ms Script
application/javascript 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/wp-content/plugins/gutenberg-core/v17.6.4/build/a11y/index.min.js?m=1707348690i&ver=9061ce25a6ee8a006b52
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/23/applocker-bypass-rundll32/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: 729cb114db2bc898ebd76af066a49a76432f8ad984505e6ecfcfbc37672813cf

Request headers

Referer: https://pentestlab.blog/
Origin: https://pentestlab.blog
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Thu, 08 Feb 2024 15:27:19 GMT
content-encoding: br
x-ac: 2.hhn _dfw BYPASS
last-modified: Wed, 07 Feb 2024 23:31:45 GMT
server: nginx
etag: W/"65c412e1-939"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
alt-svc: h3=":443"; ma=86400
expires: Thu, 06 Feb 2025 23:43:10 GMT

GET
H2 200 index.min.js Show response
s0.wp.com/wp-content/plugins/gutenberg-core/v17.6.4/build/rich-text/ 30 KB
11 KB 45ms
44ms Script
application/javascript 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/wp-content/plugins/gutenberg-core/v17.6.4/build/rich-text/index.min.js?m=1707348690i&ver=e664ffc13430770f8e20
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/23/applocker-bypass-rundll32/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: 667b4d451abe29c658488b1d4df14793babb73b00a72cca8052447eea242cae7

Request headers

Referer: https://pentestlab.blog/
Origin: https://pentestlab.blog
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Thu, 08 Feb 2024 15:27:19 GMT
content-encoding: br
x-ac: 2.hhn _dfw MISS
last-modified: Wed, 07 Feb 2024 23:31:46 GMT
server: nginx
etag: W/"65c412e2-78ae"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
alt-svc: h3=":443"; ma=86400
expires: Thu, 06 Feb 2025 23:43:10 GMT

GET
H2 200 index.min.js Show response
s0.wp.com/wp-content/plugins/gutenberg-core/v17.6.4/build/shortcode/ 3 KB
2 KB 46ms
44ms Script
application/javascript 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/wp-content/plugins/gutenberg-core/v17.6.4/build/shortcode/index.min.js?m=1707348690i&ver=76f6ae4ad6804e0c13db
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/23/applocker-bypass-rundll32/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: 91d0022cd0ba8821088854f4e21f21ddf56c1b1017446ca6189ff7bf593e2b72

Request headers

Referer: https://pentestlab.blog/
Origin: https://pentestlab.blog
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Thu, 08 Feb 2024 15:27:19 GMT
content-encoding: br
x-ac: 2.hhn _dfw BYPASS
last-modified: Wed, 07 Feb 2024 23:31:46 GMT
server: nginx
etag: W/"65c412e2-b57"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
alt-svc: h3=":443"; ma=86400
expires: Thu, 06 Feb 2025 23:43:10 GMT

GET
H2 200 index.min.js Show response
s0.wp.com/wp-content/plugins/gutenberg-core/v17.6.4/build/blocks/ 161 KB
52 KB 46ms
44ms Script
application/javascript 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/wp-content/plugins/gutenberg-core/v17.6.4/build/blocks/index.min.js?m=1707348690i&ver=e379b584e44b53e69421
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/23/applocker-bypass-rundll32/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: e395e619d3151c852bf9c05ecdad5c3099fcffedd19343618468a224a105492b

Request headers

Referer: https://pentestlab.blog/
Origin: https://pentestlab.blog
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Thu, 08 Feb 2024 15:27:19 GMT
content-encoding: br
x-ac: 2.hhn _dfw MISS
last-modified: Wed, 07 Feb 2024 23:31:46 GMT
server: nginx
etag: W/"65c412e2-283f5"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
alt-svc: h3=":443"; ma=86400
expires: Thu, 06 Feb 2025 23:43:10 GMT

GET
H2 200 / Show response
s0.wp.com/_static/ 30 KB
11 KB 46ms
44ms Script
application/javascript 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/_static/??-eJydjkEKAjEMRS9kjTpIV+JRpM3UITNtE5p2en27cCWC4PLBf48PXQxyriFXSM1IbAtlBSzcZ6Ulu2ieXJKCbxRncCLRNQ3HVQ/wXV1DFYfbm0FbhgdlBB8ZNx3sFQtJJR7jnUL/v1WCBFfNTkqVy68YusLjejRdkNMHDu+ebmd7stN0sdN1fQE/7WnB
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/23/applocker-bypass-rundll32/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: bb7e1d078ab58cc492068b9ec67be2bf234676e618b211dab57666721476d0c6

Request headers

Referer: https://pentestlab.blog/
Origin: https://pentestlab.blog
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Thu, 08 Feb 2024 15:27:19 GMT
content-encoding: br
x-ac: 2.hhn _dfw BYPASS
last-modified: Wed, 07 Feb 2024 19:05:44 GMT
server: nginx
etag: W/"65c3d488-76b1"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
alt-svc: h3=":443"; ma=86400
expires: Thu, 06 Feb 2025 19:56:20 GMT

GET
H2 200 rating.js Show response
polldaddy.com/js/rating/ 16 KB
5 KB 540ms
172ms Script
application/javascript 192.0.123.248
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://polldaddy.com/js/rating/rating.js?ver=13.2-a.0
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/23/applocker-bypass-rundll32/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.123.248 Los Angeles, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: polldaddy.com
Software: nginx /
Resource Hash: bdb75e08b4b1eedee2847c2eafacc3089842b8735f7c6d4e99aedcb6ba828e55

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pentestlab.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 15:27:20 GMT
content-encoding: br
last-modified: Thu, 14 Dec 2023 16:20:43 GMT
server: nginx
etag: W/"657b2b5b-3fc5"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000
alt-svc: h3=":443"; ma=86400
expires: Sat, 09 Mar 2024 15:27:20 GMT

GET
H2 200 sharing.min.js Show response
s0.wp.com/wp-content/mu-plugins/jetpack-plugin/sun/_inc/build/sharedaddy/ 9 KB
3 KB 46ms
45ms Script
application/javascript 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/wp-content/mu-plugins/jetpack-plugin/sun/_inc/build/sharedaddy/sharing.min.js?m=1685112397i
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/23/applocker-bypass-rundll32/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: 9e1dae23d3ad3212f67d09ca79a50003c32953c36bab976f634c9b38d8a8c6dc

Request headers

Referer: https://pentestlab.blog/
Origin: https://pentestlab.blog
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Thu, 08 Feb 2024 15:27:19 GMT
content-encoding: br
x-ac: 2.hhn _dfw BYPASS
last-modified: Fri, 26 May 2023 14:46:54 GMT
server: nginx
etag: W/"6470c65e-2259"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
alt-svc: h3=":443"; ma=86400
expires: Thu, 30 May 2024 20:22:46 GMT

GET
H2 200 w.js Show response
stats.wp.com/ 12 KB
5 KB 80ms
12ms Script
application/javascript 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.wp.com/w.js?67
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/23/applocker-bypass-rundll32/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 79674b01741c3978417b6b9b4b98d125755e7bb468979d5cd593eac4b94cdb91

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pentestlab.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

x-minify-cache: hit
x-nc: HIT hhn
date: Thu, 08 Feb 2024 15:27:19 GMT
content-encoding: br
server: nginx
x-minify: t
etag: W/12827-1705538370042.3745
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
alt-svc: h3=":443"; ma=86400
expires: Fri, 17 Jan 2025 00:39:37 GMT

GET
H2 200 css
fonts-api.wp.com/ 7 KB
1 KB 38ms
38ms Stylesheet
text/css 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts-api.wp.com/css?family=Ubuntu:r,i,b,bi%7CUbuntu:r&subset=latin,latin-ext,latin,latin-ext

Requested by

Host: s0.wp.com
URL: https://s0.wp.com/wp-content/plugins/custom-fonts/js/webfont.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

6e57606e03b2f8286e7343da02403a66a52cc44d9406dd0387e5bacf4264bf05

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pentestlab.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 15:27:19 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-encoding: gzip
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-xss-protection: 0
x-nc: BYPASS hhn 2
last-modified: Thu, 08 Feb 2024 15:27:19 GMT
server: nginx
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding, Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin

GET
H2 200 4iCs6KVjbNBYlgoKfw72.woff2
fonts.wp.com/s/ubuntu/v20/ 34 KB
34 KB 25ms
18ms Font
font/woff2 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.wp.com/s/ubuntu/v20/4iCs6KVjbNBYlgoKfw72.woff2

Requested by

Host: fonts-api.wp.com
URL: https://fonts-api.wp.com/css?family=Ubuntu:r,i,b,bi%7CUbuntu:r&subset=latin,latin-ext,latin,latin-ext

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

7f653b3ce9d3277457fc6da4edb246ae2f6c913f088c42dcb8cd2e96267aa21a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts-api.wp.com/
Origin: https://pentestlab.blog
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Thu, 08 Feb 2024 15:27:19 GMT
x-content-type-options: nosniff
last-modified: Wed, 27 Apr 2022 16:31:23 GMT
server: nginx
age: 273448
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=86400
content-length: 34852
x-xss-protection: 0

GET
H2 200 4iCu6KVjbNBYlgoKej70l0k.woff2
fonts.wp.com/s/ubuntu/v20/ 36 KB
36 KB 24ms
18ms Font
font/woff2 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.wp.com/s/ubuntu/v20/4iCu6KVjbNBYlgoKej70l0k.woff2

Requested by

Host: fonts-api.wp.com
URL: https://fonts-api.wp.com/css?family=Ubuntu:r,i,b,bi%7CUbuntu:r&subset=latin,latin-ext,latin,latin-ext

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

af186659e415490e7eee1bd3c8d511771dbd3e03ddbebf6b6a5096ac8ba29449

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts-api.wp.com/
Origin: https://pentestlab.blog
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Thu, 08 Feb 2024 15:27:19 GMT
x-content-type-options: nosniff
last-modified: Wed, 27 Apr 2022 16:13:13 GMT
server: nginx
age: 378733
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=86400
content-length: 36564
x-xss-protection: 0

GET
H2 200 4iCv6KVjbNBYlgoCxCvjsGyN.woff2
fonts.wp.com/s/ubuntu/v20/ 29 KB
29 KB 24ms
17ms Font
font/woff2 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.wp.com/s/ubuntu/v20/4iCv6KVjbNBYlgoCxCvjsGyN.woff2

Requested by

Host: fonts-api.wp.com
URL: https://fonts-api.wp.com/css?family=Ubuntu:r,i,b,bi%7CUbuntu:r&subset=latin,latin-ext,latin,latin-ext

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

7c00752ce82d6abaed0b9766d35b906b16675facdbe24115b410d1fab975effa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts-api.wp.com/
Origin: https://pentestlab.blog
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Thu, 08 Feb 2024 15:27:19 GMT
x-content-type-options: nosniff
last-modified: Wed, 27 Apr 2022 17:05:11 GMT
server: nginx
age: 360437
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=86400
content-length: 29752
x-xss-protection: 0

GET
H2 200 4iCp6KVjbNBYlgoKejZPslyPN4E.woff2
fonts.wp.com/s/ubuntu/v20/ 30 KB
30 KB 32ms
25ms Font
font/woff2 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.wp.com/s/ubuntu/v20/4iCp6KVjbNBYlgoKejZPslyPN4E.woff2

Requested by

Host: fonts-api.wp.com
URL: https://fonts-api.wp.com/css?family=Ubuntu:r,i,b,bi%7CUbuntu:r&subset=latin,latin-ext,latin,latin-ext

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

26918e4295cab1eaecebc5d4719c212691f040bfe31daf0c7caf08f7a0de520a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts-api.wp.com/
Origin: https://pentestlab.blog
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Thu, 08 Feb 2024 15:27:19 GMT
x-content-type-options: nosniff
last-modified: Wed, 27 Apr 2022 16:08:03 GMT
server: nginx
age: 569732
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=86400
content-length: 30660
x-xss-protection: 0

GET
H2 200 header.jpg
s0.wp.com/wp-content/themes/premium/thefour/img/ 200 KB
200 KB 23ms
22ms Image
image/jpeg 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s0.wp.com/wp-content/themes/premium/thefour/img/header.jpg
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/23/applocker-bypass-rundll32/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: 1f16434d944a6e996c5b5bf08d9061ee33eaf68dbd2f4f8f786e159f7dc5cae6

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pentestlab.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Thu, 08 Feb 2024 15:27:19 GMT
x-ac: 2.hhn _dca MISS
last-modified: Fri, 19 May 2023 01:54:59 GMT
server: nginx
etag: "6466d6f3-31e2d"
access-control-allow-methods: GET, HEAD
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=86400
content-length: 204333
expires: Sat, 09 Nov 2024 15:44:37 GMT

GET
DATA 200
OK truncated
/ 7 KB
7 KB Font
application/octet-stream

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 70c44a9df364a5e5779a64d3b6bace4a0939ad6649859f59e30d4df5bbfbf7d6

Request headers

Referer
Origin: https://pentestlab.blog
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Content-Type: application/octet-stream

GET
H3 200 fontawesome-webfont.woff2
s0.wp.com/wp-content/themes/premium/thefour/fonts/ 70 KB
71 KB 22ms
20ms Font
application/font-woff2 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/wp-content/themes/premium/thefour/fonts/fontawesome-webfont.woff2?v=4.6.3
Requested by: Host: s0.wp.com
URL: https://s0.wp.com/_static/??-eJzTLy/QTc7PK0nNK9EvyUjNTS3WLyhKzc0szQVx0/JLi/STi4v104BKdBPLU4vzc1P1gAI6+oT1FZdU5oAV2+faGpoZG5gamBsammYBAMXNKeE=&cssminify=yes
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: 7dacf83f51179de8d7980a513e67ab3a08f2c6272bb5946df8fd77c0d1763b73

Request headers

Referer: https://s0.wp.com/_static/??-eJzTLy/QTc7PK0nNK9EvyUjNTS3WLyhKzc0szQVx0/JLi/STi4v104BKdBPLU4vzc1P1gAI6+oT1FZdU5oAV2+faGpoZG5gamBsammYBAMXNKeE=&cssminify=yes
Origin: https://pentestlab.blog
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Thu, 08 Feb 2024 15:27:19 GMT
x-ac: 2.hhn _dfw MISS
last-modified: Fri, 19 May 2023 03:03:26 GMT
server: nginx
etag: "6466e6fe-118d8"
access-control-allow-methods: GET, HEAD
content-type: application/font-woff2
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=86400
content-length: 71896
expires: Sat, 09 Nov 2024 15:45:17 GMT

GET
H2 200 9161b274d6d350683293f1e03d228985ac0ff6ac6c89353f4b6bd1a7bc69daf4
0.gravatar.com/avatar/ 2 KB
3 KB 20ms
18ms Image
image/png 192.0.73.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://0.gravatar.com/avatar/9161b274d6d350683293f1e03d228985ac0ff6ac6c89353f4b6bd1a7bc69daf4?s=32&d=identicon&r=G
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/23/applocker-bypass-rundll32/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.73.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 7d5f6f7d593191e51c8211ccee54ec6b5425e3f5ae5da264eb56f7c1a8cbd630

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pentestlab.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Thu, 08 Feb 2024 15:27:19 GMT
last-modified: Sun, 19 Nov 2023 17:53:28 GMT
server: nginx
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=300
content-disposition: inline; filename="9161b274d6d350683293f1e03d228985ac0ff6ac6c89353f4b6bd1a7bc69daf4.png"
accept-ranges: bytes
link: <https://gravatar.com/avatar/9161b274d6d350683293f1e03d228985ac0ff6ac6c89353f4b6bd1a7bc69daf4?s=32&d=identicon&r=G>; rel="canonical"
content-length: 2556
alt-svc: h3=":443"; ma=86400
expires: Thu, 08 Feb 2024 15:32:19 GMT

GET
H2 200 msfvenom-dll-generation.png
pentestlab.files.wordpress.com/2017/05/ 87 KB
88 KB 6318ms
20ms Image
image/webp 192.0.72.29
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pentestlab.files.wordpress.com/2017/05/msfvenom-dll-generation.png

Requested by

Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/23/applocker-bypass-rundll32/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.72.29 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

9dd529e41550eb0e0e7bd092733e0a2077d73ed42012d224691fb5795067633e

Security Headers

Name	Value
X-Content-Type-Options	nosniff, nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pentestlab.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

x-nc: HIT hhn 29 np
date: Thu, 08 Feb 2024 15:27:26 GMT
x-content-type-options: nosniff, nosniff
last-modified: Sun, 21 May 2017 03:33:02 GMT
server: nginx
x-orig-src: 0_imageresize
vary: Accept, Origin
content-type: image/webp
access-control-allow-origin: https://pentestlab.wordpress.com
access-control-allow-credentials: true
accept-ranges: bytes
alt-svc: h3=":443"; ma=86400
content-length: 89338
expires: Mon, 04 Mar 2024 16:25:02 GMT

GET
H2 200 rundll32-injecting-dll-into-a-process.png
pentestlab.files.wordpress.com/2017/05/ 9 KB
9 KB 6322ms
24ms Image
image/webp 192.0.72.29
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pentestlab.files.wordpress.com/2017/05/rundll32-injecting-dll-into-a-process.png

Requested by

Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/23/applocker-bypass-rundll32/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.72.29 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

827bdaf48b181c80b5496d87940a85c95922cc5db5b607abf10921e3f111fef2

Security Headers

Name	Value
X-Content-Type-Options	nosniff, nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pentestlab.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

x-nc: HIT hhn 29 np
date: Thu, 08 Feb 2024 15:27:26 GMT
x-content-type-options: nosniff, nosniff
last-modified: Sun, 21 May 2017 03:35:50 GMT
server: nginx
x-orig-src: 0_imageresize
vary: Accept, Origin
content-type: image/webp
access-control-allow-origin: https://pentestlab.wordpress.com
access-control-allow-credentials: true
accept-ranges: bytes
alt-svc: h3=":443"; ma=86400
content-length: 8964
expires: Wed, 06 Mar 2024 02:49:41 GMT

GET
H2 200 rundll32-meterpreter.png
pentestlab.files.wordpress.com/2017/05/ 58 KB
58 KB 6317ms
19ms Image
image/webp 192.0.72.29
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pentestlab.files.wordpress.com/2017/05/rundll32-meterpreter.png

Requested by

Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/23/applocker-bypass-rundll32/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.72.29 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

ab01ed125c97e2e3734e17725ca293d58ce40e0909181b2079b91e84724463fc

Security Headers

Name	Value
X-Content-Type-Options	nosniff, nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pentestlab.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

x-nc: HIT hhn 29 np
date: Thu, 08 Feb 2024 15:27:26 GMT
x-content-type-options: nosniff, nosniff
last-modified: Sun, 21 May 2017 03:37:05 GMT
server: nginx
x-orig-src: 0_imageresize
vary: Accept, Origin
content-type: image/webp
access-control-allow-origin: https://pentestlab.wordpress.com
access-control-allow-credentials: true
accept-ranges: bytes
alt-svc: h3=":443"; ma=86400
content-length: 59390
expires: Fri, 09 Feb 2024 16:04:23 GMT

GET
H2 200 applocker-command-prompt-blocked.png
pentestlab.files.wordpress.com/2017/05/ 26 KB
26 KB 6317ms
20ms Image
image/webp 192.0.72.29
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pentestlab.files.wordpress.com/2017/05/applocker-command-prompt-blocked.png

Requested by

Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/23/applocker-bypass-rundll32/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.72.29 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

8fd02bc4739cd3ef196dd0fb17bec22a1edc93aa4b56b014374bf79b2bb560b0

Security Headers

Name	Value
X-Content-Type-Options	nosniff, nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pentestlab.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

x-nc: HIT hhn 29 np
date: Thu, 08 Feb 2024 15:27:26 GMT
x-content-type-options: nosniff, nosniff
last-modified: Sun, 21 May 2017 03:05:23 GMT
server: nginx
x-orig-src: 0_imageresize
vary: Accept, Origin
content-type: image/webp
access-control-allow-origin: https://pentestlab.wordpress.com
access-control-allow-credentials: true
accept-ranges: bytes
alt-svc: h3=":443"; ma=86400
content-length: 26204
expires: Sat, 17 Feb 2024 17:37:10 GMT

GET
H3 200 rundll32-dll-loading-entry-point.png
pentestlab.files.wordpress.com/2017/05/ 74 B
0 330ms
329ms Image
image/webp 192.0.72.29
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pentestlab.files.wordpress.com/2017/05/rundll32-dll-loading-entry-point.png

Requested by

Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/23/applocker-bypass-rundll32/

Protocol

Security

QUIC, , AES_128_GCM

Server

192.0.72.29 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff, nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pentestlab.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

x-nc: HIT hhn 29 np
date: Thu, 08 Feb 2024 15:27:19 GMT
x-content-type-options: nosniff, nosniff
last-modified: Sun, 21 May 2017 03:10:47 GMT
server: nginx
x-orig-src: 0_imageresize
vary: Accept, Origin
content-type: image/webp
access-control-allow-origin: https://pentestlab.wordpress.com
access-control-allow-credentials: true
accept-ranges: bytes
alt-svc: h3=":443"; ma=86400
content-length: 10858
expires: Mon, 18 Mar 2024 09:52:21 GMT

GET
H3 200 rundll32-dll-loading-control-run.png
pentestlab.files.wordpress.com/2017/05/ 1007 B
0 39ms
39ms Image
image/webp 192.0.72.29
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pentestlab.files.wordpress.com/2017/05/rundll32-dll-loading-control-run.png

Requested by

Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/23/applocker-bypass-rundll32/

Protocol

Security

QUIC, , AES_128_GCM

Server

192.0.72.29 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff, nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pentestlab.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

x-nc: HIT hhn 29 np
date: Thu, 08 Feb 2024 15:27:19 GMT
x-content-type-options: nosniff, nosniff
last-modified: Sun, 21 May 2017 03:12:09 GMT
server: nginx
x-orig-src: 0_imageresize
vary: Accept, Origin
content-type: image/webp
access-control-allow-origin: https://pentestlab.wordpress.com
access-control-allow-credentials: true
accept-ranges: bytes
alt-svc: h3=":443"; ma=86400
content-length: 10924
expires: Tue, 27 Feb 2024 12:40:03 GMT

GET
H2 200 rundll32-command-prompt.png
pentestlab.files.wordpress.com/2017/05/ 7 KB
8 KB 6317ms
20ms Image
image/webp 192.0.72.29
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pentestlab.files.wordpress.com/2017/05/rundll32-command-prompt.png

Requested by

Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/23/applocker-bypass-rundll32/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.72.29 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

20a2b18486c72f19319a049a2f5b04ec86aaf9a4cfe31c192b492805e84e5d82

Security Headers

Name	Value
X-Content-Type-Options	nosniff, nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pentestlab.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

x-nc: HIT hhn 29 np
date: Thu, 08 Feb 2024 15:27:26 GMT
x-content-type-options: nosniff, nosniff
last-modified: Sun, 21 May 2017 03:18:37 GMT
server: nginx
x-orig-src: 0_imageresize
vary: Accept, Origin
content-type: image/webp
access-control-allow-origin: https://pentestlab.wordpress.com
access-control-allow-credentials: true
accept-ranges: bytes
alt-svc: h3=":443"; ma=86400
content-length: 7662
expires: Sat, 17 Feb 2024 23:34:04 GMT

GET
H2 200 applocker-registry-blocked.png
pentestlab.files.wordpress.com/2017/05/ 23 KB
23 KB 6322ms
25ms Image
image/webp 192.0.72.29
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pentestlab.files.wordpress.com/2017/05/applocker-registry-blocked.png

Requested by

Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/23/applocker-bypass-rundll32/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.72.29 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

c85d2c2b820baac9404cb871788528e176b6e14d0b829c1caafc75dcf6234015

Security Headers

Name	Value
X-Content-Type-Options	nosniff, nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pentestlab.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

x-nc: HIT hhn 29 np
date: Thu, 08 Feb 2024 15:27:26 GMT
x-content-type-options: nosniff, nosniff
last-modified: Sun, 21 May 2017 09:56:07 GMT
server: nginx
x-orig-src: 0_imageresize
vary: Accept, Origin
content-type: image/webp
access-control-allow-origin: https://pentestlab.wordpress.com
access-control-allow-credentials: true
accept-ranges: bytes
alt-svc: h3=":443"; ma=86400
content-length: 23078
expires: Sun, 25 Feb 2024 05:23:52 GMT

GET
H3 200 applocker-rundll32-registry.png
pentestlab.files.wordpress.com/2017/05/ 2 KB
0 40ms
40ms Image
image/webp 192.0.72.29
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pentestlab.files.wordpress.com/2017/05/applocker-rundll32-registry.png

Requested by

Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/23/applocker-bypass-rundll32/

Protocol

Security

QUIC, , AES_128_GCM

Server

192.0.72.29 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff, nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pentestlab.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

x-nc: HIT hhn 29 np
date: Thu, 08 Feb 2024 15:27:19 GMT
x-content-type-options: nosniff, nosniff
last-modified: Sun, 21 May 2017 10:05:01 GMT
server: nginx
x-orig-src: 0_imageresize
vary: Accept, Origin
content-type: image/webp
access-control-allow-origin: https://pentestlab.wordpress.com
access-control-allow-credentials: true
accept-ranges: bytes
alt-svc: h3=":443"; ma=86400
content-length: 10808
expires: Sat, 09 Mar 2024 07:24:11 GMT

GET
H2 200 applocker-registry-unlocked.png
pentestlab.files.wordpress.com/2017/05/ 7 KB
7 KB 6321ms
24ms Image
image/webp 192.0.72.29
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pentestlab.files.wordpress.com/2017/05/applocker-registry-unlocked.png

Requested by

Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/23/applocker-bypass-rundll32/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.72.29 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

77613b7e0fb9a0c71ec67d7f91e6e6234c7147710ccc3c40d4cf2f2e68105394

Security Headers

Name	Value
X-Content-Type-Options	nosniff, nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pentestlab.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

x-nc: HIT hhn 29 np
date: Thu, 08 Feb 2024 15:27:26 GMT
x-content-type-options: nosniff, nosniff
last-modified: Sun, 21 May 2017 10:06:07 GMT
server: nginx
x-orig-src: 0_imageresize
vary: Accept, Origin
content-type: image/webp
access-control-allow-origin: https://pentestlab.wordpress.com
access-control-allow-credentials: true
accept-ranges: bytes
alt-svc: h3=":443"; ma=86400
content-length: 7122
expires: Thu, 29 Feb 2024 18:46:33 GMT

GET
H3 200 shCore.css
s0.wp.com/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/styles/ 5 KB
1 KB 19ms
19ms Stylesheet
text/css 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/styles/shCore.css?ver=3.0.9b
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/23/applocker-bypass-rundll32/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: 93111ec228b7cde5000f4062ac113d5c56c77b2a7ccc4ab3b6ceaf97fe340e37

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pentestlab.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

x-minify-cache: hit
date: Thu, 08 Feb 2024 15:27:19 GMT
content-encoding: br
x-ac: 2.hhn _dca MISS
x-minify: t
alt-svc: h3=":443"; ma=86400
x-nc: HIT hhn 1
server: nginx
etag: W/6813-1684465053565.153
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
expires: Sat, 09 Nov 2024 15:12:43 GMT

GET
H3 200 shThemeDefault.css
s0.wp.com/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/styles/ 2 KB
717 B 21ms
20ms Stylesheet
text/css 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/styles/shThemeDefault.css?m=1363304414i&ver=3.0.9b
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/23/applocker-bypass-rundll32/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: 8f892de7bd3f42587028e9a8ddd9d01c6923f3947e657710ef40a2407e718de6

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pentestlab.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

x-minify-cache: miss
date: Thu, 08 Feb 2024 15:27:19 GMT
content-encoding: br
x-ac: 2.hhn _dca MISS
x-minify: t
alt-svc: h3=":443"; ma=86400
x-nc: HIT hhn 1
server: nginx
etag: W/2877-1684465075125.5054
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
expires: Thu, 30 May 2024 20:22:47 GMT

GET
H2 200 sdk.js Show response
connect.facebook.net/en_US/ 3 KB
3 KB 367ms
22ms Script
application/x-javascript 157.240.251.9
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/sdk.js

Requested by

Host: s0.wp.com
URL: https://s0.wp.com/_static/??-eJydkNFqwzAMRX9ojjLyUPow9ilDsZVWiWV7lt3Sv6+7NmOQwsaejK6Ory4XzsnYGAqFAlJN8vXAQcHzQgqflSodMThPuZv1BZ7DM5WEdjFNOicb5bEArQFOFFzMgLVEwVLYbmjQbGGs7F2D81ilnRBpJxRQldrjLgGFrfER3TZIOZK0rCmTcJXbOMWaYVYIeOIDFo7h73/UZk5l5TlYX10j2+aRymRK/tIJb0yfNPKjiI/mBRNaGmNcDMlI7h8G954s5liV/De2Cr/EwoVVqJih6+92qzDlL/iW6F3eXnf9btj3/X6Yr/u4y/0=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

157.240.251.9 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-01-fra5.fbcdn.net

Software

Resource Hash

5b79797e7ed1fce279c7f76f77db1e5dcc2022043eeee8ced5a7a3c9fd2061ce

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pentestlab.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

permissions-policy-report-only: autoplay=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(), picture-in-picture=(), xr-spatial-tracking=();report-to="permissions_policy"
strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
date: Thu, 08 Feb 2024 15:27:20 GMT
content-md5: muWhds3Yys9m3TnzBOAokA==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 1688
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-debug: DlEvTmGhSddRTHvMxpF45eexzb3gL7VQvzAeFR8082cUmKSaq4DXTrB6QJNRHCMfGIWMgfsWSSQQVu7kyYyX7Q==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
x-fb-content-md5: 9afe32ef5becde3faba4d64b162e7e09
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
etag: "051b097d75eac7080c33de855e9c9d4f"
vary: Accept-Encoding
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
origin-agent-cluster: ?0
access-control-expose-headers: X-FB-Content-MD5
cache-control: public,max-age=1200,stale-while-revalidate=3600
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=();report-to="permissions_policy"
x-frame-options: DENY
timing-allow-origin: *
expires: Thu, 08 Feb 2024 15:39:58 GMT

GET
H2 200 rate.php Show response
polldaddy.com/ratings/ 1 KB
538 B 177ms
177ms Script
application/javascript 192.0.123.248
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://polldaddy.com/ratings/rate.php?cmd=get&id=5556500&uid=wp-post-6424&item_id=_post_6424
Requested by: Host: polldaddy.com
URL: https://polldaddy.com/js/rating/rating.js?ver=13.2-a.0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.123.248 Los Angeles, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: polldaddy.com
Software: nginx /
Resource Hash: affda14265425527d43df8172b113acdb4647b3ed4ec418c9fc9b0ff5b886dfd

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pentestlab.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

content-type: application/javascript
date: Thu, 08 Feb 2024 15:27:20 GMT
content-encoding: br
server: nginx
alt-svc: h3=":443"; ma=86400
vary: Accept-Encoding
content-language: en

GET
H2 200 master.html Show response
widgets.wp.com/likes/ Frame 883B 3 KB
1 KB 24ms
17ms Document
text/html 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://widgets.wp.com/likes/master.html?ver=202402081217
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/23/applocker-bypass-rundll32/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: c21754110d328a886423cc2f20ec83de38c4f5dab11006198ec8c0d409152881

Request headers

Referer: https://pentestlab.blog/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-methods: GET, HEAD
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
content-encoding: br
content-type: text/html
date: Thu, 08 Feb 2024 15:27:20 GMT
etag: W/"65c4ba71-b04"
last-modified: Thu, 08 Feb 2024 11:26:41 GMT
server: nginx
timing-allow-origin: *
vary: Accept-Encoding
x-ac: 2.hhn _dca MISS
x-nc: HIT hhn 1

GET
H2 200 g.gif
pixel.wp.com/ 50 B
177 B 34ms
19ms Image
image/gif 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.wp.com/g.gif?x_stats-initial-visibility=visible&v=wpcom-no-pv&rand=0.8841545892555243
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/23/applocker-bypass-rundll32/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pentestlab.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

access-control-allow-origin: *
date: Thu, 08 Feb 2024 15:27:20 GMT
cache-control: no-cache
server: nginx
alt-svc: h3=":443"; ma=86400
content-length: 50
content-type: image/gif

GET
H2 200 g.gif
pixel.wp.com/ 50 B
177 B 34ms
19ms Image
image/gif 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.wp.com/g.gif?blog=32637504&v=wpcom&tz=0&user_id=0&post=6424&subd=pentestlab&host=pentestlab.blog&ref=&rand=0.04766688055251511
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/23/applocker-bypass-rundll32/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pentestlab.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

access-control-allow-origin: *
date: Thu, 08 Feb 2024 15:27:20 GMT
cache-control: no-cache
server: nginx
alt-svc: h3=":443"; ma=86400
content-length: 50
content-type: image/gif

GET
H2 200 g.gif
pixel.wp.com/ 50 B
177 B 34ms
19ms Image
image/gif 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.wp.com/g.gif?crypt=UE40eW5QN0p8M2Y%2FRE1mNzc2NTVTamdsd0xoLz9RQkM2K298TXY9bERQMXc2MjhEaVZfb2wwakRoSj0mUkp1THptM1NdbkV1WjZIcU9mVWQmPUIvMlN6Jk8wW3NYVEJ3dWZOWExuWD9VW01sb1FYb1BbWjdGRC9sb0pTaVhpPWZ2M2IyL2FELmhfdExDTGlOcXY3ZUF1THxaPS1YSUpSRD9zV1UrR0ZQMmVoYnNxJlI0PSZTdjRMJltlXytoJnM3Um1ZazhRaUosN1JTbkVDfEVXY0FwcUlYLERpfC1ZYTJZT0lQQjAwW2lsMGJ3aXctRGp6NzFTLFJGeDh%2BZkNhLVhTP3QuNC51WHJEVFEyLyxuUC15W2tOVGZSV3l2bXxCfnVjdXh5R2UzNkZyWjZGVnlJeE5lTlMtWWl4MVJwZT9uYTg1TkgxbFhTdEJJd3JXQ2FyMUsvdExfZVItS3ZhOTg1RHV1LEozPw%3D%3D&v=wpcom-no-pv&rand=0.1322217954970002
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/23/applocker-bypass-rundll32/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pentestlab.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

access-control-allow-origin: *
date: Thu, 08 Feb 2024 15:27:20 GMT
cache-control: no-cache
server: nginx
alt-svc: h3=":443"; ma=86400
content-length: 50
content-type: image/gif

GET wp-emoji-release.min.js
s0.wp.com/wp-includes/js/ 0
0

GET
H2 200 / Show response
pentestlab.blog/2017/05/23/applocker-bypass-rundll32/ 4 KB
1 KB 411ms
411ms XHR
application/json 192.0.78.25
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://pentestlab.blog/2017/05/23/applocker-bypass-rundll32/?relatedposts=1

Requested by

Host: s0.wp.com
URL: https://s0.wp.com/_static/??-eJx9j01OxDAMhS9ExsCiogvEUUZpYypnEjvYzsDcniAVNCBgZb0fvU+G1xZWYUd2yAZVFioYuqHGbXiB+FkO2W7gqld7aKVvxAYZvcX1tGuwznAkXmHpVBIoluiYQhNz+64Olfjn7uBr8dBU3i6f2RgrPaF9hPmlo172cz3wZylU2nRAf6P9/8VuHc/ISRRid6nRndav8pkSSlM0278ttIDLCTksSmnDAXyqj3fTPM8P0/10m98BNEWIiQ==

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.78.25 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

9f6f66ae6c4271010315af726d5543a37e36e441d88166d10b927f9aa6fde32a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Referer: https://pentestlab.blog/2017/05/23/applocker-bypass-rundll32/
x-requested-with: XMLHttpRequest
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

x-hacker: Want root? Visit join.a8c.com/hacker and mention this header.
date: Thu, 08 Feb 2024 15:27:20 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-encoding: br
server: nginx
x-ac: 2.hhn _dfw MISS
vary: Accept-Encoding, accept, content-type
x-pingback: https://pentestlab.blog/xmlrpc.php
content-type: application/json; charset=utf-8
host-header: WordPress.com
alt-svc: h3=":443"; ma=86400

GET
H2 200 hovercards.min.css
0.gravatar.com/js/hovercards/ 3 KB
1 KB 18ms
18ms Stylesheet
text/css 192.0.73.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://0.gravatar.com/js/hovercards/hovercards.min.css?ver=202406131f6b765e798866d728f95661b78bbf269c86482ffff0fa8c08e18a1a65cc89

Requested by

Host: 0.gravatar.com
URL: https://0.gravatar.com/js/hovercards/hovercards.min.js?ver=202406131f6b765e798866d728f95661b78bbf269c86482ffff0fa8c08e18a1a65cc89

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.73.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

2bca0dae15027898dd6a7536d5b041014f928fbc60d9ce04dd2fa4c5d37d36ad

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pentestlab.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 15:27:20 GMT
strict-transport-security: max-age=31536000; includeSubdomains; preload
content-encoding: br
last-modified: Wed, 11 Oct 2023 03:50:13 GMT
server: nginx
etag: W/"65261b75-d5d"
content-type: text/css
cache-control: max-age=604800
alt-svc: h3=":443"; ma=86400
expires: Thu, 15 Feb 2024 15:27:20 GMT

GET
H2 200 count.json Show response
api.pinterest.com/v1/urls/ 118 B
386 B 167ms
120ms Script
application/javascript 151.101.64.84
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://api.pinterest.com/v1/urls/count.json?callback=WPCOMSharing.update_pinterest_count&url=https%3A%2F%2Fpentestlab.blog%2F2017%2F05%2F23%2Fapplocker-bypass-rundll32%2F

Requested by

Host: s0.wp.com
URL: https://s0.wp.com/wp-content/mu-plugins/jetpack-plugin/sun/_inc/build/sharedaddy/sharing.min.js?m=1685112397i

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.64.84 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

2285a97500effc1081e0d427ed0dc7befbd4499a94a9d34ece861ed2163f3e0a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pentestlab.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 15:27:20 GMT
x-content-type-options: nosniff
x-cdn: fastly
age: 0
content-type: application/javascript
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
x-envoy-upstream-service-time: 1
alt-svc: h3=":443";ma=600
x-pinterest-rid: 4848901139845900
content-length: 118
expires: Thu, 08 Feb 2024 15:42:20 GMT

GET
H2 200 g.gif
pixel.wp.com/ 50 B
177 B 31ms
18ms Image
image/gif 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.wp.com/g.gif?v=wpcom-no-pv&x_sharing-count-request=pinterest&r=0.7979146100962791
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/23/applocker-bypass-rundll32/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pentestlab.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

access-control-allow-origin: *
date: Thu, 08 Feb 2024 15:27:20 GMT
cache-control: no-cache
server: nginx
alt-svc: h3=":443"; ma=86400
content-length: 50
content-type: image/gif

GET
H2 200 remote-login.php Show response
r-login.wordpress.com/ Frame 39C7 125 B
373 B 212ms
159ms Document
text/html 192.0.78.19
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://r-login.wordpress.com/remote-login.php?wpcom_remote_login=key&origin=aHR0cHM6Ly9wZW50ZXN0bGFiLmJsb2c%3D&wpcomid=32637504&time=1707406039

Requested by

Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/23/applocker-bypass-rundll32/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.78.19 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

abd210a1d68ca64fcf3b6de42a292f5d1f17a8e7856e4489389ca1c1e6ab05c2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://pentestlab.blog/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache, must-revalidate, max-age=0
content-encoding: br
content-type: text/html; charset=utf-8
date: Thu, 08 Feb 2024 15:27:20 GMT
expires: Wed, 11 Jan 1984 05:00:00 GMT
server: nginx
strict-transport-security: max-age=31536000
vary: Accept-Encoding Cookie
x-ac: 1.hhn _dfw MISS

GET
H2 200 sdk.js Show response
connect.facebook.net/en_US/ 297 KB
87 KB 666ms
22ms Script
application/x-javascript 157.240.251.9
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/sdk.js?hash=a8273f9b0353f6cbacf694979277689b

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/sdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

157.240.251.9 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-01-fra5.fbcdn.net

Software

Resource Hash

e1d116c460927f272f88ce15f929ebb059a6542431b58d8feaa785a7665ca846

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://pentestlab.blog/
Origin: https://pentestlab.blog
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

permissions-policy-report-only: autoplay=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(), picture-in-picture=(), xr-spatial-tracking=();report-to="permissions_policy"
strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
date: Thu, 08 Feb 2024 15:27:20 GMT
content-md5: A1Tqz/FkuRpFu0uzKEh4MA==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 87005
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-debug: lUwjzhaZo55BTcp6pjBaGxyIfj2kXg36c4kp4EzBvHvDNw4ItAPUcXLYwvgIDD9eWFpGFvS02l27id8LakJQgw==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
x-fb-content-md5: e5111f47cc1f0e8b68baa16457447a21
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
etag: "187383f90647bf4a692b62f3b10fea17"
vary: Accept-Encoding
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
origin-agent-cluster: ?0
access-control-expose-headers: X-FB-Content-MD5
cache-control: public,max-age=31536000,stale-while-revalidate=3600,immutable
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=();report-to="permissions_policy"
x-frame-options: DENY
timing-allow-origin: *
expires: Fri, 07 Feb 2025 12:32:59 GMT

GET rlt-proxy.js
s0.wp.com/wp-content/js/ Frame 883B 0
0

GET /
s0.wp.com/_static/ Frame 883B 0
0

GET
H2 200 star-yellow-sml.png
polldaddy.com/images/ratings/ 3 KB
3 KB 172ms
171ms Image
image/png 192.0.123.248
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://polldaddy.com/images/ratings/star-yellow-sml.png
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/23/applocker-bypass-rundll32/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.123.248 Los Angeles, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: polldaddy.com
Software: nginx /
Resource Hash: 67f5e3a1fe926d54a765050fbdae81d08d4908c38c3a2340322ec7f5086df9e3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pentestlab.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 15:27:20 GMT
last-modified: Fri, 12 Mar 2021 05:30:45 GMT
server: nginx
etag: "604afc85-c0d"
content-type: image/png
cache-control: max-age=2592000
accept-ranges: bytes
alt-svc: h3=":443"; ma=86400
content-length: 3085
expires: Sat, 09 Mar 2024 15:27:20 GMT

GET
H2 200 info.png
polldaddy.com/images/ratings/ 1 KB
1 KB 183ms
183ms Image
image/png 192.0.123.248
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://polldaddy.com/images/ratings/info.png
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/23/applocker-bypass-rundll32/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.123.248 Los Angeles, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: polldaddy.com
Software: nginx /
Resource Hash: 8d1b51a6bcf97a173884161816c19b753e0088a0926148482d8a1f371706c774

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pentestlab.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 15:27:20 GMT
last-modified: Wed, 08 Sep 2021 02:43:27 GMT
server: nginx
etag: "6138234f-4ca"
content-type: image/png
cache-control: max-age=2592000
accept-ranges: bytes
alt-svc: h3=":443"; ma=86400
content-length: 1226
expires: Sat, 09 Mar 2024 15:27:20 GMT

GET
H2

200

/
www.facebook.com/login/ Frame 21A9
Redirect Chain

https://www.facebook.com/v2.3/plugins/page.php?app_id=249643311490&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Dfc6aaa340b063f0d2%26domain%3Dpente...
https://www.facebook.com/login/?next=https%3A%2F%2Fwww.facebook.com%2Fplugins%2Fpage.php%3Fapp_id%3D249643311490%26channel%3Dhttps%253A%252F%252Fstaticxx.facebook.com%252Fx%252Fconnect%252Fxd_arbit...

0
0

238ms
238ms

Document
text/html

157.240.253.35
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/login/?next=https%3A%2F%2Fwww.facebook.com%2Fplugins%2Fpage.php%3Fapp_id%3D249643311490%26channel%3Dhttps%253A%252F%252Fstaticxx.facebook.com%252Fx%252Fconnect%252Fxd_arbiter%252F%253Fversion%253D46%2523cb%253Dfc6aaa340b063f0d2%2526domain%253Dpentestlab.blog%2526is_canvas%253Dfalse%2526origin%253Dhttps%25253A%25252F%25252Fpentestlab.blog%25252Ff44fc44269d080a69%2526relation%253Dparent.parent%26container_width%3D342%26height%3D432%26hide_cover%3Dfalse%26hide_cta%3Dfalse%26href%3Dhttps%253A%252F%252Fwww.facebook.com%252Fpentestlaboratory%252F%26locale%3Den_US%26sdk%3Djoey%26show_facepile%3Dtrue%26small_header%3Dfalse%26tabs%3Dfalse%26width%3D200

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/sdk.js?hash=a8273f9b0353f6cbacf694979277689b

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

157.240.253.35 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

edge-star-mini-shv-02-fra5.facebook.com

Software

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net 'unsafe-inline' blob: data: 'self' 'unsafe-eval';style-src .fbcdn.net data: .facebook.com 'unsafe-inline';connect-src .facebook.com facebook.com .fbcdn.net wss://.facebook.com:* wss://.fbcdn.net attachment.fbsbx.com blob: .cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ .fbsbx.com;font-src data: .facebook.com .fbcdn.net .fbsbx.com;img-src .fbcdn.net .facebook.com data: https://.fbsbx.com facebook.com .cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster: .oculuscdn.com;media-src .cdninstagram.com blob: .fbcdn.net .fbsbx.com www.facebook.com .facebook.com data:;frame-src .facebook.com .fbsbx.com fbsbx.com data: .fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://pentestlab.blog/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: private, no-cache, no-store, must-revalidate
content-encoding: br
content-security-policy: default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com *.fbcdn.net 'unsafe-eval';script-src *.facebook.com *.fbcdn.net 'unsafe-inline' blob: data: 'self' 'unsafe-eval';style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* wss://*.fbcdn.net attachment.fbsbx.com blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ *.fbsbx.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster: *.oculuscdn.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data:;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: *.fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-type: text/html; charset="utf-8"
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
date: Thu, 08 Feb 2024 15:27:21 GMT
expires: Sat, 01 Jan 2000 00:00:00 GMT
origin-agent-cluster: ?0
pragma: no-cache
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown"
strict-transport-security: max-age=15552000; preload
vary: Accept-Encoding
x-content-type-options: nosniff
x-fb-debug: KnG0rTWFg7lQDM2gmakS/6Jp/OMREqBMXR6aet8zhUon5sv0z7gj6x/qs659SLa/7eBlHMmwKdqyaZ+5euBu+w==
x-frame-options: DENY
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=86400
cache-control: private, no-cache, no-store, must-revalidate
content-length: 0
content-security-policy: default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com *.fbcdn.net 'unsafe-eval';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'unsafe-eval';style-src fonts.googleapis.com *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com;font-src data: *.gstatic.com *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com *.whatsapp.net *.fb.com *.oculuscdn.com *.tenor.co media.tenor.com *.tenor.com *.giphy.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data: https://*.giphy.com;frame-src *.doubleclick.net *.google.com *.facebook.com www.googleadservices.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com/ https://sandbox.paywithmybank.com/;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
content-type: text/html; charset="utf-8"
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: unsafe-none;report-to="coop_report"
cross-origin-resource-policy: cross-origin
date: Thu, 08 Feb 2024 15:27:21 GMT
document-policy: force-load-at-top
expires: Sat, 01 Jan 2000 00:00:00 GMT
facebook-api-version: v12.0
location: https://www.facebook.com/login/?next=https%3A%2F%2Fwww.facebook.com%2Fplugins%2Fpage.php%3Fapp_id%3D249643311490%26channel%3Dhttps%253A%252F%252Fstaticxx.facebook.com%252Fx%252Fconnect%252Fxd_arbiter%252F%253Fversion%253D46%2523cb%253Dfc6aaa340b063f0d2%2526domain%253Dpentestlab.blog%2526is_canvas%253Dfalse%2526origin%253Dhttps%25253A%25252F%25252Fpentestlab.blog%25252Ff44fc44269d080a69%2526relation%253Dparent.parent%26container_width%3D342%26height%3D432%26hide_cover%3Dfalse%26hide_cta%3Dfalse%26href%3Dhttps%253A%252F%252Fwww.facebook.com%252Fpentestlaboratory%252F%26locale%3Den_US%26sdk%3Djoey%26show_facepile%3Dtrue%26small_header%3Dfalse%26tabs%3Dfalse%26width%3D200
origin-agent-cluster: ?0
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(self), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(self), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), usb=(), window-management=(), xr-spatial-tracking=(self);report-to="permissions_policy"
permissions-policy-report-only: autoplay=(), clipboard-read=(), clipboard-write=();report-to="permissions_policy"
pragma: no-cache
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0"
strict-transport-security: max-age=15552000; preload
x-content-type-options: nosniff
x-fb-debug: K++g2kYs5S1mhcs3PL1Yo1lx6xQXYhCbwoMAi5fptWorhueqDqRFbMGHMMN63CAwkrpo7iOitUs4478FJNLRjQ==
x-xss-protection: 0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: s0.wp.com
URL: https://s0.wp.com/wp-includes/js/wp-emoji-release.min.js?m=1677072837i&ver=6.5-alpha-57492

Domain: s0.wp.com
URL: https://s0.wp.com/wp-content/js/rlt-proxy.js?m=20211122

Domain: s0.wp.com
URL: https://s0.wp.com/_static/??/wp-content/js/postmessage.js,/wp-content/js/tannin/compat.min.js,/wp-content/js/wpcom-proxy-request.js,/wp-content/js/likes-rest-nojquery.js?m=202402081217

Verdicts & Comments Add Verdict or Comment

84 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

4 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
other	error	URL: chrome-error://chromewebdata/ Message: Refused to display 'https://www.facebook.com/' in a frame because it set 'X-Frame-Options' to 'deny'.
network	error	URL: https://pentestlab.files.wordpress.com/2017/05/rundll32-dll-loading-control-run.png Message: Failed to load resource: net::ERR_QUIC_PROTOCOL_ERROR
network	error	URL: https://pentestlab.files.wordpress.com/2017/05/applocker-rundll32-registry.png Message: Failed to load resource: net::ERR_QUIC_PROTOCOL_ERROR
network	error	URL: https://pentestlab.files.wordpress.com/2017/05/rundll32-dll-loading-entry-point.png Message: Failed to load resource: net::ERR_QUIC_PROTOCOL_ERROR

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

0.gravatar.com
api.pinterest.com
connect.facebook.net
fonts-api.wp.com
fonts.wp.com
pentestlab.blog
pentestlab.files.wordpress.com
pixel.wp.com
polldaddy.com
r-login.wordpress.com
s0.wp.com
stats.wp.com
widgets.wp.com
www.facebook.com
s0.wp.com
151.101.64.84
157.240.251.9
157.240.253.35
192.0.123.248
192.0.72.29
192.0.73.2
192.0.76.3
192.0.77.32
192.0.78.19
192.0.78.25
017bccf545b2ffdfa4d25b1b7a47d847a1c03c00d9a60426cdaed49cf7bbe2da
0f0e7117b66140a992f70a9246331a03c509b04035610e0856ce67d692be9eba
131f6b765e798866d728f95661b78bbf269c86482ffff0fa8c08e18a1a65cc89
1f16434d944a6e996c5b5bf08d9061ee33eaf68dbd2f4f8f786e159f7dc5cae6
20a2b18486c72f19319a049a2f5b04ec86aaf9a4cfe31c192b492805e84e5d82
211fdb26a74dac46f2bd297c0f02953de9e69355035cad239d87acf21c5a6a0e
2285a97500effc1081e0d427ed0dc7befbd4499a94a9d34ece861ed2163f3e0a
24004b1763b0275d5a1d9f66f08616a54b95aeec1f0034766bbb479679a82fc3
26918e4295cab1eaecebc5d4719c212691f040bfe31daf0c7caf08f7a0de520a
2bca0dae15027898dd6a7536d5b041014f928fbc60d9ce04dd2fa4c5d37d36ad
330552ee73bfedc67b35584fda8afa0faaf4f23ca42db8baefd7a5b25059c969
376eacb307ddbfb56e702fe1c39363c70218d2e4ac32d7ba96f0403da942a093
3a6eca802634248cd9896666cb3a031eabf070b1d11a7ce6bb361b1811cd67a2
3d2c10cf69410c10177fc6e56937d05151b182841fa6aee36f651d587d91fbb8
4184b0f4356e4605d8c0484f48c3e69f4840c601a4b1268f0499534e0e162802
453cb806084fdabec32e286af2e88899f79022125c2527afffbec507975d2c22
45a05663a6bbdacc788b036380a0ee4c7b49b7bc498d8a98d8e5748b91e59030
466ce3f481df55d5402c2179fbfff4190e0881d9a94ab5303b4978bb123bd8db
499b2afc2ca8c8cd894668ae9c64b89438c8170ecd5251af73215052f5125d1a
4dd338d49738b699a41993a965b1e6a8755ef8d0d5252ee3341a2707227580e4
50b14ff286671974963967fd56c5d06430fea5b81ab695665752ae76236828fe
527c5d936ae23161fc29fc8bacb85b839f0fa73efae6a4768c5f0b22d9462461
52d995270969aed722e4e20184d2d424f0e1afb1040ef2273549bf0ba7c75d07
53cb76dea3b1480782a52394a939d94c16e0725ca75b6226ddda1ff6514644af
5b79797e7ed1fce279c7f76f77db1e5dcc2022043eeee8ced5a7a3c9fd2061ce
667b4d451abe29c658488b1d4df14793babb73b00a72cca8052447eea242cae7
66f69ace341969d16b2b3709a823e62788c738e6170a9689dbe75b18e48d5453
67f5e3a1fe926d54a765050fbdae81d08d4908c38c3a2340322ec7f5086df9e3
69f13d95be58a28c857b87ec398f709e23d1c99a21f1ad935a159587460586ad
6dc63fe3f880324c960483652ea9f872199ad3887e2e072e1925cb167bafa576
6e57606e03b2f8286e7343da02403a66a52cc44d9406dd0387e5bacf4264bf05
70746c461d32b81951f85b1da353e29d43410ae13916ae31b845a0bcbf4e197f
70c44a9df364a5e5779a64d3b6bace4a0939ad6649859f59e30d4df5bbfbf7d6
7144da51c13e676115aa2ba938801234efef87990ad67e6bb5180fb4eda05b9a
729cb114db2bc898ebd76af066a49a76432f8ad984505e6ecfcfbc37672813cf
738223eb8c8c70913bf59775dc575c205070014babc8b174fd3ab8e6082ebe30
77613b7e0fb9a0c71ec67d7f91e6e6234c7147710ccc3c40d4cf2f2e68105394
79674b01741c3978417b6b9b4b98d125755e7bb468979d5cd593eac4b94cdb91
7c00752ce82d6abaed0b9766d35b906b16675facdbe24115b410d1fab975effa
7d5f6f7d593191e51c8211ccee54ec6b5425e3f5ae5da264eb56f7c1a8cbd630
7dacf83f51179de8d7980a513e67ab3a08f2c6272bb5946df8fd77c0d1763b73
7f653b3ce9d3277457fc6da4edb246ae2f6c913f088c42dcb8cd2e96267aa21a
81c14677193331d086999b1a5ba914e351f3be194e9fe4dbc6fc7af67808d0a5
81d80f7617f35c300905e4d00edab280731bc69dc5a1bb457a3171a296f0c579
827bdaf48b181c80b5496d87940a85c95922cc5db5b607abf10921e3f111fef2
861af5dd96b652ea4e711b9377e771b5200b235ad71b216dd0ba669e640f0822
8d1b51a6bcf97a173884161816c19b753e0088a0926148482d8a1f371706c774
8f892de7bd3f42587028e9a8ddd9d01c6923f3947e657710ef40a2407e718de6
8fd02bc4739cd3ef196dd0fb17bec22a1edc93aa4b56b014374bf79b2bb560b0
91d0022cd0ba8821088854f4e21f21ddf56c1b1017446ca6189ff7bf593e2b72
93111ec228b7cde5000f4062ac113d5c56c77b2a7ccc4ab3b6ceaf97fe340e37
96e284f53f584411c21ef89fa08219b4188014333413eef9f7de213669c25fa7
97cc56205ee842e64adc7912cb7e86c6b31a90ba065cf46009c09bca05293059
9875cce492eeff24686e3a4064adcc13819f77124f97b11b87ce6a574fcaf3be
9c83b89ab9d2677980617afacb833a74da3050a2d3d711176b500d7922e49ab5
9dd529e41550eb0e0e7bd092733e0a2077d73ed42012d224691fb5795067633e
9e1dae23d3ad3212f67d09ca79a50003c32953c36bab976f634c9b38d8a8c6dc
9f6f66ae6c4271010315af726d5543a37e36e441d88166d10b927f9aa6fde32a
a37ef75bef9c0b9ca67220a826fad8761b880347fbb763c56d38834eb1c5a302
a851ac2edc584a3b08c0a057bb2d0c08ac95c4de2cc453e22a2c83305cce3694
ab01ed125c97e2e3734e17725ca293d58ce40e0909181b2079b91e84724463fc
abd210a1d68ca64fcf3b6de42a292f5d1f17a8e7856e4489389ca1c1e6ab05c2
af186659e415490e7eee1bd3c8d511771dbd3e03ddbebf6b6a5096ac8ba29449
affda14265425527d43df8172b113acdb4647b3ed4ec418c9fc9b0ff5b886dfd
b6e4492d3b8358a81b80908b1f84e6bd2f64a7a46d48793af99d27bf29f4c2e8
bb7e1d078ab58cc492068b9ec67be2bf234676e618b211dab57666721476d0c6
bbc51c7d3315175c9f89d86add8afd37a09671935e0306a1fea6e0189f37901c
bdb75e08b4b1eedee2847c2eafacc3089842b8735f7c6d4e99aedcb6ba828e55
c0e93b5ebf107af77d9e7d101d186b3b93e9d5ad4fbb6a74e2dea60173cc04f8
c21754110d328a886423cc2f20ec83de38c4f5dab11006198ec8c0d409152881
c85d2c2b820baac9404cb871788528e176b6e14d0b829c1caafc75dcf6234015
ce9e6ace282c0a37d97f7d539a45062a713f4b39582873061c0377552bc1f6c4
cf75f45164a049900471e9bc171c299121e16f3675651b92ee8ca43dc974d64a
d1250ea07224819d007acda104687b92e3a5174adacf12837fc5e9ff14021286
d413a32d4aad316a296461ff801272dc11512f252e5eba70da8e0673c204b235
d6480caf5f26b15563f969737af7f284bf796de4dd63c8caaa3481fe75d05b80
d6aa645764dc59ae4f0585681381d901f186cae336e44e1fbc8de1c0a529e7ff
d743ad07240fdc75d2e2a357b4ff44b334f6d4c53683e31e824aaf61d3bad0c9
dbba6c1c59954873629e196b8009f0a8256e66d755f889cf6c8ac4f1164d10c2
de82ba6d47c0b4495e7dc26891a7ef82f1f07730df39a5375343b341c4eec13d
e1d116c460927f272f88ce15f929ebb059a6542431b58d8feaa785a7665ca846
e395e619d3151c852bf9c05ecdad5c3099fcffedd19343618468a224a105492b
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1
fe788e0f7ae46a370ab3eb4f2a404269b1072e56135216713e39502c7dacde59

pentestlab.blog Open in urlscan Pro 192.0.78.25 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

93 Requests

96 %HTTPS

0 %IPv6

8 Domains

14 Subdomains

11 IPs

2 Countries

1470 kBTransfer

2842 kBSize

0 Cookies

19 Outgoing links

Redirected requests

93 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

pentestlab.blog Open in urlscan Pro
192.0.78.25 Public Scan

Screenshot
Live screenshot

Full Image

93
Requests

96 %
HTTPS

0 %
IPv6

8
Domains

14
Subdomains

11
IPs

2
Countries

1470 kB
Transfer

2842 kB
Size

0
Cookies

93 HTTP transactions
1 data transactions