urlscan.io logo urlscan.io
SecurityTrails logo

www.thezdi.com Open in urlscan Pro
198.185.159.145  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://www.thezdi.com/blog/2019/9/18/cve-2019-1257-code-execution-on-microsoft-sharepoint-through-bdc-deserialization|
Effective URL: https://www.thezdi.com/blog/2019/9/18/cve-2019-1257-code-execution-on-microsoft-sharepoint-through-bdc-deserialization%7C
Submission: On September 19 via api from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 8 IPs in 5 countries across 7 domains to perform 18 HTTP transactions. The main IP is 198.185.159.145, located in New York, United States and belongs to SQUARESPACE - Squarespace, Inc., US. The main domain is www.thezdi.com.
TLS certificate: Issued by Let's Encrypt Authority X3 on July 27th 2019. Valid for: 3 months.
This is the only time www.thezdi.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 198.185.159.145 53831 (SQUARESPACE)
3 2a00:1450:400... 15169 (GOOGLE)
1 2a02:26f0:6c0... 20940 (AKAMAI-ASN1)
1 104.111.247.112 16625 (AKAMAI-AS)
6 52.89.240.103 16509 (AMAZON-02)
1 2 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
4 2a00:1450:400... 15169 (GOOGLE)
18 8
1    198.185.159.145 (New York, United States)

ASN53831 (SQUARESPACE - Squarespace, Inc., US)
www.thezdi.com
3    2a00:1450:4001:81f::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)
fonts.googleapis.com
1    2a02:26f0:6c00:190::4205 (Ascension Island)

ASN20940 (AKAMAI-ASN1, US)
assets.squarespace.com
1    104.111.247.112 (Netherlands)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a104-111-247-112.deploy.static.akamaitechnologies.com
static1.squarespace.com
6    52.89.240.103 (Boardman, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-52-89-240-103.us-west-2.compute.amazonaws.com
www.zerodayinitiative.com
2    2a00:1450:4001:825::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)
www.google-analytics.com
1    2a00:1450:400c:c09::9d (Brussels, Belgium)

ASN15169 (GOOGLE - Google LLC, US)
stats.g.doubleclick.net
4    2a00:1450:4001:825::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)
fonts.gstatic.com
Domain Requested by
6 www.zerodayinitiative.com www.thezdi.com
4 fonts.gstatic.com www.thezdi.com
3 fonts.googleapis.com www.thezdi.com
2 www.google-analytics.com 1 redirects www.thezdi.com
1 stats.g.doubleclick.net www.thezdi.com
1 static1.squarespace.com www.thezdi.com
1 assets.squarespace.com www.thezdi.com
1 www.thezdi.com
18 8

This site contains links to these domains. Also see Links.

Domain
www.trendmicro.com
www.zerodayinitiative.com
twitter.com
Subject Issuer Validity Valid
www.thezdi.com
Let's Encrypt Authority X3		 2019-07-27 -
2019-10-25		 3 months crt.sh
*.googleapis.com
GTS CA 1O1		 2019-08-23 -
2019-11-21		 3 months crt.sh
*.squarespace.com
DigiCert SHA2 Secure Server CA		 2019-05-31 -
2020-08-29		 a year crt.sh
*.zerodayinitiative.com
AffirmTrust Certificate Authority - OV1		 2018-02-26 -
2020-04-07		 2 years crt.sh
*.google-analytics.com
GTS CA 1O1		 2019-09-05 -
2019-11-28		 3 months crt.sh
*.g.doubleclick.net
GTS CA 1O1		 2019-09-05 -
2019-11-28		 3 months crt.sh
*.google.com
GTS CA 1O1		 2019-09-05 -
2019-11-28		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://www.thezdi.com/blog/2019/9/18/cve-2019-1257-code-execution-on-microsoft-sharepoint-through-bdc-deserialization%7C
Frame ID: 6FB22B509388C138CC5F3F47888F0995
Requests: 18 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • html /<!-- This is Squarespace\. -->/i
Overall confidence: 100%
Detected patterns
  • script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i
Overall confidence: 100%
Detected patterns
  • html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i

Page Statistics

18
Requests

100 %
HTTPS

63 %
IPv6

7
Domains

8
Subdomains

8
IPs

5
Countries

824 kB
Transfer

2478 kB
Size

4
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 10
  • https://www.google-analytics.com/r/collect?v=1&_v=j79&a=1448579000&t=pageview&_s=1&dl=https%3A%2F%2Fwww.thezdi.com%2Fblog%2F2019%2F9%2F18%2Fcve-2019-1257-code-execution-on-microsoft-sharepoint-through-bdc-deserialization%257C&ul=en-us&de=UTF-8&dt=Zero%20Day%20Initiative&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&_u=IEBAAEAB~&jid=988183732&gjid=441107438&cid=916663006.1568912144&tid=UA-93169700-1&_gid=1019425557.1568912144&_r=1&z=1044168900 HTTP 302
  • https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-93169700-1&cid=916663006.1568912144&jid=988183732&_gid=1019425557.1568912144&gjid=441107438&_v=j79&z=1044168900

18 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request cve-2019-1257-code-execution-on-microsoft-sharepoint-through-bdc-deserialization%7C
www.thezdi.com/blog/2019/9/18/ 		29 KB
8 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.thezdi.com/blog/2019/9/18/cve-2019-1257-code-execution-on-microsoft-sharepoint-through-bdc-deserialization%7C
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
198.185.159.145 New York, United States, ASN53831 (SQUARESPACE - Squarespace, Inc., US),
Reverse DNS
Software
Squarespace /
Resource Hash
d77303d96ba5e46f7c0589947556c6eaad0491a2de08e810c72452c8a02707eb
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

:method
GET
:authority
www.thezdi.com
:scheme
https
:path
/blog/2019/9/18/cve-2019-1257-code-execution-on-microsoft-sharepoint-through-bdc-deserialization%7C
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
navigate
sec-fetch-user
?1
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
none
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
navigate
Sec-Fetch-User
?1

Response headers

status
404
date
Thu, 19 Sep 2019 16:55:43 GMT
strict-transport-security
max-age=0
expires
Thu, 01 Jan 1970 00:00:00 GMT
content-type
text/html;charset=utf-8
last-modified
Thu, 19 Sep 2019 16:39:43 GMT
content-encoding
gzip
etag
W/"e2cf5218f6b47b3aff1b852631d85736"
content-length
8348
vary
Accept-Encoding
age
0
set-cookie
crumb=BUTlrS830LvzYWRjZDFmZWRlMzZiYTNjMGIzZGQxMmI3YWExZDI0;Path=/
x-contextid
kj0NxE0Q/IPSsFw6V
server
Squarespace
css
fonts.googleapis.com/ 		3 KB
569 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Titillium+Web:300,400,600,700
Requested by
Host: www.thezdi.com
URL: https://www.thezdi.com/blog/2019/9/18/cve-2019-1257-code-execution-on-microsoft-sharepoint-through-bdc-deserialization%7C
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
ESF /
Resource Hash
d5d47906e43d6581f4cc0629ac02d8e60fe5503dd8cfbfe3e91e3de19eb9ae5a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.thezdi.com/blog/2019/9/18/cve-2019-1257-code-execution-on-microsoft-sharepoint-through-bdc-deserialization%7C
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
br
last-modified
Thu, 19 Sep 2019 16:55:43 GMT
server
ESF
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
status
200
date
Thu, 19 Sep 2019 16:55:43 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43,39"
x-xss-protection
0
expires
Thu, 19 Sep 2019 16:55:43 GMT
icon
fonts.googleapis.com/ 		574 B
385 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/icon?family=Material+Icons
Requested by
Host: www.thezdi.com
URL: https://www.thezdi.com/blog/2019/9/18/cve-2019-1257-code-execution-on-microsoft-sharepoint-through-bdc-deserialization%7C
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
ESF /
Resource Hash
09e13bc501877a8383c2661e6fc80187efadbd82ac4d3b0d1ec8a41d8630756c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.thezdi.com/blog/2019/9/18/cve-2019-1257-code-execution-on-microsoft-sharepoint-through-bdc-deserialization%7C
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
br
last-modified
Thu, 19 Sep 2019 16:55:43 GMT
server
ESF
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
status
200
date
Thu, 19 Sep 2019 16:55:43 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43,39"
x-xss-protection
0
expires
Thu, 19 Sep 2019 16:55:43 GMT
css
fonts.googleapis.com/ 		5 KB
611 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Lato:100,300,400,100italic,700normal,700italic,300italic
Requested by
Host: www.thezdi.com
URL: https://www.thezdi.com/blog/2019/9/18/cve-2019-1257-code-execution-on-microsoft-sharepoint-through-bdc-deserialization%7C
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
ESF /
Resource Hash
a5c67239759e63de6c86033ae8fc577c0a2e16c1c317b9e6bdb959068e29a09b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.thezdi.com/blog/2019/9/18/cve-2019-1257-code-execution-on-microsoft-sharepoint-through-bdc-deserialization%7C
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
br
last-modified
Thu, 19 Sep 2019 16:55:43 GMT
server
ESF
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
status
200
date
Thu, 19 Sep 2019 16:55:43 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43,39"
x-xss-protection
0
expires
Thu, 19 Sep 2019 16:55:43 GMT
common-b1828f2b6f7cbf4a836f6-min.en-US.js
assets.squarespace.com/universal/scripts-compressed/ 		2 MB
424 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://assets.squarespace.com/universal/scripts-compressed/common-b1828f2b6f7cbf4a836f6-min.en-US.js
Requested by
Host: www.thezdi.com
URL: https://www.thezdi.com/blog/2019/9/18/cve-2019-1257-code-execution-on-microsoft-sharepoint-through-bdc-deserialization%7C
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a02:26f0:6c00:190::4205 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software
UploadServer /
Resource Hash
2ad9d2ad42e23c9fedcfc8e1e827fd27f1705652485a6ef1a6b43ac94b40c8ea

Request headers

Sec-Fetch-Mode
cors
Referer
https://www.thezdi.com/blog/2019/9/18/cve-2019-1257-code-execution-on-microsoft-sharepoint-through-bdc-deserialization%7C
Origin
https://www.thezdi.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 19 Sep 2019 16:55:43 GMT
Content-Encoding
gzip
Last-Modified
Wed, 18 Sep 2019 21:16:57 GMT
Server
UploadServer
ETag
"cf17bae20e9c87d98d1b3c2e33667bf3"
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET, OPTIONS
Content-Type
text/javascript
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=16588
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
433482
Expires
Thu, 19 Sep 2019 21:32:11 GMT
site.css
static1.squarespace.com/static/sitecss/5894c269e4fcb5e65a1ed623/2/58a5cc48579fb3f464465a0c/58a5cc48579fb3f464465a0e/26-05142015/1559832643637/ 		381 KB
44 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://static1.squarespace.com/static/sitecss/5894c269e4fcb5e65a1ed623/2/58a5cc48579fb3f464465a0c/58a5cc48579fb3f464465a0e/26-05142015/1559832643637/site.css?&filterFeatures=false
Requested by
Host: www.thezdi.com
URL: https://www.thezdi.com/blog/2019/9/18/cve-2019-1257-code-execution-on-microsoft-sharepoint-through-bdc-deserialization%7C
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.247.112 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-111-247-112.deploy.static.akamaitechnologies.com
Software
Squarespace /
Resource Hash
43eb46cde867a0ad2f00b16c87c5880a8e6fccfa3110d918a90f204505618a27
Security Headers
Name Value
Strict-Transport-Security max-age=0
X-Content-Type-Options nosniff

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.thezdi.com/blog/2019/9/18/cve-2019-1257-code-execution-on-microsoft-sharepoint-through-bdc-deserialization%7C
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
cache
strict-transport-security
max-age=0
content-encoding
gzip
x-content-type-options
nosniff
server
Squarespace
x-contextid
RStZNzmh/tHIiMSB0
date
Thu, 19 Sep 2019 16:55:43 GMT
vary
Accept-Encoding, "Accept-Encoding"
content-type
text/css; charset=UTF-8
status
200
cache-control
public, max-age=56260
accept-ranges
bytes
timing-allow-origin
*
content-length
45157
tracepoint
"Akamai"
main.css
www.zerodayinitiative.com/css/ 		111 KB
17 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.zerodayinitiative.com/css/main.css
Requested by
Host: www.thezdi.com
URL: https://www.thezdi.com/blog/2019/9/18/cve-2019-1257-code-execution-on-microsoft-sharepoint-through-bdc-deserialization%7C
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.89.240.103 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-89-240-103.us-west-2.compute.amazonaws.com
Software
Apache /
Resource Hash
e1689aab9024cc3410d18d228207c866ddced7c6438b9d4a6988dac602377fa2
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.thezdi.com/blog/2019/9/18/cve-2019-1257-code-execution-on-microsoft-sharepoint-through-bdc-deserialization%7C
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 19 Sep 2019 16:55:44 GMT
Content-Encoding
gzip
Last-Modified
Thu, 22 Aug 2019 16:22:07 GMT
Server
Apache
ETag
"1bd4c-590b7174d87d3-gzip"
Vary
Accept-Encoding
Strict-Transport-Security
max-age=31536000; includeSubDomains
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
17443
logo.svg
www.zerodayinitiative.com/images/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.zerodayinitiative.com/images/logo.svg
Requested by
Host: www.thezdi.com
URL: https://www.thezdi.com/blog/2019/9/18/cve-2019-1257-code-execution-on-microsoft-sharepoint-through-bdc-deserialization%7C
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.89.240.103 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-89-240-103.us-west-2.compute.amazonaws.com
Software
Apache /
Resource Hash
69e20fb427d199788e997881545689e2f99c1a47db13eb8d88849a333cbfd98f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.thezdi.com/blog/2019/9/18/cve-2019-1257-code-execution-on-microsoft-sharepoint-through-bdc-deserialization%7C
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 19 Sep 2019 16:55:44 GMT
Last-Modified
Mon, 21 Jan 2019 14:23:03 GMT
Server
Apache
ETag
"b0c-57ff8993bbfc0"
Strict-Transport-Security
max-age=31536000; includeSubDomains
Content-Type
image/svg+xml
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
2828
logo-footer.svg
www.zerodayinitiative.com/images/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.zerodayinitiative.com/images/logo-footer.svg
Requested by
Host: www.thezdi.com
URL: https://www.thezdi.com/blog/2019/9/18/cve-2019-1257-code-execution-on-microsoft-sharepoint-through-bdc-deserialization%7C
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.89.240.103 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-89-240-103.us-west-2.compute.amazonaws.com
Software
Apache /
Resource Hash
e87479d44865345cca8372041cdb9dbe43100637c4afd40375e1d373fd4268b0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.thezdi.com/blog/2019/9/18/cve-2019-1257-code-execution-on-microsoft-sharepoint-through-bdc-deserialization%7C
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 19 Sep 2019 16:55:44 GMT
Last-Modified
Mon, 21 Jan 2019 14:23:03 GMT
Server
Apache
ETag
"745-57ff8993bbfc0"
Strict-Transport-Security
max-age=31536000; includeSubDomains
Content-Type
image/svg+xml
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
1861
main.js
www.zerodayinitiative.com/js/ 		42 KB
12 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.zerodayinitiative.com/js/main.js
Requested by
Host: www.thezdi.com
URL: https://www.thezdi.com/blog/2019/9/18/cve-2019-1257-code-execution-on-microsoft-sharepoint-through-bdc-deserialization%7C
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.89.240.103 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-89-240-103.us-west-2.compute.amazonaws.com
Software
Apache /
Resource Hash
de360daa34474ce81acf8a81e3f513dca4a1f62d3c55064ab8b49af69f1c60cc
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.thezdi.com/blog/2019/9/18/cve-2019-1257-code-execution-on-microsoft-sharepoint-through-bdc-deserialization%7C
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 19 Sep 2019 16:55:44 GMT
Content-Encoding
gzip
Last-Modified
Mon, 21 Jan 2019 14:23:03 GMT
Server
Apache
ETag
"a8ab-57ff8993bbfc0-gzip"
Vary
Accept-Encoding
Strict-Transport-Security
max-age=31536000; includeSubDomains
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
11900
analytics.js
www.google-analytics.com/ 		43 KB
17 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.thezdi.com
URL: https://www.thezdi.com/blog/2019/9/18/cve-2019-1257-code-execution-on-microsoft-sharepoint-through-bdc-deserialization%7C
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:825::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
dbb67c620eaabf6679a314db18d3ae43037aef71ab27422e6feec08ee987cc0a
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.thezdi.com/blog/2019/9/18/cve-2019-1257-code-execution-on-microsoft-sharepoint-through-bdc-deserialization%7C
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Mon, 19 Aug 2019 17:22:41 GMT
server
Golfe2
age
730
date
Thu, 19 Sep 2019 16:43:33 GMT
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=7200
alt-svc
quic=":443"; ma=2592000; v="46,43,39"
content-length
17803
expires
Thu, 19 Sep 2019 18:43:33 GMT
collect
stats.g.doubleclick.net/r/
Redirect Chain
  • https://www.google-analytics.com/r/collect?v=1&_v=j79&a=1448579000&t=pageview&_s=1&dl=https%3A%2F%2Fwww.thezdi.com%2Fblog%2F2019%2F9%2F18%2Fcve-2019-1257-code-execution-on-microsoft-sharepoint-thro...
  • https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-93169700-1&cid=916663006.1568912144&jid=988183732&_gid=1019425557.1568912144&gjid=441107438&_v=j79&z=1044168900
35 B
103 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-93169700-1&cid=916663006.1568912144&jid=988183732&_gid=1019425557.1568912144&gjid=441107438&_v=j79&z=1044168900
Requested by
Host: www.thezdi.com
URL: https://www.thezdi.com/blog/2019/9/18/cve-2019-1257-code-execution-on-microsoft-sharepoint-through-bdc-deserialization%7C
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c09::9d Brussels, Belgium, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.thezdi.com/blog/2019/9/18/cve-2019-1257-code-execution-on-microsoft-sharepoint-through-bdc-deserialization%7C
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
date
Thu, 19 Sep 2019 16:55:43 GMT
status
200
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
alt-svc
quic=":443"; ma=2592000; v="46,43,39"
content-length
35
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Thu, 19 Sep 2019 16:55:43 GMT
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
status
302
location
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-93169700-1&cid=916663006.1568912144&jid=988183732&_gid=1019425557.1568912144&gjid=441107438&_v=j79&z=1044168900
content-type
text/html; charset=UTF-8
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
alt-svc
quic=":443"; ma=2592000; v="46,43,39"
content-length
417
expires
Fri, 01 Jan 1990 00:00:00 GMT
menu_icon.svg
www.zerodayinitiative.com/images/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.zerodayinitiative.com/images/menu_icon.svg
Requested by
Host: www.thezdi.com
URL: https://www.thezdi.com/blog/2019/9/18/cve-2019-1257-code-execution-on-microsoft-sharepoint-through-bdc-deserialization%7C
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.89.240.103 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-89-240-103.us-west-2.compute.amazonaws.com
Software
Apache /
Resource Hash
c0af312f3763eb40881c0cb7da81c64b692687d033d82de09e18b8211110d6d4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zerodayinitiative.com/css/main.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 19 Sep 2019 16:55:44 GMT
Last-Modified
Mon, 21 Jan 2019 14:23:03 GMT
Server
Apache
ETag
"808-57ff8993bbfc0"
Strict-Transport-Security
max-age=31536000; includeSubDomains
Content-Type
image/svg+xml
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
2056
NaPDcZTIAOhVxoMyOr9n_E7ffHjDGItzY5abuWI.woff2
fonts.gstatic.com/s/titilliumweb/v8/ 		11 KB
12 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/titilliumweb/v8/NaPDcZTIAOhVxoMyOr9n_E7ffHjDGItzY5abuWI.woff2
Requested by
Host: www.thezdi.com
URL: https://www.thezdi.com/blog/2019/9/18/cve-2019-1257-code-execution-on-microsoft-sharepoint-through-bdc-deserialization%7C
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:825::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
cd6f4900abc2da200ad96c75852facfd8872610ce9dd259acf3cc82507490dd3
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
cors
Referer
https://fonts.googleapis.com/css?family=Titillium+Web:300,400,600,700
Origin
https://www.thezdi.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 03 Sep 2019 21:43:21 GMT
x-content-type-options
nosniff
last-modified
Mon, 22 Jul 2019 19:24:58 GMT
server
sffe
age
1365143
status
200
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43,39"
content-length
11744
x-xss-protection
0
expires
Wed, 02 Sep 2020 21:43:21 GMT
NaPecZTIAOhVxoMyOr9n_E7fdMPmDaZRbrw.woff2
fonts.gstatic.com/s/titilliumweb/v8/ 		12 KB
12 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/titilliumweb/v8/NaPecZTIAOhVxoMyOr9n_E7fdMPmDaZRbrw.woff2
Requested by
Host: www.thezdi.com
URL: https://www.thezdi.com/blog/2019/9/18/cve-2019-1257-code-execution-on-microsoft-sharepoint-through-bdc-deserialization%7C
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:825::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
dd1dad45fd0dd168ad46427307aa8a206b857b783ca3afbcfe2bc8b8724acec0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
cors
Referer
https://fonts.googleapis.com/css?family=Titillium+Web:300,400,600,700
Origin
https://www.thezdi.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Sun, 25 Aug 2019 05:51:35 GMT
x-content-type-options
nosniff
last-modified
Mon, 22 Jul 2019 19:24:34 GMT
server
sffe
age
2199849
status
200
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43,39"
content-length
12344
x-xss-protection
0
expires
Mon, 24 Aug 2020 05:51:35 GMT
footer-bg.jpg
www.zerodayinitiative.com/images/ 		243 KB
243 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.zerodayinitiative.com/images/footer-bg.jpg
Requested by
Host: www.thezdi.com
URL: https://www.thezdi.com/blog/2019/9/18/cve-2019-1257-code-execution-on-microsoft-sharepoint-through-bdc-deserialization%7C
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.89.240.103 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-89-240-103.us-west-2.compute.amazonaws.com
Software
Apache /
Resource Hash
adeaf2308e4828047269f9fe49b75a6c9e89d427bd6144ca508173f886435198
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://www.zerodayinitiative.com/css/main.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 19 Sep 2019 16:55:44 GMT
Last-Modified
Mon, 21 Jan 2019 14:23:03 GMT
Server
Apache
ETag
"3cae3-57ff8993bbfc0"
Strict-Transport-Security
max-age=31536000; includeSubDomains
Content-Type
image/jpeg
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
248547
NaPDcZTIAOhVxoMyOr9n_E7ffBzCGItzY5abuWI.woff2
fonts.gstatic.com/s/titilliumweb/v8/ 		12 KB
12 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/titilliumweb/v8/NaPDcZTIAOhVxoMyOr9n_E7ffBzCGItzY5abuWI.woff2
Requested by
Host: www.thezdi.com
URL: https://www.thezdi.com/blog/2019/9/18/cve-2019-1257-code-execution-on-microsoft-sharepoint-through-bdc-deserialization%7C
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:825::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
8658dcad983dacbb3bca7bc8217fd0b75f28df85bf9259bd0dccf69e58cb0ecd
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
cors
Referer
https://fonts.googleapis.com/css?family=Titillium+Web:300,400,600,700
Origin
https://www.thezdi.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 26 Aug 2019 13:17:12 GMT
x-content-type-options
nosniff
last-modified
Mon, 22 Jul 2019 19:25:27 GMT
server
sffe
age
2086712
status
200
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43,39"
content-length
12276
x-xss-protection
0
expires
Tue, 25 Aug 2020 13:17:12 GMT
NaPDcZTIAOhVxoMyOr9n_E7ffGjEGItzY5abuWI.woff2
fonts.gstatic.com/s/titilliumweb/v8/ 		12 KB
12 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/titilliumweb/v8/NaPDcZTIAOhVxoMyOr9n_E7ffGjEGItzY5abuWI.woff2
Requested by
Host: www.thezdi.com
URL: https://www.thezdi.com/blog/2019/9/18/cve-2019-1257-code-execution-on-microsoft-sharepoint-through-bdc-deserialization%7C
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:825::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
0e23b84d6736b1645a695282788cee2070cd3f5cd2c5c2e31ea0b44a942294c2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
cors
Referer
https://fonts.googleapis.com/css?family=Titillium+Web:300,400,600,700
Origin
https://www.thezdi.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Sun, 25 Aug 2019 05:46:59 GMT
x-content-type-options
nosniff
last-modified
Mon, 22 Jul 2019 19:18:52 GMT
server
sffe
age
2200125
status
200
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43,39"
content-length
12524
x-xss-protection
0
expires
Mon, 24 Aug 2020 05:46:59 GMT

Verdicts & Comments Add Verdict or Comment

30 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate object| SQUARESPACE_ROLLUPS object| webpackJsonp object| YUI_CONFIG function| YUI object| core object| __core-js_shared__ function| Common boolean| COMMON_ALREADY_RAN object| Static function| noop object| Singleton object| Class object| SquarespaceFonts object| Squarespace object| Y string| _YUI_HISTORY_HASH_ENVIRONMENT_ID string| _yuid object| ESC_MANAGER object| Modernizr object| ImageLoader object| JSTween string| GoogleAnalyticsObject function| ga object| google_tag_data object| gaplugins object| gaGlobal object| gaData string| id

4 Cookies

Domain/Path Name / Value
.thezdi.com/ Name: _gat
Value: 1
.thezdi.com/ Name: _gid
Value: GA1.2.1019425557.1568912144
.thezdi.com/ Name: _ga
Value: GA1.2.916663006.1568912144
www.thezdi.com/ Name: crumb
Value: BUTlrS830LvzYWRjZDFmZWRlMzZiYTNjMGIzZGQxMmI3YWExZDI0

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=0

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

assets.squarespace.com
fonts.googleapis.com
fonts.gstatic.com
static1.squarespace.com
stats.g.doubleclick.net
www.google-analytics.com
www.thezdi.com
www.zerodayinitiative.com
104.111.247.112
198.185.159.145
2a00:1450:4001:81f::200a
2a00:1450:4001:825::2003
2a00:1450:4001:825::200e
2a00:1450:400c:c09::9d
2a02:26f0:6c00:190::4205
52.89.240.103
09e13bc501877a8383c2661e6fc80187efadbd82ac4d3b0d1ec8a41d8630756c
0e23b84d6736b1645a695282788cee2070cd3f5cd2c5c2e31ea0b44a942294c2
2ad9d2ad42e23c9fedcfc8e1e827fd27f1705652485a6ef1a6b43ac94b40c8ea
43eb46cde867a0ad2f00b16c87c5880a8e6fccfa3110d918a90f204505618a27
69e20fb427d199788e997881545689e2f99c1a47db13eb8d88849a333cbfd98f
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
8658dcad983dacbb3bca7bc8217fd0b75f28df85bf9259bd0dccf69e58cb0ecd
a5c67239759e63de6c86033ae8fc577c0a2e16c1c317b9e6bdb959068e29a09b
adeaf2308e4828047269f9fe49b75a6c9e89d427bd6144ca508173f886435198
c0af312f3763eb40881c0cb7da81c64b692687d033d82de09e18b8211110d6d4
cd6f4900abc2da200ad96c75852facfd8872610ce9dd259acf3cc82507490dd3
d5d47906e43d6581f4cc0629ac02d8e60fe5503dd8cfbfe3e91e3de19eb9ae5a
d77303d96ba5e46f7c0589947556c6eaad0491a2de08e810c72452c8a02707eb
dbb67c620eaabf6679a314db18d3ae43037aef71ab27422e6feec08ee987cc0a
dd1dad45fd0dd168ad46427307aa8a206b857b783ca3afbcfe2bc8b8724acec0
de360daa34474ce81acf8a81e3f513dca4a1f62d3c55064ab8b49af69f1c60cc
e1689aab9024cc3410d18d228207c866ddced7c6438b9d4a6988dac602377fa2
e87479d44865345cca8372041cdb9dbe43100637c4afd40375e1d373fd4268b0