urlscan.io logo urlscan.io
SecurityTrails logo

posts.specterops.io Open in urlscan Pro
52.4.38.70  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992.
Effective URL: https://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992.?gi=fce521df7cbc
Submission Tags: falconsandbox
Submission: On August 21 via api from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 10 IPs in 2 countries across 6 domains to perform 80 HTTP transactions. The main IP is 52.4.38.70, located in Ashburn, United States and belongs to AMAZON-AES, US. The main domain is posts.specterops.io.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on January 5th 2022. Valid for: a year.
This is the only time posts.specterops.io was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 9 52.4.38.70 14618 (AMAZON-AES)
1 48 2606:4700:7::... 13335 (CLOUDFLAR...)
11 2606:4700:7::... 13335 (CLOUDFLAR...)
1 13.225.78.70 16509 (AMAZON-02)
2 2a00:1450:400... 15169 (GOOGLE)
1 99.86.240.73 16509 (AMAZON-02)
1 2600:9000:20e... 16509 (AMAZON-02)
6 3.93.235.75 14618 (AMAZON-AES)
2 2600:9000:249... 16509 (AMAZON-02)
80 10
9    52.4.38.70 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-4-38-70.compute-1.amazonaws.com
posts.specterops.io
48    2606:4700:7::a29f:9804 (United States)

ASN13335 (CLOUDFLARENET, US)
medium.com
glyph.medium.com
miro.medium.com
cdn-client.medium.com
11    2606:4700:7::a29f:9904 (United States)

ASN13335 (CLOUDFLARENET, US)
glyph.medium.com
miro.medium.com
1    13.225.78.70 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-225-78-70.fra2.r.cloudfront.net
cdn.sprig.com
2    2a00:1450:4001:830::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google-analytics.com
1    99.86.240.73 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-99-86-240-73.vie50.r.cloudfront.net
cdn.branch.io
1    2600:9000:20eb:3200:19:9934:6a80:93a1 (United States)

ASN16509 (AMAZON-02, US)
app.link
6    3.93.235.75 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-93-235-75.compute-1.amazonaws.com
api.sprig.com
2    2600:9000:2491:e00:11:f728:3040:93a1 (United States)

ASN16509 (AMAZON-02, US)
api2.branch.io
Apex Domain
Subdomains		 Transfer
59 medium.com
medium.com — Cisco Umbrella Rank: 9565
glyph.medium.com — Cisco Umbrella Rank: 19578
miro.medium.com — Cisco Umbrella Rank: 13525
cdn-client.medium.com — Cisco Umbrella Rank: 20697
3 MB
9 specterops.io
posts.specterops.io
17 KB
7 sprig.com
cdn.sprig.com — Cisco Umbrella Rank: 14376
api.sprig.com — Cisco Umbrella Rank: 8650
73 KB
3 branch.io
cdn.branch.io — Cisco Umbrella Rank: 1004
api2.branch.io — Cisco Umbrella Rank: 649
24 KB
2 google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 45
20 KB
1 app.link
app.link — Cisco Umbrella Rank: 1670
587 B
80 6
Domain Requested by
39 cdn-client.medium.com posts.specterops.io
15 miro.medium.com posts.specterops.io
9 posts.specterops.io 1 redirects cdn-client.medium.com
6 api.sprig.com cdn-client.medium.com
4 glyph.medium.com posts.specterops.io
glyph.medium.com
2 api2.branch.io cdn-client.medium.com
2 www.google-analytics.com posts.specterops.io
cdn-client.medium.com
1 app.link cdn.branch.io
1 cdn.branch.io posts.specterops.io
1 cdn.sprig.com posts.specterops.io
1 medium.com 1 redirects
80 11

This site contains links to these domains. Also see Links.

Domain
medium.com
rsci.app.link
humanparts.medium.com
stuff.life
policy.medium.com
Subject Issuer Validity Valid
posts.specterops.io
Sectigo RSA Domain Validation Secure Server CA		 2022-01-05 -
2023-01-05		 a year crt.sh
medium.com
Cloudflare Inc ECC CA-3		 2022-06-26 -
2022-09-24		 3 months crt.sh
api.sprig.com
Amazon		 2021-08-31 -
2022-09-29		 a year crt.sh
*.google-analytics.com
GTS CA 1C3		 2022-08-01 -
2022-10-24		 3 months crt.sh
*.branch.io
DigiCert TLS RSA SHA256 2020 CA1		 2021-10-27 -
2022-11-27		 a year crt.sh
appipv4.link
Amazon		 2022-05-25 -
2023-06-23		 a year crt.sh
app.sprig.com
Amazon		 2022-03-01 -
2023-03-31		 a year crt.sh

This page contains 1 frames:

Primary Page: https://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992.?gi=fce521df7cbc
Frame ID: 3C8B02B927BA3CEC291BBF637B967033
Requests: 77 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Medium

Page URL History Show full URLs

  1. https://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992. HTTP 307
    https://medium.com/m/global-identity?redirectUrl=https%3A%2F%2Fposts.specterops.io%2Flateral-mo... HTTP 302
    https://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992.?gi=fce521df7cbc Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • medium\.com
Overall confidence: 100%
Detected patterns
  • google-analytics\.com/(?:ga|urchin|analytics)\.js

Page Statistics

80
Requests

99 %
HTTPS

56 %
IPv6

6
Domains

11
Subdomains

10
IPs

2
Countries

3230 kB
Transfer

5304 kB
Size

10
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992. HTTP 307
    https://medium.com/m/global-identity?redirectUrl=https%3A%2F%2Fposts.specterops.io%2Flateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992. HTTP 302
    https://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992.?gi=fce521df7cbc Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

80 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992.
posts.specterops.io/
Redirect Chain
  • https://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992.
  • https://medium.com/m/global-identity?redirectUrl=https%3A%2F%2Fposts.specterops.io%2Flateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992.
  • https://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992.?gi=fce521df7cbc
64 KB
15 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992.?gi=fce521df7cbc
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.4.38.70 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-4-38-70.compute-1.amazonaws.com
Software
nginx /
Resource Hash
11c8592c1f54321d6f2b6c95b9c0b1362a4b6b78967d5659a6d80c47464bc93f
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://medium.com

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cache-control
no-cache, no-store, max-age=0, must-revalidate
content-encoding
gzip
content-security-policy
frame-ancestors 'self' https://medium.com
content-type
text/html; charset=utf-8
date
Sun, 21 Aug 2022 03:27:22 GMT
etag
W/"fef6-R9jvfTMYd+lTkBXh9KgK8OSlcPg"
medium-fulfilled-by
valencia/main-20220819-121639-6e8309fd98, lite/main-20220819-155218-a6a5731aff, rito/main-20220819-125712-09d43cc70d, tutu/main-20220819-131123-09d43cc70d
medium-missing-time
193
sepia-upstream
medium
server
nginx
vary
Accept-Encoding
x-envoy-upstream-service-time
130
x-request-received-at
1661052442462

Redirect headers

alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control
no-cache, no-store, max-age=0, must-revalidate
cf-cache-status
DYNAMIC
cf-ray
73e045c3df05bb44-FRA
content-length
0
content-security-policy
default-src 'self'; connect-src https://localhost https://*.instapaper.com https://*.stripe.com https://glyph.medium.com https://*.paypal.com https://*.braintree-api.com https://*.braintreegateway.com https://accounts.google.com https://getpocket.com https://medium.com https://*.medium.com https://*.medium.com https://medium.com https://*.medium.com https://*.algolia.net https://cdn-static-1.medium.com https://dnqgz544uhbo8.cloudfront.net https://cdn-videos-1.medium.com https://cdn-audio-1.medium.com https://lightstep.medium.systems https://*.branch.io 'self'; font-src data: https://*.amazonaws.com https://*.medium.com https://glyph.medium.com https://medium.com https://*.gstatic.com https://dnqgz544uhbo8.cloudfront.net https://cdn-static-1.medium.com 'self'; frame-src chromenull: https: webviewprogressproxy: blob: medium: 'self'; img-src blob: data: https: 'self'; media-src https://*.cdn.vine.co https://d1fcbxp97j4nb2.cloudfront.net https://d262ilb51hltx0.cloudfront.net https://*.medium.com https://gomiro.medium.com https://miro.medium.com https://pbs.twimg.com 'self' blob:; object-src 'self'; script-src 'unsafe-eval' 'unsafe-inline' about: https: 'self'; style-src 'unsafe-inline' data: https: 'self'; report-uri https://csp.medium.com
content-type
text/plain;charset=UTF-8
date
Sun, 21 Aug 2022 03:27:22 GMT
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
expires
Thu, 09 Sep 1999 09:09:09 GMT
link
<https://medium.com/humans.txt>; rel="humans"
location
https://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992.?gi=fce521df7cbc
medium-fulfilled-by
edgy/8.3.0, valencia/main-20220819-121639-6e8309fd98
pragma
no-cache
server
cloudflare
strict-transport-security
max-age=15552000; includeSubDomains; preload
vary
Accept-Encoding
worker-missing-cookies
1
x-content-type-options
nosniff
x-envoy-upstream-service-time
22
x-frame-options
sameorigin
x-obvious-info
20220819-1312-root,09d43cc7
x-obvious-tid
1661052442285:93511834bf19
x-opentracing
{"ot-tracer-spanid":"1d424e3074503d34","ot-tracer-traceid":"43d81866b3f87209","ot-tracer-sampled":"true"}
x-powered-by
Medium
x-ua-compatible
IE=edge, Chrome=1
x-xss-protection
1; mode=block
unbound.css
glyph.medium.com/css/ 		12 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://glyph.medium.com/css/unbound.css
Requested by
Host: posts.specterops.io
URL: https://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992.?gi=fce521df7cbc
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:7::a29f:9804 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9f2c1f3ed67f960d3ba0f120c688de9a9ac07db0a32ef8ad2eec65e703fe62f3
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://posts.specterops.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date
Sun, 21 Aug 2022 03:27:22 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
3424
x-envoy-upstream-service-time
2
strict-transport-security
max-age=15552000; includeSubDomains; preload
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age
86400
access-control-allow-methods
GET, POST, PUT, DELETE
content-type
text/css
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=7200
access-control-allow-credentials
true
cf-ray
73e045c738f6bb44-FRA
access-control-allow-headers
Accept, Cache-Control, Content-Type, Cookie, DNT, Origin, User-Agent, X-Client-Date, X-Obvious-Cid, X-Opentracing, X-Xsrf-Token, ot-tracer-sampled, ot-tracer-spanid, ot-tracer-traceid
expires
Sun, 21 Aug 2022 05:27:22 GMT
1*8rgW0Qvy2bSGSBMlORMhQA.png
miro.medium.com/max/0/ 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://miro.medium.com/max/0/1*8rgW0Qvy2bSGSBMlORMhQA.png
Requested by
Host: posts.specterops.io
URL: https://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992.?gi=fce521df7cbc
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:7::a29f:9804 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://posts.specterops.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers
1*ErUzRtpA1KJr93I-T5kCpQ@2x.jpeg
miro.medium.com/fit/c/80/80/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://miro.medium.com/fit/c/80/80/1*ErUzRtpA1KJr93I-T5kCpQ@2x.jpeg
Requested by
Host: posts.specterops.io
URL: https://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992.?gi=fce521df7cbc
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:7::a29f:9804 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
eb204887ddb35d03f8430bd913fa28bfb2e5f5535de5123a8514203d6cce7629
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://posts.specterops.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date
Sun, 21 Aug 2022 03:27:22 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
age
48400
x-envoy-upstream-service-time
131
strict-transport-security
max-age=15552000; includeSubDomains; preload
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
2890
pragma
public
sepia-upstream
medium
cf-bgj
h2pri
server
cloudflare
etag
"16.3"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
medium-fulfilled-by
miro/main-20211118-133226-0da3f823da
accept-ranges
bytes
cf-ray
73e045c7490bbb44-FRA
expires
Tue, 20 Sep 2022 03:27:22 GMT
1*HJS2Dolxg5B0n7u1oJ213w.jpeg
miro.medium.com/fit/c/80/80/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://miro.medium.com/fit/c/80/80/1*HJS2Dolxg5B0n7u1oJ213w.jpeg
Requested by
Host: posts.specterops.io
URL: https://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992.?gi=fce521df7cbc
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:7::a29f:9804 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1ce4427bfbac3014cefafb8dc32b0bde12d8e1aea983f1f95e5e795417731b9c
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://posts.specterops.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date
Sun, 21 Aug 2022 03:27:22 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
age
419264
x-envoy-upstream-service-time
52
strict-transport-security
max-age=15552000; includeSubDomains; preload
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
2978
pragma
public
sepia-upstream
medium
cf-bgj
h2pri
server
cloudflare
etag
"16.3"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
medium-fulfilled-by
miro/main-20211118-133226-0da3f823da
accept-ranges
bytes
cf-ray
73e045c7490cbb44-FRA
expires
Tue, 20 Sep 2022 03:27:22 GMT
1*AuwihOv-G6udHbXes_-rhA.jpeg
miro.medium.com/fit/c/80/80/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://miro.medium.com/fit/c/80/80/1*AuwihOv-G6udHbXes_-rhA.jpeg
Requested by
Host: posts.specterops.io
URL: https://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992.?gi=fce521df7cbc
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:7::a29f:9804 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a117758fa6c72e27ea67353419e32a6833fe5f1051426159d25926b3970cc2d7
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://posts.specterops.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date
Sun, 21 Aug 2022 03:27:22 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
age
48400
x-envoy-upstream-service-time
75
strict-transport-security
max-age=15552000; includeSubDomains; preload
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
2628
pragma
public
sepia-upstream
medium
cf-bgj
h2pri
server
cloudflare
etag
"16.3"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
medium-fulfilled-by
miro/main-20211118-133226-0da3f823da
accept-ranges
bytes
cf-ray
73e045c7490dbb44-FRA
expires
Tue, 20 Sep 2022 03:27:22 GMT
manifest.29d169f6.js
cdn-client.medium.com/lite/static/js/ 		10 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn-client.medium.com/lite/static/js/manifest.29d169f6.js
Requested by
Host: posts.specterops.io
URL: https://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992.?gi=fce521df7cbc
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:7::a29f:9804 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
df42f7b47e70951e53b063c74b6a4d85a0bafac7e1bacc213ba70469b2cb2454
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://posts.specterops.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date
Sun, 21 Aug 2022 03:27:22 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
128828
content-type
application/javascript
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-request-id
52CRN92X02MEDM3K
x-amz-id-2
TTP3XXhR+ZU8Uong1yZ5dDffniFYVorH6nzHpW1HamiuLuv32n9HeNqTQeWnmlP+9C7R/ZlPViU=
last-modified
Fri, 19 Aug 2022 14:13:01 GMT
server
cloudflare
etag
W/"fe611127706bdbb99cde1f66e82a4c59"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15552000; includeSubDomains; preload
x-amz-version-id
plVKdxOkftqmi_vjcXLlGm_OzuprkLBq
vary
Accept-Encoding
cache-control
public, max-age=31536000
cf-ray
73e045c75916bb44-FRA
expires
Mon, 21 Aug 2023 03:27:22 GMT
221.eb6d4e84.js
cdn-client.medium.com/lite/static/js/ 		691 KB
213 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn-client.medium.com/lite/static/js/221.eb6d4e84.js
Requested by
Host: posts.specterops.io
URL: https://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992.?gi=fce521df7cbc
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:7::a29f:9804 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d9b271a0704c0769d9d4c43e4888575d36d13c7c7f0f4281965d90aed51d0a44
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://posts.specterops.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date
Sun, 21 Aug 2022 03:27:22 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
310261
content-type
application/javascript
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-request-id
J2TVWCT1EY9N2ACT
x-amz-id-2
AdbnGoZITPw5AWsHgEIvXYgiPZgy5XVnPYvmDgCgX/9Y22m9b757aLHTZLskxG4TdBNklNLgyCM=
last-modified
Wed, 03 Aug 2022 13:07:29 GMT
server
cloudflare
etag
W/"8217b3c83342b21eef3049023dae74f7"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15552000; includeSubDomains; preload
x-amz-version-id
eFYPkrNVdSEA2cbFUgGI5AL5fmJ6xhM1
vary
Accept-Encoding
cache-control
public, max-age=31536000
cf-ray
73e045c75915bb44-FRA
expires
Mon, 21 Aug 2023 03:27:22 GMT
main.8959632f.js
cdn-client.medium.com/lite/static/js/ 		732 KB
176 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn-client.medium.com/lite/static/js/main.8959632f.js
Requested by
Host: posts.specterops.io
URL: https://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992.?gi=fce521df7cbc
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:7::a29f:9804 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b92dfb845f3a184029a9df9dc79e8d273efa6caa194c3745984e7bbecb2c7a11
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://posts.specterops.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date
Sun, 21 Aug 2022 03:27:22 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
128828
content-type
application/javascript
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-request-id
52CK6JKFKFJ8SVCW
x-amz-id-2
qhieZu5XA/SzcqJuhPpR9bQ2bgztLT6wXwerYl4Lt8ACuJDeaHwHbanJMAObETuLEfT4ssFGlSE=
last-modified
Fri, 19 Aug 2022 14:12:55 GMT
server
cloudflare
etag
W/"a46be8f4025ffcbfb895ec17bc4aa1b1"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15552000; includeSubDomains; preload
x-amz-version-id
o5Hcg6lxr1mzLPb4ktL.xNykGURME3iI
vary
Accept-Encoding
cache-control
public, max-age=31536000
cf-ray
73e045c75917bb44-FRA
expires
Mon, 21 Aug 2023 03:27:22 GMT
instrumentation.d4892e93.chunk.js
cdn-client.medium.com/lite/static/js/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn-client.medium.com/lite/static/js/instrumentation.d4892e93.chunk.js
Requested by
Host: posts.specterops.io
URL: https://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992.?gi=fce521df7cbc
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:7::a29f:9804 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8c4eb367086e5f555599ef54c0e862a4f4b13e7bbb6161d859d1bc8a82fa9813
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://posts.specterops.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date
Sun, 21 Aug 2022 03:27:22 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
1062043
content-type
application/javascript
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-request-id
2R4VYQDMXXZBT37Z
x-amz-id-2
unNu4ubM7VT2JbFvJQ1MXAag2BZqoB8SbP5yjgkjPFWxUL6TSJOdrglouvrmS40SnaWtkbn+8FE=
last-modified
Fri, 01 Jul 2022 00:11:22 GMT
server
cloudflare
etag
W/"e88ebc420a64202472eb95f862dbaa1b"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15552000; includeSubDomains; preload
x-amz-version-id
PqdKEjQEBl6639b0HbvHFMWJurUzoji2
vary
Accept-Encoding
cache-control
public, max-age=31536000
cf-ray
73e045c7591abb44-FRA
expires
Mon, 21 Aug 2023 03:27:22 GMT
8732.9d4e0df2.chunk.js
cdn-client.medium.com/lite/static/js/ 		65 KB
19 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn-client.medium.com/lite/static/js/8732.9d4e0df2.chunk.js
Requested by
Host: posts.specterops.io
URL: https://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992.?gi=fce521df7cbc
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:7::a29f:9804 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
008b735b5e27e2ddea50ac42eeaef63fae74d969ff15e3144c7b9f7c927baffd
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://posts.specterops.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date
Sun, 21 Aug 2022 03:27:22 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
812878
content-type
application/javascript
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-request-id
VKC99QTCBK1JJRSK
x-amz-id-2
q5KO0l+kDDFVGCiz9TdU1XKQr813wXW0hWzBb+kJKHGPuS2cbr/qlFqjRQD4lviAyLSsWb0H0qU=
last-modified
Tue, 28 Jun 2022 21:50:52 GMT
server
cloudflare
etag
W/"6282534288238b33d8aa9c488837d8c9"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15552000; includeSubDomains; preload
x-amz-version-id
NxzGjDoZXtQ2GwkHKvwxxgw5Nexyfnov
vary
Accept-Encoding
cache-control
public, max-age=31536000
cf-ray
73e045c75919bb44-FRA
expires
Mon, 21 Aug 2023 03:27:22 GMT
2837.3a7dccc7.chunk.js
cdn-client.medium.com/lite/static/js/ 		15 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn-client.medium.com/lite/static/js/2837.3a7dccc7.chunk.js
Requested by
Host: posts.specterops.io
URL: https://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992.?gi=fce521df7cbc
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:7::a29f:9804 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5fa397435621ac9a4cb734a4a8d7da8debb23084c25e5aa6b2b3f0edd753f558
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://posts.specterops.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date
Sun, 21 Aug 2022 03:27:22 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
111160
content-type
application/javascript
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-request-id
4YW6BRVHK5N56J7W
x-amz-id-2
ceO0sXcbVtuxdhlGhIGrY28Tp/2dxuqqSD2hdpMHuSIHlXDUMHM28kubYYmVh7H0lJ2rhcAEWYE=
last-modified
Fri, 05 Aug 2022 19:52:47 GMT
server
cloudflare
etag
W/"b8152514d9c11b05556e146255855286"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15552000; includeSubDomains; preload
x-amz-version-id
yp2pMVy7TIk029DpetwV29YM16Z4pn4G
vary
Accept-Encoding
cache-control
public, max-age=31536000
cf-ray
73e045c75918bb44-FRA
expires
Mon, 21 Aug 2023 03:27:22 GMT
AppLayout.d8ec10e1.chunk.js
cdn-client.medium.com/lite/static/js/ 		106 KB
21 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn-client.medium.com/lite/static/js/AppLayout.d8ec10e1.chunk.js
Requested by
Host: posts.specterops.io
URL: https://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992.?gi=fce521df7cbc
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:7::a29f:9804 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
70c32d8e4fa288b45099a05ac62e52b7e56e9bfb9d770716b0145825b9519926
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://posts.specterops.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date
Sun, 21 Aug 2022 03:27:22 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
128774
content-type
application/javascript
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-request-id
52CMZ7XJ9E66S2MT
x-amz-id-2
PGTLAcmHTQMRyQCj7QEWWquZsULDkV0DGa3KIluGkVOe4C9Sd3YydWFQ3UibCntngaRx48nNwP8=
last-modified
Fri, 19 Aug 2022 14:12:20 GMT
server
cloudflare
etag
W/"fa86db75dd1759716b836ce1900859a4"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15552000; includeSubDomains; preload
x-amz-version-id
eb5a.gPDGBn6khtnwP5DrtPpXzIytKqh
vary
Accept-Encoding
cache-control
public, max-age=31536000
cf-ray
73e045c7b951bb44-FRA
expires
Mon, 21 Aug 2023 03:27:22 GMT
reporting.bbdcaa9d.chunk.js
cdn-client.medium.com/lite/static/js/ 		1 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn-client.medium.com/lite/static/js/reporting.bbdcaa9d.chunk.js
Requested by
Host: posts.specterops.io
URL: https://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992.?gi=fce521df7cbc
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:7::a29f:9804 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4a96cae42b1009fa744e6e9d4149f69da1ad14892d80a57ca04f6b0e3f1d9e46
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://posts.specterops.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date
Sun, 21 Aug 2022 03:27:22 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
1061947
content-type
application/javascript
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-request-id
2R4YTKBCDDS6HF3J
x-amz-id-2
hpLJFwZLVe3kLMmVyN1xu6SbW8NO3o//weOaZ5BXpjjUY6yHS7cvPj69YBWyN1dhbN/YbQe1UB4=
last-modified
Fri, 01 Jul 2022 00:11:40 GMT
server
cloudflare
etag
W/"72bc359fe3377069bd162b3be6ed3d05"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15552000; includeSubDomains; preload
x-amz-version-id
hDbV.8OiTMB.Vn8rqDBCJ.dxBb4bMoaR
vary
Accept-Encoding
cache-control
public, max-age=31536000
cf-ray
73e045c7b952bb44-FRA
expires
Mon, 21 Aug 2023 03:27:22 GMT
4270.c0f5b685.chunk.js
cdn-client.medium.com/lite/static/js/ 		5 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn-client.medium.com/lite/static/js/4270.c0f5b685.chunk.js
Requested by
Host: posts.specterops.io
URL: https://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992.?gi=fce521df7cbc
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:7::a29f:9804 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d787d15d3e723baa0a7493cbb2e220bd72a640111eca49229ab21aa82a3c0fb8
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://posts.specterops.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date
Sun, 21 Aug 2022 03:27:22 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
362856
content-type
application/javascript
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-request-id
C2ZN163S1S828YMM
x-amz-id-2
lN1VMVaeaxRA6JY7+jojWRuyaU3UMOhyF07ltDGS+YyWWVSyvqeb9ASTn/Hr82e9/OYyZQ+ZxgQ=
last-modified
Wed, 08 Jun 2022 01:57:01 GMT
server
cloudflare
etag
W/"ecb15ff3b96846c74bbdba0df72c6c69"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15552000; includeSubDomains; preload
x-amz-version-id
KSkooLLVUmAEyr4Mvb9mqebbFmTOLR9I
vary
Accept-Encoding
cache-control
public, max-age=31536000
cf-ray
73e045c7b953bb44-FRA
expires
Mon, 21 Aug 2023 03:27:22 GMT
1752.a348f767.chunk.js
cdn-client.medium.com/lite/static/js/ 		23 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn-client.medium.com/lite/static/js/1752.a348f767.chunk.js
Requested by
Host: posts.specterops.io
URL: https://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992.?gi=fce521df7cbc
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:7::a29f:9804 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
961f2b3e92eba06b032c090511ab8fb8b65ff7f0b471c7bd22817061288f8368
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://posts.specterops.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date
Sun, 21 Aug 2022 03:27:22 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
1014285
content-type
application/javascript
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-request-id
KZ14F4DJ39Z3KD31
x-amz-id-2
EH9a3SVQgwGg+xgKP+wLoMBxv4vi3bqNF1lLFBsPfty2oXINnyDdoXCZNr63aUDBWO4Du/Lj2Tk=
last-modified
Tue, 25 May 2021 18:36:29 GMT
server
cloudflare
etag
W/"7741f0aa651938c2144d2a015cea95e3"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15552000; includeSubDomains; preload
x-amz-version-id
tE2Oq32GJtDB6jVcHF3DcPbZYJQJcUaP
vary
Accept-Encoding
cache-control
public, max-age=31536000
cf-ray
73e045c7b954bb44-FRA
expires
Mon, 21 Aug 2023 03:27:22 GMT
7794.9590314e.chunk.js
cdn-client.medium.com/lite/static/js/ 		9 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn-client.medium.com/lite/static/js/7794.9590314e.chunk.js
Requested by
Host: posts.specterops.io
URL: https://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992.?gi=fce521df7cbc
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:7::a29f:9804 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0a68bdc22aa6d2deedff5c4999e3618222cf20b0902530b7f924b9e2a4300e40
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://posts.specterops.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date
Sun, 21 Aug 2022 03:27:22 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
115040
content-type
application/javascript
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-request-id
ZZ2GZ8XPEV2XSK8Q
x-amz-id-2
ZlnxwgkjMnGtnnoC7ojH0QwhC0XfdFWPNT0tzpzMx7ygzdLPg6cqgl3wZCpV+Z2ow4dAGrEJyes=
last-modified
Tue, 25 May 2021 18:36:34 GMT
server
cloudflare
etag
W/"fdb51abd005c8009b18f0a8ff313072f"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15552000; includeSubDomains; preload
x-amz-version-id
edEnQQoOPA8J97QSUBTjXG.e16leDLA5
vary
Accept-Encoding
cache-control
public, max-age=31536000
cf-ray
73e045c7b955bb44-FRA
expires
Mon, 21 Aug 2023 03:27:22 GMT
8316.18f2a6aa.chunk.js
cdn-client.medium.com/lite/static/js/ 		6 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn-client.medium.com/lite/static/js/8316.18f2a6aa.chunk.js
Requested by
Host: posts.specterops.io
URL: https://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992.?gi=fce521df7cbc
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:7::a29f:9804 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
83ba7707bfe79a63651504c93f7a572d83f1effea66a3e9429a4b10f26c38899
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://posts.specterops.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date
Sun, 21 Aug 2022 03:27:22 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
115040
content-type
application/javascript
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-request-id
CNHD5SFN5Y8TW45S
x-amz-id-2
hFIjAklPE8uAiFD3F+iWoIjr1hZAL+bvgJNwZvAJEZUDnYTo6ZgZ84z2QdIcyEiccMTz7/tDkuo=
last-modified
Thu, 14 Apr 2022 09:06:33 GMT
server
cloudflare
etag
W/"9fa67454adaeb385a3a70077ff7b7df1"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15552000; includeSubDomains; preload
x-amz-version-id
QUYK47Sx_vLYH.MHyrUF8Ib7srVpusAN
vary
Accept-Encoding
cache-control
public, max-age=31536000
cf-ray
73e045c7b958bb44-FRA
expires
Mon, 21 Aug 2023 03:27:22 GMT
5221.06a0b41f.chunk.js
cdn-client.medium.com/lite/static/js/ 		23 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn-client.medium.com/lite/static/js/5221.06a0b41f.chunk.js
Requested by
Host: posts.specterops.io
URL: https://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992.?gi=fce521df7cbc
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:7::a29f:9804 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
05c4d00fffe6af6e9025f21d345c629cf51f22be6252f877b1899a4a2400c0c8
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://posts.specterops.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date
Sun, 21 Aug 2022 03:27:22 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
220002
content-type
application/javascript
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-request-id
VE28HFEC9Q6413DQ
x-amz-id-2
kA5fKbGI7k+gixls1Z0xghbtaW+LYqqgsqKXMq5YFOrUCD+zREqcax314QkjwVUAwsP0+3gONA8=
last-modified
Thu, 18 Aug 2022 09:01:19 GMT
server
cloudflare
etag
W/"b1449ed6fde8fc058f591da0ae4e0d43"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15552000; includeSubDomains; preload
x-amz-version-id
kTEAB57AMd00E0W0o_VmWloESfxXzj0y
vary
Accept-Encoding
cache-control
public, max-age=31536000
cf-ray
73e045c7b959bb44-FRA
expires
Mon, 21 Aug 2023 03:27:22 GMT
4330.1bf9fad7.chunk.js
cdn-client.medium.com/lite/static/js/ 		23 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn-client.medium.com/lite/static/js/4330.1bf9fad7.chunk.js
Requested by
Host: posts.specterops.io
URL: https://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992.?gi=fce521df7cbc
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:7::a29f:9804 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
bbcda18e1943f0f75e8175a83e202f28fba2c0c47d32c7f754d8dd036ad81d4b
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://posts.specterops.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date
Sun, 21 Aug 2022 03:27:22 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
128774
content-type
application/javascript
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-request-id
Q3K8X89VWEQWFJFP
x-amz-id-2
8rYXe8zduUzNNWU53wt/4/8VrtqKg4JdvbHF87JAX2bZJXzbcLDL1Zf5d8yG6G/0YOh8H//6un0=
last-modified
Fri, 19 Aug 2022 09:09:11 GMT
server
cloudflare
etag
W/"04ebdc2cf5ce5b3af61fb14aad72c9cf"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15552000; includeSubDomains; preload
x-amz-version-id
rlLggrivkn9IZHyP5QRp3Psll4yBPofV
vary
Accept-Encoding
cache-control
public, max-age=31536000
cf-ray
73e045c7b95abb44-FRA
expires
Mon, 21 Aug 2023 03:27:22 GMT
2981.c8b67800.chunk.js
cdn-client.medium.com/lite/static/js/ 		8 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn-client.medium.com/lite/static/js/2981.c8b67800.chunk.js
Requested by
Host: posts.specterops.io
URL: https://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992.?gi=fce521df7cbc
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:7::a29f:9804 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f5d17ba49b5f0294f90d348d8f5892105fbfefbc0264d55eb82300cbf58c2ce0
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://posts.specterops.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date
Sun, 21 Aug 2022 03:27:22 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
139370
content-type
application/javascript
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-request-id
GAQFSEGQ7ZX9WVAM
x-amz-id-2
JZ3QGAr3YDxzfAuaIsASsvJvN+RTmdc03eLiHotXzIYN053sc/z1HPnQtDrlr+KdJljcubb5W7Y=
last-modified
Fri, 19 Aug 2022 10:43:45 GMT
server
cloudflare
etag
W/"ae90acd9390e2e8ae30aa02c7d1d058e"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15552000; includeSubDomains; preload
x-amz-version-id
TKbpTetPCYsKF3g5_IiCFHFhUDC2WY1y
vary
Accept-Encoding
cache-control
public, max-age=31536000
cf-ray
73e045c7b95bbb44-FRA
expires
Mon, 21 Aug 2023 03:27:22 GMT
3115.2b079df5.chunk.js
cdn-client.medium.com/lite/static/js/ 		150 KB
39 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn-client.medium.com/lite/static/js/3115.2b079df5.chunk.js
Requested by
Host: posts.specterops.io
URL: https://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992.?gi=fce521df7cbc
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:7::a29f:9804 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
12fab1118e4be062559b1448f84d7f9bfd7053a4720332ed4da990d0d91d95f8
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://posts.specterops.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date
Sun, 21 Aug 2022 03:27:22 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
136132
content-type
application/javascript
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-request-id
WVNKNY72BN4264GH
x-amz-id-2
NOWNADfK5+o7jxoSApYcdUOXhDzUT9Ss6oaw3YahrrtPyqRmEYgE63/zXF5Ew0HgdmPZxkweWx8=
last-modified
Thu, 04 Aug 2022 20:37:37 GMT
server
cloudflare
etag
W/"3c75de9a125d29852ce1005d10427ddc"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15552000; includeSubDomains; preload
x-amz-version-id
y7lFnprI0oiRQ6Kqgs7Ozi4o.OkiOrrr
vary
Accept-Encoding
cache-control
public, max-age=31536000
cf-ray
73e045c7b95cbb44-FRA
expires
Mon, 21 Aug 2023 03:27:22 GMT
4869.15af887a.chunk.js
cdn-client.medium.com/lite/static/js/ 		12 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn-client.medium.com/lite/static/js/4869.15af887a.chunk.js
Requested by
Host: posts.specterops.io
URL: https://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992.?gi=fce521df7cbc
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:7::a29f:9804 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
78bedd375082bded00712183c8e141c4d65dfcffb8b4bd369e3081e1027a1338
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://posts.specterops.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date
Sun, 21 Aug 2022 03:27:22 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
363896
content-type
application/javascript
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-request-id
BVXG0076RV4B9JAP
x-amz-id-2
uKH8UQbmWp1mPmCPTJvTtTv1kuEn3ARbt5hpFXJtd9Q7grMGajh8gSczyhsbEk9PSu4/TmP63i8=
last-modified
Tue, 21 Jun 2022 18:46:21 GMT
server
cloudflare
etag
W/"461c7bfcd82063a67a77f584159505ce"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15552000; includeSubDomains; preload
x-amz-version-id
zsasPIPj4VNjHd6lWz1Ablp9oC5jhxmA
vary
Accept-Encoding
cache-control
public, max-age=31536000
cf-ray
73e045c7b95dbb44-FRA
expires
Mon, 21 Aug 2023 03:27:22 GMT
5472.5f6d4371.chunk.js
cdn-client.medium.com/lite/static/js/ 		11 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn-client.medium.com/lite/static/js/5472.5f6d4371.chunk.js
Requested by
Host: posts.specterops.io
URL: https://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992.?gi=fce521df7cbc
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:7::a29f:9804 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ee6184aa8ad5fa680d2808790bb04a001d8369d143b313da43af3794ab7ea3e5
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://posts.specterops.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date
Sun, 21 Aug 2022 03:27:22 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
115040
content-type
application/javascript
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-request-id
CNH8PTMK5AP330DM
x-amz-id-2
xGpOOu8UZAzsu1YWUtNuDaspxj3NnwdsbLl4CFr6mQNnuC5VgdmPYNonihLFzHPh0iUQuVnGPss=
last-modified
Thu, 14 Apr 2022 09:06:30 GMT
server
cloudflare
etag
W/"6adb8844d763f7d58b6ed49ab89899c7"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15552000; includeSubDomains; preload
x-amz-version-id
M9BL7xv54wPjdaXSST5ko_cL9x0mMNwi
vary
Accept-Encoding
cache-control
public, max-age=31536000
cf-ray
73e045c7b95ebb44-FRA
expires
Mon, 21 Aug 2023 03:27:22 GMT
9401.492bc814.chunk.js
cdn-client.medium.com/lite/static/js/ 		22 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn-client.medium.com/lite/static/js/9401.492bc814.chunk.js
Requested by
Host: posts.specterops.io
URL: https://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992.?gi=fce521df7cbc
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:7::a29f:9804 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ba5bf3fa263482c7fb5667136879875ef46b6bda007664510797fddc88b1244d
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://posts.specterops.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date
Sun, 21 Aug 2022 03:27:22 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
363896
content-type
application/javascript
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-request-id
BVXT7BCCKH158FM3
x-amz-id-2
fmyPMPKPQeWvDtiHrQgX5CGXZTku+5n0vOfhSaA2QdzDZmCmY1RbWsXR1l8WR2n7FzWl5DH3jRU=
last-modified
Tue, 21 Jun 2022 18:46:28 GMT
server
cloudflare
etag
W/"1ddc9c0c19f0fe0be7a7d8a22ff4b327"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15552000; includeSubDomains; preload
x-amz-version-id
o7qB8yuUJ2.ySHF37F8FxNhTjXdITIXy
vary
Accept-Encoding
cache-control
public, max-age=31536000
cf-ray
73e045c7b95fbb44-FRA
expires
Mon, 21 Aug 2023 03:27:22 GMT
2307.e2eee8fb.chunk.js
cdn-client.medium.com/lite/static/js/ 		43 KB
12 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn-client.medium.com/lite/static/js/2307.e2eee8fb.chunk.js
Requested by
Host: posts.specterops.io
URL: https://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992.?gi=fce521df7cbc
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:7::a29f:9804 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4a0ab426387b4578de5273a69f300167c07ceef4d6fd614061f82e744912caf3
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://posts.specterops.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date
Sun, 21 Aug 2022 03:27:22 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
1069316
content-type
application/javascript
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-request-id
C161FKXC1QHNCGJ5
x-amz-id-2
VDHgfeX3rOnFPcDMyWQmOisa1RU2GseRafJzK1phkL0TbrZgYDmVx6uwAFSigxUD2XCvUAKuZ7s=
last-modified
Mon, 11 Jul 2022 17:54:24 GMT
server
cloudflare
etag
W/"7d0f7b40aa739665bb020b5a1565de04"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15552000; includeSubDomains; preload
x-amz-version-id
qIXQQpBSzO.nx9tUzBqTqIUMorGPbz14
vary
Accept-Encoding
cache-control
public, max-age=31536000
cf-ray
73e045c7b960bb44-FRA
expires
Mon, 21 Aug 2023 03:27:22 GMT
9442.5291e270.chunk.js
cdn-client.medium.com/lite/static/js/ 		21 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn-client.medium.com/lite/static/js/9442.5291e270.chunk.js
Requested by
Host: posts.specterops.io
URL: https://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992.?gi=fce521df7cbc
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:7::a29f:9804 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
344df165dff1ae918acd3a503ff235364e3e2588b76ac6ac7afe9b28a347d661
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://posts.specterops.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date
Sun, 21 Aug 2022 03:27:22 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
308758
content-type
application/javascript
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-request-id
8NAYDQE9MQK743Q9
x-amz-id-2
Q+YMUo3f6jyml7SXk6SmWMrC+AY114aKXRjQlxqfefqQ7aN4c6PDcZ7B2XOvKqS3AdCjuSFaiK8=
last-modified
Wed, 06 Jul 2022 07:53:44 GMT
server
cloudflare
etag
W/"3edcd4d9e5942e997e7195e591b148c6"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15552000; includeSubDomains; preload
x-amz-version-id
pCL2A.BoWSvPuskvdf9gJgCn0qWM.lXJ
vary
Accept-Encoding
cache-control
public, max-age=31536000
cf-ray
73e045c7b961bb44-FRA
expires
Mon, 21 Aug 2023 03:27:22 GMT
7070.4ba587c4.chunk.js
cdn-client.medium.com/lite/static/js/ 		18 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn-client.medium.com/lite/static/js/7070.4ba587c4.chunk.js
Requested by
Host: posts.specterops.io
URL: https://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992.?gi=fce521df7cbc
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:7::a29f:9804 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
05050a7f9156fca338fdf18683aba2fc6810ae354eae1c647bd786c05c7fa369
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://posts.specterops.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date
Sun, 21 Aug 2022 03:27:22 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
879813
content-type
application/javascript
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-request-id
VRBCPMJBPG92T288
x-amz-id-2
Nq8zLg44/1nh7KpJFbh9SoI54n8gmcYTDENnt5yMPN05j0QYhTHEUpNZHmn/zCpVrWrB1yk08nE=
last-modified
Wed, 29 Jun 2022 22:03:10 GMT
server
cloudflare
etag
W/"fd36f064abbbaf7b29c9f3a8e4011812"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15552000; includeSubDomains; preload
x-amz-version-id
SwMGig1K1198JJuUScFH8NXAGwDIOmeE
vary
Accept-Encoding
cache-control
public, max-age=31536000
cf-ray
73e045c7b962bb44-FRA
expires
Mon, 21 Aug 2023 03:27:22 GMT
4483.0a43a5ce.chunk.js
cdn-client.medium.com/lite/static/js/ 		24 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn-client.medium.com/lite/static/js/4483.0a43a5ce.chunk.js
Requested by
Host: posts.specterops.io
URL: https://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992.?gi=fce521df7cbc
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:7::a29f:9804 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b4c2d3ac3573990d7b0d77e4a006d6d40bb259ce817b64d9223d7e117c259293
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://posts.specterops.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date
Sun, 21 Aug 2022 03:27:22 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
442793
content-type
application/javascript
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-request-id
W3D8VPVQKPJHDC62
x-amz-id-2
ytI/ljuGLDtWZEwYKNhFOgDeD2WTPgxo05GxSQEDIon/zinlUDuR+/2Nyy0YzyZcgw8tUYCCnFU=
last-modified
Mon, 01 Aug 2022 21:57:50 GMT
server
cloudflare
etag
W/"bf55b6950792bc738fb0d12bda42e128"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15552000; includeSubDomains; preload
x-amz-version-id
nXdB1pZcC2zXCHIpRf4DyB5qHFX0z_KH
vary
Accept-Encoding
cache-control
public, max-age=31536000
cf-ray
73e045c7b963bb44-FRA
expires
Mon, 21 Aug 2023 03:27:22 GMT
210.f2d589d2.chunk.js
cdn-client.medium.com/lite/static/js/ 		32 KB
11 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn-client.medium.com/lite/static/js/210.f2d589d2.chunk.js
Requested by
Host: posts.specterops.io
URL: https://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992.?gi=fce521df7cbc
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:7::a29f:9804 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fc4e14de11834a07a456fe0d9fb8aafa563947eb506bfeff5a5e6549d91948df
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://posts.specterops.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date
Sun, 21 Aug 2022 03:27:22 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
879819
content-type
application/javascript
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-request-id
VRB62HQF9KZWZDNS
x-amz-id-2
9xy6z54+hwogO0SXBWj9eBNu/rPHcLWhZ+qzFF3+A9yqmlTxsqrx9zk4O12IQOcIM76g/vqZfoM=
last-modified
Wed, 29 Jun 2022 22:03:04 GMT
server
cloudflare
etag
W/"9a35f014802f77682c7a5dea172b39f0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15552000; includeSubDomains; preload
x-amz-version-id
NufGT1xWWTJHfKM35WiTPKCz6YBkLYaA
vary
Accept-Encoding
cache-control
public, max-age=31536000
cf-ray
73e045c7b965bb44-FRA
expires
Mon, 21 Aug 2023 03:27:22 GMT
864.b1b3cbfe.chunk.js
cdn-client.medium.com/lite/static/js/ 		15 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn-client.medium.com/lite/static/js/864.b1b3cbfe.chunk.js
Requested by
Host: posts.specterops.io
URL: https://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992.?gi=fce521df7cbc
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:7::a29f:9804 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
671c3a0a31006e6d8a14663bc1a9a26b5932d117c408b824601209446681818b
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://posts.specterops.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date
Sun, 21 Aug 2022 03:27:22 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
725515
content-type
application/javascript
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-request-id
4GV6P4BCR3JVE00W
x-amz-id-2
XYd5LanLCynxR3eN0gQMIg1RKPgzEFqAqk17TxtMw31scz1nZiPIk84FBiL18k3V4sV/ED+EX/E=
last-modified
Thu, 11 Aug 2022 23:41:34 GMT
server
cloudflare
etag
W/"dac07218b3bd056a8b8f8768c07ec92c"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15552000; includeSubDomains; preload
x-amz-version-id
SLtLST95HkkWDjHOoiHi87cH9zt1QQgS
vary
Accept-Encoding
cache-control
public, max-age=31536000
cf-ray
73e045c7d976bb44-FRA
expires
Mon, 21 Aug 2023 03:27:22 GMT
9841.1bb423da.chunk.js
cdn-client.medium.com/lite/static/js/ 		10 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn-client.medium.com/lite/static/js/9841.1bb423da.chunk.js
Requested by
Host: posts.specterops.io
URL: https://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992.?gi=fce521df7cbc
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:7::a29f:9804 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8b5255e96502b2b45b78b0e006ddd885fbbfdec57eda875d73c57c213ebe031c
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://posts.specterops.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date
Sun, 21 Aug 2022 03:27:22 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
308757
content-type
application/javascript
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-request-id
8NAXTKXVT5YRHG8C
x-amz-id-2
6RKhOlsS35C1DjFeoOeZMOD90SHxxnChKIQkQecxgi1FNFcL9Jw/77BJ3rP6obK3+XmQcVD4AV8=
last-modified
Wed, 06 Jul 2022 07:53:45 GMT
server
cloudflare
etag
W/"a438d4b84fc984bedab39eff52de7d1b"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15552000; includeSubDomains; preload
x-amz-version-id
1xI7YK_MjEYp2K.Qr19IRQM3SL0GPfHl
vary
Accept-Encoding
cache-control
public, max-age=31536000
cf-ray
73e045c7d977bb44-FRA
expires
Mon, 21 Aug 2023 03:27:22 GMT
1681.08ba3d39.chunk.js
cdn-client.medium.com/lite/static/js/ 		29 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn-client.medium.com/lite/static/js/1681.08ba3d39.chunk.js
Requested by
Host: posts.specterops.io
URL: https://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992.?gi=fce521df7cbc
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:7::a29f:9804 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c52d3fccbb007e0d9dd980ebd09d66d9dc643cbf4ba224ed2b227e8509892825
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://posts.specterops.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date
Sun, 21 Aug 2022 03:27:22 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
479993
content-type
application/javascript
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-request-id
72K6X38YY3BK0VP3
x-amz-id-2
8KEXHK8WZ0DB3hNY7B8X+1QMQZvBZTrI0/z6TD/jKSOGYLH/CAPnEq85mN/njVZU65KIljYpJNg=
last-modified
Wed, 27 Jul 2022 18:52:22 GMT
server
cloudflare
etag
W/"bfd6407f6bb6a9dd31ab731f1a2bbb35"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15552000; includeSubDomains; preload
x-amz-version-id
PIR4.T_GjbL8QPCayeFtdvPwoztRJDnI
vary
Accept-Encoding
cache-control
public, max-age=31536000
cf-ray
73e045c7d979bb44-FRA
expires
Mon, 21 Aug 2023 03:27:22 GMT
1018.7751940c.chunk.js
cdn-client.medium.com/lite/static/js/ 		15 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn-client.medium.com/lite/static/js/1018.7751940c.chunk.js
Requested by
Host: posts.specterops.io
URL: https://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992.?gi=fce521df7cbc
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:7::a29f:9804 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
05e683582182d82981126d3413288170e49be62d16996e37144133b6158977f2
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://posts.specterops.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date
Sun, 21 Aug 2022 03:27:22 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
725515
content-type
application/javascript
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-request-id
PYBZKPWRW0SFB6CT
x-amz-id-2
OyFrTwGzdSI7/bdEW2LV1wLYNLqDyRSk54q8VWVbj1x8GaK4iOj0vq7M0UjitO5OwcUUq+foXwM=
last-modified
Thu, 11 Aug 2022 23:41:23 GMT
server
cloudflare
etag
W/"228eb20cca332f1b337280aba55db1ea"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15552000; includeSubDomains; preload
x-amz-version-id
QGlrd5STug_bVCEDRLtBn52.wxEbdZ4H
vary
Accept-Encoding
cache-control
public, max-age=31536000
cf-ray
73e045c7d97bbb44-FRA
expires
Mon, 21 Aug 2023 03:27:22 GMT
9304.0cb94a81.chunk.js
cdn-client.medium.com/lite/static/js/ 		18 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn-client.medium.com/lite/static/js/9304.0cb94a81.chunk.js
Requested by
Host: posts.specterops.io
URL: https://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992.?gi=fce521df7cbc
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:7::a29f:9804 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
85680d3c77cd3614269bce280229fa6bebfe637c767374279107aa08ad2445b7
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://posts.specterops.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date
Sun, 21 Aug 2022 03:27:22 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
725515
content-type
application/javascript
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-request-id
PYBR1DKCN47BG4ZF
x-amz-id-2
P0QqCo9GiORu/1Uu4KnPQvcZS/Yrfpj/H8laqiPmaJvk8V0DTIp/P4sPencvBBmFDY7M96Wm670=
last-modified
Thu, 11 Aug 2022 23:41:35 GMT
server
cloudflare
etag
W/"35a365dd6d3637cc9e506a50fd80f196"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15552000; includeSubDomains; preload
x-amz-version-id
EUbbSDBYtr6yy40B98WAsjnEFwTlEUsj
vary
Accept-Encoding
cache-control
public, max-age=31536000
cf-ray
73e045c7d97cbb44-FRA
expires
Mon, 21 Aug 2023 03:27:22 GMT
1579.d42a41fe.chunk.js
cdn-client.medium.com/lite/static/js/ 		9 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn-client.medium.com/lite/static/js/1579.d42a41fe.chunk.js
Requested by
Host: posts.specterops.io
URL: https://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992.?gi=fce521df7cbc
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:7::a29f:9804 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fec16a472e685f22d9ad57d42e20dc052a9bd255950aabc48b628eaca247b3f3
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://posts.specterops.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date
Sun, 21 Aug 2022 03:27:22 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
1080780
content-type
application/javascript
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-request-id
W7GM9KN75DZ0HYK9
x-amz-id-2
xtM+fKBIR7z9K0RkrETLLhvZcMGt221HXYN4aC3O2Y8YJiNkGwFYIek80Pxcy/JyMdIGmom7BRw=
last-modified
Mon, 08 Aug 2022 14:33:40 GMT
server
cloudflare
etag
W/"9b4a0033f4cd833da3bf51118ff1d3e8"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15552000; includeSubDomains; preload
x-amz-version-id
9YW5PJWTCkia0VUOyQvU5WDibJOL_Tpp
vary
Accept-Encoding
cache-control
public, max-age=31536000
cf-ray
73e045c7d97dbb44-FRA
expires
Mon, 21 Aug 2023 03:27:22 GMT
8051.21e8e5f9.chunk.js
cdn-client.medium.com/lite/static/js/ 		59 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn-client.medium.com/lite/static/js/8051.21e8e5f9.chunk.js
Requested by
Host: posts.specterops.io
URL: https://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992.?gi=fce521df7cbc
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:7::a29f:9804 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
509ced3d3b592e6fe143aed420afb0dc1cf4c1d25b6574cc9dfead62c3350870
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://posts.specterops.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date
Sun, 21 Aug 2022 03:27:22 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
977943
content-type
application/javascript
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-request-id
S9HRZY7RH8ETMMSM
x-amz-id-2
x87vMDOTgt/RTDct24CD2+evv8vuL3Y3LSnO1ADQQWnB122KYB5svTKTRGzErkuWqdlBkdRKxnU=
last-modified
Mon, 08 Aug 2022 19:49:07 GMT
server
cloudflare
etag
W/"d46527581792a422e82dc0a3589f2e1c"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15552000; includeSubDomains; preload
x-amz-version-id
kra28l_9v28pXuENT2edj12ZzCBKp0.J
vary
Accept-Encoding
cache-control
public, max-age=31536000
cf-ray
73e045c7d97ebb44-FRA
expires
Mon, 21 Aug 2023 03:27:22 GMT
334.1987698a.chunk.js
cdn-client.medium.com/lite/static/js/ 		32 KB
9 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn-client.medium.com/lite/static/js/334.1987698a.chunk.js
Requested by
Host: posts.specterops.io
URL: https://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992.?gi=fce521df7cbc
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:7::a29f:9804 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1a4be9f1473151d2ad4cd6b976d3cf90c71d9471d99b17fb49725f12e249e338
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://posts.specterops.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date
Sun, 21 Aug 2022 03:27:22 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
111404
content-type
application/javascript
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-request-id
KYXDJVWJMVSZ1DXX
x-amz-id-2
Mq6G3Ur8eyDUvWlQykaxK5yKQB2yWAKYfXAf0JH+8U78Gm74h01fVRpLAdyD4CSWtzo1p0ryLSc=
last-modified
Fri, 05 Aug 2022 20:16:53 GMT
server
cloudflare
etag
W/"407b86382747a8721ecfc96700eff51b"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15552000; includeSubDomains; preload
x-amz-version-id
lZeVjzFGZBrJqMZ6a1yaKBSRdXE9oLxH
vary
Accept-Encoding
cache-control
public, max-age=31536000
cf-ray
73e045c7d97fbb44-FRA
expires
Mon, 21 Aug 2023 03:27:22 GMT
251.80d522dd.chunk.js
cdn-client.medium.com/lite/static/js/ 		27 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn-client.medium.com/lite/static/js/251.80d522dd.chunk.js
Requested by
Host: posts.specterops.io
URL: https://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992.?gi=fce521df7cbc
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:7::a29f:9804 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9c5bbca13a0274452220f8cbabf9c85832528c5587bdce1576357b7e543ea104
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://posts.specterops.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date
Sun, 21 Aug 2022 03:27:22 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
278385
content-type
application/javascript
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-request-id
5Q1NQNRYPMY4N5PS
x-amz-id-2
TeecfaQrKEeG07D8yk8mH0DTGuQMmsq8hOUmiYmViUaECBeShip4IGx2CdHMaqQ43Zipx1LTRes=
last-modified
Wed, 17 Aug 2022 21:34:20 GMT
server
cloudflare
etag
W/"6080fe0cf5f982689e35d99ffb7d9066"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15552000; includeSubDomains; preload
x-amz-version-id
ptz9xMbLsK8yEThk7N189.3h9d4t_xOB
vary
Accept-Encoding
cache-control
public, max-age=31536000
cf-ray
73e045c7d980bb44-FRA
expires
Mon, 21 Aug 2023 03:27:22 GMT
5754.6687b8d5.chunk.js
cdn-client.medium.com/lite/static/js/ 		17 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn-client.medium.com/lite/static/js/5754.6687b8d5.chunk.js
Requested by
Host: posts.specterops.io
URL: https://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992.?gi=fce521df7cbc
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:7::a29f:9804 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b1e92c14799368b0d71e27852d5b17948e2d3afad881d404f25aa05550bb3f48
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://posts.specterops.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date
Sun, 21 Aug 2022 03:27:22 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
724720
content-type
application/javascript
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-request-id
BABNVAC1BSV2C8K2
x-amz-id-2
JuAasHgUwNuFUAxgOmmPG+bBIkW5yXPNOZqk3r8KUPVeaUKAUHQjXw6QBt3GUwX6eWS+1+eA1Co=
last-modified
Fri, 20 May 2022 05:33:41 GMT
server
cloudflare
etag
W/"d8cccf81b0e959008ed590e4a91a1c61"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15552000; includeSubDomains; preload
x-amz-version-id
jm4XNl7ULcgGCxMyZPfaouJSQOG7cvnF
vary
Accept-Encoding
cache-control
public, max-age=31536000
cf-ray
73e045c7d981bb44-FRA
expires
Mon, 21 Aug 2023 03:27:22 GMT
PostPage.MainContent.3f668324.chunk.js
cdn-client.medium.com/lite/static/js/ 		119 KB
27 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn-client.medium.com/lite/static/js/PostPage.MainContent.3f668324.chunk.js
Requested by
Host: posts.specterops.io
URL: https://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992.?gi=fce521df7cbc
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:7::a29f:9804 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
20f2e846bde6a5fe62fc88a907be5427076190b7744ed192cfa73cc77a83e77c
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://posts.specterops.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date
Sun, 21 Aug 2022 03:27:22 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
212303
content-type
application/javascript
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-request-id
ME21RH9S4T7MPZHD
x-amz-id-2
r8rcgirP1HinOWo+QyDcBYCO3xkgAgm3G7ISMZg7selrswBzd3vjfu5XayeGvRX69B3vAElLILw=
last-modified
Thu, 18 Aug 2022 16:12:58 GMT
server
cloudflare
etag
W/"e46cd35681c08bc801e1df027b9f8d36"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15552000; includeSubDomains; preload
x-amz-version-id
RVrH1UW.hcfRASGZyIoAG3pIBbAre4WQ
vary
Accept-Encoding
cache-control
public, max-age=31536000
cf-ray
73e045c7d982bb44-FRA
expires
Mon, 21 Aug 2023 03:27:22 GMT
3702.99c8e9df.chunk.js
cdn-client.medium.com/lite/static/js/ 		21 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn-client.medium.com/lite/static/js/3702.99c8e9df.chunk.js
Requested by
Host: posts.specterops.io
URL: https://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992.?gi=fce521df7cbc
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:7::a29f:9804 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c15c2602de0285908cbcc7403cf7d64be078ce73e5ac12cd76a4bbe058498c63
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://posts.specterops.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date
Sun, 21 Aug 2022 03:27:22 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
725515
content-type
application/javascript
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-request-id
B3AZ66D1S2ZN5QKA
x-amz-id-2
Q3HwxaB0qO7eYtWUiltaS2+7NZUAUgsdiYv2Da5Mnjoo4f0t1yq+B9G+ueJH8qxNQO9qz03KKXk=
last-modified
Fri, 12 Aug 2022 16:40:24 GMT
server
cloudflare
etag
W/"6e745650946015a44a7ced9c89fa5bad"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15552000; includeSubDomains; preload
x-amz-version-id
ZIF89cviSHV23ApKm4ylE6Cd1nopyN_M
vary
Accept-Encoding
cache-control
public, max-age=31536000
cf-ray
73e045c7d983bb44-FRA
expires
Mon, 21 Aug 2023 03:27:22 GMT
2021.3321f6a0.chunk.js
cdn-client.medium.com/lite/static/js/ 		9 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn-client.medium.com/lite/static/js/2021.3321f6a0.chunk.js
Requested by
Host: posts.specterops.io
URL: https://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992.?gi=fce521df7cbc
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:7::a29f:9804 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
10f700c67fec93e54b772be1bb062cc63d947386f001aa2d1b988ececb806126
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://posts.specterops.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date
Sun, 21 Aug 2022 03:27:22 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
135161
content-type
application/javascript
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-request-id
TDZW3M0XQYYH3EGF
x-amz-id-2
H0Z9EcvHD7ajNrAWzJrJ9F+24OLTkVEIAo1d6DQUld1cezA6Zqcp+Bs1bCR9OetjqB7moFgZ5E8=
last-modified
Fri, 05 Aug 2022 13:30:54 GMT
server
cloudflare
etag
W/"936168d058821e80682c82e0702c525b"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15552000; includeSubDomains; preload
x-amz-version-id
RYh6qC2V0HTvvoDrzw4dUbCxwavk6F0j
vary
Accept-Encoding
cache-control
public, max-age=31536000
cf-ray
73e045c7d984bb44-FRA
expires
Mon, 21 Aug 2023 03:27:22 GMT
9291.54612f18.chunk.js
cdn-client.medium.com/lite/static/js/ 		20 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn-client.medium.com/lite/static/js/9291.54612f18.chunk.js
Requested by
Host: posts.specterops.io
URL: https://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992.?gi=fce521df7cbc
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:7::a29f:9804 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ecc79b96c9bce058e6ed0782f4be50303e597c23425324bedd4d6ae08478cb59
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://posts.specterops.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date
Sun, 21 Aug 2022 03:27:22 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
725515
content-type
application/javascript
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-request-id
PYBGCTHVYH7VPQEG
x-amz-id-2
c+jsNh1L1lqRpU+DyiKfYCirtz9ZAuZ7kehGEHIVoWue38SzJ3LDI1wY09UTxb7onv2tMENvgOo=
last-modified
Thu, 11 Aug 2022 23:41:35 GMT
server
cloudflare
etag
W/"415f600a46cb403b8dedfd511e49dff3"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15552000; includeSubDomains; preload
x-amz-version-id
Ry_wfERWyTnFMlU7IGxxnASKhlEIVoCR
vary
Accept-Encoding
cache-control
public, max-age=31536000
cf-ray
73e045c7d985bb44-FRA
expires
Mon, 21 Aug 2023 03:27:22 GMT
PostPage.RightColumnContent.1629a6fb.chunk.js
cdn-client.medium.com/lite/static/js/ 		38 KB
11 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn-client.medium.com/lite/static/js/PostPage.RightColumnContent.1629a6fb.chunk.js
Requested by
Host: posts.specterops.io
URL: https://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992.?gi=fce521df7cbc
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:7::a29f:9804 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
256599a9e5ad9e04645f8e793ceee2528791650afb3adec6548835cc4092b895
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://posts.specterops.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date
Sun, 21 Aug 2022 03:27:22 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
374402
content-type
application/javascript
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-request-id
R8N1QFWYB1MX93HP
x-amz-id-2
APRSLNmNNGjG68Mi6453/TTeElajGoRSzqNzLVue7STKiZ7o3291pyTNZapQ+eOpyXvf6ke2oCg=
last-modified
Tue, 02 Aug 2022 18:57:37 GMT
server
cloudflare
etag
W/"0adb78061598f84aa7e23660cd453fc2"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15552000; includeSubDomains; preload
x-amz-version-id
GV.fwiki59VrNK7eg1fyQdIxzorqlsgt
vary
Accept-Encoding
cache-control
public, max-age=31536000
cf-ray
73e045c7d986bb44-FRA
expires
Mon, 21 Aug 2023 03:27:22 GMT
1*6XM15VaWbf7HK1HmiRkv1Q.png
miro.medium.com/max/1534/ 		916 KB
918 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://miro.medium.com/max/1534/1*6XM15VaWbf7HK1HmiRkv1Q.png
Requested by
Host: posts.specterops.io
URL: https://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992.?gi=fce521df7cbc
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:7::a29f:9804 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
57cca6a573f50ef861f32cf6ac1c2f9e622b72396edc71ee6ec320eb0852ced0
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://posts.specterops.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date
Sun, 21 Aug 2022 03:27:22 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
age
417464
x-envoy-upstream-service-time
69
strict-transport-security
max-age=15552000; includeSubDomains; preload
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
938357
pragma
public
sepia-upstream
medium
server
cloudflare
etag
"16.3"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=2592000
medium-fulfilled-by
miro/main-20211118-133226-0da3f823da
accept-ranges
bytes
cf-ray
73e045c7b94cbb44-FRA
expires
Tue, 20 Sep 2022 03:27:22 GMT
1*WPMRCdxJhe4cvefeJ5FbmQ.jpeg
miro.medium.com/max/1534/ 		236 KB
236 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://miro.medium.com/max/1534/1*WPMRCdxJhe4cvefeJ5FbmQ.jpeg
Requested by
Host: posts.specterops.io
URL: https://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992.?gi=fce521df7cbc
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:7::a29f:9804 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f49dd05c9e66318b4c49435f7d061daf1d4cd1241fcb312d738a35e223773d12
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://posts.specterops.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date
Sun, 21 Aug 2022 03:27:22 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
age
59131
x-envoy-upstream-service-time
120
strict-transport-security
max-age=15552000; includeSubDomains; preload
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
241602
pragma
public
sepia-upstream
medium
cf-bgj
h2pri
server
cloudflare
etag
"16.3"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
medium-fulfilled-by
miro/main-20211118-133226-0da3f823da
accept-ranges
bytes
cf-ray
73e045c7b94dbb44-FRA
expires
Tue, 20 Sep 2022 03:27:22 GMT
1*tKP4kGZhSa-H0wroJxY3fQ.jpeg
miro.medium.com/max/1534/ 		439 KB
440 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://miro.medium.com/max/1534/1*tKP4kGZhSa-H0wroJxY3fQ.jpeg
Requested by
Host: posts.specterops.io
URL: https://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992.?gi=fce521df7cbc
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:7::a29f:9804 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
76ab71ee0832196f5a54cd924b4473fed49378abf993060767ff831a286aafed
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://posts.specterops.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date
Sun, 21 Aug 2022 03:27:22 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
age
47229
x-envoy-upstream-service-time
130
strict-transport-security
max-age=15552000; includeSubDomains; preload
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
449950
pragma
public
sepia-upstream
medium
cf-bgj
h2pri
server
cloudflare
etag
"16.3"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
medium-fulfilled-by
miro/main-20211118-133226-0da3f823da
accept-ranges
bytes
cf-ray
73e045c7b94ebb44-FRA
expires
Tue, 20 Sep 2022 03:27:22 GMT
gt-super-400-normal.woff
glyph.medium.com/font/4a44748/0-3j_4g_53_6bu_6c4_6c8_6c9_6cc_6cd_6ci_6cm/ 		13 KB
14 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://glyph.medium.com/font/4a44748/0-3j_4g_53_6bu_6c4_6c8_6c9_6cc_6cd_6ci_6cm/gt-super-400-normal.woff
Requested by
Host: glyph.medium.com
URL: https://glyph.medium.com/css/unbound.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
40c05a07ac09c244b63a1755d524e094c32a18072335fb6cfc7f13da9cfe3eb9
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://glyph.medium.com/css/unbound.css
Origin
https://posts.specterops.io
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date
Sun, 21 Aug 2022 03:27:22 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
15339482
x-envoy-upstream-service-time
16
strict-transport-security
max-age=15552000; includeSubDomains; preload
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age
86400
access-control-allow-methods
GET, POST, PUT, DELETE
content-type
application/font-woff
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
access-control-allow-credentials
true
cf-ray
73e045c7cddc6928-FRA
access-control-allow-headers
Accept, Cache-Control, Content-Type, Cookie, DNT, Origin, User-Agent, X-Client-Date, X-Obvious-Cid, X-Opentracing, X-Xsrf-Token, ot-tracer-sampled, ot-tracer-spanid, ot-tracer-traceid
expires
Mon, 21 Aug 2023 03:27:22 GMT
sohne-500-normal.woff
glyph.medium.com/font/df9ba7f/0-3j_4g_53_6bu_6c4_6c8_6c9_6cc_6cd_6ci_6cm/ 		18 KB
19 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://glyph.medium.com/font/df9ba7f/0-3j_4g_53_6bu_6c4_6c8_6c9_6cc_6cd_6ci_6cm/sohne-500-normal.woff
Requested by
Host: glyph.medium.com
URL: https://glyph.medium.com/css/unbound.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
65f0c65b5db3aa0568c7986479a4a3e909a05a84fb34ced48d70a2d628dd1444
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://glyph.medium.com/css/unbound.css
Origin
https://posts.specterops.io
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date
Sun, 21 Aug 2022 03:27:22 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
15009799
x-envoy-upstream-service-time
31
strict-transport-security
max-age=15552000; includeSubDomains; preload
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age
86400
access-control-allow-methods
GET, POST, PUT, DELETE
content-type
application/font-woff
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
access-control-allow-credentials
true
cf-ray
73e045c7cddd6928-FRA
access-control-allow-headers
Accept, Cache-Control, Content-Type, Cookie, DNT, Origin, User-Agent, X-Client-Date, X-Obvious-Cid, X-Opentracing, X-Xsrf-Token, ot-tracer-sampled, ot-tracer-spanid, ot-tracer-traceid
expires
Mon, 21 Aug 2023 03:27:22 GMT
sohne-400-normal.woff
glyph.medium.com/font/b492c44/0-3j_4g_53_6bu_6c4_6c8_6c9_6cc_6cd_6ci_6cm/ 		19 KB
19 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://glyph.medium.com/font/b492c44/0-3j_4g_53_6bu_6c4_6c8_6c9_6cc_6cd_6ci_6cm/sohne-400-normal.woff
Requested by
Host: glyph.medium.com
URL: https://glyph.medium.com/css/unbound.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b0f424bafe993b016ea96973894f95dfc4290608478a2d7d3fdd080d9b0a60d1
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://glyph.medium.com/css/unbound.css
Origin
https://posts.specterops.io
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date
Sun, 21 Aug 2022 03:27:22 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
16654089
x-envoy-upstream-service-time
32
strict-transport-security
max-age=15552000; includeSubDomains; preload
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age
86400
access-control-allow-methods
GET, POST, PUT, DELETE
content-type
application/font-woff
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
access-control-allow-credentials
true
cf-ray
73e045c7cdde6928-FRA
access-control-allow-headers
Accept, Cache-Control, Content-Type, Cookie, DNT, Origin, User-Agent, X-Client-Date, X-Obvious-Cid, X-Opentracing, X-Xsrf-Token, ot-tracer-sampled, ot-tracer-spanid, ot-tracer-traceid
expires
Mon, 21 Aug 2023 03:27:22 GMT
1*6XM15VaWbf7HK1HmiRkv1Q.png
miro.medium.com/max/767/ 		285 KB
285 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://miro.medium.com/max/767/1*6XM15VaWbf7HK1HmiRkv1Q.png
Requested by
Host: posts.specterops.io
URL: https://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992.
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5dc4bbd445f554e2935bf052b759ef745229c34a14ddf864f0463e3b6b4579e1
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://posts.specterops.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date
Sun, 21 Aug 2022 03:27:23 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
age
593816
x-envoy-upstream-service-time
58
strict-transport-security
max-age=15552000; includeSubDomains; preload
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
291400
pragma
public
sepia-upstream
medium
server
cloudflare
etag
"16.3"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=2592000
medium-fulfilled-by
miro/main-20211118-133226-0da3f823da
accept-ranges
bytes
cf-ray
73e045cb68876904-FRA
expires
Tue, 20 Sep 2022 03:27:23 GMT
1*WPMRCdxJhe4cvefeJ5FbmQ.jpeg
miro.medium.com/max/767/ 		48 KB
48 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://miro.medium.com/max/767/1*WPMRCdxJhe4cvefeJ5FbmQ.jpeg
Requested by
Host: posts.specterops.io
URL: https://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992.
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5aa6acd1109c663814ef7f5bbe7c5a28098ff1a27b8aab702773dd48cf0c1e23
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://posts.specterops.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date
Sun, 21 Aug 2022 03:27:23 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
age
235561
x-envoy-upstream-service-time
82
strict-transport-security
max-age=15552000; includeSubDomains; preload
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
48667
pragma
public
sepia-upstream
medium
cf-bgj
h2pri
server
cloudflare
etag
"16.3"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
medium-fulfilled-by
miro/main-20211118-133226-0da3f823da
accept-ranges
bytes
cf-ray
73e045cb68886904-FRA
expires
Tue, 20 Sep 2022 03:27:23 GMT
1*tKP4kGZhSa-H0wroJxY3fQ.jpeg
miro.medium.com/max/767/ 		141 KB
141 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://miro.medium.com/max/767/1*tKP4kGZhSa-H0wroJxY3fQ.jpeg
Requested by
Host: posts.specterops.io
URL: https://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992.
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2651880732676607999b5adbc829e2134a182f45d60695c4a1f9f231d21e4f38
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://posts.specterops.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date
Sun, 21 Aug 2022 03:27:23 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
age
593816
x-envoy-upstream-service-time
100
strict-transport-security
max-age=15552000; includeSubDomains; preload
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
144027
pragma
public
sepia-upstream
medium
cf-bgj
h2pri
server
cloudflare
etag
"16.3"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
medium-fulfilled-by
miro/main-20211118-133226-0da3f823da
accept-ranges
bytes
cf-ray
73e045cb68896904-FRA
expires
Tue, 20 Sep 2022 03:27:23 GMT
1*dmbNkD5D-u45r44go_cf0g.png
miro.medium.com/fit/c/24/24/ 		383 B
790 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://miro.medium.com/fit/c/24/24/1*dmbNkD5D-u45r44go_cf0g.png
Requested by
Host: posts.specterops.io
URL: https://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992.
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c7472f7ddd48154cafa5966a38a523318a4c9463190594712195bfaba962220a
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://posts.specterops.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date
Sun, 21 Aug 2022 03:27:23 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
age
114309
x-envoy-upstream-service-time
25
strict-transport-security
max-age=15552000; includeSubDomains; preload
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
383
pragma
public
sepia-upstream
medium
server
cloudflare
etag
"16.3"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=2592000
medium-fulfilled-by
miro/main-20211118-133226-0da3f823da
accept-ranges
bytes
cf-ray
73e045cba8aa6904-FRA
expires
Tue, 20 Sep 2022 03:27:23 GMT
1*8rgW0Qvy2bSGSBMlORMhQA.png
miro.medium.com/max/0/ 		0
0
1*ErUzRtpA1KJr93I-T5kCpQ@2x.jpeg
miro.medium.com/fit/c/40/40/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://miro.medium.com/fit/c/40/40/1*ErUzRtpA1KJr93I-T5kCpQ@2x.jpeg
Requested by
Host: posts.specterops.io
URL: https://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992.
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
81fbed4e0104cb3882d92af4131251f799a53a390a67677d1efa1c60a5feb1c9
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://posts.specterops.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date
Sun, 21 Aug 2022 03:27:23 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
age
17863
x-envoy-upstream-service-time
375
strict-transport-security
max-age=15552000; includeSubDomains; preload
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
1471
pragma
public
sepia-upstream
medium
cf-bgj
h2pri
server
cloudflare
etag
"16.3"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
medium-fulfilled-by
miro/main-20211118-133226-0da3f823da
accept-ranges
bytes
cf-ray
73e045cba8ac6904-FRA
expires
Tue, 20 Sep 2022 03:27:23 GMT
1*HJS2Dolxg5B0n7u1oJ213w.jpeg
miro.medium.com/fit/c/40/40/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://miro.medium.com/fit/c/40/40/1*HJS2Dolxg5B0n7u1oJ213w.jpeg
Requested by
Host: posts.specterops.io
URL: https://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992.
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
edacbb4f600f16d0aba4c26739b1317f6308d5102363c7047d38c3e3dc45deb8
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://posts.specterops.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date
Sun, 21 Aug 2022 03:27:23 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
age
32506
x-envoy-upstream-service-time
1888
strict-transport-security
max-age=15552000; includeSubDomains; preload
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
1440
pragma
public
sepia-upstream
medium
cf-bgj
h2pri
server
cloudflare
etag
"16.3"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
medium-fulfilled-by
miro/main-20211118-133226-0da3f823da
accept-ranges
bytes
cf-ray
73e045cba8ad6904-FRA
expires
Tue, 20 Sep 2022 03:27:23 GMT
1*AuwihOv-G6udHbXes_-rhA.jpeg
miro.medium.com/fit/c/40/40/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://miro.medium.com/fit/c/40/40/1*AuwihOv-G6udHbXes_-rhA.jpeg
Requested by
Host: posts.specterops.io
URL: https://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992.
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1e433e9fd4aad0b2bc26fee66e5f05ee4d0e2dae8039831ed947175778e48289
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://posts.specterops.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date
Sun, 21 Aug 2022 03:27:23 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
age
227015
x-envoy-upstream-service-time
292
strict-transport-security
max-age=15552000; includeSubDomains; preload
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
1435
pragma
public
sepia-upstream
medium
cf-bgj
h2pri
server
cloudflare
etag
"16.3"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
medium-fulfilled-by
miro/main-20211118-133226-0da3f823da
accept-ranges
bytes
cf-ray
73e045cba8ae6904-FRA
expires
Tue, 20 Sep 2022 03:27:23 GMT
1*8rgW0Qvy2bSGSBMlORMhQA.png
miro.medium.com/proxy/ 		274 KB
275 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://miro.medium.com/proxy/1*8rgW0Qvy2bSGSBMlORMhQA.png
Requested by
Host: posts.specterops.io
URL: https://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992.
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
646d8cb64a720e7a4867157e23cd3dd5f55cfe3c4fa33998a48821a4a8277363
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://posts.specterops.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date
Sun, 21 Aug 2022 03:27:23 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
age
79710
x-envoy-upstream-service-time
104
strict-transport-security
max-age=15552000; includeSubDomains; preload
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
280968
pragma
public
sepia-upstream
medium
server
cloudflare
etag
"16.3"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=2592000
medium-fulfilled-by
miro/main-20211118-133226-0da3f823da
accept-ranges
bytes
cf-ray
73e045cbd8d36904-FRA
expires
Tue, 20 Sep 2022 03:27:23 GMT
graphql
posts.specterops.io/_/ 		143 B
440 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://posts.specterops.io/_/graphql
Requested by
Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/221.eb6d4e84.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.4.38.70 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-4-38-70.compute-1.amazonaws.com
Software
nginx /
Resource Hash
e407bb45d1989e7da18b99474857fcb5ebffa9e7bbb16aecacbddccd1efc260f
Security Headers
Name Value
X-Xss-Protection 0

Request headers

apollographql-client-name
lite
medium-frontend-route
post
ot-tracer-sampled
true
accept-language
de-DE,de;q=0.9
ot-tracer-traceid
17ba8c88bc940f81
medium-frontend-path
/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992.
graphql-operation
VisitorQuery
content-type
application/json
accept
*/*
Referer
https://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992.
medium-frontend-app
lite/main-20220819-155218-a6a5731aff
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
apollographql-client-version
main-20220819-155218-a6a5731aff
ot-tracer-spanid
4461ea3d1e6ca6d0

Response headers

date
Sun, 21 Aug 2022 03:27:23 GMT
sepia-upstream
medium
server
nginx
etag
W/"8f-maPozfsB5+GqVSF+dzuTg0whyYw"
content-type
application/json; charset=utf-8
access-control-allow-origin
*
medium-fulfilled-by
valencia/main-20220819-121639-6e8309fd98, rito/main-20220819-125712-09d43cc70d
x-envoy-upstream-service-time
11
content-length
143
x-xss-protection
0
x-request-received-at
1661052443552
graphql
posts.specterops.io/_/ 		108 B
429 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://posts.specterops.io/_/graphql
Requested by
Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/221.eb6d4e84.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.4.38.70 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-4-38-70.compute-1.amazonaws.com
Software
nginx /
Resource Hash
02e9e1939e214dfa38c8eab94afca48043e7f00c46e95908662548a7d19819e1
Security Headers
Name Value
X-Xss-Protection 0

Request headers

apollographql-client-name
lite
medium-frontend-route
post
ot-tracer-sampled
true
accept-language
de-DE,de;q=0.9
ot-tracer-traceid
17ba8c88bc940f81
medium-frontend-path
/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992.
graphql-operation
PostPageMeterQuery
content-type
application/json
accept
*/*
Referer
https://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992.
medium-frontend-app
lite/main-20220819-155218-a6a5731aff
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
apollographql-client-version
main-20220819-155218-a6a5731aff
ot-tracer-spanid
4461ea3d1e6ca6d0

Response headers

date
Sun, 21 Aug 2022 03:27:23 GMT
sepia-upstream
medium
server
nginx
etag
W/"6c-I3CG28DxUiEEF9QH3iLEotaTHR8"
content-type
application/json; charset=utf-8
access-control-allow-origin
*
medium-fulfilled-by
valencia/main-20220819-121639-6e8309fd98, rito/main-20220819-125712-09d43cc70d, tutu/main-20220819-131123-09d43cc70d
x-envoy-upstream-service-time
34
content-length
108
x-xss-protection
0
x-request-received-at
1661052443552
shim.js
cdn.sprig.com/ 		193 KB
69 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.sprig.com/shim.js?id=WISfSM8eD3
Requested by
Host: posts.specterops.io
URL: https://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992.?gi=fce521df7cbc
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.225.78.70 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-225-78-70.fra2.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
ec9cea8ff0551809116f897242d87779daa8c5847e088191b5c7fcf7d5325f99

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://posts.specterops.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

x-amz-version-id
fvnEO8KuYg4KCmjYX6vKQqvUny90_mFB
content-encoding
gzip
last-modified
Thu, 18 Aug 2022 19:10:22 GMT
server
AmazonS3
age
13410
etag
W/"aad2e41e4cf49032d1d9bf15fe9e4217"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
via
1.1 f99b5b46e77cfe9c3413f99dc8a4088c.cloudfront.net (CloudFront)
date
Sat, 20 Aug 2022 23:43:59 GMT
x-amz-cf-pop
FRA2-C2
x-amz-cf-id
kh2etSaKSNn2QhM2fN_bu2vyiBA0WdGFcq9GeSRuV7SdcalRt9lNTA==
analytics.js
www.google-analytics.com/ 		49 KB
20 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: posts.specterops.io
URL: https://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992.?gi=fce521df7cbc
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://posts.specterops.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 13 Apr 2022 21:02:38 GMT
server
Golfe2
age
1286
date
Sun, 21 Aug 2022 03:05:57 GMT
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
20006
expires
Sun, 21 Aug 2022 05:05:57 GMT
branch-latest.min.js
cdn.branch.io/ 		76 KB
23 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.branch.io/branch-latest.min.js
Requested by
Host: posts.specterops.io
URL: https://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992.?gi=fce521df7cbc
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
99.86.240.73 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-86-240-73.vie50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
3f39b863af13e4947632922f698a345a33f45f618e25cbdda80fecdb029c1d8f

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://posts.specterops.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

x-amz-version-id
TYUFb0ZW1v2KsNT79quwkf.N0GdhhUX6
content-encoding
gzip
last-modified
Thu, 11 Aug 2022 19:34:23 GMT
server
AmazonS3
age
153
etag
"6002812647adfb5e20a34acdfe3de9f2"
x-cache
Hit from cloudfront
content-type
text/javascript
via
1.1 89325178f4430fe7d65a260b33ed0234.cloudfront.net (CloudFront)
cache-control
max-age=300
date
Sun, 21 Aug 2022 03:24:53 GMT
x-amz-cf-pop
VIE50-C1
content-length
23151
x-amz-cf-id
Zca4rT2j-F2ubULO8FUQKncenVjre1WnMD2XnzaqoeibsSXcFz8R4g==
/
posts.specterops.io/_/clientele/reports/performance/ 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://posts.specterops.io/_/clientele/reports/performance/
Requested by
Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/main.8959632f.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.4.38.70 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-4-38-70.compute-1.amazonaws.com
Software
nginx /
Resource Hash

Request headers

Referer
https://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992.
Medium-Clientele-Client
lite
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
Content-Type
application/json

Response headers

date
Sun, 21 Aug 2022 03:27:23 GMT
medium-fulfilled-by
valencia/main-20220819-121639-6e8309fd98, clientele/main-20220815-151000-eca7c63127
x-envoy-upstream-service-time
4
sepia-upstream
medium
server
nginx
content-length
0
content-type
application/octet-stream
/
posts.specterops.io/_/clientele/reports/performance/ 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://posts.specterops.io/_/clientele/reports/performance/
Requested by
Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/main.8959632f.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.4.38.70 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-4-38-70.compute-1.amazonaws.com
Software
nginx /
Resource Hash

Request headers

Referer
https://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992.
Medium-Clientele-Client
lite
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
Content-Type
application/json

Response headers

date
Sun, 21 Aug 2022 03:27:23 GMT
medium-fulfilled-by
valencia/main-20220819-121639-6e8309fd98, clientele/main-20220815-151000-eca7c63127
x-envoy-upstream-service-time
5
sepia-upstream
medium
server
nginx
content-length
0
content-type
application/octet-stream
/
posts.specterops.io/_/clientele/reports/performance/ 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://posts.specterops.io/_/clientele/reports/performance/
Requested by
Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/main.8959632f.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.4.38.70 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-4-38-70.compute-1.amazonaws.com
Software
nginx /
Resource Hash

Request headers

Referer
https://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992.
Medium-Clientele-Client
lite
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
Content-Type
application/json

Response headers

date
Sun, 21 Aug 2022 03:27:23 GMT
medium-fulfilled-by
valencia/main-20220819-121639-6e8309fd98, clientele/main-20220815-151000-eca7c63127
x-envoy-upstream-service-time
4
sepia-upstream
medium
server
nginx
content-length
0
content-type
application/octet-stream
collect
www.google-analytics.com/j/ 		2 B
22 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j96&a=2018489058&t=pageview&_s=1&dl=https%3A%2F%2Fposts.specterops.io%2Flateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992.&ul=en-us&de=UTF-8&dt=Medium&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAEABAAAAAC~&jid=1836879526&gjid=721101695&cid=1196118499.1661052444&tid=UA-24232453-2&_gid=1313873775.1661052444&_r=1&_slc=1&z=850467372
Requested by
Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/221.eb6d4e84.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
a048e640908046be06e00eab37742b5d5ff80964af58cfd22f7cb2de4dfe375f
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://posts.specterops.io/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Sun, 21 Aug 2022 03:27:23 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://posts.specterops.io
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2
expires
Fri, 01 Jan 1990 00:00:00 GMT
_r
app.link/ 		91 B
587 B 		Script
General
Check archive.org
Download Go to
Full URL
https://app.link/_r?sdk=web2.64.0&branch_key=key_live_ofxXr2qTrrU9NqURK8ZwEhknBxiI6KBm&callback=branch_callback__0
Requested by
Host: cdn.branch.io
URL: https://cdn.branch.io/branch-latest.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:20eb:3200:19:9934:6a80:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
openresty /
Resource Hash
39ce007d72b48520cd950dd722e6c7858c0efa7fad414a8853aad1ab8d4a0706
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://posts.specterops.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date
Sun, 21 Aug 2022 03:27:23 GMT
via
1.1 1ac3fd533bf6be1b511077f8b8e23bfc.cloudfront.net (CloudFront)
x-content-type-options
nosniff
server
openresty
x-amz-cf-pop
FRA2-C1
etag
W/"5b-5m23hl8iSNa/3/Kjtt3ri/KnCtQ"
strict-transport-security
max-age=31536000; includeSubDomains
x-cache
Miss from cloudfront
content-type
text/javascript; charset=utf-8
content-length
91
x-amz-cf-id
wo8KTYrMjOu6m-irfg_hY5M9AGoDhvRrjJW2mkITpqXBHwHw9ra3_A==
config
api.sprig.com/sdk/1/environments/WISfSM8eD3/ 		15 KB
3 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://api.sprig.com/sdk/1/environments/WISfSM8eD3/config
Requested by
Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/221.eb6d4e84.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.93.235.75 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-93-235-75.compute-1.amazonaws.com
Software
istio-envoy /
Resource Hash
31176d3e3fda6faed4d5d58c81ff174ec627eac7cb2392d7d49d67c267e60e8c

Request headers

x-ul-visitor-id
469b161e-d134-42ba-86cc-9d9979b42d92
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
Content-Type
application/json
x-ul-installation-method
web-snippet
Referer
https://posts.specterops.io/
x-ul-sdk-version
2.17.2
x-ul-environment-id
WISfSM8eD3
userleap-platform
web

Response headers

date
Sun, 21 Aug 2022 03:27:24 GMT
content-encoding
gzip
x-envoy-decorator-operation
userleap-api.userleap-api.svc.cluster.local:80/*
server
istio-envoy
etag
W/"3cee-D4hyxNlwa7hy5zo3/o9FsgPVy6Y"
vary
Accept-Encoding, Origin
Content-Type
application/json; charset=utf-8
access-control-allow-origin
*
Transfer-Encoding
chunked
x-envoy-upstream-service-time
24
Connection
keep-alive
timing-allow-origin
https://0.0.com, https://0.1.com, https://1.0.com, https://1.1.com
config
api.sprig.com/sdk/1/environments/WISfSM8eD3/ 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://api.sprig.com/sdk/1/environments/WISfSM8eD3/config
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.93.235.75 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-93-235-75.compute-1.amazonaws.com
Software
/
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type,userleap-platform,x-ul-environment-id,x-ul-installation-method,x-ul-sdk-version,x-ul-visitor-id
Access-Control-Request-Method
GET
Origin
https://posts.specterops.io
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Access-Control-Allow-Headers
Accept,Content-Type,authorization,*
Access-Control-Allow-Methods
GET,POST,PUT,PATCH,DELETE,OPTIONS,HEAD
Access-Control-Allow-Origin
*
Access-Control-Max-Age
3600
Connection
keep-alive
Content-Length
0
Date
Sun, 21 Aug 2022 03:27:24 GMT
vary
Origin
open
api2.branch.io/v1/ 		316 B
676 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://api2.branch.io/v1/open
Requested by
Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/221.eb6d4e84.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2491:e00:11:f728:3040:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
a3b56dfdf828a898c33c495edce56330017d1b3d1e1c3214bbb40f2885aee2e6
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://posts.specterops.io/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

date
Sun, 21 Aug 2022 03:27:24 GMT
via
1.1 da749f044be44d389a30372d73356c4e.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P7
strict-transport-security
max-age=31536000; includeSubDomains
x-cache
Miss from cloudfront
content-type
application/json
access-control-allow-origin
*
cache-control
no-cache
x-branch-request-id
5d2951dedba74b25b7a136d66873c19e-2022082103
content-length
316
x-amz-cf-id
BTvaWf0oHgmukvQqSRdQdGP-EoSsYouGKIlHiAQIvx4WH677GAPE3g==
pageview
api2.branch.io/v1/ 		28 B
433 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://api2.branch.io/v1/pageview
Requested by
Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/221.eb6d4e84.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2491:e00:11:f728:3040:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/ Express
Resource Hash
a82dc28d43942326b346f92907df3bea5e38b2325ef97176f3b6234966bf19eb
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://posts.specterops.io/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

date
Sun, 21 Aug 2022 03:27:24 GMT
via
1.1 da749f044be44d389a30372d73356c4e.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P7
x-powered-by
Express
etag
W/"1c-KRZWpHfIKyIHGKJ9mp9lAyX+vFY"
strict-transport-security
max-age=31536000; includeSubDomains
x-cache
Miss from cloudfront
content-type
application/json; charset=utf-8
access-control-allow-origin
*
x-branch-request-id
e68a00cb97ca4f46908fe302ffe84321-2022082103
content-length
28
x-amz-cf-id
zT9BkprZkb7rZ13dfAb00fGrM7bNDYAku2nKmPh7e_OoWG2IqAS0RA==
469b161e-d134-42ba-86cc-9d9979b42d92
api.sprig.com/sdk/1/environments/WISfSM8eD3/visitors/ 		0
815 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://api.sprig.com/sdk/1/environments/WISfSM8eD3/visitors/469b161e-d134-42ba-86cc-9d9979b42d92
Requested by
Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/221.eb6d4e84.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.93.235.75 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-93-235-75.compute-1.amazonaws.com
Software
istio-envoy /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

x-ul-user-id
sprig-anon-c7e1e2c0-cade-4a77-984b-7abf22763535
x-ul-visitor-id
469b161e-d134-42ba-86cc-9d9979b42d92
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
Content-Type
application/json
x-ul-installation-method
web-snippet
Referer
https://posts.specterops.io/
x-ul-sdk-version
2.17.2
x-ul-environment-id
WISfSM8eD3
userleap-platform
web

Response headers

date
Sun, 21 Aug 2022 03:27:24 GMT
x-envoy-decorator-operation
userleap-api.userleap-api.svc.cluster.local:80/*
server
istio-envoy
x-ul-visitor-id
469b161e-d134-42ba-86cc-9d9979b42d92
etag
W/"a-bAsFyilMr4Ra1hIU5PyoyFRunpI"
authorization
Bearer eyJhbGciOiJIUzUxMiIsInR5cCI6IkpXVCJ9.eyJndCI6InZpc2l0b3IiLCJpZCI6IldJU2ZTTThlRDMiLCJ2aWQiOiI0NjliMTYxZS1kMTM0LTQyYmEtODZjYy05ZDk5NzliNDJkOTIiLCJpYXQiOjE2NjEwNTI0NDQsImV4cCI6MTY2MTIyNTI0NH0.vydDbG97BHo9Wsfm9y-JHn4ccUlzaa3waphqJmwYYIpkMfbDGwgOk2ZuuvAlgw6zC9z5BkF2o-yT6QEsQhdUxA
vary
Origin
access-control-allow-origin
*
access-control-expose-headers
Authorization,x-ul-visitor-id
x-envoy-upstream-service-time
18
Connection
keep-alive
timing-allow-origin
https://0.0.com, https://0.1.com, https://1.0.com, https://1.1.com
attributes
api.sprig.com/sdk/1/environments/WISfSM8eD3/visitors/469b161e-d134-42ba-86cc-9d9979b42d92/ 		0
815 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://api.sprig.com/sdk/1/environments/WISfSM8eD3/visitors/469b161e-d134-42ba-86cc-9d9979b42d92/attributes
Requested by
Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/221.eb6d4e84.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.93.235.75 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-93-235-75.compute-1.amazonaws.com
Software
istio-envoy /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

x-ul-user-id
sprig-anon-c7e1e2c0-cade-4a77-984b-7abf22763535
x-ul-visitor-id
469b161e-d134-42ba-86cc-9d9979b42d92
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
Content-Type
application/json
x-ul-installation-method
web-snippet
Referer
https://posts.specterops.io/
x-ul-sdk-version
2.17.2
x-ul-environment-id
WISfSM8eD3
userleap-platform
web

Response headers

date
Sun, 21 Aug 2022 03:27:24 GMT
x-envoy-decorator-operation
userleap-api.userleap-api.svc.cluster.local:80/*
server
istio-envoy
x-ul-visitor-id
469b161e-d134-42ba-86cc-9d9979b42d92
etag
W/"a-bAsFyilMr4Ra1hIU5PyoyFRunpI"
authorization
Bearer eyJhbGciOiJIUzUxMiIsInR5cCI6IkpXVCJ9.eyJndCI6InZpc2l0b3IiLCJpZCI6IldJU2ZTTThlRDMiLCJ2aWQiOiI0NjliMTYxZS1kMTM0LTQyYmEtODZjYy05ZDk5NzliNDJkOTIiLCJpYXQiOjE2NjEwNTI0NDQsImV4cCI6MTY2MTIyNTI0NH0.vydDbG97BHo9Wsfm9y-JHn4ccUlzaa3waphqJmwYYIpkMfbDGwgOk2ZuuvAlgw6zC9z5BkF2o-yT6QEsQhdUxA
vary
Origin
access-control-allow-origin
*
access-control-expose-headers
Authorization,x-ul-visitor-id
x-envoy-upstream-service-time
64
Connection
keep-alive
timing-allow-origin
https://0.0.com, https://0.1.com, https://1.0.com, https://1.1.com
469b161e-d134-42ba-86cc-9d9979b42d92
api.sprig.com/sdk/1/environments/WISfSM8eD3/visitors/ 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://api.sprig.com/sdk/1/environments/WISfSM8eD3/visitors/469b161e-d134-42ba-86cc-9d9979b42d92
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.93.235.75 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-93-235-75.compute-1.amazonaws.com
Software
/
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type,userleap-platform,x-ul-environment-id,x-ul-installation-method,x-ul-sdk-version,x-ul-user-id,x-ul-visitor-id
Access-Control-Request-Method
PUT
Origin
https://posts.specterops.io
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Access-Control-Allow-Headers
Accept,Content-Type,authorization,*
Access-Control-Allow-Methods
GET,POST,PUT,PATCH,DELETE,OPTIONS,HEAD
Access-Control-Allow-Origin
*
Access-Control-Max-Age
3600
Connection
keep-alive
Content-Length
0
Date
Sun, 21 Aug 2022 03:27:24 GMT
vary
Origin
attributes
api.sprig.com/sdk/1/environments/WISfSM8eD3/visitors/469b161e-d134-42ba-86cc-9d9979b42d92/ 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://api.sprig.com/sdk/1/environments/WISfSM8eD3/visitors/469b161e-d134-42ba-86cc-9d9979b42d92/attributes
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.93.235.75 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-93-235-75.compute-1.amazonaws.com
Software
/
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type,userleap-platform,x-ul-environment-id,x-ul-installation-method,x-ul-sdk-version,x-ul-user-id,x-ul-visitor-id
Access-Control-Request-Method
PUT
Origin
https://posts.specterops.io
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Access-Control-Allow-Headers
Accept,Content-Type,authorization,*
Access-Control-Allow-Methods
GET,POST,PUT,PATCH,DELETE,OPTIONS,HEAD
Access-Control-Allow-Origin
*
Access-Control-Max-Age
3600
Connection
keep-alive
Content-Length
0
Date
Sun, 21 Aug 2022 03:27:24 GMT
vary
Origin
oh-noes
posts.specterops.io/_/ 		101 B
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://posts.specterops.io/_/oh-noes
Requested by
Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/main.8959632f.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.4.38.70 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-4-38-70.compute-1.amazonaws.com
Software
nginx / Medium
Resource Hash
Security Headers
Name Value
Content-Security-Policy default-src 'self'; connect-src https://localhost https://*.instapaper.com https://*.stripe.com https://glyph.medium.com https://*.paypal.com https://*.braintree-api.com https://*.braintreegateway.com https://accounts.google.com https://getpocket.com https://posts.specterops.io https://*.posts.specterops.io https://*.medium.com https://medium.com https://*.medium.com https://*.algolia.net https://cdn-static-1.medium.com https://dnqgz544uhbo8.cloudfront.net https://cdn-videos-1.medium.com https://cdn-audio-1.medium.com https://lightstep.medium.systems https://*.branch.io 'self'; font-src data: https://*.amazonaws.com https://*.medium.com https://glyph.medium.com https://medium.com https://*.gstatic.com https://dnqgz544uhbo8.cloudfront.net https://cdn-static-1.medium.com 'self'; frame-src chromenull: https: webviewprogressproxy: blob: medium: 'self'; img-src blob: data: https: 'self'; media-src https://*.cdn.vine.co https://d1fcbxp97j4nb2.cloudfront.net https://d262ilb51hltx0.cloudfront.net https://*.medium.com https://gomiro.medium.com https://miro.medium.com https://pbs.twimg.com 'self' blob:; object-src 'self'; script-src 'unsafe-eval' 'unsafe-inline' about: https: 'self'; style-src 'unsafe-inline' data: https: 'self'; report-uri https://csp.medium.com
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

Referer
https://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992.
x-xsrf-token
1
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
content-type
application/json

Response headers

content-security-policy
default-src 'self'; connect-src https://localhost https://*.instapaper.com https://*.stripe.com https://glyph.medium.com https://*.paypal.com https://*.braintree-api.com https://*.braintreegateway.com https://accounts.google.com https://getpocket.com https://posts.specterops.io https://*.posts.specterops.io https://*.medium.com https://medium.com https://*.medium.com https://*.algolia.net https://cdn-static-1.medium.com https://dnqgz544uhbo8.cloudfront.net https://cdn-videos-1.medium.com https://cdn-audio-1.medium.com https://lightstep.medium.systems https://*.branch.io 'self'; font-src data: https://*.amazonaws.com https://*.medium.com https://glyph.medium.com https://medium.com https://*.gstatic.com https://dnqgz544uhbo8.cloudfront.net https://cdn-static-1.medium.com 'self'; frame-src chromenull: https: webviewprogressproxy: blob: medium: 'self'; img-src blob: data: https: 'self'; media-src https://*.cdn.vine.co https://d1fcbxp97j4nb2.cloudfront.net https://d262ilb51hltx0.cloudfront.net https://*.medium.com https://gomiro.medium.com https://miro.medium.com https://pbs.twimg.com 'self' blob:; object-src 'self'; script-src 'unsafe-eval' 'unsafe-inline' about: https: 'self'; style-src 'unsafe-inline' data: https: 'self'; report-uri https://csp.medium.com
x-content-type-options
nosniff
x-powered-by
Medium
x-obvious-info
20220819-1312-root,09d43cc7
x-envoy-upstream-service-time
19
content-length
101
x-xss-protection
1; mode=block
x-ua-compatible
IE=edge, Chrome=1
pragma
no-cache
link
<https://medium.com/humans.txt>; rel="humans"
x-obvious-tid
1661052448450:5d991597b5f0
sepia-upstream
medium
server
nginx
date
Sun, 21 Aug 2022 03:27:28 GMT
x-frame-options
sameorigin
content-type
application/json; charset=utf-8
cache-control
no-cache, no-store, max-age=0, must-revalidate
medium-fulfilled-by
valencia/main-20220819-121639-6e8309fd98
x-opentracing
{"ot-tracer-spanid":"6f53247c7cd563d7","ot-tracer-traceid":"f7894873c89a889","ot-tracer-sampled":"true"}
expires
Thu, 09 Sep 1999 09:09:09 GMT
batch
posts.specterops.io/_/ 		17 B
172 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://posts.specterops.io/_/batch
Requested by
Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/main.8959632f.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.4.38.70 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-4-38-70.compute-1.amazonaws.com
Software
nginx /
Resource Hash
f1ea07a1e51a389c8de07120ae5c2e432e9dd8f4fbd6f92489f185b0523a3fd4

Request headers

Referer
https://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992.
x-xsrf-token
1
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
content-type
application/json

Response headers

date
Sun, 21 Aug 2022 03:27:28 GMT
medium-fulfilled-by
valencia/main-20220819-121639-6e8309fd98
x-envoy-upstream-service-time
25
sepia-upstream
medium
server
nginx
content-length
17
content-type
application/json

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
miro.medium.com
URL
https://miro.medium.com/max/0/1*8rgW0Qvy2bSGSBMlORMhQA.png

Verdicts & Comments Add Verdict or Comment

28 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation string| __BUILD_ID__ string| __GRAPHQL_URI__ object| __PRELOADED_STATE__ object| __APOLLO_STATE__ object| webpackChunklite function| setImmediate function| clearImmediate object| regeneratorRuntime object| DD_RUM function| main object| __APOLLO_CLIENT__ function| Sprig function| UserLeap string| GoogleAnalyticsObject function| ga object| branch object| google_tag_data object| gaplugins object| gaGlobal object| gaData

10 Cookies

Domain/Path Name / Value
.medium.com/ Name: sid
Value: 1:jBJhHiLtCxHsWDQ8NM2VVV/5o5X6APBw3ZTSemAMrqvfTFeU+WZjc/h/ma0EcKUj
.medium.com/ Name: uid
Value: lo_b95da90a1333
.medium.com/ Name: __cfruid
Value: a5416e2b8709544aa5f0b0314078ef7c398d4c25-1661052442
posts.specterops.io/ Name: uid
Value: lo_b95da90a1333
posts.specterops.io/ Name: sid
Value: 1:C2oF+r1oGGD6XDP1kAo+TvMjraR5ZwMr5jGcEmGn1lcI6GKZuC1zqerWvy4g3AYn
posts.specterops.io/ Name: _dd_s
Value: rum=0&expire=1661053343397
.specterops.io/ Name: _ga
Value: GA1.2.1196118499.1661052444
.specterops.io/ Name: _gid
Value: GA1.2.1313873775.1661052444
.specterops.io/ Name: _gat
Value: 1
.app.link/ Name: _s
Value: fYVrZ8KsoMQv4EBKLVWy8rbyrHY4pu2b99aTFpolFTePKN241UHeRef0h1lJvNR7

2 Console Messages

Source Level URL
Text
network error URL: https://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992.?gi=fce521df7cbc
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://miro.medium.com/max/0/1*8rgW0Qvy2bSGSBMlORMhQA.png
Message:
Failed to load resource: the server responded with a status of 400 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy frame-ancestors 'self' https://medium.com

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

api.sprig.com
api2.branch.io
app.link
cdn-client.medium.com
cdn.branch.io
cdn.sprig.com
glyph.medium.com
medium.com
miro.medium.com
posts.specterops.io
www.google-analytics.com
miro.medium.com
13.225.78.70
2600:9000:20eb:3200:19:9934:6a80:93a1
2600:9000:2491:e00:11:f728:3040:93a1
2606:4700:7::a29f:9804
2606:4700:7::a29f:9904
2a00:1450:4001:830::200e
3.93.235.75
52.4.38.70
99.86.240.73
008b735b5e27e2ddea50ac42eeaef63fae74d969ff15e3144c7b9f7c927baffd
02e9e1939e214dfa38c8eab94afca48043e7f00c46e95908662548a7d19819e1
05050a7f9156fca338fdf18683aba2fc6810ae354eae1c647bd786c05c7fa369
05c4d00fffe6af6e9025f21d345c629cf51f22be6252f877b1899a4a2400c0c8
05e683582182d82981126d3413288170e49be62d16996e37144133b6158977f2
0a68bdc22aa6d2deedff5c4999e3618222cf20b0902530b7f924b9e2a4300e40
10f700c67fec93e54b772be1bb062cc63d947386f001aa2d1b988ececb806126
11c8592c1f54321d6f2b6c95b9c0b1362a4b6b78967d5659a6d80c47464bc93f
12fab1118e4be062559b1448f84d7f9bfd7053a4720332ed4da990d0d91d95f8
1a4be9f1473151d2ad4cd6b976d3cf90c71d9471d99b17fb49725f12e249e338
1ce4427bfbac3014cefafb8dc32b0bde12d8e1aea983f1f95e5e795417731b9c
1e433e9fd4aad0b2bc26fee66e5f05ee4d0e2dae8039831ed947175778e48289
20f2e846bde6a5fe62fc88a907be5427076190b7744ed192cfa73cc77a83e77c
256599a9e5ad9e04645f8e793ceee2528791650afb3adec6548835cc4092b895
2651880732676607999b5adbc829e2134a182f45d60695c4a1f9f231d21e4f38
31176d3e3fda6faed4d5d58c81ff174ec627eac7cb2392d7d49d67c267e60e8c
344df165dff1ae918acd3a503ff235364e3e2588b76ac6ac7afe9b28a347d661
39ce007d72b48520cd950dd722e6c7858c0efa7fad414a8853aad1ab8d4a0706
3f39b863af13e4947632922f698a345a33f45f618e25cbdda80fecdb029c1d8f
40c05a07ac09c244b63a1755d524e094c32a18072335fb6cfc7f13da9cfe3eb9
4a0ab426387b4578de5273a69f300167c07ceef4d6fd614061f82e744912caf3
4a96cae42b1009fa744e6e9d4149f69da1ad14892d80a57ca04f6b0e3f1d9e46
509ced3d3b592e6fe143aed420afb0dc1cf4c1d25b6574cc9dfead62c3350870
57cca6a573f50ef861f32cf6ac1c2f9e622b72396edc71ee6ec320eb0852ced0
5aa6acd1109c663814ef7f5bbe7c5a28098ff1a27b8aab702773dd48cf0c1e23
5dc4bbd445f554e2935bf052b759ef745229c34a14ddf864f0463e3b6b4579e1
5fa397435621ac9a4cb734a4a8d7da8debb23084c25e5aa6b2b3f0edd753f558
646d8cb64a720e7a4867157e23cd3dd5f55cfe3c4fa33998a48821a4a8277363
65f0c65b5db3aa0568c7986479a4a3e909a05a84fb34ced48d70a2d628dd1444
671c3a0a31006e6d8a14663bc1a9a26b5932d117c408b824601209446681818b
70c32d8e4fa288b45099a05ac62e52b7e56e9bfb9d770716b0145825b9519926
76ab71ee0832196f5a54cd924b4473fed49378abf993060767ff831a286aafed
78bedd375082bded00712183c8e141c4d65dfcffb8b4bd369e3081e1027a1338
81fbed4e0104cb3882d92af4131251f799a53a390a67677d1efa1c60a5feb1c9
83ba7707bfe79a63651504c93f7a572d83f1effea66a3e9429a4b10f26c38899
85680d3c77cd3614269bce280229fa6bebfe637c767374279107aa08ad2445b7
8b5255e96502b2b45b78b0e006ddd885fbbfdec57eda875d73c57c213ebe031c
8c4eb367086e5f555599ef54c0e862a4f4b13e7bbb6161d859d1bc8a82fa9813
961f2b3e92eba06b032c090511ab8fb8b65ff7f0b471c7bd22817061288f8368
9c5bbca13a0274452220f8cbabf9c85832528c5587bdce1576357b7e543ea104
9f2c1f3ed67f960d3ba0f120c688de9a9ac07db0a32ef8ad2eec65e703fe62f3
a048e640908046be06e00eab37742b5d5ff80964af58cfd22f7cb2de4dfe375f
a117758fa6c72e27ea67353419e32a6833fe5f1051426159d25926b3970cc2d7
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
a3b56dfdf828a898c33c495edce56330017d1b3d1e1c3214bbb40f2885aee2e6
a82dc28d43942326b346f92907df3bea5e38b2325ef97176f3b6234966bf19eb
b0f424bafe993b016ea96973894f95dfc4290608478a2d7d3fdd080d9b0a60d1
b1e92c14799368b0d71e27852d5b17948e2d3afad881d404f25aa05550bb3f48
b4c2d3ac3573990d7b0d77e4a006d6d40bb259ce817b64d9223d7e117c259293
b92dfb845f3a184029a9df9dc79e8d273efa6caa194c3745984e7bbecb2c7a11
ba5bf3fa263482c7fb5667136879875ef46b6bda007664510797fddc88b1244d
bbcda18e1943f0f75e8175a83e202f28fba2c0c47d32c7f754d8dd036ad81d4b
c15c2602de0285908cbcc7403cf7d64be078ce73e5ac12cd76a4bbe058498c63
c52d3fccbb007e0d9dd980ebd09d66d9dc643cbf4ba224ed2b227e8509892825
c7472f7ddd48154cafa5966a38a523318a4c9463190594712195bfaba962220a
d787d15d3e723baa0a7493cbb2e220bd72a640111eca49229ab21aa82a3c0fb8
d9b271a0704c0769d9d4c43e4888575d36d13c7c7f0f4281965d90aed51d0a44
df42f7b47e70951e53b063c74b6a4d85a0bafac7e1bacc213ba70469b2cb2454
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e407bb45d1989e7da18b99474857fcb5ebffa9e7bbb16aecacbddccd1efc260f
eb204887ddb35d03f8430bd913fa28bfb2e5f5535de5123a8514203d6cce7629
ec9cea8ff0551809116f897242d87779daa8c5847e088191b5c7fcf7d5325f99
ecc79b96c9bce058e6ed0782f4be50303e597c23425324bedd4d6ae08478cb59
edacbb4f600f16d0aba4c26739b1317f6308d5102363c7047d38c3e3dc45deb8
ee6184aa8ad5fa680d2808790bb04a001d8369d143b313da43af3794ab7ea3e5
f1ea07a1e51a389c8de07120ae5c2e432e9dd8f4fbd6f92489f185b0523a3fd4
f49dd05c9e66318b4c49435f7d061daf1d4cd1241fcb312d738a35e223773d12
f5d17ba49b5f0294f90d348d8f5892105fbfefbc0264d55eb82300cbf58c2ce0
fc4e14de11834a07a456fe0d9fb8aafa563947eb506bfeff5a5e6549d91948df
fec16a472e685f22d9ad57d42e20dc052a9bd255950aabc48b628eaca247b3f3