URL: https://labs.integrity.pt/advisories/cve-2022-37247/
Submission: On September 21 via api from US — Scanned from DE

Summary

This website contacted 4 IPs in 2 countries across 3 domains to perform 15 HTTP transactions. The main IP is 52.31.90.249, located in Dublin, Ireland and belongs to AMAZON-02, US. The main domain is labs.integrity.pt.
TLS certificate: Issued by Amazon on May 31st 2022. Valid for: a year.
This is the only time labs.integrity.pt was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
11 52.31.90.249 16509 (AMAZON-02)
1 2a00:1450:400... 15169 (GOOGLE)
3 2a00:1450:400... 15169 (GOOGLE)
15 4
Apex Domain
Subdomains
Transfer
11 integrity.pt
labs.integrity.pt
263 KB
3 gstatic.com
fonts.gstatic.com
41 KB
1 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 40
13 KB
15 3
Domain Requested by
11 labs.integrity.pt labs.integrity.pt
3 fonts.gstatic.com fonts.googleapis.com
1 fonts.googleapis.com labs.integrity.pt
15 3

This site contains links to these domains. Also see Links.

Domain
github.com
www.integrity.pt
www.linkedin.com
www.youtube.com
Subject Issuer Validity Valid
*.integrity.pt
Amazon
2022-05-31 -
2023-06-29
a year crt.sh
upload.video.google.com
GTS CA 1C3
2022-08-29 -
2022-11-21
3 months crt.sh
*.gstatic.com
GTS CA 1C3
2022-08-29 -
2022-11-21
3 months crt.sh

This page contains 1 frames:

Primary Page: https://labs.integrity.pt/advisories/cve-2022-37247/
Frame ID: 7EF9DCFDDDB5932333179E543C3F836E
Requests: 16 HTTP requests in this frame

Screenshot

Page Title

CVE-2022-37247 - Stored XSS in Fields in Craft CMS | INTEGRITY Labs

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
  • <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
  • (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

15
Requests

100 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

4
IPs

2
Countries

317 kB
Transfer

657 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

15 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
labs.integrity.pt/advisories/cve-2022-37247/
15 KB
5 KB
Document
General
Full URL
https://labs.integrity.pt/advisories/cve-2022-37247/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.31.90.249 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-31-90-249.eu-west-1.compute.amazonaws.com
Software
null /
Resource Hash
747db3d20ba49efb0ce649f12d5915ea59df1635a6dc150b3ad0bbc0cb2ebe58
Security Headers
Name Value
Content-Security-Policy default-src 'self'; script-src 'self' https://www.google-analytics.com 'unsafe-inline'; connect-src 'self' https://www.google-analytics.com/; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com/; frame-src 'self'; img-src 'self' https://www.google-analytics.com data: blob:; font-src 'self' data: 'unsafe-inline' https://fonts.gstatic.com/; media-src 'self' https://videos.integrity.pt;
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ranges
bytes
cache-control
max-age=60, must-revalidate
content-encoding
gzip
content-length
4460
content-security-policy
default-src 'self'; script-src 'self' https://www.google-analytics.com 'unsafe-inline'; connect-src 'self' https://www.google-analytics.com/; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com/; frame-src 'self'; img-src 'self' https://www.google-analytics.com data: blob:; font-src 'self' data: 'unsafe-inline' https://fonts.gstatic.com/; media-src 'self' https://videos.integrity.pt;
content-type
text/html
date
Wed, 21 Sep 2022 20:00:07 GMT
etag
"2798481128"
frame-options
SAMEORIGIN
last-modified
Fri, 16 Sep 2022 14:26:10 GMT
referrer-policy
origin-when-cross-origin
server
null
strict-transport-security
max-age=31536000
vary
Accept-Encoding
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-xss-protection
1; mode=block
css2
fonts.googleapis.com/
52 KB
13 KB
Stylesheet
General
Full URL
https://fonts.googleapis.com/css2?family=Gugi&family=Red+Hat+Mono:wght@400;500&display=swap
Requested by
Host: labs.integrity.pt
URL: https://labs.integrity.pt/advisories/cve-2022-37247/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
c151fa4b514d32163a3047a225d432c937d28b40f1fde074e6308a10bd474f9e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://labs.integrity.pt/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Wed, 21 Sep 2022 20:00:07 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
date
Wed, 21 Sep 2022 20:00:07 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Wed, 21 Sep 2022 20:00:07 GMT
bootstrap.min.css
labs.integrity.pt/assets/css/
161 KB
24 KB
Stylesheet
General
Full URL
https://labs.integrity.pt/assets/css/bootstrap.min.css
Requested by
Host: labs.integrity.pt
URL: https://labs.integrity.pt/advisories/cve-2022-37247/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.31.90.249 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-31-90-249.eu-west-1.compute.amazonaws.com
Software
null /
Resource Hash
a535ac470f0701cf77bd0217692e77c6401ad9a35e62bebab062ff76060be302
Security Headers
Name Value
Content-Security-Policy default-src 'self'; script-src 'self' https://www.google-analytics.com 'unsafe-inline'; connect-src 'self' https://www.google-analytics.com/; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com/; frame-src 'self'; img-src 'self' https://www.google-analytics.com data: blob:; font-src 'self' data: 'unsafe-inline' https://fonts.gstatic.com/; media-src 'self' https://videos.integrity.pt;
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://labs.integrity.pt/advisories/cve-2022-37247/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date
Wed, 21 Sep 2022 20:00:07 GMT
content-encoding
gzip
x-content-type-options
nosniff
frame-options
SAMEORIGIN
vary
Accept-Encoding
content-length
23918
x-xss-protection
1; mode=block
referrer-policy
origin-when-cross-origin
last-modified
Fri, 16 Sep 2022 14:27:27 GMT
server
null
x-frame-options
SAMEORIGIN
etag
"3858852842"
strict-transport-security
max-age=31536000
content-type
text/css; charset=utf-8
cache-control
max-age=60, must-revalidate
content-security-policy
default-src 'self'; script-src 'self' https://www.google-analytics.com 'unsafe-inline'; connect-src 'self' https://www.google-analytics.com/; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com/; frame-src 'self'; img-src 'self' https://www.google-analytics.com data: blob:; font-src 'self' data: 'unsafe-inline' https://fonts.gstatic.com/; media-src 'self' https://videos.integrity.pt;
accept-ranges
bytes
font-awesome.min.css
labs.integrity.pt/assets/css/
58 KB
13 KB
Stylesheet
General
Full URL
https://labs.integrity.pt/assets/css/font-awesome.min.css
Requested by
Host: labs.integrity.pt
URL: https://labs.integrity.pt/advisories/cve-2022-37247/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.31.90.249 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-31-90-249.eu-west-1.compute.amazonaws.com
Software
null /
Resource Hash
f19a9fd07af2f1663239f35205055dab6d49e4725abd107b6a34278566538998
Security Headers
Name Value
Content-Security-Policy default-src 'self'; script-src 'self' https://www.google-analytics.com 'unsafe-inline'; connect-src 'self' https://www.google-analytics.com/; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com/; frame-src 'self'; img-src 'self' https://www.google-analytics.com data: blob:; font-src 'self' data: 'unsafe-inline' https://fonts.gstatic.com/; media-src 'self' https://videos.integrity.pt;
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://labs.integrity.pt/advisories/cve-2022-37247/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date
Wed, 21 Sep 2022 20:00:07 GMT
content-encoding
gzip
x-content-type-options
nosniff
frame-options
SAMEORIGIN
vary
Accept-Encoding
content-length
12867
x-xss-protection
1; mode=block
referrer-policy
origin-when-cross-origin
last-modified
Fri, 16 Sep 2022 14:27:28 GMT
server
null
x-frame-options
SAMEORIGIN
etag
"2951373096"
strict-transport-security
max-age=31536000
content-type
text/css; charset=utf-8
cache-control
max-age=60, must-revalidate
content-security-policy
default-src 'self'; script-src 'self' https://www.google-analytics.com 'unsafe-inline'; connect-src 'self' https://www.google-analytics.com/; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com/; frame-src 'self'; img-src 'self' https://www.google-analytics.com data: blob:; font-src 'self' data: 'unsafe-inline' https://fonts.gstatic.com/; media-src 'self' https://videos.integrity.pt;
accept-ranges
bytes
main.css
labs.integrity.pt/assets/
3 KB
2 KB
Stylesheet
General
Full URL
https://labs.integrity.pt/assets/main.css
Requested by
Host: labs.integrity.pt
URL: https://labs.integrity.pt/advisories/cve-2022-37247/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.31.90.249 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-31-90-249.eu-west-1.compute.amazonaws.com
Software
null /
Resource Hash
9b4d8a9301f09a353eed5163627df10178bf8cb830f3b95b87706619deb87b0c
Security Headers
Name Value
Content-Security-Policy default-src 'self'; script-src 'self' https://www.google-analytics.com 'unsafe-inline'; connect-src 'self' https://www.google-analytics.com/; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com/; frame-src 'self'; img-src 'self' https://www.google-analytics.com data: blob:; font-src 'self' data: 'unsafe-inline' https://fonts.gstatic.com/; media-src 'self' https://videos.integrity.pt;
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://labs.integrity.pt/advisories/cve-2022-37247/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date
Wed, 21 Sep 2022 20:00:07 GMT
content-encoding
gzip
x-content-type-options
nosniff
frame-options
SAMEORIGIN
vary
Accept-Encoding
content-length
1007
x-xss-protection
1; mode=block
referrer-policy
origin-when-cross-origin
last-modified
Fri, 16 Sep 2022 14:27:27 GMT
server
null
x-frame-options
SAMEORIGIN
etag
"367384229"
strict-transport-security
max-age=31536000
content-type
text/css; charset=utf-8
cache-control
max-age=60, must-revalidate
content-security-policy
default-src 'self'; script-src 'self' https://www.google-analytics.com 'unsafe-inline'; connect-src 'self' https://www.google-analytics.com/; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com/; frame-src 'self'; img-src 'self' https://www.google-analytics.com data: blob:; font-src 'self' data: 'unsafe-inline' https://fonts.gstatic.com/; media-src 'self' https://videos.integrity.pt;
accept-ranges
bytes
logo-black.svg
labs.integrity.pt/images/
10 KB
10 KB
Image
General
Full URL
https://labs.integrity.pt/images/logo-black.svg
Requested by
Host: labs.integrity.pt
URL: https://labs.integrity.pt/advisories/cve-2022-37247/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.31.90.249 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-31-90-249.eu-west-1.compute.amazonaws.com
Software
null /
Resource Hash
872a466a84a9a9c88e44fa519f53f6f1c43931580b9e061043629a7c002e696e
Security Headers
Name Value
Content-Security-Policy default-src 'self'; script-src 'self' https://www.google-analytics.com 'unsafe-inline'; connect-src 'self' https://www.google-analytics.com/; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com/; frame-src 'self'; img-src 'self' https://www.google-analytics.com data: blob:; font-src 'self' data: 'unsafe-inline' https://fonts.gstatic.com/; media-src 'self' https://videos.integrity.pt;
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://labs.integrity.pt/advisories/cve-2022-37247/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date
Wed, 21 Sep 2022 20:00:07 GMT
referrer-policy
origin-when-cross-origin
frame-options
SAMEORIGIN
last-modified
Wed, 22 Dec 2021 10:02:43 GMT
server
null
etag
"4261633358"
x-frame-options
SAMEORIGIN
content-type
image/svg+xml
x-xss-protection
1; mode=block
cache-control
max-age=60, must-revalidate
content-security-policy
default-src 'self'; script-src 'self' https://www.google-analytics.com 'unsafe-inline'; connect-src 'self' https://www.google-analytics.com/; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com/; frame-src 'self'; img-src 'self' https://www.google-analytics.com data: blob:; font-src 'self' data: 'unsafe-inline' https://fonts.gstatic.com/; media-src 'self' https://videos.integrity.pt;
strict-transport-security
max-age=31536000
accept-ranges
bytes
content-length
9748
x-content-type-options
nosniff
jquery-3.6.0.min.js
labs.integrity.pt/assets/js/
87 KB
31 KB
Script
General
Full URL
https://labs.integrity.pt/assets/js/jquery-3.6.0.min.js
Requested by
Host: labs.integrity.pt
URL: https://labs.integrity.pt/advisories/cve-2022-37247/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.31.90.249 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-31-90-249.eu-west-1.compute.amazonaws.com
Software
null /
Resource Hash
52914962d50676f6088820a088f55a326d0b733f05ef6f5c358256f5d09388ca
Security Headers
Name Value
Content-Security-Policy default-src 'self'; script-src 'self' https://www.google-analytics.com 'unsafe-inline'; connect-src 'self' https://www.google-analytics.com/; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com/; frame-src 'self'; img-src 'self' https://www.google-analytics.com data: blob:; font-src 'self' data: 'unsafe-inline' https://fonts.gstatic.com/; media-src 'self' https://videos.integrity.pt;
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://labs.integrity.pt/advisories/cve-2022-37247/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date
Wed, 21 Sep 2022 20:00:07 GMT
content-encoding
gzip
x-content-type-options
nosniff
frame-options
SAMEORIGIN
vary
Accept-Encoding
content-length
30887
x-xss-protection
1; mode=block
referrer-policy
origin-when-cross-origin
last-modified
Fri, 16 Sep 2022 14:27:26 GMT
server
null
x-frame-options
SAMEORIGIN
etag
"2733205862"
strict-transport-security
max-age=31536000
content-type
application/javascript
cache-control
max-age=60, must-revalidate
content-security-policy
default-src 'self'; script-src 'self' https://www.google-analytics.com 'unsafe-inline'; connect-src 'self' https://www.google-analytics.com/; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com/; frame-src 'self'; img-src 'self' https://www.google-analytics.com data: blob:; font-src 'self' data: 'unsafe-inline' https://fonts.gstatic.com/; media-src 'self' https://videos.integrity.pt;
accept-ranges
bytes
bootstrap.bundle.min.js
labs.integrity.pt/assets/js/
76 KB
23 KB
Script
General
Full URL
https://labs.integrity.pt/assets/js/bootstrap.bundle.min.js
Requested by
Host: labs.integrity.pt
URL: https://labs.integrity.pt/advisories/cve-2022-37247/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.31.90.249 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-31-90-249.eu-west-1.compute.amazonaws.com
Software
null /
Resource Hash
f5210fa3e7f0245a4c51eb7f280092c0ef99fdd28c45e17dab8cc5854fdf4fd3
Security Headers
Name Value
Content-Security-Policy default-src 'self'; script-src 'self' https://www.google-analytics.com 'unsafe-inline'; connect-src 'self' https://www.google-analytics.com/; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com/; frame-src 'self'; img-src 'self' https://www.google-analytics.com data: blob:; font-src 'self' data: 'unsafe-inline' https://fonts.gstatic.com/; media-src 'self' https://videos.integrity.pt;
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://labs.integrity.pt/advisories/cve-2022-37247/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date
Wed, 21 Sep 2022 20:00:07 GMT
content-encoding
gzip
x-content-type-options
nosniff
frame-options
SAMEORIGIN
vary
Accept-Encoding
content-length
23051
x-xss-protection
1; mode=block
referrer-policy
origin-when-cross-origin
last-modified
Wed, 22 Dec 2021 10:02:39 GMT
server
null
x-frame-options
SAMEORIGIN
etag
"3359313280"
strict-transport-security
max-age=31536000
content-type
application/javascript
cache-control
max-age=60, must-revalidate
content-security-policy
default-src 'self'; script-src 'self' https://www.google-analytics.com 'unsafe-inline'; connect-src 'self' https://www.google-analytics.com/; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com/; frame-src 'self'; img-src 'self' https://www.google-analytics.com data: blob:; font-src 'self' data: 'unsafe-inline' https://fonts.gstatic.com/; media-src 'self' https://videos.integrity.pt;
accept-ranges
bytes
switch.js
labs.integrity.pt/assets/js/
3 KB
2 KB
Script
General
Full URL
https://labs.integrity.pt/assets/js/switch.js
Requested by
Host: labs.integrity.pt
URL: https://labs.integrity.pt/advisories/cve-2022-37247/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.31.90.249 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-31-90-249.eu-west-1.compute.amazonaws.com
Software
null /
Resource Hash
9565417850d35f0e6d26f7e5d66a226b9480f79f345f2d961b6e235afd0a8380
Security Headers
Name Value
Content-Security-Policy default-src 'self'; script-src 'self' https://www.google-analytics.com 'unsafe-inline'; connect-src 'self' https://www.google-analytics.com/; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com/; frame-src 'self'; img-src 'self' https://www.google-analytics.com data: blob:; font-src 'self' data: 'unsafe-inline' https://fonts.gstatic.com/; media-src 'self' https://videos.integrity.pt;
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://labs.integrity.pt/advisories/cve-2022-37247/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date
Wed, 21 Sep 2022 20:00:07 GMT
content-encoding
gzip
x-content-type-options
nosniff
frame-options
SAMEORIGIN
vary
Accept-Encoding
content-length
868
x-xss-protection
1; mode=block
referrer-policy
origin-when-cross-origin
last-modified
Wed, 22 Dec 2021 10:02:39 GMT
server
null
x-frame-options
SAMEORIGIN
etag
"2397244364"
strict-transport-security
max-age=31536000
content-type
application/javascript
cache-control
max-age=60, must-revalidate
content-security-policy
default-src 'self'; script-src 'self' https://www.google-analytics.com 'unsafe-inline'; connect-src 'self' https://www.google-analytics.com/; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com/; frame-src 'self'; img-src 'self' https://www.google-analytics.com data: blob:; font-src 'self' data: 'unsafe-inline' https://fonts.gstatic.com/; media-src 'self' https://videos.integrity.pt;
accept-ranges
bytes
main.js
labs.integrity.pt/assets/js/
175 B
832 B
Script
General
Full URL
https://labs.integrity.pt/assets/js/main.js
Requested by
Host: labs.integrity.pt
URL: https://labs.integrity.pt/advisories/cve-2022-37247/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.31.90.249 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-31-90-249.eu-west-1.compute.amazonaws.com
Software
null /
Resource Hash
904974b11f00d5cd6bd5131dcea0316f831f32858e39d7a09374acce3d78b01a
Security Headers
Name Value
Content-Security-Policy default-src 'self'; script-src 'self' https://www.google-analytics.com 'unsafe-inline'; connect-src 'self' https://www.google-analytics.com/; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com/; frame-src 'self'; img-src 'self' https://www.google-analytics.com data: blob:; font-src 'self' data: 'unsafe-inline' https://fonts.gstatic.com/; media-src 'self' https://videos.integrity.pt;
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://labs.integrity.pt/advisories/cve-2022-37247/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date
Wed, 21 Sep 2022 20:00:07 GMT
referrer-policy
origin-when-cross-origin
frame-options
SAMEORIGIN
last-modified
Fri, 16 Sep 2022 14:27:23 GMT
server
null
etag
"2736301202"
x-frame-options
SAMEORIGIN
content-type
application/javascript
x-xss-protection
1; mode=block
cache-control
max-age=60, must-revalidate
content-security-policy
default-src 'self'; script-src 'self' https://www.google-analytics.com 'unsafe-inline'; connect-src 'self' https://www.google-analytics.com/; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com/; frame-src 'self'; img-src 'self' https://www.google-analytics.com data: blob:; font-src 'self' data: 'unsafe-inline' https://fonts.gstatic.com/; media-src 'self' https://videos.integrity.pt;
strict-transport-security
max-age=31536000
accept-ranges
bytes
content-length
175
x-content-type-options
nosniff
truncated
/
108 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
8f27b2160255b0a3bbe960f0af6a1772a8514e2b3ba0acbeea1e622ebb5f3e4a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://labs.integrity.pt/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

Content-Type
image/svg+xml
A2BVn5dXywshVAvo4jMQ8c2HNvL_56t4zTCEuE6pbA.119.woff2
fonts.gstatic.com/s/gugi/v13/
9 KB
9 KB
Font
General
Full URL
https://fonts.gstatic.com/s/gugi/v13/A2BVn5dXywshVAvo4jMQ8c2HNvL_56t4zTCEuE6pbA.119.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Gugi&family=Red+Hat+Mono:wght@400;500&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f8323d65f8a210afa590db3c0384294ee096519c791a609042bf89899019721d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://labs.integrity.pt
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date
Fri, 16 Sep 2022 00:58:20 GMT
x-content-type-options
nosniff
age
500507
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
8908
x-xss-protection
0
last-modified
Thu, 21 Apr 2022 16:52:50 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sat, 16 Sep 2023 00:58:20 GMT
jVyN7nDnA2uf2zVvFAhhzEsUWOxS.woff2
fonts.gstatic.com/s/redhatmono/v10/
21 KB
21 KB
Font
General
Full URL
https://fonts.gstatic.com/s/redhatmono/v10/jVyN7nDnA2uf2zVvFAhhzEsUWOxS.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Gugi&family=Red+Hat+Mono:wght@400;500&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
faf8db01f840cc3722c80c1fe9f1061de28175042644ced80c6229388522d1f7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://labs.integrity.pt
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date
Tue, 20 Sep 2022 03:42:30 GMT
x-content-type-options
nosniff
age
145057
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
21336
x-xss-protection
0
last-modified
Mon, 15 Aug 2022 18:17:16 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 20 Sep 2023 03:42:30 GMT
fa-solid-900.woff2
labs.integrity.pt/assets/webfonts/
76 KB
77 KB
Font
General
Full URL
https://labs.integrity.pt/assets/webfonts/fa-solid-900.woff2
Requested by
Host: labs.integrity.pt
URL: https://labs.integrity.pt/assets/css/font-awesome.min.css
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.31.90.249 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-31-90-249.eu-west-1.compute.amazonaws.com
Software
null /
Resource Hash
d0b4256abed72481585662971262eabee345c19f837af00d7ce24239d3b40eef
Security Headers
Name Value
Content-Security-Policy default-src 'self'; script-src 'self' https://www.google-analytics.com 'unsafe-inline'; connect-src 'self' https://www.google-analytics.com/; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com/; frame-src 'self'; img-src 'self' https://www.google-analytics.com data: blob:; font-src 'self' data: 'unsafe-inline' https://fonts.gstatic.com/; media-src 'self' https://videos.integrity.pt;
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://labs.integrity.pt/assets/css/font-awesome.min.css
Origin
https://labs.integrity.pt
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date
Wed, 21 Sep 2022 20:00:07 GMT
referrer-policy
origin-when-cross-origin
frame-options
SAMEORIGIN
last-modified
Wed, 22 Dec 2021 10:02:39 GMT
server
null
etag
"2822442373"
x-frame-options
SAMEORIGIN
content-type
font/woff2
x-xss-protection
1; mode=block
cache-control
max-age=60, must-revalidate
content-security-policy
default-src 'self'; script-src 'self' https://www.google-analytics.com 'unsafe-inline'; connect-src 'self' https://www.google-analytics.com/; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com/; frame-src 'self'; img-src 'self' https://www.google-analytics.com data: blob:; font-src 'self' data: 'unsafe-inline' https://fonts.gstatic.com/; media-src 'self' https://videos.integrity.pt;
strict-transport-security
max-age=31536000
accept-ranges
bytes
content-length
78196
x-content-type-options
nosniff
fa-brands-400.woff2
labs.integrity.pt/assets/webfonts/
75 KB
76 KB
Font
General
Full URL
https://labs.integrity.pt/assets/webfonts/fa-brands-400.woff2
Requested by
Host: labs.integrity.pt
URL: https://labs.integrity.pt/assets/css/font-awesome.min.css
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.31.90.249 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-31-90-249.eu-west-1.compute.amazonaws.com
Software
null /
Resource Hash
43c072c16c9ee6d67acdfa6c6d6685ff1e74eb4237b7cc3c1348ab1c108b26af
Security Headers
Name Value
Content-Security-Policy default-src 'self'; script-src 'self' https://www.google-analytics.com 'unsafe-inline'; connect-src 'self' https://www.google-analytics.com/; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com/; frame-src 'self'; img-src 'self' https://www.google-analytics.com data: blob:; font-src 'self' data: 'unsafe-inline' https://fonts.gstatic.com/; media-src 'self' https://videos.integrity.pt;
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://labs.integrity.pt/assets/css/font-awesome.min.css
Origin
https://labs.integrity.pt
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date
Wed, 21 Sep 2022 20:00:07 GMT
referrer-policy
origin-when-cross-origin
frame-options
SAMEORIGIN
last-modified
Wed, 22 Dec 2021 10:02:39 GMT
server
null
etag
"2822470671"
x-frame-options
SAMEORIGIN
content-type
font/woff2
x-xss-protection
1; mode=block
cache-control
max-age=60, must-revalidate
content-security-policy
default-src 'self'; script-src 'self' https://www.google-analytics.com 'unsafe-inline'; connect-src 'self' https://www.google-analytics.com/; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com/; frame-src 'self'; img-src 'self' https://www.google-analytics.com data: blob:; font-src 'self' data: 'unsafe-inline' https://fonts.gstatic.com/; media-src 'self' https://videos.integrity.pt;
strict-transport-security
max-age=31536000
accept-ranges
bytes
content-length
76764
x-content-type-options
nosniff
A2BVn5dXywshVAvo4jMQ8c2HNvL_56t4zTCEuE6pbA.118.woff2
fonts.gstatic.com/s/gugi/v13/
11 KB
11 KB
Font
General
Full URL
https://fonts.gstatic.com/s/gugi/v13/A2BVn5dXywshVAvo4jMQ8c2HNvL_56t4zTCEuE6pbA.118.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Gugi&family=Red+Hat+Mono:wght@400;500&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
b5cf8222cc29efa056a9a94f4428040d102f0781f1fa4b46b5c36139d5bfb467
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://labs.integrity.pt
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date
Mon, 19 Sep 2022 23:48:41 GMT
x-content-type-options
nosniff
age
159086
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
10792
x-xss-protection
0
last-modified
Thu, 21 Apr 2022 16:59:04 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 19 Sep 2023 23:48:41 GMT

Verdicts & Comments Add Verdict or Comment

16 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation function| $ function| jQuery number| uidEvent object| bootstrap string| cookieName string| cookieValue number| cookieExpireDays

0 Cookies

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy default-src 'self'; script-src 'self' https://www.google-analytics.com 'unsafe-inline'; connect-src 'self' https://www.google-analytics.com/; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com/; frame-src 'self'; img-src 'self' https://www.google-analytics.com data: blob:; font-src 'self' data: 'unsafe-inline' https://fonts.gstatic.com/; media-src 'self' https://videos.integrity.pt;
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block