blog.harmj0y.net Open in urlscan Pro
104.145.235.86 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://t.co/rXaMzMW6Uo
Effective URL:
https://blog.harmj0y.net/redteaming/keethief-a-case-study-in-attacking-keepass-part-2/
Submission: On January 27 via manual (January 27th 2023, 11:58:47 am UTC) from ES — Scanned from ES

Summary HTTP 23 Redirects Links 68 Behaviour Indicators

Summary

This website contacted 4 IPs in 2 countries across 4 domains to perform 23 HTTP transactions. The main IP is 104.145.235.86, located in New York, United States and belongs to AS-DIGITALFYRE, US. The main domain is blog.harmj0y.net.
TLS certificate: Issued by R3 on December 6th 2022. Valid for: 3 months.

This is the only time blog.harmj0y.net was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1	104.244.42.197 104.244.42.197	13414 (TWITTER) (TWITTER)
19	104.145.235.86 104.145.235.86	64245 (AS-DIGITA...) (AS-DIGITALFYRE)
1	2a00:1450:400... 2a00:1450:4001:80f::200a	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:80b::2003	15169 (GOOGLE) (GOOGLE)
23	4

1 104.244.42.197 (United States)

ASN13414 (TWITTER, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

19 104.145.235.86 (New York, United States)

ASN64245 (AS-DIGITALFYRE, US)
PTR: leia.digitalfyre.net

blog.harmj0y.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80f::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:80b::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
19	harmj0y.net blog.harmj0y.net	1 MB
2	gstatic.com fonts.gstatic.com	24 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 34	1 KB
1	t.co t.co — Cisco Umbrella Rank: 531	597 B
23	4

	Domain	Requested by
19	blog.harmj0y.net	t.co blog.harmj0y.net
2	fonts.gstatic.com	fonts.googleapis.com
1	fonts.googleapis.com	blog.harmj0y.net
1	t.co
23	4

This site contains links to these domains. Also see Links.

Domain
twitter.com
www.harmj0y.net
keepass.info
github.com
fossies.org
msdn.microsoft.com
www.exploit-monday.com
www.microsoft.com
www.okta.com
technet.microsoft.com
sourceforge.net
implicitdeny.org
cfzero.wordpress.com
rallysecurity.com
akismet.com
specterops.io
posts.specterops.io
felicitybrigham.com

Subject Issuer	Validity	Valid
t.co DigiCert TLS RSA SHA256 2020 CA1	`2022-11-14` - `2023-11-14`	a year	crt.sh
blog.harmj0y.net R3	`2022-12-06` - `2023-03-06`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2023-01-09` - `2023-04-03`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2023-01-09` - `2023-04-03`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://blog.harmj0y.net/redteaming/keethief-a-case-study-in-attacking-keepass-part-2/
Frame ID: 55279325364FEA9A737D94E8B3F9E71B
Requests: 23 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

KeeThief – A Case Study in Attacking KeePass Part 2 – harmj0y Email

Page URL History Show full URLs

https://t.co/rXaMzMW6Uo Page URL
https://blog.harmj0y.net/redteaming/keethief-a-case-study-in-attacking-keepass-part-2/ Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

<link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
/wp-(?:content|includes)/

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jQuery Migrate (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?

Page Statistics

23
Requests

100 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

4
IPs

2
Countries

1264 kB
Transfer

1260 kB
Size

1
Cookies

68 Outgoing links

These are links going to different origins than the main page.

URL: https://twitter.com/harmj0y
Title: Twitter

Search URL Search Domain Scan URL

URL: https://twitter.com/tifkin_
Title: @tifkin_

Search URL Search Domain Scan URL

URL: http://www.harmj0y.net/blog/redteaming/a-case-study-in-attacking-keepass/
Title: A Case Study in Attacking KeePass

Search URL Search Domain Scan URL

URL: http://keepass.info/help/kb/sec_desk.html
Title: secure desktop

Search URL Search Domain Scan URL

URL: https://github.com/adaptivethreat/KeeThief
Title: KeeThief

Search URL Search Domain Scan URL

URL: https://github.com/adaptivethreat/KeeThief/tree/master/PowerShell
Title: PowerShell script

Search URL Search Domain Scan URL

URL: https://github.com/denandz/KeeFarce/
Title: KeeFarce project

Search URL Search Domain Scan URL

URL: https://github.com/denandz/KeeFarce/blob/a600351c28d040c48e467d8f4f886c9bdfbf3029/src/KeeFarce/Injection.cpp#L49-L73
Title: to force a call LoadLibraryA()

Search URL Search Domain Scan URL

URL: https://github.com/denandz/KeeFarce/blob/e06dbe17124c8f938294971545f5ce09264bd701/src/KeeFarceDLL/main.cs#L30-L63
Title: walks the heap enumerating .NET objects

Search URL Search Domain Scan URL

URL: https://fossies.org/dox/KeePass-2.34-Source/classKeePass_1_1UI_1_1DocumentManagerEx.html
Title: KeePass.UI.DocumentManagerEx

Search URL Search Domain Scan URL

URL: https://github.com/denandz/KeeFarce/blob/e06dbe17124c8f938294971545f5ce09264bd701/src/KeeFarceDLL/main.cs#L71-L72
Title: loads the KeePass assembly with reflection

Search URL Search Domain Scan URL

URL: https://github.com/denandz/KeeFarce/blob/e06dbe17124c8f938294971545f5ce09264bd701/src/KeeFarceDLL/main.cs#L73-92
Title: instantiates

Search URL Search Domain Scan URL

URL: https://fossies.org/dox/KeePass-2.34-Source/classKeePass_1_1DataExchange_1_1PwExportInfo.html
Title: KeePass.DataExchange.PwExportInfo

Search URL Search Domain Scan URL

URL: https://fossies.org/dox/KeePass-2.34-Source/namespaceKeePass_1_1DataExchange_1_1Formats.html
Title: KeePass.DataExchange.Formats.KeePassCsv1x

Search URL Search Domain Scan URL

URL: https://github.com/denandz/KeeFarce/blob/e06dbe17124c8f938294971545f5ce09264bd701/src/KeeFarceDLL/main.cs#L97-L106
Title: is instantiated

Search URL Search Domain Scan URL

URL: https://github.com/denandz/KeeFarce/blob/e06dbe17124c8f938294971545f5ce09264bd701/src/KeeFarceDLL/main.cs#L130
Title: export method is invoked

Search URL Search Domain Scan URL

URL: https://github.com/PowerShellEmpire/PowerTools/blob/master/PowerPick/PSInjector/PSInject.ps1
Title: Invoke-PSInject

Search URL Search Domain Scan URL

URL: https://msdn.microsoft.com/en-us/library/windows/desktop/aa387693(v=vs.85).aspx
Title: RtlEncryptMemory()

Search URL Search Domain Scan URL

URL: https://msdn.microsoft.com/en-us/library/windows/desktop/aa387692(v=vs.85).aspx
Title: RtlDecryptMemory()

Search URL Search Domain Scan URL

URL: https://fossies.org/dox/KeePass-2.34-Source/ProtectedBinary_8cs_source.html
Title: ProtectedBinary

Search URL Search Domain Scan URL

URL: https://fossies.org/dox/KeePass-2.34-Source/KcpUserAccount_8cs_source.html
Title: m_pbEntropy

Search URL Search Domain Scan URL

URL: https://twitter.com/gentilkiwi/status/748436076738547712
Title: this Twitter thread

Search URL Search Domain Scan URL

URL: https://github.com/Microsoft/clrmd
Title: released under the MIT license by Microsoft

Search URL Search Domain Scan URL

URL: https://github.com/Microsoft/clrmd/tree/master/Documentation
Title: getting started documentation

Search URL Search Domain Scan URL

URL: https://fossies.org/dox/KeePass-2.34-Source/classKeePassLib_1_1PwDatabase.html
Title: KeePassLib.PwDatabase

Search URL Search Domain Scan URL

URL: https://fossies.org/dox/KeePass-2.34-Source/classKeePassLib_1_1Serialization_1_1IOConnectionInfo.html
Title: KeePassLib.Serialization.IOConnectionInfo

Search URL Search Domain Scan URL

URL: https://fossies.org/dox/KeePass-2.34-Source/classKeePassLib_1_1Keys_1_1KcpPassword.html
Title: KeePassLib.Keys.KcpPassword

Search URL Search Domain Scan URL

URL: https://fossies.org/dox/KeePass-2.34-Source/classKeePassLib_1_1Keys_1_1KcpKeyFile.html
Title: KeePassLib.Keys.KcpKeyFile

Search URL Search Domain Scan URL

URL: https://fossies.org/dox/KeePass-2.34-Source/classKeePassLib_1_1Keys_1_1KcpUserAccount.html
Title: KeePassLib.Keys.KcpUserAccount

Search URL Search Domain Scan URL

URL: https://fossies.org/dox/KeePass-2.34-Source/classKeePassLib_1_1Keys_1_1CompositeKey.html
Title: KeePassLib.Keys.CompositeKey

Search URL Search Domain Scan URL

URL: https://fossies.org/dox/KeePass-2.34-Source/classKeePassLib_1_1Security_1_1ProtectedBinary.html
Title: ProtectedBinary

Search URL Search Domain Scan URL

URL: https://msdn.microsoft.com/en-us/library/windows/desktop/aa387693%28v=vs.85%29.aspx?f=255&MSPPError=-2147217396
Title: RtlEncryptMemory()

Search URL Search Domain Scan URL

URL: https://twitter.com/mattifestation
Title: Matt Graeber

Search URL Search Domain Scan URL

URL: https://github.com/mattifestation/PIC_Bindshell
Title: PIC_Bindshell

Search URL Search Domain Scan URL

URL: http://www.exploit-monday.com/2013/08/writing-optimized-windows-shellcode-in-c.html
Title: Matt’s guidance on the subject

Search URL Search Domain Scan URL

URL: https://github.com/adaptivethreat/KeeThief/tree/master/DecryptionShellcode
Title: ./DecryptionShellcode/

Search URL Search Domain Scan URL

URL: http://www.exploit-monday.com/2012/12/in-memory-dll-loading.html
Title: In-Memory Managed Dll Loading With PowerShell

Search URL Search Domain Scan URL

URL: https://github.com/PowerShellMafia/PowerSploit/blob/237d362acff8ef134f0ccc9150e6b6ab8a25e768/ScriptModification/Out-CompressedDll.ps1
Title: Out-CompressedDll

Search URL Search Domain Scan URL

URL: https://github.com/adaptivethreat/KeeThief/blob/9e60798ba51d03de687bbc1a5248f12032b01951/PowerShell/KeeThief.ps1#L105
Title: load it in memory

Search URL Search Domain Scan URL

URL: https://github.com/adaptivethreat/KeeThief/blob/9e60798ba51d03de687bbc1a5248f12032b01951/PowerShell/KeeThief.ps1
Title: PowerShell script

Search URL Search Domain Scan URL

URL: https://github.com/adaptivethreat/KeeThief/blob/9e60798ba51d03de687bbc1a5248f12032b01951/PowerShell/KeeThief.ps1#L123
Title: GetKeePassMasterKeys()

Search URL Search Domain Scan URL

URL: https://fossies.org/dox/KeePass-2.34-Source/KcpKeyFile_8cs_source.html
Title: KcpKeyFile.cs

Search URL Search Domain Scan URL

URL: https://github.com/adaptivethreat/KeeThief/tree/master/KeePass-2.34-Source-Patched
Title: ./KeePass-2.34-Source-Patched/

Search URL Search Domain Scan URL

URL: https://github.com/adaptivethreat/KeeThief/tree/master/KeeTheft/ClrMD
Title: Lee customized CLR MD

Search URL Search Domain Scan URL

URL: http://keepass.info/help/v2/triggers.html
Title: “trigger” framework

Search URL Search Domain Scan URL

URL: http://keepass.info/help/v2/triggers.html#actions
Title: actions

Search URL Search Domain Scan URL

URL: http://keepass.info/help/v2/triggers.html#events
Title: events

Search URL Search Domain Scan URL

URL: http://keepass.info/help/base/configuration.html
Title: located in the same directory

Search URL Search Domain Scan URL

URL: https://github.com/adaptivethreat/KeeThief/blob/9e60798ba51d03de687bbc1a5248f12032b01951/PowerShell/KeePassConfig.ps1#L3-L294
Title: Find-KeePassconfig

Search URL Search Domain Scan URL

URL: http://keepass.info/help/kb/trigger_examples.html#export
Title: actually an example

Search URL Search Domain Scan URL

URL: https://twitter.com/markrussinovich/status/746071435047632896
Title: forthcoming ProcessOpen event

Search URL Search Domain Scan URL

URL: https://github.com/adaptivethreat/KeeThief/blob/master/PowerShell/KeePassConfig.ps1
Title: ./PowerShell/KeePassConfig.ps1

Search URL Search Domain Scan URL

URL: https://www.microsoft.com/en-us/download/details.aspx?id=50766
Title: Enhanced Mitigation Experience Toolkit

Search URL Search Domain Scan URL

URL: https://twitter.com/midnite_runr/
Title: @midnite_runr

Search URL Search Domain Scan URL

URL: https://twitter.com/subtee
Title: @subtee

Search URL Search Domain Scan URL

URL: https://www.okta.com/blog/2016/07/the-emet-serendipity-emets-ineffectiveness-against-non-exploitation-uses/
Title: The EMET Serendipity: EMET’s (In)Effectiveness Against Non-Exploitation Uses

Search URL Search Domain Scan URL

URL: https://technet.microsoft.com/en-us/library/mt634654.aspx
Title: Privileged Access Workstations

Search URL Search Domain Scan URL

URL: https://technet.microsoft.com/en-us/library/hh831782(v=ws.11).aspx
Title: Group Managed Service Accounts

Search URL Search Domain Scan URL

URL: http://keepass.info/help/base/security.html#secspecattacks
Title: KeePass knows these issues

Search URL Search Domain Scan URL

URL: https://sourceforge.net/p/keepass/discussion/329220/thread/8e511d96/#e919
Title: consider tools like KeeFarce a threat

Search URL Search Domain Scan URL

URL: https://implicitdeny.org/2016/07/user-creeping-wmi-events/
Title: User Creeping with WMI Events | Implicit Deny

Search URL Search Domain Scan URL

URL: https://cfzero.wordpress.com/2016/08/25/keepass-security-hardening/
Title: KeePass security hardening | cf zero

Search URL Search Domain Scan URL

URL: http://rallysecurity.com/rallysecurity-episode-2-keethievery/
Title: RallySecurity – Episode 2 – KeeThievery | Rally Security Podcast

Search URL Search Domain Scan URL

URL: https://akismet.com/privacy/
Title: Learn how your comment data is processed

Search URL Search Domain Scan URL

URL: https://specterops.io/

Search URL Search Domain Scan URL

URL: https://github.com/harmj0y

Search URL Search Domain Scan URL

URL: https://posts.specterops.io/

Search URL Search Domain Scan URL

URL: http://felicitybrigham.com/
Title: Felicity Brigham Design

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://t.co/rXaMzMW6Uo Page URL
https://blog.harmj0y.net/redteaming/keethief-a-case-study-in-attacking-keepass-part-2/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

23 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 rXaMzMW6Uo
t.co/ 415 B
597 B 303ms
175ms Document
text/html 104.244.42.197
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

https://t.co/rXaMzMW6Uo

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.197 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_f /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
accept-language: es-ES,es;q=0.9

Response headers

cache-control: private,max-age=300
content-encoding: gzip
content-length: 226
content-type: text/html; charset=utf-8
date: Fri, 27 Jan 2023 11:58:39 GMT
expires: Fri, 27 Jan 2023 12:03:40 GMT
perf: 7626143928
server: tsa_f
strict-transport-security: max-age=0
vary: Origin
x-connection-hash: ca0fb08930cc0817c55d541e45b37c2f21160bafec2315c7f5ada3723ca94d41
x-response-time: 115
x-transaction-id: 37eca896dc52fa26
x-xss-protection: 0

GET
H/1.1 200
OK Primary Request / Show response
blog.harmj0y.net/redteaming/keethief-a-case-study-in-attacking-keepass-part-2/ 175 KB
176 KB 1032ms
677ms Document
text/html 104.145.235.86
AS-DIGITALFYRE

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.harmj0y.net/redteaming/keethief-a-case-study-in-attacking-keepass-part-2/
Requested by: Host: t.co
URL: https://t.co/rXaMzMW6Uo
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 104.145.235.86 New York, United States, ASN64245 (AS-DIGITALFYRE, US),
Reverse DNS: leia.digitalfyre.net
Software: Apache / PHP/7.4.33
Resource Hash: f00fdbff532316e6baf3aaca12dc767e6d419482c2bb6fb17905c4fc0e2e2d32

Request headers

Referer: https://t.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
accept-language: es-ES,es;q=0.9

Response headers

Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
Date: Fri, 27 Jan 2023 11:58:40 GMT
Keep-Alive: timeout=5, max=100
Link: <https://blog.harmj0y.net/wp-json/>; rel="https://api.w.org/", <https://blog.harmj0y.net/wp-json/wp/v2/posts/3124>; rel="alternate"; type="application/json", <https://blog.harmj0y.net/?p=3124>; rel=shortlink
Server: Apache
Transfer-Encoding: chunked
X-Pingback: https://blog.harmj0y.net/xmlrpc.php
X-Powered-By: PHP/7.4.33

GET
H/1.1 200
OK main.min.css
blog.harmj0y.net/wp-content/themes/astra/assets/css/minified/ 39 KB
39 KB 374ms
132ms Stylesheet
text/css 104.145.235.86
AS-DIGITALFYRE

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.harmj0y.net/wp-content/themes/astra/assets/css/minified/main.min.css?ver=3.8.5
Requested by: Host: blog.harmj0y.net
URL: https://blog.harmj0y.net/redteaming/keethief-a-case-study-in-attacking-keepass-part-2/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 104.145.235.86 New York, United States, ASN64245 (AS-DIGITALFYRE, US),
Reverse DNS: leia.digitalfyre.net
Software: Apache /
Resource Hash: 2661bf7b0200e2fb896e87f63eb9b3ad0deb75e9e6b41d6daee5f05c1288a427

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://blog.harmj0y.net/redteaming/keethief-a-case-study-in-attacking-keepass-part-2/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Date: Fri, 27 Jan 2023 11:58:41 GMT
Last-Modified: Thu, 07 Jul 2022 18:47:29 GMT
Server: Apache
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 40031

GET
H/1.1 200
OK wp-emoji-release.min.js Show response
blog.harmj0y.net/wp-includes/js/ 18 KB
18 KB 712ms
125ms Script
application/javascript 104.145.235.86
AS-DIGITALFYRE

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.harmj0y.net/wp-includes/js/wp-emoji-release.min.js?ver=6.0.3
Requested by: Host: blog.harmj0y.net
URL: https://blog.harmj0y.net/redteaming/keethief-a-case-study-in-attacking-keepass-part-2/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 104.145.235.86 New York, United States, ASN64245 (AS-DIGITALFYRE, US),
Reverse DNS: leia.digitalfyre.net
Software: Apache /
Resource Hash: 5aad5fbd4238981a9ff5e2772ff1353dfe1a801fb49542fe157418c1438f7782

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://blog.harmj0y.net/redteaming/keethief-a-case-study-in-attacking-keepass-part-2/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Date: Fri, 27 Jan 2023 11:58:42 GMT
Last-Modified: Tue, 12 Apr 2022 05:56:23 GMT
Server: Apache
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 18617

GET
H2 200 css
fonts.googleapis.com/ 3 KB
1 KB 254ms
87ms Stylesheet
text/css 2a00:1450:4001:80f::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto%3A400%2C%7COxanium%3A400%2C&display=fallback&ver=3.8.5

Requested by

Host: blog.harmj0y.net
URL: https://blog.harmj0y.net/redteaming/keethief-a-case-study-in-attacking-keepass-part-2/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

ba20771ece0acdda46038d5f126c3734aece9528d9f8868611f954e15eaa2dba

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://blog.harmj0y.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Fri, 27 Jan 2023 11:58:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Fri, 27 Jan 2023 11:58:41 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 27 Jan 2023 11:58:41 GMT

GET
H/1.1 200
OK style.min.css
blog.harmj0y.net/wp-includes/css/dist/block-library/ 87 KB
87 KB 146ms
128ms Stylesheet
text/css 104.145.235.86
AS-DIGITALFYRE

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.harmj0y.net/wp-includes/css/dist/block-library/style.min.css?ver=6.0.3
Requested by: Host: blog.harmj0y.net
URL: https://blog.harmj0y.net/redteaming/keethief-a-case-study-in-attacking-keepass-part-2/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 104.145.235.86 New York, United States, ASN64245 (AS-DIGITALFYRE, US),
Reverse DNS: leia.digitalfyre.net
Software: Apache /
Resource Hash: d7705700d24d5919255576642ad2c28bfc790390b7183a369038ff5c1e814d51

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://blog.harmj0y.net/redteaming/keethief-a-case-study-in-attacking-keepass-part-2/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Date: Fri, 27 Jan 2023 11:58:41 GMT
Last-Modified: Mon, 04 Jul 2022 12:10:37 GMT
Server: Apache
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 88932

GET
H/1.1 200
OK default.css
blog.harmj0y.net/wp-content/plugins/tablepress/css/build/ 6 KB
6 KB 357ms
128ms Stylesheet
text/css 104.145.235.86
AS-DIGITALFYRE

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.harmj0y.net/wp-content/plugins/tablepress/css/build/default.css?ver=2.0.4
Requested by: Host: blog.harmj0y.net
URL: https://blog.harmj0y.net/redteaming/keethief-a-case-study-in-attacking-keepass-part-2/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 104.145.235.86 New York, United States, ASN64245 (AS-DIGITALFYRE, US),
Reverse DNS: leia.digitalfyre.net
Software: Apache /
Resource Hash: b7193bd1228920067e241fc9b5c987bfa8eb9b9dc06e986ff31e338b1f06d93f

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://blog.harmj0y.net/redteaming/keethief-a-case-study-in-attacking-keepass-part-2/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Date: Fri, 27 Jan 2023 11:58:41 GMT
Last-Modified: Thu, 19 Jan 2023 20:07:43 GMT
Server: Apache
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 6068

GET
H/1.1 200
OK frontend.min.css
blog.harmj0y.net/wp-content/plugins/elementor/assets/css/ 143 KB
144 KB 366ms
125ms Stylesheet
text/css 104.145.235.86
AS-DIGITALFYRE

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.harmj0y.net/wp-content/plugins/elementor/assets/css/frontend.min.css?ver=3.10.1
Requested by: Host: blog.harmj0y.net
URL: https://blog.harmj0y.net/redteaming/keethief-a-case-study-in-attacking-keepass-part-2/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 104.145.235.86 New York, United States, ASN64245 (AS-DIGITALFYRE, US),
Reverse DNS: leia.digitalfyre.net
Software: Apache /
Resource Hash: f06ce878cc6f6ffda8ab31093a9846dce86798a8e64359e8fbde826687b98a00

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://blog.harmj0y.net/redteaming/keethief-a-case-study-in-attacking-keepass-part-2/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Date: Fri, 27 Jan 2023 11:58:41 GMT
Last-Modified: Wed, 18 Jan 2023 02:07:34 GMT
Server: Apache
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 146877

GET
H/1.1 200
OK general.min.css
blog.harmj0y.net/wp-content/plugins/essential-addons-for-elementor-lite/assets/front-end/css/view/ 3 KB
4 KB 368ms
125ms Stylesheet
text/css 104.145.235.86
AS-DIGITALFYRE

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.harmj0y.net/wp-content/plugins/essential-addons-for-elementor-lite/assets/front-end/css/view/general.min.css?ver=5.5.3
Requested by: Host: blog.harmj0y.net
URL: https://blog.harmj0y.net/redteaming/keethief-a-case-study-in-attacking-keepass-part-2/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 104.145.235.86 New York, United States, ASN64245 (AS-DIGITALFYRE, US),
Reverse DNS: leia.digitalfyre.net
Software: Apache /
Resource Hash: d89ae0ab7e6358b2a4b1b6c1fa017edaeb608e20d5acb44562096ac0ea775482

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://blog.harmj0y.net/redteaming/keethief-a-case-study-in-attacking-keepass-part-2/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Date: Fri, 27 Jan 2023 11:58:41 GMT
Last-Modified: Wed, 25 Jan 2023 20:07:24 GMT
Server: Apache
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 3509

GET
H/1.1 200
OK jquery.min.js Show response
blog.harmj0y.net/wp-includes/js/jquery/ 87 KB
88 KB 372ms
129ms Script
application/javascript 104.145.235.86
AS-DIGITALFYRE

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.harmj0y.net/wp-includes/js/jquery/jquery.min.js?ver=3.6.0
Requested by: Host: blog.harmj0y.net
URL: https://blog.harmj0y.net/redteaming/keethief-a-case-study-in-attacking-keepass-part-2/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 104.145.235.86 New York, United States, ASN64245 (AS-DIGITALFYRE, US),
Reverse DNS: leia.digitalfyre.net
Software: Apache /
Resource Hash: bd4de6a3fc0fb68d6f76ba7b93514b96a92e585c295b5351c31ad92a4b0777ea

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://blog.harmj0y.net/redteaming/keethief-a-case-study-in-attacking-keepass-part-2/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Date: Fri, 27 Jan 2023 11:58:42 GMT
Last-Modified: Wed, 10 Mar 2021 15:07:24 GMT
Server: Apache
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 89521

GET
H/1.1 200
OK jquery-migrate.min.js Show response
blog.harmj0y.net/wp-includes/js/jquery/ 11 KB
11 KB 471ms
125ms Script
application/javascript 104.145.235.86
AS-DIGITALFYRE

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.harmj0y.net/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2
Requested by: Host: blog.harmj0y.net
URL: https://blog.harmj0y.net/redteaming/keethief-a-case-study-in-attacking-keepass-part-2/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 104.145.235.86 New York, United States, ASN64245 (AS-DIGITALFYRE, US),
Reverse DNS: leia.digitalfyre.net
Software: Apache /
Resource Hash: 029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://blog.harmj0y.net/redteaming/keethief-a-case-study-in-attacking-keepass-part-2/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Date: Fri, 27 Jan 2023 11:58:42 GMT
Last-Modified: Wed, 18 Nov 2020 09:06:06 GMT
Server: Apache
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 11224

GET
H/1.1 200
OK Union-120x38.png
blog.harmj0y.net/wp-content/uploads/2021/05/ 2 KB
3 KB 133ms
133ms Image
image/png 104.145.235.86
AS-DIGITALFYRE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blog.harmj0y.net/wp-content/uploads/2021/05/Union-120x38.png
Requested by: Host: blog.harmj0y.net
URL: https://blog.harmj0y.net/redteaming/keethief-a-case-study-in-attacking-keepass-part-2/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 104.145.235.86 New York, United States, ASN64245 (AS-DIGITALFYRE, US),
Reverse DNS: leia.digitalfyre.net
Software: Apache /
Resource Hash: 8a1dde7ad01f6cf4cbf610c758ee960c3a1af61ad86ac7426cdbee1fe760d68b

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://blog.harmj0y.net/redteaming/keethief-a-case-study-in-attacking-keepass-part-2/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Date: Fri, 27 Jan 2023 11:58:42 GMT
Last-Modified: Mon, 21 Feb 2022 20:07:23 GMT
Server: Apache
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 2480

GET
H/1.1 200
OK 1_keepass_securedesktop-768x614.png
blog.harmj0y.net/wp-content/uploads/2016/07/ 117 KB
118 KB 134ms
133ms Image
image/png 104.145.235.86
AS-DIGITALFYRE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blog.harmj0y.net/wp-content/uploads/2016/07/1_keepass_securedesktop-768x614.png
Requested by: Host: blog.harmj0y.net
URL: https://blog.harmj0y.net/redteaming/keethief-a-case-study-in-attacking-keepass-part-2/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 104.145.235.86 New York, United States, ASN64245 (AS-DIGITALFYRE, US),
Reverse DNS: leia.digitalfyre.net
Software: Apache /
Resource Hash: d9a583aa66bfcf7abdc70994a6a56d9b9d37e0b3a048988d3b5650f29fc56cfe

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://blog.harmj0y.net/redteaming/keethief-a-case-study-in-attacking-keepass-part-2/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Date: Fri, 27 Jan 2023 11:58:42 GMT
Last-Modified: Wed, 06 Jul 2016 20:38:28 GMT
Server: Apache
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 120099

GET
H/1.1 200
OK comment-reply.min.js Show response
blog.harmj0y.net/wp-includes/js/ 3 KB
3 KB 126ms
126ms Script
application/javascript 104.145.235.86
AS-DIGITALFYRE

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.harmj0y.net/wp-includes/js/comment-reply.min.js?ver=6.0.3
Requested by: Host: blog.harmj0y.net
URL: https://blog.harmj0y.net/redteaming/keethief-a-case-study-in-attacking-keepass-part-2/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 104.145.235.86 New York, United States, ASN64245 (AS-DIGITALFYRE, US),
Reverse DNS: leia.digitalfyre.net
Software: Apache /
Resource Hash: e174a58a503ab84b3d1b9de12fd3895788204485170f1289e445f7b5b98ec789

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://blog.harmj0y.net/redteaming/keethief-a-case-study-in-attacking-keepass-part-2/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Date: Fri, 27 Jan 2023 11:58:42 GMT
Last-Modified: Fri, 08 Apr 2022 20:07:18 GMT
Server: Apache
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 2981

GET
H/1.1 200
OK frontend.min.js Show response
blog.harmj0y.net/wp-content/themes/astra/assets/js/minified/ 16 KB
17 KB 126ms
126ms Script
application/javascript 104.145.235.86
AS-DIGITALFYRE

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.harmj0y.net/wp-content/themes/astra/assets/js/minified/frontend.min.js?ver=3.8.5
Requested by: Host: blog.harmj0y.net
URL: https://blog.harmj0y.net/redteaming/keethief-a-case-study-in-attacking-keepass-part-2/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 104.145.235.86 New York, United States, ASN64245 (AS-DIGITALFYRE, US),
Reverse DNS: leia.digitalfyre.net
Software: Apache /
Resource Hash: 07b22178596c5c5ac3c9d568c7c86ab07960f1fb5ac0be88761eb3802df8905b

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://blog.harmj0y.net/redteaming/keethief-a-case-study-in-attacking-keepass-part-2/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Date: Fri, 27 Jan 2023 11:58:42 GMT
Last-Modified: Thu, 07 Jul 2022 18:47:29 GMT
Server: Apache
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 16732

GET
H/1.1 200
OK general.min.js Show response
blog.harmj0y.net/wp-content/plugins/essential-addons-for-elementor-lite/assets/front-end/js/view/ 9 KB
9 KB 126ms
125ms Script
application/javascript 104.145.235.86
AS-DIGITALFYRE

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.harmj0y.net/wp-content/plugins/essential-addons-for-elementor-lite/assets/front-end/js/view/general.min.js?ver=5.5.3
Requested by: Host: blog.harmj0y.net
URL: https://blog.harmj0y.net/redteaming/keethief-a-case-study-in-attacking-keepass-part-2/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 104.145.235.86 New York, United States, ASN64245 (AS-DIGITALFYRE, US),
Reverse DNS: leia.digitalfyre.net
Software: Apache /
Resource Hash: 93272f20839f44a19564f78577a3c3ac70131dd6304ccddeedcb3cabed750df5

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://blog.harmj0y.net/redteaming/keethief-a-case-study-in-attacking-keepass-part-2/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Date: Fri, 27 Jan 2023 11:58:42 GMT
Last-Modified: Wed, 25 Jan 2023 20:07:24 GMT
Server: Apache
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=97
Content-Length: 8770

GET
H/1.1 200
OK akismet-frontend.js Show response
blog.harmj0y.net/wp-content/plugins/akismet/_inc/ 10 KB
11 KB 132ms
132ms Script
application/javascript 104.145.235.86
AS-DIGITALFYRE

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.harmj0y.net/wp-content/plugins/akismet/_inc/akismet-frontend.js?ver=1669947675
Requested by: Host: blog.harmj0y.net
URL: https://blog.harmj0y.net/redteaming/keethief-a-case-study-in-attacking-keepass-part-2/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 104.145.235.86 New York, United States, ASN64245 (AS-DIGITALFYRE, US),
Reverse DNS: leia.digitalfyre.net
Software: Apache /
Resource Hash: 5734f1b66dcb622529d435aba20990813d43553f949bc0813719b4e7d1252527

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://blog.harmj0y.net/redteaming/keethief-a-case-study-in-attacking-keepass-part-2/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Date: Fri, 27 Jan 2023 11:58:42 GMT
Last-Modified: Fri, 02 Dec 2022 02:21:15 GMT
Server: Apache
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 10733

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ 15 KB
16 KB 191ms
59ms Font
font/woff2 2a00:1450:4001:80b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A400%2C%7COxanium%3A400%2C&display=fallback&ver=3.8.5

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://blog.harmj0y.net
accept-language: es-ES,es;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 27 Jan 2023 01:48:43 GMT
x-content-type-options: nosniff
age: 36599
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15744
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:48 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 27 Jan 2024 01:48:43 GMT

GET
H2 200 RrQPboN_4yJ0JmiMUW7sIGjd1IA9G81JfkiLD3U.woff2
fonts.gstatic.com/s/oxanium/v14/ 8 KB
8 KB 207ms
76ms Font
font/woff2 2a00:1450:4001:80b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/oxanium/v14/RrQPboN_4yJ0JmiMUW7sIGjd1IA9G81JfkiLD3U.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A400%2C%7COxanium%3A400%2C&display=fallback&ver=3.8.5

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e966553564a7f089cfb2e2b54f2988d176fda9ba0778483b7c66763f21fe33df

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://blog.harmj0y.net
accept-language: es-ES,es;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Thu, 26 Jan 2023 10:07:56 GMT
x-content-type-options: nosniff
age: 93046
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8084
x-xss-protection: 0
last-modified: Mon, 18 Jul 2022 19:11:31 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 26 Jan 2024 10:07:56 GMT

GET
H/1.1 200
OK 2_get_keepassdatabasekey-768x736.png
blog.harmj0y.net/wp-content/uploads/2016/07/ 264 KB
264 KB 125ms
124ms Image
image/png 104.145.235.86
AS-DIGITALFYRE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blog.harmj0y.net/wp-content/uploads/2016/07/2_get_keepassdatabasekey-768x736.png
Requested by: Host: blog.harmj0y.net
URL: https://blog.harmj0y.net/redteaming/keethief-a-case-study-in-attacking-keepass-part-2/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 104.145.235.86 New York, United States, ASN64245 (AS-DIGITALFYRE, US),
Reverse DNS: leia.digitalfyre.net
Software: Apache /
Resource Hash: 65fb45e7522322d8c0d68cfa4b5967422342a702ae5e641cac3113be8b2c15c3

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://blog.harmj0y.net/redteaming/keethief-a-case-study-in-attacking-keepass-part-2/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Date: Fri, 27 Jan 2023 11:58:42 GMT
Last-Modified: Wed, 06 Jul 2016 20:38:48 GMT
Server: Apache
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 270019

GET
H/1.1 200
OK 3_patched_keepass-768x602.png
blog.harmj0y.net/wp-content/uploads/2016/07/ 140 KB
140 KB 125ms
125ms Image
image/png 104.145.235.86
AS-DIGITALFYRE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blog.harmj0y.net/wp-content/uploads/2016/07/3_patched_keepass-768x602.png
Requested by: Host: blog.harmj0y.net
URL: https://blog.harmj0y.net/redteaming/keethief-a-case-study-in-attacking-keepass-part-2/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 104.145.235.86 New York, United States, ASN64245 (AS-DIGITALFYRE, US),
Reverse DNS: leia.digitalfyre.net
Software: Apache /
Resource Hash: 2db0125573a7b44349444f4c9d0fc7667ec103ee6e655da304bdd7eda64a7c0a

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://blog.harmj0y.net/redteaming/keethief-a-case-study-in-attacking-keepass-part-2/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Date: Fri, 27 Jan 2023 11:58:42 GMT
Last-Modified: Wed, 06 Jul 2016 20:39:00 GMT
Server: Apache
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 143300

GET
H/1.1 200
OK 4_open_database-768x604.png
blog.harmj0y.net/wp-content/uploads/2016/07/ 94 KB
94 KB 125ms
125ms Image
image/png 104.145.235.86
AS-DIGITALFYRE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blog.harmj0y.net/wp-content/uploads/2016/07/4_open_database-768x604.png
Requested by: Host: blog.harmj0y.net
URL: https://blog.harmj0y.net/redteaming/keethief-a-case-study-in-attacking-keepass-part-2/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 104.145.235.86 New York, United States, ASN64245 (AS-DIGITALFYRE, US),
Reverse DNS: leia.digitalfyre.net
Software: Apache /
Resource Hash: 70e3db52e22f5e755df4143b663abcff632d6a1a1cc987c5f5f6c7440a1277af

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://blog.harmj0y.net/redteaming/keethief-a-case-study-in-attacking-keepass-part-2/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Date: Fri, 27 Jan 2023 11:58:42 GMT
Last-Modified: Wed, 06 Jul 2016 20:39:15 GMT
Server: Apache
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 95957

GET
H/1.1 200
OK SO-logo-300x119.png
blog.harmj0y.net/wp-content/uploads/2021/06/ 8 KB
8 KB 126ms
124ms Image
image/png 104.145.235.86
AS-DIGITALFYRE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blog.harmj0y.net/wp-content/uploads/2021/06/SO-logo-300x119.png
Requested by: Host: blog.harmj0y.net
URL: https://blog.harmj0y.net/redteaming/keethief-a-case-study-in-attacking-keepass-part-2/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 104.145.235.86 New York, United States, ASN64245 (AS-DIGITALFYRE, US),
Reverse DNS: leia.digitalfyre.net
Software: Apache /
Resource Hash: 4a8b68ea05f8700184289a3823c6bd3781c98678e1c50bdfabaf12d44dc7f8a6

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://blog.harmj0y.net/redteaming/keethief-a-case-study-in-attacking-keepass-part-2/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Date: Fri, 27 Jan 2023 11:58:42 GMT
Last-Modified: Wed, 02 Jun 2021 20:58:15 GMT
Server: Apache
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=96
Content-Length: 8230

Verdicts & Comments Add Verdict or Comment

22 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.t.co/	1970-01-20 18:43:55	Name: muc Value: d11ae2a4-b623-4e41-b7bf-3c164ca874a5

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	warning	URL: https://blog.harmj0y.net/redteaming/keethief-a-case-study-in-attacking-keepass-part-2/(Line 695) Message: Mixed Content: The page at 'https://blog.harmj0y.net/redteaming/keethief-a-case-study-in-attacking-keepass-part-2/' was loaded over HTTPS, but requested an insecure element 'http://www.harmj0y.net/blog/wp-content/uploads/2016/07/keepass_trigger.gif'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://blog.harmj0y.net/redteaming/keethief-a-case-study-in-attacking-keepass-part-2/(Line 695) Message: Mixed Content: The page at 'https://blog.harmj0y.net/redteaming/keethief-a-case-study-in-attacking-keepass-part-2/' was loaded over HTTPS, but requested an insecure element 'http://www.harmj0y.net/blog/wp-content/uploads/2016/07/keepass_textcopy.gif'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=0
X-Xss-Protection	0

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

blog.harmj0y.net
fonts.googleapis.com
fonts.gstatic.com
t.co
104.145.235.86
104.244.42.197
2a00:1450:4001:80b::2003
2a00:1450:4001:80f::200a
029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300
07b22178596c5c5ac3c9d568c7c86ab07960f1fb5ac0be88761eb3802df8905b
2661bf7b0200e2fb896e87f63eb9b3ad0deb75e9e6b41d6daee5f05c1288a427
2db0125573a7b44349444f4c9d0fc7667ec103ee6e655da304bdd7eda64a7c0a
4a8b68ea05f8700184289a3823c6bd3781c98678e1c50bdfabaf12d44dc7f8a6
5734f1b66dcb622529d435aba20990813d43553f949bc0813719b4e7d1252527
5aad5fbd4238981a9ff5e2772ff1353dfe1a801fb49542fe157418c1438f7782
65fb45e7522322d8c0d68cfa4b5967422342a702ae5e641cac3113be8b2c15c3
70e3db52e22f5e755df4143b663abcff632d6a1a1cc987c5f5f6c7440a1277af
8a1dde7ad01f6cf4cbf610c758ee960c3a1af61ad86ac7426cdbee1fe760d68b
93272f20839f44a19564f78577a3c3ac70131dd6304ccddeedcb3cabed750df5
b7193bd1228920067e241fc9b5c987bfa8eb9b9dc06e986ff31e338b1f06d93f
ba20771ece0acdda46038d5f126c3734aece9528d9f8868611f954e15eaa2dba
bd4de6a3fc0fb68d6f76ba7b93514b96a92e585c295b5351c31ad92a4b0777ea
d7705700d24d5919255576642ad2c28bfc790390b7183a369038ff5c1e814d51
d89ae0ab7e6358b2a4b1b6c1fa017edaeb608e20d5acb44562096ac0ea775482
d9a583aa66bfcf7abdc70994a6a56d9b9d37e0b3a048988d3b5650f29fc56cfe
e174a58a503ab84b3d1b9de12fd3895788204485170f1289e445f7b5b98ec789
e966553564a7f089cfb2e2b54f2988d176fda9ba0778483b7c66763f21fe33df
f00fdbff532316e6baf3aaca12dc767e6d419482c2bb6fb17905c4fc0e2e2d32
f06ce878cc6f6ffda8ab31093a9846dce86798a8e64359e8fbde826687b98a00
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615

blog.harmj0y.net Open in urlscan Pro 104.145.235.86 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

23 Requests

100 %HTTPS

50 %IPv6

4 Domains

4 Subdomains

4 IPs

2 Countries

1264 kBTransfer

1260 kBSize

1 Cookies

68 Outgoing links

Page URL History

Redirected requests

23 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

22 JavaScript Global Variables

1 Cookies

2 Console Messages

Security Headers

Indicators

blog.harmj0y.net Open in urlscan Pro
104.145.235.86 Public Scan

Screenshot
Live screenshot

Full Image

23
Requests

100 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

4
IPs

2
Countries

1264 kB
Transfer

1260 kB
Size

1
Cookies

23 HTTP transactions
0 data transactions