ired.team Open in urlscan Pro
2606:4700:3030::681f:5ab4 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-...
Submission: On April 06 via manual (April 6th 2020, 11:35:18 pm UTC)

Summary HTTP 51 Redirects Links 11 Behaviour Indicators

Summary

This website contacted 16 IPs in 3 countries across 12 domains to perform 51 HTTP transactions. The main IP is 2606:4700:3030::681f:5ab4, located in United States and belongs to CLOUDFLARENET, US. The main domain is ired.team.
TLS certificate: Issued by CloudFlare Inc ECC CA-2 on September 11th 2019. Valid for: a year.

This is the only time ired.team was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
2	2606:4700:303... 2606:4700:3030::681f:5ab4	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:808::200a	15169 (GOOGLE) (GOOGLE)
1	2606:4700::68... 2606:4700::6810:7daf	13335 (CLOUDFLAR...) (CLOUDFLARENET)
8	34.107.189.150 34.107.189.150	15169 (GOOGLE) (GOOGLE)
1	2a04:4e42:400... 2a04:4e42:400::621	54113 (FASTLY) (FASTLY)
16	34.107.207.82 34.107.207.82	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:806::2001	15169 (GOOGLE) (GOOGLE)
2	72.52.131.85 72.52.131.85	32244 (LIQUIDWEB) (LIQUIDWEB)
2	2606:4700::68... 2606:4700::6810:7591	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:814::2003	15169 (GOOGLE) (GOOGLE)
1	2606:4700:e2:... 2606:4700:e2::ac40:8b14	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700:20:... 2606:4700:20::681a:7cd	13335 (CLOUDFLAR...) (CLOUDFLARENET)
8	2600:1901:0:9... 2600:1901:0:94b6::	15169 (GOOGLE) (GOOGLE)
1	2606:4700:20:... 2606:4700:20::681a:6cd	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	2a00:1450:400... 2a00:1450:4001:81c::200e	15169 (GOOGLE) (GOOGLE)
51	16

2 2606:4700:3030::681f:5ab4 (United States)

ASN13335 (CLOUDFLARENET, US)

ired.team	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:808::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:7daf (United States)

ASN13335 (CLOUDFLARENET, US)

unpkg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 34.107.189.150 (United States)

ASN15169 (GOOGLE, US)
PTR: 150.189.107.34.bc.googleusercontent.com

gstatic.gitbook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:400::621 (Ascension Island)

ASN54113 (FASTLY, US)

polyfill.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

16 34.107.207.82 (United States)

ASN15169 (GOOGLE, US)
PTR: 82.207.107.34.bc.googleusercontent.com

gblobscdn.gitbook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:806::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

lh5.googleusercontent.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 72.52.131.85 (Lansing, United States)

ASN32244 (LIQUIDWEB, US)

blog.stealthbits.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6810:7591 (United States)

ASN13335 (CLOUDFLARENET, US)

miro.medium.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:814::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:e2::ac40:8b14 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.lr-ingest.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:20::681a:7cd (United States)

ASN13335 (CLOUDFLARENET, US)

app.gitbook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2600:1901:0:94b6:: (United States)

ASN15169 (GOOGLE, US)

gitbook-28427.firebaseio.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
s-usc1c-nss-287.firebaseio.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:20::681a:6cd (United States)

ASN13335 (CLOUDFLARENET, US)

www.gitbook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:81c::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
26	gitbook.com gstatic.gitbook.com gblobscdn.gitbook.com app.gitbook.com www.gitbook.com	6 MB
8	firebaseio.com gitbook-28427.firebaseio.com s-usc1c-nss-287.firebaseio.com	2 KB
3	google-analytics.com www.google-analytics.com	18 KB
2	medium.com miro.medium.com	149 KB
2	stealthbits.com blog.stealthbits.com	263 KB
2	googleusercontent.com lh5.googleusercontent.com	14 KB
2	ired.team ired.team	292 KB
1	lr-ingest.io cdn.lr-ingest.io	105 KB
1	gstatic.com fonts.gstatic.com	11 KB
1	polyfill.io polyfill.io	555 B
1	unpkg.com unpkg.com	14 KB
1	googleapis.com fonts.googleapis.com	682 B
51	12

	Domain	Requested by
16	gblobscdn.gitbook.com	ired.team gstatic.gitbook.com
8	gstatic.gitbook.com	ired.team gstatic.gitbook.com
7	s-usc1c-nss-287.firebaseio.com	gstatic.gitbook.com
3	www.google-analytics.com	gstatic.gitbook.com
2	miro.medium.com	ired.team
2	blog.stealthbits.com	ired.team
2	lh5.googleusercontent.com	ired.team gstatic.gitbook.com
2	ired.team	ired.team
1	www.gitbook.com	gstatic.gitbook.com
1	gitbook-28427.firebaseio.com	gstatic.gitbook.com
1	app.gitbook.com	gstatic.gitbook.com
1	cdn.lr-ingest.io	gstatic.gitbook.com
1	fonts.gstatic.com	ired.team
1	polyfill.io	ired.team
1	unpkg.com	ired.team
1	fonts.googleapis.com	ired.team
51	16

This site contains links to these domains. Also see Links.

Domain
www.linkedin.com
github.com
twitter.com
www.patreon.com
www.gitbook.com
msdn.microsoft.com
www.harmj0y.net
blog.stealthbits.com
medium.com

Subject Issuer	Validity	Valid
sni.cloudflaressl.com CloudFlare Inc ECC CA-2	`2019-09-11` - `2020-09-10`	a year	crt.sh
*.storage.googleapis.com GTS CA 1O1	`2020-03-03` - `2020-05-26`	3 months	crt.sh
gstatic.gitbook.com GTS CA 1D2	`2020-03-06` - `2020-06-04`	3 months	crt.sh
f3.shared.global.fastly.net GlobalSign CloudSSL CA - SHA256 - G3	`2019-05-29` - `2020-04-23`	a year	crt.sh
gblobscdn.gitbook.com GTS CA 1D2	`2020-02-21` - `2020-05-21`	3 months	crt.sh
*.googleusercontent.com GTS CA 1O1	`2020-03-03` - `2020-05-26`	3 months	crt.sh
downloads.stealthbits.com Go Daddy Secure Certificate Authority - G2	`2018-10-24` - `2020-10-24`	2 years	crt.sh
*.medium.com DigiCert SHA2 Secure Server CA	`2018-07-31` - `2020-09-09`	2 years	crt.sh
*.google.com GTS CA 1O1	`2020-03-03` - `2020-05-26`	3 months	crt.sh
firebaseio.com GTS CA 1O1	`2020-02-20` - `2021-02-18`	a year	crt.sh
*.google-analytics.com GTS CA 1O1	`2020-03-03` - `2020-05-26`	3 months	crt.sh

This page contains 3 frames:

Primary Page: https://ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
Frame ID: 5A3ACEAB2D8168FF02EE10C384277A30
Requests: 43 HTTP requests in this frame

Frame: https://gitbook-28427.firebaseio.com/.lp?start=t&ser=3082479&cb=1&v=5
Frame ID: 3911A4FCEFA381007713FA410B2FD4B8
Requests: 7 HTTP requests in this frame

Frame: https://s-usc1c-nss-287.firebaseio.com/.lp?dframe=t&id=2745328&pw=weIeKzyrlD&ns=gitbook-28427
Frame ID: 1ECD8D9E1A96DE94BF67716578803264
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

React (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

html /<[^>]+data-react/i

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /^cloudflare$/i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i

Polyfill (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /\/polyfill\.min\.js/i

Page Statistics

51
Requests

98 %
HTTPS

80 %
IPv6

12
Domains

16
Subdomains

16
IPs

3
Countries

6668 kB
Transfer

8951 kB
Size

2
Cookies

11 Outgoing links

These are links going to different origins than the main page.

URL: https://www.linkedin.com/in/mantvydasb/
Title: linkedin

Search URL Search Domain Scan URL

URL: https://github.com/mantvydasb/RedTeam-Tactics-and-Techniques
Title: github

Search URL Search Domain Scan URL

URL: https://twitter.com/spotheplanet
Title: @spotheplanet

Search URL Search Domain Scan URL

URL: https://www.patreon.com/iredteam
Title: patreon

Search URL Search Domain Scan URL

URL: https://www.gitbook.com/?utm_source=content&utm_medium=trademark&utm_campaign=mantvydas
Title: Powered by GitBook

Search URL Search Domain Scan URL

URL: https://msdn.microsoft.com/en-us/library/ms684354(v=vs.85).aspx
Title: DS-Replication-Get-Changes

Search URL Search Domain Scan URL

URL: https://msdn.microsoft.com/en-us/library/ms684355(v=vs.85).aspx
Title: Replicating Directory Changes All

Search URL Search Domain Scan URL

URL: https://msdn.microsoft.com/en-us/library/hh338663(v=vs.85).aspx
Title: Replicating Directory Changes In Filtered Set

Search URL Search Domain Scan URL

URL: http://www.harmj0y.net/blog/redteaming/abusing-active-directory-permissions-with-powerview/
Title: http://www.harmj0y.net/blog/redteaming/abusing-active-directory-permissions-with-powerview/

Search URL Search Domain Scan URL

URL: https://blog.stealthbits.com/extracting-user-password-data-with-mimikatz-dcsync/
Title: Extracting User Password Data with Mimikatz DCSync | Insider ThreatUsing the Mimikatz DCSync command to compromise credentials by replicating information with Directory Replication Service Remote Protocol MS-DRSR.blog.stealthbits.com

Search URL Search Domain Scan URL

URL: https://medium.com/@jsecurity101/syncing-into-the-shadows-bbd656dd14c8
Title: Syncing Into the ShadowsIntroduction:medium.com

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

51 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request dump-password-hashes-from-domain-controller-with-dcsync Show response
ired.team/offensive-security-experiments/active-directory-kerberos-abuse/ 1 MB
292 KB 90ms
28ms Document
text/html 2606:4700:3030::681f:5ab4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3030::681f:5ab4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e7a89c9941bc8240f4675b9aaa19bfc37da0c3680eda23a9ce3c4961671d7d06

Request headers

:method: GET
:authority: ired.team
:scheme: https
:path: /offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest: document
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: document

Response headers

status: 200
date: Mon, 06 Apr 2020 23:34:59 GMT
content-type: text/html; charset=utf-8
set-cookie: __cfduid=d17faa05ae997a1b3217ff562ee0034bf1586216099; expires=Wed, 06-May-20 23:34:59 GMT; path=/; domain=.ired.team; HttpOnly; SameSite=Lax
age: 25648
last-modified: Mon, 06 Apr 2020 16:27:31 GMT
vary: Accept-Encoding
x-cache: HIT
x-cdn-cache-group: -LFEMnER3fywgFHoroYn
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 57ff529f4c96d6c5-FRA
content-encoding: br

GET
H2 200 css
fonts.googleapis.com/ 2 KB
682 B 19ms
14ms Stylesheet
text/css 2a00:1450:4001:808::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Source+Code+Pro:500

Requested by

Host: ired.team
URL: https://ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

dfbf03bd10a5461d085675f9ab7c442b3b4dbe2c5001a661a3925ac9f1378cb6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
x-xss-protection: 0
last-modified: Mon, 06 Apr 2020 23:34:59 GMT
server: ESF
date: Mon, 06 Apr 2020 23:34:59 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 06 Apr 2020 23:34:59 GMT

GET
H2 200 emojione-sprite-40.min.css
unpkg.com/emojione-assets@4.0.0/sprites/ 183 KB
14 KB 39ms
21ms Stylesheet
text/css 2606:4700::6810:7daf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://unpkg.com/emojione-assets@4.0.0/sprites/emojione-sprite-40.min.css

Requested by

Host: ired.team
URL: https://ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7daf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c5e939d7d3f9c9bfe632d16484c12354fa89a12738f30f738aa81c984e5b9a92

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

date: Mon, 06 Apr 2020 23:34:59 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 5152623
status: 200
strict-transport-security: max-age=31536000; includeSubDomains; preload
last-modified: Sat, 26 Oct 1985 08:15:00 GMT
server: cloudflare
etag: W/"2dc7c-MlEndlChcp6B66cJCh5yD8CB/Fo"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
x-cloud-trace-context: 7aa8f28d7cd64baade2cd0abcd9d1b99
cache-control: public, max-age=31536000
cf-ray: 57ff529faff72724-FRA

GET
H2 200 6c3c9dec9383137845be0f0ea2cf1bf4.css
gstatic.gitbook.com/css/ 2 KB
2 KB 91ms
27ms Stylesheet
text/css 34.107.189.150
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://gstatic.gitbook.com/css/6c3c9dec9383137845be0f0ea2cf1bf4.css
Requested by: Host: ired.team
URL: https://ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.107.189.150 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 150.189.107.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: f008dc0769c2e3c28c21859c9f0f18a05aeef49930affa9cc6a8afb8104355fb

Request headers

Referer: https://ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

date: Tue, 10 Mar 2020 13:04:58 GMT
age: 2370601
status: 200
x-guploader-uploadid: AEnB2Uo0hVdryFl9E0ecDLqkfUR48bc9KjdBeEb1-ODaXm0Ssu7Ae736fPKDUZnasyGp1ncBZgGLrOsKy8fxRjRu8g-_8dNPNw
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: clear
content-length: 1701
last-modified: Tue, 10 Mar 2020 12:58:48 GMT
server: UploadServer
etag: "6c3c9dec9383137845be0f0ea2cf1bf4"
x-goog-hash: crc32c=hL62rA==, md5=bDyd7JODE3hFvg8Oos8b9A==
x-goog-generation: 1583845128372242
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-goog-stored-content-length: 1701
accept-ranges: bytes
content-type: text/css
expires: Wed, 10 Mar 2021 13:04:58 GMT

GET
H2 200 polyfill.min.js Show response
polyfill.io/v3/ 72 B
555 B 22ms
7ms Script
text/javascript 2a04:4e42:400::621
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://polyfill.io/v3/polyfill.min.js?flags=gated&features=Intl

Requested by

Host: ired.team
URL: https://ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:400::621 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

aaecd144d2b8763b2fa5c91f09778294363cef363c10504205f4203922644d11

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

strict-transport-security: max-age=31536000; includeSubdomains; preload
content-encoding: br
x-content-type-options: nosniff
age: 1575555
normalized-user-agent: chrome/74.0.0
detected-user-agent: Chrome/74.0.3729
status: 200
request_came_from_shield: FRA
server-timing: HIT-CLUSTER, fastly;desc="Edge time";dur=1, HIT-CLUSTER, fastly;desc="Edge time";dur=1
content-length: 74
referrer-policy: origin-when-cross-origin
last-modified: Thu, 19 Mar 2020 17:46:14 GMT
date: Mon, 06 Apr 2020 23:34:59 GMT
vary: User-Agent, Accept-Encoding
access-control-allow-methods: GET,HEAD,OPTIONS
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, s-maxage=31536000, max-age=604800, stale-while-revalidate=604800, stale-if-error=604800
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 spaces%2F-LFEMnER3fywgFHoroYn%2Favatar.png
gblobscdn.gitbook.com/ 28 KB
29 KB 116ms
60ms Image
image/png 34.107.207.82
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://gblobscdn.gitbook.com/spaces%2F-LFEMnER3fywgFHoroYn%2Favatar.png?generation=1536436814766237&alt=media
Requested by: Host: ired.team
URL: https://ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.107.207.82 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 82.207.107.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: aee2771f5f57ecf568ffffd5c0d0fee81b7fb2b5540e10d856f2462abdbd5f92

Request headers

Referer: https://ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Mon, 09 Mar 2020 21:33:45 GMT
age: 2426474
status: 200
x-guploader-uploadid: AEnB2UrpqFhPka_IF_EIg3tElDucQpBBedEEuWF_fY6Hfp6dDwBbFKd2NRYYSbrLjpsEDpkBCjdIgPXTW51LGyAfkoS1ozMGcg
x-goog-storage-class: STANDARD
x-goog-metageneration: 3
x-goog-stored-content-encoding: identity
alt-svc: clear
content-length: 29066
last-modified: Sat, 08 Sep 2018 20:00:14 GMT
server: UploadServer
etag: "2965c5f978755802debc0291c5574853"
x-goog-hash: crc32c=ALxBKw==, md5=KWXF+Xh1WALevAKRxVdIUw==
x-goog-generation: 1536436814766237
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-goog-stored-content-length: 29066
x-goog-meta-firebasestoragedownloadtokens: 1910800b-eed5-42ea-b282-39d0660128fe
accept-ranges: bytes
content-type: image/png
expires: Tue, 09 Mar 2021 21:33:45 GMT

GET
H2 200 assets%2F-LFEMnER3fywgFHoroYn%2F-LYHcIL_R4k6YNEXjoex%2F-LYHcll2Cw7RXzll00Y7%2FScreenshot%20from%202019-02-09%2014-18-32.png
gblobscdn.gitbook.com/ 22 KB
22 KB 167ms
118ms Image
image/png 34.107.207.82
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://gblobscdn.gitbook.com/assets%2F-LFEMnER3fywgFHoroYn%2F-LYHcIL_R4k6YNEXjoex%2F-LYHcll2Cw7RXzll00Y7%2FScreenshot%20from%202019-02-09%2014-18-32.png?alt=media&token=db120148-d85d-4401-b8c8-8808844af82e
Requested by: Host: ired.team
URL: https://ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.107.207.82 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 82.207.107.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: fd6ed6532676b92d9ef04191bd606d815b885cdcc9f1acc4c75c67eacacb9bc3

Request headers

Referer: https://ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Sat, 04 Apr 2020 15:59:08 GMT
age: 200151
status: 200
x-guploader-uploadid: AEnB2UqsrXP6l5_xuCCsvMJdQ3cw04RuDAvVJ5h8ihAWToF-ZE_XfAuFmcHC5XQRexunVfJ3wBnI2E6ScXT6jhcbsYdlpQommw
x-goog-storage-class: STANDARD
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
content-disposition: inline; filename*=utf-8''Screenshot%20from%202019-02-09%2014-18-32.png
alt-svc: clear
content-length: 22424
last-modified: Sat, 09 Feb 2019 14:39:34 GMT
server: UploadServer
etag: "4acb1bda71b8909c495f56e5fcede96a"
x-goog-hash: crc32c=kgN2yg==, md5=Sssb2nG4kJxJX1bl/O3pag==
x-goog-generation: 1549723174315618
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-goog-stored-content-length: 22424
x-goog-meta-firebasestoragedownloadtokens: db120148-d85d-4401-b8c8-8808844af82e
accept-ranges: bytes
content-type: image/png
expires: Sun, 04 Apr 2021 15:59:08 GMT

GET
H2 200 assets%2F-LFEMnER3fywgFHoroYn%2F-LYHcIL_R4k6YNEXjoex%2F-LYHcnmhsrPaq84QCCXJ%2FScreenshot%20from%202019-02-09%2014-21-02.png
gblobscdn.gitbook.com/ 30 KB
31 KB 77ms
29ms Image
image/png 34.107.207.82
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://gblobscdn.gitbook.com/assets%2F-LFEMnER3fywgFHoroYn%2F-LYHcIL_R4k6YNEXjoex%2F-LYHcnmhsrPaq84QCCXJ%2FScreenshot%20from%202019-02-09%2014-21-02.png?alt=media&token=fd127c93-66ab-4d13-b4cc-f61645fbb55e
Requested by: Host: ired.team
URL: https://ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.107.207.82 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 82.207.107.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 03b0665e307caf691a7e91427ecd157e8037ef3aeb3e73faad928d67ffe55113

Request headers

Referer: https://ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Mon, 06 Apr 2020 15:45:55 GMT
age: 28144
status: 200
x-guploader-uploadid: AEnB2Upy2ANTLP2DZFrkuN9swgjxuWRTfruHVDAdeVpOWlPQiEf83T64XnN6_FvE3oU90doeRzxZfnkvejfMe4OQMZB4vXeZNVTaSqvecOO7ZjG0cfsuroA
x-goog-storage-class: STANDARD
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
content-disposition: inline; filename*=utf-8''Screenshot%20from%202019-02-09%2014-21-02.png
alt-svc: clear
content-length: 30696
last-modified: Sat, 09 Feb 2019 14:39:34 GMT
server: UploadServer
etag: "3231dc1793ab392f4969a166550dd56e"
x-goog-hash: crc32c=gffoKA==, md5=MjHcF5OrOS9JaaFmVQ3Vbg==
x-goog-generation: 1549723174151198
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-goog-stored-content-length: 30696
x-goog-meta-firebasestoragedownloadtokens: fd127c93-66ab-4d13-b4cc-f61645fbb55e
accept-ranges: bytes
content-type: image/png
expires: Tue, 06 Apr 2021 15:45:55 GMT

GET
H2 200 assets%2F-LFEMnER3fywgFHoroYn%2F-LYHcIL_R4k6YNEXjoex%2F-LYHcqSVg0P0r8dBLjpC%2FScreenshot%20from%202019-02-09%2014-21-09.png
gblobscdn.gitbook.com/ 37 KB
37 KB 158ms
110ms Image
image/png 34.107.207.82
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://gblobscdn.gitbook.com/assets%2F-LFEMnER3fywgFHoroYn%2F-LYHcIL_R4k6YNEXjoex%2F-LYHcqSVg0P0r8dBLjpC%2FScreenshot%20from%202019-02-09%2014-21-09.png?alt=media&token=0cb494ef-c05f-4b98-9450-9c40d3834c04
Requested by: Host: ired.team
URL: https://ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.107.207.82 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 82.207.107.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 136ce930cd83f459c9528efa1b255d028476ad4638e9f87eafe7ea6df2795521

Request headers

Referer: https://ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Mon, 06 Apr 2020 17:51:08 GMT
age: 20631
status: 200
x-guploader-uploadid: AEnB2UrpyicKsU89rZnFVAMdh2NScdg_PygvPBU21cjIn7Tifx2FcQTMfLayKVBUbaE_OSHTznForLPeFqXmKvNzHXt7a0G4wkuIgGxYPdMVlTjflp62ed4
x-goog-storage-class: STANDARD
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
content-disposition: inline; filename*=utf-8''Screenshot%20from%202019-02-09%2014-21-09.png
alt-svc: clear
content-length: 37928
last-modified: Sat, 09 Feb 2019 14:39:34 GMT
server: UploadServer
etag: "b460d65a660971a5a564b8e0583fcab4"
x-goog-hash: crc32c=9e2oyQ==, md5=tGDWWmYJcaWlZLjgWD/KtA==
x-goog-generation: 1549723174315835
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-goog-stored-content-length: 37928
x-goog-meta-firebasestoragedownloadtokens: 0cb494ef-c05f-4b98-9450-9c40d3834c04
accept-ranges: bytes
content-type: image/png
expires: Tue, 06 Apr 2021 17:51:08 GMT

GET
H2 200 assets%2F-LFEMnER3fywgFHoroYn%2F-LYHcIL_R4k6YNEXjoex%2F-LYHeE3F5dXK_ePCdQJH%2FScreenshot%20from%202019-02-09%2014-28-18.png
gblobscdn.gitbook.com/ 6 KB
6 KB 166ms
117ms Image
image/png 34.107.207.82
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://gblobscdn.gitbook.com/assets%2F-LFEMnER3fywgFHoroYn%2F-LYHcIL_R4k6YNEXjoex%2F-LYHeE3F5dXK_ePCdQJH%2FScreenshot%20from%202019-02-09%2014-28-18.png?alt=media&token=682c2b70-15cf-4243-897d-07a50dcb60ce
Requested by: Host: ired.team
URL: https://ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.107.207.82 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 82.207.107.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 3e8a9ea983c768e3924813f0f562c7a0eb02425e282d3d91e64ffd5c0c24e2d8

Request headers

Referer: https://ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Sat, 04 Apr 2020 15:59:08 GMT
age: 200151
status: 200
x-guploader-uploadid: AEnB2UpahIcT_7DViLyZnCVN_AXlg3eJwZ8Q0OXmhKgQfyA2HsT40U8k1gr0Y85J3lM9pSVA1oZZuNTDc8-ZsnSllOl1yLmxLA
x-goog-storage-class: STANDARD
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
content-disposition: inline; filename*=utf-8''Screenshot%20from%202019-02-09%2014-28-18.png
alt-svc: clear
content-length: 6335
last-modified: Sat, 09 Feb 2019 14:39:34 GMT
server: UploadServer
etag: "3bd8990e69e8b5900d577fcb72e07a74"
x-goog-hash: crc32c=k59gxw==, md5=O9iZDmnotZANV3/LcuB6dA==
x-goog-generation: 1549723174278644
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-goog-stored-content-length: 6335
x-goog-meta-firebasestoragedownloadtokens: 682c2b70-15cf-4243-897d-07a50dcb60ce
accept-ranges: bytes
content-type: image/png
expires: Sun, 04 Apr 2021 15:59:08 GMT

GET
H2 200 assets%2F-LFEMnER3fywgFHoroYn%2F-LYHcIL_R4k6YNEXjoex%2F-LYHeGTSUXeuBes1DUA8%2FScreenshot%20from%202019-02-09%2014-27-54.png
gblobscdn.gitbook.com/ 93 KB
93 KB 121ms
78ms Image
image/png 34.107.207.82
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://gblobscdn.gitbook.com/assets%2F-LFEMnER3fywgFHoroYn%2F-LYHcIL_R4k6YNEXjoex%2F-LYHeGTSUXeuBes1DUA8%2FScreenshot%20from%202019-02-09%2014-27-54.png?alt=media&token=69793e54-eccd-4592-9c37-dd3953c91345
Requested by: Host: ired.team
URL: https://ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.107.207.82 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 82.207.107.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 34d111f20960b8fbe1ebf0be28b3a67ae36c01e0dfd7a22ab3ebdfda3a40dbfc

Request headers

Referer: https://ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Sat, 04 Apr 2020 15:59:08 GMT
age: 200151
status: 200
x-guploader-uploadid: AEnB2UpguReonVXUsaskBkumf5ruhGRJJSOa7mG7_d615TEUUs0JmNNgm7P7eWB_B2EAKlo3vUmZhWnVxXI4stzt4PlZsF-dPw
x-goog-storage-class: STANDARD
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
content-disposition: inline; filename*=utf-8''Screenshot%20from%202019-02-09%2014-27-54.png
alt-svc: clear
content-length: 94853
last-modified: Sat, 09 Feb 2019 14:39:34 GMT
server: UploadServer
etag: "44ed3e6f94392a62fd069e1273546e2d"
x-goog-hash: crc32c=z8GiyQ==, md5=RO0+b5Q5KmL9Bp4Sc1RuLQ==
x-goog-generation: 1549723174933629
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-goog-stored-content-length: 94853
x-goog-meta-firebasestoragedownloadtokens: 69793e54-eccd-4592-9c37-dd3953c91345
accept-ranges: bytes
content-type: image/png
expires: Sun, 04 Apr 2021 15:59:08 GMT

GET
H2 200 assets%2F-LFEMnER3fywgFHoroYn%2F-LYHn7bhLyxbOjA7EU9M%2F-LYHo8SqVwHexwGHFRIn%2FScreenshot%20from%202019-02-09%2015-11-36.png
gblobscdn.gitbook.com/ 47 KB
47 KB 93ms
92ms Image
image/png 34.107.207.82
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://gblobscdn.gitbook.com/assets%2F-LFEMnER3fywgFHoroYn%2F-LYHn7bhLyxbOjA7EU9M%2F-LYHo8SqVwHexwGHFRIn%2FScreenshot%20from%202019-02-09%2015-11-36.png?alt=media&token=82b495d7-34fe-41c1-a296-8f802dbb660f
Requested by: Host: ired.team
URL: https://ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.107.207.82 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 82.207.107.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: eb470d0e44fc9ea031dff6615f4dcf8f460cc71c4603dbe9abd583cc3bb034cf

Request headers

Referer: https://ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Mon, 06 Apr 2020 17:51:08 GMT
age: 20631
status: 200
x-guploader-uploadid: AEnB2UpA7RiYpExJT0cYaLfxBZ0aCwQu9x1JAZsIIPbN1KhYGO4gj-rm-otIQDfdm6i8ZBjXkUH-rBc5FAUPWGBVwLgh1zHKvFXSEF1vhjvyIuyYRRK5C8Q
x-goog-storage-class: STANDARD
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
content-disposition: inline; filename*=utf-8''Screenshot%20from%202019-02-09%2015-11-36.png
alt-svc: clear
content-length: 47701
last-modified: Sat, 09 Feb 2019 15:13:51 GMT
server: UploadServer
etag: "d86aebfc9eb6e46dc89fbc8e76a5f171"
x-goog-hash: crc32c=30HShA==, md5=2Grr/J625G3In7yOdqXxcQ==
x-goog-generation: 1549725231705609
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-goog-stored-content-length: 47701
x-goog-meta-firebasestoragedownloadtokens: 82b495d7-34fe-41c1-a296-8f802dbb660f
accept-ranges: bytes
content-type: image/png
expires: Tue, 06 Apr 2021 17:51:08 GMT

GET
H2 200 assets%2F-LFEMnER3fywgFHoroYn%2F-LYHcIL_R4k6YNEXjoex%2F-LYHfiPA13UOQiYsWHVT%2FScreenshot%20from%202019-02-09%2014-34-44.png
gblobscdn.gitbook.com/ 86 KB
87 KB 100ms
100ms Image
image/png 34.107.207.82
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://gblobscdn.gitbook.com/assets%2F-LFEMnER3fywgFHoroYn%2F-LYHcIL_R4k6YNEXjoex%2F-LYHfiPA13UOQiYsWHVT%2FScreenshot%20from%202019-02-09%2014-34-44.png?alt=media&token=1b755cd8-e2d9-45e4-9b25-72f58955065c
Requested by: Host: ired.team
URL: https://ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.107.207.82 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 82.207.107.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 8beb5465b2abd6a7b77922b8ee2db26b06cac44607544aa47a07aa5501158969

Request headers

Referer: https://ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Sat, 04 Apr 2020 15:59:08 GMT
age: 200151
status: 200
x-guploader-uploadid: AEnB2Uo-AyBdjZiKjyuRjbkcC-pweMw7yNQ7B1cH88S7ijeKu6vWUrh8jGu6Du9q2aOtUNI-Xw8EaJK-N1n1LkbTC0wqZp30Zw
x-goog-storage-class: STANDARD
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
content-disposition: inline; filename*=utf-8''Screenshot%20from%202019-02-09%2014-34-44.png
alt-svc: clear
content-length: 88354
last-modified: Sat, 09 Feb 2019 14:39:34 GMT
server: UploadServer
etag: "c61020e42bbd137a5a629ad410262cf7"
x-goog-hash: crc32c=LOeygg==, md5=xhAg5Cu9E3paYprUECYs9w==
x-goog-generation: 1549723174810591
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-goog-stored-content-length: 88354
x-goog-meta-firebasestoragedownloadtokens: 1b755cd8-e2d9-45e4-9b25-72f58955065c
accept-ranges: bytes
content-type: image/png
expires: Sun, 04 Apr 2021 15:59:08 GMT

GET
H2 200 photo.jpg
lh5.googleusercontent.com/-BT5DyX_LUys/AAAAAAAAAAI/AAAAAAAAAF4/wkmG-hKpMQk/ 7 KB
7 KB 21ms
7ms Image
image/jpeg 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh5.googleusercontent.com/-BT5DyX_LUys/AAAAAAAAAAI/AAAAAAAAAF4/wkmG-hKpMQk/photo.jpg

Requested by

Host: ired.team
URL: https://ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

3e46dc2084ab2945b5af16a2d88abcd6fa7e8aa5ef5a43fc6c83ce561b6c9577

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Mon, 06 Apr 2020 21:55:45 GMT
x-content-type-options: nosniff
age: 5954
status: 200
content-disposition: inline;filename=""
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 6707
x-xss-protection: 0
server: fife
etag: "v5e"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Sun, 05 Apr 2020 07:36:29 GMT

GET
H2 200 email-decode.min.js Show response
ired.team/cdn-cgi/scripts/5c5dd728/cloudflare-static/ 1 KB
833 B 10ms
9ms Script
application/javascript 2606:4700:3030::681f:5ab4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ired.team/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js

Requested by

Host: ired.team
URL: https://ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3030::681f:5ab4 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Mon, 06 Apr 2020 23:34:59 GMT
content-encoding: gzip
vary: Accept-Encoding
last-modified: Thu, 02 Apr 2020 11:45:47 GMT
server: cloudflare
etag: W/"5e85d06b-4d7"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
content-type: application/javascript
status: 200
cache-control: max-age=172800, public
cf-ray: 57ff529fad2bd6c5-FRA
expires: Wed, 08 Apr 2020 23:34:59 GMT

GET
H2 200 111.a59367d0.js Show response
gstatic.gitbook.com/js/ 3 MB
3 MB 85ms
30ms Script
application/javascript 34.107.189.150
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://gstatic.gitbook.com/js/111.a59367d0.js
Requested by: Host: ired.team
URL: https://ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.107.189.150 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 150.189.107.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 265ee4e0a83c54da9d60812c74ed9d5854c8a8454834d13b6859cf8e898bdef6

Request headers

Referer: https://ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
Origin: https://ired.team
Sec-Fetch-Dest: script
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 03 Apr 2020 20:41:35 GMT
age: 269604
status: 200
x-guploader-uploadid: AEnB2UrYY5-k0khk34ytjc9i_EFx8yiXcZEtVTCRnK_3sJsRcGhnXsWMhnz6254OYF3n221GtSpb8hZYpYj5VHRkBf8h6MgKRQ
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: clear
content-length: 3382937
last-modified: Fri, 03 Apr 2020 20:33:48 GMT
server: UploadServer
etag: "37c141e84811cf32463f13b34b1747c1"
x-goog-hash: crc32c=9p3PzQ==, md5=N8FB6EgRzzJGPxOzSxdHwQ==
x-goog-generation: 1585946028314739
access-control-allow-origin: *
access-control-expose-headers: Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
cache-control: public, max-age=31536000
x-goog-stored-content-length: 3382937
accept-ranges: bytes
content-type: application/javascript
expires: Sat, 03 Apr 2021 20:41:35 GMT

GET
H/1.1 200
OK Mimikatz-Attacks-1.jpg
blog.stealthbits.com/wp-content/uploads/2017/07/ 131 KB
132 KB 391ms
123ms Image
image/jpeg 72.52.131.85
LIQUIDWEB

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.stealthbits.com/wp-content/uploads/2017/07/Mimikatz-Attacks-1.jpg

Requested by

Host: ired.team
URL: https://ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

72.52.131.85 Lansing, United States, ASN32244 (LIQUIDWEB, US),

Reverse DNS

Software

Apache /

Resource Hash

a4673c2c7bd5a4fdfd2c6290c1636bc84efa8cef2ada3843c55868c9cf9da0e4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Mon, 06 Apr 2020 23:35:00 GMT
Last-Modified: Tue, 11 Jul 2017 17:05:59 GMT
Server: Apache
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000
Content-Type: image/jpeg
Cache-Control: max-age=10368000
Connection: keep-alive, Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=2, max=150
Content-Length: 134298
Expires: max-age=A10368000, public

GET
H2 200 0*Icen2GYXvhyUz7Av.PNG
miro.medium.com/max/1200/ 74 KB
75 KB 46ms
26ms Image
image/png 2606:4700::6810:7591
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/max/1200/0*Icen2GYXvhyUz7Av.PNG

Requested by

Host: ired.team
URL: https://ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7591 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

e3da858ea17f1a638cb4fb0d0edbb6328ce601bf698ef58dad130f3b97efccc5

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Mon, 06 Apr 2020 23:34:59 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 2512731
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3209-f49543a
status: 200
alt-svc: h3-27=":443"; ma=86400, h3-25=":443"; ma=86400, h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
content-length: 75904
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/png
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=2592000
accept-ranges: bytes
cf-ray: 57ff52a08db5dfc7-FRA
expires: Wed, 06 May 2020 23:34:59 GMT

GET
H2 200 f4fa50c4003f87e7dc10459e500933c3.woff
gstatic.gitbook.com/fonts/ 92 KB
93 KB 457ms
457ms Font
font/woff 34.107.189.150
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://gstatic.gitbook.com/fonts/f4fa50c4003f87e7dc10459e500933c3.woff
Requested by: Host: ired.team
URL: https://ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.107.189.150 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 150.189.107.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 3e692de9565d90dd947a080d4d10cee72a83447ba053e08fdcac457d7197128a

Request headers

Referer: https://ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
Origin: https://ired.team
Sec-Fetch-Dest: font
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 10 Mar 2020 13:04:58 GMT
age: 2370601
status: 200
x-guploader-uploadid: AEnB2UpI_BqTAZIOqM1zQJlYUz0lXS0y6CCvAisuh6orhBvUiwbkdq2I4d0l9u_a7ojhHngwXtxqFpd0RBCd8usJCH_hf3YGqwqRkumAONewcAEgD110wjc
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: clear
content-length: 94368
last-modified: Tue, 10 Mar 2020 12:58:48 GMT
server: UploadServer
etag: "f4fa50c4003f87e7dc10459e500933c3"
x-goog-hash: crc32c=FUjfEA==, md5=9PpQxAA/h+fcEEWeUAkzww==
x-goog-generation: 1583845128534922
access-control-allow-origin: *
access-control-expose-headers: Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
cache-control: public, max-age=31536000
x-goog-stored-content-length: 94368
accept-ranges: bytes
content-type: font/woff
expires: Wed, 10 Mar 2021 13:04:58 GMT

GET
H2 200 72e37e5bf95a8dba938c78b1d7d91253.woff
gstatic.gitbook.com/fonts/ 92 KB
92 KB 457ms
457ms Font
font/woff 34.107.189.150
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://gstatic.gitbook.com/fonts/72e37e5bf95a8dba938c78b1d7d91253.woff
Requested by: Host: ired.team
URL: https://ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.107.189.150 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 150.189.107.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: a18af7799b7d241fe5d00645492ccedcad39815e9f4125b7e3e90b18a1b77405

Request headers

Referer: https://ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
Origin: https://ired.team
Sec-Fetch-Dest: font
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 10 Mar 2020 13:04:58 GMT
age: 2370601
status: 200
x-guploader-uploadid: AEnB2UrrToZ8KtegJ75zLiPdmAHW0fh7OS5nNA7n8RsxUWN1rCy5hDee-93hQaO_02Ofau_9--zYW6AGgX6X9fau5qjYFRSYfg
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: clear
content-length: 94040
last-modified: Tue, 10 Mar 2020 12:58:48 GMT
server: UploadServer
etag: "72e37e5bf95a8dba938c78b1d7d91253"
x-goog-hash: crc32c=TBIniA==, md5=cuN+W/lajbqTjHix19kSUw==
x-goog-generation: 1583845128570709
access-control-allow-origin: *
access-control-expose-headers: Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
cache-control: public, max-age=31536000
x-goog-stored-content-length: 94040
accept-ranges: bytes
content-type: font/woff
expires: Wed, 10 Mar 2021 13:04:58 GMT

GET
H2 200 fc3d4b35e4d07d4e0485cc2db0e57c77.woff
gstatic.gitbook.com/fonts/ 92 KB
92 KB 455ms
455ms Font
font/woff 34.107.189.150
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://gstatic.gitbook.com/fonts/fc3d4b35e4d07d4e0485cc2db0e57c77.woff
Requested by: Host: ired.team
URL: https://ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.107.189.150 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 150.189.107.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: b87e90677bdbc3c6bc296a368f57b2d72783c1a7c6e8e9325cd1645c18039cf2

Request headers

Referer: https://ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
Origin: https://ired.team
Sec-Fetch-Dest: font
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 17 Mar 2020 12:20:25 GMT
age: 1768474
status: 200
x-guploader-uploadid: AEnB2UrBbloUPPs9L2syFt3NnztAD2wT0wcu3YtJTN-Sogy-yxFMv83IVxKiVNTJskzXgEHSI5YF7KNYgezKbnMCdgGItJgx2A
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: clear
content-length: 93788
last-modified: Thu, 12 Mar 2020 14:53:23 GMT
server: UploadServer
etag: "fc3d4b35e4d07d4e0485cc2db0e57c77"
x-goog-hash: crc32c=7TN+QQ==, md5=/D1LNeTQfU4EhcwtsOV8dw==
x-goog-generation: 1584024803933768
access-control-allow-origin: *
access-control-expose-headers: Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
cache-control: public, max-age=31536000
x-goog-stored-content-length: 93788
accept-ranges: bytes
content-type: font/woff
expires: Wed, 17 Mar 2021 12:20:25 GMT

GET
H2 200 HI_XiYsKILxRpg3hIP6sJ7fM7PqtzsjDs-cq7Gq0DA.woff2
fonts.gstatic.com/s/sourcecodepro/v11/ 11 KB
11 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:814::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcecodepro/v11/HI_XiYsKILxRpg3hIP6sJ7fM7PqtzsjDs-cq7Gq0DA.woff2

Requested by

Host: ired.team
URL: https://ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:814::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

59fd4f207936792ab9910baa7df5f1f7bff899e35e0428df34ab9a1319184052

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/css?family=Source+Code+Pro:500
Origin: https://ired.team
Sec-Fetch-Dest: font
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 10 Mar 2020 20:41:46 GMT
x-content-type-options: nosniff
last-modified: Thu, 22 Aug 2019 20:45:13 GMT
server: sffe
age: 2343193
content-type: font/woff2
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-origin: *
content-length: 11232
x-xss-protection: 0
expires: Wed, 10 Mar 2021 20:41:46 GMT

GET
H2 200 logger.min.js Show response
cdn.lr-ingest.io/ 573 KB
105 KB 49ms
15ms Script
text/javascript 2606:4700:e2::ac40:8b14
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.lr-ingest.io/logger.min.js

Requested by

Host: gstatic.gitbook.com
URL: https://gstatic.gitbook.com/js/111.a59367d0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:e2::ac40:8b14 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e936101b48971cd50155204875f9d2d9e8d9e6ca6ec30d9ac49e239139dc60fc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926

Request headers

Referer: https://ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Mon, 06 Apr 2020 23:35:00 GMT
content-encoding: br
cf-cache-status: HIT
age: 147
x-cache: MISS
status: 200
strict-transport-security: max-age=31556926
x-served-by: cache-fra19166-FRA
last-modified: Mon, 06 Apr 2020 18:01:50 GMT
server: cloudflare
x-timer: S1586196388.055618,VS0,VE728
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: x-fh-requested-host, accept-encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=14400
cf-ray: 57ff52a419851f25-FRA
x-cache-hits: 0

GET
H2 200 __session Show response
app.gitbook.com/ 52 B
818 B 330ms
303ms Fetch
application/json 2606:4700:20::681a:7cd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://app.gitbook.com/__session?proposed=181b9ae0-6d6a-425e-b0b6-cc4622187b77R
Requested by: Host: gstatic.gitbook.com
URL: https://gstatic.gitbook.com/js/111.a59367d0.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:7cd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 0121a107ac97882ea9528f93b212a198ef106cbf6a3ab693a2743061542577f3

Request headers

Referer: https://ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
Origin: https://ired.team
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 06 Apr 2020 23:35:01 GMT
via: no cache
cf-cache-status: DYNAMIC
x-magic-hash: fe8acf360fc945d5654a995839cbb65450d75442fd20a1058472da0c89f0431f
x-powered-by: Express
x-cache: MISS
x-release: gitbook-28427-6.15.11
status: 200
content-encoding: br
server: cloudflare
etag: W/"34-cU0rsp6/Yfqraeb00E98OPnk8w4"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Origin, Accept-Encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: https://ired.team
x-cloud-trace-context: 752208d66d903394c9c25caa4dd27c20/6622972695697322065;o=1, 752208d66d903394c9c25caa4dd27c20
cache-control: private
access-control-allow-credentials: true
function-execution-id: s5j8rut64sdg
cf-ray: 57ff52a618381f11-FRA
expires: Mon, 06 Apr 2020 23:35:01 GMT

GET
BLOB 200
OK 904b184d-65b2-4dd7-aedb-9ffafb195a6f
https://ired.team/ 397 KB
0 Other
text/plain

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://ired.team/904b184d-65b2-4dd7-aedb-9ffafb195a6f
Requested by: Host: cdn.lr-ingest.io
URL: https://cdn.lr-ingest.io/logger.min.js
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e4e0e2248cf8d33abc677b8c37b5e50d22422040d29744b3e3fa89c91d75103b

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: worker

Response headers

Content-Length: 406806

GET
H2 200 spaces%2F-LFEMnER3fywgFHoroYn%2Favatar.png
gblobscdn.gitbook.com/ 28 KB
28 KB 31ms
31ms Image
image/png 34.107.207.82
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://gblobscdn.gitbook.com/spaces%2F-LFEMnER3fywgFHoroYn%2Favatar.png?generation=1536436814766237&alt=media
Requested by: Host: gstatic.gitbook.com
URL: https://gstatic.gitbook.com/js/111.a59367d0.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.107.207.82 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 82.207.107.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: aee2771f5f57ecf568ffffd5c0d0fee81b7fb2b5540e10d856f2462abdbd5f92

Request headers

Referer: https://ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Mon, 09 Mar 2020 21:33:45 GMT
age: 2426476
status: 200
x-guploader-uploadid: AEnB2UrpqFhPka_IF_EIg3tElDucQpBBedEEuWF_fY6Hfp6dDwBbFKd2NRYYSbrLjpsEDpkBCjdIgPXTW51LGyAfkoS1ozMGcg
x-goog-storage-class: STANDARD
x-goog-metageneration: 3
x-goog-stored-content-encoding: identity
alt-svc: clear
content-length: 29066
last-modified: Sat, 08 Sep 2018 20:00:14 GMT
server: UploadServer
etag: "2965c5f978755802debc0291c5574853"
x-goog-hash: crc32c=ALxBKw==, md5=KWXF+Xh1WALevAKRxVdIUw==
x-goog-generation: 1536436814766237
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-goog-stored-content-length: 29066
x-goog-meta-firebasestoragedownloadtokens: 1910800b-eed5-42ea-b282-39d0660128fe
accept-ranges: bytes
content-type: image/png
expires: Tue, 09 Mar 2021 21:33:45 GMT

GET
H/1.1 200
OK .lp Show response
gitbook-28427.firebaseio.com/ Frame 3911 422 B
664 B 359ms
118ms Script
application/javascript 2600:1901:0:94b6::
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://gitbook-28427.firebaseio.com/.lp?start=t&ser=3082479&cb=1&v=5

Requested by

Host: gstatic.gitbook.com
URL: https://gstatic.gitbook.com/js/111.a59367d0.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305

Server

2600:1901:0:94b6:: , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

nginx /

Resource Hash

5e998f881a9ca86ceb2d55ab78a9612004b4305d1f7972858ccf495e5db4be25

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Referer: https://ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Date: Mon, 06 Apr 2020 23:35:01 GMT
Server: nginx
Connection: keep-alive
Content-Length: 422
Strict-Transport-Security: max-age=31556926; includeSubDomains; preload
Content-Type: application/javascript; charset=utf-8

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://gblobscdn.gitbook.com/assets%2F-LFEMnER3fywgFHoroYn%2F-LYHcIL_R4k6YNEXjoex%2F-LYHcll2Cw7RXzll00Y7%2FScreenshot%20from%202019-02-09%2014-18-32.png?alt=media&token=db120148-d85d-4401-b8c8-8808844af82e
Requested by: Host: gstatic.gitbook.com
URL: https://gstatic.gitbook.com/js/111.a59367d0.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.107.207.82 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 82.207.107.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: fd6ed6532676b92d9ef04191bd606d815b885cdcc9f1acc4c75c67eacacb9bc3

Request headers

Referer: https://ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Sat, 04 Apr 2020 15:59:08 GMT
age: 200153
status: 200
x-guploader-uploadid: AEnB2UqsrXP6l5_xuCCsvMJdQ3cw04RuDAvVJ5h8ihAWToF-ZE_XfAuFmcHC5XQRexunVfJ3wBnI2E6ScXT6jhcbsYdlpQommw
x-goog-storage-class: STANDARD
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
content-disposition: inline; filename*=utf-8''Screenshot%20from%202019-02-09%2014-18-32.png
alt-svc: clear
content-length: 22424
last-modified: Sat, 09 Feb 2019 14:39:34 GMT
server: UploadServer
etag: "4acb1bda71b8909c495f56e5fcede96a"
x-goog-hash: crc32c=kgN2yg==, md5=Sssb2nG4kJxJX1bl/O3pag==
x-goog-generation: 1549723174315618
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-goog-stored-content-length: 22424
x-goog-meta-firebasestoragedownloadtokens: db120148-d85d-4401-b8c8-8808844af82e
accept-ranges: bytes
content-type: image/png
expires: Sun, 04 Apr 2021 15:59:08 GMT

GET
H2 200 6c3c9dec9383137845be0f0ea2cf1bf4.css
gstatic.gitbook.com/css/ 2 KB
2 KB 27ms
27ms Stylesheet
text/css 34.107.189.150
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://gstatic.gitbook.com/css/6c3c9dec9383137845be0f0ea2cf1bf4.css
Requested by: Host: gstatic.gitbook.com
URL: https://gstatic.gitbook.com/js/111.a59367d0.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.107.189.150 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 150.189.107.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: f008dc0769c2e3c28c21859c9f0f18a05aeef49930affa9cc6a8afb8104355fb

Request headers

Referer: https://ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

date: Tue, 10 Mar 2020 13:04:58 GMT
age: 2370603
status: 200
x-guploader-uploadid: AEnB2Uo0hVdryFl9E0ecDLqkfUR48bc9KjdBeEb1-ODaXm0Ssu7Ae736fPKDUZnasyGp1ncBZgGLrOsKy8fxRjRu8g-_8dNPNw
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: clear
content-length: 1701
last-modified: Tue, 10 Mar 2020 12:58:48 GMT
server: UploadServer
etag: "6c3c9dec9383137845be0f0ea2cf1bf4"
x-goog-hash: crc32c=hL62rA==, md5=bDyd7JODE3hFvg8Oos8b9A==
x-goog-generation: 1583845128372242
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-goog-stored-content-length: 1701
accept-ranges: bytes
content-type: text/css
expires: Wed, 10 Mar 2021 13:04:58 GMT

GET
H2 200 assets%2F-LFEMnER3fywgFHoroYn%2F-LYHcIL_R4k6YNEXjoex%2F-LYHcnmhsrPaq84QCCXJ%2FScreenshot%20from%202019-02-09%2014-21-02.png
gblobscdn.gitbook.com/ 30 KB
30 KB 26ms
26ms Image
image/png 34.107.207.82
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://gblobscdn.gitbook.com/assets%2F-LFEMnER3fywgFHoroYn%2F-LYHcIL_R4k6YNEXjoex%2F-LYHcnmhsrPaq84QCCXJ%2FScreenshot%20from%202019-02-09%2014-21-02.png?alt=media&token=fd127c93-66ab-4d13-b4cc-f61645fbb55e
Requested by: Host: gstatic.gitbook.com
URL: https://gstatic.gitbook.com/js/111.a59367d0.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.107.207.82 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 82.207.107.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 03b0665e307caf691a7e91427ecd157e8037ef3aeb3e73faad928d67ffe55113

Request headers

Referer: https://ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Mon, 06 Apr 2020 15:45:55 GMT
age: 28146
status: 200
x-guploader-uploadid: AEnB2Upy2ANTLP2DZFrkuN9swgjxuWRTfruHVDAdeVpOWlPQiEf83T64XnN6_FvE3oU90doeRzxZfnkvejfMe4OQMZB4vXeZNVTaSqvecOO7ZjG0cfsuroA
x-goog-storage-class: STANDARD
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
content-disposition: inline; filename*=utf-8''Screenshot%20from%202019-02-09%2014-21-02.png
alt-svc: clear
content-length: 30696
last-modified: Sat, 09 Feb 2019 14:39:34 GMT
server: UploadServer
etag: "3231dc1793ab392f4969a166550dd56e"
x-goog-hash: crc32c=gffoKA==, md5=MjHcF5OrOS9JaaFmVQ3Vbg==
x-goog-generation: 1549723174151198
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-goog-stored-content-length: 30696
x-goog-meta-firebasestoragedownloadtokens: fd127c93-66ab-4d13-b4cc-f61645fbb55e
accept-ranges: bytes
content-type: image/png
expires: Tue, 06 Apr 2021 15:45:55 GMT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://gblobscdn.gitbook.com/assets%2F-LFEMnER3fywgFHoroYn%2F-LYHcIL_R4k6YNEXjoex%2F-LYHcqSVg0P0r8dBLjpC%2FScreenshot%20from%202019-02-09%2014-21-09.png?alt=media&token=0cb494ef-c05f-4b98-9450-9c40d3834c04
Requested by: Host: gstatic.gitbook.com
URL: https://gstatic.gitbook.com/js/111.a59367d0.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.107.207.82 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 82.207.107.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 136ce930cd83f459c9528efa1b255d028476ad4638e9f87eafe7ea6df2795521

Request headers

Referer: https://ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Mon, 06 Apr 2020 17:51:08 GMT
age: 20633
status: 200
x-guploader-uploadid: AEnB2UrpyicKsU89rZnFVAMdh2NScdg_PygvPBU21cjIn7Tifx2FcQTMfLayKVBUbaE_OSHTznForLPeFqXmKvNzHXt7a0G4wkuIgGxYPdMVlTjflp62ed4
x-goog-storage-class: STANDARD
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
content-disposition: inline; filename*=utf-8''Screenshot%20from%202019-02-09%2014-21-09.png
alt-svc: clear
content-length: 37928
last-modified: Sat, 09 Feb 2019 14:39:34 GMT
server: UploadServer
etag: "b460d65a660971a5a564b8e0583fcab4"
x-goog-hash: crc32c=9e2oyQ==, md5=tGDWWmYJcaWlZLjgWD/KtA==
x-goog-generation: 1549723174315835
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-goog-stored-content-length: 37928
x-goog-meta-firebasestoragedownloadtokens: 0cb494ef-c05f-4b98-9450-9c40d3834c04
accept-ranges: bytes
content-type: image/png
expires: Tue, 06 Apr 2021 17:51:08 GMT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://gblobscdn.gitbook.com/assets%2F-LFEMnER3fywgFHoroYn%2F-LYHcIL_R4k6YNEXjoex%2F-LYHeE3F5dXK_ePCdQJH%2FScreenshot%20from%202019-02-09%2014-28-18.png?alt=media&token=682c2b70-15cf-4243-897d-07a50dcb60ce
Requested by: Host: gstatic.gitbook.com
URL: https://gstatic.gitbook.com/js/111.a59367d0.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.107.207.82 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 82.207.107.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 3e8a9ea983c768e3924813f0f562c7a0eb02425e282d3d91e64ffd5c0c24e2d8

Request headers

Referer: https://ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Sat, 04 Apr 2020 15:59:08 GMT
age: 200153
status: 200
x-guploader-uploadid: AEnB2UpahIcT_7DViLyZnCVN_AXlg3eJwZ8Q0OXmhKgQfyA2HsT40U8k1gr0Y85J3lM9pSVA1oZZuNTDc8-ZsnSllOl1yLmxLA
x-goog-storage-class: STANDARD
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
content-disposition: inline; filename*=utf-8''Screenshot%20from%202019-02-09%2014-28-18.png
alt-svc: clear
content-length: 6335
last-modified: Sat, 09 Feb 2019 14:39:34 GMT
server: UploadServer
etag: "3bd8990e69e8b5900d577fcb72e07a74"
x-goog-hash: crc32c=k59gxw==, md5=O9iZDmnotZANV3/LcuB6dA==
x-goog-generation: 1549723174278644
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-goog-stored-content-length: 6335
x-goog-meta-firebasestoragedownloadtokens: 682c2b70-15cf-4243-897d-07a50dcb60ce
accept-ranges: bytes
content-type: image/png
expires: Sun, 04 Apr 2021 15:59:08 GMT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://gblobscdn.gitbook.com/assets%2F-LFEMnER3fywgFHoroYn%2F-LYHcIL_R4k6YNEXjoex%2F-LYHeGTSUXeuBes1DUA8%2FScreenshot%20from%202019-02-09%2014-27-54.png?alt=media&token=69793e54-eccd-4592-9c37-dd3953c91345
Requested by: Host: gstatic.gitbook.com
URL: https://gstatic.gitbook.com/js/111.a59367d0.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.107.207.82 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 82.207.107.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 34d111f20960b8fbe1ebf0be28b3a67ae36c01e0dfd7a22ab3ebdfda3a40dbfc

Request headers

Referer: https://ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Sat, 04 Apr 2020 15:59:08 GMT
age: 200153
status: 200
x-guploader-uploadid: AEnB2UpguReonVXUsaskBkumf5ruhGRJJSOa7mG7_d615TEUUs0JmNNgm7P7eWB_B2EAKlo3vUmZhWnVxXI4stzt4PlZsF-dPw
x-goog-storage-class: STANDARD
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
content-disposition: inline; filename*=utf-8''Screenshot%20from%202019-02-09%2014-27-54.png
alt-svc: clear
content-length: 94853
last-modified: Sat, 09 Feb 2019 14:39:34 GMT
server: UploadServer
etag: "44ed3e6f94392a62fd069e1273546e2d"
x-goog-hash: crc32c=z8GiyQ==, md5=RO0+b5Q5KmL9Bp4Sc1RuLQ==
x-goog-generation: 1549723174933629
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-goog-stored-content-length: 94853
x-goog-meta-firebasestoragedownloadtokens: 69793e54-eccd-4592-9c37-dd3953c91345
accept-ranges: bytes
content-type: image/png
expires: Sun, 04 Apr 2021 15:59:08 GMT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://gblobscdn.gitbook.com/assets%2F-LFEMnER3fywgFHoroYn%2F-LYHn7bhLyxbOjA7EU9M%2F-LYHo8SqVwHexwGHFRIn%2FScreenshot%20from%202019-02-09%2015-11-36.png?alt=media&token=82b495d7-34fe-41c1-a296-8f802dbb660f
Requested by: Host: gstatic.gitbook.com
URL: https://gstatic.gitbook.com/js/111.a59367d0.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.107.207.82 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 82.207.107.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: eb470d0e44fc9ea031dff6615f4dcf8f460cc71c4603dbe9abd583cc3bb034cf

Request headers

Referer: https://ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Mon, 06 Apr 2020 17:51:08 GMT
age: 20633
status: 200
x-guploader-uploadid: AEnB2UpA7RiYpExJT0cYaLfxBZ0aCwQu9x1JAZsIIPbN1KhYGO4gj-rm-otIQDfdm6i8ZBjXkUH-rBc5FAUPWGBVwLgh1zHKvFXSEF1vhjvyIuyYRRK5C8Q
x-goog-storage-class: STANDARD
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
content-disposition: inline; filename*=utf-8''Screenshot%20from%202019-02-09%2015-11-36.png
alt-svc: clear
content-length: 47701
last-modified: Sat, 09 Feb 2019 15:13:51 GMT
server: UploadServer
etag: "d86aebfc9eb6e46dc89fbc8e76a5f171"
x-goog-hash: crc32c=30HShA==, md5=2Grr/J625G3In7yOdqXxcQ==
x-goog-generation: 1549725231705609
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-goog-stored-content-length: 47701
x-goog-meta-firebasestoragedownloadtokens: 82b495d7-34fe-41c1-a296-8f802dbb660f
accept-ranges: bytes
content-type: image/png
expires: Tue, 06 Apr 2021 17:51:08 GMT

GET
H2 200 assets%2F-LFEMnER3fywgFHoroYn%2F-LYHcIL_R4k6YNEXjoex%2F-LYHfiPA13UOQiYsWHVT%2FScreenshot%20from%202019-02-09%2014-34-44.png
gblobscdn.gitbook.com/ 86 KB
86 KB 26ms
26ms Image
image/png 34.107.207.82
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://gblobscdn.gitbook.com/assets%2F-LFEMnER3fywgFHoroYn%2F-LYHcIL_R4k6YNEXjoex%2F-LYHfiPA13UOQiYsWHVT%2FScreenshot%20from%202019-02-09%2014-34-44.png?alt=media&token=1b755cd8-e2d9-45e4-9b25-72f58955065c
Requested by: Host: gstatic.gitbook.com
URL: https://gstatic.gitbook.com/js/111.a59367d0.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.107.207.82 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 82.207.107.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 8beb5465b2abd6a7b77922b8ee2db26b06cac44607544aa47a07aa5501158969

Request headers

Referer: https://ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Sat, 04 Apr 2020 15:59:08 GMT
age: 200153
status: 200
x-guploader-uploadid: AEnB2Uo-AyBdjZiKjyuRjbkcC-pweMw7yNQ7B1cH88S7ijeKu6vWUrh8jGu6Du9q2aOtUNI-Xw8EaJK-N1n1LkbTC0wqZp30Zw
x-goog-storage-class: STANDARD
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
content-disposition: inline; filename*=utf-8''Screenshot%20from%202019-02-09%2014-34-44.png
alt-svc: clear
content-length: 88354
last-modified: Sat, 09 Feb 2019 14:39:34 GMT
server: UploadServer
etag: "c61020e42bbd137a5a629ad410262cf7"
x-goog-hash: crc32c=LOeygg==, md5=xhAg5Cu9E3paYprUECYs9w==
x-goog-generation: 1549723174810591
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-goog-stored-content-length: 88354
x-goog-meta-firebasestoragedownloadtokens: 1b755cd8-e2d9-45e4-9b25-72f58955065c
accept-ranges: bytes
content-type: image/png
expires: Sun, 04 Apr 2021 15:59:08 GMT

GET
H2 200 photo.jpg
lh5.googleusercontent.com/-BT5DyX_LUys/AAAAAAAAAAI/AAAAAAAAAF4/wkmG-hKpMQk/ 7 KB
7 KB 6ms
6ms Image
image/jpeg 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh5.googleusercontent.com/-BT5DyX_LUys/AAAAAAAAAAI/AAAAAAAAAF4/wkmG-hKpMQk/photo.jpg

Requested by

Host: gstatic.gitbook.com
URL: https://gstatic.gitbook.com/js/111.a59367d0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

3e46dc2084ab2945b5af16a2d88abcd6fa7e8aa5ef5a43fc6c83ce561b6c9577

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Mon, 06 Apr 2020 21:55:45 GMT
x-content-type-options: nosniff
age: 5956
status: 200
content-disposition: inline;filename=""
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 6707
x-xss-protection: 0
server: fife
etag: "v5e"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Sun, 05 Apr 2020 07:36:29 GMT

GET
H/1.1 200
OK Mimikatz-Attacks-1.jpg
blog.stealthbits.com/wp-content/uploads/2017/07/ 131 KB
132 KB 123ms
123ms Image
image/jpeg 72.52.131.85
LIQUIDWEB

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.stealthbits.com/wp-content/uploads/2017/07/Mimikatz-Attacks-1.jpg

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

72.52.131.85 Lansing, United States, ASN32244 (LIQUIDWEB, US),

Reverse DNS

Software

Apache /

Resource Hash

a4673c2c7bd5a4fdfd2c6290c1636bc84efa8cef2ada3843c55868c9cf9da0e4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Mon, 06 Apr 2020 23:35:01 GMT
Last-Modified: Tue, 11 Jul 2017 17:05:59 GMT
Server: Apache
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000
Content-Type: image/jpeg
Cache-Control: max-age=10368000
Connection: keep-alive, Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=2, max=149
Content-Length: 134298
Expires: max-age=A10368000, public

GET
H2 200 0*Icen2GYXvhyUz7Av.PNG
miro.medium.com/max/1200/ 74 KB
74 KB 35ms
35ms Image
image/png 2606:4700::6810:7591
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/max/1200/0*Icen2GYXvhyUz7Av.PNG

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7591 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

e3da858ea17f1a638cb4fb0d0edbb6328ce601bf698ef58dad130f3b97efccc5

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Mon, 06 Apr 2020 23:35:01 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 2512733
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3209-f49543a
status: 200
alt-svc: h3-27=":443"; ma=86400, h3-25=":443"; ma=86400, h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
content-length: 75904
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/png
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=2592000
accept-ranges: bytes
cf-ray: 57ff52a91aa5dfc7-FRA
expires: Wed, 06 May 2020 23:35:01 GMT

POST
H2 200 / Show response
www.gitbook.com/__amp/ 7 B
375 B 825ms
796ms XHR
text/html 2606:4700:20::681a:6cd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gitbook.com/__amp/

Requested by

Host: gstatic.gitbook.com
URL: https://gstatic.gitbook.com/js/111.a59367d0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:6cd , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

aee408847d35e44e99430f0979c3357b85fe8dbb4535a494301198adbee85f27

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

Referer: https://ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
Origin: https://ired.team
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

date: Mon, 06 Apr 2020 23:35:02 GMT
cf-cache-status: DYNAMIC
server: cloudflare
status: 200
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, POST
content-type: text/html;charset=utf-8
access-control-allow-origin: *
strict-transport-security: max-age=15768000
cf-ray: 57ff52a97aa66425-FRA
content-length: 7

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 44 KB
18 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:81c::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: gstatic.gitbook.com
URL: https://gstatic.gitbook.com/js/111.a59367d0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

eaf1b128b927ac2868755cb7366d35554255c8af362235afe270f9614f8c806d

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 06 Feb 2020 00:21:02 GMT
server: Golfe2
age: 3689
date: Mon, 06 Apr 2020 22:33:32 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 18174
expires: Tue, 07 Apr 2020 00:33:32 GMT

GET
H2 200 7f9239ce726764aa22093884902e018d.svg
gstatic.gitbook.com/images/ 2 KB
2 KB 27ms
27ms Image
image/svg+xml 34.107.189.150
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://gstatic.gitbook.com/images/7f9239ce726764aa22093884902e018d.svg
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.107.189.150 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 150.189.107.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 863db76a201dedb75ccb6392a1664138cfb5c60d71e2073056db22ca39a56fec

Request headers

Referer: https://ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Wed, 11 Mar 2020 02:52:59 GMT
age: 2320922
status: 200
x-guploader-uploadid: AEnB2Upa9DzhQml4QrfTaz67DMnIfpm2IBlF1gxqyR6FQ5243zzIb9Kncv3AlEjO84fjkbwTWFm7Q1ZDJYSloZiPUu4dBnKTiQ
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: clear
content-length: 2137
last-modified: Tue, 10 Mar 2020 12:58:48 GMT
server: UploadServer
etag: "7f9239ce726764aa22093884902e018d"
x-goog-hash: crc32c=VnuT0A==, md5=f5I5znJnZKoiCTiEkC4BjQ==
x-goog-generation: 1583845128485401
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-goog-stored-content-length: 2137
accept-ranges: bytes
content-type: image/svg+xml
expires: Thu, 11 Mar 2021 02:52:59 GMT

GET
H2 200 collect
www.google-analytics.com/r/ 35 B
101 B 15ms
14ms Image
image/gif 2a00:1450:4001:81c::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/r/collect?v=1&_v=j81&a=1324581029&t=pageview&_s=1&dl=https%3A%2F%2Fired.team%2Foffensive-security-experiments%2Factive-directory-kerberos-abuse%2Fdump-password-hashes-from-domain-controller-with-dcsync&dp=%2Foffensive-security-experiments%2Factive-directory-kerberos-abuse%2Fdump-password-hashes-from-domain-controller-with-dcsync&ul=en-us&de=UTF-8&dt=DCSync%3A%20Dump%20Password%20Hashes%20from%20Domain%20Controller%20-%20Red%20Teaming%20Experiments&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&_u=YEDAAEAB~&jid=2015067909&gjid=125570915&cid=589817377.1586216101&tid=UA-57505611-10&_gid=1060716779.1586216101&_r=1&cd1=-LFEMnER3fywgFHoroYn&cd2=-LFEMnEQwqZOY6DtfrzY&cd3=-M25tV5MUcph3bcnY5jh&cd4=master&cd5=-LYHcKlvPpvC2Ly98FpQ&z=294549299

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Mon, 06 Apr 2020 23:35:01 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
access-control-allow-origin: *
content-type: image/gif
status: 200
cache-control: no-cache, no-store, must-revalidate
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 35
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 collect
www.google-analytics.com/r/ 35 B
101 B 15ms
15ms Image
image/gif 2a00:1450:4001:81c::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/r/collect?v=1&_v=j81&a=1324581029&t=pageview&_s=1&dl=https%3A%2F%2Fired.team%2Foffensive-security-experiments%2Factive-directory-kerberos-abuse%2Fdump-password-hashes-from-domain-controller-with-dcsync&dp=%2Foffensive-security-experiments%2Factive-directory-kerberos-abuse%2Fdump-password-hashes-from-domain-controller-with-dcsync&ul=en-us&de=UTF-8&dt=DCSync%3A%20Dump%20Password%20Hashes%20from%20Domain%20Controller%20-%20Red%20Teaming%20Experiments&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&_u=YEDAAEAB~&jid=2079395336&gjid=1937782813&cid=589817377.1586216101&tid=UA-128974775-1&_gid=1060716779.1586216101&_r=1&z=1251074287

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Mon, 06 Apr 2020 23:35:01 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
access-control-allow-origin: *
content-type: image/gif
status: 200
cache-control: no-cache, no-store, must-revalidate
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 35
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK .lp
s-usc1c-nss-287.firebaseio.com/ Frame 1ECD 0
0 337ms
113ms Document
text/html 2600:1901:0:94b6::
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s-usc1c-nss-287.firebaseio.com/.lp?dframe=t&id=2745328&pw=weIeKzyrlD&ns=gitbook-28427

Requested by

Host: gstatic.gitbook.com
URL: https://gstatic.gitbook.com/js/111.a59367d0.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305

Server

2600:1901:0:94b6:: , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Host: s-usc1c-nss-287.firebaseio.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Referer: https://ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Referer: https://ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync

Response headers

Server: nginx
Date: Mon, 06 Apr 2020 23:35:01 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 420
Connection: keep-alive
Strict-Transport-Security: max-age=31556926; includeSubDomains; preload

GET
H/1.1 200
OK .lp Show response
s-usc1c-nss-287.firebaseio.com/ Frame 3911 15 B
256 B 339ms
116ms Script
application/javascript 2600:1901:0:94b6::
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s-usc1c-nss-287.firebaseio.com/.lp?id=2745328&pw=weIeKzyrlD&ser=30978207&ns=gitbook-28427

Requested by

Host: gstatic.gitbook.com
URL: https://gstatic.gitbook.com/js/111.a59367d0.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305

Server

2600:1901:0:94b6:: , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

nginx /

Resource Hash

3d14e96bd08692f39b357173c908dcb0b21ee11d0bdb29b963ce7fcc836eb4fd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Referer: https://ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Date: Mon, 06 Apr 2020 23:35:01 GMT
Server: nginx
Connection: keep-alive
Content-Length: 15
Strict-Transport-Security: max-age=31556926; includeSubDomains; preload
Content-Type: application/javascript; charset=utf-8

GET
H/1.1 200
OK .lp Show response
s-usc1c-nss-287.firebaseio.com/ Frame 3911 58 B
299 B 341ms
115ms Script
application/javascript 2600:1901:0:94b6::
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s-usc1c-nss-287.firebaseio.com/.lp?id=2745328&pw=weIeKzyrlD&ser=30978208&ns=gitbook-28427&seg0=0&ts0=1&d0=eyJ0IjoiZCIsImQiOnsiciI6MSwiYSI6InMiLCJiIjp7ImMiOnsic2RrLmpzLjctMTItMCI6MX19fX0.

Requested by

Host: gstatic.gitbook.com
URL: https://gstatic.gitbook.com/js/111.a59367d0.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305

Server

2600:1901:0:94b6:: , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

nginx /

Resource Hash

ef824052cc54e24358011a6d1f363813e99264883d6a019f5c98f75e43f78dc9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Referer: https://ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Date: Mon, 06 Apr 2020 23:35:01 GMT
Server: nginx
Connection: keep-alive
Content-Length: 58
Strict-Transport-Security: max-age=31556926; includeSubDomains; preload
Content-Type: application/javascript; charset=utf-8

GET
H/1.1 200
OK .lp Show response
s-usc1c-nss-287.firebaseio.com/ Frame 3911 58 B
299 B 118ms
118ms Script
application/javascript 2600:1901:0:94b6::
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s-usc1c-nss-287.firebaseio.com/.lp?id=2745328&pw=weIeKzyrlD&ser=30978209&ns=gitbook-28427&seg0=1&ts0=1&d0=eyJ0IjoiZCIsImQiOnsiciI6MiwiYSI6InEiLCJiIjp7InAiOiIvc3BhY2VzLy1MRkVNbkVSM2Z5d2dGSG9yb1luL3VzZXJQYWdlUmF0aW5ncy8tTFlIY0tsdlBwdkMyTHk5OEZwUS8tTTRGSk42MVVMdzhWTS0wMjAxcSIsImgiOiIifX19&seg1=2&ts1=1&d1=eyJ0IjoiZCIsImQiOnsiciI6MywiYSI6Im0iLCJiIjp7InAiOiIvZW1iZWRzL2h0dHA6JTJGJTJGd3d3JTJFaGFybWoweSUyRW5ldCUyRmJsb2clMkZyZWR0ZWFtaW5nJTJGYWJ1c2luZy1hY3RpdmUtZGlyZWN0b3J5LXBlcm1pc3Npb25zLXdpdGgtcG93ZXJ2aWV3JTJGIiwiZCI6eyJvdXRkYXRlZCI6dHJ1ZX19fX0.&seg2=3&ts2=1&d2=eyJ0IjoiZCIsImQiOnsiciI6NCwiYSI6Im0iLCJiIjp7InAiOiIvZW1iZWRzL2h0dHBzOiUyRiUyRmJsb2clMkVzdGVhbHRoYml0cyUyRWNvbSUyRmV4dHJhY3RpbmctdXNlci1wYXNzd29yZC1kYXRhLXdpdGgtbWltaWthdHotZGNzeW5jJTJGIiwiZCI6eyJvdXRkYXRlZCI6dHJ1ZX19fX0.&seg3=4&ts3=1&d3=eyJ0IjoiZCIsImQiOnsiciI6NSwiYSI6Im0iLCJiIjp7InAiOiIvZW1iZWRzL2h0dHBzOiUyRiUyRm1lZGl1bSUyRWNvbSUyRkBqc2VjdXJpdHkxMDElMkZzeW5jaW5nLWludG8tdGhlLXNoYWRvd3MtYmJkNjU2ZGQxNGM4IiwiZCI6eyJvdXRkYXRlZCI6dHJ1ZX19fX0.

Requested by

Host: gstatic.gitbook.com
URL: https://gstatic.gitbook.com/js/111.a59367d0.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305

Server

2600:1901:0:94b6:: , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

nginx /

Resource Hash

01fe65d4fd93c66f51043f540156e23f6c69ef7ca0b6a0484bb063888989eb0e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Referer: https://ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Date: Mon, 06 Apr 2020 23:35:01 GMT
Server: nginx
Connection: keep-alive
Content-Length: 58
Strict-Transport-Security: max-age=31556926; includeSubDomains; preload
Content-Type: application/javascript; charset=utf-8

GET
H/1.1 200
OK .lp Show response
s-usc1c-nss-287.firebaseio.com/ Frame 3911 146 B
388 B 117ms
116ms Script
application/javascript 2600:1901:0:94b6::
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s-usc1c-nss-287.firebaseio.com/.lp?id=2745328&pw=weIeKzyrlD&ser=30978210&ns=gitbook-28427

Requested by

Host: gstatic.gitbook.com
URL: https://gstatic.gitbook.com/js/111.a59367d0.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305

Server

2600:1901:0:94b6:: , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

nginx /

Resource Hash

1297df6a08a9d468838d7128f03eb06fb6194048cfeb74aa28806225165fb88f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Referer: https://ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Date: Mon, 06 Apr 2020 23:35:01 GMT
Server: nginx
Connection: keep-alive
Content-Length: 146
Strict-Transport-Security: max-age=31556926; includeSubDomains; preload
Content-Type: application/javascript; charset=utf-8

GET
H/1.1 200
OK .lp Show response
s-usc1c-nss-287.firebaseio.com/ Frame 3911 47 B
288 B 163ms
162ms Script
application/javascript 2600:1901:0:94b6::
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s-usc1c-nss-287.firebaseio.com/.lp?id=2745328&pw=weIeKzyrlD&ser=30978211&ns=gitbook-28427

Requested by

Host: gstatic.gitbook.com
URL: https://gstatic.gitbook.com/js/111.a59367d0.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305

Server

2600:1901:0:94b6:: , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

nginx /

Resource Hash

431270143e9fb062562e977b4e3a627d721bfd1a97e45e87794e2515425f3f60

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Referer: https://ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Date: Mon, 06 Apr 2020 23:35:02 GMT
Server: nginx
Connection: keep-alive
Content-Length: 47
Strict-Transport-Security: max-age=31556926; includeSubDomains; preload
Content-Type: application/javascript; charset=utf-8

GET
H/1.1 200
OK .lp Show response
s-usc1c-nss-287.firebaseio.com/ Frame 3911 38 B
279 B 144ms
112ms Script
application/javascript 2600:1901:0:94b6::
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s-usc1c-nss-287.firebaseio.com/.lp?id=2745328&pw=weIeKzyrlD&ser=30978212&ns=gitbook-28427&seg0=5&ts0=1&d0=eyJ0IjoiYyIsImQiOnsidCI6Im4iLCJkIjp7fX19

Requested by

Host: gstatic.gitbook.com
URL: https://gstatic.gitbook.com/js/111.a59367d0.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305

Server

2600:1901:0:94b6:: , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

nginx /

Resource Hash

8e9bd0e2d3d483ebc55071a08a6b569aac5da3a6b7d473c4dd7f0288030f8dae

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Referer: https://ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Date: Mon, 06 Apr 2020 23:35:02 GMT
Server: nginx
Connection: keep-alive
Content-Length: 38
Strict-Transport-Security: max-age=31556926; includeSubDomains; preload
Content-Type: application/javascript; charset=utf-8

GET
H2 200 chunk.966.9bcdd26c.js Show response
gstatic.gitbook.com/js/ 1 MB
1 MB 31ms
31ms Script
application/javascript 34.107.189.150
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://gstatic.gitbook.com/js/chunk.966.9bcdd26c.js
Requested by: Host: gstatic.gitbook.com
URL: https://gstatic.gitbook.com/js/111.a59367d0.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.107.189.150 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 150.189.107.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 870f8d6ed2b3a07d9452473c6fd0639fd89ebd3f87888650c21cccebfa9d43ef

Request headers

Referer: https://ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Tue, 31 Mar 2020 13:08:22 GMT
age: 556004
status: 200
x-guploader-uploadid: AEnB2UqdqUqdfbb9v2SSe-YiW8H9x7_BA0ED3_Nwpuo3zjI3UQTqC-b_f6Yz1eiCk2NXnQjesp4Ts0BeHVlnezSxv7DAXICmog
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: clear
content-length: 1540766
last-modified: Fri, 27 Mar 2020 15:33:33 GMT
server: UploadServer
etag: "1ee0a04f04f79506addc6f9cc9ade2c0"
x-goog-hash: crc32c=6ui4QQ==, md5=HuCgTwT3lQat3G+cya3iwA==
x-goog-generation: 1585323213534405
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-goog-stored-content-length: 1540766
accept-ranges: bytes
content-type: application/javascript
expires: Wed, 31 Mar 2021 13:08:22 GMT

Verdicts & Comments Add Verdict or Comment

26 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.ired.team/	1970-01-23 00:12:56	Name: amplitude_id_fef1e872c952688acd962d30aa545b9eired.team Value: eyJkZXZpY2VJZCI6IjE4MWI5YWUwLTZkNmEtNDI1ZS1iMGI2LWNjNDYyMjE4N2I3N1IiLCJ1c2VySWQiOm51bGwsIm9wdE91dCI6ZmFsc2UsInNlc3Npb25JZCI6MTU4NjIxNjEwMTE0NSwibGFzdEV2ZW50VGltZSI6MTU4NjIxNjEwMTMyMCwiZXZlbnRJZCI6MSwiaWRlbnRpZnlJZCI6MCwic2VxdWVuY2VOdW1iZXIiOjF9
			.ired.team/	1970-01-19 09:20:08	Name: __cfduid Value: d17faa05ae997a1b3217ff562ee0034bf1586216099

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://gstatic.gitbook.com/js/111.a59367d0.js(Line 2) Message: Application ready

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

app.gitbook.com
blog.stealthbits.com
cdn.lr-ingest.io
fonts.googleapis.com
fonts.gstatic.com
gblobscdn.gitbook.com
gitbook-28427.firebaseio.com
gstatic.gitbook.com
ired.team
lh5.googleusercontent.com
miro.medium.com
polyfill.io
s-usc1c-nss-287.firebaseio.com
unpkg.com
www.gitbook.com
www.google-analytics.com
2600:1901:0:94b6::
2606:4700:20::681a:6cd
2606:4700:20::681a:7cd
2606:4700:3030::681f:5ab4
2606:4700::6810:7591
2606:4700::6810:7daf
2606:4700:e2::ac40:8b14
2a00:1450:4001:806::2001
2a00:1450:4001:808::200a
2a00:1450:4001:814::2003
2a00:1450:4001:81c::200e
2a04:4e42:400::621
34.107.189.150
34.107.207.82
72.52.131.85
0121a107ac97882ea9528f93b212a198ef106cbf6a3ab693a2743061542577f3
01fe65d4fd93c66f51043f540156e23f6c69ef7ca0b6a0484bb063888989eb0e
03b0665e307caf691a7e91427ecd157e8037ef3aeb3e73faad928d67ffe55113
1297df6a08a9d468838d7128f03eb06fb6194048cfeb74aa28806225165fb88f
136ce930cd83f459c9528efa1b255d028476ad4638e9f87eafe7ea6df2795521
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
265ee4e0a83c54da9d60812c74ed9d5854c8a8454834d13b6859cf8e898bdef6
34d111f20960b8fbe1ebf0be28b3a67ae36c01e0dfd7a22ab3ebdfda3a40dbfc
3d14e96bd08692f39b357173c908dcb0b21ee11d0bdb29b963ce7fcc836eb4fd
3e46dc2084ab2945b5af16a2d88abcd6fa7e8aa5ef5a43fc6c83ce561b6c9577
3e692de9565d90dd947a080d4d10cee72a83447ba053e08fdcac457d7197128a
3e8a9ea983c768e3924813f0f562c7a0eb02425e282d3d91e64ffd5c0c24e2d8
431270143e9fb062562e977b4e3a627d721bfd1a97e45e87794e2515425f3f60
59fd4f207936792ab9910baa7df5f1f7bff899e35e0428df34ab9a1319184052
5e998f881a9ca86ceb2d55ab78a9612004b4305d1f7972858ccf495e5db4be25
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
863db76a201dedb75ccb6392a1664138cfb5c60d71e2073056db22ca39a56fec
870f8d6ed2b3a07d9452473c6fd0639fd89ebd3f87888650c21cccebfa9d43ef
8beb5465b2abd6a7b77922b8ee2db26b06cac44607544aa47a07aa5501158969
8e9bd0e2d3d483ebc55071a08a6b569aac5da3a6b7d473c4dd7f0288030f8dae
a18af7799b7d241fe5d00645492ccedcad39815e9f4125b7e3e90b18a1b77405
a4673c2c7bd5a4fdfd2c6290c1636bc84efa8cef2ada3843c55868c9cf9da0e4
aaecd144d2b8763b2fa5c91f09778294363cef363c10504205f4203922644d11
aee2771f5f57ecf568ffffd5c0d0fee81b7fb2b5540e10d856f2462abdbd5f92
aee408847d35e44e99430f0979c3357b85fe8dbb4535a494301198adbee85f27
b87e90677bdbc3c6bc296a368f57b2d72783c1a7c6e8e9325cd1645c18039cf2
c5e939d7d3f9c9bfe632d16484c12354fa89a12738f30f738aa81c984e5b9a92
dfbf03bd10a5461d085675f9ab7c442b3b4dbe2c5001a661a3925ac9f1378cb6
e3da858ea17f1a638cb4fb0d0edbb6328ce601bf698ef58dad130f3b97efccc5
e4e0e2248cf8d33abc677b8c37b5e50d22422040d29744b3e3fa89c91d75103b
e7a89c9941bc8240f4675b9aaa19bfc37da0c3680eda23a9ce3c4961671d7d06
e936101b48971cd50155204875f9d2d9e8d9e6ca6ec30d9ac49e239139dc60fc
eaf1b128b927ac2868755cb7366d35554255c8af362235afe270f9614f8c806d
eb470d0e44fc9ea031dff6615f4dcf8f460cc71c4603dbe9abd583cc3bb034cf
ef824052cc54e24358011a6d1f363813e99264883d6a019f5c98f75e43f78dc9
f008dc0769c2e3c28c21859c9f0f18a05aeef49930affa9cc6a8afb8104355fb
fd6ed6532676b92d9ef04191bd606d815b885cdcc9f1acc4c75c67eacacb9bc3

ired.team Open in urlscan Pro 2606:4700:3030::681f:5ab4 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

51 Requests

98 %HTTPS

80 %IPv6

12 Domains

16 Subdomains

16 IPs

3 Countries

6668 kBTransfer

8951 kBSize

2 Cookies

11 Outgoing links

Redirected requests

51 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

ired.team Open in urlscan Pro
2606:4700:3030::681f:5ab4 Public Scan

Screenshot
Live screenshot

Full Image

51
Requests

98 %
HTTPS

80 %
IPv6

12
Domains

16
Subdomains

16
IPs

3
Countries

6668 kB
Transfer

8951 kB
Size

2
Cookies

51 HTTP transactions
0 data transactions