pentestlab.blog Open in urlscan Pro
192.0.78.25 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/
Submission: On July 20 via manual (July 20th 2020, 5:30:54 pm UTC) from US

Summary HTTP 80 Redirects Links 41 Behaviour Indicators

Summary

This website contacted 17 IPs in 4 countries across 12 domains to perform 80 HTTP transactions. The main IP is 192.0.78.25, located in San Francisco, United States and belongs to AUTOMATTIC, US. The main domain is pentestlab.blog.
TLS certificate: Issued by Let's Encrypt Authority X3 on June 15th 2020. Valid for: 3 months.

This is the only time pentestlab.blog was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
2	192.0.78.25 192.0.78.25	2635 (AUTOMATTIC) (AUTOMATTIC)
23	192.0.77.32 192.0.77.32	2635 (AUTOMATTIC) (AUTOMATTIC)
2	2a00:1450:400... 2a00:1450:4001:819::200a	15169 (GOOGLE) (GOOGLE)
8	2a04:fa87:fff... 2a04:fa87:fffe::c000:4902	2635 (AUTOMATTIC) (AUTOMATTIC)
14	192.0.72.29 192.0.72.29	2635 (AUTOMATTIC) (AUTOMATTIC)
6	2a00:1450:400... 2a00:1450:4001:81d::2003	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:81c::2004	15169 (GOOGLE) (GOOGLE)
4	2606:2800:234... 2606:2800:234:59:254c:406:2366:268c	15133 (EDGECAST) (EDGECAST)
4	192.0.123.249 192.0.123.249	2635 (AUTOMATTIC) (AUTOMATTIC)
6	192.0.76.3 192.0.76.3	2635 (AUTOMATTIC) (AUTOMATTIC)
2	2a03:2880:f01... 2a03:2880:f01c:8012:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
2	2a03:2880:f11... 2a03:2880:f11c:8183:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
1	23.210.248.189 23.210.248.189	16625 (AKAMAI-AS) (AKAMAI-AS)
1	2a03:2880:f01... 2a03:2880:f01c:800e:face:b00c:0:2	32934 (FACEBOOK) (FACEBOOK)
1	192.0.78.19 192.0.78.19	2635 (AUTOMATTIC) (AUTOMATTIC)
1	104.244.42.72 104.244.42.72	13414 (TWITTER) (TWITTER)
80	17

2 192.0.78.25 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)

pentestlab.blog	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

23 192.0.77.32 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)

s0.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
widgets.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:819::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2a04:fa87:fffe::c000:4902 (Ireland)

ASN2635 (AUTOMATTIC, US)

1.gravatar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
2.gravatar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
0.gravatar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 192.0.72.29 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)

pentestlab.files.wordpress.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:81d::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:81c::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2606:2800:234:59:254c:406:2366:268c (United States)

ASN15133 (EDGECAST, US)

platform.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 192.0.123.249 (Los Angeles, United States)

ASN2635 (AUTOMATTIC, US)

polldaddy.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 192.0.76.3 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)

stats.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pixel.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f01c:8012:face:b00c:0:3 (Ireland)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f11c:8183:face:b00c:0:25de (Ireland)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.210.248.189 (Netherlands)

ASN16625 (AKAMAI-AS, US)

api.pinterest.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a03:2880:f01c:800e:face:b00c:0:2 (Ireland)

ASN32934 (FACEBOOK, US)

graph.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.0.78.19 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)

r-login.wordpress.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.72 (United States)

ASN13414 (TWITTER, US)

syndication.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
29	wp.com s0.wp.com stats.wp.com widgets.wp.com pixel.wp.com	476 KB
15	wordpress.com pentestlab.files.wordpress.com r-login.wordpress.com	429 KB
8	gravatar.com 1.gravatar.com 2.gravatar.com 0.gravatar.com	22 KB
6	gstatic.com fonts.gstatic.com www.gstatic.com	199 KB
5	twitter.com platform.twitter.com syndication.twitter.com	32 KB
4	polldaddy.com polldaddy.com	9 KB
3	facebook.com www.facebook.com graph.facebook.com	335 B
3	google.com www.google.com	664 B
2	facebook.net connect.facebook.net	62 KB
2	googleapis.com fonts.googleapis.com	2 KB
2	pentestlab.blog pentestlab.blog	51 KB
1	pinterest.com api.pinterest.com	366 B
80	12

	Domain	Requested by
21	s0.wp.com	pentestlab.blog
14	pentestlab.files.wordpress.com	pentestlab.blog
5	pixel.wp.com	pentestlab.blog
5	fonts.gstatic.com	pentestlab.blog s0.wp.com
4	polldaddy.com	pentestlab.blog polldaddy.com www.gstatic.com
4	platform.twitter.com	pentestlab.blog platform.twitter.com
4	1.gravatar.com	pentestlab.blog
3	www.google.com	pentestlab.blog www.gstatic.com
3	0.gravatar.com	pentestlab.blog 0.gravatar.com
2	widgets.wp.com	pentestlab.blog s0.wp.com
2	www.facebook.com	connect.facebook.net
2	connect.facebook.net	s0.wp.com connect.facebook.net
2	fonts.googleapis.com	pentestlab.blog s0.wp.com
2	pentestlab.blog	s0.wp.com
1	syndication.twitter.com
1	r-login.wordpress.com	pentestlab.blog
1	graph.facebook.com	s0.wp.com
1	api.pinterest.com	s0.wp.com
1	www.gstatic.com	www.google.com
1	stats.wp.com	pentestlab.blog
1	2.gravatar.com	pentestlab.blog
80	21

This site contains links to these domains. Also see Links.

Domain
twitter.com
medium.com
sensepost.com
www.secarma.co.uk
www.securitysift.com
staaldraad.github.io
willgenovese.com
cariagiovannib.wordpress.com
null-byte.wonderhowto.com
pentestlab.wordpress.com
mysecjournal.wordpress.com
www.sentinelone.com
malware.pizza
gravatar.com
cognosec.com
discord.gg
www.facebook.com
wordpress.com
wp.me
en.wordpress.com
subscribe.wordpress.com

Subject Issuer	Validity	Valid
tls.automattic.com Let's Encrypt Authority X3	`2020-06-15` - `2020-09-13`	3 months	crt.sh
*.wp.com Sectigo RSA Domain Validation Secure Server CA	`2020-04-02` - `2022-07-05`	2 years	crt.sh
upload.video.google.com GTS CA 1O1	`2020-06-30` - `2020-09-22`	3 months	crt.sh
*.gravatar.com COMODO RSA Domain Validation Secure Server CA	`2018-09-06` - `2020-09-05`	2 years	crt.sh
*.files.wordpress.com Sectigo RSA Domain Validation Secure Server CA	`2019-01-15` - `2021-01-14`	2 years	crt.sh
*.gstatic.com GTS CA 1O1	`2020-06-30` - `2020-09-22`	3 months	crt.sh
www.google.com GTS CA 1O1	`2020-06-30` - `2020-09-22`	3 months	crt.sh
*.twimg.com DigiCert SHA2 High Assurance Server CA	`2019-11-12` - `2020-11-18`	a year	crt.sh
*.polldaddy.com COMODO RSA Domain Validation Secure Server CA	`2018-09-06` - `2020-09-05`	2 years	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2020-05-14` - `2020-08-05`	3 months	crt.sh
*.pinterest.com DigiCert SHA2 High Assurance Server CA	`2020-07-16` - `2021-08-04`	a year	crt.sh
*.wordpress.com COMODO RSA Domain Validation Secure Server CA	`2018-09-06` - `2020-09-05`	2 years	crt.sh
syndication.twitter.com DigiCert SHA2 High Assurance Server CA	`2020-03-05` - `2021-03-02`	a year	crt.sh

This page contains 10 frames:

Primary Page: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/
Frame ID: 9DB690A14168B4FDD2044FBD07965837
Requests: 72 HTTP requests in this frame

Frame: https://www.facebook.com/v2.3/plugins/page.php?app_id=249643311490&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df197914bfef7a98%26domain%3Dpentestlab.blog%26origin%3Dhttps%253A%252F%252Fpentestlab.blog%252Ff3b533b9ed7e518%26relation%3Dparent.parent&container_width=342&height=432&hide_cover=false&hide_cta=false&href=https%3A%2F%2Fwww.facebook.com%2Fpentestlaboratory%2F&locale=en_US&sdk=joey&show_facepile=true&small_header=false&tabs=false&width=200
Frame ID: 0210ABCA06D8FCC835A7C9BC3CE3ADE6
Requests: 1 HTTP requests in this frame

Frame: https://widgets.wp.com/likes/master.html?ver=20190321
Frame ID: 812FFDC33D55D251F4A91482F1047175
Requests: 1 HTTP requests in this frame

Frame: https://platform.twitter.com/widgets/widget_iframe.c4b33f07650267db9f8a72eaac551cac.html?origin=https%3A%2F%2Fpentestlab.blog
Frame ID: 11D6E1FD870F8C315A4ECB0F913064CC
Requests: 1 HTTP requests in this frame

Frame: https://www.facebook.com/v2.3/plugins/page.php?app_id=249643311490&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df1d52a711df9ad4%26domain%3Dpentestlab.blog%26origin%3Dhttps%253A%252F%252Fpentestlab.blog%252Ff3b533b9ed7e518%26relation%3Dparent.parent&container_width=200&height=432&hide_cover=false&hide_cta=false&href=https%3A%2F%2Fwww.facebook.com%2Fpentestlaboratory%2F&locale=en_US&sdk=joey&show_facepile=true&small_header=false&tabs=false&width=200
Frame ID: 2BECEDACDC5EA2DDB245639D6B4DA44A
Requests: 1 HTTP requests in this frame

Frame: https://r-login.wordpress.com/remote-login.php?wpcom_remote_login=key&origin=aHR0cHM6Ly9wZW50ZXN0bGFiLmJsb2c%3D&wpcomid=32637504&time=1595266234
Frame ID: 9D97CBEC0C468BEB4B987C4D0ACBDA75
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LcmyE0UAAAAALID28yVNg7pFCodGaArJzHitez_&co=aHR0cHM6Ly9wZW50ZXN0bGFiLmJsb2c6NDQz&hl=en&type=image&v=6uMSoEJtPugDt7Qm0Uu5iuSY&theme=light&size=normal&cb=srhhea75s7mh
Frame ID: 934205D7EB5F24B59690DF4CD00849CA
Requests: 1 HTTP requests in this frame

Frame: https://platform.twitter.com/widgets/follow_button.c4b33f07650267db9f8a72eaac551cac.en.html
Frame ID: 208B2F46127FB6FCA74DABC17A896EBA
Requests: 1 HTTP requests in this frame

Frame: https://widgets.wp.com/likes/index.html?ver=20190321
Frame ID: 2D794995A16089C2EF3E95675764C6AC
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/bframe?hl=en&v=6uMSoEJtPugDt7Qm0Uu5iuSY&k=6LcmyE0UAAAAALID28yVNg7pFCodGaArJzHitez_&cb=1lvpgms5157
Frame ID: 21B256F1ED5F90646864AA571CD962C9
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Page Statistics

80
Requests

100 %
HTTPS

50 %
IPv6

12
Domains

21
Subdomains

17
IPs

4
Countries

1290 kB
Transfer

2449 kB
Size

0
Cookies

41 Outgoing links

These are links going to different origins than the main page.

URL: https://twitter.com/sensepost
Title: SensePost

Search URL Search Domain Scan URL

URL: https://medium.com/red-team/dde-payloads-16629f4a2fcd
Title: DDE Payloads

Search URL Search Domain Scan URL

URL: https://sensepost.com/blog/2017/macro-less-code-exec-in-msword/
Title: post

Search URL Search Domain Scan URL

URL: https://twitter.com/cornerpirate
Title: Paul Ritchie

Search URL Search Domain Scan URL

URL: https://www.secarma.co.uk/labs/is-dynamic-data-exchange-dde-injection-a-thing/
Title: blog

Search URL Search Domain Scan URL

URL: https://twitter.com/securitysift
Title: Mike Czumak

Search URL Search Domain Scan URL

URL: https://www.securitysift.com/abusing-microsoft-office-dde/
Title: blog

Search URL Search Domain Scan URL

URL: http://staaldraad.github.io/2017/10/23/msword-field-codes/
Title: http://staaldraad.github.io/2017/10/23/msword-field-codes/

Search URL Search Domain Scan URL

URL: http://willgenovese.com/office-ddeauto-attacks/
Title: http://willgenovese.com/office-ddeauto-attacks/

Search URL Search Domain Scan URL

URL: https://cariagiovannib.wordpress.com/2018/01/16/microsoft-office-dde-attacks-penetration-testing-lab/
Title: Microsoft Office – DDE Attacks | Penetration Testing Lab – Caria Giovanni B. Security Blog

Search URL Search Domain Scan URL

URL: https://null-byte.wonderhowto.com/how-to/hide-dde-based-attacks-ms-word-0180784/
Title: https://null-byte.wonderhowto.com/how-to/hide-dde-based-attacks-ms-word-0180784/

Search URL Search Domain Scan URL

URL: https://pentestlab.wordpress.com/
Title: netbiosX

Search URL Search Domain Scan URL

URL: https://mysecjournal.wordpress.com/2018/05/18/ms-dde-exploit-social-engineering-with-metasploit/
Title: Ms. DDE Exploit (Social Engineering with metasploit) – #One-Secure-Cent

Search URL Search Domain Scan URL

URL: https://www.sentinelone.com/blog/malware-embedded-microsoft-office-documents-dde-exploit-macroless/
Title: Malware Embedded in Microsoft Office Documents | DDE Exploit (MACROLESS)

Search URL Search Domain Scan URL

URL: http://malware.pizza/2020/05/12/evading-av-with-excel-macros-and-biff8-xls/
Title: Evading Detection with Excel 4.0 Macros and the BIFF8 XLS Format – Yet Another Security Blog

Search URL Search Domain Scan URL

URL: https://gravatar.com/site/signup/
Title:

Search URL Search Domain Scan URL

URL: http://twitter.com/netbiosX
Title: @ Twitter

Search URL Search Domain Scan URL

URL: http://twitter.com/domchell
Title: domchell

Search URL Search Domain Scan URL

URL: http://twitter.com/dtmsecurity
Title: dtmsecurity

Search URL Search Domain Scan URL

URL: http://twitter.com/MDSecLabs
Title: MDSecLabs

Search URL Search Domain Scan URL

URL: http://twitter.com/netbiosX/statuses/1285138529069277190
Title: 8 hours ago

Search URL Search Domain Scan URL

URL: http://twitter.com/_RastaMouse
Title: _RastaMouse

Search URL Search Domain Scan URL

URL: http://twitter.com/TheRealWover
Title: TheRealWover

Search URL Search Domain Scan URL

URL: http://twitter.com/F
Title: F

Search URL Search Domain Scan URL

URL: http://twitter.com/netbiosX/statuses/1284900479126962176
Title: 1 day ago

Search URL Search Domain Scan URL

URL: http://twitter.com/Flangvik
Title: Flangvik

Search URL Search Domain Scan URL

URL: https://twitter.com/i/web/status/1284842598063124480
Title: twitter.com/i/web/status/1…

Search URL Search Domain Scan URL

URL: http://twitter.com/netbiosX/statuses/1284842598063124480
Title: 1 day ago

Search URL Search Domain Scan URL

URL: https://cognosec.com/bypassing-symantec-endpoint-protection-for-fun-profit-defense-evasion/
Title: cognosec.com/bypassing-syma…

Search URL Search Domain Scan URL

URL: http://twitter.com/netbiosX/statuses/1284831300420018176
Title: 1 day ago

Search URL Search Domain Scan URL

URL: http://twitter.com/424f424f
Title: 424f424f

Search URL Search Domain Scan URL

URL: http://twitter.com/netbiosX/statuses/1284830248232800257
Title: 1 day ago

Search URL Search Domain Scan URL

URL: https://discord.gg/rR6FJBH
Title: Discord

Search URL Search Domain Scan URL

URL: https://www.facebook.com/pentestlaboratory/
Title: Facebook Page

Search URL Search Domain Scan URL

URL: https://wordpress.com/?ref=footer_blog
Title: Blog at WordPress.com.

Search URL Search Domain Scan URL

URL: https://pentestlab.wordpress.com/wp-admin/customize.php?url=https%3A%2F%2Fpentestlab.wordpress.com%2F2018%2F01%2F16%2Fmicrosoft-office-dde-attacks%2F
Title: Customize

Search URL Search Domain Scan URL

URL: https://wordpress.com/start/
Title: Sign up

Search URL Search Domain Scan URL

URL: https://wordpress.com/log-in?redirect_to=https%3A%2F%2Fpentestlab.blog%2F2018%2F01%2F16%2Fmicrosoft-office-dde-attacks%2F&signup_flow=account&domain=pentestlab.blog
Title: Log in

Search URL Search Domain Scan URL

URL: https://wp.me/p2cWvm-3yt
Title: Copy shortlink

Search URL Search Domain Scan URL

URL: http://en.wordpress.com/abuse/
Title: Report this content

Search URL Search Domain Scan URL

URL: https://subscribe.wordpress.com/
Title: Manage subscriptions

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

80 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/ 173 KB
49 KB 394ms
368ms Document
text/html 192.0.78.25
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.78.25 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

1dcec1a3e1b6a6dab5f52e000e5bf5d78eb746ecc818b4e7245748dde5396ae1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

:method: GET
:authority: pentestlab.blog
:scheme: https
:path: /2018/01/16/microsoft-office-dde-attacks/
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
server: nginx
date: Mon, 20 Jul 2020 17:30:34 GMT
content-type: text/html; charset=UTF-8
strict-transport-security: max-age=31536000
vary: Accept-Encoding Cookie
x-hacker: If you're reading this, you should visit automattic.com/jobs and apply to join the fun, mention this header.
x-pingback: https://pentestlab.blog/xmlrpc.php
link: <https://wp.me/p2cWvm-3yt>; rel=shortlink
last-modified: Mon, 20 Jul 2020 17:30:34 GMT
cache-control: max-age=300, must-revalidate
x-nananana: Batcache
content-encoding: gzip
x-ac: 3.fra _dfw

GET
H2 200 /
s0.wp.com/_static/ 210 KB
30 KB 28ms
8ms Stylesheet
text/css 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/_static/??-eJylklFuwyAQRC9UvLZTV/ZH1bMA3lISMIhdFPn2xW4SRW7kRurnwL7RMCyco9BhYpwYfBbRZWMngnPUwQvy1uG8UZUmeoHHWEInGUcRA/FG7WHOnpDgiBylPolV/Rq/zppcpMJkyk1C6KtDVYPK1o2gXFhxlWSagXh2+H8b/kL/jM1K3T1CziGzMMmOTyfZWCTJdjL0B/6ZnRNkGQWOdgEurULT9f3Q1e0AMaG32d/QfUMdLjmaql1KGS3x7VA8Zu/+cqmznPsoeZnwJZVEVzqceA/7WTGlSlYicU28lr/uwod/b7rhtW7bpn47fgMTVAJf?cssminify=yes
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 95784f33a6d1aa8f8cfd53db40a8cfb8d1d44c7180062a6ff6212fe6797a62b5

Request headers

Referer: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT fra 2
date: Mon, 20 Jul 2020 17:30:34 GMT
content-encoding: gzip
last-modified: Mon, 06 Jul 2020 07:55:26 GMT
server: nginx
etag: W/"5f02d8ee-3477c"
vary: Accept-Encoding
content-type: text/css;charset=utf-8
status: 200
cache-control: max-age=31536000
x-ac: 4.fra _dfw
expires: Tue, 06 Jul 2021 07:55:53 GMT

GET
H2 200 css
fonts.googleapis.com/ 2 KB
1021 B 29ms
16ms Stylesheet
text/css 2a00:1450:4001:819::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open%2BSans%3A400%2C400italic%2C700%2C700italic%7CMontserrat%3A500&subset=latin%2Clatin-ext&ver=5.4.2

Requested by

Host: pentestlab.blog
URL: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

d74cd406e1340a9c44419adaa5525d562cfc5647052c3169298b8fe1b39bbbf8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/
Origin: https://pentestlab.blog

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 20 Jul 2020 17:30:34 GMT
server: ESF
date: Mon, 20 Jul 2020 17:30:34 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 20 Jul 2020 17:30:34 GMT

GET
H2 200 /
s0.wp.com/_static/ 75 KB
16 KB 28ms
8ms Stylesheet
text/css 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/_static/??-eJyNkEEOwjAMBD9EsCgqEgfEW9LgBlMnruJEhd+TcqkqpMJt15rZg2EajZOYMWbIdwyoMCYMVMJceykJnCr0FTF2QpWA+3rYwW9P84u/4VDMyMVTVJjo5jHXceuwExkM01DD839TxZFlQxVZly3ZoxgWZzNJXBXTs6W0pSbsWHyN/vOVpW5J1s3jnU1LmvFruBzac9scD21zerwB35aTmw==?cssminify=yes
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 2a05abeef37f6a78416123e305d4dca2ad43149d7e9b5b2aed69b00bd539b486

Request headers

Referer: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT fra 2
date: Mon, 20 Jul 2020 17:30:34 GMT
content-encoding: gzip
last-modified: Mon, 20 Jul 2020 07:52:10 GMT
server: nginx
etag: W/"5f154d2a-12b34"
vary: Accept-Encoding
content-type: text/css;charset=utf-8
status: 200
cache-control: max-age=31536000
x-ac: 4.fra _dfw
expires: Tue, 20 Jul 2021 08:03:21 GMT

GET
H2 200 /
s0.wp.com/_static/ 29 KB
11 KB 39ms
19ms Stylesheet
text/css 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/_static/??-eJxti8sKgCAQAH8oW6IHdIi+xcR0Y3XFVfr96NAh6jQMzMCZlOFYbCwQqkpUHUaBxFLUThoziNcZo3vYGpEG/i9hg5oUseO3fKbibbACfgBHvGm6gzUs3Tj3UzcO/XRcZTE30g==?cssminify=yes
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: a236159f6444621c00f349c80413f633a690492d637dde74b590e00b7f3f7f50

Request headers

Referer: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT fra 2
date: Mon, 20 Jul 2020 17:30:34 GMT
content-encoding: gzip
last-modified: Wed, 01 Jul 2020 14:57:29 GMT
server: nginx
etag: W/"5efca459-7203"
vary: Accept-Encoding
content-type: text/css;charset=utf-8
status: 200
cache-control: max-age=31536000
x-ac: 4.fra _dfw
expires: Thu, 01 Jul 2021 14:57:33 GMT

GET
H2 200 / Show response
s0.wp.com/_static/ 130 KB
43 KB 39ms
19ms Script
application/javascript 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/_static/??-eJx9jNsKgzAMQH9osSrr0Iexb/ESS6Rpu7aZ7O/Xge7Bh0EgJJxz1BaA3GRlxqTWMk/B+N5XtaaL+gcAk4lDxorJHfDkXUaXvyz7kSyCJIyDKb8SWvyZY4FgxZBLKqItsRmCT/l0na1DWcRaSJQRcKZMzuwx1eiu63Xd9ipEZBL+qS/CreQefG90f63btqlv6wdzkmDG
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: addeb43bc4679efd3c579491a532ef3c0b22395877042df5683e53649a9b9b07

Request headers

Referer: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT fra 2
date: Mon, 20 Jul 2020 17:30:34 GMT
content-encoding: gzip
last-modified: Mon, 06 Jul 2020 07:55:26 GMT
server: nginx
etag: W/"5f02d8ee-208db"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: max-age=31536000
x-ac: 4.fra _dfw
expires: Tue, 06 Jul 2021 07:55:36 GMT

GET
H2 200 style.css
s0.wp.com/wp-content/mu-plugins/highlander-comments/ 19 KB
3 KB 37ms
17ms Stylesheet
text/css 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/wp-content/mu-plugins/highlander-comments/style.css?m=1530132353h&cssminify=yes
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 89d01b152beefa0885d7821cea6cc319054d5e272549b004479a6ac81ecafee3

Request headers

Referer: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT fra 2
date: Mon, 20 Jul 2020 17:30:34 GMT
content-encoding: gzip
server: nginx
etag: W/"5b33f7b7-5e1f"
vary: Accept-Encoding
content-type: text/css
status: 200
cache-control: max-age=31536000
x-ac: 4.fra _dfw
expires: Sat, 21 Nov 2020 08:30:14 GMT

GET
H2 200 /
s0.wp.com/ 5 KB
1 KB 37ms
17ms Stylesheet
text/css 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/?custom-css=1&csblog=2cWvm&cscache=6&csrev=34
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 893a7a315254505f93d4c92ada4651a29eab01b5f46047c15ebf8dedca408414

Request headers

Referer: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-hacker: If you're reading this, you should visit automattic.com/jobs and apply to join the fun, mention this header.
date: Mon, 20 Jul 2020 17:30:34 GMT
content-encoding: gzip
server: nginx
status: 200
vary: Accept-Encoding
content-type: text/css;charset=utf-8
x-nc: HIT fra 2
x-ac: 4.fra _dfw
expires: Wed, 07 Jul 2021 01:27:20 GMT

GET
H2 200 4605db59f0637ffc3e084bd14d744ff7
1.gravatar.com/avatar/ 1 KB
1 KB 21ms
7ms Image
image/jpeg 2a04:fa87:fffe::c000:4902
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://1.gravatar.com/avatar/4605db59f0637ffc3e084bd14d744ff7?s=32&d=identicon&r=G
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 72f6111c826a30ccd1f165810abe57ede94f3e780e3cfb3e706cd08ccde1c14e

Request headers

Referer: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT fra 3
date: Mon, 20 Jul 2020 17:30:34 GMT
last-modified: Sun, 19 Feb 2012 06:41:30 GMT
server: nginx
status: 200
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=300
content-disposition: inline; filename="4605db59f0637ffc3e084bd14d744ff7.jpeg"
accept-ranges: bytes
link: <https://www.gravatar.com/avatar/4605db59f0637ffc3e084bd14d744ff7?s=32&d=identicon&r=G>; rel="canonical"
content-length: 1163
expires: Mon, 20 Jul 2020 17:35:34 GMT

GET
H2 200 word-dde-via-field-code.png
pentestlab.files.wordpress.com/2018/01/ 9 KB
9 KB 45ms
8ms Image
image/png 192.0.72.29
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pentestlab.files.wordpress.com/2018/01/word-dde-via-field-code.png

Requested by

Host: pentestlab.blog
URL: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.72.29 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

ebbb4aa97840400fa489b0776549879019b7fd903a15ac4b92a40f86140ece1e

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT fra 29 np
date: Mon, 20 Jul 2020 17:30:34 GMT
x-content-type-options: nosniff
last-modified: Tue, 16 Jan 2018 01:57:23 GMT
server: nginx
status: 200
accept-ranges: bytes
vary: Origin
content-type: image/png
access-control-allow-origin: https://pentestlab.wordpress.com
x-orig-src: 01_mogdir
access-control-allow-credentials: true
content-length: 8896
expires: Thu, 13 Aug 2020 13:27:03 GMT

GET
H2 200 word-dde-payload.png
pentestlab.files.wordpress.com/2018/01/ 53 KB
53 KB 33ms
8ms Image
image/png 192.0.72.29
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pentestlab.files.wordpress.com/2018/01/word-dde-payload.png?w=760

Requested by

Host: pentestlab.blog
URL: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.72.29 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

91ecdb29153f8c63536d7e26cb932857670368a4fcadd13f6b77ff617943a1b4

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT fra 29 np
date: Mon, 20 Jul 2020 17:30:34 GMT
x-content-type-options: nosniff
last-modified: Tue, 16 Jan 2018 02:00:08 GMT
server: nginx
status: 200
accept-ranges: bytes
vary: Accept, Origin
content-type: image/png
access-control-allow-origin: https://pentestlab.wordpress.com
x-orig-src: 0_imageresize
access-control-allow-credentials: true
content-length: 54572
expires: Fri, 07 Aug 2020 05:11:46 GMT

GET
H2 200 word-dde-via-macro.png
pentestlab.files.wordpress.com/2018/01/ 64 KB
64 KB 58ms
33ms Image
image/png 192.0.72.29
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pentestlab.files.wordpress.com/2018/01/word-dde-via-macro.png?w=760

Requested by

Host: pentestlab.blog
URL: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.72.29 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

cd55789a6791eec8aaefa58a0cf56e7e8b4cf4cb0ab14d7a62b4596aa52ea397

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT fra 29 np
date: Mon, 20 Jul 2020 17:30:34 GMT
x-content-type-options: nosniff
last-modified: Mon, 15 Jan 2018 00:31:19 GMT
server: nginx
status: 200
accept-ranges: bytes
vary: Accept, Origin
content-type: image/png
access-control-allow-origin: https://pentestlab.wordpress.com
x-orig-src: 0_imageresize
access-control-allow-credentials: true
content-length: 65349
expires: Mon, 10 Aug 2020 14:15:20 GMT

GET
H2 200 word-load-dde-payload-from-another-document.png
pentestlab.files.wordpress.com/2018/01/ 29 KB
29 KB 33ms
8ms Image
image/png 192.0.72.29
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pentestlab.files.wordpress.com/2018/01/word-load-dde-payload-from-another-document.png?w=760

Requested by

Host: pentestlab.blog
URL: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.72.29 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

571e5ca33ec03b69193f60cd340a69825b012754ddb1b7f1d2af7c6ebbe23ee1

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT fra 29 np
date: Mon, 20 Jul 2020 17:30:34 GMT
x-content-type-options: nosniff
last-modified: Tue, 16 Jan 2018 02:50:39 GMT
server: nginx
status: 200
accept-ranges: bytes
vary: Accept, Origin
content-type: image/png
access-control-allow-origin: https://pentestlab.wordpress.com
x-orig-src: 0_imageresize
access-control-allow-credentials: true
content-length: 29262
expires: Mon, 03 Aug 2020 04:14:14 GMT

GET
H2 200 excel-dde-command.png
pentestlab.files.wordpress.com/2018/01/ 9 KB
9 KB 214ms
190ms Image
image/png 192.0.72.29
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pentestlab.files.wordpress.com/2018/01/excel-dde-command.png

Requested by

Host: pentestlab.blog
URL: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.72.29 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

fb4c6ee2e98a83d8fcc4dfb630b8a17ac4468e76f9b3e69e57788843af8ad8ab

Security Headers

Name	Value
X-Content-Type-Options	nosniff, nosniff, nosniff

Request headers

Referer: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: EXPIRED fra 29 np
date: Mon, 20 Jul 2020 17:30:34 GMT
x-content-type-options: nosniff, nosniff, nosniff
last-modified: Sun, 14 Jan 2018 23:45:37 GMT
server: nginx
status: 200
x-orig-src: 01_mogdir
content-type: image/png
access-control-allow-origin: https://pentestlab.wordpress.com
access-control-allow-credentials: true
accept-ranges: bytes
vary: Origin
content-length: 9596
expires: Sat, 22 Aug 2020 05:46:21 GMT

GET
H2 200 excel-dde-dialog-box.png
pentestlab.files.wordpress.com/2018/01/ 28 KB
29 KB 38ms
14ms Image
image/png 192.0.72.29
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pentestlab.files.wordpress.com/2018/01/excel-dde-dialog-box.png?w=760

Requested by

Host: pentestlab.blog
URL: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.72.29 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

a2e62af5d781f00c62cd01e38c858476f83863c9840c6849606118d2f059ad74

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT fra 29 np
date: Mon, 20 Jul 2020 17:30:34 GMT
x-content-type-options: nosniff
last-modified: Sun, 14 Jan 2018 23:46:50 GMT
server: nginx
status: 200
accept-ranges: bytes
vary: Accept, Origin
content-type: image/png
access-control-allow-origin: https://pentestlab.wordpress.com
x-orig-src: 0_imageresize
access-control-allow-credentials: true
content-length: 29120
expires: Sat, 08 Aug 2020 05:18:44 GMT

GET
H2 200 excel-dde-2nd-command.png
pentestlab.files.wordpress.com/2018/01/ 79 KB
79 KB 32ms
30ms Image
image/png 192.0.72.29
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pentestlab.files.wordpress.com/2018/01/excel-dde-2nd-command.png?w=760

Requested by

Host: pentestlab.blog
URL: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.72.29 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

1c5e9c9b3a7288ebfc739b0dd1c4a874fa7621bfdece74b86379f69173818e5f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT fra 29 np
date: Mon, 20 Jul 2020 17:30:34 GMT
x-content-type-options: nosniff
last-modified: Sun, 14 Jan 2018 23:47:28 GMT
server: nginx
status: 200
accept-ranges: bytes
vary: Accept, Origin
content-type: image/png
access-control-allow-origin: https://pentestlab.wordpress.com
x-orig-src: 0_imageresize
access-control-allow-credentials: true
content-length: 80680
expires: Wed, 12 Aug 2020 04:46:05 GMT

GET
H2 200 outlook-message-dde-payload.png
pentestlab.files.wordpress.com/2018/01/ 47 KB
47 KB 23ms
22ms Image
image/png 192.0.72.29
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pentestlab.files.wordpress.com/2018/01/outlook-message-dde-payload.png

Requested by

Host: pentestlab.blog
URL: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.72.29 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

3926b6601949fca7a0a863fdfbc49b17f628db8cf02af287ba00ece2ea348459

Security Headers

Name	Value
X-Content-Type-Options	nosniff, nosniff, nosniff

Request headers

Referer: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT fra 29 np
date: Mon, 20 Jul 2020 17:30:34 GMT
x-content-type-options: nosniff, nosniff, nosniff
last-modified: Tue, 16 Jan 2018 00:28:02 GMT
server: nginx
status: 200
x-orig-src: 01_mogdir
content-type: image/png
access-control-allow-origin: https://pentestlab.wordpress.com
access-control-allow-credentials: true
accept-ranges: bytes
vary: Origin
content-length: 48126
expires: Mon, 17 Aug 2020 15:46:15 GMT

GET
H2 200 outlook-message-dde-in-rich-text.png
pentestlab.files.wordpress.com/2018/01/ 12 KB
13 KB 26ms
25ms Image
image/png 192.0.72.29
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pentestlab.files.wordpress.com/2018/01/outlook-message-dde-in-rich-text.png

Requested by

Host: pentestlab.blog
URL: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.72.29 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

3ded10a28701c6597e11c913d5653c967d29a6efae0c07a8964ad9368c2fdef0

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT fra 29 np
date: Mon, 20 Jul 2020 17:30:34 GMT
x-content-type-options: nosniff
last-modified: Tue, 16 Jan 2018 00:38:54 GMT
server: nginx
status: 200
accept-ranges: bytes
vary: Origin
content-type: image/png
access-control-allow-origin: https://pentestlab.wordpress.com
x-orig-src: 01_mogdir
access-control-allow-credentials: true
content-length: 12763
expires: Fri, 31 Jul 2020 20:48:44 GMT

GET
H2 200 outlook-message-rtf-email-message.png
pentestlab.files.wordpress.com/2018/01/ 4 KB
5 KB 25ms
25ms Image
image/png 192.0.72.29
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pentestlab.files.wordpress.com/2018/01/outlook-message-rtf-email-message.png

Requested by

Host: pentestlab.blog
URL: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.72.29 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

0b90f8d797485c8dfdcec97343f1e907b35106eae14a78eb1f49f7c5fc8b119d

Security Headers

Name	Value
X-Content-Type-Options	nosniff, nosniff, nosniff

Request headers

Referer: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT fra 29 np
date: Mon, 20 Jul 2020 17:30:34 GMT
x-content-type-options: nosniff, nosniff, nosniff
last-modified: Tue, 16 Jan 2018 00:40:47 GMT
server: nginx
status: 200
x-orig-src: 01_mogdir
content-type: image/png
access-control-allow-origin: https://pentestlab.wordpress.com
access-control-allow-credentials: true
accept-ranges: bytes
vary: Origin
content-length: 4569
expires: Sun, 16 Aug 2020 07:26:44 GMT

GET
H2 200 outlook-dde-payload-in-contact-notes.png
pentestlab.files.wordpress.com/2018/01/ 21 KB
21 KB 26ms
25ms Image
image/png 192.0.72.29
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pentestlab.files.wordpress.com/2018/01/outlook-dde-payload-in-contact-notes.png?w=760

Requested by

Host: pentestlab.blog
URL: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.72.29 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

894828fb9f227c2b0808b1fb6b7450d3c1836da06fd4887f7b05c5da6cd698c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT fra 29 np
date: Mon, 20 Jul 2020 17:30:34 GMT
x-content-type-options: nosniff
last-modified: Mon, 15 Jan 2018 23:28:30 GMT
server: nginx
status: 200
accept-ranges: bytes
vary: Accept, Origin
content-type: image/png
access-control-allow-origin: https://pentestlab.wordpress.com
x-orig-src: 0_imageresize
access-control-allow-credentials: true
content-length: 21886
expires: Sat, 08 Aug 2020 19:50:42 GMT

GET
H2 200 outlook-foward-contact-with-dde.png
pentestlab.files.wordpress.com/2018/01/ 4 KB
4 KB 31ms
30ms Image
image/png 192.0.72.29
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pentestlab.files.wordpress.com/2018/01/outlook-foward-contact-with-dde.png

Requested by

Host: pentestlab.blog
URL: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.72.29 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

b3bad6d06e32ad2814b5c6d7c374339affbb945923b2c4d592840cd9b52cab90

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT fra 29 np
date: Mon, 20 Jul 2020 17:30:34 GMT
x-content-type-options: nosniff
last-modified: Mon, 15 Jan 2018 23:30:22 GMT
server: nginx
status: 200
accept-ranges: bytes
vary: Origin
content-type: image/png
access-control-allow-origin: https://pentestlab.wordpress.com
x-orig-src: 01_mogdir
access-control-allow-credentials: true
content-length: 3903
expires: Tue, 11 Aug 2020 03:17:57 GMT

GET
H2 200 outlook-dde-execution.png
pentestlab.files.wordpress.com/2018/01/ 35 KB
35 KB 26ms
25ms Image
image/png 192.0.72.29
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pentestlab.files.wordpress.com/2018/01/outlook-dde-execution.png

Requested by

Host: pentestlab.blog
URL: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.72.29 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

f11cfaacd0126c09f533b25a2723a29ecc53d8524037fc7c29a89150bd1b9440

Security Headers

Name	Value
X-Content-Type-Options	nosniff, nosniff, nosniff

Request headers

Referer: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT fra 29 np
date: Mon, 20 Jul 2020 17:30:34 GMT
x-content-type-options: nosniff, nosniff, nosniff
last-modified: Mon, 15 Jan 2018 23:31:33 GMT
server: nginx
status: 200
x-orig-src: 01_mogdir
content-type: image/png
access-control-allow-origin: https://pentestlab.wordpress.com
access-control-allow-credentials: true
accept-ranges: bytes
vary: Origin
content-length: 35569
expires: Sun, 09 Aug 2020 10:11:07 GMT

GET
H2 200 outlook-dde-via-calendar-invitations.png
pentestlab.files.wordpress.com/2018/01/ 33 KB
33 KB 28ms
27ms Image
image/png 192.0.72.29
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pentestlab.files.wordpress.com/2018/01/outlook-dde-via-calendar-invitations.png

Requested by

Host: pentestlab.blog
URL: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.72.29 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

eb9e489b0b3ccca9ea5a5753c98df13ce2ffda679883f8159a288c798ae4ae75

Security Headers

Name	Value
X-Content-Type-Options	nosniff, nosniff, nosniff

Request headers

Referer: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT fra 29 np
date: Mon, 20 Jul 2020 17:30:34 GMT
x-content-type-options: nosniff, nosniff, nosniff
last-modified: Mon, 15 Jan 2018 23:50:43 GMT
server: nginx
status: 200
x-orig-src: 01_mogdir
content-type: image/png
access-control-allow-origin: https://pentestlab.wordpress.com
access-control-allow-credentials: true
accept-ranges: bytes
vary: Origin
content-length: 33563
expires: Thu, 20 Aug 2020 10:54:29 GMT

GET
H2 200 webfont.js Show response
s0.wp.com/wp-content/plugins/custom-fonts/js/ 12 KB
5 KB 8ms
7ms Script
application/x-javascript 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/wp-content/plugins/custom-fonts/js/webfont.js
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: cb8943abdc046f98c2a74cbe013552f1ed2a5746fd76546ed63f60d32dd83615

Request headers

Referer: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT fra 2
date: Mon, 20 Jul 2020 17:30:34 GMT
content-encoding: gzip
server: nginx
etag: W/"5867460b-30cd"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=31536000
x-ac: 4.fra _dfw
expires: Sat, 21 Nov 2020 08:30:14 GMT

GET
H2 200 wp-emoji-release.min.js Show response
s0.wp.com/wp-includes/js/ 14 KB
5 KB 9ms
8ms Script
application/javascript 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/wp-includes/js/wp-emoji-release.min.js?m=1582709031h&ver=5.4.2
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 96d33f532112177ede6bf262dcf6d0140dbe29f05a4595d17b0be4743205b5ea

Request headers

Referer: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT fra 2
date: Mon, 20 Jul 2020 17:30:34 GMT
content-encoding: gzip
server: nginx
etag: W/"5e563936-364d"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: max-age=31536000
x-ac: 4.fra _dfw
expires: Fri, 11 Jun 2021 12:55:16 GMT

GET
H2 200 header.jpg
s0.wp.com/wp-content/themes/premium/thefour/img/ 200 KB
200 KB 8ms
8ms Image
image/jpeg 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s0.wp.com/wp-content/themes/premium/thefour/img/header.jpg
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1f16434d944a6e996c5b5bf08d9061ee33eaf68dbd2f4f8f786e159f7dc5cae6

Request headers

Referer: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT fra 2
date: Mon, 20 Jul 2020 17:30:34 GMT
x-ac: 4.fra _dfw
last-modified: Thu, 08 Dec 2016 06:33:13 GMT
server: nginx
etag: "5848fea9-31e2d"
content-type: image/jpeg
status: 200
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 204333
expires: Sat, 21 Nov 2020 09:22:22 GMT

GET
H2 200 JTURjIg1_i6t8kCHKm45_ZpC3gnD_vx3rCs.woff2
fonts.gstatic.com/s/montserrat/v14/ 13 KB
13 KB 8ms
6ms Font
font/woff2 2a00:1450:4001:81d::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/montserrat/v14/JTURjIg1_i6t8kCHKm45_ZpC3gnD_vx3rCs.woff2

Requested by

Host: pentestlab.blog
URL: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cedb226bd7759d04b58baa1a609e1aeecc1aa5c6c3280c4db153019f426f3de0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://fonts.googleapis.com/css?family=Open%2BSans%3A400%2C400italic%2C700%2C700italic%7CMontserrat%3A500&subset=latin%2Clatin-ext&ver=5.4.2
Origin: https://pentestlab.blog

Response headers

date: Thu, 16 Jul 2020 15:18:32 GMT
x-content-type-options: nosniff
last-modified: Tue, 23 Jul 2019 03:46:41 GMT
server: sffe
age: 353522
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13640
x-xss-protection: 0
expires: Fri, 16 Jul 2021 15:18:32 GMT

GET
DATA 200
OK truncated
/ 7 KB
7 KB Font
application/font-woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5e7d52bf5f53348ca036d8381f04bb01c93b3110ccac87ca3cb75fd1ce0a92c6

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
Origin: https://pentestlab.blog

Response headers

Content-Type: application/font-woff;charset=utf-8

GET
H2 200 54c81b315dfce62b8b0442a232766f2a
2.gravatar.com/avatar/ 3 KB
3 KB 15ms
11ms Image
image/png 2a04:fa87:fffe::c000:4902
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://2.gravatar.com/avatar/54c81b315dfce62b8b0442a232766f2a?s=50&d=identicon&r=G
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: f5114bceac5491c140dfa98f7708a900fa29d619783da4f371f71db619b94854

Request headers

Referer: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT fra 3
date: Mon, 20 Jul 2020 17:30:34 GMT
last-modified: Wed, 11 Jan 1984 08:00:00 GMT
server: nginx
status: 200
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=300
accept-ranges: bytes
link: <https://www.gravatar.com/avatar/54c81b315dfce62b8b0442a232766f2a?s=50&d=identicon&r=G>; rel="canonical"
content-length: 2671
expires: Mon, 20 Jul 2020 17:35:34 GMT

GET
H2 200 768e41a5122765eb8b7c41c12ffbe2de
1.gravatar.com/avatar/ 3 KB
3 KB 10ms
7ms Image
image/png 2a04:fa87:fffe::c000:4902
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://1.gravatar.com/avatar/768e41a5122765eb8b7c41c12ffbe2de?s=50&d=identicon&r=G
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 2eb0d705f21cb8ccbcb2160ba33cc4227db00a161da2165ab05fb78ab3ae8dd0

Request headers

Referer: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT fra 3
date: Mon, 20 Jul 2020 17:30:34 GMT
last-modified: Wed, 11 Jan 1984 08:00:00 GMT
server: nginx
status: 200
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=300
accept-ranges: bytes
link: <https://www.gravatar.com/avatar/768e41a5122765eb8b7c41c12ffbe2de?s=50&d=identicon&r=G>; rel="canonical"
content-length: 3317
expires: Mon, 20 Jul 2020 17:35:34 GMT

GET
H2 200 4605db59f0637ffc3e084bd14d744ff7
1.gravatar.com/avatar/ 2 KB
2 KB 9ms
6ms Image
image/jpeg 2a04:fa87:fffe::c000:4902
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://1.gravatar.com/avatar/4605db59f0637ffc3e084bd14d744ff7?s=50&d=identicon&r=G
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ebf0adb2c0f1cba7c6fff7c7cc42de21930c547599ba51db28d884d2d2e86823

Request headers

Referer: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT fra 3
date: Mon, 20 Jul 2020 17:30:34 GMT
last-modified: Sun, 19 Feb 2012 06:41:30 GMT
server: nginx
status: 200
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=300
content-disposition: inline; filename="4605db59f0637ffc3e084bd14d744ff7.jpeg"
accept-ranges: bytes
link: <https://www.gravatar.com/avatar/4605db59f0637ffc3e084bd14d744ff7?s=50&d=identicon&r=G>; rel="canonical"
content-length: 2220
expires: Mon, 20 Jul 2020 17:35:34 GMT

GET
H2 200 ad516503a11cd5ca435acc9bb6523536
1.gravatar.com/avatar/ 2 KB
2 KB 9ms
7ms Image
image/png 2a04:fa87:fffe::c000:4902
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://1.gravatar.com/avatar/ad516503a11cd5ca435acc9bb6523536?s=25&d=identicon&forcedefault=y&r=G
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: cb3e87ff58a5e66937ffb6013c8265ed549658a4ff59c1f8d8ae193f488390a5

Request headers

Referer: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT fra 3
date: Mon, 20 Jul 2020 17:30:34 GMT
last-modified: Sat, 01 Mar 2008 02:44:06 GMT
server: nginx
status: 200
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=300
accept-ranges: bytes
link: <https://www.gravatar.com/avatar/ad516503a11cd5ca435acc9bb6523536?s=25&d=identicon&forcedefault=y&r=G>; rel="canonical"
content-length: 1792
expires: Mon, 20 Jul 2020 17:35:34 GMT

GET
H2 200 gprofiles.js Show response
0.gravatar.com/js/ 23 KB
7 KB 10ms
7ms Script
application/javascript 2a04:fa87:fffe::c000:4902
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://0.gravatar.com/js/gprofiles.js?ver=202030y
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 3742b8f2006b7a23df3252c615bb113e94f77729ac9cc4b021e35517285cf0c2

Request headers

Referer: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 20 Jul 2020 17:30:34 GMT
content-encoding: gzip
last-modified: Thu, 02 Apr 2020 15:50:36 GMT
server: nginx
etag: W/"5e8609cc-5dea"
content-type: application/javascript
status: 200
cache-control: max-age=604800
expires: Mon, 27 Jul 2020 17:30:34 GMT

GET
H2 200 wpgroho.js Show response
s0.wp.com/wp-content/mu-plugins/gravatar-hovercards/ 582 B
365 B 10ms
8ms Script
application/x-javascript 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/wp-content/mu-plugins/gravatar-hovercards/wpgroho.js?m=1380573781h
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 21c557180f1bd074974eb41ae4228b6aa9c41234ab1729d780bc8f05761110bb

Request headers

Referer: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT fra 2
date: Mon, 20 Jul 2020 17:30:34 GMT
content-encoding: gzip
server: nginx
etag: W/"58674607-2f0"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=31536000
x-ac: 4.fra _dfw
expires: Sat, 21 Nov 2020 08:30:14 GMT

GET
H2 200 / Show response
s0.wp.com/_static/ 42 KB
11 KB 11ms
8ms Script
application/x-javascript 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/_static/??/wp-content/js/jquery/jquery.autoresize.js,/wp-content/mu-plugins/highlander-comments/script.js?m=1573483029j
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 4a82bed4d069950b1f5e43cdfb5b107eee29ee9e60b6363543b3f3ee58e0f558

Request headers

Referer: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT fra 2
date: Mon, 20 Jul 2020 17:30:34 GMT
content-encoding: gzip
last-modified: Mon, 11 Nov 2019 14:37:22 GMT
server: nginx
etag: W/"5dc97222-a830"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=31536000
x-ac: 4.fra _dfw
expires: Tue, 10 Nov 2020 14:37:25 GMT

GET
H2 200 api.js Show response
www.google.com/recaptcha/ 674 B
664 B 17ms
15ms Script
text/javascript 2a00:1450:4001:81c::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api.js?hl=en

Requested by

Host: pentestlab.blog
URL: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

73d19e971e9e9ad4a8ed7181f88487f94eb79aa5a36a829fd4e0870b1cd34b14

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 20 Jul 2020 17:30:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: GSE
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=UTF-8
status: 200
cache-control: private, max-age=300
cross-origin-resource-policy: cross-origin
content-security-policy: frame-ancestors 'self'
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 445
x-xss-protection: 1; mode=block
expires: Mon, 20 Jul 2020 17:30:34 GMT

GET
H2 200 loading.gif
s0.wp.com/wp-content/mu-plugins/post-flair/sharing/images/ 2 KB
3 KB 11ms
9ms Image
image/gif 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s0.wp.com/wp-content/mu-plugins/post-flair/sharing/images/loading.gif
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 3fa54e29f88aee644eaaac38e11681ea07858eb1ea76b1baae12597aae83fe82

Request headers

Referer: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT fra 2
date: Mon, 20 Jul 2020 17:30:34 GMT
x-ac: 4.fra _dfw
last-modified: Mon, 07 Jan 2019 04:58:07 GMT
server: nginx
etag: "5c32dc5f-9e2"
content-type: image/gif
status: 200
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 2530
expires: Sat, 21 Nov 2020 08:30:14 GMT

GET
H/1.1 200
OK widgets.js Show response
platform.twitter.com/ 96 KB
29 KB 8ms
6ms Script
application/javascript 2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets.js?ver=20111117
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (fcn/41A4) /
Resource Hash: 99ab6fd805e3873aa0a5adedd4b27e9c74becff9cd70b5ae1e96d420379736b0

Request headers

Referer: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 20 Jul 2020 17:30:34 GMT
Content-Encoding: gzip
Last-Modified: Tue, 30 Jun 2020 18:28:19 GMT
Server: ECS (fcn/41A4)
Age: 988
Etag: "39da0b876a64ee1b6bc99d214750b9f3+gzip"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: *
Access-Control-Max-Age: 3000
Cache-Control: public, max-age=1800
X-Cache: HIT
Content-Type: application/javascript; charset=utf-8
Content-Length: 28903

GET
H2 200 / Show response
s0.wp.com/_static/ 29 KB
11 KB 10ms
9ms Script
application/x-javascript 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/_static/??-eJzTLy/QTc7PK0nNK9EvyClNz8wr1i+uzCtJrMjITM/IAeKS1CJMEWP94uSizIISoOIM5/yiVL2sYh19yo1yKioFmldcDDTOPtfW0NTcwMjAxNLCNAsAj3M/rw==
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 0d17da85986308697b1090ff212930ec7a871da4bf5a7aa296cc7e6c83318860

Request headers

Referer: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT fra 2
date: Mon, 20 Jul 2020 17:30:34 GMT
content-encoding: gzip
last-modified: Fri, 04 Oct 2019 16:03:14 GMT
server: nginx
etag: W/"5d976d42-73da"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=31536000
x-ac: 4.fra _dfw
expires: Sat, 03 Oct 2020 16:05:07 GMT

GET
H2 200 jetpack-carousel.css
s0.wp.com/wp-content/mu-plugins/carousel/ 23 KB
4 KB 10ms
9ms Stylesheet
text/css 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/wp-content/mu-plugins/carousel/jetpack-carousel.css?m=1592560282h&cssminify=yes
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: cc5635df2454d61df6102853426d79860b19de9f70e961bbb544f5ce67747030

Request headers

Referer: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT fra 2
date: Mon, 20 Jul 2020 17:30:34 GMT
content-encoding: gzip
server: nginx
etag: W/"5eec8aa4-684c"
vary: Accept-Encoding
content-type: text/css
status: 200
cache-control: max-age=31536000
x-ac: 4.fra _dfw
expires: Sat, 19 Jun 2021 09:51:35 GMT

GET
H2 200 css
fonts.googleapis.com/ 8 KB
869 B 23ms
22ms Stylesheet
text/css 2a00:1450:4001:819::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Ubuntu:r,i,b,bi%7CUbuntu:r&subset=latin,latin-ext,latin,latin-ext

Requested by

Host: s0.wp.com
URL: https://s0.wp.com/wp-content/plugins/custom-fonts/js/webfont.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

88b7b8e4a13f6e95686ab47279166b264c5c31efeb1d9d10fb52c2b25b7b38a0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 20 Jul 2020 17:30:34 GMT
server: ESF
date: Mon, 20 Jul 2020 17:30:34 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 20 Jul 2020 17:30:34 GMT

GET
H2 200 fontawesome-webfont.woff2
s0.wp.com/wp-content/themes/premium/thefour/fonts/ 70 KB
70 KB 30ms
12ms Font
application/font-woff2 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/wp-content/themes/premium/thefour/fonts/fontawesome-webfont.woff2?v=4.6.3
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 7dacf83f51179de8d7980a513e67ab3a08f2c6272bb5946df8fd77c0d1763b73

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://s0.wp.com/_static/??-eJyNkEEOwjAMBD9EsCgqEgfEW9LgBlMnruJEhd+TcqkqpMJt15rZg2EajZOYMWbIdwyoMCYMVMJceykJnCr0FTF2QpWA+3rYwW9P84u/4VDMyMVTVJjo5jHXceuwExkM01DD839TxZFlQxVZly3ZoxgWZzNJXBXTs6W0pSbsWHyN/vOVpW5J1s3jnU1LmvFruBzac9scD21zerwB35aTmw==?cssminify=yes
Origin: https://pentestlab.blog

Response headers

x-nc: HIT fra 1
date: Mon, 20 Jul 2020 17:30:34 GMT
x-ac: 4.fra _dfw
last-modified: Mon, 07 Jan 2019 05:01:32 GMT
server: nginx
etag: "5c32dd2c-118d8"
status: 200
access-control-allow-methods: GET, HEAD
content-type: application/font-woff2
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 71896
expires: Sat, 21 Nov 2020 08:34:15 GMT

GET
H2 200 button-back.gif
s0.wp.com/wp-content/mu-plugins/highlander-comments/images/ 1 KB
1 KB 7ms
7ms Image
image/gif 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s0.wp.com/wp-content/mu-plugins/highlander-comments/images/button-back.gif
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 0dab369eac5fd3a06420395d02d292bc3e3ab0bf62add857c72804fd9f4edd35

Request headers

Referer: https://s0.wp.com/wp-content/mu-plugins/highlander-comments/style.css?m=1530132353h&cssminify=yes
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT fra 2
date: Mon, 20 Jul 2020 17:30:34 GMT
x-ac: 4.fra _dfw
last-modified: Mon, 16 May 2016 00:20:34 GMT
server: nginx
etag: "57391252-4d0"
content-type: image/gif
status: 200
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 1232
expires: Sat, 21 Nov 2020 08:30:14 GMT

GET
H2 200 / Show response
s0.wp.com/_static/ 156 KB
41 KB 11ms
9ms Script
application/javascript 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/_static/??-eJyVj+tOwzAMhV+I1FBpCH4gHgWlibe5zQ076TaeHldaJ3FREb/i2Oc7PoZTMS6niqnCKOBxJofl3I1yB19HJUuNKGIP+Mt0fG/Il+vTUZoJT3/KRqzFuskwCn38cI3NlNAOlAQCTSigUMOjTT4gfxfXI2o4KIyRWly++9x4WSmOqdRVT8mF5lWpE5djVFbXl3DpIqWNBNeo8KYGsLcOh5wng3FAv0FZr65msAzRSkXWyuQZmWmJcOv906GyJpEtyFXKaYFu1YbaWc5NMKw3mrWhzGt8edg997vH+/6pHz8B5CPRRw==
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 661207618bf0ab1dd57715db1046c820bb9fa9d5adb5647f48ca5973f6ebd0b2

Request headers

Referer: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT fra 2
date: Mon, 20 Jul 2020 17:30:34 GMT
content-encoding: gzip
last-modified: Fri, 19 Jun 2020 09:51:32 GMT
server: nginx
etag: W/"5eec8aa4-26f81"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: max-age=31536000
x-ac: 4.fra _dfw
expires: Sun, 04 Jul 2021 09:54:41 GMT

GET
H2 200 rating.js Show response
polldaddy.com/js/rating/ 15 KB
4 KB 498ms
163ms Script
application/javascript 192.0.123.249
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://polldaddy.com/js/rating/rating.js?ver=wpcom
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.123.249 Los Angeles, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 753317c58e485fe930390c7d2b9a30e6609a274456a37384506950283004664b

Request headers

Referer: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 20 Jul 2020 17:30:35 GMT
content-encoding: gzip
last-modified: Tue, 18 Feb 2020 17:20:34 GMT
server: nginx
etag: W/"5e4c1ce2-3b42"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: max-age=2592000
expires: Wed, 19 Aug 2020 17:30:35 GMT

GET
H2 200 / Show response
s0.wp.com/_static/ 16 KB
4 KB 11ms
10ms Script
application/x-javascript 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/_static/??/wp-content/mu-plugins/akismet-3.0/_inc/form.js,/wp-content/mu-plugins/post-flair/sharing/sharing.js?m=1564557884j
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: cb2e13c29b37fb7a570930077d89219a3c3060ca1d316e3dce070fe149e46629

Request headers

Referer: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT fra 2
date: Mon, 20 Jul 2020 17:30:34 GMT
content-encoding: gzip
last-modified: Wed, 31 Jul 2019 07:25:45 GMT
server: nginx
etag: W/"5d414279-3f50"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=31536000
x-ac: 4.fra _dfw
expires: Thu, 30 Jul 2020 07:26:09 GMT

GET
H2 200 w.js Show response
stats.wp.com/ 13 KB
5 KB 29ms
11ms Script
application/javascript 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.wp.com/w.js?61
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: f45206737eac638bb52a6adda01ec197e1b62f4e40399fbf2956497308b4b63f

Request headers

Referer: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 20 Jul 2020 17:30:34 GMT
content-encoding: gzip
server: nginx
etag: W/"5e6029bb-4e62"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: max-age=31536000
expires: Thu, 04 Mar 2021 22:24:12 GMT

GET
H2 200 4iCs6KVjbNBYlgoKfw72nU6AFw.woff2
fonts.gstatic.com/s/ubuntu/v14/ 13 KB
14 KB 7ms
6ms Font
font/woff2 2a00:1450:4001:81d::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/ubuntu/v14/4iCs6KVjbNBYlgoKfw72nU6AFw.woff2

Requested by

Host: s0.wp.com
URL: https://s0.wp.com/wp-content/plugins/custom-fonts/js/webfont.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

943a150e9577247cc5e8e493065795ca77a35485b4169f33a4d6f570c209b010

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://fonts.googleapis.com/css?family=Ubuntu:r,i,b,bi%7CUbuntu:r&subset=latin,latin-ext,latin,latin-ext
Origin: https://pentestlab.blog

Response headers

date: Tue, 09 Jun 2020 03:22:38 GMT
x-content-type-options: nosniff
last-modified: Mon, 22 Jul 2019 19:17:45 GMT
server: sffe
age: 3593276
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13720
x-xss-protection: 0
expires: Wed, 09 Jun 2021 03:22:38 GMT

GET
H2 200 4iCu6KVjbNBYlgoKej70l0miFYxn.woff2
fonts.gstatic.com/s/ubuntu/v14/ 14 KB
14 KB 9ms
8ms Font
font/woff2 2a00:1450:4001:81d::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/ubuntu/v14/4iCu6KVjbNBYlgoKej70l0miFYxn.woff2

Requested by

Host: s0.wp.com
URL: https://s0.wp.com/wp-content/plugins/custom-fonts/js/webfont.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

dce569cc963341079475e7e09383868af54d13d40e3e1bb47a50e6e203cacf64

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://fonts.googleapis.com/css?family=Ubuntu:r,i,b,bi%7CUbuntu:r&subset=latin,latin-ext,latin,latin-ext
Origin: https://pentestlab.blog

Response headers

date: Sat, 18 Jul 2020 08:10:22 GMT
x-content-type-options: nosniff
last-modified: Mon, 22 Jul 2019 19:17:28 GMT
server: sffe
age: 206412
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14148
x-xss-protection: 0
expires: Sun, 18 Jul 2021 08:10:22 GMT

GET
H2 200 4iCv6KVjbNBYlgoCxCvjsGyNPYZvgw.woff2
fonts.gstatic.com/s/ubuntu/v14/ 14 KB
14 KB 7ms
7ms Font
font/woff2 2a00:1450:4001:81d::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/ubuntu/v14/4iCv6KVjbNBYlgoCxCvjsGyNPYZvgw.woff2

Requested by

Host: s0.wp.com
URL: https://s0.wp.com/wp-content/plugins/custom-fonts/js/webfont.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

251e8e864140d9a7ceacce3371ff692595dd0a455ad000de4041d8a313618bd7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://fonts.googleapis.com/css?family=Ubuntu:r,i,b,bi%7CUbuntu:r&subset=latin,latin-ext,latin,latin-ext
Origin: https://pentestlab.blog

Response headers

date: Wed, 08 Jul 2020 21:10:50 GMT
x-content-type-options: nosniff
last-modified: Mon, 22 Jul 2019 19:17:48 GMT
server: sffe
age: 1023584
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14096
x-xss-protection: 0
expires: Thu, 08 Jul 2021 21:10:50 GMT

GET
H2 200 4iCp6KVjbNBYlgoKejZPslyPN4FNgYUJ.woff2
fonts.gstatic.com/s/ubuntu/v14/ 15 KB
15 KB 8ms
8ms Font
font/woff2 2a00:1450:4001:81d::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/ubuntu/v14/4iCp6KVjbNBYlgoKejZPslyPN4FNgYUJ.woff2

Requested by

Host: s0.wp.com
URL: https://s0.wp.com/wp-content/plugins/custom-fonts/js/webfont.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e8e24b2d7ac47818c18b9dd522bcf423301a39c6ed5218fe5115d4318fa5d5d4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://fonts.googleapis.com/css?family=Ubuntu:r,i,b,bi%7CUbuntu:r&subset=latin,latin-ext,latin,latin-ext
Origin: https://pentestlab.blog

Response headers

date: Sat, 18 Jul 2020 06:53:35 GMT
x-content-type-options: nosniff
last-modified: Mon, 22 Jul 2019 19:17:53 GMT
server: sffe
age: 211019
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14924
x-xss-protection: 0
expires: Sun, 18 Jul 2021 06:53:35 GMT

GET
H2 200 recaptcha__en.js Show response
www.gstatic.com/recaptcha/releases/6uMSoEJtPugDt7Qm0Uu5iuSY/ 329 KB
130 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:81d::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/6uMSoEJtPugDt7Qm0Uu5iuSY/recaptcha__en.js

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api.js?hl=en

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3c1e9aab62a2c88f24e19bad4bfc936a5c36fbaed957bf9f84a0cd0f17b7f39e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 15 Jul 2020 20:59:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 13 Jul 2020 19:35:16 GMT
server: sffe
age: 419449
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=31536000
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 132946
x-xss-protection: 0
expires: Thu, 15 Jul 2021 20:59:45 GMT

GET
H2 200 shCore.css
s0.wp.com/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/styles/ 5 KB
1 KB 10ms
9ms Stylesheet
text/css 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/styles/shCore.css?ver=3.0.9b
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 508c7309c11430e3d80e2f203836ac3f26ea2ef3127239fa47592661523a94f0

Request headers

Referer: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT fra 2
date: Mon, 20 Jul 2020 17:30:34 GMT
content-encoding: gzip
server: nginx
etag: W/"5c32dc5b-1995"
vary: Accept-Encoding
content-type: text/css
status: 200
cache-control: max-age=31536000
x-ac: 4.fra _dfw
expires: Sat, 21 Nov 2020 08:30:26 GMT

GET
H2 200 shThemeDefault.css
s0.wp.com/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/styles/ 2 KB
510 B 10ms
10ms Stylesheet
text/css 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/styles/shThemeDefault.css?m=1363304414h&ver=3.0.9b
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 923e3009de4c32eb9cad94e6d350b077cb806a3bb02b31fb0595ef3adef0b35c

Request headers

Referer: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT fra 2
date: Mon, 20 Jul 2020 17:30:34 GMT
content-encoding: gzip
server: nginx
etag: W/"5867460d-b3d"
vary: Accept-Encoding
content-type: text/css
status: 200
cache-control: max-age=31536000
x-ac: 4.fra _dfw
expires: Sat, 21 Nov 2020 08:30:26 GMT

GET
H2 200 sdk.js Show response
connect.facebook.net/en_US/ 3 KB
2 KB 8ms
6ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/sdk.js

Requested by

Host: s0.wp.com
URL: https://s0.wp.com/_static/??-eJyVj+tOwzAMhV+I1FBpCH4gHgWlibe5zQ076TaeHldaJ3FREb/i2Oc7PoZTMS6niqnCKOBxJofl3I1yB19HJUuNKGIP+Mt0fG/Il+vTUZoJT3/KRqzFuskwCn38cI3NlNAOlAQCTSigUMOjTT4gfxfXI2o4KIyRWly++9x4WSmOqdRVT8mF5lWpE5djVFbXl3DpIqWNBNeo8KYGsLcOh5wng3FAv0FZr65msAzRSkXWyuQZmWmJcOv906GyJpEtyFXKaYFu1YbaWc5NMKw3mrWhzGt8edg997vH+/6pHz8B5CPRRw==

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

1f14fee85ce10d8c2efa56acd8a8b0ddefce0fcdefb2b7ebbcd51c9136f24a62

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
content-md5: +fkZCvWvAk6zfN6e9lhf9w==
status: 200
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 1780
etag: "3b94aa46d535630b3cb09365d65585b5"
x-fb-debug: GQjn9NjIxhNZODXC7k7A1sAHQCMyiK4yK04WZxhdJaLQdLcjiRg7ueV6h6LExzlSgsVvxVS7n8N8hHkqyYSIFw==
x-fb-trip-id: 664085054
x-fb-content-md5: d4ca5328c678be8c0c8e53864a15de47
x-frame-options: DENY
date: Mon, 20 Jul 2020 17:30:34 GMT
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-FB-Content-MD5
cache-control: public,max-age=1200,stale-while-revalidate=3600
timing-allow-origin: *
expires: Mon, 20 Jul 2020 17:49:52 GMT

GET
H2 200 wpcom-gray-white.png
s0.wp.com/i/logo/ 8 KB
8 KB 8ms
8ms Image
image/png 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s0.wp.com/i/logo/wpcom-gray-white.png
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: c0e93b5ebf107af77d9e7d101d186b3b93e9d5ad4fbb6a74e2dea60173cc04f8

Request headers

Referer: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT fra 2
date: Mon, 20 Jul 2020 17:30:34 GMT
x-ac: 4.fra _dfw
last-modified: Wed, 23 Nov 2016 19:27:32 GMT
server: nginx
etag: "5835eda4-200b"
content-type: image/png
status: 200
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 8203
expires: Sat, 21 Nov 2020 08:30:14 GMT

GET
H2 200 sdk.js Show response
connect.facebook.net/en_US/ 198 KB
60 KB 19ms
6ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/sdk.js?hash=53ba917fefc66ff1f991b783ff69b397&ua=modern_es6

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/sdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

2669c82fbcdafa440499833e51af3790c1d86014b395b8518b0b808a02c79c40

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/
Origin: https://pentestlab.blog

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
content-md5: frl7AswJzTasxdIVNPeesQ==
status: 200
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 61080
etag: "9a681bab83ed8fc6dba33664ee553f29"
x-fb-debug: Aa40W/h/Dl7trUzZ/mXY5cxxE7aQvD/MVC8tj4v8cIewMnUxGmRARqGqs0dLTPtrJt7Ld/lxtKOZjtwonWQKmQ==
x-fb-trip-id: 664085054
x-fb-content-md5: c03596f6c81db119e985db7f3a966bc2
x-frame-options: DENY
date: Mon, 20 Jul 2020 17:30:34 GMT
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-FB-Content-MD5
cache-control: public,max-age=31536000,stale-while-revalidate=3600,immutable
timing-allow-origin: *
expires: Tue, 20 Jul 2021 17:09:13 GMT

GET
H2 200 page.php
www.facebook.com/v2.3/plugins/ Frame 0210 0
0 50ms
49ms Document
text/html 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/v2.3/plugins/page.php?app_id=249643311490&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df197914bfef7a98%26domain%3Dpentestlab.blog%26origin%3Dhttps%253A%252F%252Fpentestlab.blog%252Ff3b533b9ed7e518%26relation%3Dparent.parent&container_width=342&height=432&hide_cover=false&hide_cta=false&href=https%3A%2F%2Fwww.facebook.com%2Fpentestlaboratory%2F&locale=en_US&sdk=joey&show_facepile=true&small_header=false&tabs=false&width=200

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/sdk.js?hash=53ba917fefc66ff1f991b783ff69b397&ua=modern_es6

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: www.facebook.com
:scheme: https
:path: /v2.3/plugins/page.php?app_id=249643311490&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df197914bfef7a98%26domain%3Dpentestlab.blog%26origin%3Dhttps%253A%252F%252Fpentestlab.blog%252Ff3b533b9ed7e518%26relation%3Dparent.parent&container_width=342&height=432&hide_cover=false&hide_cta=false&href=https%3A%2F%2Fwww.facebook.com%2Fpentestlaboratory%2F&locale=en_US&sdk=joey&show_facepile=true&small_header=false&tabs=false&width=200
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/

Response headers

status: 200
cache-control: private, no-cache, no-store, must-revalidate
expires: Sat, 01 Jan 2000 00:00:00 GMT
pragma: no-cache
strict-transport-security: max-age=15552000; preload
content-encoding: br
timing-allow-origin: *
content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;
vary: Accept-Encoding
x-content-type-options: nosniff
facebook-api-version: v3.0
x-xss-protection: 0
content-type: text/html; charset="utf-8"
x-fb-debug: 6xiURgJuAlIINspz2wCAwXX46V4uYfnS3PSCCIQ7XNfsbH9ZLE3aBUsGrsIrsCpTNPRC9KyOn9vRSIDqMyUmJA==
date: Mon, 20 Jul 2020 17:30:34 GMT
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600

GET
H2 200 rate.php Show response
polldaddy.com/ratings/ 1 KB
443 B 188ms
188ms Script
application/javascript 192.0.123.249
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://polldaddy.com/ratings/rate.php?cmd=get&id=5556500&uid=wp-post-13669&item_id=_post_13669
Requested by: Host: polldaddy.com
URL: https://polldaddy.com/js/rating/rating.js?ver=wpcom
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.123.249 Los Angeles, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 8101e8ea0de866a10e1d9ce4e922e415b03260d1f70a8490a698aed98f7a136c

Request headers

Referer: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
date: Mon, 20 Jul 2020 17:30:35 GMT
content-encoding: gzip
server: nginx
content-type: application/javascript
vary: Accept-Encoding
content-language: en

GET
H2 200 master.html
widgets.wp.com/likes/ Frame 812F 0
0 9ms
7ms Document
text/html 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://widgets.wp.com/likes/master.html?ver=20190321
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash

Request headers

:method: GET
:authority: widgets.wp.com
:scheme: https
:path: /likes/master.html?ver=20190321
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/

Response headers

status: 200
server: nginx
date: Mon, 20 Jul 2020 17:30:35 GMT
content-type: text/html
last-modified: Thu, 21 Mar 2019 13:37:08 GMT
vary: Accept-Encoding
etag: W/"5c939384-84e"
content-encoding: gzip
x-ac: 4.fra _dfw
x-nc: HIT fra 2

GET
H2 200 / Show response
pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/ 3 KB
1 KB 245ms
244ms XHR
application/json 192.0.78.25
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/?relatedposts=1

Requested by

Host: s0.wp.com
URL: https://s0.wp.com/_static/??-eJx9jNsKgzAMQH9osSrr0Iexb/ESS6Rpu7aZ7O/Xge7Bh0EgJJxz1BaA3GRlxqTWMk/B+N5XtaaL+gcAk4lDxorJHfDkXUaXvyz7kSyCJIyDKb8SWvyZY4FgxZBLKqItsRmCT/l0na1DWcRaSJQRcKZMzuwx1eiu63Xd9ipEZBL+qS/CreQefG90f63btqlv6wdzkmDG

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.78.25 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

38a6a0edb783c4f72aafcf9bcb304098ec9278c5b8deed85f7d8916d323847d8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-pingback: https://pentestlab.blog/xmlrpc.php
x-hacker: If you're reading this, you should visit automattic.com/jobs and apply to join the fun, mention this header.
date: Mon, 20 Jul 2020 17:30:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: nginx
vary: Accept-Encoding
strict-transport-security: max-age=31536000
content-type: application/json; charset=utf-8
status: 200
x-ac: 3.fra _dfw

GET
H2 200 hovercard.min.css
0.gravatar.com/dist/css/ 8 KB
2 KB 6ms
6ms Stylesheet
text/css 2a04:fa87:fffe::c000:4902
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://0.gravatar.com/dist/css/hovercard.min.css?ver=202030y
Requested by: Host: 0.gravatar.com
URL: https://0.gravatar.com/js/gprofiles.js?ver=202030y
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ba4824bef4054dec92055cf62207b9532823232c0d58f9c31c1213b2eb333ff9

Request headers

Referer: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 20 Jul 2020 17:30:35 GMT
content-encoding: gzip
last-modified: Tue, 24 Mar 2020 12:26:59 GMT
server: nginx
etag: W/"5e79fc93-1fb3"
content-type: text/css
status: 200
cache-control: max-age=604800
expires: Mon, 27 Jul 2020 17:30:35 GMT

GET
H2 200 services.min.css
0.gravatar.com/dist/css/ 3 KB
587 B 7ms
6ms Stylesheet
text/css 2a04:fa87:fffe::c000:4902
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://0.gravatar.com/dist/css/services.min.css?ver=202030y
Requested by: Host: 0.gravatar.com
URL: https://0.gravatar.com/js/gprofiles.js?ver=202030y
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e9fc9b1878db1b13b973252b048d19a17abb34a8da464a552c6d401728ed1e86

Request headers

Referer: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 20 Jul 2020 17:30:35 GMT
content-encoding: gzip
last-modified: Thu, 22 Mar 2018 09:46:04 GMT
server: nginx
etag: W/"5ab37b5c-a54"
content-type: text/css
status: 200
cache-control: max-age=604800
expires: Mon, 27 Jul 2020 17:30:35 GMT

GET
H2 200 count.json Show response
api.pinterest.com/v1/urls/ 121 B
366 B 163ms
142ms Script
application/javascript 23.210.248.189
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://api.pinterest.com/v1/urls/count.json?callback=WPCOMSharing.update_pinterest_count&url=https%3A%2F%2Fpentestlab.blog%2F2018%2F01%2F16%2Fmicrosoft-office-dde-attacks%2F&_=1595266234475

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.210.248.189 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Resource Hash

54164d35fbd144286bcc646f82c14de767b4681f9ae02c8db9cbc3bf00ae2085

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 20 Jul 2020 17:30:35 GMT
x-content-type-options: nosniff
x-cdn: akamai
age: 0
status: 200
content-type: application/javascript
access-control-allow-origin: *
cache-control: private
x-envoy-upstream-service-time: 0
content-length: 121
x-pinterest-rid: 1236964702596558
expires: Mon, 20 Jul 2020 17:45:35 GMT

GET
H2 200 / Show response
graph.facebook.com/ 202 B
335 B 161ms
161ms Script
text/javascript 2a03:2880:f01c:800e:face:b00c:0:2
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://graph.facebook.com/?callback=WPCOMSharing.update_facebook_count&ids=https%3A%2F%2Fpentestlab.blog%2F2018%2F01%2F16%2Fmicrosoft-office-dde-attacks%2F&_=1595266234476

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:800e:face:b00c:0:2 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

d3937cfecb4260d0fa7abc8dbe89b3439b61721031f396032b8246a0d961e4df

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload

Request headers

Referer: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; preload
content-encoding: br
etag: "3c2813fc513304db834e710505ace5bf38f53490"
status: 200
x-fb-rev: 1002392470
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 128
pragma: no-cache
x-fb-debug: W600ItP0nvAnSE07dQBExplHfFdyTcZbXgDxpBD/xbvY9/kxL14dh16EY6aFFrej/qJ7aAVzUVEIeT93kqN2xA==
x-fb-trace-id: E52gpjd6iBH
date: Mon, 20 Jul 2020 17:30:35 GMT
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
x-fb-request-id: A26RlGrFrQlcq01dRkX8Tir
cache-control: private, no-cache, no-store, must-revalidate
facebook-api-version: v3.0
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 g.gif
pixel.wp.com/ 50 B
74 B 9ms
8ms Image
image/gif 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.wp.com/g.gif?v=wpcom-no-pv&x_sharing-count-request=pinterest&r=0.49465279482899915
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

Referer: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
date: Mon, 20 Jul 2020 17:30:35 GMT
cache-control: no-cache
server: nginx
content-length: 50
content-type: image/gif

GET
H2 200 g.gif
pixel.wp.com/ 50 B
115 B 8ms
7ms Image
image/gif 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.wp.com/g.gif?v=wpcom-no-pv&x_sharing-count-request=facebook&r=0.15753283067441037
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

Referer: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
date: Mon, 20 Jul 2020 17:30:35 GMT
cache-control: no-cache
server: nginx
content-length: 50
content-type: image/gif

GET
H/1.1 200
OK widget_iframe.c4b33f07650267db9f8a72eaac551cac.html
platform.twitter.com/widgets/ Frame 11D6 0
0 7ms
6ms Document
text/html 2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets/widget_iframe.c4b33f07650267db9f8a72eaac551cac.html?origin=https%3A%2F%2Fpentestlab.blog
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js?ver=20111117
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (fcn/4192) /
Resource Hash

Request headers

Host: platform.twitter.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/

Response headers

Content-Encoding: gzip
Access-Control-Allow-Methods: GET
Access-Control-Allow-Origin: *
Age: 421599
Cache-Control: public, max-age=315360000
Content-Type: text/html; charset=utf-8
Date: Mon, 20 Jul 2020 17:30:35 GMT
Etag: "9fa476ae827f556d5b037fe43632370d+gzip"
Last-Modified: Tue, 30 Jun 2020 18:26:55 GMT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server: ECS (fcn/4192)
Vary: Accept-Encoding
X-Cache: HIT
Content-Length: 5825

GET
H2 200 page.php
www.facebook.com/v2.3/plugins/ Frame 2BEC 0
0 51ms
51ms Document
text/html 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/v2.3/plugins/page.php?app_id=249643311490&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df1d52a711df9ad4%26domain%3Dpentestlab.blog%26origin%3Dhttps%253A%252F%252Fpentestlab.blog%252Ff3b533b9ed7e518%26relation%3Dparent.parent&container_width=200&height=432&hide_cover=false&hide_cta=false&href=https%3A%2F%2Fwww.facebook.com%2Fpentestlaboratory%2F&locale=en_US&sdk=joey&show_facepile=true&small_header=false&tabs=false&width=200

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/sdk.js?hash=53ba917fefc66ff1f991b783ff69b397&ua=modern_es6

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: www.facebook.com
:scheme: https
:path: /v2.3/plugins/page.php?app_id=249643311490&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df1d52a711df9ad4%26domain%3Dpentestlab.blog%26origin%3Dhttps%253A%252F%252Fpentestlab.blog%252Ff3b533b9ed7e518%26relation%3Dparent.parent&container_width=200&height=432&hide_cover=false&hide_cta=false&href=https%3A%2F%2Fwww.facebook.com%2Fpentestlaboratory%2F&locale=en_US&sdk=joey&show_facepile=true&small_header=false&tabs=false&width=200
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/

Response headers

status: 200
cache-control: private, no-cache, no-store, must-revalidate
expires: Sat, 01 Jan 2000 00:00:00 GMT
pragma: no-cache
strict-transport-security: max-age=15552000; preload
content-encoding: br
timing-allow-origin: *
content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;
vary: Accept-Encoding
x-content-type-options: nosniff
facebook-api-version: v3.0
x-xss-protection: 0
content-type: text/html; charset="utf-8"
x-fb-debug: gJNAJ/ufRLL2C8DDsKqhYDeEA33Q+kwn5UoOvL+WoNuBbQoLrQBFTYbRpi4++RMMker1pMjaUPOpCQuoNhM9MA==
date: Mon, 20 Jul 2020 17:30:35 GMT
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600

GET
H2 200 remote-login.php
r-login.wordpress.com/ Frame 9D97 0
0 180ms
138ms Document
text/html 192.0.78.19
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://r-login.wordpress.com/remote-login.php?wpcom_remote_login=key&origin=aHR0cHM6Ly9wZW50ZXN0bGFiLmJsb2c%3D&wpcomid=32637504&time=1595266234

Requested by

Host: pentestlab.blog
URL: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.78.19 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

:method: GET
:authority: r-login.wordpress.com
:scheme: https
:path: /remote-login.php?wpcom_remote_login=key&origin=aHR0cHM6Ly9wZW50ZXN0bGFiLmJsb2c%3D&wpcomid=32637504&time=1595266234
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/

Response headers

status: 200
server: nginx
date: Mon, 20 Jul 2020 17:30:35 GMT
content-type: text/html; charset=utf-8
vary: Accept-Encoding Cookie
expires: Wed, 11 Jan 1984 05:00:00 GMT
cache-control: no-cache, must-revalidate, max-age=0
content-encoding: gzip
x-ac: 2.fra _dfw
strict-transport-security: max-age=15552000

GET
H2 200 anchor
www.google.com/recaptcha/api2/ Frame 9342 0
0 28ms
27ms Document
text/html 2a00:1450:4001:81c::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LcmyE0UAAAAALID28yVNg7pFCodGaArJzHitez_&co=aHR0cHM6Ly9wZW50ZXN0bGFiLmJsb2c6NDQz&hl=en&type=image&v=6uMSoEJtPugDt7Qm0Uu5iuSY&theme=light&size=normal&cb=srhhea75s7mh

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/6uMSoEJtPugDt7Qm0Uu5iuSY/recaptcha__en.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-+yzBUpbh/mpb4UNhA3pj0A' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/api2/anchor?ar=1&k=6LcmyE0UAAAAALID28yVNg7pFCodGaArJzHitez_&co=aHR0cHM6Ly9wZW50ZXN0bGFiLmJsb2c6NDQz&hl=en&type=image&v=6uMSoEJtPugDt7Qm0Uu5iuSY&theme=light&size=normal&cb=srhhea75s7mh
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/

Response headers

status: 200
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Mon, 20 Jul 2020 17:30:35 GMT
content-security-policy: script-src 'report-sample' 'nonce-+yzBUpbh/mpb4UNhA3pj0A' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 10405
server: GSE
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 g.gif
pixel.wp.com/ 50 B
74 B 33ms
7ms Image
image/gif 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.wp.com/g.gif?x_stats-initial-visibility=visible&v=wpcom-no-pv&rand=0.9616178483141893
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

Referer: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
date: Mon, 20 Jul 2020 17:30:35 GMT
cache-control: no-cache
server: nginx
content-length: 50
content-type: image/gif

GET
H2 200 g.gif
pixel.wp.com/ 50 B
74 B 33ms
8ms Image
image/gif 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.wp.com/g.gif?blog=32637504&v=wpcom&tz=0&user_id=0&post=13669&subd=pentestlab&host=pentestlab.blog&ref=&fcp=558&rand=0.2509768153606895
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

Referer: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
date: Mon, 20 Jul 2020 17:30:35 GMT
cache-control: no-cache
server: nginx
content-length: 50
content-type: image/gif

GET
H2 200 g.gif
pixel.wp.com/ 50 B
74 B 33ms
8ms Image
image/gif 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.wp.com/g.gif?crypt=UE40eW5QN0p8M2Y%2FRE1TaVhzUzFMbjdWNHpwZGhTayxPSUFCMGNrd29%2BSmw0TDhnZmRTK0hlRi9QSGh6bi9GXVhBJWIlZlR5U1JMLU8%2FMkNtblkvY1dzRllmL3pDc1daMWIyayxvaytjJUsudnFyWDA4RlpSSmYuWFd%2BLTA3JmcuM01bZi1WVX5HZXVken4tN21ld3klM0Y0UUh%2Bbys%2Fa35jaWhBV2VncFAuY2h0VkRQS2prSGtwTm56RGZIMFI0bUpRZkFybyxTUD8vNUVbME41OX5oNnV6Y29nQVpLLDdzVGVyJlZpaDRDS0JVJno%2FRHE%2FS3wvWG4ua2RlV1Z8cGVzTissZld6ZHxWeX5rd0h3WGp3SWh8WVRHajJ4TVU5OFl4bjhZXSxnNHFWT1pQRVJocSs4c2JZdEdmVS9MeEMyZkRDSWV%2BTGQvei44ZURqP0FlTHVVLmhwXzlWVkswYS1PQWVTWlBlUEo4a2phUmtxNklh&v=wpcom-no-pv&rand=0.6578222653111216
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

Referer: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
date: Mon, 20 Jul 2020 17:30:35 GMT
cache-control: no-cache
server: nginx
content-length: 50
content-type: image/gif

GET
H/1.1 200
OK button.1378e6a69a23712ca26755ee3c4084b4.js Show response
platform.twitter.com/js/ 7 KB
3 KB 11ms
8ms Script
application/javascript 2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/js/button.1378e6a69a23712ca26755ee3c4084b4.js
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js?ver=20111117
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (fcn/41A4) /
Resource Hash: 01066facadb03ef32ef7506b3dcc6144c8e9da7896c3af0bac25f4b853022b9a

Request headers

Referer: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 20 Jul 2020 17:30:35 GMT
Content-Encoding: gzip
Last-Modified: Tue, 30 Jun 2020 18:26:44 GMT
Server: ECS (fcn/41A4)
Age: 421598
Etag: "16a79eba6d08d31b4b3b907d174f7f97+gzip"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=315360000
X-Cache: HIT
Content-Type: application/javascript; charset=utf-8
Content-Length: 2297

GET
H/1.1 200
OK follow_button.c4b33f07650267db9f8a72eaac551cac.en.html
platform.twitter.com/widgets/ Frame 208B 0
0 7ms
6ms Document
text/html 2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets/follow_button.c4b33f07650267db9f8a72eaac551cac.en.html
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js?ver=20111117
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (fcn/41A4) /
Resource Hash

Request headers

Host: platform.twitter.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/

Response headers

Content-Encoding: gzip
Access-Control-Allow-Methods: GET
Access-Control-Allow-Origin: *
Age: 421598
Cache-Control: public, max-age=315360000
Content-Type: text/html; charset=utf-8
Date: Mon, 20 Jul 2020 17:30:35 GMT
Etag: "14ba4497f9b96d309872e83b6496820b+gzip"
Last-Modified: Tue, 30 Jun 2020 18:26:47 GMT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server: ECS (fcn/41A4)
Vary: Accept-Encoding
X-Cache: HIT
Content-Length: 13696

GET
H2 200 index.html
widgets.wp.com/likes/ Frame 2D79 0
0 7ms
7ms Document
text/html 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://widgets.wp.com/likes/index.html?ver=20190321
Requested by: Host: s0.wp.com
URL: https://s0.wp.com/_static/??-eJx9jNsKgzAMQH9osSrr0Iexb/ESS6Rpu7aZ7O/Xge7Bh0EgJJxz1BaA3GRlxqTWMk/B+N5XtaaL+gcAk4lDxorJHfDkXUaXvyz7kSyCJIyDKb8SWvyZY4FgxZBLKqItsRmCT/l0na1DWcRaSJQRcKZMzuwx1eiu63Xd9ipEZBL+qS/CreQefG90f63btqlv6wdzkmDG
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash

Request headers

:method: GET
:authority: widgets.wp.com
:scheme: https
:path: /likes/index.html?ver=20190321
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/

Response headers

status: 200
server: nginx
date: Mon, 20 Jul 2020 17:30:35 GMT
content-type: text/html
content-length: 126
last-modified: Sat, 23 Dec 2017 00:24:47 GMT
etag: "5a3da24f-7e"
x-ac: 4.fra _dfw
x-nc: HIT fra 2
accept-ranges: bytes

GET
H2 200 star-yellow-sml.png
polldaddy.com/images/ratings/ 3 KB
3 KB 164ms
163ms Image
image/png 192.0.123.249
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://polldaddy.com/images/ratings/star-yellow-sml.png
Requested by: Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/6uMSoEJtPugDt7Qm0Uu5iuSY/recaptcha__en.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.123.249 Los Angeles, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 67f5e3a1fe926d54a765050fbdae81d08d4908c38c3a2340322ec7f5086df9e3

Request headers

Referer: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 20 Jul 2020 17:30:35 GMT
last-modified: Thu, 24 Dec 2015 22:38:23 GMT
server: nginx
etag: "567c73df-c0d"
content-type: image/png
status: 200
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 3085
expires: Wed, 19 Aug 2020 17:30:35 GMT

GET
H2 200 info.png
polldaddy.com/images/ratings/ 1 KB
1 KB 164ms
163ms Image
image/png 192.0.123.249
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://polldaddy.com/images/ratings/info.png
Requested by: Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/6uMSoEJtPugDt7Qm0Uu5iuSY/recaptcha__en.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.123.249 Los Angeles, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 8d1b51a6bcf97a173884161816c19b753e0088a0926148482d8a1f371706c774

Request headers

Referer: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 20 Jul 2020 17:30:35 GMT
last-modified: Thu, 24 Dec 2015 22:38:00 GMT
server: nginx
etag: "567c73c8-4ca"
content-type: image/png
status: 200
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 1226
expires: Wed, 19 Aug 2020 17:30:35 GMT

GET
H2 200 bframe
www.google.com/recaptcha/api2/ Frame 21B2 0
0 16ms
16ms Document
text/html 2a00:1450:4001:81c::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/bframe?hl=en&v=6uMSoEJtPugDt7Qm0Uu5iuSY&k=6LcmyE0UAAAAALID28yVNg7pFCodGaArJzHitez_&cb=1lvpgms5157

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/6uMSoEJtPugDt7Qm0Uu5iuSY/recaptcha__en.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-kU1awXwdPTL9zk95nwQYfg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/api2/bframe?hl=en&v=6uMSoEJtPugDt7Qm0Uu5iuSY&k=6LcmyE0UAAAAALID28yVNg7pFCodGaArJzHitez_&cb=1lvpgms5157
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/

Response headers

status: 200
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Mon, 20 Jul 2020 17:30:35 GMT
content-security-policy: script-src 'report-sample' 'nonce-kU1awXwdPTL9zk95nwQYfg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 1176
server: GSE
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 jot
syndication.twitter.com/i/ 43 B
337 B 130ms
129ms Image
image/gif 104.244.42.72
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://syndication.twitter.com/i/jot?l=%7B%22widget_origin%22%3A%22https%3A%2F%2Fpentestlab.blog%2F2018%2F01%2F16%2Fmicrosoft-office-dde-attacks%2F%22%2C%22widget_frame%22%3Afalse%2C%22widget_site_screen_name%22%3A%22wordpressdotcom%22%2C%22language%22%3A%22en%22%2C%22message%22%3A%22m%3Awithcount%3A%22%2C%22_category_%22%3A%22tfw_client_event%22%2C%22triggered_on%22%3A1595266235578%2C%22dnt%22%3Afalse%2C%22client_version%22%3A%229066bb2%3A1593540614199%22%2C%22format_version%22%3A1%2C%22event_namespace%22%3A%7B%22client%22%3A%22tfw%22%2C%22page%22%3A%22button%22%2C%22section%22%3A%22follow%22%2C%22action%22%3A%22impression%22%7D%7D

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.72 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://pentestlab.blog/2018/01/16/microsoft-office-dde-attacks/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 20 Jul 2020 17:30:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 65
x-xss-protection: 0
x-response-time: 122
pragma: no-cache
last-modified: Mon, 20 Jul 2020 17:30:35 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=631138519
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: 1baa8046a20f0ec9811d825db74f0697
x-transaction: 0063aff50027ce3b
expires: Tue, 31 Mar 1981 05:00:00 GMT

Verdicts & Comments Add Verdict or Comment

101 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://s0.wp.com/_static/??-eJx9jNsKgzAMQH9osSrr0Iexb/ESS6Rpu7aZ7O/Xge7Bh0EgJJxz1BaA3GRlxqTWMk/B+N5XtaaL+gcAk4lDxorJHfDkXUaXvyz7kSyCJIyDKb8SWvyZY4FgxZBLKqItsRmCT/l0na1DWcRaSJQRcKZMzuwx1eiu63Xd9ipEZBL+qS/CreQefG90f63btqlv6wdzkmDG(Line 8) Message: JQMIGRATE: Migrate is installed, version 1.4.1

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

0.gravatar.com
1.gravatar.com
2.gravatar.com
api.pinterest.com
connect.facebook.net
fonts.googleapis.com
fonts.gstatic.com
graph.facebook.com
pentestlab.blog
pentestlab.files.wordpress.com
pixel.wp.com
platform.twitter.com
polldaddy.com
r-login.wordpress.com
s0.wp.com
stats.wp.com
syndication.twitter.com
widgets.wp.com
www.facebook.com
www.google.com
www.gstatic.com
104.244.42.72
192.0.123.249
192.0.72.29
192.0.76.3
192.0.77.32
192.0.78.19
192.0.78.25
23.210.248.189
2606:2800:234:59:254c:406:2366:268c
2a00:1450:4001:819::200a
2a00:1450:4001:81c::2004
2a00:1450:4001:81d::2003
2a03:2880:f01c:800e:face:b00c:0:2
2a03:2880:f01c:8012:face:b00c:0:3
2a03:2880:f11c:8183:face:b00c:0:25de
2a04:fa87:fffe::c000:4902
01066facadb03ef32ef7506b3dcc6144c8e9da7896c3af0bac25f4b853022b9a
0b90f8d797485c8dfdcec97343f1e907b35106eae14a78eb1f49f7c5fc8b119d
0d17da85986308697b1090ff212930ec7a871da4bf5a7aa296cc7e6c83318860
0dab369eac5fd3a06420395d02d292bc3e3ab0bf62add857c72804fd9f4edd35
1c5e9c9b3a7288ebfc739b0dd1c4a874fa7621bfdece74b86379f69173818e5f
1dcec1a3e1b6a6dab5f52e000e5bf5d78eb746ecc818b4e7245748dde5396ae1
1f14fee85ce10d8c2efa56acd8a8b0ddefce0fcdefb2b7ebbcd51c9136f24a62
1f16434d944a6e996c5b5bf08d9061ee33eaf68dbd2f4f8f786e159f7dc5cae6
21c557180f1bd074974eb41ae4228b6aa9c41234ab1729d780bc8f05761110bb
251e8e864140d9a7ceacce3371ff692595dd0a455ad000de4041d8a313618bd7
2669c82fbcdafa440499833e51af3790c1d86014b395b8518b0b808a02c79c40
2a05abeef37f6a78416123e305d4dca2ad43149d7e9b5b2aed69b00bd539b486
2eb0d705f21cb8ccbcb2160ba33cc4227db00a161da2165ab05fb78ab3ae8dd0
3742b8f2006b7a23df3252c615bb113e94f77729ac9cc4b021e35517285cf0c2
38a6a0edb783c4f72aafcf9bcb304098ec9278c5b8deed85f7d8916d323847d8
3926b6601949fca7a0a863fdfbc49b17f628db8cf02af287ba00ece2ea348459
3c1e9aab62a2c88f24e19bad4bfc936a5c36fbaed957bf9f84a0cd0f17b7f39e
3ded10a28701c6597e11c913d5653c967d29a6efae0c07a8964ad9368c2fdef0
3fa54e29f88aee644eaaac38e11681ea07858eb1ea76b1baae12597aae83fe82
4a82bed4d069950b1f5e43cdfb5b107eee29ee9e60b6363543b3f3ee58e0f558
508c7309c11430e3d80e2f203836ac3f26ea2ef3127239fa47592661523a94f0
54164d35fbd144286bcc646f82c14de767b4681f9ae02c8db9cbc3bf00ae2085
571e5ca33ec03b69193f60cd340a69825b012754ddb1b7f1d2af7c6ebbe23ee1
5e7d52bf5f53348ca036d8381f04bb01c93b3110ccac87ca3cb75fd1ce0a92c6
661207618bf0ab1dd57715db1046c820bb9fa9d5adb5647f48ca5973f6ebd0b2
67f5e3a1fe926d54a765050fbdae81d08d4908c38c3a2340322ec7f5086df9e3
72f6111c826a30ccd1f165810abe57ede94f3e780e3cfb3e706cd08ccde1c14e
73d19e971e9e9ad4a8ed7181f88487f94eb79aa5a36a829fd4e0870b1cd34b14
753317c58e485fe930390c7d2b9a30e6609a274456a37384506950283004664b
7dacf83f51179de8d7980a513e67ab3a08f2c6272bb5946df8fd77c0d1763b73
8101e8ea0de866a10e1d9ce4e922e415b03260d1f70a8490a698aed98f7a136c
88b7b8e4a13f6e95686ab47279166b264c5c31efeb1d9d10fb52c2b25b7b38a0
893a7a315254505f93d4c92ada4651a29eab01b5f46047c15ebf8dedca408414
894828fb9f227c2b0808b1fb6b7450d3c1836da06fd4887f7b05c5da6cd698c1
89d01b152beefa0885d7821cea6cc319054d5e272549b004479a6ac81ecafee3
8d1b51a6bcf97a173884161816c19b753e0088a0926148482d8a1f371706c774
91ecdb29153f8c63536d7e26cb932857670368a4fcadd13f6b77ff617943a1b4
923e3009de4c32eb9cad94e6d350b077cb806a3bb02b31fb0595ef3adef0b35c
943a150e9577247cc5e8e493065795ca77a35485b4169f33a4d6f570c209b010
95784f33a6d1aa8f8cfd53db40a8cfb8d1d44c7180062a6ff6212fe6797a62b5
96d33f532112177ede6bf262dcf6d0140dbe29f05a4595d17b0be4743205b5ea
99ab6fd805e3873aa0a5adedd4b27e9c74becff9cd70b5ae1e96d420379736b0
a236159f6444621c00f349c80413f633a690492d637dde74b590e00b7f3f7f50
a2e62af5d781f00c62cd01e38c858476f83863c9840c6849606118d2f059ad74
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
addeb43bc4679efd3c579491a532ef3c0b22395877042df5683e53649a9b9b07
b3bad6d06e32ad2814b5c6d7c374339affbb945923b2c4d592840cd9b52cab90
ba4824bef4054dec92055cf62207b9532823232c0d58f9c31c1213b2eb333ff9
c0e93b5ebf107af77d9e7d101d186b3b93e9d5ad4fbb6a74e2dea60173cc04f8
cb2e13c29b37fb7a570930077d89219a3c3060ca1d316e3dce070fe149e46629
cb3e87ff58a5e66937ffb6013c8265ed549658a4ff59c1f8d8ae193f488390a5
cb8943abdc046f98c2a74cbe013552f1ed2a5746fd76546ed63f60d32dd83615
cc5635df2454d61df6102853426d79860b19de9f70e961bbb544f5ce67747030
cd55789a6791eec8aaefa58a0cf56e7e8b4cf4cb0ab14d7a62b4596aa52ea397
cedb226bd7759d04b58baa1a609e1aeecc1aa5c6c3280c4db153019f426f3de0
d3937cfecb4260d0fa7abc8dbe89b3439b61721031f396032b8246a0d961e4df
d74cd406e1340a9c44419adaa5525d562cfc5647052c3169298b8fe1b39bbbf8
dce569cc963341079475e7e09383868af54d13d40e3e1bb47a50e6e203cacf64
e8e24b2d7ac47818c18b9dd522bcf423301a39c6ed5218fe5115d4318fa5d5d4
e9fc9b1878db1b13b973252b048d19a17abb34a8da464a552c6d401728ed1e86
eb9e489b0b3ccca9ea5a5753c98df13ce2ffda679883f8159a288c798ae4ae75
ebbb4aa97840400fa489b0776549879019b7fd903a15ac4b92a40f86140ece1e
ebf0adb2c0f1cba7c6fff7c7cc42de21930c547599ba51db28d884d2d2e86823
f11cfaacd0126c09f533b25a2723a29ecc53d8524037fc7c29a89150bd1b9440
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1
f45206737eac638bb52a6adda01ec197e1b62f4e40399fbf2956497308b4b63f
f5114bceac5491c140dfa98f7708a900fa29d619783da4f371f71db619b94854
fb4c6ee2e98a83d8fcc4dfb630b8a17ac4468e76f9b3e69e57788843af8ad8ab

pentestlab.blog Open in urlscan Pro 192.0.78.25 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

80 Requests

100 %HTTPS

50 %IPv6

12 Domains

21 Subdomains

17 IPs

4 Countries

1290 kBTransfer

2449 kBSize

0 Cookies

41 Outgoing links

Redirected requests

80 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

pentestlab.blog Open in urlscan Pro
192.0.78.25 Public Scan

Screenshot
Live screenshot

Full Image

80
Requests

100 %
HTTPS

50 %
IPv6

12
Domains

21
Subdomains

17
IPs

4
Countries

1290 kB
Transfer

2449 kB
Size

0
Cookies

80 HTTP transactions
1 data transactions