urlscan.io logo urlscan.io
SecurityTrails logo

www.ired.team Open in urlscan Pro
188.166.160.174  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-...
Effective URL: https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-...
Submission Tags: falconsandbox
Submission: On January 18 via api from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 12 IPs in 3 countries across 11 domains to perform 41 HTTP transactions. The main IP is 188.166.160.174, located in Frankfurt am Main, Germany and belongs to DIGITALOCEAN-ASN, US. The main domain is www.ired.team.
TLS certificate: Issued by R3 on December 21st 2020. Valid for: 3 months.
This is the only time www.ired.team was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 2 188.166.160.174 14061 (DIGITALOC...)
1 2a00:1450:400... 15169 (GOOGLE)
1 2606:4700::68... 13335 (CLOUDFLAR...)
25 2606:4700::68... 13335 (CLOUDFLAR...)
1 2a04:4e42:200... 54113 (FASTLY)
2 2a00:1450:400... 15169 (GOOGLE)
2 2 209.59.132.164 32244 (LIQUIDWEB)
2 72.52.228.51 32244 (LIQUIDWEB)
2 2606:4700::68... 13335 (CLOUDFLAR...)
1 2a00:1450:400... 15169 (GOOGLE)
1 2606:4700:e0:... 13335 (CLOUDFLAR...)
3 2a00:1450:400... 15169 (GOOGLE)
41 12
2    188.166.160.174 (Frankfurt am Main, Germany)

ASN14061 (DIGITALOCEAN-ASN, US)
PTR: eu2-do-fra.blobs.gitbook.me
ired.team
www.ired.team
1    2a00:1450:4001:819::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.googleapis.com
1    2606:4700::6810:7eaf (United States)

ASN13335 (CLOUDFLARENET, US)
unpkg.com
25    2606:4700::6812:86f (United States)

ASN13335 (CLOUDFLARENET, US)
gstatic.gitbook.com
gblobscdn.gitbook.com
app.gitbook.com
www.gitbook.com
1    2a04:4e42:200::621 (Ascension Island)

ASN54113 (FASTLY, US)
polyfill.io
2    2a00:1450:4001:801::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
lh5.googleusercontent.com
2    209.59.132.164 (Lansing, United States)

ASN32244 (LIQUIDWEB, US)
blog.stealthbits.com
2    72.52.228.51 (Lansing, United States)

ASN32244 (LIQUIDWEB, US)
www.stealthbits.com
2    2606:4700::6811:e13f (United States)

ASN13335 (CLOUDFLARENET, US)
miro.medium.com
1    2a00:1450:4001:80b::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.gstatic.com
1    2606:4700:e0::ac40:6502 (United States)

ASN13335 (CLOUDFLARENET, US)
cdn.lr-ingest.io
3    2a00:1450:4001:815::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google-analytics.com
Domain Requested by
16 gblobscdn.gitbook.com www.ired.team
gstatic.gitbook.com
7 gstatic.gitbook.com www.ired.team
gstatic.gitbook.com
3 www.google-analytics.com gstatic.gitbook.com
2 miro.medium.com www.ired.team
2 www.stealthbits.com www.ired.team
2 blog.stealthbits.com 2 redirects
2 lh5.googleusercontent.com www.ired.team
gstatic.gitbook.com
1 www.gitbook.com gstatic.gitbook.com
1 app.gitbook.com gstatic.gitbook.com
1 cdn.lr-ingest.io gstatic.gitbook.com
1 fonts.gstatic.com fonts.googleapis.com
1 polyfill.io www.ired.team
1 unpkg.com www.ired.team
1 fonts.googleapis.com www.ired.team
1 www.ired.team
1 ired.team 1 redirects
41 16

This site contains no links.

Subject Issuer Validity Valid
www.ired.team
R3		 2020-12-21 -
2021-03-21		 3 months crt.sh
upload.video.google.com
GTS CA 1O1		 2020-12-15 -
2021-03-09		 3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2020-08-02 -
2021-08-02		 a year crt.sh
f3.shared.global.fastly.net
GlobalSign CloudSSL CA - SHA256 - G3		 2020-10-26 -
2021-04-17		 6 months crt.sh
*.googleusercontent.com
GTS CA 1O1		 2020-12-15 -
2021-03-09		 3 months crt.sh
stealthbits.com
cPanel, Inc. Certification Authority		 2020-12-24 -
2021-03-24		 3 months crt.sh
medium.com
Cloudflare Inc ECC CA-3		 2021-01-08 -
2021-04-07		 3 months crt.sh
*.gstatic.com
GTS CA 1O1		 2020-12-15 -
2021-03-09		 3 months crt.sh
*.google-analytics.com
GTS CA 1O1		 2020-12-15 -
2021-03-09		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
Frame ID: E5597146AA83124CAC5839346C9E867E
Requests: 41 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. https://ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password... HTTP 302
    https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password... Page URL

Page Statistics

41
Requests

98 %
HTTPS

75 %
IPv6

11
Domains

16
Subdomains

12
IPs

3
Countries

2874 kB
Transfer

7730 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync HTTP 302
    https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 6
  • https://blog.stealthbits.com/wp-content/uploads/2017/07/Mimikatz-Attacks-1.jpg HTTP 302
  • https://www.stealthbits.com/blog/wp-content/uploads/2017/07/Mimikatz-Attacks-1.jpg
Request Chain 33
  • https://blog.stealthbits.com/wp-content/uploads/2017/07/Mimikatz-Attacks-1.jpg HTTP 302
  • https://www.stealthbits.com/blog/wp-content/uploads/2017/07/Mimikatz-Attacks-1.jpg

41 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request dump-password-hashes-from-domain-controller-with-dcsync
www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/
Redirect Chain
  • https://ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
  • https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
2 MB
351 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
188.166.160.174 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
eu2-do-fra.blobs.gitbook.me
Software
/
Resource Hash
b99a8b77dbc42ec79010e6532f36c739177d6bcf05427ff0f9673b56ed1cd1c5

Request headers

:method
GET
:authority
www.ired.team
:scheme
https
:path
/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

age
23226
content-encoding
gzip
content-type
text/html; charset=utf-8
etag
W/"19c2fe-ucXj5KIppxHbowh2lw0DzwAee7E"
last-modified
Sun, 17 Jan 2021 20:26:46 GMT
vary
Accept-Encoding
x-cache
HIT
x-cdn-cache-group
-LFEMnER3fywgFHoroYn
date
Mon, 18 Jan 2021 02:53:52 GMT

Redirect headers

alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
private
content-encoding
gzip
content-security-policy
default-src 'self' gstatic.gitbook.com *.gitbook-staging.com *.gitbook.com *.firebaseio.com wss://*.firebaseio.com *.cloudfunctions.net *.googleapis.com *.gstatic.com data: *.google.com *.github.com *.algolianet.com *.algolia.net sentry.io *.logrocket.io *.lr-ingest.io *.stripe.com *.clearbit.com *.google-analytics.com d3hb14vkzrxvla.cloudfront.net d1j8pt39hxlh3d.cloudfront.net *.iframe.ly blob: cdn.jsdelivr.net cdnjs.cloudflare.com api.amplitude.com https://api.intercom.io https://api-iam.intercom.io https://api-ping.intercom.io https://nexus-websocket-a.intercom.io https://nexus-websocket-b.intercom.io https://nexus-long-poller-a.intercom.io https://nexus-long-poller-b.intercom.io wss://nexus-websocket-a.intercom.io wss://nexus-websocket-b.intercom.io https://uploads.intercomcdn.com https://uploads.intercomusercontent.com https://share.intercom.io https://intercom-sheets.com https://www.intercom-reporting.com https://www.youtube.com https://player.vimeo.com https://fast.wistia.net https://js.intercomcdn.com https://intercom.help; script-src 'self' gstatic.gitbook.com 'unsafe-inline' *.firebaseio.com *.google.com polyfill.io cdn.lr-ingest.io cdn.logrocket.io *.stripe.com *.clearbit.com *.google-analytics.com *.iframe.ly *.gstatic.com cdnjs.cloudflare.com *.intercom.io *.intercomcdn.com gitbookio.github.io https://app.intercom.io https://widget.intercom.io https://js.intercomcdn.com; style-src 'self' gstatic.gitbook.com 'unsafe-inline' fonts.googleapis.com unpkg.com cdnjs.cloudflare.com cdn.jsdelivr.net; img-src * data: blob: https://js.intercomcdn.com https://static.intercomassets.com https://downloads.intercomcdn.com https://uploads.intercomusercontent.com https://gifs.intercomcdn.com https://messenger-apps.intercom.io https://*.intercom-attachments.com; frame-src *; object-src 'none'; child-src 'self' blob:; worker-src 'self' blob:; frame-ancestors https:
content-type
text/html; charset=utf-8
date
Mon, 18 Jan 2021 02:53:52 GMT
function-execution-id
904ecfub8a4u
location
https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
referrer-policy
no-referrer-when-downgrade
server
Google Frontend
strict-transport-security
max-age=31536000; includeSubDomains
vary
Accept-Encoding, Authorization, Cookie, X-CDN-Host, Accept
x-cache
MISS
x-cloud-trace-context
c9601b3c1b8045bfeb4c36404b17ebf7
x-content-type-options
nosniff
x-dns-prefetch-control
off
x-download-options
noopen
x-permitted-cross-domain-policies
none
x-xss-protection
1; mode=block
content-length
165
css
fonts.googleapis.com/ 		2 KB
664 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Source+Code+Pro:500&display=swap
Requested by
Host: www.ired.team
URL: https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:819::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
084337b4bbbd1e1e5f06c0755f0d17421b55f8b9499f4c5244354405fb70cfa6
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Mon, 18 Jan 2021 01:31:47 GMT
server
ESF
date
Mon, 18 Jan 2021 02:53:52 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Mon, 18 Jan 2021 02:53:52 GMT
emojione-sprite-40.min.css
unpkg.com/emojione-assets@4.0.0/sprites/ 		183 KB
14 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://unpkg.com/emojione-assets@4.0.0/sprites/emojione-sprite-40.min.css
Requested by
Host: www.ired.team
URL: https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:7eaf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c5e939d7d3f9c9bfe632d16484c12354fa89a12738f30f738aa81c984e5b9a92
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 18 Jan 2021 02:53:52 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
age
1983368
vary
Accept-Encoding
cf-request-id
07b502d2ef00004a6d8b2df000000001
last-modified
Sat, 26 Oct 1985 08:15:00 GMT
server
cloudflare
etag
W/"2dc7c-MlEndlChcp6B66cJCh5yD8CB/Fo"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/css; charset=utf-8
access-control-allow-origin
*
x-cloud-trace-context
22a561d395b235f9c3e2c0bd377a83e4
cache-control
public, max-age=31536000
cf-ray
613507317d664a6d-FRA
6c3c9dec9383137845be0f0ea2cf1bf4.css
gstatic.gitbook.com/css/ 		1 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://gstatic.gitbook.com/css/6c3c9dec9383137845be0f0ea2cf1bf4.css
Requested by
Host: www.ired.team
URL: https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:86f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c5ff636c13e4983198fbed7d325d1cbafbe544702de06f5874c46e359ce68b43

Request headers

Referer
https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 18 Jan 2021 02:53:52 GMT
content-encoding
gzip
cf-cache-status
HIT
age
1983310
cf-polished
origSize=1701
x-guploader-uploadid
ABg5-UwRbBqrUTgzcypdeEnLLffVrUFlH4Ffm7o_Kq_YTSXWywTO_QDa5W3zu0-BQvy2RezZBILefdfyeqntrV4Fiuc
x-goog-storage-class
STANDARD
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
content-type
text/css
cf-request-id
07b502d30700003240e42c6000000001
expires
Sat, 25 Dec 2021 13:13:54 GMT
last-modified
Thu, 17 Dec 2020 11:33:02 GMT
server
cloudflare
etag
W/"6c3c9dec9383137845be0f0ea2cf1bf4"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
x-goog-hash
crc32c=hL62rA==, md5=bDyd7JODE3hFvg8Oos8b9A==
x-goog-generation
1608204782760602
access-control-allow-origin
*
access-control-expose-headers
Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
cache-control
public, max-age=31536000
x-goog-stored-content-length
1701
cf-ray
61350731af7b3240-FRA
cf-bgj
minify
polyfill.min.js
polyfill.io/v3/ 		72 B
196 B 		Script
General
Check archive.org
Download Go to
Full URL
https://polyfill.io/v3/polyfill.min.js?flags=gated&features=Intl
Requested by
Host: www.ired.team
URL: https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:200::621 , Ascension Island, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
aaecd144d2b8763b2fa5c91f09778294363cef363c10504205f4203922644d11
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubdomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubdomains; preload
content-encoding
br
x-content-type-options
nosniff
content-type
text/javascript; charset=utf-8
age
207441
detected-user-agent
Chrome Mobile/83.0.4103
server-timing
HIT, fastly;desc="Edge time";dur=0, HIT-CLUSTER, fastly;desc="Edge time";dur=1
content-length
74
referrer-policy
origin-when-cross-origin
last-modified
Fri, 15 Jan 2021 13:50:24 GMT
date
Mon, 18 Jan 2021 02:53:52 GMT
access-control-allow-methods
GET,HEAD,OPTIONS
normalized-user-agent
chrome/83.0.0
access-control-allow-origin
*
cache-control
public, s-maxage=31536000, max-age=604800, stale-while-revalidate=604800, stale-if-error=604800
accept-ranges
bytes
timing-allow-origin
*
spaces%2F-LFEMnER3fywgFHoroYn%2Favatar.png
gblobscdn.gitbook.com/ 		28 KB
29 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://gblobscdn.gitbook.com/spaces%2F-LFEMnER3fywgFHoroYn%2Favatar.png?alt=media
Requested by
Host: www.ired.team
URL: https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:86f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
aee2771f5f57ecf568ffffd5c0d0fee81b7fb2b5540e10d856f2462abdbd5f92

Request headers

Referer
https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 18 Jan 2021 02:53:52 GMT
cf-cache-status
HIT
age
6294310
x-guploader-uploadid
ABg5-Uyi4yb6xzxMM2w327T_bM1rD925KiGNS4hflTye11n2aT2qYIBoHaJ5uVZwPi_ZGvAk3DvyTXK_GKBnEy9uCVy38JPavg
x-goog-storage-class
STANDARD
x-goog-metageneration
3
x-goog-stored-content-encoding
identity
content-type
image/png
content-length
29066
cf-request-id
07b502d30c0000324083b83000000001
last-modified
Sat, 08 Sep 2018 20:00:14 GMT
server
cloudflare
etag
"2965c5f978755802debc0291c5574853"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
x-goog-hash
crc32c=ALxBKw==, md5=KWXF+Xh1WALevAKRxVdIUw==
x-goog-generation
1536436814766237
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-goog-stored-content-length
29066
x-goog-meta-firebasestoragedownloadtokens
1910800b-eed5-42ea-b282-39d0660128fe
accept-ranges
bytes
cf-ray
61350731af853240-FRA
expires
Sat, 06 Nov 2021 04:14:37 GMT
photo.jpg
lh5.googleusercontent.com/-BT5DyX_LUys/AAAAAAAAAAI/AAAAAAAAAF4/wkmG-hKpMQk/ 		7 KB
7 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://lh5.googleusercontent.com/-BT5DyX_LUys/AAAAAAAAAAI/AAAAAAAAAF4/wkmG-hKpMQk/photo.jpg
Requested by
Host: www.ired.team
URL: https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
fife /
Resource Hash
3e46dc2084ab2945b5af16a2d88abcd6fa7e8aa5ef5a43fc6c83ce561b6c9577
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 18 Jan 2021 00:44:57 GMT
x-content-type-options
nosniff
age
7735
content-disposition
inline;filename=""
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
6707
x-xss-protection
0
server
fife
etag
"v5e"
vary
Origin
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Content-Length
cache-control
public, max-age=86400, no-transform
timing-allow-origin
*
expires
Wed, 13 Jan 2021 07:45:23 GMT
Mimikatz-Attacks-1.jpg
www.stealthbits.com/blog/wp-content/uploads/2017/07/
Redirect Chain
  • https://blog.stealthbits.com/wp-content/uploads/2017/07/Mimikatz-Attacks-1.jpg
  • https://www.stealthbits.com/blog/wp-content/uploads/2017/07/Mimikatz-Attacks-1.jpg
131 KB
132 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.stealthbits.com/blog/wp-content/uploads/2017/07/Mimikatz-Attacks-1.jpg
Requested by
Host: www.ired.team
URL: https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
72.52.228.51 Lansing, United States, ASN32244 (LIQUIDWEB, US),
Reverse DNS
Software
Apache /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 18 Jan 2021 02:53:54 GMT
referrer-policy
same-origin
last-modified
Tue, 11 Jul 2017 17:05:59 GMT
server
Apache
x-frame-options
SAMEORIGIN
content-type
image/jpeg
x-xss-protection
1; mode=block
cache-control
public
feature-policy
geolocation 'self'; vibrate 'none'
strict-transport-security
max-age=31536000
accept-ranges
bytes
vary
User-Agent
content-length
134298
x-content-type-options
nosniff
expires
Tue, 18 Jan 2022 02:53:54 GMT

Redirect headers

date
Mon, 18 Jan 2021 02:53:54 GMT
server
Apache
x-frame-options
SAMEORIGIN
content-type
text/html; charset=iso-8859-1
location
https://www.stealthbits.com/blog/wp-content/uploads/2017/07/Mimikatz-Attacks-1.jpg
cache-control
max-age=0
content-length
266
expires
Mon, 18 Jan 2021 02:53:54 GMT
0*Icen2GYXvhyUz7Av.PNG
miro.medium.com/max/1200/ 		74 KB
75 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://miro.medium.com/max/1200/0*Icen2GYXvhyUz7Av.PNG
Requested by
Host: www.ired.team
URL: https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:e13f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3da858ea17f1a638cb4fb0d0edbb6328ce601bf698ef58dad130f3b97efccc5
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 18 Jan 2021 02:53:52 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
age
570020
x-envoy-upstream-service-time
69
strict-transport-security
max-age=15552000; includeSubDomains; preload
content-length
75904
cf-request-id
07b502d33d00001f511c0cf000000001
pragma
public
sepia-upstream
medium
server
cloudflare
etag
"16.3"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=2592000
medium-fulfilled-by
miro/main-20201209-194421-2f3bd69bbf
accept-ranges
bytes
cf-ray
61350731ffc81f51-FRA
expires
Wed, 17 Feb 2021 02:53:52 GMT
f4fa50c4003f87e7dc10459e500933c3.woff
gstatic.gitbook.com/fonts/ 		92 KB
93 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://gstatic.gitbook.com/fonts/f4fa50c4003f87e7dc10459e500933c3.woff
Requested by
Host: www.ired.team
URL: https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:86f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3e692de9565d90dd947a080d4d10cee72a83447ba053e08fdcac457d7197128a

Request headers

Origin
https://www.ired.team
Referer
https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 18 Jan 2021 02:53:52 GMT
cf-cache-status
HIT
age
2008322
x-guploader-uploadid
ABg5-UzVRFW5qIke36Qrv68wqfr-LQyKSWZPBWozYVHc4gA8hdpPZUs4046a_ds07mlk8yT7f_bxBjdAV_xxYzFa2E5KXiCiVA
x-goog-storage-class
STANDARD
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
content-type
font/woff
content-length
94368
cf-request-id
07b502d33e00002b953730e000000001
last-modified
Thu, 17 Dec 2020 11:33:02 GMT
server
cloudflare
etag
"f4fa50c4003f87e7dc10459e500933c3"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
x-goog-hash
crc32c=FUjfEA==, md5=9PpQxAA/h+fcEEWeUAkzww==
x-goog-generation
1602258407339499
access-control-allow-origin
*
access-control-expose-headers
Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
cache-control
public, max-age=31536000
x-goog-stored-content-length
94368
accept-ranges
bytes
cf-ray
61350731fa3d2b95-FRA
expires
Sat, 18 Dec 2021 19:02:08 GMT
72e37e5bf95a8dba938c78b1d7d91253.woff
gstatic.gitbook.com/fonts/ 		92 KB
92 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://gstatic.gitbook.com/fonts/72e37e5bf95a8dba938c78b1d7d91253.woff
Requested by
Host: www.ired.team
URL: https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:86f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a18af7799b7d241fe5d00645492ccedcad39815e9f4125b7e3e90b18a1b77405

Request headers

Origin
https://www.ired.team
Referer
https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 18 Jan 2021 02:53:52 GMT
cf-cache-status
HIT
age
2665978
x-guploader-uploadid
ABg5-UzguBzcgPQpqsxkKRSlbiQTLL63Y9DBDsgnVQI06YhZpZKy0FDH-p7dZdonY5SW4zbyIyeA84cEJVPL9leRw0c
x-goog-storage-class
STANDARD
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
content-type
font/woff
content-length
94040
cf-request-id
07b502d33f00002b9543322000000001
last-modified
Fri, 11 Dec 2020 09:44:49 GMT
server
cloudflare
etag
"72e37e5bf95a8dba938c78b1d7d91253"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
x-goog-hash
crc32c=TBIniA==, md5=cuN+W/lajbqTjHix19kSUw==
x-goog-generation
1607679889767722
access-control-allow-origin
*
access-control-expose-headers
Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
cache-control
public, max-age=31536000
x-goog-stored-content-length
94040
accept-ranges
bytes
cf-ray
61350731fa412b95-FRA
expires
Sat, 11 Dec 2021 15:22:28 GMT
fc3d4b35e4d07d4e0485cc2db0e57c77.woff
gstatic.gitbook.com/fonts/ 		92 KB
92 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://gstatic.gitbook.com/fonts/fc3d4b35e4d07d4e0485cc2db0e57c77.woff
Requested by
Host: www.ired.team
URL: https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:86f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b87e90677bdbc3c6bc296a368f57b2d72783c1a7c6e8e9325cd1645c18039cf2

Request headers

Origin
https://www.ired.team
Referer
https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 18 Jan 2021 02:53:52 GMT
cf-cache-status
HIT
age
2008322
x-guploader-uploadid
AEnB2UqsZ3WK_xS0YchRtujyaXSHhWyr8A3u9cWzDfV84KgDBxBluJjubL9gKNbI1STPBxQltx3kLRWA6bEaNRNxSvRzAcBChQ
x-goog-storage-class
STANDARD
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
content-type
font/woff
content-length
93788
cf-request-id
07b502d33f00002b951f2d7000000001
last-modified
Fri, 11 Dec 2020 09:44:49 GMT
server
cloudflare
etag
"fc3d4b35e4d07d4e0485cc2db0e57c77"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
x-goog-hash
crc32c=7TN+QQ==, md5=/D1LNeTQfU4EhcwtsOV8dw==
x-goog-generation
1584024803933768
access-control-allow-origin
*
access-control-expose-headers
Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
cache-control
public, max-age=31536000
x-goog-stored-content-length
93788
accept-ranges
bytes
cf-ray
61350731fa3f2b95-FRA
expires
Sat, 11 Dec 2021 16:43:23 GMT
HI_XiYsKILxRpg3hIP6sJ7fM7PqtzsjDs-cq7Gq0DA.woff2
fonts.gstatic.com/s/sourcecodepro/v13/ 		11 KB
11 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/sourcecodepro/v13/HI_XiYsKILxRpg3hIP6sJ7fM7PqtzsjDs-cq7Gq0DA.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Code+Pro:500&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
59fd4f207936792ab9910baa7df5f1f7bff899e35e0428df34ab9a1319184052
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://www.ired.team
Referer
https://fonts.googleapis.com/css?family=Source+Code+Pro:500&display=swap
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 13 Jan 2021 10:47:55 GMT
x-content-type-options
nosniff
last-modified
Thu, 24 Sep 2020 23:57:48 GMT
server
sffe
age
403557
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
11232
x-xss-protection
0
expires
Thu, 13 Jan 2022 10:47:55 GMT
assets%2F-LFEMnER3fywgFHoroYn%2F-LYHcIL_R4k6YNEXjoex%2F-LYHcll2Cw7RXzll00Y7%2FScreenshot%20from%202019-02-09%2014-18-32.png
gblobscdn.gitbook.com/ 		22 KB
22 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://gblobscdn.gitbook.com/assets%2F-LFEMnER3fywgFHoroYn%2F-LYHcIL_R4k6YNEXjoex%2F-LYHcll2Cw7RXzll00Y7%2FScreenshot%20from%202019-02-09%2014-18-32.png?alt=media&token=db120148-d85d-4401-b8c8-8808844af82e
Requested by
Host: www.ired.team
URL: https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:86f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fd6ed6532676b92d9ef04191bd606d815b885cdcc9f1acc4c75c67eacacb9bc3

Request headers

Referer
https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 18 Jan 2021 02:53:52 GMT
cf-cache-status
HIT
age
490432
x-guploader-uploadid
ABg5-Uz60AxndCfnf3191TBpYR2n2TR0k0NlnKvTfGKFuPOjCr78FZ1dS-kVKl6lDy6AQkr9oFCb3Eoga9J4Y4hnIO5l5_KPPg
x-goog-storage-class
STANDARD
x-goog-metageneration
2
x-goog-stored-content-encoding
identity
content-disposition
inline; filename*=utf-8''Screenshot%20from%202019-02-09%2014-18-32.png
content-type
image/png
content-length
22424
cf-request-id
07b502d392000032406d1a9000000001
last-modified
Sat, 09 Feb 2019 14:39:34 GMT
server
cloudflare
etag
"4acb1bda71b8909c495f56e5fcede96a"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
x-goog-hash
crc32c=kgN2yg==, md5=Sssb2nG4kJxJX1bl/O3pag==
x-goog-generation
1549723174315618
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-goog-stored-content-length
22424
x-goog-meta-firebasestoragedownloadtokens
db120148-d85d-4401-b8c8-8808844af82e
accept-ranges
bytes
cf-ray
61350732882b3240-FRA
expires
Sun, 09 Jan 2022 21:16:16 GMT
assets%2F-LFEMnER3fywgFHoroYn%2F-LYHcIL_R4k6YNEXjoex%2F-LYHcnmhsrPaq84QCCXJ%2FScreenshot%20from%202019-02-09%2014-21-02.png
gblobscdn.gitbook.com/ 		30 KB
31 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://gblobscdn.gitbook.com/assets%2F-LFEMnER3fywgFHoroYn%2F-LYHcIL_R4k6YNEXjoex%2F-LYHcnmhsrPaq84QCCXJ%2FScreenshot%20from%202019-02-09%2014-21-02.png?alt=media&token=fd127c93-66ab-4d13-b4cc-f61645fbb55e
Requested by
Host: www.ired.team
URL: https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:86f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
03b0665e307caf691a7e91427ecd157e8037ef3aeb3e73faad928d67ffe55113

Request headers

Referer
https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 18 Jan 2021 02:53:52 GMT
cf-cache-status
HIT
age
490432
x-guploader-uploadid
ABg5-UzOczP0-LSI4tYIY0qmWZHm23wOLPsfG1mr8mKFfF9p0n3Ob6oY3Y00AT2Vp5QdJfsa7REq3__SKGNxIepzGE4
x-goog-storage-class
STANDARD
x-goog-metageneration
2
x-goog-stored-content-encoding
identity
content-disposition
inline; filename*=utf-8''Screenshot%20from%202019-02-09%2014-21-02.png
content-type
image/png
content-length
30696
cf-request-id
07b502d392000032403d39a000000001
last-modified
Sat, 09 Feb 2019 14:39:34 GMT
server
cloudflare
etag
"3231dc1793ab392f4969a166550dd56e"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
x-goog-hash
crc32c=gffoKA==, md5=MjHcF5OrOS9JaaFmVQ3Vbg==
x-goog-generation
1549723174151198
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-goog-stored-content-length
30696
x-goog-meta-firebasestoragedownloadtokens
fd127c93-66ab-4d13-b4cc-f61645fbb55e
accept-ranges
bytes
cf-ray
61350732882c3240-FRA
expires
Sun, 09 Jan 2022 21:25:48 GMT
assets%2F-LFEMnER3fywgFHoroYn%2F-LYHcIL_R4k6YNEXjoex%2F-LYHcqSVg0P0r8dBLjpC%2FScreenshot%20from%202019-02-09%2014-21-09.png
gblobscdn.gitbook.com/ 		37 KB
38 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://gblobscdn.gitbook.com/assets%2F-LFEMnER3fywgFHoroYn%2F-LYHcIL_R4k6YNEXjoex%2F-LYHcqSVg0P0r8dBLjpC%2FScreenshot%20from%202019-02-09%2014-21-09.png?alt=media&token=0cb494ef-c05f-4b98-9450-9c40d3834c04
Requested by
Host: www.ired.team
URL: https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:86f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
136ce930cd83f459c9528efa1b255d028476ad4638e9f87eafe7ea6df2795521

Request headers

Referer
https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 18 Jan 2021 02:53:52 GMT
cf-cache-status
MISS
x-guploader-uploadid
ABg5-UzyJ6_rH_csWxAzCMcv2Q0Rxelxw74X2Fe3wFjhtjVuE6SnRkLgfY_c7ZidZG18F1TAbctPxjcy2E3ITdl4BdM
x-goog-storage-class
STANDARD
x-goog-metageneration
2
x-goog-stored-content-encoding
identity
content-disposition
inline; filename*=utf-8''Screenshot%20from%202019-02-09%2014-21-09.png
content-type
image/png
content-length
37928
cf-request-id
07b502d39300003240571eb000000001
last-modified
Sat, 09 Feb 2019 14:39:34 GMT
server
cloudflare
etag
"b460d65a660971a5a564b8e0583fcab4"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
x-goog-hash
crc32c=9e2oyQ==, md5=tGDWWmYJcaWlZLjgWD/KtA==
x-goog-generation
1549723174315835
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-goog-stored-content-length
37928
x-goog-meta-firebasestoragedownloadtokens
0cb494ef-c05f-4b98-9450-9c40d3834c04
accept-ranges
bytes
cf-ray
61350732882d3240-FRA
expires
Tue, 18 Jan 2022 02:53:52 GMT
assets%2F-LFEMnER3fywgFHoroYn%2F-LYHcIL_R4k6YNEXjoex%2F-LYHeE3F5dXK_ePCdQJH%2FScreenshot%20from%202019-02-09%2014-28-18.png
gblobscdn.gitbook.com/ 		6 KB
7 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://gblobscdn.gitbook.com/assets%2F-LFEMnER3fywgFHoroYn%2F-LYHcIL_R4k6YNEXjoex%2F-LYHeE3F5dXK_ePCdQJH%2FScreenshot%20from%202019-02-09%2014-28-18.png?alt=media&token=682c2b70-15cf-4243-897d-07a50dcb60ce
Requested by
Host: www.ired.team
URL: https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:86f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3e8a9ea983c768e3924813f0f562c7a0eb02425e282d3d91e64ffd5c0c24e2d8

Request headers

Referer
https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 18 Jan 2021 02:53:52 GMT
cf-cache-status
HIT
age
490432
x-guploader-uploadid
ABg5-Uwanfw5u7XDzz4PuhT74yi13JGR_K88gSXPb-jIi9UgOu2yiedkA2nyhl_55J_8JefzungJp8zbYk08drBTNr2eH8QhMw
x-goog-storage-class
STANDARD
x-goog-metageneration
2
x-goog-stored-content-encoding
identity
content-disposition
inline; filename*=utf-8''Screenshot%20from%202019-02-09%2014-28-18.png
content-type
image/png
content-length
6335
cf-request-id
07b502d393000032408614a000000001
last-modified
Sat, 09 Feb 2019 14:39:34 GMT
server
cloudflare
etag
"3bd8990e69e8b5900d577fcb72e07a74"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
x-goog-hash
crc32c=k59gxw==, md5=O9iZDmnotZANV3/LcuB6dA==
x-goog-generation
1549723174278644
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-goog-stored-content-length
6335
x-goog-meta-firebasestoragedownloadtokens
682c2b70-15cf-4243-897d-07a50dcb60ce
accept-ranges
bytes
cf-ray
61350732882e3240-FRA
expires
Tue, 11 Jan 2022 18:44:25 GMT
assets%2F-LFEMnER3fywgFHoroYn%2F-LYHcIL_R4k6YNEXjoex%2F-LYHeGTSUXeuBes1DUA8%2FScreenshot%20from%202019-02-09%2014-27-54.png
gblobscdn.gitbook.com/ 		93 KB
93 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://gblobscdn.gitbook.com/assets%2F-LFEMnER3fywgFHoroYn%2F-LYHcIL_R4k6YNEXjoex%2F-LYHeGTSUXeuBes1DUA8%2FScreenshot%20from%202019-02-09%2014-27-54.png?alt=media&token=69793e54-eccd-4592-9c37-dd3953c91345
Requested by
Host: www.ired.team
URL: https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:86f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
34d111f20960b8fbe1ebf0be28b3a67ae36c01e0dfd7a22ab3ebdfda3a40dbfc

Request headers

Referer
https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 18 Jan 2021 02:53:52 GMT
cf-cache-status
HIT
age
490432
x-guploader-uploadid
ABg5-UyGgNKm1MotpgHOHIyX81Ym4hJxygCjMAvgWtXQo0JMbUmOLpBnWHa86RYyHjTa5xuUE0SIUv_tXGrFXAJjKDc
x-goog-storage-class
STANDARD
x-goog-metageneration
2
x-goog-stored-content-encoding
identity
content-disposition
inline; filename*=utf-8''Screenshot%20from%202019-02-09%2014-27-54.png
content-type
image/png
content-length
94853
cf-request-id
07b502d393000032403a349000000001
last-modified
Sat, 09 Feb 2019 14:39:34 GMT
server
cloudflare
etag
"44ed3e6f94392a62fd069e1273546e2d"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
x-goog-hash
crc32c=z8GiyQ==, md5=RO0+b5Q5KmL9Bp4Sc1RuLQ==
x-goog-generation
1549723174933629
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-goog-stored-content-length
94853
x-goog-meta-firebasestoragedownloadtokens
69793e54-eccd-4592-9c37-dd3953c91345
accept-ranges
bytes
cf-ray
61350732882f3240-FRA
expires
Wed, 12 Jan 2022 10:40:00 GMT
assets%2F-LFEMnER3fywgFHoroYn%2F-LYHn7bhLyxbOjA7EU9M%2F-LYHo8SqVwHexwGHFRIn%2FScreenshot%20from%202019-02-09%2015-11-36.png
gblobscdn.gitbook.com/ 		47 KB
47 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://gblobscdn.gitbook.com/assets%2F-LFEMnER3fywgFHoroYn%2F-LYHn7bhLyxbOjA7EU9M%2F-LYHo8SqVwHexwGHFRIn%2FScreenshot%20from%202019-02-09%2015-11-36.png?alt=media&token=82b495d7-34fe-41c1-a296-8f802dbb660f
Requested by
Host: www.ired.team
URL: https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:86f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
eb470d0e44fc9ea031dff6615f4dcf8f460cc71c4603dbe9abd583cc3bb034cf

Request headers

Referer
https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 18 Jan 2021 02:53:52 GMT
cf-cache-status
MISS
x-guploader-uploadid
ABg5-UzNCyqm3pLwkFNCD5jwLe2ncIVTKX7Ppu4KtqTAo5MRb-2YkwfcKn4LSGwvaLJdsar4g4f2_7IIp63omejT372emt6cyA
x-goog-storage-class
STANDARD
x-goog-metageneration
2
x-goog-stored-content-encoding
identity
content-disposition
inline; filename*=utf-8''Screenshot%20from%202019-02-09%2015-11-36.png
content-type
image/png
content-length
47701
cf-request-id
07b502d393000032407335c000000001
last-modified
Sat, 09 Feb 2019 15:13:51 GMT
server
cloudflare
etag
"d86aebfc9eb6e46dc89fbc8e76a5f171"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
x-goog-hash
crc32c=30HShA==, md5=2Grr/J625G3In7yOdqXxcQ==
x-goog-generation
1549725231705609
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-goog-stored-content-length
47701
x-goog-meta-firebasestoragedownloadtokens
82b495d7-34fe-41c1-a296-8f802dbb660f
accept-ranges
bytes
cf-ray
6135073288303240-FRA
expires
Tue, 18 Jan 2022 02:53:52 GMT
assets%2F-LFEMnER3fywgFHoroYn%2F-LYHcIL_R4k6YNEXjoex%2F-LYHfiPA13UOQiYsWHVT%2FScreenshot%20from%202019-02-09%2014-34-44.png
gblobscdn.gitbook.com/ 		86 KB
87 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://gblobscdn.gitbook.com/assets%2F-LFEMnER3fywgFHoroYn%2F-LYHcIL_R4k6YNEXjoex%2F-LYHfiPA13UOQiYsWHVT%2FScreenshot%20from%202019-02-09%2014-34-44.png?alt=media&token=1b755cd8-e2d9-45e4-9b25-72f58955065c
Requested by
Host: www.ired.team
URL: https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:86f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8beb5465b2abd6a7b77922b8ee2db26b06cac44607544aa47a07aa5501158969

Request headers

Referer
https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 18 Jan 2021 02:53:52 GMT
cf-cache-status
HIT
age
490423
x-guploader-uploadid
ABg5-UyF_czSpvHfxAX2YiAkabLcjGYKzwFH6yjBnaViKg7Mgj6qyMgzA-IdPq5W_JjAd8Kch63LszuZPabl4-31L70
x-goog-storage-class
STANDARD
x-goog-metageneration
2
x-goog-stored-content-encoding
identity
content-disposition
inline; filename*=utf-8''Screenshot%20from%202019-02-09%2014-34-44.png
content-type
image/png
content-length
88354
cf-request-id
07b502d3ac00003240213f3000000001
last-modified
Sat, 09 Feb 2019 14:39:34 GMT
server
cloudflare
etag
"c61020e42bbd137a5a629ad410262cf7"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
x-goog-hash
crc32c=LOeygg==, md5=xhAg5Cu9E3paYprUECYs9w==
x-goog-generation
1549723174810591
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-goog-stored-content-length
88354
x-goog-meta-firebasestoragedownloadtokens
1b755cd8-e2d9-45e4-9b25-72f58955065c
accept-ranges
bytes
cf-ray
61350732a8543240-FRA
expires
Sun, 09 Jan 2022 21:16:18 GMT
111.49fd34a8.js
gstatic.gitbook.com/js/ 		3 MB
944 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://gstatic.gitbook.com/js/111.49fd34a8.js
Requested by
Host: www.ired.team
URL: https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:86f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Origin
https://www.ired.team
Referer
https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 18 Jan 2021 02:53:52 GMT
content-encoding
gzip
cf-cache-status
HIT
age
3930751
cf-polished
origSize=3417393
x-guploader-uploadid
ABg5-UzBG2XH8u8q54myIm_kvdh-rYsQTY00SBdZ6IKKNuGk_h6osZyPVBFPmgwEohDJmJZ9DArkt2pXFvdBQ8fzaJyxyHQC1A
x-goog-storage-class
STANDARD
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
content-type
application/javascript
cf-request-id
07b502d3db00002b954b26a000000001
expires
Fri, 03 Dec 2021 13:44:45 GMT
last-modified
Thu, 03 Dec 2020 13:42:02 GMT
server
cloudflare
etag
W/"a5ffba961d9b3db89f271e8280d5191b"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
x-goog-hash
crc32c=C2fKZQ==, md5=pf+6lh2bPbifJx6CgNUZGw==
x-goog-generation
1607002922242339
access-control-allow-origin
*
access-control-expose-headers
Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
cache-control
public, max-age=31536000
x-goog-stored-content-length
3417393
cf-ray
61350732fb422b95-FRA
cf-bgj
minify
logger.min.js
cdn.lr-ingest.io/ 		658 KB
119 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.lr-ingest.io/logger.min.js
Requested by
Host: gstatic.gitbook.com
URL: https://gstatic.gitbook.com/js/111.49fd34a8.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:e0::ac40:6502 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31556926

Request headers

Referer
https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 18 Jan 2021 02:53:53 GMT
content-encoding
br
vary
x-fh-requested-host, accept-encoding
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
273
x-cache
HIT
cf-request-id
07b502d81900002c2a3e8f0000000001
x-served-by
cache-fra19124-FRA
last-modified
Fri, 15 Jan 2021 18:24:33 GMT
server
cloudflare
x-timer
S1610735282.036511,VS0,VE1
etag
W/"d1b82a207bd555860e81f104b372b0e8cb3ebe9e9cb5420b980a02e4579f68ec"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31556926
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=U2hrEqrJYDz%2FCFxV2eOyDqLRQPmthISW7rlW5r3y9OFiAz%2FzdbCL3Iefz63WlQusOHm6OgAwJOrnjgJuVlk96%2FvfMEbnBJWqpFM96DLNyaQtlPP6qYxxW0Xy%2BQk%2B"}],"group":"cf-nel","max_age":604800}
content-type
text/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=14400
cf-ray
61350739c8362c2a-FRA
x-cache-hits
1
__session
app.gitbook.com/ 		52 B
738 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://app.gitbook.com/__session?proposed=47546f1a-ab4c-452c-b7e6-21422efb1323R
Requested by
Host: gstatic.gitbook.com
URL: https://gstatic.gitbook.com/js/111.49fd34a8.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:86f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / Express
Resource Hash

Request headers

Referer
https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 18 Jan 2021 02:53:54 GMT
content-encoding
gzip
cf-cache-status
DYNAMIC
x-magic-hash
687f88df5ced97e059a758e59a755b51d23598a61d4670b1ae5d6932f0361902
x-powered-by
Express
x-cache
MISS
x-release
gitbook-28427-6.23.6
cf-request-id
07b502d9c8000032402baa2000000001
access-control-allow-origin
https://www.ired.team
server
cloudflare
etag
W/"34-1yUUp/FlE6ae2xKOCTxKTwDlui0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Origin, Accept-Encoding
content-type
application/json; charset=utf-8
via
no cache
x-cloud-trace-context
4d7a59f12644482e8f6caff5f15397c1
cache-control
private
access-control-allow-credentials
true
function-execution-id
9b4sam17vpa9
cf-ray
6135073c7f963240-FRA
expires
Mon, 18 Jan 2021 02:53:54 GMT
83d071ea-8be9-48c9-9a22-811bf166a34b
https://www.ired.team/ 		443 KB
0 		Other
General
Check archive.org
Download Go to
Full URL
blob:https://www.ired.team/83d071ea-8be9-48c9-9a22-811bf166a34b
Requested by
Host: www.ired.team
URL: https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Length
453220
spaces%2F-LFEMnER3fywgFHoroYn%2Favatar.png
gblobscdn.gitbook.com/ 		28 KB
29 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://gblobscdn.gitbook.com/spaces%2F-LFEMnER3fywgFHoroYn%2Favatar.png?alt=media
Requested by
Host: gstatic.gitbook.com
URL: https://gstatic.gitbook.com/js/111.49fd34a8.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:86f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Referer
https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 18 Jan 2021 02:53:54 GMT
cf-cache-status
HIT
age
6294312
x-guploader-uploadid
ABg5-Uyi4yb6xzxMM2w327T_bM1rD925KiGNS4hflTye11n2aT2qYIBoHaJ5uVZwPi_ZGvAk3DvyTXK_GKBnEy9uCVy38JPavg
x-goog-storage-class
STANDARD
x-goog-metageneration
3
x-goog-stored-content-encoding
identity
content-type
image/png
content-length
29066
cf-request-id
07b502db33000032408c21f000000001
last-modified
Sat, 08 Sep 2018 20:00:14 GMT
server
cloudflare
etag
"2965c5f978755802debc0291c5574853"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
x-goog-hash
crc32c=ALxBKw==, md5=KWXF+Xh1WALevAKRxVdIUw==
x-goog-generation
1536436814766237
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-goog-stored-content-length
29066
x-goog-meta-firebasestoragedownloadtokens
1910800b-eed5-42ea-b282-39d0660128fe
accept-ranges
bytes
cf-ray
6135073eb92f3240-FRA
expires
Sat, 06 Nov 2021 04:14:37 GMT
assets%2F-LFEMnER3fywgFHoroYn%2F-LYHcIL_R4k6YNEXjoex%2F-LYHcll2Cw7RXzll00Y7%2FScreenshot%20from%202019-02-09%2014-18-32.png
gblobscdn.gitbook.com/ 		22 KB
22 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://gblobscdn.gitbook.com/assets%2F-LFEMnER3fywgFHoroYn%2F-LYHcIL_R4k6YNEXjoex%2F-LYHcll2Cw7RXzll00Y7%2FScreenshot%20from%202019-02-09%2014-18-32.png?alt=media&token=db120148-d85d-4401-b8c8-8808844af82e
Requested by
Host: gstatic.gitbook.com
URL: https://gstatic.gitbook.com/js/111.49fd34a8.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:86f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Referer
https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 18 Jan 2021 02:53:54 GMT
cf-cache-status
HIT
age
490434
x-guploader-uploadid
ABg5-Uz60AxndCfnf3191TBpYR2n2TR0k0NlnKvTfGKFuPOjCr78FZ1dS-kVKl6lDy6AQkr9oFCb3Eoga9J4Y4hnIO5l5_KPPg
x-goog-storage-class
STANDARD
x-goog-metageneration
2
x-goog-stored-content-encoding
identity
content-disposition
inline; filename*=utf-8''Screenshot%20from%202019-02-09%2014-18-32.png
content-type
image/png
content-length
22424
cf-request-id
07b502dc6c0000324092bee000000001
last-modified
Sat, 09 Feb 2019 14:39:34 GMT
server
cloudflare
etag
"4acb1bda71b8909c495f56e5fcede96a"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
x-goog-hash
crc32c=kgN2yg==, md5=Sssb2nG4kJxJX1bl/O3pag==
x-goog-generation
1549723174315618
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-goog-stored-content-length
22424
x-goog-meta-firebasestoragedownloadtokens
db120148-d85d-4401-b8c8-8808844af82e
accept-ranges
bytes
cf-ray
61350740aacd3240-FRA
expires
Sun, 09 Jan 2022 21:16:16 GMT
6c3c9dec9383137845be0f0ea2cf1bf4.css
gstatic.gitbook.com/css/ 		1 KB
973 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://gstatic.gitbook.com/css/6c3c9dec9383137845be0f0ea2cf1bf4.css
Requested by
Host: gstatic.gitbook.com
URL: https://gstatic.gitbook.com/js/111.49fd34a8.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:86f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Referer
https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 18 Jan 2021 02:53:54 GMT
content-encoding
gzip
cf-cache-status
HIT
age
1983312
cf-polished
origSize=1701
x-guploader-uploadid
ABg5-UwRbBqrUTgzcypdeEnLLffVrUFlH4Ffm7o_Kq_YTSXWywTO_QDa5W3zu0-BQvy2RezZBILefdfyeqntrV4Fiuc
x-goog-storage-class
STANDARD
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
content-type
text/css
cf-request-id
07b502dc7b0000324061861000000001
expires
Sat, 25 Dec 2021 13:13:54 GMT
last-modified
Thu, 17 Dec 2020 11:33:02 GMT
server
cloudflare
etag
W/"6c3c9dec9383137845be0f0ea2cf1bf4"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
x-goog-hash
crc32c=hL62rA==, md5=bDyd7JODE3hFvg8Oos8b9A==
x-goog-generation
1608204782760602
access-control-allow-origin
*
access-control-expose-headers
Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
cache-control
public, max-age=31536000
x-goog-stored-content-length
1701
cf-ray
61350740cade3240-FRA
cf-bgj
minify
assets%2F-LFEMnER3fywgFHoroYn%2F-LYHcIL_R4k6YNEXjoex%2F-LYHcnmhsrPaq84QCCXJ%2FScreenshot%20from%202019-02-09%2014-21-02.png
gblobscdn.gitbook.com/ 		30 KB
31 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://gblobscdn.gitbook.com/assets%2F-LFEMnER3fywgFHoroYn%2F-LYHcIL_R4k6YNEXjoex%2F-LYHcnmhsrPaq84QCCXJ%2FScreenshot%20from%202019-02-09%2014-21-02.png?alt=media&token=fd127c93-66ab-4d13-b4cc-f61645fbb55e
Requested by
Host: gstatic.gitbook.com
URL: https://gstatic.gitbook.com/js/111.49fd34a8.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:86f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Referer
https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 18 Jan 2021 02:53:54 GMT
cf-cache-status
HIT
age
490434
x-guploader-uploadid
ABg5-UzOczP0-LSI4tYIY0qmWZHm23wOLPsfG1mr8mKFfF9p0n3Ob6oY3Y00AT2Vp5QdJfsa7REq3__SKGNxIepzGE4
x-goog-storage-class
STANDARD
x-goog-metageneration
2
x-goog-stored-content-encoding
identity
content-disposition
inline; filename*=utf-8''Screenshot%20from%202019-02-09%2014-21-02.png
content-type
image/png
content-length
30696
cf-request-id
07b502dc7e00003240fa80b000000001
last-modified
Sat, 09 Feb 2019 14:39:34 GMT
server
cloudflare
etag
"3231dc1793ab392f4969a166550dd56e"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
x-goog-hash
crc32c=gffoKA==, md5=MjHcF5OrOS9JaaFmVQ3Vbg==
x-goog-generation
1549723174151198
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-goog-stored-content-length
30696
x-goog-meta-firebasestoragedownloadtokens
fd127c93-66ab-4d13-b4cc-f61645fbb55e
accept-ranges
bytes
cf-ray
61350740cae03240-FRA
expires
Sun, 09 Jan 2022 21:25:48 GMT
assets%2F-LFEMnER3fywgFHoroYn%2F-LYHcIL_R4k6YNEXjoex%2F-LYHcqSVg0P0r8dBLjpC%2FScreenshot%20from%202019-02-09%2014-21-09.png
gblobscdn.gitbook.com/ 		37 KB
38 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://gblobscdn.gitbook.com/assets%2F-LFEMnER3fywgFHoroYn%2F-LYHcIL_R4k6YNEXjoex%2F-LYHcqSVg0P0r8dBLjpC%2FScreenshot%20from%202019-02-09%2014-21-09.png?alt=media&token=0cb494ef-c05f-4b98-9450-9c40d3834c04
Requested by
Host: gstatic.gitbook.com
URL: https://gstatic.gitbook.com/js/111.49fd34a8.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:86f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Referer
https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 18 Jan 2021 02:53:55 GMT
cf-cache-status
MISS
x-guploader-uploadid
ABg5-Uz06h0temX3xY0-oiki3ER88YYNsJo7WpsYaNbZZnu6bNttolXkhtYkfCIpl1TPJndbOpDtQ6C2_nSb-TcMVe8
x-goog-storage-class
STANDARD
x-goog-metageneration
2
x-goog-stored-content-encoding
identity
content-disposition
inline; filename*=utf-8''Screenshot%20from%202019-02-09%2014-21-09.png
content-type
image/png
content-length
37928
cf-request-id
07b502dc81000032406d1f8000000001
last-modified
Sat, 09 Feb 2019 14:39:34 GMT
server
cloudflare
etag
"b460d65a660971a5a564b8e0583fcab4"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
x-goog-hash
crc32c=9e2oyQ==, md5=tGDWWmYJcaWlZLjgWD/KtA==
x-goog-generation
1549723174315835
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-goog-stored-content-length
37928
x-goog-meta-firebasestoragedownloadtokens
0cb494ef-c05f-4b98-9450-9c40d3834c04
accept-ranges
bytes
cf-ray
61350740cae43240-FRA
expires
Tue, 18 Jan 2022 02:53:54 GMT
assets%2F-LFEMnER3fywgFHoroYn%2F-LYHcIL_R4k6YNEXjoex%2F-LYHeE3F5dXK_ePCdQJH%2FScreenshot%20from%202019-02-09%2014-28-18.png
gblobscdn.gitbook.com/ 		6 KB
7 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://gblobscdn.gitbook.com/assets%2F-LFEMnER3fywgFHoroYn%2F-LYHcIL_R4k6YNEXjoex%2F-LYHeE3F5dXK_ePCdQJH%2FScreenshot%20from%202019-02-09%2014-28-18.png?alt=media&token=682c2b70-15cf-4243-897d-07a50dcb60ce
Requested by
Host: gstatic.gitbook.com
URL: https://gstatic.gitbook.com/js/111.49fd34a8.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:86f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Referer
https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 18 Jan 2021 02:53:54 GMT
cf-cache-status
HIT
age
490434
x-guploader-uploadid
ABg5-Uwanfw5u7XDzz4PuhT74yi13JGR_K88gSXPb-jIi9UgOu2yiedkA2nyhl_55J_8JefzungJp8zbYk08drBTNr2eH8QhMw
x-goog-storage-class
STANDARD
x-goog-metageneration
2
x-goog-stored-content-encoding
identity
content-disposition
inline; filename*=utf-8''Screenshot%20from%202019-02-09%2014-28-18.png
content-type
image/png
content-length
6335
cf-request-id
07b502dc84000032406922c000000001
last-modified
Sat, 09 Feb 2019 14:39:34 GMT
server
cloudflare
etag
"3bd8990e69e8b5900d577fcb72e07a74"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
x-goog-hash
crc32c=k59gxw==, md5=O9iZDmnotZANV3/LcuB6dA==
x-goog-generation
1549723174278644
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-goog-stored-content-length
6335
x-goog-meta-firebasestoragedownloadtokens
682c2b70-15cf-4243-897d-07a50dcb60ce
accept-ranges
bytes
cf-ray
61350740dae63240-FRA
expires
Tue, 11 Jan 2022 18:44:25 GMT
assets%2F-LFEMnER3fywgFHoroYn%2F-LYHcIL_R4k6YNEXjoex%2F-LYHeGTSUXeuBes1DUA8%2FScreenshot%20from%202019-02-09%2014-27-54.png
gblobscdn.gitbook.com/ 		93 KB
93 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://gblobscdn.gitbook.com/assets%2F-LFEMnER3fywgFHoroYn%2F-LYHcIL_R4k6YNEXjoex%2F-LYHeGTSUXeuBes1DUA8%2FScreenshot%20from%202019-02-09%2014-27-54.png?alt=media&token=69793e54-eccd-4592-9c37-dd3953c91345
Requested by
Host: gstatic.gitbook.com
URL: https://gstatic.gitbook.com/js/111.49fd34a8.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:86f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Referer
https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 18 Jan 2021 02:53:54 GMT
cf-cache-status
HIT
age
490434
x-guploader-uploadid
ABg5-UyGgNKm1MotpgHOHIyX81Ym4hJxygCjMAvgWtXQo0JMbUmOLpBnWHa86RYyHjTa5xuUE0SIUv_tXGrFXAJjKDc
x-goog-storage-class
STANDARD
x-goog-metageneration
2
x-goog-stored-content-encoding
identity
content-disposition
inline; filename*=utf-8''Screenshot%20from%202019-02-09%2014-27-54.png
content-type
image/png
content-length
94853
cf-request-id
07b502dc9500003240138f6000000001
last-modified
Sat, 09 Feb 2019 14:39:34 GMT
server
cloudflare
etag
"44ed3e6f94392a62fd069e1273546e2d"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
x-goog-hash
crc32c=z8GiyQ==, md5=RO0+b5Q5KmL9Bp4Sc1RuLQ==
x-goog-generation
1549723174933629
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-goog-stored-content-length
94853
x-goog-meta-firebasestoragedownloadtokens
69793e54-eccd-4592-9c37-dd3953c91345
accept-ranges
bytes
cf-ray
61350740eaff3240-FRA
expires
Wed, 12 Jan 2022 10:40:00 GMT
assets%2F-LFEMnER3fywgFHoroYn%2F-LYHn7bhLyxbOjA7EU9M%2F-LYHo8SqVwHexwGHFRIn%2FScreenshot%20from%202019-02-09%2015-11-36.png
gblobscdn.gitbook.com/ 		47 KB
47 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://gblobscdn.gitbook.com/assets%2F-LFEMnER3fywgFHoroYn%2F-LYHn7bhLyxbOjA7EU9M%2F-LYHo8SqVwHexwGHFRIn%2FScreenshot%20from%202019-02-09%2015-11-36.png?alt=media&token=82b495d7-34fe-41c1-a296-8f802dbb660f
Requested by
Host: gstatic.gitbook.com
URL: https://gstatic.gitbook.com/js/111.49fd34a8.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:86f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Referer
https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 18 Jan 2021 02:53:55 GMT
cf-cache-status
MISS
x-guploader-uploadid
ABg5-UxFX2tDEzcfr3qj1ZaUdAj6g-s9sKLoN-6GXyTcR-CXUF4xh5MXZg1Vw9zQ_TzcvUFKhc92hlaQJeJ7Y9MEbmY
x-goog-storage-class
STANDARD
x-goog-metageneration
2
x-goog-stored-content-encoding
identity
content-disposition
inline; filename*=utf-8''Screenshot%20from%202019-02-09%2015-11-36.png
content-type
image/png
content-length
47701
cf-request-id
07b502dcab0000324039b29000000001
last-modified
Sat, 09 Feb 2019 15:13:51 GMT
server
cloudflare
etag
"d86aebfc9eb6e46dc89fbc8e76a5f171"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
x-goog-hash
crc32c=30HShA==, md5=2Grr/J625G3In7yOdqXxcQ==
x-goog-generation
1549725231705609
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-goog-stored-content-length
47701
x-goog-meta-firebasestoragedownloadtokens
82b495d7-34fe-41c1-a296-8f802dbb660f
accept-ranges
bytes
cf-ray
613507411b123240-FRA
expires
Tue, 18 Jan 2022 02:53:54 GMT
assets%2F-LFEMnER3fywgFHoroYn%2F-LYHcIL_R4k6YNEXjoex%2F-LYHfiPA13UOQiYsWHVT%2FScreenshot%20from%202019-02-09%2014-34-44.png
gblobscdn.gitbook.com/ 		86 KB
87 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://gblobscdn.gitbook.com/assets%2F-LFEMnER3fywgFHoroYn%2F-LYHcIL_R4k6YNEXjoex%2F-LYHfiPA13UOQiYsWHVT%2FScreenshot%20from%202019-02-09%2014-34-44.png?alt=media&token=1b755cd8-e2d9-45e4-9b25-72f58955065c
Requested by
Host: gstatic.gitbook.com
URL: https://gstatic.gitbook.com/js/111.49fd34a8.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:86f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Referer
https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 18 Jan 2021 02:53:54 GMT
cf-cache-status
HIT
age
490425
x-guploader-uploadid
ABg5-UyF_czSpvHfxAX2YiAkabLcjGYKzwFH6yjBnaViKg7Mgj6qyMgzA-IdPq5W_JjAd8Kch63LszuZPabl4-31L70
x-goog-storage-class
STANDARD
x-goog-metageneration
2
x-goog-stored-content-encoding
identity
content-disposition
inline; filename*=utf-8''Screenshot%20from%202019-02-09%2014-34-44.png
content-type
image/png
content-length
88354
cf-request-id
07b502dcb50000324087148000000001
last-modified
Sat, 09 Feb 2019 14:39:34 GMT
server
cloudflare
etag
"c61020e42bbd137a5a629ad410262cf7"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
x-goog-hash
crc32c=LOeygg==, md5=xhAg5Cu9E3paYprUECYs9w==
x-goog-generation
1549723174810591
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-goog-stored-content-length
88354
x-goog-meta-firebasestoragedownloadtokens
1b755cd8-e2d9-45e4-9b25-72f58955065c
accept-ranges
bytes
cf-ray
613507412b173240-FRA
expires
Sun, 09 Jan 2022 21:16:18 GMT
photo.jpg
lh5.googleusercontent.com/-BT5DyX_LUys/AAAAAAAAAAI/AAAAAAAAAF4/wkmG-hKpMQk/ 		7 KB
7 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://lh5.googleusercontent.com/-BT5DyX_LUys/AAAAAAAAAAI/AAAAAAAAAF4/wkmG-hKpMQk/photo.jpg
Requested by
Host: gstatic.gitbook.com
URL: https://gstatic.gitbook.com/js/111.49fd34a8.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
fife /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 18 Jan 2021 00:44:57 GMT
x-content-type-options
nosniff
age
7737
content-disposition
inline;filename=""
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
6707
x-xss-protection
0
server
fife
etag
"v5e"
vary
Origin
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Content-Length
cache-control
public, max-age=86400, no-transform
timing-allow-origin
*
expires
Wed, 13 Jan 2021 07:45:23 GMT
Mimikatz-Attacks-1.jpg
www.stealthbits.com/blog/wp-content/uploads/2017/07/
Redirect Chain
  • https://blog.stealthbits.com/wp-content/uploads/2017/07/Mimikatz-Attacks-1.jpg
  • https://www.stealthbits.com/blog/wp-content/uploads/2017/07/Mimikatz-Attacks-1.jpg
131 KB
132 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.stealthbits.com/blog/wp-content/uploads/2017/07/Mimikatz-Attacks-1.jpg
Requested by
Host: www.ired.team
URL: https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
72.52.228.51 Lansing, United States, ASN32244 (LIQUIDWEB, US),
Reverse DNS
Software
Apache /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 18 Jan 2021 02:53:57 GMT
referrer-policy
same-origin
last-modified
Tue, 11 Jul 2017 17:05:59 GMT
server
Apache
x-frame-options
SAMEORIGIN
content-type
image/jpeg
x-xss-protection
1; mode=block
cache-control
public
feature-policy
geolocation 'self'; vibrate 'none'
strict-transport-security
max-age=31536000
accept-ranges
bytes
vary
User-Agent
content-length
134298
x-content-type-options
nosniff
expires
Tue, 18 Jan 2022 02:53:57 GMT

Redirect headers

date
Mon, 18 Jan 2021 02:53:56 GMT
server
Apache
x-frame-options
SAMEORIGIN
content-type
text/html; charset=iso-8859-1
location
https://www.stealthbits.com/blog/wp-content/uploads/2017/07/Mimikatz-Attacks-1.jpg
cache-control
max-age=0
content-length
266
expires
Mon, 18 Jan 2021 02:53:56 GMT
0*Icen2GYXvhyUz7Av.PNG
miro.medium.com/max/1200/ 		74 KB
75 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://miro.medium.com/max/1200/0*Icen2GYXvhyUz7Av.PNG
Requested by
Host: www.ired.team
URL: https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:e13f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 18 Jan 2021 02:53:54 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
age
570022
x-envoy-upstream-service-time
69
strict-transport-security
max-age=15552000; includeSubDomains; preload
content-length
75904
cf-request-id
07b502dce700001f514a1f9000000001
pragma
public
sepia-upstream
medium
server
cloudflare
etag
"16.3"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=2592000
medium-fulfilled-by
miro/main-20201209-194421-2f3bd69bbf
accept-ranges
bytes
cf-ray
6135074178941f51-FRA
expires
Wed, 17 Feb 2021 02:53:54 GMT
/
www.gitbook.com/__amp/ 		7 B
289 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.gitbook.com/__amp/
Requested by
Host: gstatic.gitbook.com
URL: https://gstatic.gitbook.com/js/111.49fd34a8.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:86f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

Referer
https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

date
Mon, 18 Jan 2021 02:53:55 GMT
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
access-control-allow-methods
GET, POST
content-type
text/html;charset=utf-8
access-control-allow-origin
*
strict-transport-security
max-age=15768000
cf-ray
61350741b92e2b95-FRA
content-length
7
cf-request-id
07b502dd0e00002b959083c000000001
analytics.js
www.google-analytics.com/ 		46 KB
18 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: gstatic.gitbook.com
URL: https://gstatic.gitbook.com/js/111.49fd34a8.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:815::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Fri, 23 Oct 2020 03:00:57 GMT
server
Golfe2
age
5662
date
Mon, 18 Jan 2021 01:19:32 GMT
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
18817
expires
Mon, 18 Jan 2021 03:19:32 GMT
7f9239ce726764aa22093884902e018d.svg
gstatic.gitbook.com/images/ 		2 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://gstatic.gitbook.com/images/7f9239ce726764aa22093884902e018d.svg
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:86f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Referer
https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 18 Jan 2021 02:53:54 GMT
content-encoding
gzip
cf-cache-status
HIT
age
1983366
x-guploader-uploadid
ABg5-UxR-FK8U0DOCB_P1BxO-s8Ghu37pQrgymkBCX2n2Py5GRD03GproWHx5b3Vll0WKMKiFF9wUfq9hocu_bfxU-Q
x-goog-storage-class
STANDARD
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
content-type
image/svg+xml
cf-request-id
07b502dd16000032403d3ea000000001
last-modified
Thu, 17 Dec 2020 11:33:02 GMT
server
cloudflare
etag
W/"7f9239ce726764aa22093884902e018d"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
x-goog-hash
crc32c=VnuT0A==, md5=f5I5znJnZKoiCTiEkC4BjQ==
x-goog-generation
1608204782831580
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-goog-stored-content-length
2137
cf-ray
61350741bb7e3240-FRA
expires
Sun, 26 Dec 2021 03:57:47 GMT
collect
www.google-analytics.com/j/ 		2 B
42 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j87&a=50423858&t=pageview&_s=1&dl=https%3A%2F%2Fwww.ired.team%2Foffensive-security-experiments%2Factive-directory-kerberos-abuse%2Fdump-password-hashes-from-domain-controller-with-dcsync&dp=%2Foffensive-security-experiments%2Factive-directory-kerberos-abuse%2Fdump-password-hashes-from-domain-controller-with-dcsync&ul=en-us&de=UTF-8&dt=DCSync%3A%20Dump%20Password%20Hashes%20from%20Domain%20Controller%20-%20Red%20Teaming%20Experiments&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEDAAEABAAAAAC~&jid=876030952&gjid=1909735565&cid=1407318477.1610938435&tid=UA-57505611-10&_gid=1239691597.1610938435&_r=1&_slc=1&cd1=-LFEMnER3fywgFHoroYn&cd2=-LFEMnEQwqZOY6DtfrzY&cd3=-MRFMgz9BtQDWVsc6jpa&cd4=master&cd5=-LYHcKlvPpvC2Ly98FpQ&z=1136057641
Requested by
Host: gstatic.gitbook.com
URL: https://gstatic.gitbook.com/js/111.49fd34a8.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:815::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Mon, 18 Jan 2021 02:53:54 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.ired.team
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/j/ 		2 B
25 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j87&a=50423858&t=pageview&_s=1&dl=https%3A%2F%2Fwww.ired.team%2Foffensive-security-experiments%2Factive-directory-kerberos-abuse%2Fdump-password-hashes-from-domain-controller-with-dcsync&dp=%2Foffensive-security-experiments%2Factive-directory-kerberos-abuse%2Fdump-password-hashes-from-domain-controller-with-dcsync&ul=en-us&de=UTF-8&dt=DCSync%3A%20Dump%20Password%20Hashes%20from%20Domain%20Controller%20-%20Red%20Teaming%20Experiments&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEDAAEABAAAAAC~&jid=1949356594&gjid=734809765&cid=1407318477.1610938435&tid=UA-128974775-1&_gid=1239691597.1610938435&_r=1&_slc=1&z=468362199
Requested by
Host: gstatic.gitbook.com
URL: https://gstatic.gitbook.com/js/111.49fd34a8.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:815::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/dump-password-hashes-from-domain-controller-with-dcsync
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Mon, 18 Jan 2021 02:53:54 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.ired.team
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2
expires
Fri, 01 Jan 1990 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

1 Console Messages

Source Level URL
Text
console-api log URL: https://gstatic.gitbook.com/js/111.49fd34a8.js(Line 1)
Message:
Application ready

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

app.gitbook.com
blog.stealthbits.com
cdn.lr-ingest.io
fonts.googleapis.com
fonts.gstatic.com
gblobscdn.gitbook.com
gstatic.gitbook.com
ired.team
lh5.googleusercontent.com
miro.medium.com
polyfill.io
unpkg.com
www.gitbook.com
www.google-analytics.com
www.ired.team
www.stealthbits.com
188.166.160.174
209.59.132.164
2606:4700::6810:7eaf
2606:4700::6811:e13f
2606:4700::6812:86f
2606:4700:e0::ac40:6502
2a00:1450:4001:801::2001
2a00:1450:4001:80b::2003
2a00:1450:4001:815::200e
2a00:1450:4001:819::200a
2a04:4e42:200::621
72.52.228.51
03b0665e307caf691a7e91427ecd157e8037ef3aeb3e73faad928d67ffe55113
084337b4bbbd1e1e5f06c0755f0d17421b55f8b9499f4c5244354405fb70cfa6
136ce930cd83f459c9528efa1b255d028476ad4638e9f87eafe7ea6df2795521
34d111f20960b8fbe1ebf0be28b3a67ae36c01e0dfd7a22ab3ebdfda3a40dbfc
3e46dc2084ab2945b5af16a2d88abcd6fa7e8aa5ef5a43fc6c83ce561b6c9577
3e692de9565d90dd947a080d4d10cee72a83447ba053e08fdcac457d7197128a
3e8a9ea983c768e3924813f0f562c7a0eb02425e282d3d91e64ffd5c0c24e2d8
59fd4f207936792ab9910baa7df5f1f7bff899e35e0428df34ab9a1319184052
8beb5465b2abd6a7b77922b8ee2db26b06cac44607544aa47a07aa5501158969
a18af7799b7d241fe5d00645492ccedcad39815e9f4125b7e3e90b18a1b77405
aaecd144d2b8763b2fa5c91f09778294363cef363c10504205f4203922644d11
aee2771f5f57ecf568ffffd5c0d0fee81b7fb2b5540e10d856f2462abdbd5f92
b87e90677bdbc3c6bc296a368f57b2d72783c1a7c6e8e9325cd1645c18039cf2
b99a8b77dbc42ec79010e6532f36c739177d6bcf05427ff0f9673b56ed1cd1c5
c5e939d7d3f9c9bfe632d16484c12354fa89a12738f30f738aa81c984e5b9a92
c5ff636c13e4983198fbed7d325d1cbafbe544702de06f5874c46e359ce68b43
e3da858ea17f1a638cb4fb0d0edbb6328ce601bf698ef58dad130f3b97efccc5
eb470d0e44fc9ea031dff6615f4dcf8f460cc71c4603dbe9abd583cc3bb034cf
fd6ed6532676b92d9ef04191bd606d815b885cdcc9f1acc4c75c67eacacb9bc3