www.nowsecure.com Open in urlscan Pro
2606:4700:20::ac43:4987 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://www.nowsecure.com/blog/2015/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-app...
Effective URL:
https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-app...
Submission: On May 23 via api (May 23rd 2022, 8:41:56 pm UTC) from US — Scanned from DE

Summary HTTP 157 Redirects Links 28 Behaviour Indicators

Summary

This website contacted 45 IPs in 7 countries across 38 domains to perform 157 HTTP transactions. The main IP is 2606:4700:20::ac43:4987, located in United States and belongs to CLOUDFLARENET, US. The main domain is www.nowsecure.com.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on May 18th 2022. Valid for: a year.

This is the only time www.nowsecure.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 75	2606:4700:20:... 2606:4700:20::ac43:4987	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a00:1450:400... 2a00:1450:4001:831::200a	15169 (GOOGLE) (GOOGLE)
3	2606:4700::68... 2606:4700::6811:190e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
7	104.17.70.206 104.17.70.206	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:829::200e	15169 (GOOGLE) (GOOGLE)
1 1	68.67.153.60 68.67.153.60	29990 (ASN-APPNEX) (ASN-APPNEX)
2 2	185.33.221.89 185.33.221.89	29990 (ASN-APPNEX) (ASN-APPNEX)
1	2600:9000:21f... 2600:9000:21f3:de00:12:3734:2a40:93a1	16509 (AMAZON-02) (AMAZON-02)
1	151.101.128.114 151.101.128.114	54113 (FASTLY) (FASTLY)
1	2606:4700::68... 2606:4700::6812:1734	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	185.93.2.243 185.93.2.243	60068 (CDN77 ^_^) (CDN77 ^_^)
1	2a00:1450:400... 2a00:1450:4001:828::2003	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:830::2008	15169 (GOOGLE) (GOOGLE)
2	104.111.234.67 104.111.234.67	16625 (AKAMAI-AS) (AKAMAI-AS)
1	2606:4700:440... 2606:4700:4400::6812:2a27	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	34.111.234.236 34.111.234.236	15169 (GOOGLE) (GOOGLE)
2	52.88.33.114 52.88.33.114	16509 (AMAZON-02) (AMAZON-02)
5	2606:4700::68... 2606:4700::6812:1634	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	13.224.198.41 13.224.198.41	16509 (AMAZON-02) (AMAZON-02)
1	199.232.136.157 199.232.136.157	54113 (FASTLY) (FASTLY)
1	2a02:26f0:350... 2a02:26f0:3500:7::17d8:4dd3	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	2a03:2880:f01... 2a03:2880:f01c:8012:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
1	206.19.49.24 206.19.49.24	17225 (ATT-CERFN...) (ATT-CERFNET-BLOCK)
1	13.225.80.86 13.225.80.86	16509 (AMAZON-02) (AMAZON-02)
5	2a00:1450:400... 2a00:1450:4001:80e::200e	15169 (GOOGLE) (GOOGLE)
1	13.225.80.58 13.225.80.58	16509 (AMAZON-02) (AMAZON-02)
1	142.250.181.226 142.250.181.226	15169 (GOOGLE) (GOOGLE)
1	13.224.198.61 13.224.198.61	16509 (AMAZON-02) (AMAZON-02)
5	2a06:98c1:312... 2a06:98c1:3120::a	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	192.28.144.124 192.28.144.124	15224 (OMNITURE) (OMNITURE)
3 3	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	13.107.42.14 13.107.42.14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
3	104.244.42.131 104.244.42.131	13414 (TWITTER) (TWITTER)
3	104.244.42.5 104.244.42.5	13414 (TWITTER) (TWITTER)
6	18.208.17.54 18.208.17.54	14618 (AMAZON-AES) (AMAZON-AES)
1	2606:4700::68... 2606:4700::6812:acf	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	13.224.198.15 13.224.198.15	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:831::2002	15169 (GOOGLE) (GOOGLE)
2 2	52.208.250.69 52.208.250.69	16509 (AMAZON-02) (AMAZON-02)
1 2	13.225.80.38 13.225.80.38	16509 (AMAZON-02) (AMAZON-02)
1	35.244.174.68 35.244.174.68	15169 (GOOGLE) (GOOGLE)
2	2a03:2880:f11... 2a03:2880:f11c:8183:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
1	13.225.80.45 13.225.80.45	16509 (AMAZON-02) (AMAZON-02)
1	13.224.198.73 13.224.198.73	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:400c:c0c::9d	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:80f::2004	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:810::2003	15169 (GOOGLE) (GOOGLE)
1	34.250.211.64 34.250.211.64	16509 (AMAZON-02) (AMAZON-02)
1	13.225.80.115 13.225.80.115	16509 (AMAZON-02) (AMAZON-02)
157	45

75 2606:4700:20::ac43:4987 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

www.nowsecure.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:831::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2606:4700::6811:190e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 104.17.70.206 (None, )

ASN13335 (CLOUDFLARENET, US)

info.nowsecure.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:829::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googleoptimize.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 68.67.153.60 (Secaucus, United States) 1 redirects

ASN29990 (ASN-APPNEX, US)
PTR: s.ml-attr.com.pxlsrv.net

s.ml-attr.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.33.221.89 (Amsterdam, Netherlands) 2 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 719.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

secure.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:21f3:de00:12:3734:2a40:93a1 (United States)

ASN16509 (AMAZON-02, US)

attr.ml-api.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.128.114 (United States)

ASN54113 (FASTLY, US)

cdn.evgnet.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:1734 (United States)

ASN13335 (CLOUDFLARENET, US)

kit.fontawesome.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.93.2.243 (Paris, France)

ASN60068 (CDN77 ^_^, GB)
PTR: unn-185-93-2-243.datapacket.com

a.omappapi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:828::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:830::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.111.234.67 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-234-67.deploy.static.akamaitechnologies.com

munchkin.marketo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:4400::6812:2a27 (United States)

ASN13335 (CLOUDFLARENET, US)

trk.techtarget.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.111.234.236 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 236.234.111.34.bc.googleusercontent.com

ml314.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.88.33.114 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-88-33-114.us-west-2.compute.amazonaws.com

nowsecure.us-4.evergage.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2606:4700::6812:1634 (United States)

ASN13335 (CLOUDFLARENET, US)

ka-p.fontawesome.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.224.198.41 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-224-198-41.fra2.r.cloudfront.net

cdn-app.pathfactory.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 199.232.136.157 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

static.ads-twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:3500:7::17d8:4dd3 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f01c:8012:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 206.19.49.24 (United States)

ASN17225 (ATT-CERFNET-BLOCK, US)

apt.techtarget.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.225.80.86 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-225-80-86.fra2.r.cloudfront.net

api.omappapi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:80e::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.225.80.58 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-225-80-58.fra2.r.cloudfront.net

static.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.181.226 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s56-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.224.198.61 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-224-198-61.fra2.r.cloudfront.net

tag.demandbase.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a06:98c1:3120::a (United States)

ASN13335 (CLOUDFLARENET, US)

edge.marker.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
api.marker.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.28.144.124 (United States)

ASN15224 (OMNITURE, US)

201-xew-873.mktoresp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:1ec:21::14 (United States) 3 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.107.42.14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px4.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 104.244.42.131 (United States)

ASN13414 (TWITTER, US)

analytics.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 104.244.42.5 (United States)

ASN13414 (TWITTER, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 18.208.17.54 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-18-208-17-54.compute-1.amazonaws.com

jukebox.pathfactory.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:acf (United States)

ASN13335 (CLOUDFLARENET, US)

maxcdn.bootstrapcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.224.198.15 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-224-198-15.fra2.r.cloudfront.net

script.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:831::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.208.250.69 (Dublin, Ireland) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-208-250-69.eu-west-1.compute.amazonaws.com

match.prod.bidr.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 13.225.80.38 (United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: server-13-225-80-38.fra2.r.cloudfront.net

segments.company-target.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.244.174.68 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 68.174.244.35.bc.googleusercontent.com

id.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f11c:8183:face:b00c:0:25de (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.225.80.45 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-225-80-45.fra2.r.cloudfront.net

api.company-target.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.224.198.73 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-224-198-73.fra2.r.cloudfront.net

vars.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c0c::9d (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:80f::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:810::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.250.211.64 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-250-211-64.eu-west-1.compute.amazonaws.com

in.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.225.80.115 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-225-80-115.fra2.r.cloudfront.net

vc.hotjar.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
82	nowsecure.com 1 redirects www.nowsecure.com info.nowsecure.com	1 MB
7	pathfactory.com cdn-app.pathfactory.com — Cisco Umbrella Rank: 132427 jukebox.pathfactory.com — Cisco Umbrella Rank: 67339	244 KB
6	fontawesome.com kit.fontawesome.com — Cisco Umbrella Rank: 1636 ka-p.fontawesome.com — Cisco Umbrella Rank: 4277	121 KB
5	marker.io edge.marker.io — Cisco Umbrella Rank: 81526 api.marker.io — Cisco Umbrella Rank: 79617	140 KB
5	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 37	58 KB
4	linkedin.com 3 redirects px.ads.linkedin.com — Cisco Umbrella Rank: 511 www.linkedin.com — Cisco Umbrella Rank: 616 px4.ads.linkedin.com — Cisco Umbrella Rank: 4745	3 KB
4	hotjar.com static.hotjar.com — Cisco Umbrella Rank: 645 script.hotjar.com — Cisco Umbrella Rank: 896 vars.hotjar.com — Cisco Umbrella Rank: 989 in.hotjar.com — Cisco Umbrella Rank: 1730	67 KB
3	company-target.com 1 redirects segments.company-target.com — Cisco Umbrella Rank: 1294 api.company-target.com — Cisco Umbrella Rank: 3542	2 KB
3	t.co t.co — Cisco Umbrella Rank: 495	734 B
3	twitter.com analytics.twitter.com — Cisco Umbrella Rank: 534	772 B
3	omappapi.com a.omappapi.com — Cisco Umbrella Rank: 4968 api.omappapi.com — Cisco Umbrella Rank: 5066	58 KB
3	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 237	11 KB
2	google.de www.google.de — Cisco Umbrella Rank: 5483	655 B
2	google.com www.google.com — Cisco Umbrella Rank: 7	655 B
2	facebook.com www.facebook.com — Cisco Umbrella Rank: 102	315 B
2	bidr.io 2 redirects match.prod.bidr.io — Cisco Umbrella Rank: 466	1019 B
2	doubleclick.net googleads.g.doubleclick.net — Cisco Umbrella Rank: 44 stats.g.doubleclick.net — Cisco Umbrella Rank: 92	2 KB
2	facebook.net connect.facebook.net — Cisco Umbrella Rank: 146	114 KB
2	evergage.com nowsecure.us-4.evergage.com	1 KB
2	ml314.com ml314.com — Cisco Umbrella Rank: 1640	32 KB
2	techtarget.com trk.techtarget.com — Cisco Umbrella Rank: 13915 apt.techtarget.com — Cisco Umbrella Rank: 19549	2 KB
2	marketo.net munchkin.marketo.net — Cisco Umbrella Rank: 3700	6 KB
2	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 71	139 KB
2	adnxs.com 2 redirects secure.adnxs.com — Cisco Umbrella Rank: 424	2 KB
2	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 46	2 KB
1	hotjar.io vc.hotjar.io — Cisco Umbrella Rank: 2320	256 B
1	rlcdn.com id.rlcdn.com — Cisco Umbrella Rank: 598	98 B
1	bootstrapcdn.com maxcdn.bootstrapcdn.com — Cisco Umbrella Rank: 714	7 KB
1	mktoresp.com 201-xew-873.mktoresp.com	311 B
1	demandbase.com tag.demandbase.com — Cisco Umbrella Rank: 5207	18 KB
1	googleadservices.com www.googleadservices.com — Cisco Umbrella Rank: 110	15 KB
1	licdn.com snap.licdn.com — Cisco Umbrella Rank: 939	3 KB
1	ads-twitter.com static.ads-twitter.com — Cisco Umbrella Rank: 638	14 KB
1	gstatic.com fonts.gstatic.com	17 KB
1	evgnet.com cdn.evgnet.com — Cisco Umbrella Rank: 5409	43 KB
1	ml-api.io attr.ml-api.io — Cisco Umbrella Rank: 22404	242 B
1	ml-attr.com 1 redirects s.ml-attr.com — Cisco Umbrella Rank: 17746	278 B
1	googleoptimize.com www.googleoptimize.com — Cisco Umbrella Rank: 1364	38 KB
157	38

	Domain	Requested by
75	www.nowsecure.com	1 redirects www.nowsecure.com
7	info.nowsecure.com	www.nowsecure.com info.nowsecure.com
6	jukebox.pathfactory.com	cdn-app.pathfactory.com
5	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com
5	ka-p.fontawesome.com	kit.fontawesome.com www.nowsecure.com
3	t.co	www.nowsecure.com
3	analytics.twitter.com	www.nowsecure.com
3	edge.marker.io	www.nowsecure.com edge.marker.io
3	cdnjs.cloudflare.com	www.nowsecure.com
2	api.marker.io	edge.marker.io
2	www.google.de	www.nowsecure.com
2	www.google.com	www.nowsecure.com
2	www.facebook.com	www.nowsecure.com
2	segments.company-target.com	1 redirects www.nowsecure.com
2	match.prod.bidr.io	2 redirects
2	px.ads.linkedin.com	2 redirects
2	connect.facebook.net	www.nowsecure.com connect.facebook.net
2	nowsecure.us-4.evergage.com	cdn.evgnet.com
2	ml314.com	www.nowsecure.com ml314.com
2	munchkin.marketo.net	www.nowsecure.com munchkin.marketo.net
2	www.googletagmanager.com	www.nowsecure.com www.googletagmanager.com
2	a.omappapi.com	www.nowsecure.com a.omappapi.com
2	secure.adnxs.com	2 redirects
2	fonts.googleapis.com	www.nowsecure.com cdn-app.pathfactory.com
1	vc.hotjar.io	script.hotjar.com
1	in.hotjar.com	script.hotjar.com
1	stats.g.doubleclick.net	www.google-analytics.com
1	vars.hotjar.com	static.hotjar.com
1	api.company-target.com	tag.demandbase.com
1	id.rlcdn.com	www.nowsecure.com
1	googleads.g.doubleclick.net	www.googleadservices.com
1	script.hotjar.com	static.hotjar.com
1	maxcdn.bootstrapcdn.com	cdn-app.pathfactory.com
1	px4.ads.linkedin.com	www.nowsecure.com
1	www.linkedin.com	1 redirects
1	201-xew-873.mktoresp.com	munchkin.marketo.net
1	tag.demandbase.com	www.nowsecure.com
1	www.googleadservices.com	www.googletagmanager.com
1	static.hotjar.com	www.googletagmanager.com
1	api.omappapi.com	a.omappapi.com
1	apt.techtarget.com	www.nowsecure.com
1	snap.licdn.com	www.nowsecure.com
1	static.ads-twitter.com	www.nowsecure.com
1	cdn-app.pathfactory.com	www.nowsecure.com
1	trk.techtarget.com	www.nowsecure.com
1	fonts.gstatic.com	fonts.googleapis.com
1	kit.fontawesome.com	www.nowsecure.com
1	cdn.evgnet.com	www.nowsecure.com
1	attr.ml-api.io	www.nowsecure.com
1	s.ml-attr.com	1 redirects
1	www.googleoptimize.com	www.nowsecure.com
157	51

This site contains links to these domains. Also see Links.

Domain
info.nowsecure.com
academy.nowsecure.com
lab.nowsecure.com
nowsecurehelp.zendesk.com
discover.nowsecure.com
mobilerisktracker.nowsecure.com
facebook.com
twitter.com
www.linkedin.com
play.google.com
www.vungle.com
towelroot.com
medium.com
www.facebook.com
jakewharton.com
blog.osom.info
developer.android.com
webpolicy.org
www.youtube.com

Subject Issuer	Validity	Valid
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-05-18` - `2023-05-18`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2022-05-04` - `2022-07-27`	3 months	crt.sh
info.nowsecure.com Cloudflare Inc ECC CA-3	`2022-05-04` - `2023-05-04`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2022-05-04` - `2022-07-27`	3 months	crt.sh
cdn.evergage.com DigiCert TLS RSA SHA256 2020 CA1	`2022-04-13` - `2023-04-12`	a year	crt.sh
*.fontawesome.com DigiCert TLS RSA SHA256 2020 CA1	`2021-12-01` - `2023-01-01`	a year	crt.sh
a.omappapi.com R3	`2022-04-30` - `2022-07-29`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2022-05-04` - `2022-07-27`	3 months	crt.sh
*.marketo.net DigiCert SHA2 Secure Server CA	`2022-02-06` - `2023-02-07`	a year	crt.sh
*.ml314.com GoGetSSL RSA DV CA	`2022-03-29` - `2023-03-29`	a year	crt.sh
*.us-4.evergage.com Amazon	`2021-09-22` - `2022-10-20`	a year	crt.sh
*.pathfactory.com Amazon	`2021-08-10` - `2022-09-08`	a year	crt.sh
ads-twitter.com DigiCert TLS RSA SHA256 2020 CA1	`2021-07-21` - `2022-07-26`	a year	crt.sh
snap.licdn.com DigiCert SHA2 Secure Server CA	`2022-03-01` - `2023-03-01`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2022-03-02` - `2022-05-31`	3 months	crt.sh
*.techtarget.com Sectigo RSA Domain Validation Secure Server CA	`2021-10-13` - `2022-11-12`	a year	crt.sh
api.opmnstr.com Amazon	`2022-02-09` - `2023-03-10`	a year	crt.sh
*.hotjar.com Amazon	`2021-11-25` - `2022-12-23`	a year	crt.sh
www.googleadservices.com GTS CA 1C3	`2022-05-04` - `2022-07-27`	3 months	crt.sh
tag.demandbase.com Go Daddy Secure Certificate Authority - G2	`2021-10-18` - `2022-10-14`	a year	crt.sh
*.mktoresp.com DigiCert TLS RSA SHA256 2020 CA1	`2021-11-30` - `2022-11-30`	a year	crt.sh
*.twitter.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2022-03-07` - `2023-03-06`	a year	crt.sh
t.co DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2022-03-07` - `2023-03-06`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2022-05-04` - `2022-07-27`	3 months	crt.sh
*.rlcdn.com Sectigo RSA Domain Validation Secure Server CA	`2022-02-03` - `2023-02-25`	a year	crt.sh
api.demandbase.com Go Daddy Secure Certificate Authority - G2	`2021-10-20` - `2022-09-26`	a year	crt.sh
www.google.com GTS CA 1C3	`2022-05-04` - `2022-07-27`	3 months	crt.sh
www.google.de GTS CA 1C3	`2022-05-04` - `2022-07-27`	3 months	crt.sh
*.hotjar.io Amazon	`2021-08-17` - `2022-09-15`	a year	crt.sh

This page contains 4 frames:

Primary Page: https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/
Frame ID: D46EF91941F5BE01C2B696F9042CC588
Requests: 149 HTTP requests in this frame

Frame: https://info.nowsecure.com/index.php/form/XDFrame
Frame ID: 5373BACB24AC691E7D18FBC72F9BFD8D
Requests: 2 HTTP requests in this frame

Frame: https://vars.hotjar.com/box-4924254a9ce4dc9b959b6e4a9b662d60.html
Frame ID: F018D73A88C25ECC170DB55F2ABCEC6D
Requests: 1 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: 03AF35B30BC2E02220C943059F231886
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Remote Code Execution using Arbitrary File Writes & MultiDex Apps

Page URL History Show full URLs

https://www.nowsecure.com/blog/2015/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-wri... HTTP 301
https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-wri... Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

<link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
/wp-(?:content|includes)/

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
kit\.fontawesome\.com/([0-9a-z]+).js

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Google Optimize (A/B Testing) Expand

Overall confidence: 100%
Detected patterns

googleoptimize\.com/optimize\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Hotjar (Analytics) Expand

Overall confidence: 100%
Detected patterns

//static\.hotjar\.com/

Linkedin Insight Tag (Analytics) Expand

Overall confidence: 100%
Detected patterns

snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

Marketo (Marketing Automation) Expand

Overall confidence: 100%
Detected patterns

munchkin\.marketo\.\w+/(?:([\d.]+)/)?munchkin\.js

Slick (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

(?:/([\d.]+))?/slick(?:\.min)?\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jQuery Migrate (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?

Page Statistics

157
Requests

98 %
HTTPS

43 %
IPv6

38
Domains

51
Subdomains

45
IPs

7
Countries

2432 kB
Transfer

6032 kB
Size

38
Cookies

28 Outgoing links

These are links going to different origins than the main page.

URL: https://info.nowsecure.com/free-mobile-app-security-report.html?utm_source=website&utm_medium=organic&utm_campaign=evg-Zv3Dp&utm_term=cta-tpl-Get%20a%20Demo-main-menu-cta
Title: Test Your App

Search URL Search Domain Scan URL

URL: https://academy.nowsecure.com/
Title: NowSecure AcademyNowSecure AcademyFree mobile appsec training for dev and sec teams and expert-led certifications

Search URL Search Domain Scan URL

URL: https://info.nowsecure.com/free-mobile-app-security-report.html
Title: Free Mobile App Security Assessment

Search URL Search Domain Scan URL

URL: https://info.nowsecure.com/free-dynamic-SBOMs.html
Title: Get 10 SBOMs on Us!

Search URL Search Domain Scan URL

URL: https://lab.nowsecure.com/login
Title: NowSecure PlatformNowSecure PlatformLogin portal for NowSecure Platform customers

Search URL Search Domain Scan URL

URL: https://nowsecurehelp.zendesk.com/hc/en-us
Title: Customer Help CenterCustomer Help CenterResources and job aides for NowSecure customers

Search URL Search Domain Scan URL

URL: https://discover.nowsecure.com/c/camelot-lottery-case-study?x=LIaYZt
Title: Camelot Lottery Integrates NowSecure Into Its Mobile DevSecOps Pipeline

Search URL Search Domain Scan URL

URL: https://mobilerisktracker.nowsecure.com/
Title: Mobile App Risk TrackerMobile App Risk TrackerSnapshot of the current risk profile for mobile apps in your industry

Search URL Search Domain Scan URL

URL: https://facebook.com/sharer/sharer.php?u=https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/

Search URL Search Domain Scan URL

URL: https://twitter.com/intent/tweet/?text=A%20Pattern%20for%20Remote%20Code%20Execution%20using%20Arbitrary%20File%20Writes%20and%20MultiDex%20Applications&url=https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/shareArticle?mini=true&url=https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/&title=A%20Pattern%20for%20Remote%20Code%20Execution%20using%20Arbitrary%20File%20Writes%20and%20MultiDex%20Applications&source=https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/

Search URL Search Domain Scan URL

URL: https://play.google.com/store/apps/details?id=com.outfit7.mytalkingtomfree
Title: Talking Tom

Search URL Search Domain Scan URL

URL: https://twitter.com/fuzion24
Title: @fuzion24

Search URL Search Domain Scan URL

URL: http://www.vungle.com/
Title: Vungle

Search URL Search Domain Scan URL

URL: https://towelroot.com/
Title: privilege escalation vulnerabilities

Search URL Search Domain Scan URL

URL: https://medium.com/@rotxed/dex-skys-the-limit-no-65k-methods-is-28e6cb40cf71
Title: well documented limitations

Search URL Search Domain Scan URL

URL: https://www.facebook.com/notes/facebook-engineering/under-the-hood-dalvik-patch-for-facebook-for-android/10151345597798920
Title: horrible workarounds

Search URL Search Domain Scan URL

URL: http://jakewharton.com/play-services-is-a-monolith/
Title: bloated libraries

Search URL Search Domain Scan URL

URL: http://blog.osom.info/2014/10/multi-dex-to-rescue-from-infamous-65536.html
Title: problem

Search URL Search Domain Scan URL

URL: https://developer.android.com/reference/dalvik/system/DexClassLoader.html
Title: dex loading API

Search URL Search Domain Scan URL

URL: http://webpolicy.org/2014/10/24/how-verizons-advertising-header-works/
Title: Verizon injecting unique indentifiers into traffic

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/in/ryanwelton

Search URL Search Domain Scan URL

URL: https://discover.nowsecure.com/c/web-vs-mobile-app-security-testing-tools?x=9z-j5n
Title: Definitive Guide to Web vs Mobile AppSec Testing Tools

Search URL Search Domain Scan URL

URL: https://discover.nowsecure.com/c/devsecops-toolchain-guide?x=LIaYZt
Title: The Ultimate Guide to Establishing an Effective Mobile DevSecOps Toolchain

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/nowsecure

Search URL Search Domain Scan URL

URL: https://twitter.com/nowsecuremobile

Search URL Search Domain Scan URL

URL: https://www.youtube.com/channel/UC297YyKtSDb22sjpL-S9uVA

Search URL Search Domain Scan URL

URL: https://info.nowsecure.com/NowSecure-SOC2-Type2-Compliance.html
Title: Trust & Security

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://www.nowsecure.com/blog/2015/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/ HTTP 301
https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 11

https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dnowsecure.com%26pId%3d%24UID HTTP 302
https://secure.adnxs.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dnowsecure.com%26pId%3d%24UID HTTP 307
https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fattr.ml-api.io%252f%253fdomain%253dnowsecure.com%2526pId%253d%2524UID HTTP 302
https://attr.ml-api.io/?domain=nowsecure.com&pId=4213993209352775319

Request Chain 114

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=29257&time=1653338510420&url=https%3A%2F%2Fwww.nowsecure.com%2Fblog%2F2017%2F06%2F15%2Fa-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications%2F HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D29257%26time%3D1653338510420%26url%3Dhttps%253A%252F%252Fwww.nowsecure.com%252Fblog%252F2017%252F06%252F15%252Fa-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications%252F%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=29257&time=1653338510420&url=https%3A%2F%2Fwww.nowsecure.com%2Fblog%2F2017%2F06%2F15%2Fa-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications%2F&liSync=true HTTP 302
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=29257&time=1653338510420&url=https%3A%2F%2Fwww.nowsecure.com%2Fblog%2F2017%2F06%2F15%2Fa-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications%2F&liSync=true&e_ipv6=AQLLiz5uhzZB5QAAAYDyp5t_RrbtOVxFQ72bGIHNRGAgycE-KcgU3IFmT94Hup5A_0yzjxg

Request Chain 133

https://match.prod.bidr.io/cookie-sync/demandbase HTTP 303
https://match.prod.bidr.io/cookie-sync/demandbase?_bee_ppp=1 HTTP 303
https://segments.company-target.com/log?vendor=choca&user_id=AAGAy07FF-MAAEozrDpxvQ HTTP 303
https://segments.company-target.com/validateCookie?vendor=choca&user_id=AAGAy07FF-MAAEozrDpxvQ&verifyHash=2d021484ea920ea957d41af0e36e4d84e4776be5

157 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/
Redirect Chain

https://www.nowsecure.com/blog/2015/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/
https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/

107 KB
27 KB

574ms
574ms

Document
text/html

2606:4700:20::ac43:4987
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4987 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / WP Engine

Resource Hash

01c0bfff80631ac74f2c10884df96abbc36324a1089d52a210db02623b2cd5d3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: max-age=600, must-revalidate
cf-cache-status: DYNAMIC
cf-edge-cache: cache,platform=wordpress
cf-ray: 71009d55ef239b43-FRA
content-encoding: br
content-type: text/html; charset=UTF-8
date: Mon, 23 May 2022 20:41:50 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
feature-policy: geolocation 'none';midi 'none';sync-xhr 'none';microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';speaker 'self';vibrate 'none';fullscreen 'self';payment 'none';
link: <https://www.nowsecure.com/wp-json/>; rel="https://api.w.org/" <https://www.nowsecure.com/wp-json/wp/v2/posts/1359>; rel="alternate"; type="application/json" <https://www.nowsecure.com/?p=1359>; rel=shortlink
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0BGYNx7wE9LLhfQPlSbNeKLI5Q0hUh3U9fXYRenoKR9Eu6dbiIPh7yLzKenF%2FJhR6j5wwmhDlQa%2BmvWDOGRJ86MtMqz%2Fu310p7U6Fi%2Fm7CgtJmFZgzd%2FEM%2F9FkWiIiZsv4gdnwCyPXyjhW13nYjq"}],"group":"cf-nel","max_age":604800}
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding Accept-Encoding,Cookie
x-cache: MISS
x-cache-group: normal
x-cacheable: SHORT
x-content-type-options: nosniff
x-powered-by: WP Engine

Redirect headers

cf-cache-status: DYNAMIC
cf-ray: 71009d544c6f9b43-FRA
content-type: text/html
date: Mon, 23 May 2022 20:41:49 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
location: https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=IlJxJQyQLJFDCsay86CW%2BF3aAXHyiRiwY%2Fik78qeAGdCAJIvMSnF9IivFvXu8VtO2Hn9zTsSsi7yLySKt%2F1%2BKvRi3%2BA7zAS4IulMEl0M%2FnOkzar2D0bfah%2BnllyGDHgDGkbB6lqFiZC1xR4X8s5z"}],"group":"cf-nel","max_age":604800}
server: cloudflare

GET
H2 200 css
fonts.googleapis.com/ 2 KB
1 KB 132ms
48ms Stylesheet
text/css 2a00:1450:4001:831::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Nunito%20Sans&display=swap

Requested by

Host: www.nowsecure.com
URL: https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

711f7b6da74f50c460ba881558549c74cd558bfea076857f843d80a514974fef

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 23 May 2022 20:37:03 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Mon, 23 May 2022 20:41:50 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 23 May 2022 20:41:50 GMT

GET
H2 200 style.min.css
www.nowsecure.com/wp-includes/css/dist/block-library/ 81 KB
12 KB 53ms
51ms Stylesheet
text/css 2606:4700:20::ac43:4987
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.nowsecure.com/wp-includes/css/dist/block-library/style.min.css?ver=5.9.3

Requested by

Host: www.nowsecure.com
URL: https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4987 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cdbdaa122823601390c7dcbdd1afde33c2f1a432b8c5ff025c6137ee99ba541a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Mon, 23 May 2022 20:41:50 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 2903412
strict-transport-security: max-age=31536000; includeSubDomains; preload
referrer-policy: strict-origin
last-modified: Wed, 20 Apr 2022 04:47:10 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"625f904e-145db"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fiK4Xk4e4E7Lcr67VHZDP7iH6KOecIrJP%2BmkTrTdKo1oA%2FrN4Q1Eff5oG%2B1eyamnEMVfzGme8d1job9qnh2HFih3tEos5auMxW%2Fb3ANmzkBD62o5ZwFF4d5QOGo%2BUyThj%2FGSSfwkhdzfvs8fX4LU"}],"group":"cf-nel","max_age":604800}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
feature-policy: geolocation 'none';midi 'none';sync-xhr 'none';microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';speaker 'self';vibrate 'none';fullscreen 'self';payment 'none';
cf-ray: 71009d59ae259b43-FRA

GET
H2 200 dashicons.min.css
www.nowsecure.com/wp-includes/css/ 58 KB
35 KB 51ms
48ms Stylesheet
text/css 2606:4700:20::ac43:4987
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.nowsecure.com/wp-includes/css/dashicons.min.css?ver=5.9.3

Requested by

Host: www.nowsecure.com
URL: https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4987 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c21e5a2b32c47bc5f9d9efc97bc0e29fd081946d1d3ebffc5621cfafb1d3960e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Mon, 23 May 2022 20:41:50 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 731107
strict-transport-security: max-age=31536000; includeSubDomains; preload
referrer-policy: strict-origin
last-modified: Mon, 14 Mar 2022 22:05:13 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"622fbc19-e688"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NrWX8b0432bISgNX3qMvgtcn%2Ftub9%2FiJzLV7gsjeYrSOGgQ56pQvPtPlr0JtsUTHt71HRpdM1EG5ez44o0HSadzHl5FmraRwgQZB%2BeXKoBvmkm%2FuDwo5J4WTDcdJM2owmqEle9DWc5BtvmyeXSkF"}],"group":"cf-nel","max_age":604800}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
feature-policy: geolocation 'none';midi 'none';sync-xhr 'none';microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';speaker 'self';vibrate 'none';fullscreen 'self';payment 'none';
cf-ray: 71009d59ae299b43-FRA

GET
H2 200 style.min.css
www.nowsecure.com/wp-content/themes/nowsecure-2016/resources/build/styles/ 441 KB
66 KB 89ms
86ms Stylesheet
text/css 2606:4700:20::ac43:4987
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.nowsecure.com/wp-content/themes/nowsecure-2016/resources/build/styles/style.min.css?ver=576

Requested by

Host: www.nowsecure.com
URL: https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4987 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1019fe78e70e11b34296c6c0a22f0e3c7ff371af85d3e6591c50eb87ddb4c5e1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Mon, 23 May 2022 20:41:50 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 3460464
strict-transport-security: max-age=31536000; includeSubDomains; preload
referrer-policy: strict-origin
last-modified: Wed, 13 Apr 2022 16:33:29 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"6256fb59-6e55e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4g9m4G9isqOSSOnIR2H3t6XxIMQJ%2Foz3AJduu3%2BZO56wLW5YWYWRrxJwXzaZRefOHTj%2BFRFCUIRzQPTp1ELQQ8sbOSIMMf2sQpwxKuQVNjTNH%2FlB7ODNjO3yJigvcZvPkQlbCOY7jwTYpng6Dl6h"}],"group":"cf-nel","max_age":604800}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
feature-policy: geolocation 'none';midi 'none';sync-xhr 'none';microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';speaker 'self';vibrate 'none';fullscreen 'self';payment 'none';
cf-ray: 71009d59ae2f9b43-FRA

GET
H2 200 slick.min.css
cdnjs.cloudflare.com/ajax/libs/slick-carousel/1.6.0/ 1 KB
697 B 129ms
48ms Stylesheet
text/css 2606:4700::6811:190e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/slick-carousel/1.6.0/slick.min.css?ver=576

Requested by

Host: www.nowsecure.com
URL: https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8f24862077717aa659bc9f521e03cd8dbb013fcae88a3eff5a3824a064c92029

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Mon, 23 May 2022 20:41:50 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 1633153
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 382
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:16:21 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03fd5-50a"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZTsNlg3zMaqpVSIr7svev7N2Nv0KMgC3LRqW9ypaq%2BtqlDw0qjk4H3JMDEym87Fd7qpMBVR%2FcK0ogV4X0SeZFhbrI9c5fFXznE3EyuSOejTPvMJ1rLSwLRbVt3GqjULPRXo0N3jt0XEeiHgVrJhbRlUH"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 71009d5a2c0d68f7-FRA
expires: Sat, 13 May 2023 20:41:50 GMT

GET
H2 200 slick-theme.min.css
cdnjs.cloudflare.com/ajax/libs/slick-carousel/1.6.0/ 2 KB
1 KB 125ms
45ms Stylesheet
text/css 2606:4700::6811:190e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/slick-carousel/1.6.0/slick-theme.min.css?ver=576

Requested by

Host: www.nowsecure.com
URL: https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5a684227c1eef599cf45d875e0f906a73e0fb247aca49c0de70c1a14e7ef818f

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Mon, 23 May 2022 20:41:50 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 439525
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 637
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:16:21 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03fd5-92d"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3Ve%2Fg2sJYmzzLYZJ94fw3IjYz9jljjraxIzjFpOk258dHlYLoOzYy1jLo8ZFzB9T%2BhCwnDvD8FzSktOytQkOalCXV8DtYW%2BIHkLQCGxCvlBQ131fl9TTkHFwqGUm4oFegnlzhBxR34FDSDNlyJEsHfAR"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 71009d5a2c0f68f7-FRA
expires: Sat, 13 May 2023 20:41:50 GMT

GET
H2 200 jquery.min.js Show response
www.nowsecure.com/wp-includes/js/jquery/ 87 KB
32 KB 67ms
64ms Script
application/javascript 2606:4700:20::ac43:4987
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.nowsecure.com/wp-includes/js/jquery/jquery.min.js?ver=3.6.0

Requested by

Host: www.nowsecure.com
URL: https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4987 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

bd4de6a3fc0fb68d6f76ba7b93514b96a92e585c295b5351c31ad92a4b0777ea

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Mon, 23 May 2022 20:41:50 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 400585
strict-transport-security: max-age=31536000; includeSubDomains; preload
referrer-policy: strict-origin
last-modified: Mon, 14 Mar 2022 22:05:13 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"622fbc19-15db1"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cIrCitT%2BID2TB0KPSpCXzF7XIDp6kkf2aR101K3w42yLUM%2FtaIbvhqinXN%2B1g0zgXcCwhnbbzuTM6A0pxiD7Z6eNaKf6byWTWjNczNpwweLGb6u3AGGwjb8aGVARXCLJ0ZhrmNRV7QVT5Pi7KUvh"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
feature-policy: geolocation 'none';midi 'none';sync-xhr 'none';microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';speaker 'self';vibrate 'none';fullscreen 'self';payment 'none';
cf-ray: 71009d59ae319b43-FRA

GET
H2 200 jquery-migrate.min.js Show response
www.nowsecure.com/wp-includes/js/jquery/ 11 KB
5 KB 103ms
101ms Script
application/javascript 2606:4700:20::ac43:4987
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.nowsecure.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2

Requested by

Host: www.nowsecure.com
URL: https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4987 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Mon, 23 May 2022 20:41:50 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 400585
strict-transport-security: max-age=31536000; includeSubDomains; preload
referrer-policy: strict-origin
last-modified: Mon, 14 Mar 2022 22:05:13 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"622fbc19-2bd8"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Ky5IdD%2Fnen0wWpTe86HI9%2F20CtwAWxv%2BY212QUNkuhSuk1kQP%2BSwpaoo8GbSSP6tyFFh55A%2BRBtAzOvPoB9uDsMRMSnyEMvr45SwJSb%2Bh5HDWU3B00J3t4Ba2dZf%2B%2B0TTZ%2Bnrxg7E1fq9CbXUQHY"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
feature-policy: geolocation 'none';midi 'none';sync-xhr 'none';microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';speaker 'self';vibrate 'none';fullscreen 'self';payment 'none';
cf-ray: 71009d59ae349b43-FRA

GET
H2 200 forms2.min.js Show response
info.nowsecure.com/js/forms2/js/ 205 KB
68 KB 364ms
161ms Script
application/x-javascript 104.17.70.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://info.nowsecure.com/js/forms2/js/forms2.min.js?ver=576

Requested by

Host: www.nowsecure.com
URL: https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.70.206 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

54b1a318711ed45da6f1a787a0b0f601199c8676b7d565a4163674833c64b0a0

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Mon, 23 May 2022 20:41:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
last-modified: Tue, 03 May 2022 03:46:42 GMT
server: cloudflare
etag: "360777-3326e-5de135b5b2c80"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/x-javascript
accept-ranges: bytes
cf-ray: 71009d5aeb369bc2-FRA

GET
H2 200 slick.min.js Show response
cdnjs.cloudflare.com/ajax/libs/slick-carousel/1.6.0/ 41 KB
9 KB 126ms
47ms Script
application/javascript 2606:4700::6811:190e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/slick-carousel/1.6.0/slick.min.js?ver=1.0.0

Requested by

Host: www.nowsecure.com
URL: https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e02af7df9a190d88380e2dcec2050ecaa493ae2d23526dbeec67f6907df3a752

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Mon, 23 May 2022 20:41:50 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 335880
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 9033
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:16:21 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03fd5-a3e1"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yZgbP5LXA3lIB3yDs%2BQj3r8yVqfHevMIPVAkmgtQ2YYvLFUY2bmP%2Fl0P79GjP%2BS2TSl5%2F0GKp1rtWq1Xb5KjvfVYGjGEsWq5EeqdacdfJ4F0MIu7%2BUSCdzSaWyfX8ntZVWqEuG5%2FxPoOuGZQxJDD2Rcm"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 71009d5a2c1168f7-FRA
expires: Sat, 13 May 2023 20:41:50 GMT

GET
H2 200 optimize.js Show response
www.googleoptimize.com/ 96 KB
38 KB 162ms
52ms Script
application/javascript 2a00:1450:4001:829::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleoptimize.com/optimize.js?id=OPT-N4W8ZMW

Requested by

Host: www.nowsecure.com
URL: https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

3abdefb76fda3805d9685290e489c60ce60bd6eee3cecb284a48fa48b16184b9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Mon, 23 May 2022 20:41:50 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38306
x-xss-protection: 0
last-modified: Mon, 23 May 2022 19:51:46 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 23 May 2022 20:41:50 GMT

GET
H2

200

/
attr.ml-api.io/
Redirect Chain

https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dnowsecure.com%26pId%3d%24UID
https://secure.adnxs.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dnowsecure.com%26pId%3d%24UID
https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fattr.ml-api.io%252f%253fdomain%253dnowsecure.com%2526pId%253d%2524UID
https://attr.ml-api.io/?domain=nowsecure.com&pId=4213993209352775319

0
242 B

374ms
245ms

Image
application/json

2600:9000:21f3:de00:12:3734:2a40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://attr.ml-api.io/?domain=nowsecure.com&pId=4213993209352775319
Requested by: Host: www.nowsecure.com
URL: https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/
Protocol: H2
Server: 2600:9000:21f3:de00:12:3734:2a40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Mon, 23 May 2022 20:41:52 GMT
via: 1.1 ff2bcb2d3b4a3d9e0615ddd1033c38c4.cloudfront.net (CloudFront)
apigw-requestid: SmKuij8ZIAMES3A=
x-amz-cf-pop: FRA2-C2
x-cache: Miss from cloudfront
content-type: application/json
content-length: 0
x-amz-cf-id: UdAyio-RUUIgsQJpyY4B9WqNNOtk5C4NEpUG4HD6HCybrmxegUsY7Q==

Redirect headers

Pragma: no-cache
Date: Mon, 23 May 2022 20:41:51 GMT
X-Proxy-Origin: 80.255.7.102; 80.255.7.102; 719.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 3fd9ed47-18af-4d47-9048-56c1135829ae
Server: nginx/1.21.3
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://attr.ml-api.io/?domain=nowsecure.com&pId=4213993209352775319
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 evergage.min.js Show response
cdn.evgnet.com/beacon/nowsecure/engage/scripts/ 160 KB
43 KB 230ms
141ms Script
application/javascript 151.101.128.114
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.evgnet.com/beacon/nowsecure/engage/scripts/evergage.min.js
Requested by: Host: www.nowsecure.com
URL: https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.128.114 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: ec1b955b630541c406d5b609050491a3b6e516cd8778acd053526e30cfbcd546

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

x-amz-version-id: Qee1_.v.AJAhnomvqZt489h0dDBehE1z
content-encoding: gzip
etag: "d4ab8a4e3e504593d954cf9cc2517a10"
timing-allow-origin: *
age: 0
x-cache: HIT, HIT
x-amz-replication-status: COMPLETED
content-length: 43032
x-amz-id-2: 1p8qtETAiNt9WiLDwxz3xGE8jQamo649sRaA7hT7WAAb/I1cqEV6MC3oMg8KmtLl/rDtQZHsslo=
x-served-by: cache-iad-kcgs7200056-IAD, cache-hhn4050-HHN
x-amz-meta-evergage-sum: a7d5d4726455c8ce5a87b3fa7e74578a4ab3aacd
last-modified: Wed, 04 May 2022 20:33:59 GMT
server: AmazonS3
x-timer: S1653338511.646320,VS0,VE99
date: Mon, 23 May 2022 20:41:50 GMT
vary: Accept-Encoding
x-amz-request-id: 67EY1M6281ABPQQY
via: 1.1 varnish, 1.1 varnish
cache-control: max-age=120
accept-ranges: bytes
content-type: application/javascript; charset=utf-8
x-amz-meta-evergage-beacon-ver: 16
x-cache-hits: 1, 1

GET
H2 200 Products-Test-Your-App.png
www.nowsecure.com/wp-content/uploads/2022/03/ 68 KB
68 KB 136ms
126ms Image
image/png 2606:4700:20::ac43:4987
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.nowsecure.com/wp-content/uploads/2022/03/Products-Test-Your-App.png

Requested by

Host: www.nowsecure.com
URL: https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4987 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a0e689678664574f2a3f4a3bd3e085d27472f531e4e0b52699f6ea3a0aae5eff

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Mon, 23 May 2022 20:41:50 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 174093
cf-polished: origSize=69409
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 69292
referrer-policy: strict-origin
last-modified: Mon, 14 Mar 2022 22:05:15 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "622fbc1b-10f21"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OaQy8BtNViYi%2FbL9u9%2FA84TuazWJFBGpgGn2Xee1G%2BO0NXU3DL96%2F2YBrA%2FllrIWXW8D8hb2Ez09vqS4heS6IapCXslIsC4ka%2BBFAvM76xW%2BGXQ9N5wdfHiP7Amr%2FMBHwJcO%2FTGr%2BxQs9Hq5%2Br%2FF"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
feature-policy: geolocation 'none';midi 'none';sync-xhr 'none';microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';speaker 'self';vibrate 'none';fullscreen 'self';payment 'none';
accept-ranges: bytes
cf-ray: 71009d5cdc229b43-FRA
cf-bgj: imgq:100,h2pri

GET
H2 200 Logo-Nowsecure.png
www.nowsecure.com/wp-content/uploads/2022/03/ 4 KB
5 KB 101ms
92ms Image
image/png 2606:4700:20::ac43:4987
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.nowsecure.com/wp-content/uploads/2022/03/Logo-Nowsecure.png

Requested by

Host: www.nowsecure.com
URL: https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4987 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

22e8142d74fd8ad5ee6f339d0aff7c1641f83a285306b428f1232088780d5432

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Mon, 23 May 2022 20:41:50 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 400584
cf-polished: origSize=6216
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 4433
referrer-policy: strict-origin
last-modified: Mon, 14 Mar 2022 22:05:15 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "622fbc1b-1848"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7KFh0GQGOAiBhSir5udlCRRlz8f5KJDAd7Y7LVc9uW9Me7UeJhobh5tkiF%2FKGUm6ZjOB3jgS2Oe8ypToNS4zNMt2tYhjzcBwGtHzPoKHCfCGT0PmrGGTwFA2l3MKHWSn7EktXGqAPlLaf9w4KZWN"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
feature-policy: geolocation 'none';midi 'none';sync-xhr 'none';microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';speaker 'self';vibrate 'none';fullscreen 'self';payment 'none';
accept-ranges: bytes
cf-ray: 71009d5cdc239b43-FRA
cf-bgj: imgq:100,h2pri

GET
H2 200 Products-Test-Your-App.png
www.nowsecure.com/wp-content/uploads/2022/01/ 69 KB
70 KB 136ms
127ms Image
image/png 2606:4700:20::ac43:4987
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.nowsecure.com/wp-content/uploads/2022/01/Products-Test-Your-App.png

Requested by

Host: www.nowsecure.com
URL: https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4987 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

85df1412ad2772b0260c2240591579588c2f9d08c44a50e937f2928be99ea3b5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Mon, 23 May 2022 20:41:50 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 803002
cf-polished: origSize=71153
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 71036
referrer-policy: strict-origin
last-modified: Tue, 15 Mar 2022 03:36:52 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "623009d4-115f1"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SqjHub62%2B%2FULNeaivojhaIEgtey7QzkqUPU0FRH7Bfn%2BRAoIC0TOF4%2FRz7kgXMGOikInN4kep1NhWTtLQ8vHi323xrrCPVni09VMsKLkZmDepZ%2FsJTv4pFnQ%2F8HYNDiyi3PvOdAYHl3tPvi0Lmoi"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
feature-policy: geolocation 'none';midi 'none';sync-xhr 'none';microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';speaker 'self';vibrate 'none';fullscreen 'self';payment 'none';
accept-ranges: bytes
cf-ray: 71009d5cdc259b43-FRA
cf-bgj: imgq:100,h2pri

GET
H2 200 Solutions-Free-SBOM.png
www.nowsecure.com/wp-content/uploads/2022/01/ 81 KB
81 KB 139ms
130ms Image
image/png 2606:4700:20::ac43:4987
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.nowsecure.com/wp-content/uploads/2022/01/Solutions-Free-SBOM.png

Requested by

Host: www.nowsecure.com
URL: https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4987 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2948f174a43959148792e8182d013109a7ddbeb27ad00945753244e00e64e1e1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Mon, 23 May 2022 20:41:50 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 400584
cf-polished: origSize=82696
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 82567
referrer-policy: strict-origin
last-modified: Tue, 15 Mar 2022 03:35:04 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "62300968-14308"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=pQ1999jQYozTPtKVRp%2B1xqSheh1zLUKj6FRqMCEzV%2FweGfO25AQSeadj2uXfCqxp2BKsb1YTAiQuJXIhTy8KxsBp8XfFdigZAtSM7zzA3nBG2XSZqNQg1Ugetsajzm6yo7xKlg72bJ3iMdJjeOvy"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
feature-policy: geolocation 'none';midi 'none';sync-xhr 'none';microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';speaker 'self';vibrate 'none';fullscreen 'self';payment 'none';
accept-ranges: bytes
cf-ray: 71009d5cdc269b43-FRA
cf-bgj: imgq:100,h2pri

GET
H2 200 Camelot-Lottery-hex-image-500x500-1.png
www.nowsecure.com/wp-content/uploads/2022/04/ 195 KB
195 KB 105ms
97ms Image
image/png 2606:4700:20::ac43:4987
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.nowsecure.com/wp-content/uploads/2022/04/Camelot-Lottery-hex-image-500x500-1.png

Requested by

Host: www.nowsecure.com
URL: https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4987 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ddd9effdec180a580a131e7a1e1e40f786cf1701642deb976fc80f6368df1573

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Mon, 23 May 2022 20:41:50 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 400584
cf-polished: origSize=199720
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 199309
referrer-policy: strict-origin
last-modified: Fri, 22 Apr 2022 18:35:29 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "6262f571-30c28"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ISdLzQn3TV96KN5OJ5LXIGB5xAl6AuNbM7pnyvst31M%2BMYti%2BbKJWo%2B0tCdQ83OwORYD0JI4SjMcjTISbgkPxSPYKb9kJoUltSbsJ3slW7HLvG1ZTbzJZ81zDsOnFgOjIIUKHgr7XMkVpicoTrZc"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
feature-policy: geolocation 'none';midi 'none';sync-xhr 'none';microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';speaker 'self';vibrate 'none';fullscreen 'self';payment 'none';
accept-ranges: bytes
cf-ray: 71009d5cdc279b43-FRA
cf-bgj: imgq:100,h2pri

GET
H2 200 Resources-Mobile-Risk-Tracker.png
www.nowsecure.com/wp-content/uploads/2022/01/ 63 KB
63 KB 135ms
127ms Image
image/png 2606:4700:20::ac43:4987
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.nowsecure.com/wp-content/uploads/2022/01/Resources-Mobile-Risk-Tracker.png

Requested by

Host: www.nowsecure.com
URL: https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4987 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7e2b3a54a5b20496afd5595c276d311267bf651d29967f5a922c33aa3db28e44

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Mon, 23 May 2022 20:41:50 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 730347
cf-polished: origSize=64346
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 64241
referrer-policy: strict-origin
last-modified: Tue, 15 Mar 2022 03:35:40 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "6230098c-fb5a"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yS%2FrlyCkeB8XC%2FH%2FuNj3itk0a%2FhAkyhBSrimeMoGvgXIfki0zz%2BxgCyK6f1vGxQ%2FYlcbnVPuwM5rWto3Bn%2BVQRdATRD3slrJXY5pLjiA6j0pOw2%2BNv92y2OsSpcekt0x7Khpu4v7OB9lDhYwFJht"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
feature-policy: geolocation 'none';midi 'none';sync-xhr 'none';microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';speaker 'self';vibrate 'none';fullscreen 'self';payment 'none';
accept-ranges: bytes
cf-ray: 71009d5cdc299b43-FRA
cf-bgj: imgq:100,h2pri

GET
H2 200 Company-GitHub-Press-Release.png
www.nowsecure.com/wp-content/uploads/2022/01/ 67 KB
67 KB 129ms
120ms Image
image/png 2606:4700:20::ac43:4987
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.nowsecure.com/wp-content/uploads/2022/01/Company-GitHub-Press-Release.png

Requested by

Host: www.nowsecure.com
URL: https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4987 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4b39d8acc83a3e0d63197de1c41cd8c3b0f77befd854c79a0d13bdef652e43db

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Mon, 23 May 2022 20:41:50 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 400584
cf-polished: origSize=72275
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 68611
referrer-policy: strict-origin
last-modified: Mon, 14 Mar 2022 22:05:16 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "622fbc1c-11a53"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=X6TuvTOsqUT%2BDxVWSZnugXO95rZHN4PdiH24BBjHq%2ByuB1NiUHtqDYaDwnmnOrXnGmYZXu%2FedSHUPme73FSMyvyMtFNW7AoIMpFWln84humY15PgXlgZwT%2BbZn9nvwkmm31D2fXgzBMuB4i7fD5k"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
feature-policy: geolocation 'none';midi 'none';sync-xhr 'none';microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';speaker 'self';vibrate 'none';fullscreen 'self';payment 'none';
accept-ranges: bytes
cf-ray: 71009d5cdc2a9b43-FRA
cf-bgj: imgq:100,h2pri

GET
H2 200 icon-search.png
www.nowsecure.com/wp-content/themes/nowsecure-2016/images/ 1 KB
2 KB 137ms
128ms Image
image/png 2606:4700:20::ac43:4987
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.nowsecure.com/wp-content/themes/nowsecure-2016/images/icon-search.png

Requested by

Host: www.nowsecure.com
URL: https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4987 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3d07083bd8e3c956f0bb35897a125bdb9d74fabeede0b4692ce365aff1b2b39a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Mon, 23 May 2022 20:41:50 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 730347
cf-polished: origSize=3125
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 1455
referrer-policy: strict-origin
last-modified: Wed, 06 Apr 2022 21:12:36 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "624e0244-c35"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hl3Ukmvd5SWvbaUfJYslO3qKJoYaKka%2B6Xt2G4nxGP7QhXJFhU88KeFy4WLDftdJJ6HEs9R7bZCeh698XvojqeHmbuS0pQTZCkhcGj80bzH7%2BrhzsJ2gPqSj5iIMeMR%2FbNIvplkrCQioGkxdqqFg"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
feature-policy: geolocation 'none';midi 'none';sync-xhr 'none';microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';speaker 'self';vibrate 'none';fullscreen 'self';payment 'none';
accept-ranges: bytes
cf-ray: 71009d5cdc2b9b43-FRA
cf-bgj: imgq:100,h2pri

GET
H2 200 icon-magnify.png
www.nowsecure.com/wp-content/themes/nowsecure-2016/images/ 1018 B
2 KB 130ms
122ms Image
image/png 2606:4700:20::ac43:4987
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.nowsecure.com/wp-content/themes/nowsecure-2016/images/icon-magnify.png

Requested by

Host: www.nowsecure.com
URL: https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4987 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d0d86f70555b57cc161546d4ae356a36a0a666b3c98c25412a2255734a598ef8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Mon, 23 May 2022 20:41:50 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 803002
cf-polished: origSize=1576
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 1018
referrer-policy: strict-origin
last-modified: Wed, 06 Apr 2022 21:12:36 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "624e0244-628"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Bs2R9QbfOiXuDXD5RzJ1w27eJwkb%2Fmn0sQgDOYTwVO%2B1IMwEy7rFGe0DmpQcxjoYP1QiMXaYpx1oN0aIZMQSE5mvDGU8iIRai8O6a6hCmoUxJbeGR6DqvaOrPxCLCM5wliyJaVn%2By42wKpENwLyP"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
feature-policy: geolocation 'none';midi 'none';sync-xhr 'none';microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';speaker 'self';vibrate 'none';fullscreen 'self';payment 'none';
accept-ranges: bytes
cf-ray: 71009d5cdc2c9b43-FRA
cf-bgj: imgq:100,h2pri

GET
H2 200 cat_pictures-7.png
www.nowsecure.com/wp-content/uploads/2015/06/ 153 KB
154 KB 648ms
640ms Image
image/png 2606:4700:20::ac43:4987
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.nowsecure.com/wp-content/uploads/2015/06/cat_pictures-7.png

Requested by

Host: www.nowsecure.com
URL: https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4987 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

023e77108ac88387cda838cbeafa0108b6546dc7c60e78ce999483a6eab44249

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Mon, 23 May 2022 20:41:51 GMT
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 156915
referrer-policy: strict-origin
last-modified: Mon, 14 Mar 2022 22:05:37 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "622fbc31-264f3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=St8AsJGGc6%2F08xRX9lXtEmsJey%2FIRhP8Vvu9IoZmxDROSuqq33ZdZNAlCmkOMdvsgCvbGwpfbTN4sLihn%2BhgwYrgPPxBN3%2FoS0gl0AZwJywp08GrUecqSJYIiukDqS4z2on8Au17eLn6G8UPeerf"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
feature-policy: geolocation 'none';midi 'none';sync-xhr 'none';microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';speaker 'self';vibrate 'none';fullscreen 'self';payment 'none';
accept-ranges: bytes
cf-ray: 71009d5cdc2d9b43-FRA

GET
H2 200 talking_tom_crash-7.png
www.nowsecure.com/wp-content/uploads/2015/06/ 11 KB
12 KB 390ms
382ms Image
image/png 2606:4700:20::ac43:4987
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.nowsecure.com/wp-content/uploads/2015/06/talking_tom_crash-7.png

Requested by

Host: www.nowsecure.com
URL: https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4987 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

31c07b36cc3224a40c70dccb3db129d904b3cd7282cccae96c5690bcbe6a9265

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Mon, 23 May 2022 20:41:51 GMT
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 11637
referrer-policy: strict-origin
last-modified: Mon, 14 Mar 2022 22:05:37 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "622fbc31-2d75"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Y%2FVKLYxgn%2Fx5eGwy0SzyQtwU4T33RQd%2Br9QGI0C8pwn7JIoMX9Fxa1L%2FG9jGtJp3uRh6AcENrb%2B0SQQFc83uRs6gDILqYcP%2FQWEo0CXwxGImYm21iL0DejA8hCKplWWCvoQd87u3OPW3OzCe9vUo"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
feature-policy: geolocation 'none';midi 'none';sync-xhr 'none';microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';speaker 'self';vibrate 'none';fullscreen 'self';payment 'none';
accept-ranges: bytes
cf-ray: 71009d5cdc2e9b43-FRA

GET
H2 200 linkedin.svg
www.nowsecure.com/wp-content/themes/nowsecure-2016/images/ 2 KB
1 KB 137ms
130ms Image
image/svg+xml 2606:4700:20::ac43:4987
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.nowsecure.com/wp-content/themes/nowsecure-2016/images/linkedin.svg

Requested by

Host: www.nowsecure.com
URL: https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4987 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

805c74fa717a90cffcc1464f5464f3863e9417b4180ebcc9cb8c8d3ffbedecdb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Mon, 23 May 2022 20:41:50 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 730347
strict-transport-security: max-age=31536000; includeSubDomains; preload
referrer-policy: strict-origin
last-modified: Mon, 14 Mar 2022 22:05:45 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"622fbc39-791"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=W9YM3zYaJC46LoZKnzHkzGTnRb6TXUMQO4Y3%2FkXLCv98p6YhY8o5xiqoeS404fy8rHOa3DGfGNluXxLp%2BJ1sLku%2BPBa%2BEXhthUizx%2BriIQD1igLb1wKkVx7%2Bo15kRrrRZoF3ycPCMbp04fXEG5eI"}],"group":"cf-nel","max_age":604800}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
feature-policy: geolocation 'none';midi 'none';sync-xhr 'none';microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';speaker 'self';vibrate 'none';fullscreen 'self';payment 'none';
cf-ray: 71009d5cdc369b43-FRA

GET
H2 200 twitter.svg
www.nowsecure.com/wp-content/themes/nowsecure-2016/images/ 2 KB
1 KB 129ms
121ms Image
image/svg+xml 2606:4700:20::ac43:4987
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.nowsecure.com/wp-content/themes/nowsecure-2016/images/twitter.svg

Requested by

Host: www.nowsecure.com
URL: https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4987 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

472ef4cfe45e17e12eeb6a45c88127e28afa97162b86f78fc931165b9319fa43

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Mon, 23 May 2022 20:41:50 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 731179
strict-transport-security: max-age=31536000; includeSubDomains; preload
referrer-policy: strict-origin
last-modified: Mon, 14 Mar 2022 22:05:45 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"622fbc39-784"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hvCBdsWk2dtmdyfvbTkxTeLMAyQUSsINfp9MIoOKEbq6Ub6pv68RsBRPV21VAyJQP905sdoM0JZByoxDaa8LkCWEurvaVbFK5WXZ3XVH0Xx0GgCWFhH3ZPNcvtBm9s67XA8AH4ivRZA7aCp34dcC"}],"group":"cf-nel","max_age":604800}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
feature-policy: geolocation 'none';midi 'none';sync-xhr 'none';microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';speaker 'self';vibrate 'none';fullscreen 'self';payment 'none';
cf-ray: 71009d5cdc379b43-FRA

GET
H2 200 icon-email.png
www.nowsecure.com/wp-content/uploads/2021/04/ 2 KB
3 KB 103ms
96ms Image
image/png 2606:4700:20::ac43:4987
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.nowsecure.com/wp-content/uploads/2021/04/icon-email.png

Requested by

Host: www.nowsecure.com
URL: https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4987 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a8af1e3b2d7159da8b359c744ae8a1600eca594236d7196f3e4669038db20691

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Mon, 23 May 2022 20:41:50 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 326306
cf-polished: origSize=4655
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 2514
referrer-policy: strict-origin
last-modified: Mon, 14 Mar 2022 22:05:17 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "622fbc1d-122f"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WqTQKZChpfCtTUVSzXruepogQ%2FOWcg8BCiDWSBiQVoo4ioOHzbuzY5AAqp1QINEGzMh88n3kVkQGqABvUxcCEkzN2lPnVd8sChDhTSioASCJZ4rqjz4n4yhilIk%2B2khDhnD5UKiFUXB8daCwMWAz"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
feature-policy: geolocation 'none';midi 'none';sync-xhr 'none';microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';speaker 'self';vibrate 'none';fullscreen 'self';payment 'none';
accept-ranges: bytes
cf-ray: 71009d5cdc399b43-FRA
cf-bgj: imgq:100,h2pri

GET
H2 200 email-decode.min.js Show response
www.nowsecure.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/ 1 KB
1 KB 41ms
41ms Script
application/javascript 2606:4700:20::ac43:4987
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.nowsecure.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js

Requested by

Host: www.nowsecure.com
URL: https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4987 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Mon, 23 May 2022 20:41:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 17 May 2022 19:29:40 GMT
server: cloudflare
etag: W/"6283f7a4-4d7"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: DENY
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wSIdVxIFr0hpckPEKqP%2Bi72X8jdfQlF7gxnTwGIZYhgeijmxADWWsuCj4flQ4zOZS3ZL2zAzlh0YEZd1JhZPIAVLfx7HShdyPYISZMMPNhMH3VpAq9Rqakkl6NsZW%2BDTIZo7ETkXW822tRKwCiQW"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=172800, public
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 71009d5c2aa59b43-FRA
vary: Accept-Encoding
expires: Wed, 25 May 2022 20:41:50 GMT

GET
H2 200 Logo-2.png
www.nowsecure.com/wp-content/uploads/2022/03/ 2 KB
3 KB 132ms
125ms Image
image/png 2606:4700:20::ac43:4987
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.nowsecure.com/wp-content/uploads/2022/03/Logo-2.png

Requested by

Host: www.nowsecure.com
URL: https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4987 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dc994dee64c8f1d130b9747f8fd46f9ad774e865d3656906f6c3e546918b5989

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Mon, 23 May 2022 20:41:50 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 803001
cf-polished: origSize=3503
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 2469
referrer-policy: strict-origin
last-modified: Mon, 14 Mar 2022 22:05:15 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "622fbc1b-daf"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nNO6xpRyuiH%2FjP0hgRUqpjuKBa90YrBhRf45jBBanRl%2BfmaOfmJm2DbPsH5tC16SSJ0fAYGfB7fUbwdF5toSHWqTeBwlirWDaCYoR576hwAg7rrz8HUv29ZvfQmdths3X5Yd97K3jETp4EXPcx9r"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
feature-policy: geolocation 'none';midi 'none';sync-xhr 'none';microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';speaker 'self';vibrate 'none';fullscreen 'self';payment 'none';
accept-ranges: bytes
cf-ray: 71009d5cdc3a9b43-FRA
cf-bgj: imgq:100,h2pri

GET
H2 200 LinkedIn.png
www.nowsecure.com/wp-content/uploads/2022/03/ 258 B
622 B 136ms
129ms Image
image/png 2606:4700:20::ac43:4987
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.nowsecure.com/wp-content/uploads/2022/03/LinkedIn.png

Requested by

Host: www.nowsecure.com
URL: https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4987 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

db66dc8d4cd649a6a2af3d01440ff4239ceefed79d0b2d4e2883c186e0c34bb7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Mon, 23 May 2022 20:41:50 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 803001
cf-polished: origSize=279
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 258
referrer-policy: strict-origin
last-modified: Mon, 14 Mar 2022 22:05:15 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "622fbc1b-117"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XMOMwi9nX4g6Lz6FscZHwQfhnWHseJUghez%2B9DwlBSEKB7v1vw7Y93V7ahZh7zi2nfgYv%2BJOlr%2FHAW5lfAbfPGLLN47jzJXmNWWIM27QYlqLYTHb7X1ogilUYdl2QKMck1md5wjZJI8C%2BESQp4pz"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
feature-policy: geolocation 'none';midi 'none';sync-xhr 'none';microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';speaker 'self';vibrate 'none';fullscreen 'self';payment 'none';
accept-ranges: bytes
cf-ray: 71009d5cdc3b9b43-FRA
cf-bgj: imgq:100,h2pri

GET
H2 200 Twitter.png
www.nowsecure.com/wp-content/uploads/2022/03/ 304 B
645 B 130ms
123ms Image
image/png 2606:4700:20::ac43:4987
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.nowsecure.com/wp-content/uploads/2022/03/Twitter.png

Requested by

Host: www.nowsecure.com
URL: https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4987 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

802cb14286b666bebc0198266fb91d8386c3091d3cb35ab7821f962140751cbe

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Mon, 23 May 2022 20:41:50 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 400584
cf-polished: origSize=325
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 304
referrer-policy: strict-origin
last-modified: Mon, 14 Mar 2022 22:05:15 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "622fbc1b-145"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PnSHUzm6GRCgcpFITUO2Dwy5RGTV3ClqMZUStX5MAmMeS0jQNNX2eTj6kVUWCIt3wALDSmWqeZsyMT5uLsODdErhuI8LkMoJQjfHZZPqYp%2FhFTJpCA75T29v6%2BpDwLsgAzgQRa2yU4R4w4X4QxUw"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
feature-policy: geolocation 'none';midi 'none';sync-xhr 'none';microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';speaker 'self';vibrate 'none';fullscreen 'self';payment 'none';
accept-ranges: bytes
cf-ray: 71009d5cdc3f9b43-FRA
cf-bgj: imgq:100,h2pri

GET
H2 200 youtube.png
www.nowsecure.com/wp-content/uploads/2022/03/ 299 B
900 B 135ms
129ms Image
image/png 2606:4700:20::ac43:4987
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.nowsecure.com/wp-content/uploads/2022/03/youtube.png

Requested by

Host: www.nowsecure.com
URL: https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4987 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a8d079bdcacb19987fc764a5fc3504efda2fca1f33f0bd237494bb862390c2b3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Mon, 23 May 2022 20:41:50 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 174093
cf-polished: origSize=320
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 299
referrer-policy: strict-origin
last-modified: Mon, 14 Mar 2022 22:05:15 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "622fbc1b-140"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NKhu%2BL7%2BvEcjpdOhkRk90Q%2FzP1vyXfdje1v8O5XXA5gmI88P3FJNQjnmhco3%2B6PLc%2FAnTXElpbC1JJgH6x%2FWbx7ZPjwjqjRbM74WnX08a95yv%2FNs8raju8rcs2dTICTImH%2F49nHOjtM5W2N7zUWN"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
feature-policy: geolocation 'none';midi 'none';sync-xhr 'none';microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';speaker 'self';vibrate 'none';fullscreen 'self';payment 'none';
accept-ranges: bytes
cf-ray: 71009d5cdc409b43-FRA
cf-bgj: imgq:100,h2pri

GET
H2 200 shCore.js Show response
www.nowsecure.com/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/ 23 KB
10 KB 64ms
47ms Script
application/javascript 2606:4700:20::ac43:4987
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.nowsecure.com/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/shCore.js?ver=3.0.9b

Requested by

Host: www.nowsecure.com
URL: https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4987 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7626e49a61fdffe1f5b33930d03103cfa7f5a59ea4186e92be736c365e64ca5e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Mon, 23 May 2022 20:41:50 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 400585
cf-polished: origSize=23922
vary: Accept-Encoding, Accept-Encoding
referrer-policy: strict-origin
last-modified: Tue, 17 May 2022 10:41:12 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"62837bc8-5d72"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=pkskz9XeNVL%2FZkrmXDsmob7qkSYZDpZxt2HeGSJ5jfXu1fdJ4KP54ezLaS%2BLjOLJVPvni3ORLnwN6GzQhJR7IEewm92uBiXH03sg5BvfKt0j9fBvfTBzkyTGsGW6CIVBv7CsxBvxiyD341VOd5%2BB"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
feature-policy: geolocation 'none';midi 'none';sync-xhr 'none';microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';speaker 'self';vibrate 'none';fullscreen 'self';payment 'none';
cf-ray: 71009d5c9b6c9b43-FRA
cf-bgj: minify

GET
H2 200 shBrushAS3.js Show response
www.nowsecure.com/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/ 2 KB
1 KB 66ms
48ms Script
application/javascript 2606:4700:20::ac43:4987
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.nowsecure.com/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/shBrushAS3.js?ver=3.0.9b

Requested by

Host: www.nowsecure.com
URL: https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4987 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1ba7f3c6e2c73d2f2ffce37b8fb9bae6861d1e8e56530eadfc94355aab189bbd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Mon, 23 May 2022 20:41:50 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 7274381
cf-polished: origSize=2469
vary: Accept-Encoding, Accept-Encoding
referrer-policy: strict-origin
last-modified: Mon, 10 Jan 2022 22:39:52 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"61dcb5b8-9a5"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=aAZSypfhaGB%2BPCLskHRb7G4KZps%2BohvqWuRjdZRNmoQD76SnGoVFl5789YMt1oqUyiBgYLshaPb7DEGKUscUYJvuu8m%2FLA%2BNPQK9DaY9ixChrLkO%2FP7sLOeY0%2Fwt32pmVUwMS5WDmf97bR3DCr9c"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
feature-policy: geolocation 'none';midi 'none';sync-xhr 'none';microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';speaker 'self';vibrate 'none';fullscreen 'self';payment 'none';
cf-ray: 71009d5c9b7d9b43-FRA
cf-bgj: minify

GET
H2 200 shBrushArduino.js Show response
www.nowsecure.com/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/ 2 KB
1 KB 67ms
49ms Script
application/javascript 2606:4700:20::ac43:4987
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.nowsecure.com/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/shBrushArduino.js?ver=3.0.9b

Requested by

Host: www.nowsecure.com
URL: https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4987 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

af31d745794104696d3a1d91dab0237d6328f5c07dd6d6fe5e776b1ea8637117

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Mon, 23 May 2022 20:41:50 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 400584
cf-polished: origSize=3057
vary: Accept-Encoding, Accept-Encoding
referrer-policy: strict-origin
last-modified: Tue, 17 May 2022 10:41:12 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"62837bc8-bf1"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HpmitYfME7a8xoUMsakWGNmUl0LACH3GzR%2BnlyxHQK6cSKbEIwKl7mpUe%2BVLrwjuE5C3aLxMYh09WVXHFe6RS5bA4dtcxxjizTnjZM38vG%2BgjV5dR8wELdRcFK6tKUV738U6BKGI2p5J9c%2Bw8h6b"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
feature-policy: geolocation 'none';midi 'none';sync-xhr 'none';microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';speaker 'self';vibrate 'none';fullscreen 'self';payment 'none';
cf-ray: 71009d5c9b7f9b43-FRA
cf-bgj: minify

GET
H2 200 shBrushBash.js Show response
www.nowsecure.com/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/ 3 KB
2 KB 72ms
54ms Script
application/javascript 2606:4700:20::ac43:4987
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.nowsecure.com/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/shBrushBash.js?ver=3.0.9b

Requested by

Host: www.nowsecure.com
URL: https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4987 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5e6744806e10959204a1eb939d4f704780b86e43849fc38d38d0952673fce8d7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Mon, 23 May 2022 20:41:50 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 7607716
cf-polished: origSize=3634
vary: Accept-Encoding, Accept-Encoding
referrer-policy: strict-origin
last-modified: Mon, 10 Jan 2022 22:39:52 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"61dcb5b8-e32"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LyLbaWn4GA%2Fh5ICuuE9dz%2BtwkcDta8mvtgH%2BCH2BM%2B6bMSZUYxZ4oIwNOy8LvpFYJqNoSQVX7AxeF7UJYJoZILtj%2B1LcmIGNyZk5Rig23ffZAssfJ7zq%2B6KWg9GJiu%2FFaHhbjtJH%2FTGdql3Q%2B8nO"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
feature-policy: geolocation 'none';midi 'none';sync-xhr 'none';microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';speaker 'self';vibrate 'none';fullscreen 'self';payment 'none';
cf-ray: 71009d5c9b829b43-FRA
cf-bgj: minify

GET
H2 200 shBrushColdFusion.js Show response
www.nowsecure.com/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/ 7 KB
3 KB 65ms
47ms Script
application/javascript 2606:4700:20::ac43:4987
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.nowsecure.com/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/shBrushColdFusion.js?ver=3.0.9b

Requested by

Host: www.nowsecure.com
URL: https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4987 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0b901e45c2c71b37eb4e2f8db2a28dc9f5eefd092e0a5b8ee3d3bcdbdf1dfaf9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Mon, 23 May 2022 20:41:50 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 400584
cf-polished: origSize=8334
vary: Accept-Encoding, Accept-Encoding
referrer-policy: strict-origin
last-modified: Tue, 17 May 2022 10:41:12 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"62837bc8-208e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZOAmMVEZ%2BFjvbSzgONXYu8mQDoyxTYXPVnb%2FpuDdScAGB7yRaZaFDCT7HytcmxxHy3nS0%2F%2BEJF5vYmYVd4fNTixuE3I8nPsNODBAypKTtfV2Eh5bODvsR8skPnbHgtUOEksNJ9YY6y9iF4YmULgI"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
feature-policy: geolocation 'none';midi 'none';sync-xhr 'none';microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';speaker 'self';vibrate 'none';fullscreen 'self';payment 'none';
cf-ray: 71009d5c9b839b43-FRA
cf-bgj: minify

GET
H2 200 shBrushClojure.js Show response
www.nowsecure.com/wp-content/plugins/syntaxhighlighter/third-party-brushes/ 1 KB
908 B 70ms
52ms Script
application/javascript 2606:4700:20::ac43:4987
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.nowsecure.com/wp-content/plugins/syntaxhighlighter/third-party-brushes/shBrushClojure.js?ver=20090602

Requested by

Host: www.nowsecure.com
URL: https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4987 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9b6f398f55c1b58a05c7e75e79eee7ca7d6a867677660227f86f9d318a8a485f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Mon, 23 May 2022 20:41:50 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 400584
cf-polished: origSize=1490
vary: Accept-Encoding, Accept-Encoding
referrer-policy: strict-origin
last-modified: Tue, 17 May 2022 10:41:12 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"62837bc8-5d2"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=neGcs6uAchFBnGAITRQfKBJH1SDDqBsceOuxGDh8%2BafDfcwneHiRIcZchImv0RuhCD1HlP4zTt%2B7NtlfDqKHW5ma9qyV4X%2FoK1SC54FU9WNqIp%2FhOqwQZKv9PQMi5sm0rwVunFR57tZrLWARnp27"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
feature-policy: geolocation 'none';midi 'none';sync-xhr 'none';microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';speaker 'self';vibrate 'none';fullscreen 'self';payment 'none';
cf-ray: 71009d5c9b849b43-FRA
cf-bgj: minify

GET
H2 200 shBrushCpp.js Show response
www.nowsecure.com/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/ 5 KB
3 KB 75ms
58ms Script
application/javascript 2606:4700:20::ac43:4987
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.nowsecure.com/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/shBrushCpp.js?ver=3.0.9b

Requested by

Host: www.nowsecure.com
URL: https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4987 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ab21f912734ffdd281fadc78bdafc65d4a4ecb39ac93d629c738a7d9a70321ec

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Mon, 23 May 2022 20:41:50 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 326313
cf-polished: origSize=5820
vary: Accept-Encoding, Accept-Encoding
referrer-policy: strict-origin
last-modified: Tue, 17 May 2022 10:41:12 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"62837bc8-16bc"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EYD7RNduvU8lTqbQ1vggZ6I0a4EFa5hi6aZZiKsmxc8NscNgZjhJIrhrSX6NLAPydA599bE6Ibp8z1BPQEaAJqD%2BX3QL%2Fj78cnayGGDHfTT226%2FjuGvtCJZGLYSonTBd7KWbQAjZHamVaCaScwK3"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
feature-policy: geolocation 'none';midi 'none';sync-xhr 'none';microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';speaker 'self';vibrate 'none';fullscreen 'self';payment 'none';
cf-ray: 71009d5c9b859b43-FRA
cf-bgj: minify

GET
H2 200 shBrushCSharp.js Show response
www.nowsecure.com/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/ 2 KB
1 KB 70ms
53ms Script
application/javascript 2606:4700:20::ac43:4987
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.nowsecure.com/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/shBrushCSharp.js?ver=3.0.9b

Requested by

Host: www.nowsecure.com
URL: https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4987 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5ddf5adbb7ec6cf1e6cb616308497262bcdebd5e98552dfba0f01bfbd2111fb2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Mon, 23 May 2022 20:41:50 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 400584
cf-polished: origSize=2681
vary: Accept-Encoding, Accept-Encoding
referrer-policy: strict-origin
last-modified: Tue, 17 May 2022 10:41:12 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"62837bc8-a79"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DpZB7mVgliV1XgazUd0w6%2FUUioJYnjMfWwBtucGCmyukjUre6tH2RkqsCcarv0kdR%2BVYArNw%2FX0VPZLk%2Fds%2Bq0fd5ZmjxTbYNzRs%2FG%2FG%2F3vcZpVAEVTfobK03QS5EMKInV0O8CWC1r%2Fp6fZU%2BvEV"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
feature-policy: geolocation 'none';midi 'none';sync-xhr 'none';microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';speaker 'self';vibrate 'none';fullscreen 'self';payment 'none';
cf-ray: 71009d5c9b869b43-FRA
cf-bgj: minify

GET
H2 200 shBrushCss.js Show response
www.nowsecure.com/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/ 8 KB
3 KB 67ms
50ms Script
application/javascript 2606:4700:20::ac43:4987
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.nowsecure.com/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/shBrushCss.js?ver=3.0.9b

Requested by

Host: www.nowsecure.com
URL: https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4987 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

77704260eaefb3ee4158c2afed91f4867af90eca7d13ec84bbec1c140440d2a1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Mon, 23 May 2022 20:41:50 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 7542113
cf-polished: origSize=9166
vary: Accept-Encoding, Accept-Encoding
referrer-policy: strict-origin
last-modified: Mon, 10 Jan 2022 22:39:52 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"61dcb5b8-23ce"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Lq2fvA5oI56vQ8tvDGkKMn5Df0d%2BzDNpjllfmmo6E%2BRUtVpFuN%2BhyivsHfBnxOoQ24vL%2FwDJHz04LcWhLT50FSDue%2B%2Bid2N0Ee01onxr5YBQ7OdpHNcUXzjhJ5VhHZLryykYFHmhYDPqPZirvHUx"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
feature-policy: geolocation 'none';midi 'none';sync-xhr 'none';microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';speaker 'self';vibrate 'none';fullscreen 'self';payment 'none';
cf-ray: 71009d5cab8d9b43-FRA
cf-bgj: minify

GET
H2 200 shBrushDelphi.js Show response
www.nowsecure.com/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/ 2 KB
1 KB 68ms
51ms Script
application/javascript 2606:4700:20::ac43:4987
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.nowsecure.com/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/shBrushDelphi.js?ver=3.0.9b

Requested by

Host: www.nowsecure.com
URL: https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4987 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3a8c5841272dc617f0fcdccbca0cf7dadc04a3ccc5606609e302242bc437b35f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Mon, 23 May 2022 20:41:50 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 11805980
cf-polished: origSize=2420
vary: Accept-Encoding, Accept-Encoding
referrer-policy: strict-origin
last-modified: Tue, 30 Nov 2021 07:34:34 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"61a5d40a-974"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KUmISFD%2BTtHTTEp9LS2Jx%2FJbhu76Tg483C0DRN1JqlLHQa1CYwrD1eNvD9yErYqw9Riy11CQ2RVlIlqiqxSg1wIqVbVm%2BTgofds50jHwNO6h9K%2Bj9IBfDSgycdGMhCL%2FSIcyu2xDFHC5I1d3f4dc"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
feature-policy: geolocation 'none';midi 'none';sync-xhr 'none';microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';speaker 'self';vibrate 'none';fullscreen 'self';payment 'none';
cf-ray: 71009d5cab8e9b43-FRA
cf-bgj: minify

GET
H2 200 shBrushDiff.js Show response
www.nowsecure.com/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/ 547 B
596 B 112ms
95ms Script
application/javascript 2606:4700:20::ac43:4987
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.nowsecure.com/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/shBrushDiff.js?ver=3.0.9b

Requested by

Host: www.nowsecure.com
URL: https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4987 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

873fc6e8f8edc13595db7f5d730a68b458108742a1371df8ab68470762ab7b34

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Mon, 23 May 2022 20:41:50 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 7607716
cf-polished: origSize=1154
vary: Accept-Encoding, Accept-Encoding
referrer-policy: strict-origin
last-modified: Mon, 10 Jan 2022 22:39:52 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"61dcb5b8-482"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fOJm8qgIsz7CmQRdDY7sQwavFWJ%2F%2Ft7RJQneFPSIutkgnJlQSUKCPpyvJkj%2FuP9ZX%2F9L5qoMyb02Mh0S%2BpwQyaMCglj784%2FA79JmnYriLXZCw%2B8hGaZv%2BXwugmiHuWCg8MpDg6QImG8ZlFdD7p%2Fj"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
feature-policy: geolocation 'none';midi 'none';sync-xhr 'none';microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';speaker 'self';vibrate 'none';fullscreen 'self';payment 'none';
cf-ray: 71009d5cdbf29b43-FRA
cf-bgj: minify

GET
H2 200 shBrushErlang.js Show response
www.nowsecure.com/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/ 965 B
810 B 100ms
83ms Script
application/javascript 2606:4700:20::ac43:4987
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.nowsecure.com/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/shBrushErlang.js?ver=3.0.9b

Requested by

Host: www.nowsecure.com
URL: https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4987 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d6382bc70b1c57b4d81778b61d35436c3c03910fc922a29d3e639585fc15e38a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Mon, 23 May 2022 20:41:50 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 326312
cf-polished: origSize=1750
vary: Accept-Encoding, Accept-Encoding
referrer-policy: strict-origin
last-modified: Tue, 17 May 2022 10:41:12 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"62837bc8-6d6"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SD4n9NeHs56NOb8ZI%2FwZZSzDUYLbK2xR%2Fsx3SUymGWMHEVWLQDHAOquEIiycz%2BYYEYCTphCAI5DIuB%2B%2FJSq%2BBLAUaeGjY6ByVNjGCITbt24id7x7QjiKX%2Bf5jBTnzJxWGJCAYUZVq9GflCaDAYuy"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
feature-policy: geolocation 'none';midi 'none';sync-xhr 'none';microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';speaker 'self';vibrate 'none';fullscreen 'self';payment 'none';
cf-ray: 71009d5cdbf59b43-FRA
cf-bgj: minify

GET
H2 200 shBrushFSharp.js Show response
www.nowsecure.com/wp-content/plugins/syntaxhighlighter/third-party-brushes/ 1 KB
1 KB 102ms
86ms Script
application/javascript 2606:4700:20::ac43:4987
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.nowsecure.com/wp-content/plugins/syntaxhighlighter/third-party-brushes/shBrushFSharp.js?ver=20091003

Requested by

Host: www.nowsecure.com
URL: https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4987 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

bd03f034c6642dedafbbbd1b157b4cefe7cb46ee07aa5102043e94eacfe7d26f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Mon, 23 May 2022 20:41:50 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 731107
cf-polished: origSize=2114
vary: Accept-Encoding, Accept-Encoding
referrer-policy: strict-origin
last-modified: Mon, 14 Mar 2022 22:05:46 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"622fbc3a-842"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xbDZa1nzosIikU8ZCExfsIeeYSRHO0lnR7%2FcAI8s2OU3w6lhCLYH7n%2BM1VhUQBIX3xiTjK%2FW%2BoJiaxJqW8jYY%2B9bcA2g04cJt660YkhE7z7hmRNwLwTdCPiSOsEBdGHVrUqNcWKEuKFNAMbHl80j"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
feature-policy: geolocation 'none';midi 'none';sync-xhr 'none';microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';speaker 'self';vibrate 'none';fullscreen 'self';payment 'none';
cf-ray: 71009d5cdbf69b43-FRA
cf-bgj: minify

GET
H2 200 shBrushGo.js Show response
www.nowsecure.com/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/ 1 KB
1 KB 98ms
82ms Script
application/javascript 2606:4700:20::ac43:4987
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.nowsecure.com/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/shBrushGo.js?ver=3.0.9b

Requested by

Host: www.nowsecure.com
URL: https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4987 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

751b7ed555c2b53e11f551a6ddd184f3c2c7ec7d806d7e8d50c50444ce6e7006

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Mon, 23 May 2022 20:41:50 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 14965736
cf-polished: origSize=2257
vary: Accept-Encoding, Accept-Encoding
referrer-policy: strict-origin
last-modified: Tue, 30 Nov 2021 07:34:34 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"61a5d40a-8d1"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains;
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zWtMhfT%2FBl5F4prRWuNYqvyrsZnqp%2FBn%2BRGiJSaq1NTm9XCR%2FgBd0H%2BewqOH1YDJDPKX3cA6f9f4wZ69eHyCrKjHqfm1czmFhLAQefZlGNowu59VsK5JBWdI6FbbZxxUmyrUGloF3nBv2aTzVvWR"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
feature-policy: geolocation 'none';midi 'none';sync-xhr 'none';microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';speaker 'self';vibrate 'none';fullscreen 'self';payment 'none';
cf-ray: 71009d5cdbf79b43-FRA
cf-bgj: minify

GET
H2 200 shBrushGroovy.js Show response
www.nowsecure.com/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/ 2 KB
1 KB 103ms
87ms Script
application/javascript 2606:4700:20::ac43:4987
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.nowsecure.com/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/shBrushGroovy.js?ver=3.0.9b

Requested by

Host: www.nowsecure.com
URL: https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4987 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ebba58d2ae23674a1c22f38a26ca6ae316c4ac05f558c68c354623c3b10556f4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Mon, 23 May 2022 20:41:50 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 7542113
cf-polished: origSize=3055
vary: Accept-Encoding, Accept-Encoding
referrer-policy: strict-origin
last-modified: Mon, 10 Jan 2022 22:39:52 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"61dcb5b8-bef"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZOsREbu%2FRkz3%2BVnfIpI1s5XKHsKvtAZvCNfcWRqIMFJeTnjx1fZTaVg8B%2FuNwpHwcmgaJHWAaHLkDWDhPtqXfOMt1sUp1DvfOuP8pU1%2FvW0Qj%2BOtDd0%2BS8tRePV51Ca6PoaTeedTaX2zzsx7DAA4"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
feature-policy: geolocation 'none';midi 'none';sync-xhr 'none';microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';speaker 'self';vibrate 'none';fullscreen 'self';payment 'none';
cf-ray: 71009d5cdbf89b43-FRA
cf-bgj: minify

GET
H2 200 shBrushHaskell.js Show response
www.nowsecure.com/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/ 1 KB
1 KB 112ms
96ms Script
application/javascript 2606:4700:20::ac43:4987
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.nowsecure.com/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/shBrushHaskell.js?ver=3.0.9b

Requested by

Host: www.nowsecure.com
URL: https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4987 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fe1288901615e6e296459f696f2808158ab250cdcd13fc5508ba6259f57515a3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Mon, 23 May 2022 20:41:50 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 10310437
cf-polished: origSize=1718
vary: Accept-Encoding, Accept-Encoding
referrer-policy: strict-origin
last-modified: Mon, 10 Jan 2022 22:39:52 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"61dcb5b8-6b6"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mY0moUAD%2Brs%2B7%2FmRR7haTBjMprNkpfDwWhJKecjiGr4Tzg2ZwbLCKuBQ9PDFsNwI9dlZk1i4kv5V%2FE0YSqsleY7vvki6H7az%2FazkcGRCNNY2UNAdS6Dg%2Bd4MeKL03gE%2FFU7xovGDWfM%2BqLFq3A12"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
feature-policy: geolocation 'none';midi 'none';sync-xhr 'none';microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';speaker 'self';vibrate 'none';fullscreen 'self';payment 'none';
cf-ray: 71009d5cdbf99b43-FRA
cf-bgj: minify

GET
H2 200 shBrushJava.js Show response
www.nowsecure.com/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/ 1 KB
1 KB 147ms
132ms Script
application/javascript 2606:4700:20::ac43:4987
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.nowsecure.com/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/shBrushJava.js?ver=3.0.9b

Requested by

Host: www.nowsecure.com
URL: https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4987 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e737d82f6a217559a8b63521b6b07ac0c3268343b59bd99fc60d3f81ea7f4b75

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Mon, 23 May 2022 20:41:50 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 7542113
cf-polished: origSize=2140
vary: Accept-Encoding, Accept-Encoding
referrer-policy: strict-origin
last-modified: Mon, 10 Jan 2022 22:39:52 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"61dcb5b8-85c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7f3nPc%2BtOOjrNKJJ84Sq3V206djOogz8h1duMUduDetr6QIdAHZA0I2ldEVyFWdv6UMIDmf7AbvrojExBdjN%2FdINegjhgcdMAtx5x92nEMQgyNm9jOU1Td2%2BVHfkFl3p23LKJeHAvEdIGesMnnFn"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
feature-policy: geolocation 'none';midi 'none';sync-xhr 'none';microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';speaker 'self';vibrate 'none';fullscreen 'self';payment 'none';
cf-ray: 71009d5cdbfa9b43-FRA
cf-bgj: minify

GET
H2 200 shBrushJavaFX.js Show response
www.nowsecure.com/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/ 1 KB
1 KB 102ms
87ms Script
application/javascript 2606:4700:20::ac43:4987
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.nowsecure.com/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/shBrushJavaFX.js?ver=3.0.9b

Requested by

Host: www.nowsecure.com
URL: https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4987 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

48d99405043c7efdb93cc29f66c77ebc552629b8c60289962729733f60766d81

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Mon, 23 May 2022 20:41:50 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 400584
cf-polished: origSize=2276
vary: Accept-Encoding, Accept-Encoding
referrer-policy: strict-origin
last-modified: Tue, 17 May 2022 10:41:12 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"62837bc8-8e4"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=H%2BMKG8bXdLvPO22sSPSdKgftEkA9OmplSe2YEJTxrmcMKziwsF9sF3oEVOd4VCXUmzNo7OB61j7bzFXjudfQuoZW07aTdGkp8JWm0vYuQHWw7N03YHOV3KWALh7mw%2B4clNhoqvVtxHQVsh4FG4ho"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
feature-policy: geolocation 'none';midi 'none';sync-xhr 'none';microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';speaker 'self';vibrate 'none';fullscreen 'self';payment 'none';
cf-ray: 71009d5cdbfb9b43-FRA
cf-bgj: minify

GET
H2 200 shBrushJScript.js Show response
www.nowsecure.com/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/ 1 KB
895 B 140ms
125ms Script
application/javascript 2606:4700:20::ac43:4987
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.nowsecure.com/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/shBrushJScript.js?ver=3.0.9b

Requested by

Host: www.nowsecure.com
URL: https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4987 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3a3204a64bd27e15d31af28ace5cd56d19fff5d04c0844fa15a6c2b361b943d5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Mon, 23 May 2022 20:41:50 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 7274380
cf-polished: origSize=1828
vary: Accept-Encoding, Accept-Encoding
referrer-policy: strict-origin
last-modified: Mon, 10 Jan 2022 22:39:52 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"61dcb5b8-724"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2sKq3FZiSyOHapqL31FJhgpF1ZVT5XdajxekoIg35d2DAE9ohOoupHGIksiaGW47Ek0xoS3c9%2BwiINbKqCoswtKVIl4qTivvBn1x4diwQcVzAUu4mFTS5DI3AEPZwNv%2FVTf1ae8hRo1jSXHtTJVj"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
feature-policy: geolocation 'none';midi 'none';sync-xhr 'none';microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';speaker 'self';vibrate 'none';fullscreen 'self';payment 'none';
cf-ray: 71009d5cdbfd9b43-FRA
cf-bgj: minify

GET
H2 200 shBrushLatex.js Show response
www.nowsecure.com/wp-content/plugins/syntaxhighlighter/third-party-brushes/ 545 B
884 B 107ms
93ms Script
application/javascript 2606:4700:20::ac43:4987
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.nowsecure.com/wp-content/plugins/syntaxhighlighter/third-party-brushes/shBrushLatex.js?ver=20090613

Requested by

Host: www.nowsecure.com
URL: https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4987 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fe8c4576ef624cf4c108d382c9c9e49a8c8001c93d0cd8a51f4bce61691b6eaa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Mon, 23 May 2022 20:41:50 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 7542113
cf-polished: origSize=1907
vary: Accept-Encoding, Accept-Encoding
referrer-policy: strict-origin
last-modified: Mon, 10 Jan 2022 22:39:52 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"61dcb5b8-773"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=s0%2Bzo3Fd8JEUSBECmjjRPKTE%2BYfWM%2Bf3F0C077ZIYKaX2a3oYMva702QNDYdSqrsuCa5dVRFOMClHNSjG6lS97bW3h5PtKvR3bsQMIh3XwsZN5%2FRj8bwCBxDGvN41VDwvQFsAtxgzXYr%2FcQYZa5i"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
feature-policy: geolocation 'none';midi 'none';sync-xhr 'none';microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';speaker 'self';vibrate 'none';fullscreen 'self';payment 'none';
cf-ray: 71009d5cdbfe9b43-FRA
cf-bgj: minify

GET
H2 200 shBrushMatlabKey.js Show response
www.nowsecure.com/wp-content/plugins/syntaxhighlighter/third-party-brushes/ 656 B
818 B 144ms
130ms Script
application/javascript 2606:4700:20::ac43:4987
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.nowsecure.com/wp-content/plugins/syntaxhighlighter/third-party-brushes/shBrushMatlabKey.js?ver=20091209

Requested by

Host: www.nowsecure.com
URL: https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4987 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

742f3c909d855efefaccbdd2e733df64aa08c04bf449f5b921839e1b1d4bb5c3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Mon, 23 May 2022 20:41:50 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 400584
cf-polished: origSize=855
vary: Accept-Encoding, Accept-Encoding
referrer-policy: strict-origin
last-modified: Tue, 17 May 2022 10:41:12 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"62837bc8-357"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ghmygiuBldHggW5V78D6aGxGAzHNuufFFD%2B54q62gRgmssYIymTIeGMN67XgjQ3StTFxXlE%2BkFdNkoX6vlPI8VMIdm63TUcREwX9FNtmaQAz9yvA5SAAF%2B8dAF1QwJnfTFJ0KeZ7m%2Ftsh1lWlESq"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
feature-policy: geolocation 'none';midi 'none';sync-xhr 'none';microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';speaker 'self';vibrate 'none';fullscreen 'self';payment 'none';
cf-ray: 71009d5cdbff9b43-FRA
cf-bgj: minify

GET
H2 200 shBrushObjC.js Show response
www.nowsecure.com/wp-content/plugins/syntaxhighlighter/third-party-brushes/ 2 KB
1 KB 102ms
88ms Script
application/javascript 2606:4700:20::ac43:4987
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.nowsecure.com/wp-content/plugins/syntaxhighlighter/third-party-brushes/shBrushObjC.js?ver=20091207

Requested by

Host: www.nowsecure.com
URL: https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4987 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7a09f192f6cc0a70605d99c0931b2652c187feb1674de9a15cd980868c710d5d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Mon, 23 May 2022 20:41:50 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 731217
cf-polished: origSize=2374
vary: Accept-Encoding, Accept-Encoding
referrer-policy: strict-origin
last-modified: Mon, 14 Mar 2022 22:05:47 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"622fbc3b-946"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=z4TgahLIHAYhKr%2B83S88v5N9z1UfbaNaK%2B96Izib86h3Qmnpp3cob4%2FrCNnPj3mj%2FUnYV5M1Src81ogym4FMl7WsI4y0yTnP8e9zYx59TzLCDY4Fp877NRfdjiryzEj0Y03pDwh6aNYCivrcfqSP"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
feature-policy: geolocation 'none';midi 'none';sync-xhr 'none';microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';speaker 'self';vibrate 'none';fullscreen 'self';payment 'none';
cf-ray: 71009d5cdc009b43-FRA
cf-bgj: minify

GET
H2 200 shBrushPerl.js Show response
www.nowsecure.com/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/ 3 KB
2 KB 107ms
94ms Script
application/javascript 2606:4700:20::ac43:4987
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.nowsecure.com/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/shBrushPerl.js?ver=3.0.9b

Requested by

Host: www.nowsecure.com
URL: https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4987 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2008b9f1b3da9ab3352f5e76889e0d592f4e37bfe21c4d41d769f9eada9c2c0c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Mon, 23 May 2022 20:41:50 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 7288396
cf-polished: origSize=4347
vary: Accept-Encoding, Accept-Encoding
referrer-policy: strict-origin
last-modified: Mon, 10 Jan 2022 22:39:52 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"61dcb5b8-10fb"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MdEt4317zgM53Thcxqok%2FWnwqSDQgWaBtLHioP4qeyuuZxC6QIeReqUMzPuX1wZJaTOUygVfO0hBXM3%2FScdZhTKu5zbRLyOSvUZ%2B8nlWJCh4Yosybt69yOrR1D9HRo88z5xgDLL13rVhHY9euZmQ"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
feature-policy: geolocation 'none';midi 'none';sync-xhr 'none';microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';speaker 'self';vibrate 'none';fullscreen 'self';payment 'none';
cf-ray: 71009d5cdc019b43-FRA
cf-bgj: minify

GET
H2 200 shBrushPhp.js Show response
www.nowsecure.com/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/ 4 KB
2 KB 137ms
123ms Script
application/javascript 2606:4700:20::ac43:4987
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.nowsecure.com/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/shBrushPhp.js?ver=3.0.9b

Requested by

Host: www.nowsecure.com
URL: https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4987 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

553e8e99e11b039cee67652cb4e5784c4f9c822a2fcbc18d3db57dc16f8b64c6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Mon, 23 May 2022 20:41:50 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 400584
cf-polished: origSize=5314
vary: Accept-Encoding, Accept-Encoding
referrer-policy: strict-origin
last-modified: Tue, 17 May 2022 10:41:12 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"62837bc8-14c2"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=sFeDXiDqXhuLoabaZSNVQJY8Ub8ZQWICJ%2BIXf25AUjnejVEyxGrDunoUlRNwYSqaviJvv12ttOOC5pVX1W%2Bx97m%2BPJMeUxLrB6ICxrySdjO61Ov2d8N9bn50q8KXUOA4qlAnU6DWs2sLXt9GOrhR"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
feature-policy: geolocation 'none';midi 'none';sync-xhr 'none';microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';speaker 'self';vibrate 'none';fullscreen 'self';payment 'none';
cf-ray: 71009d5cdc029b43-FRA
cf-bgj: minify

GET
H2 200 shBrushPlain.js Show response
www.nowsecure.com/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/ 323 B
564 B 105ms
92ms Script
application/javascript 2606:4700:20::ac43:4987
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.nowsecure.com/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/shBrushPlain.js?ver=3.0.9b

Requested by

Host: www.nowsecure.com
URL: https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4987 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c0f5e370c43c80dd7d93dc18583a6147da8633a0e2b68a6546650b6583a90d2e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Mon, 23 May 2022 20:41:50 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 731107
cf-polished: origSize=788
vary: Accept-Encoding, Accept-Encoding
referrer-policy: strict-origin
last-modified: Mon, 14 Mar 2022 22:05:46 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"622fbc3a-314"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2Fz%2Bs7PVNJo%2BYL0janzM3ls%2Faf07nBQ5MzIE8kbckrLOFZfNnYmOtOLdhJ3KFMJx0vbMWYQxSMvH7OzgZdezJK5pr1IMIMsAjCEz9BjC%2F1CJl7BlWr41B%2Fiqm0LF4L3LpsCvj2n5UqffXfe%2BJXiPa"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
feature-policy: geolocation 'none';midi 'none';sync-xhr 'none';microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';speaker 'self';vibrate 'none';fullscreen 'self';payment 'none';
cf-ray: 71009d5cdc039b43-FRA
cf-bgj: minify

GET
H2 200 shBrushPowerShell.js Show response
www.nowsecure.com/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/ 3 KB
2 KB 103ms
90ms Script
application/javascript 2606:4700:20::ac43:4987
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.nowsecure.com/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/shBrushPowerShell.js?ver=3.0.9b

Requested by

Host: www.nowsecure.com
URL: https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4987 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c2d66e3a7df3e10293760e4c5bde20ac8293577b083971ce8aad47b4585d1c8d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Mon, 23 May 2022 20:41:50 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 400584
cf-polished: origSize=4361
vary: Accept-Encoding, Accept-Encoding
referrer-policy: strict-origin
last-modified: Tue, 17 May 2022 10:41:12 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"62837bc8-1109"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=oBOQHF6CddEcbzfEmr%2BHt3Q3u0Rdt%2Fos0KdEbB502x%2BFSRpdZMZVxA71o7X%2Bpw04ENwPMcyXR0GrMUQAGcD%2F528%2BkDmuSU6D1lltWB%2BKvBd6UX%2Bfzb3qD%2BB7IP203JKt2z%2F62bs%2BrbOFmLwDNkwv"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
feature-policy: geolocation 'none';midi 'none';sync-xhr 'none';microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';speaker 'self';vibrate 'none';fullscreen 'self';payment 'none';
cf-ray: 71009d5cdc049b43-FRA
cf-bgj: minify

GET
H2 200 shBrushPython.js Show response
www.nowsecure.com/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/ 2 KB
1 KB 143ms
131ms Script
application/javascript 2606:4700:20::ac43:4987
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.nowsecure.com/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/shBrushPython.js?ver=3.0.9b

Requested by

Host: www.nowsecure.com
URL: https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4987 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d53f99629c6d422544c444ce70785aa089a413c64bea95da9cdabbf398a9402a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Mon, 23 May 2022 20:41:50 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 400584
cf-polished: origSize=2481
vary: Accept-Encoding, Accept-Encoding
referrer-policy: strict-origin
last-modified: Tue, 17 May 2022 10:41:12 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"62837bc8-9b1"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8J832tIWIoH8ROiLrPWcbhRTDwRfdqWeaUXd80bcbTgHVzm1sYo0pVgP9PNN40kVd8P8LMQ%2BzQR2QDmdHiI1EE50pLkAcG5VgOoZMBEPp2gu97G1i1cEJKe56BB1%2Befqib9nO4WLRJk%2FwKGxe%2FTD"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
feature-policy: geolocation 'none';midi 'none';sync-xhr 'none';microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';speaker 'self';vibrate 'none';fullscreen 'self';payment 'none';
cf-ray: 71009d5cdc059b43-FRA
cf-bgj: minify

GET
H2 200 shBrushR.js Show response
www.nowsecure.com/wp-content/plugins/syntaxhighlighter/third-party-brushes/ 771 B
701 B 103ms
90ms Script
application/javascript 2606:4700:20::ac43:4987
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.nowsecure.com/wp-content/plugins/syntaxhighlighter/third-party-brushes/shBrushR.js?ver=20100919

Requested by

Host: www.nowsecure.com
URL: https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4987 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

64a348d63ce321342b3c3553529ba5bd1343e5264ae95dc6b71db3099bd7b60b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Mon, 23 May 2022 20:41:50 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 400584
cf-polished: origSize=1035
vary: Accept-Encoding, Accept-Encoding
referrer-policy: strict-origin
last-modified: Tue, 17 May 2022 10:41:12 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"62837bc8-40b"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RZynXI6wfpklZB51kpYgZ2tSgGIfS0VjY62GauIm299R%2FZ5bOgoa7l2CqX5Hsac9fG5tzpfR1wtZmx2rlSV4krBzpXJmHCTdhP5fR58trwLuZd%2BSTqAPzc0pNCkgTo2iw%2F%2F%2FgazdZ45tlVTVUIKt"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
feature-policy: geolocation 'none';midi 'none';sync-xhr 'none';microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';speaker 'self';vibrate 'none';fullscreen 'self';payment 'none';
cf-ray: 71009d5cdc069b43-FRA
cf-bgj: minify

GET
H2 200 shBrushRuby.js Show response
www.nowsecure.com/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/ 1 KB
1 KB 106ms
93ms Script
application/javascript 2606:4700:20::ac43:4987
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.nowsecure.com/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/shBrushRuby.js?ver=3.0.9b

Requested by

Host: www.nowsecure.com
URL: https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4987 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c4c34809a5467ebde4b8560258364d032bb52821addc8a731b1c4dc007f268b0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Mon, 23 May 2022 20:41:50 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 731107
cf-polished: origSize=2226
vary: Accept-Encoding, Accept-Encoding
referrer-policy: strict-origin
last-modified: Mon, 14 Mar 2022 22:05:47 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"622fbc3b-8b2"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jwDFudpdN%2B0EdYXKRbUMlME9qROV64fN7OABG1%2F%2B6IezgxpX3bAsd%2BE8PzG4iwmOadSwhNDSJ%2BKfPORFxGm6kjB7ZFj91wn5CyZTnrMbnh2DV%2BypUIq%2BBr%2FrCcBaEce34ePNq1XIDKkhbEM0nUtQ"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
feature-policy: geolocation 'none';midi 'none';sync-xhr 'none';microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';speaker 'self';vibrate 'none';fullscreen 'self';payment 'none';
cf-ray: 71009d5cdc079b43-FRA
cf-bgj: minify

GET
H2 200 shBrushScala.js Show response
www.nowsecure.com/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/ 1 KB
1 KB 135ms
122ms Script
application/javascript 2606:4700:20::ac43:4987
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.nowsecure.com/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/shBrushScala.js?ver=3.0.9b

Requested by

Host: www.nowsecure.com
URL: https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4987 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6f1f4bf3f7dff1cbb74b974f610378b5f52e212b855155741b0c4917efa56705

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Mon, 23 May 2022 20:41:50 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 7607716
cf-polished: origSize=1930
vary: Accept-Encoding, Accept-Encoding
referrer-policy: strict-origin
last-modified: Mon, 10 Jan 2022 22:39:52 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"61dcb5b8-78a"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PGKbIZkG4bIAqQaXTcG%2F4NMkTw0MzkUGRChy0Vcp%2BApwqYVMzyhca0WxDcJjXbXB0MHkTXgdL6XUnkE2vqf5fhj4FkWh1gbkjkLnIW2KK4pJXMqgVIW8nZegYnedqEZQ%2FSOKNPDFrMIpGeLYbHyz"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
feature-policy: geolocation 'none';midi 'none';sync-xhr 'none';microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';speaker 'self';vibrate 'none';fullscreen 'self';payment 'none';
cf-ray: 71009d5cdc089b43-FRA
cf-bgj: minify

GET
H2 200 shBrushSql.js Show response
www.nowsecure.com/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/ 2 KB
2 KB 101ms
88ms Script
application/javascript 2606:4700:20::ac43:4987
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.nowsecure.com/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/shBrushSql.js?ver=3.0.9b

Requested by

Host: www.nowsecure.com
URL: https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4987 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

efdab9a4ce00bb4c5f767c604681e8961643a147b0a89994583a04aca613c4cc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Mon, 23 May 2022 20:41:50 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 7542113
cf-polished: origSize=3274
vary: Accept-Encoding, Accept-Encoding
referrer-policy: strict-origin
last-modified: Mon, 10 Jan 2022 22:39:52 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"61dcb5b8-cca"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yrAT725iRtnjFLNwvwvKAWA5zr7OLFLZgthBqrK3wP6JoQjon2WNDBqfAkd%2Bbax0y1uHolhqY6GI8MJm8L3qBJcz3CW0LSxBfR2CPCqUFLUYlk3M6DB4tsF2r6NUR4AP%2FNdj03ylE0ArSE8MrlSR"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
feature-policy: geolocation 'none';midi 'none';sync-xhr 'none';microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';speaker 'self';vibrate 'none';fullscreen 'self';payment 'none';
cf-ray: 71009d5cdc099b43-FRA
cf-bgj: minify

GET
H2 200 shBrushSwift.js Show response
www.nowsecure.com/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/ 7 KB
4 KB 97ms
85ms Script
application/javascript 2606:4700:20::ac43:4987
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.nowsecure.com/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/shBrushSwift.js?ver=3.0.9b

Requested by

Host: www.nowsecure.com
URL: https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4987 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f182373610354ad5cdd8ffdc647fc612e1afcfdd1883c966807e5b22eebf1f3f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Mon, 23 May 2022 20:41:50 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 400584
cf-polished: origSize=8485
vary: Accept-Encoding, Accept-Encoding
referrer-policy: strict-origin
last-modified: Tue, 17 May 2022 10:41:12 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"62837bc8-2125"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=a33bwvoT%2FUfvX0b3DR6m%2F%2FDr7ePOe319fdqLGlEPmFtkPJ6WAkgckhzJ4gaSwHwvMuvnJviD5mdhSSHog5NtlDcHLM9QDuK0HFnqvON0LZrxqurE6SFVhckh%2BR2uicTD%2BksVtIB9VWPAqzYro1K%2B"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
feature-policy: geolocation 'none';midi 'none';sync-xhr 'none';microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';speaker 'self';vibrate 'none';fullscreen 'self';payment 'none';
cf-ray: 71009d5cdc0b9b43-FRA
cf-bgj: minify

GET
H2 200 shBrushVb.js Show response
www.nowsecure.com/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/ 2 KB
1 KB 107ms
95ms Script
application/javascript 2606:4700:20::ac43:4987
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.nowsecure.com/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/shBrushVb.js?ver=3.0.9b

Requested by

Host: www.nowsecure.com
URL: https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4987 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7251edebcf81d5d2c55f2731548efd258e62e17605a044bd04f19624cc7e0b06

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Mon, 23 May 2022 20:41:50 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 400584
cf-polished: origSize=2319
vary: Accept-Encoding, Accept-Encoding
referrer-policy: strict-origin
last-modified: Tue, 17 May 2022 10:41:12 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"62837bc8-90f"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=L%2FbNGJq0MUW%2FVozJpektsNk2a1DyA%2BjqTAEFnC43ItimaIme98HESOY8ujHNueZwuHnPAn%2BymnaoHSzT6oJuvqAhH0Ovb1oJTlZCz4UkKy%2Bl0h7A2XL4vrg8ZE50xzmnSNv8B4%2B2xMO5dv9qvyqu"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
feature-policy: geolocation 'none';midi 'none';sync-xhr 'none';microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';speaker 'self';vibrate 'none';fullscreen 'self';payment 'none';
cf-ray: 71009d5cdc0d9b43-FRA
cf-bgj: minify

GET
H2 200 shBrushXml.js Show response
www.nowsecure.com/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/ 1 KB
1004 B 106ms
94ms Script
application/javascript 2606:4700:20::ac43:4987
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.nowsecure.com/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/shBrushXml.js?ver=3.0.9b

Requested by

Host: www.nowsecure.com
URL: https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4987 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e116d223ab752d1118f0079694cd6abf654e9e4a25a03fa1a6acdd791628c3ff

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Mon, 23 May 2022 20:41:50 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 400584
cf-polished: origSize=2112
vary: Accept-Encoding, Accept-Encoding
referrer-policy: strict-origin
last-modified: Tue, 17 May 2022 10:41:12 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"62837bc8-840"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=s75czULmHAnTHR8DO7Lh7byPa6AuqeRPV6nLefvy7PlPakO96z9tFo6kd6DXdHyvSkk%2F2iHoPAcMhL7sVBwA59kBP7fkoaPeXtmxlK1gZSzAJvLVhv4KlWpIXI8fJJkQu%2FMoAYR20VF1Se42z%2Fg0"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
feature-policy: geolocation 'none';midi 'none';sync-xhr 'none';microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';speaker 'self';vibrate 'none';fullscreen 'self';payment 'none';
cf-ray: 71009d5cdc0e9b43-FRA
cf-bgj: minify

GET
H2 200 shBrushYaml.js Show response
www.nowsecure.com/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/ 1 KB
824 B 98ms
86ms Script
application/javascript 2606:4700:20::ac43:4987
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.nowsecure.com/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/shBrushYaml.js?ver=3.0.9b

Requested by

Host: www.nowsecure.com
URL: https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4987 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

11618bb5a83a8fd4cd9312a653d4d2f321e3c9c6165f89b8d7d29927c3f5a9e5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Mon, 23 May 2022 20:41:50 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 7607716
cf-polished: origSize=2060
vary: Accept-Encoding, Accept-Encoding
referrer-policy: strict-origin
last-modified: Mon, 10 Jan 2022 22:39:52 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"61dcb5b8-80c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Xo6XX5Ph4TXc%2BEC%2BIB3bKud9nmulzH1yXH3BAMnuwflG9nyRqpulEsGtE5YNIsYMCXvQORvjczQa%2Blu20H5QFEWAF%2FeTSeSEwvgQ4dHXoQra0QYBM4RXgiuQxgI2jQZP1airRvGWIMKn3iB%2BdP20"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
feature-policy: geolocation 'none';midi 'none';sync-xhr 'none';microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';speaker 'self';vibrate 'none';fullscreen 'self';payment 'none';
cf-ray: 71009d5cdc109b43-FRA
cf-bgj: minify

GET
H2 200 style.css
www.nowsecure.com/wp-content/plugins/eu-cookie-law/css/ 3 KB
1 KB 102ms
91ms Stylesheet
text/css 2606:4700:20::ac43:4987
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.nowsecure.com/wp-content/plugins/eu-cookie-law/css/style.css?ver=5.9.3

Requested by

Host: www.nowsecure.com
URL: https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4987 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0b150d0e7595c7dc3d57192608e357c28a2b3c4947c575968ef94eef996a829f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Mon, 23 May 2022 20:41:50 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 400045
cf-polished: origSize=3699
vary: Accept-Encoding, Accept-Encoding
referrer-policy: strict-origin
last-modified: Mon, 14 Mar 2022 22:05:48 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"622fbc3c-e73"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CXZwOBb1C9j5Zj%2FCWtTIIsl87%2FB5EIuf7fKkoflVLI%2Fp92PjlSIn699C96Fm0lGbDrSj%2B1xFjtJVtPZG0sWl%2F%2BtKnRsOR%2BPSMuwUUKPAtuJxjR14UON4zIFjfIHagxRfnZ40iBoz9qJNEkjCASEl"}],"group":"cf-nel","max_age":604800}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
feature-policy: geolocation 'none';midi 'none';sync-xhr 'none';microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';speaker 'self';vibrate 'none';fullscreen 'self';payment 'none';
cf-ray: 71009d5cdc139b43-FRA
cf-bgj: minify

GET
H2 200 svgs-inline-min.js Show response
www.nowsecure.com/wp-content/plugins/svg-support/js/min/ 2 KB
1 KB 137ms
126ms Script
application/javascript 2606:4700:20::ac43:4987
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.nowsecure.com/wp-content/plugins/svg-support/js/min/svgs-inline-min.js?ver=1.0.0

Requested by

Host: www.nowsecure.com
URL: https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4987 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a394d95c5c1465fbcb01a45f42ab8d22cbd553163a23bbaffa21b8cf01424337

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Mon, 23 May 2022 20:41:50 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 400584
strict-transport-security: max-age=31536000; includeSubDomains; preload
referrer-policy: strict-origin
last-modified: Mon, 14 Mar 2022 22:05:47 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"622fbc3b-6ac"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=g313Lzt99LuZ37tCOpVTfeIdEhO4QQuKaIhkMpcGLlSI8JHn4EaD39VMw8oCNv%2Bv2lcAJ15n93Zfx1esu3k4exlifhB425PZrD1u7sf6k0tgbLBhYhaBQQepboXwERZMMLAA4rQfZOC2%2FpeD1zIp"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
feature-policy: geolocation 'none';midi 'none';sync-xhr 'none';microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';speaker 'self';vibrate 'none';fullscreen 'self';payment 'none';
cf-ray: 71009d5cdc159b43-FRA

GET
H2 200 hoverIntent.min.js Show response
www.nowsecure.com/wp-includes/js/ 1 KB
1 KB 137ms
126ms Script
application/javascript 2606:4700:20::ac43:4987
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.nowsecure.com/wp-includes/js/hoverIntent.min.js?ver=1.10.2

Requested by

Host: www.nowsecure.com
URL: https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4987 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

491ee20092ce969e6785601ae4595748d4ac5ee4df19012b19b77de6c9dfd357

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Mon, 23 May 2022 20:41:50 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1299087
strict-transport-security: max-age=31536000; includeSubDomains; preload
referrer-policy: strict-origin
last-modified: Mon, 14 Mar 2022 22:05:12 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"622fbc18-5dc"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Jz8Q0lBdTNV%2FBo3k%2FeWl3rYqBt4Tj9oKunqpica%2FWr0mER7lThH9U0oYGNxB4Uy9kl%2BtmBtt0h2Rly7X3ka4hk%2FHI7Xt2wvxiXLm8qz1mA6xnx52yhdceNhJIp2eqMpVnEJx7Ft3HDiqWwiDQyTF"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
feature-policy: geolocation 'none';midi 'none';sync-xhr 'none';microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';speaker 'self';vibrate 'none';fullscreen 'self';payment 'none';
cf-ray: 71009d5cdc169b43-FRA

GET
H2 200 superfish2.min.js Show response
www.nowsecure.com/wp-content/themes/genesis/lib/js/menu/ 4 KB
2 KB 143ms
132ms Script
application/javascript 2606:4700:20::ac43:4987
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.nowsecure.com/wp-content/themes/genesis/lib/js/menu/superfish2.min.js?ver=1.7.10.2

Requested by

Host: www.nowsecure.com
URL: https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4987 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8201b2f75e87b8b107921329ece010b6546986a5517a1530e10d455ece7b1bfa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Mon, 23 May 2022 20:41:50 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 3939132
strict-transport-security: max-age=31536000; includeSubDomains; preload
referrer-policy: strict-origin
last-modified: Fri, 08 Apr 2022 02:57:48 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"624fa4ac-117e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yAy3JU0PJiE8TobzT51M2l808uL5GnMkRnXhCwcCuXHifH76SqFI0IimPjnHHKXPaNGf85dTpf7dYfYd4a0z2hsk55TUHdPJLv43pqDB%2B4rMadrsGEHepI8ns%2BwNsuIvaIYyIyVqjaihvYsccAIL"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
feature-policy: geolocation 'none';midi 'none';sync-xhr 'none';microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';speaker 'self';vibrate 'none';fullscreen 'self';payment 'none';
cf-ray: 71009d5cdc199b43-FRA

GET
H2 200 superfish.args.min.js Show response
www.nowsecure.com/wp-content/themes/genesis/lib/js/menu/ 132 B
710 B 135ms
124ms Script
application/javascript 2606:4700:20::ac43:4987
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.nowsecure.com/wp-content/themes/genesis/lib/js/menu/superfish.args.min.js?ver=3.3.5

Requested by

Host: www.nowsecure.com
URL: https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4987 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

20550f7bcb2a817ac9a5879e04260da8268e971c0b8031a6b7a2f48a55ee60d5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Mon, 23 May 2022 20:41:50 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 400584
strict-transport-security: max-age=31536000; includeSubDomains; preload
referrer-policy: strict-origin
last-modified: Mon, 14 Mar 2022 22:05:45 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"622fbc39-84"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Eas4fP9cm7UshIuu0Z%2BK%2F9zAopeQx2GMFLdt9jP%2BqS%2B0r5qT60n%2Bgj4d8lPYZfgzzlSwtXYls%2FhAMi7hAXsFrNgeQohRZeTSyxsB8Pgxz%2B%2FK8qkT6kR9TtpMC%2FE9Lyx9f0wrCfqZsYEd74zs%2Bv6%2F"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
feature-policy: geolocation 'none';midi 'none';sync-xhr 'none';microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';speaker 'self';vibrate 'none';fullscreen 'self';payment 'none';
cf-ray: 71009d5cdc1a9b43-FRA

GET
H2 200 skip-links.min.js Show response
www.nowsecure.com/wp-content/themes/genesis/lib/js/ 386 B
594 B 138ms
127ms Script
application/javascript 2606:4700:20::ac43:4987
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.nowsecure.com/wp-content/themes/genesis/lib/js/skip-links.min.js?ver=3.3.5

Requested by

Host: www.nowsecure.com
URL: https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4987 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ade38136058fcd75880d3673855aff859ee377d5915e59cccf24a973d418bebb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Mon, 23 May 2022 20:41:50 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 400584
strict-transport-security: max-age=31536000; includeSubDomains; preload
referrer-policy: strict-origin
last-modified: Mon, 14 Mar 2022 22:05:45 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"622fbc39-182"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nD0b5ls5qsXfNJy9QM2eq5OIEA0QbwfYlkVcDLAT8fQJPZ5BaFDWg%2FCJlOeL4xj9whOWROvNSOWLNtIH0FLjGPu4icvd02tBA9lmoAVbTvSSaIhNYnZwOLZ3OzcdQjZ1%2FykI97obKCaWsQXCkAHL"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
feature-policy: geolocation 'none';midi 'none';sync-xhr 'none';microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';speaker 'self';vibrate 'none';fullscreen 'self';payment 'none';
cf-ray: 71009d5cdc1c9b43-FRA

GET
H2 200 3fb0309a29.js Show response
kit.fontawesome.com/ 11 KB
4 KB 195ms
73ms Script
text/javascript 2606:4700::6812:1734
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://kit.fontawesome.com/3fb0309a29.js?ver=1.0.0

Requested by

Host: www.nowsecure.com
URL: https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:1734 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

71f74e4f7fd376665a313e2c383a704473aa9a6b185f8cfcb08a88b37e5bfb93

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Mon, 23 May 2022 20:41:50 GMT
content-encoding: gzip
cf-cache-status: REVALIDATED
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: origin, accept-encoding, access-control-request-headers, access-control-request-method
access-control-allow-methods: GET, OPTIONS
content-type: text/javascript
access-control-allow-origin: *
access-control-max-age: 3000
cache-control: max-age=60, public, must-revalidate
strict-transport-security: max-age=31536000; preload
cf-ray: 71009d5d6fb59960-FRA
access-control-allow-headers: accept, accept-langauge, content-language, content-type, fa-kit-token
x-request-id: FtftCdFdBdc9hsp0745h

GET
H2 200 main.min.js Show response
www.nowsecure.com/wp-content/themes/nowsecure-2016/resources/build/scripts/ 75 KB
20 KB 138ms
128ms Script
application/javascript 2606:4700:20::ac43:4987
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.nowsecure.com/wp-content/themes/nowsecure-2016/resources/build/scripts/main.min.js?ver=576

Requested by

Host: www.nowsecure.com
URL: https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4987 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

73fcfb63ea87ea02d9b1335e9a1e15398486bd4af63add386d3838e6c41921f3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Mon, 23 May 2022 20:41:50 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 3460463
strict-transport-security: max-age=31536000; includeSubDomains; preload
referrer-policy: strict-origin
last-modified: Wed, 13 Apr 2022 16:33:45 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"6256fb69-12c12"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fErxlZVknu0rBmGXZrPfKHyFGYJ87VOnpwib0UnkoL5Vwp9FVFgUYNk2Ix2FgWxybLjom%2FK8nZvixFcJ%2FeMSRq3oXddWkuIpPlGAFjYb1RRWOwcoboueDquf1qxkTFaFWAZvqDkbRh7cr%2Bb%2B%2F13O"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
feature-policy: geolocation 'none';midi 'none';sync-xhr 'none';microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';speaker 'self';vibrate 'none';fullscreen 'self';payment 'none';
cf-ray: 71009d5cdc1d9b43-FRA

GET
H2 200 search-bar.js Show response
www.nowsecure.com/wp-content/themes/nowsecure-2016/resources/dev/scripts/ 2 KB
858 B 134ms
124ms Script
application/javascript 2606:4700:20::ac43:4987
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.nowsecure.com/wp-content/themes/nowsecure-2016/resources/dev/scripts/search-bar.js?ver=576

Requested by

Host: www.nowsecure.com
URL: https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4987 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

573c5017cef6a1833a540b650c2264242db032a1183ba50946c53b95268039f5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Mon, 23 May 2022 20:41:50 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 3460463
cf-polished: origSize=3873
vary: Accept-Encoding, Accept-Encoding
referrer-policy: strict-origin
last-modified: Thu, 07 Apr 2022 19:48:23 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"624f4007-f21"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7ClBjk%2BY6v7uX1KBbYzf8NFhm%2B1dTqmKb%2BHLEz%2FGEt68kR%2B8BlYr9lhzGD5HdAOPrVfYGTPRCp%2FcSgQJnhEbH2xffbRbgHNDRXAyZ2lLwMaYberi5zR9DOpKOQ%2FDlaM5qlRD7D9vGWPyLRJUXwN8"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
feature-policy: geolocation 'none';midi 'none';sync-xhr 'none';microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';speaker 'self';vibrate 'none';fullscreen 'self';payment 'none';
cf-ray: 71009d5cdc1f9b43-FRA
cf-bgj: minify

GET
H2 200 scripts.js Show response
www.nowsecure.com/wp-content/plugins/eu-cookie-law/js/ 2 KB
1 KB 141ms
131ms Script
application/javascript 2606:4700:20::ac43:4987
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.nowsecure.com/wp-content/plugins/eu-cookie-law/js/scripts.js?ver=3.1.6

Requested by

Host: www.nowsecure.com
URL: https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4987 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7daf3f5acd448e33c96a746407198ccbe6eff0402f20bbf1164a1129205c13bd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Mon, 23 May 2022 20:41:50 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 326310
cf-polished: origSize=2960
vary: Accept-Encoding, Accept-Encoding
referrer-policy: strict-origin
last-modified: Mon, 14 Mar 2022 22:05:48 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"622fbc3c-b90"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Vp7cQQUhO%2FabcQumzjmsr7i6zbgKVX18bJj8bc4nQ3v2424lzgrHnNrmchP4Y3n%2F6vL3RoomNgUze5h4ASuSk1alyW3ImdYRZUMgOlGa7zrkvqi9FGFFuNjfxpXa0FH5maSgniN1a4kuJ9iJ8wbA"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
feature-policy: geolocation 'none';midi 'none';sync-xhr 'none';microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';speaker 'self';vibrate 'none';fullscreen 'self';payment 'none';
cf-ray: 71009d5cdc209b43-FRA
cf-bgj: minify

GET
H2 200 api.min.js Show response
a.omappapi.com/app/js/ 194 KB
54 KB 172ms
53ms Script
application/javascript 185.93.2.243
CDN77 ^_^

General

Check archive.org

Show headers Download Go to

Full URL: https://a.omappapi.com/app/js/api.min.js
Requested by: Host: www.nowsecure.com
URL: https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.93.2.243 Paris, France, ASN60068 (CDN77 ^_^, GB),
Reverse DNS: unn-185-93-2-243.datapacket.com
Software: BunnyCDN-FR1-827 /
Resource Hash: ffe502118bc0aee7860c46e00171257b4218821138846a73d68e44f604662a8b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Mon, 23 May 2022 20:41:50 GMT
content-encoding: br
cdn-edgestorageid: 827
perma-cache: HIT
cdn-storageserver: DE-51
cdn-cachedat: 05/23/2022 20:30:49
cdn-pullzone: 293267
access-control-allow-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cdn-requestpullcode: 200
server: BunnyCDN-FR1-827
access-control-allow-origin: *
last-modified: Mon, 16 May 2022 18:33:44 GMT
cdn-proxyver: 1.02
cdn-fileserver: 324
etag: W/"62829908-30606"
vary: Accept-Encoding, Accept-Encoding
content-type: application/javascript
cdn-cache: HIT
access-control-expose-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cache-control: public, max-age=31919000
cdn-uid: efcab737-66db-4b75-ab55-ed485d5a01dd
cdn-requestid: 8b4d95e01cc2dba5154fcd70fa38c4e4
cdn-requestcountrycode: DE
cdn-status: 200
cdn-requestpullsuccess: True

GET
H2 200 pe0qMImSLYBIv1o4X1M8cce9I9s.woff2
fonts.gstatic.com/s/nunitosans/v12/ 17 KB
17 KB 122ms
37ms Font
font/woff2 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/nunitosans/v12/pe0qMImSLYBIv1o4X1M8cce9I9s.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Nunito%20Sans&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

97d5a594e7f76c7e50045b67667fd6b74b268515efe6425097be1b2647079787

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.nowsecure.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Mon, 23 May 2022 11:07:43 GMT
x-content-type-options: nosniff
age: 34447
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16980
x-xss-protection: 0
last-modified: Mon, 09 May 2022 18:33:54 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 23 May 2023 11:07:43 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 205 KB
71 KB 186ms
69ms Script
application/javascript 2a00:1450:4001:830::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-KMWSR9S

Requested by

Host: www.nowsecure.com
URL: https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

fd644f20e2890bfee73e02d814c859d48b960533d6aae7af37eb109d8a17e8d5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Mon, 23 May 2022 20:41:50 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 72496
x-xss-protection: 0
last-modified: Mon, 23 May 2022 19:51:46 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 23 May 2022 20:41:50 GMT

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/ 1 KB
1 KB 166ms
48ms Script
application/x-javascript 104.111.234.67
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/munchkin.js
Requested by: Host: www.nowsecure.com
URL: https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.111.234.67 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-234-67.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 4bf3aca933aa233702f890083af601fb16149ec8a17f8c1b90d30450562bde08

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Date: Mon, 23 May 2022 20:41:50 GMT
Content-Encoding: gzip
Last-Modified: Fri, 29 Oct 2021 01:24:07 GMT
Server: AkamaiNetStorage
ETag: "461ce1cffaadfebf2e7659745618ba8e:1635470647.434977"
Vary: Accept-Encoding
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: application/x-javascript
Content-Length: 753

GET
H2 200 tracking.js Show response
trk.techtarget.com/ 2 KB
1 KB 187ms
69ms Script
text/javascript 2606:4700:4400::6812:2a27
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://trk.techtarget.com/tracking.js
Requested by: Host: www.nowsecure.com
URL: https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::6812:2a27 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ac5000602bb127a5a07be117df96c48667d2e2a9fb1bb33d5ebb7c50e4480a88

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Mon, 23 May 2022 20:41:50 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 15 Oct 2021 14:31:37 GMT
server: cloudflare
age: 342
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript
expires: Mon, 23 May 2022 20:46:08 GMT
cache-control: max-age=1200
cf-ray: 71009d5d6f566957-FRA
cf-bgj: minify

GET
H2 200 tag.aspx Show response
ml314.com/ 31 KB
32 KB 165ms
47ms Script
application/javascript 34.111.234.236
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://ml314.com/tag.aspx?234
Requested by: Host: www.nowsecure.com
URL: https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.111.234.236 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 236.234.111.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 75d893335a1d25db1bf02e25ab904d97a3af743128850d8566b93d197e56e9e9

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Mon, 23 May 2022 19:42:30 GMT
age: 3560
x-guploader-uploadid: ADPycdvfxmqR3rXw0KDj3EvcjEzGTA6bijOSTSp1FfJqQYStJgmPQ0PHk2NGA4ka6AiQLLkgkwYW3hQeh2STb5wMmYd8BaHa6diM
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 32025
last-modified: Mon, 04 Apr 2022 15:43:44 GMT
server: UploadServer
cache-control: public,max-age=3600
etag: "25b1f355dd487bdf5381a749056080c4"
x-goog-hash: crc32c=dPpbog==, md5=JbHzVd1Ie99TgadJBWCAxA==
x-goog-generation: 1649087024620619
cache-id: FRA-fa985ced
x-cache-hit: hit
x-goog-stored-content-length: 32025
accept-ranges: bytes
content-type: application/javascript

GET
H2 200 engage Show response
nowsecure.us-4.evergage.com/api2/event/ 137 B
701 B 758ms
222ms XHR
application/json 52.88.33.114
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://nowsecure.us-4.evergage.com/api2/event/engage?event=eyJpdGVtQWN0aW9uIjpudWxsLCJzb3VyY2UiOnsicGFnZVR5cGUiOiJkZWZhdWx0IiwiY29udGVudFpvbmVzIjpbImdsb2JhbF9lbWFpbF9ib3R0b21fb2ZfcGFnZSJdLCJ1cmwiOiJodHRwczovL3d3dy5ub3dzZWN1cmUuY29tL2Jsb2cvMjAxNy8wNi8xNS9hLXBhdHRlcm4tZm9yLXJlbW90ZS1jb2RlLWV4ZWN1dGlvbi11c2luZy1hcmJpdHJhcnktZmlsZS13cml0ZXMtYW5kLW11bHRpZGV4LWFwcGxpY2F0aW9ucy8iLCJ1cmxSZWZlcnJlciI6IiIsImNoYW5uZWwiOiJXZWIiLCJiZWFjb25WZXJzaW9uIjoxNiwiY29uZmlnVmVyc2lvbiI6IjE1NyJ9LCJmbGFncyI6eyJwYWdlVmlldyI6dHJ1ZX0sInVzZXIiOnsiYW5vbklkIjoiN2E4ODJkOTEyZmU1OGQ1NiJ9LCJwZXJmb3JtYW5jZSI6e30sImRlYnVnIjp7ImV4cGxhbmF0aW9ucyI6dHJ1ZX0sImNhdGFsb2ciOnt9LCJjb25zZW50cyI6W10sImFjY291bnQiOnt9LCJfdG9vbHNFdmVudExpbmtJZCI6IjYzMjk3MjkxMzQ1OTk3MjIifQ%3D%3D

Requested by

Host: cdn.evgnet.com
URL: https://cdn.evgnet.com/beacon/nowsecure/engage/scripts/evergage.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.88.33.114 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-88-33-114.us-west-2.compute.amazonaws.com

Software

Resource Hash

513a235b91636710909b30122fd779c4346bda3c02688d05ef369ffd9ca7d9b9

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://www.nowsecure.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Mon, 23 May 2022 20:41:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
vary: accept-encoding
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://www.nowsecure.com
access-control-allow-credentials: true
timing-allow-origin: *

GET
H2 200 getForm Show response
info.nowsecure.com/index.php/form/ 3 KB
1 KB 114ms
112ms Script
application/javascript 104.17.70.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://info.nowsecure.com/index.php/form/getForm?munchkinId=201-XEW-873&form=1864&url=https%3A%2F%2Fwww.nowsecure.com%2Fblog%2F2017%2F06%2F15%2Fa-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications%2F&callback=jQuery1124047169088164555073_1653338509686&_=1653338509687
Requested by: Host: info.nowsecure.com
URL: https://info.nowsecure.com/js/forms2/js/forms2.min.js?ver=576
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 104.17.70.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4d9aca7a0a0df29e4ae225bfd8ec77433e5f594aae95f7482b17af62d93d77ea

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Mon, 23 May 2022 20:41:50 GMT
content-encoding: gzip
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cf-ray: 71009d5cefbf9bc2-FRA
cached: true

GET
H2 200 getForm Show response
info.nowsecure.com/index.php/form/ 3 KB
1 KB 116ms
115ms Script
application/javascript 104.17.70.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://info.nowsecure.com/index.php/form/getForm?munchkinId=201-XEW-873&form=1864&url=https%3A%2F%2Fwww.nowsecure.com%2Fblog%2F2017%2F06%2F15%2Fa-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications%2F&callback=jQuery1124047169088164555073_1653338509688&_=1653338509689
Requested by: Host: info.nowsecure.com
URL: https://info.nowsecure.com/js/forms2/js/forms2.min.js?ver=576
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 104.17.70.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c52cef61fc913fe9db19ce22a74b99487f80f96f7f2d6711f0aa1b25146957cd

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Mon, 23 May 2022 20:41:50 GMT
content-encoding: gzip
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cf-ray: 71009d5cefc09bc2-FRA
cached: true

GET
H2 200 hero-blue-background.jpg
www.nowsecure.com/wp-content/uploads/2019/11/ 19 KB
19 KB 87ms
80ms Image
image/jpeg 2606:4700:20::ac43:4987
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.nowsecure.com/wp-content/uploads/2019/11/hero-blue-background.jpg

Requested by

Host: www.nowsecure.com
URL: https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4987 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f811403705aeb303a686593d0f38979db1715bfe3ae0f6fda77ffb9bf6bdcf5c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Mon, 23 May 2022 20:41:50 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 730347
cf-polished: origSize=18974
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 18966
referrer-policy: strict-origin
last-modified: Mon, 14 Mar 2022 22:05:20 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "622fbc20-4a1e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jSdQLcm0vwoqwjIvEevoB7SoBDUVHl4LCf8jpNT1suvUcqvkwk168AV%2BYz4I0k3iDdobfx9qhIAaRfY7L8dHk2rO8wRRikEUrYmYZzFgH6NDWAXnAWa3fVl4kptu26hVxRMlhq0RZ75wBnDPA6jz"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
feature-policy: geolocation 'none';midi 'none';sync-xhr 'none';microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';speaker 'self';vibrate 'none';fullscreen 'self';payment 'none';
accept-ranges: bytes
cf-ray: 71009d5cfc4b9b43-FRA
cf-bgj: imgq:100,h2pri

GET
H2 200 WvsM-White-Paper-Feat-image-768x480-1-1-e1652198978481.png
www.nowsecure.com/wp-content/uploads/2022/05/ 36 KB
37 KB 83ms
76ms Image
image/png 2606:4700:20::ac43:4987
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.nowsecure.com/wp-content/uploads/2022/05/WvsM-White-Paper-Feat-image-768x480-1-1-e1652198978481.png

Requested by

Host: www.nowsecure.com
URL: https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4987 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

625678da4f32cce1cc042b7dc74311ac900d1ac476292184dd6d4f96bb600d94

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Mon, 23 May 2022 20:41:50 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 87878
cf-polished: origSize=38044
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 36929
referrer-policy: strict-origin
last-modified: Tue, 10 May 2022 16:09:38 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "627a8e42-949c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7kz5gxTcSertMhC82S%2F34mAXshBN%2Fh6KITf2BByrE9zFcEnuX8EJehU4GdBWNoHOw7i8T4EyNBcjaNOdxkEmxTOr0g4v9Mw41oXOgekSzkehrhgIAjMipOefowGCTDp0qHMkI22z0zHu1T5DBS2T"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
feature-policy: geolocation 'none';midi 'none';sync-xhr 'none';microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';speaker 'self';vibrate 'none';fullscreen 'self';payment 'none';
accept-ranges: bytes
cf-ray: 71009d5cfc509b43-FRA
cf-bgj: imgq:100,h2pri

GET
H2 200 Footet-BG.jpg
www.nowsecure.com/wp-content/uploads/2022/03/ 79 KB
79 KB 79ms
77ms Image
image/jpeg 2606:4700:20::ac43:4987
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.nowsecure.com/wp-content/uploads/2022/03/Footet-BG.jpg

Requested by

Host: www.nowsecure.com
URL: https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4987 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a2222159f7d51a8387b1730a9d166751d24ffd056c7bf29bf5ed58a604efa0af

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Mon, 23 May 2022 20:41:50 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 803001
cf-polished: origSize=87185
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 80900
referrer-policy: strict-origin
last-modified: Mon, 14 Mar 2022 22:05:15 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "622fbc1b-15491"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=BEgznXnxpTcz1%2BEi1uz71i2tr42NdNPDztto13ImXBYGYnYXyobJYQ7AnRMs43s%2F9iqrD8G3XyX%2FrAasDiuIce5TBp7mbez2W9SFX7jV1NHlcOSBdk5gBPNYe3ImEkSI6A3iGIOVtJ113O7scZBW"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
feature-policy: geolocation 'none';midi 'none';sync-xhr 'none';microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';speaker 'self';vibrate 'none';fullscreen 'self';payment 'none';
accept-ranges: bytes
cf-ray: 71009d5cfc559b43-FRA
cf-bgj: imgq:100,h2pri

GET
H2 200 shCore.css
www.nowsecure.com/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/styles/ 5 KB
1 KB 60ms
57ms Stylesheet
text/css 2606:4700:20::ac43:4987
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.nowsecure.com/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/styles/shCore.css?ver=3.0.9b

Requested by

Host: www.nowsecure.com
URL: https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4987 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0ac02552a5875932b835d30e9db135a212063ee77a1723138d3a88f4158eab14

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Mon, 23 May 2022 20:41:51 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 731108
cf-polished: origSize=6813
vary: Accept-Encoding, Accept-Encoding
referrer-policy: strict-origin
last-modified: Mon, 14 Mar 2022 22:05:46 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"622fbc3a-1a9d"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jAQeM4He3RZx8hSv12al5L%2FWYf3%2FyFN%2BQPn78WTPqPzKtKlspDrfstWzf9ZYc4EXMrx%2F2xSxWr%2Bb0kApqr11YhF%2BLnPiQnQWmLM0Z64lRk2mpWhL9MG76cLSjjv0q5ntq6e6J9ek7cfkyqxroPb8"}],"group":"cf-nel","max_age":604800}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
feature-policy: geolocation 'none';midi 'none';sync-xhr 'none';microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';speaker 'self';vibrate 'none';fullscreen 'self';payment 'none';
cf-ray: 71009d5eaf7a9b43-FRA
cf-bgj: minify

GET
H2 200 shThemeDefault.css
www.nowsecure.com/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/styles/ 2 KB
813 B 51ms
47ms Stylesheet
text/css 2606:4700:20::ac43:4987
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.nowsecure.com/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/styles/shThemeDefault.css?ver=3.0.9b

Requested by

Host: www.nowsecure.com
URL: https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4987 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6163607ff0d5fd12f5c2b16a42fce3ee9595537c37deccd4cdf9a941b1286c5d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Mon, 23 May 2022 20:41:51 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 4023997
cf-polished: origSize=2877
vary: Accept-Encoding, Accept-Encoding
referrer-policy: strict-origin
last-modified: Mon, 14 Mar 2022 22:05:47 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"622fbc3b-b3d"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JvHXfRL2SJ1PhSTE4kp%2BPDe6vN4Ig%2BEUZ4S6kM%2FVo1XDkAQjdkWBSMf7NReY0m%2Bt3Qk9culOgPNdb5lRuxB48TwY9xdMZydsBGMnif%2BXelIyphSMvK0bkirlBdCHESk7%2BTm3ukb61nl%2BhaXh3dnx"}],"group":"cf-nel","max_age":604800}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
feature-policy: geolocation 'none';midi 'none';sync-xhr 'none';microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';speaker 'self';vibrate 'none';fullscreen 'self';payment 'none';
cf-ray: 71009d5eaf829b43-FRA
cf-bgj: minify

GET
H2 200 pro.min.css Show response
ka-p.fontawesome.com/releases/v5.15.4/css/ 315 KB
53 KB 159ms
59ms Fetch
text/css 2606:4700::6812:1634
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ka-p.fontawesome.com/releases/v5.15.4/css/pro.min.css?token=3fb0309a29
Requested by: Host: kit.fontawesome.com
URL: https://kit.fontawesome.com/3fb0309a29.js?ver=1.0.0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1634 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 37c65071f378cc9582aabdda3b52979ef901f2925e3f3c3dc597f41eac0f1b6d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Mon, 23 May 2022 20:41:51 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Wed, 04 Aug 2021 18:53:09 GMT
server: cloudflare
age: 433901
etag: "610ae215-d3b2"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Origin, Accept-Encoding, Access-Control-Request-Headers, Access-Control-Request-Method
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31556926
accept-ranges: bytes
cf-ray: 71009d5f4ebd92a7-FRA
content-length: 54194

GET
H2 200 pro-v4-shims.min.css Show response
ka-p.fontawesome.com/releases/v5.15.4/css/ 26 KB
4 KB 156ms
56ms Fetch
text/css 2606:4700::6812:1634
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ka-p.fontawesome.com/releases/v5.15.4/css/pro-v4-shims.min.css?token=3fb0309a29
Requested by: Host: kit.fontawesome.com
URL: https://kit.fontawesome.com/3fb0309a29.js?ver=1.0.0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1634 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4245ecca2a4b50d7fd9adc9a965ed1f9b4ec24e9935e34c80efafc0f856d54c6

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Mon, 23 May 2022 20:41:51 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Wed, 04 Aug 2021 18:53:09 GMT
server: cloudflare
age: 10234043
etag: "610ae215-1062"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Origin, Accept-Encoding, Access-Control-Request-Headers, Access-Control-Request-Method
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31556926
accept-ranges: bytes
cf-ray: 71009d5f4ec392a7-FRA
content-length: 4194

GET
H2 200 pro-v4-font-face.min.css Show response
ka-p.fontawesome.com/releases/v5.15.4/css/ 27 KB
3 KB 157ms
57ms Fetch
text/css 2606:4700::6812:1634
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ka-p.fontawesome.com/releases/v5.15.4/css/pro-v4-font-face.min.css?token=3fb0309a29
Requested by: Host: kit.fontawesome.com
URL: https://kit.fontawesome.com/3fb0309a29.js?ver=1.0.0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1634 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a8a00b576cc9fad532a52ecdf8024724ddaa83cb0f5ca5d1b1d6eb8841103d60

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Mon, 23 May 2022 20:41:51 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Wed, 04 Aug 2021 18:53:09 GMT
server: cloudflare
age: 10234043
etag: "610ae215-a2b"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Origin, Accept-Encoding, Access-Control-Request-Headers, Access-Control-Request-Method
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31556926
accept-ranges: bytes
cf-ray: 71009d5f4ec492a7-FRA
content-length: 2603

GET
H2 200 jukebox.js Show response
cdn-app.pathfactory.com/production/jukebox/current/ 887 KB
242 KB 147ms
42ms Script
text/javascript 13.224.198.41
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn-app.pathfactory.com/production/jukebox/current/jukebox.js
Requested by: Host: www.nowsecure.com
URL: https://www.nowsecure.com/wp-content/themes/nowsecure-2016/resources/build/scripts/main.min.js?ver=576
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.198.41 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-198-41.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 3baac7f6496e21443822d21a036f03cbd750d24f4b6269de361fc7ef9fb81810

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

x-amz-version-id: null
content-encoding: gzip
last-modified: Wed, 11 May 2022 01:08:44 GMT
server: AmazonS3
age: 21967
etag: W/"f88f11998b0139e7a04eda58ad4c0acd"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript
via: 1.1 0b9e85cfe8fe19b385db56d32b4ce802.cloudfront.net (CloudFront)
cache-control: max-age=43200
date: Mon, 23 May 2022 14:35:53 GMT
x-amz-cf-pop: FRA2-C1
x-amz-cf-id: MfF7TpdmeAGW6J_Y0YIXNr-sF6EriDuq-bGBcosH8VnaMwlMuHByKg==

GET
H2 200 uwt.js Show response
static.ads-twitter.com/ 48 KB
14 KB 143ms
47ms Script
application/javascript 199.232.136.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/uwt.js
Requested by: Host: www.nowsecure.com
URL: https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 199.232.136.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: d217d238f3f2648014fb12906dca5366954ffa6256d160726190d9e0e9c8376a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Mon, 23 May 2022 20:41:51 GMT
content-encoding: gzip
last-modified: Wed, 18 May 2022 16:49:30 GMT
etag: "39dd6daafb219ee61305f13521c2d060+gzip+gzip"
vary: Accept-Encoding,Host
x-tw-cdn: FT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
cache-control: no-cache
x-cache: HIT, HIT
accept-ranges: bytes
content-type: application/javascript; charset=utf-8
content-length: 14051
x-served-by: cache-iad-kcgs7200157-IAD, cache-hhn11549-HHN

GET
H/1.1 200
OK insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 8 KB
3 KB 143ms
49ms Script
application/x-javascript 2a02:26f0:3500:7::17d8:4dd3
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by: Host: www.nowsecure.com
URL: https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:7::17d8:4dd3 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: 14f2ec002b176e0dee403cb7dd4ef2274a1353080e1e3e4084678770f4c15b9c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Date: Mon, 23 May 2022 20:41:51 GMT
Content-Encoding: gzip
Last-Modified: Wed, 13 Apr 2022 23:25:22 GMT
X-CDN: AKAM
Vary: Accept-Encoding
Content-Type: application/x-javascript;charset=utf-8
Cache-Control: max-age=52278
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 3085

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 99 KB
27 KB 124ms
46ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: www.nowsecure.com
URL: https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

acbe6770b0fc8b621a9d4f7068b241fb403fe999ea33270931ee59ec4cfdf3f1

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding: gzip
x-content-type-options: nosniff
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400,h3-29=":443"; ma=86400
content-length: 26310
x-xss-protection: 0
pragma: public
x-fb-debug: CUpG41B35eW/Jq2RKTIv537wP5zG551+jw0Y0j+yXJzY9Zz+y9Q/vtwjwg2Fdm6w1NviQC+JqbMSWeVqtpJWhw==
x-fb-trip-id: 686109401
x-frame-options: DENY
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
date: Mon, 23 May 2022 20:41:51 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 forms2.css
info.nowsecure.com/js/forms2/css/ 13 KB
3 KB 179ms
179ms Stylesheet
text/css 104.17.70.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://info.nowsecure.com/js/forms2/css/forms2.css

Requested by

Host: info.nowsecure.com
URL: https://info.nowsecure.com/js/forms2/js/forms2.min.js?ver=576

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.70.206 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

256e42104f48a5fa80b031da12dc56acde224fba3f9810f8f8192b39136d365a

Security Headers

Name	Value
Strict-Transport-Security	max-age=63113904
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Mon, 23 May 2022 20:41:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: REVALIDATED
vary: Accept-Encoding
content-length: 2623
last-modified: Tue, 03 May 2022 03:46:42 GMT
server: cloudflare
etag: "36076b-3437-5de135b5b2c80"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=63113904
content-type: text/css
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 71009d5ebc1d9bc2-FRA
expires: Tue, 24 May 2022 00:41:51 GMT

GET
H2 200 forms2-theme-plain.css
info.nowsecure.com/js/forms2/css/ 828 B
413 B 152ms
152ms Stylesheet
text/css 104.17.70.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://info.nowsecure.com/js/forms2/css/forms2-theme-plain.css

Requested by

Host: info.nowsecure.com
URL: https://info.nowsecure.com/js/forms2/js/forms2.min.js?ver=576

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.70.206 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

57cd46adbabd6c40823602b4513aecbe89320a769572255272abe9f008de69fa

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Mon, 23 May 2022 20:41:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: REVALIDATED
last-modified: Tue, 03 May 2022 03:46:42 GMT
server: cloudflare
etag: "36076d-33c-5de135b5b2c80"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 71009d5ebc209bc2-FRA
content-length: 246
expires: Tue, 24 May 2022 00:41:51 GMT

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/161/ 11 KB
5 KB 39ms
38ms Script
application/x-javascript 104.111.234.67
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/161/munchkin.js
Requested by: Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/munchkin.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.111.234.67 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-234-67.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: c2aee78040b4ed46c2377e6825db12a9691a2eb584adf338e77312c8978d8537

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Date: Mon, 23 May 2022 20:41:51 GMT
Content-Encoding: gzip
Last-Modified: Wed, 08 Sep 2021 00:38:21 GMT
Server: AkamaiNetStorage
ETag: "0e0eefac8daf874e8b1aa34aeb160c52:1631061501.737429"
Vary: Accept-Encoding
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Cache-Control: max-age=8640000
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: application/x-javascript
Content-Length: 4681
Expires: Wed, 31 Aug 2022 20:41:51 GMT

GET
H2 200 utsync.ashx Show response
ml314.com/ 62 B
309 B 131ms
128ms Script
application/javascript 34.111.234.236
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://ml314.com/utsync.ashx?pub=&adv=&et=0&eid=81430&ct=js&pi=&fp=&clid=&if=0&ps=&cl=&mlt=&data=&&cp=https%3A%2F%2Fwww.nowsecure.com%2Fblog%2F2017%2F06%2F15%2Fa-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications%2F&pv=1653338510114_vy7t93oh6&bl=en-us&cb=211265&return=&ht=&d=&dc=&si=1653338510114_vy7t93oh6&cid=84fb030a-2621-4a09-8f10-943d23e9350e&s=1600x1200&rp=&v=2.5.1.2
Requested by: Host: ml314.com
URL: https://ml314.com/tag.aspx?234
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.111.234.236 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 236.234.111.34.bc.googleusercontent.com
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 5a1ba6ff6db12f791bbbfc4da3cb389e06f0cd53eede09ef3eb3ceb074089ef1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 23 May 2022 20:41:50 GMT
via: 1.1 google
server: Microsoft-IIS/10.0
x-aspnet-version: 4.0.30319
x-powered-by: ASP.NET
p3p: CP="NON DSP COR ADMo PSAo DEVo BUS COM UNI NAV DEM STA"
cache-control: no-cache, no-store, must-revalidate
content-type: application/javascript; charset=utf-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 62
expires: 0

GET
H/1.1 200
OK activity.gif
apt.techtarget.com/activity/ 43 B
324 B 536ms
130ms Image
image/gif 206.19.49.24
ATT-CERFNET-BLOCK

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://apt.techtarget.com/activity/activity.gif?activityTypeId=31&cid=16504986&version=2.1.1&ref=https%3A%2F%2Fwww.nowsecure.com%2Fblog%2F2017%2F06%2F15%2Fa-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications%2F&r=1653338510121
Requested by: Host: www.nowsecure.com
URL: https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 206.19.49.24 , United States, ASN17225 (ATT-CERFNET-BLOCK, US),
Reverse DNS
Software: Apache/2.4.6 (CentOS) /
Resource Hash: 2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Date: Mon, 23 May 2022 20:41:51 GMT
Last-Modified: Tue, 26 Mar 2019 18:30:29 GMT
Server: Apache/2.4.6 (CentOS)
ETag: "2b-5850384023492"
Content-Type: image/gif
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=76
Content-Length: 43

GET
H2 200 api.min.css
a.omappapi.com/app/js/ 18 KB
3 KB 53ms
53ms Stylesheet
text/css 185.93.2.243
CDN77 ^_^

General

Check archive.org

Show headers Download Go to

Full URL: https://a.omappapi.com/app/js/api.min.css
Requested by: Host: a.omappapi.com
URL: https://a.omappapi.com/app/js/api.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.93.2.243 Paris, France, ASN60068 (CDN77 ^_^, GB),
Reverse DNS: unn-185-93-2-243.datapacket.com
Software: BunnyCDN-FR1-827 /
Resource Hash: 4b99a75a42582fd22e780855dfb50880df624ce43988616f4b19dc7ba90f1250

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Mon, 23 May 2022 20:41:51 GMT
content-encoding: br
cdn-edgestorageid: 827
perma-cache: HIT
cdn-storageserver: DE-164
cdn-cachedat: 05/23/2022 20:30:45
cdn-pullzone: 293267
access-control-allow-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cdn-requestpullcode: 200
server: BunnyCDN-FR1-827
access-control-allow-origin: *
last-modified: Mon, 16 May 2022 18:33:39 GMT
cdn-proxyver: 1.02
cdn-fileserver: 324
etag: W/"62829903-464c"
vary: Accept-Encoding, Accept-Encoding
content-type: text/css
cdn-cache: HIT
access-control-expose-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cache-control: public, max-age=31919000
cdn-uid: efcab737-66db-4b75-ab55-ed485d5a01dd
cdn-requestid: d74d04fca05021ed77bce8cbb9df2c5e
cdn-requestcountrycode: DE
cdn-status: 200
cdn-requestpullsuccess: True

GET
H2 200 90851 Show response
api.omappapi.com/v2/embed/ 227 B
827 B 298ms
170ms XHR
application/json 13.225.80.86
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.omappapi.com/v2/embed/90851?d=nowsecure.com
Requested by: Host: a.omappapi.com
URL: https://a.omappapi.com/app/js/api.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.80.86 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-80-86.fra2.r.cloudfront.net
Software: Pagely Gateway/1.5.1 /
Resource Hash: 5aa4142a40b5a1e0cdee8d5416c145c0e3d8b785254a566b5393069dcd2e0de8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Mon, 23 May 2022 20:41:51 GMT
via: 1.1 590590f04f79f692591f9db0e720a31c.cloudfront.net (CloudFront)
x-cache-config: 0 0
x-amz-cf-pop: FRA2-C2
x-cache-status: EXPIRED
x-cache: Miss from cloudfront
content-length: 227
x-optinmonster-account: 101485
x-user-agent: standard--
last-modified: Thu, 01 Jan 1970 00:00:00 GMT
server: Pagely Gateway/1.5.1
etag: "b91e5dc54e033e761837b7b846da520f"
vary: Accept-Encoding, User-Agent
content-type: application/json
access-control-allow-origin: *
access-control-expose-headers: X-OptinMonster-Account, X-User-Agent
cache-control: public, max-age=30, stale-while-revalidate=1800
access-control-allow-headers: X-CSRF-Token
x-amz-cf-id: NW75wi2cu62SUYq7ngvtO_HRPSHGE-JCHBsVmG1dN5I4aQfVospa2g==
expires: Mon, 23 May 2022 20:42:21 GMT

GET
H2 200 optimize.js Show response
www.google-analytics.com/gtm/ 96 KB
38 KB 196ms
73ms Script
application/javascript 2a00:1450:4001:80e::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/gtm/optimize.js?id=GTM-KZKPCLZ

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KMWSR9S

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

386ab100d5c0cc50f185cbb37805c729a19f2fc0446ee6df60955db6b9022134

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Mon, 23 May 2022 20:41:51 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38259
x-xss-protection: 0
last-modified: Mon, 23 May 2022 19:51:46 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 23 May 2022 20:41:51 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 189 KB
68 KB 158ms
60ms Script
application/javascript 2a00:1450:4001:830::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-TJ8H8840QM&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KMWSR9S

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

8bbc0b2faa7fc7f814af324a077a85a2a5016bb39f43e2939dc13925c19ce006

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Mon, 23 May 2022 20:41:51 GMT
content-encoding: br
server: Google Tag Manager
access-control-allow-headers: Cache-Control
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 69576
x-xss-protection: 0
expires: Mon, 23 May 2022 20:41:51 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 49 KB
20 KB 136ms
37ms Script
text/javascript 2a00:1450:4001:80e::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KMWSR9S

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 13 Apr 2022 21:02:38 GMT
server: Golfe2
age: 4025
date: Mon, 23 May 2022 19:34:46 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20006
expires: Mon, 23 May 2022 21:34:46 GMT

GET
H2 200 hotjar-1091679.js Show response
static.hotjar.com/c/ 5 KB
3 KB 213ms
81ms Script
application/javascript 13.225.80.58
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://static.hotjar.com/c/hotjar-1091679.js?sv=7

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KMWSR9S

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.225.80.58 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-225-80-58.fra2.r.cloudfront.net

Software

Resource Hash

d435f04f716a1686cbce45925c71f32ec452c56cf849b46ee0b09b81eaeb27b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Mon, 23 May 2022 20:41:51 GMT
content-encoding: br
x-content-type-options: nosniff
cache-control: max-age=60
x-amz-cf-pop: FRA2-C2
etag: W/d758c04ce35787ab6790718909ab6fd3
vary: Accept-Encoding
x-cache: RefreshHit from cloudfront
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
x-cache-hit: 1
cross-origin-resource-policy: cross-origin
x-amz-cf-id: AYCthGo7zGmhroRGhCiUeIJ3_2h4ne6mglTp2X7aSuaGuzgkIBuM6g==
via: 1.1 21a3da42c823b5a4a2d9c4c63248bbd6.cloudfront.net (CloudFront)

GET
H2 200 conversion_async.js Show response
www.googleadservices.com/pagead/ 39 KB
15 KB 189ms
58ms Script
text/javascript 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion_async.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KMWSR9S

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f2.1e100.net

Software

cafe /

Resource Hash

0a9adccc17d9e34e3971bce91e3723f1fef884844fed6e6e10085e19745faef5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Mon, 23 May 2022 20:41:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14849
x-xss-protection: 0
server: cafe
etag: 10272469744856839321
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Mon, 23 May 2022 20:41:51 GMT

GET
H2 200 514d3f40ca3ece89.min.js Show response
tag.demandbase.com/ 66 KB
18 KB 329ms
45ms Script
application/javascript 13.224.198.61
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://tag.demandbase.com/514d3f40ca3ece89.min.js

Requested by

Host: www.nowsecure.com
URL: https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.198.61 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-198-61.fra2.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

efaefbca699704ae2692aed4c8fb84c872d99c3b74e5c3c4465abc91191ec145

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

x-amz-version-id: pJYUV1U5bt7xkZjqRHRW3xEdIIYeD9aF
content-encoding: gzip
etag: W/"992d7a1e3da2a291e6ba8d5ecc5a05d3"
age: 3074
x-cache: Hit from cloudfront
vary: Accept-Encoding
last-modified: Thu, 03 Mar 2022 16:06:50 GMT
server: AmazonS3
date: Mon, 23 May 2022 19:50:38 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
content-type: application/javascript; charset=utf-8
via: 1.1 cdcb559c2f25d8ad2ccf0419bee33b02.cloudfront.net (CloudFront)
cache-control: public, max-age=3600
permissions-policy: accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=(), interest-cohort=()
x-amz-cf-pop: FRA2-C1
x-amz-cf-id: BK2kTK6IqK2SlyTLJ8ZlRNTaNoUOT5jsHEyKRhr1OcKMjA3vispGOA==

GET
H2 200 shim.js Show response
edge.marker.io/latest/ 40 KB
13 KB 179ms
48ms Script
application/javascript 2a06:98c1:3120::a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://edge.marker.io/latest/shim.js
Requested by: Host: www.nowsecure.com
URL: https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a06:98c1:3120::a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bfb65c2bfc46002d44857fa454a4520b8363ca95d7b1c9933fc313593dc0b520

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Mon, 23 May 2022 20:41:51 GMT
via: 1.1 b1dc6a0d7547e8d4ab339f8c4caf9ea8.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 118
x-cache: Miss from cloudfront
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Fri, 13 May 2022 10:09:19 GMT
server: cloudflare
etag: W/"8fd0dcf6d05b0e60f58976d1313505dd"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=y9o7dbRTCTPJqOicOgf8Mt4sPHd452%2FNKgvD6%2Bwi07lP%2BjvvFixddQEDtAFfAFAy3eg7QT%2FHz%2FDGDtSGlE9BSxAyIibi25YPypONTRbKy2EW0tnEo%2BtLQPqSrSeRLeO9jsNj4UoPjOb7zL6adg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=300,public
x-amz-cf-pop: DUS51-P2
cf-ray: 71009d60ac179195-FRA
x-amz-cf-id: hXDZi9s4qBeCsPqLdTyMSLcwq8D1A_M-vEGls7cMV_K5ta-Pyv3LhQ==

POST
H/1.1 200
OK visitWebPage
201-xew-873.mktoresp.com/webevents/ 2 B
311 B 700ms
122ms Ping
text/plain 192.28.144.124
OMNITURE

General

Check archive.org

Show headers Download Go to

Full URL: https://201-xew-873.mktoresp.com/webevents/visitWebPage?_mchNc=1653338510381&_mchCn=&_mchId=201-XEW-873&_mchTk=_mch-nowsecure.com-1653338510377-89343&_mchHo=www.nowsecure.com&_mchPo=&_mchRu=%2Fblog%2F2017%2F06%2F15%2Fa-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications%2F&_mchPc=https%3A&_mchVr=161&_mchEcid=&_mchHa=&_mchRe=&_mchQp=
Requested by: Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/161/munchkin.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 192.28.144.124 , United States, ASN15224 (OMNITURE, US),
Reverse DNS
Software: nginx /
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Date: Mon, 23 May 2022 20:41:52 GMT
Content-Encoding: gzip
Server: nginx
Transfer-Encoding: chunked
Content-Type: text/plain; charset=UTF-8
Access-Control-Allow-Origin: *
Connection: keep-alive
X-Request-Id: fffe101f-a2ba-4d56-9bca-2e0ec6425e11

GET
H3 200 1728859480752613 Show response
connect.facebook.net/signals/config/ 305 KB
87 KB 297ms
216ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/1728859480752613?v=2.9.60&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

dedcaf1428313f932058701825b598dc3eb1b26a561b5f7bd862961b17f0c9d6

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding: gzip
x-content-type-options: nosniff
document-policy: force-load-at-top
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400,h3-29=":443"; ma=86400
x-xss-protection: 0
pragma: public
x-fb-debug: fk/bkCyrMKOmskvXHx2TBtsgrmlmHDB6REITUCbbNM2BcPaep2Rx73BV0tfSMFz3f5rTAiWUZF3Pp82D7BlXGQ==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: DENY
date: Mon, 23 May 2022 20:41:51 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
x-content-cdn-origin-ts: 1653338511737
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2

200

collect
px4.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=29257&time=1653338510420&url=https%3A%2F%2Fwww.nowsecure.com%2Fblog%2F2017%2F06%2F15%2Fa-pattern-for-remote-code-execution-using-arbitrary-file-wr...
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D29257%26time%3D1653338510420%26url%3Dhttps%253A%252F%252Fwww.nowsecure.com%252Fbl...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=29257&time=1653338510420&url=https%3A%2F%2Fwww.nowsecure.com%2Fblog%2F2017%2F06%2F15%2Fa-pattern-for-remote-code-execution-using-arbitrary-file-wr...
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=29257&time=1653338510420&url=https%3A%2F%2Fwww.nowsecure.com%2Fblog%2F2017%2F06%2F15%2Fa-pattern-for-remote-code-execution-using-arbitrary-file-w...

0
265 B

301ms
218ms

Image
application/javascript

13.107.42.14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=29257&time=1653338510420&url=https%3A%2F%2Fwww.nowsecure.com%2Fblog%2F2017%2F06%2F15%2Fa-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications%2F&liSync=true&e_ipv6=AQLLiz5uhzZB5QAAAYDyp5t_RrbtOVxFQ72bGIHNRGAgycE-KcgU3IFmT94Hup5A_0yzjxg
Requested by: Host: www.nowsecure.com
URL: https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/
Protocol: H2
Server: 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Mon, 23 May 2022 20:41:52 GMT
x-li-pop: afd-prod-lor1-x
x-msedge-ref: Ref A: DF4B9FB5BA5C4593A9CE13E066E35E81 Ref B: FRAEDGE1421 Ref C: 2022-05-23T20:41:52Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
content-type: application/javascript
x-li-proto: http/2
content-length: 0
x-li-uuid: AAXfs969Of3+lIk168LsRQ==
x-li-fabric: prod-lor1

Redirect headers

date: Mon, 23 May 2022 20:41:51 GMT
x-li-pop: afd-prod-lor1-x
x-msedge-ref: Ref A: E790B07631A14F82BF29025EBEE1BDBE Ref B: FRAEDGE1411 Ref C: 2022-05-23T20:41:52Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-lor1
location: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=29257&time=1653338510420&url=https%3A%2F%2Fwww.nowsecure.com%2Fblog%2F2017%2F06%2F15%2Fa-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications%2F&liSync=true&e_ipv6=AQLLiz5uhzZB5QAAAYDyp5t_RrbtOVxFQ72bGIHNRGAgycE-KcgU3IFmT94Hup5A_0yzjxg
x-li-proto: http/2
content-length: 0
x-li-uuid: AAXfs963PZK4/XQTzbW7hw==

GET
H2 200 adsct
analytics.twitter.com/i/ 43 B
222 B 266ms
146ms Image
image/gif 104.244.42.131
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://analytics.twitter.com/i/adsct?type=javascript&version=2.3.12&p_id=Twitter&p_user_id=0&txn_id=nvlqg&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&tw_order_quantity=0&tw_sale_amount=0&tw_iframe_status=0&event_id=90b7e8a6-44fd-4f90-9965-99205db92dd1&tw_document_href=https%3A%2F%2Fwww.nowsecure.com%2Fblog%2F2017%2F06%2F15%2Fa-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications%2F

Requested by

Host: www.nowsecure.com
URL: https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.131 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

x-response-time: 109
date: Mon, 23 May 2022 20:41:51 GMT
server: tsa_o
strict-transport-security: max-age=631138519
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, max-age=0
x-connection-hash: a96ffb9f082abbd8b20135614f9d39c0970a7b898d090770f56e51b61c244a4e
content-length: 43

GET
H2 200 adsct
t.co/i/ 43 B
187 B 257ms
153ms Image
image/gif 104.244.42.5
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?type=javascript&version=2.3.12&p_id=Twitter&p_user_id=0&txn_id=nvlqg&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&tw_order_quantity=0&tw_sale_amount=0&tw_iframe_status=0&event_id=90b7e8a6-44fd-4f90-9965-99205db92dd1&tw_document_href=https%3A%2F%2Fwww.nowsecure.com%2Fblog%2F2017%2F06%2F15%2Fa-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications%2F

Requested by

Host: www.nowsecure.com
URL: https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.5 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

x-response-time: 116
date: Mon, 23 May 2022 20:41:50 GMT
server: tsa_o
strict-transport-security: max-age=0
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, max-age=0
x-connection-hash: 15bf5729290bca863321ac79a6c1ce993b8b0c9e7487f3d86cc261529a4ed2e1
content-length: 43

GET
H2 200 adsct
analytics.twitter.com/i/ 43 B
355 B 262ms
144ms Image
image/gif 104.244.42.131
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://analytics.twitter.com/i/adsct?type=javascript&version=2.3.12&p_id=Twitter&p_user_id=0&txn_id=nvlqg&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&tw_order_quantity=0&tw_sale_amount=0&tw_iframe_status=0&event_id=e1485acf-f89f-44b4-a19c-ade291550b91&tw_document_href=https%3A%2F%2Fwww.nowsecure.com%2Fblog%2F2017%2F06%2F15%2Fa-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications%2F

Requested by

Host: www.nowsecure.com
URL: https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.131 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

x-response-time: 106
date: Mon, 23 May 2022 20:41:50 GMT
server: tsa_o
strict-transport-security: max-age=631138519
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, max-age=0
x-connection-hash: a96ffb9f082abbd8b20135614f9d39c0970a7b898d090770f56e51b61c244a4e
content-length: 43

GET
H2 200 adsct
t.co/i/ 43 B
336 B 195ms
141ms Image
image/gif 104.244.42.5
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?type=javascript&version=2.3.12&p_id=Twitter&p_user_id=0&txn_id=nvlqg&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&tw_order_quantity=0&tw_sale_amount=0&tw_iframe_status=0&event_id=e1485acf-f89f-44b4-a19c-ade291550b91&tw_document_href=https%3A%2F%2Fwww.nowsecure.com%2Fblog%2F2017%2F06%2F15%2Fa-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications%2F

Requested by

Host: www.nowsecure.com
URL: https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.5 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

x-response-time: 103
date: Mon, 23 May 2022 20:41:50 GMT
server: tsa_o
strict-transport-security: max-age=0
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, max-age=0
x-connection-hash: 15bf5729290bca863321ac79a6c1ce993b8b0c9e7487f3d86cc261529a4ed2e1
content-length: 43

GET
H2 200 adsct
analytics.twitter.com/i/ 43 B
195 B 215ms
147ms Image
image/gif 104.244.42.131
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://analytics.twitter.com/i/adsct?type=javascript&version=2.3.12&p_id=Twitter&p_user_id=0&txn_id=nvlqg&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&tw_order_quantity=0&tw_sale_amount=0&tw_iframe_status=0&event_id=1601e4ae-75d6-48af-b234-25987394a6ca&tw_document_href=https%3A%2F%2Fwww.nowsecure.com%2Fblog%2F2017%2F06%2F15%2Fa-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications%2F

Requested by

Host: www.nowsecure.com
URL: https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.131 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

x-response-time: 109
date: Mon, 23 May 2022 20:41:51 GMT
server: tsa_o
strict-transport-security: max-age=631138519
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, max-age=0
x-connection-hash: a96ffb9f082abbd8b20135614f9d39c0970a7b898d090770f56e51b61c244a4e
content-length: 43

GET
H2 200 adsct
t.co/i/ 43 B
211 B 158ms
158ms Image
image/gif 104.244.42.5
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?type=javascript&version=2.3.12&p_id=Twitter&p_user_id=0&txn_id=nvlqg&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&tw_order_quantity=0&tw_sale_amount=0&tw_iframe_status=0&event_id=1601e4ae-75d6-48af-b234-25987394a6ca&tw_document_href=https%3A%2F%2Fwww.nowsecure.com%2Fblog%2F2017%2F06%2F15%2Fa-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications%2F

Requested by

Host: www.nowsecure.com
URL: https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.5 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

x-response-time: 120
date: Mon, 23 May 2022 20:41:51 GMT
server: tsa_o
strict-transport-security: max-age=0
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, max-age=0
x-connection-hash: 15bf5729290bca863321ac79a6c1ce993b8b0c9e7487f3d86cc261529a4ed2e1
content-length: 43

GET
H2 200 pro-fa-brands-400-5.0.0.woff2
ka-p.fontawesome.com/releases/v5.15.4/webfonts/ 37 KB
37 KB 61ms
53ms Font
font/woff2 2606:4700::6812:1634
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ka-p.fontawesome.com/releases/v5.15.4/webfonts/pro-fa-brands-400-5.0.0.woff2
Requested by: Host: www.nowsecure.com
URL: https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1634 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 49fd3e0c64f247cf56cb828bc37b88cf139df6e5c7bb4c3a4507f740e9a52c17

Request headers

Referer: https://www.nowsecure.com/
Origin: https://www.nowsecure.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Mon, 23 May 2022 20:41:51 GMT
cf-cache-status: HIT
last-modified: Wed, 04 Aug 2021 18:58:25 GMT
server: cloudflare
age: 317818
etag: "610ae351-93a4"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Origin, Accept-Encoding, Access-Control-Request-Headers, Access-Control-Request-Method
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=31556926
accept-ranges: bytes
cf-ray: 71009d618a1f92a7-FRA
content-length: 37796

OPTIONS
H2 200 init
jukebox.pathfactory.com/api/public/v1/ Frame 0
0 389ms
130ms Preflight 18.208.17.54
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://jukebox.pathfactory.com/api/public/v1/init?clientId=LB-60A06E40-10540&image=&title=&url=https%3A%2F%2Fwww.nowsecure.com%2Fblog%2F2017%2F06%2F15%2Fa-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications%2F
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.208.17.54 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-208-17-54.compute-1.amazonaws.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://www.nowsecure.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET, PUT, POST, PATCH, OPTIONS
access-control-allow-origin: https://www.nowsecure.com
access-control-expose-headers
access-control-max-age: 7200
date: Mon, 23 May 2022 20:41:52 GMT

GET
H2 200 font-awesome.min.css
maxcdn.bootstrapcdn.com/font-awesome/4.6.1/css/ 28 KB
7 KB 149ms
68ms Stylesheet
text/css 2606:4700::6812:acf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://maxcdn.bootstrapcdn.com/font-awesome/4.6.1/css/font-awesome.min.css

Requested by

Host: cdn-app.pathfactory.com
URL: https://cdn-app.pathfactory.com/production/jukebox/current/jukebox.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:acf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b5d7707ea8fc00aae40bf500ac7498d7f32f6b1bbff7b4fde976a40345eb5f9d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Mon, 23 May 2022 20:41:51 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
cdn-edgestorageid: 617, 617
age: 10234776
cdn-cachedat: 2021-06-03 22:46:19
cdn-pullzone: 252412
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
timing-allow-origin: *
access-control-allow-origin: *
last-modified: Mon, 25 Jan 2021 22:04:54 GMT
server: cloudflare
cdn-requestpullcode: 200
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/css; charset=utf-8
cdn-cache: HIT
vary: Accept-Encoding
cache-control: public, max-age=31919000
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid: b43941af4bb8e32ed6d04a6a37617f28
cf-ray: 71009d62fa8792a5-FRA
cdn-requestcountrycode: US
cdn-requestpullsuccess: True

GET
H3 200 css
fonts.googleapis.com/ 4 KB
618 B 125ms
48ms Stylesheet
text/css 2a00:1450:4001:831::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:400,700

Requested by

Host: cdn-app.pathfactory.com
URL: https://cdn-app.pathfactory.com/production/jukebox/current/jukebox.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

4c8133f9ff3d5ddfa526a8a06252211430b695a31b8a02cdbaf4e538a8080610

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 23 May 2022 19:26:18 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Mon, 23 May 2022 20:41:51 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 23 May 2022 20:41:51 GMT

GET
H2 200 init Show response
jukebox.pathfactory.com/api/public/v1/ 4 KB
2 KB 408ms
159ms XHR
application/json 18.208.17.54
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://jukebox.pathfactory.com/api/public/v1/init?clientId=LB-60A06E40-10540&image=&title=&url=https%3A%2F%2Fwww.nowsecure.com%2Fblog%2F2017%2F06%2F15%2Fa-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications%2F

Requested by

Host: cdn-app.pathfactory.com
URL: https://cdn-app.pathfactory.com/production/jukebox/current/jukebox.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

18.208.17.54 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-18-208-17-54.compute-1.amazonaws.com

Software

Resource Hash

d517cbba61aa556fe5e8a90279666121f22c5df20e95e98cc7c2fc278c077401

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json
Referer: https://www.nowsecure.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36
Content-Type: application/json

Response headers

date: Mon, 23 May 2022 20:41:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
access-control-max-age: 7200
vary: Accept, Origin, Accept-Encoding
x-request-id: 1233858b-578d-49c4-860b-a4449517e941
x-runtime: 0.030760
referrer-policy: no-referrer-when-downgrade
etag: W/"d517cbba61aa556fe5e8a90279666121"
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-methods: GET, PUT, POST, PATCH, OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.nowsecure.com
access-control-expose-headers
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true

POST
H2 204 pr
nowsecure.us-4.evergage.com/ 0
447 B 212ms
206ms Ping
text/plain 52.88.33.114
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://nowsecure.us-4.evergage.com/pr?.top=932&.tt=759&.ttdns=23&.dt=1877&.btdns=7&.bv=16&_ak=nowsecure&_ds=engage&.scv=157&channel=Web&_r=041159&.anonId=7a882d912fe58d56&_anon=true

Requested by

Host: cdn.evgnet.com
URL: https://cdn.evgnet.com/beacon/nowsecure/engage/scripts/evergage.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.88.33.114 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-88-33-114.us-west-2.compute.amazonaws.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.nowsecure.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

access-control-allow-origin: https://www.nowsecure.com
date: Mon, 23 May 2022 20:41:51 GMT
x-content-type-options: nosniff
timing-allow-origin: *

GET
H2 200 XDFrame Show response
info.nowsecure.com/index.php/form/ Frame 5373 2 KB
737 B 173ms
173ms Document
text/html 104.17.70.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://info.nowsecure.com/index.php/form/XDFrame

Requested by

Host: info.nowsecure.com
URL: https://info.nowsecure.com/js/forms2/js/forms2.min.js?ver=576

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.70.206 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b9c979191b8407348cc7de061591b020517554fd2b12025a808aed717e4e58bd

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.nowsecure.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: max-age=3600
cf-cache-status: DYNAMIC
cf-ray: 71009d62bd109bc2-FRA
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Mon, 23 May 2022 20:41:51 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
vary: Accept-Encoding
x-content-type-options: nosniff

POST
H3 204 collect
www.google-analytics.com/g/ 0
17 B 133ms
54ms Ping
text/plain 2a00:1450:4001:80e::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-TJ8H8840QM&gtm=2oe5b0&_p=1346156640&_z=ccd.tfB&cid=2017760781.1653338511&ul=en-us&sr=1600x1200&_s=1&sid=1653338510&sct=1&seg=0&dl=https%3A%2F%2Fwww.nowsecure.com%2Fblog%2F2017%2F06%2F15%2Fa-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications%2F&dt=Remote%20Code%20Execution%20using%20Arbitrary%20File%20Writes%20%26%20MultiDex%20Apps&en=page_view&_fv=1&_nsi=1&_ss=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-TJ8H8840QM&l=dataLayer&cx=c
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:80e::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 23 May 2022 20:41:51 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.nowsecure.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pro-fa-solid-900-5.0.0.woff2
ka-p.fontawesome.com/releases/v5.15.4/webfonts/ 19 KB
19 KB 51ms
51ms Font
font/woff2 2606:4700::6812:1634
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ka-p.fontawesome.com/releases/v5.15.4/webfonts/pro-fa-solid-900-5.0.0.woff2
Requested by: Host: www.nowsecure.com
URL: https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1634 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1b50aa1d36ea249991fb44f8f6ad2aa74fe360df9cc04c564b5edf3b053b739c

Request headers

Referer: https://www.nowsecure.com/
Origin: https://www.nowsecure.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Mon, 23 May 2022 20:41:51 GMT
cf-cache-status: HIT
last-modified: Wed, 04 Aug 2021 18:58:39 GMT
server: cloudflare
age: 38683
etag: "610ae35f-4d48"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Origin, Accept-Encoding, Access-Control-Request-Headers, Access-Control-Request-Method
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=31556926
accept-ranges: bytes
cf-ray: 71009d630c5f92a7-FRA
content-length: 19784

GET
H2 200 modules.9df047ec291a23154332.js Show response
script.hotjar.com/ 243 KB
63 KB 139ms
43ms Script
application/javascript 13.224.198.15
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://script.hotjar.com/modules.9df047ec291a23154332.js

Requested by

Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-1091679.js?sv=7

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.198.15 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-198-15.fra2.r.cloudfront.net

Software

Resource Hash

2604a6f4a19dac1ad524aad3f287fa9f8f1e2982a69144403044860d6bddf7a0

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Mon, 23 May 2022 15:52:06 GMT
content-encoding: br
x-content-type-options: nosniff
age: 17384
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 63956
access-control-allow-origin: *
last-modified: Mon, 23 May 2022 15:52:03 GMT
etag: "c575f1f0bf4374a5e177b9bd85b0b874"
vary: Accept-Encoding
content-type: application/javascript
via: 1.1 adb1b226e6965f6206603ba087bd4a0a.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: FRA2-C1
accept-ranges: bytes
x-robots-tag: none
x-amz-cf-id: cEer74nNOWLpOf8SxltG1QbEzXfFlG5jbdXzarf784_fC2v0TUPuxw==

POST
H3 200 collect Show response
www.google-analytics.com/j/ 2 B
22 B 54ms
45ms XHR
text/plain 2a00:1450:4001:80e::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j96&a=1346156640&t=pageview&_s=1&dl=https%3A%2F%2Fwww.nowsecure.com%2Fblog%2F2017%2F06%2F15%2Fa-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications%2F&ul=en-us&de=UTF-8&dt=Remote%20Code%20Execution%20using%20Arbitrary%20File%20Writes%20%26%20MultiDex%20Apps&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aADAAAABQAAAAC~&jid=2071636768&gjid=1342188247&cid=2017760781.1653338511&tid=UA-4968988-13&_gid=1238693812.1653338511&_r=1&gtm=2wg5b0KMWSR9S&z=1390858740

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.nowsecure.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 23 May 2022 20:41:51 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.nowsecure.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/884447472/ 2 KB
2 KB 150ms
50ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/884447472/?random=1653338510825&cv=9&fst=1653338510825&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wg5b0&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.nowsecure.com%2Fblog%2F2017%2F06%2F15%2Fa-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications%2F&tiba=Remote%20Code%20Execution%20using%20Arbitrary%20File%20Writes%20%26%20MultiDex%20Apps&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

207f6b04ca01a38b9f72d2384d8f6742f819272d599dac4ad21c1ae99f7fc2bc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 23 May 2022 20:41:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1118
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

validateCookie
segments.company-target.com/
Redirect Chain

https://match.prod.bidr.io/cookie-sync/demandbase
https://match.prod.bidr.io/cookie-sync/demandbase?_bee_ppp=1
https://segments.company-target.com/log?vendor=choca&user_id=AAGAy07FF-MAAEozrDpxvQ
https://segments.company-target.com/validateCookie?vendor=choca&user_id=AAGAy07FF-MAAEozrDpxvQ&verifyHash=2d021484ea920ea957d41af0e36e4d84e4776be5

26 B
408 B

216ms
216ms

Image
image/gif

13.225.80.38
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://segments.company-target.com/validateCookie?vendor=choca&user_id=AAGAy07FF-MAAEozrDpxvQ&verifyHash=2d021484ea920ea957d41af0e36e4d84e4776be5
Requested by: Host: www.nowsecure.com
URL: https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/
Protocol: HTTP/1.1
Server: 13.225.80.38 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-80-38.fra2.r.cloudfront.net
Software: /
Resource Hash: 3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Date: Mon, 23 May 2022 20:41:52 GMT
Via: 1.1 f8fe53d5464b299529d281799da8de30.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA2-C2
Vary: Origin
X-Cache: Miss from cloudfront
Content-Type: image/gif
Transfer-Encoding: chunked
Connection: keep-alive
trace-id: b24d2a0f6bda487b
X-Amz-Cf-Id: DDkwLjKQXTHF1X_un1rTdBPEQnQUbPd_LBJZT3rP6JJH5uLw596njg==

Redirect headers

Date: Mon, 23 May 2022 20:41:52 GMT
Via: 1.1 f8fe53d5464b299529d281799da8de30.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA2-C2
Vary: Origin
X-Cache: Miss from cloudfront
Location: /validateCookie?vendor=choca&user_id=AAGAy07FF-MAAEozrDpxvQ&verifyHash=2d021484ea920ea957d41af0e36e4d84e4776be5
Connection: keep-alive
trace-id: 6def77ff21ffcee4
Content-Length: 0
X-Amz-Cf-Id: sIxFgA7bJbiT7rRCmAED2osimPl3O2G4wGfgv-SNIa2QyXWNkMBusQ==

GET
H2 451 464526.gif
id.rlcdn.com/ 0
98 B 133ms
45ms Image
text/plain 35.244.174.68
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://id.rlcdn.com/464526.gif
Requested by: Host: www.nowsecure.com
URL: https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.174.68 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 68.174.244.35.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Mon, 23 May 2022 20:41:52 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2 200 /
www.facebook.com/tr/ 44 B
297 B 115ms
37ms Image
image/gif 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1728859480752613&ev=PageView&dl=https%3A%2F%2Fwww.nowsecure.com%2Fblog%2F2017%2F06%2F15%2Fa-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications%2F&rl=&if=false&ts=1653338510898&sw=1600&sh=1200&v=2.9.60&r=stable&ec=0&o=30&fbp=fb.1.1653338510891.57427159&it=1653338510399&coo=false&rqm=GET

Requested by

Host: www.nowsecure.com
URL: https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Mon, 23 May 2022 20:41:52 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 44
expires: Mon, 23 May 2022 20:41:52 GMT

GET
H2 200 ip.json Show response
api.company-target.com/api/v2/ 447 B
934 B 175ms
81ms XHR
application/json 13.225.80.45
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.company-target.com/api/v2/ip.json?referrer=&page=https%3A%2F%2Fwww.nowsecure.com%2Fblog%2F2017%2F06%2F15%2Fa-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications%2F&page_title=Remote%20Code%20Execution%20using%20Arbitrary%20File%20Writes%20%26%20MultiDex%20Apps&src=tag&auth=7IAaoNAD6x2WvKuJYFAhbAvjMPVXo4yf0dCNwofu
Requested by: Host: tag.demandbase.com
URL: https://tag.demandbase.com/514d3f40ca3ece89.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.80.45 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-80-45.fra2.r.cloudfront.net
Software: nginx /
Resource Hash: 2ba4a6b1ebfb80728d3b65bfa635d53207ea54977db48861f4b81cec562f8458

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Mon, 23 May 2022 20:41:52 GMT
identification-source: CENTRAL
vary: Accept-Encoding, Origin
x-amz-cf-pop: FRA2-C2
x-cache: Miss from cloudfront
request-id: 7771fb25-1041-40f3-9d4a-6ef2513846ea
content-encoding: gzip
pragma: no-cache
access-control-allow-origin: https://www.nowsecure.com
server: nginx
access-control-max-age: 7200
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/json;charset=utf-8
via: 1.1 182ef5a8d12abb5df1553676864737b0.cloudfront.net (CloudFront)
access-control-expose-headers
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
api-version: v2
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: Iimj-4qlXwNTADMBPQOcc8N6nxUVEPiqfPhkrLi0hz9ooCU5-XZiyA==
expires: Sun, 22 May 2022 20:41:52 GMT

GET
H2 200 box-4924254a9ce4dc9b959b6e4a9b662d60.html Show response
vars.hotjar.com/ Frame F018 2 KB
1 KB 130ms
37ms Document
text/html 13.224.198.73
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://vars.hotjar.com/box-4924254a9ce4dc9b959b6e4a9b662d60.html
Requested by: Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-1091679.js?sv=7
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.198.73 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-198-73.fra2.r.cloudfront.net
Software: /
Resource Hash: 67f8c7fd7353ad063da1f3115924c458c494cb134f4d87de4407a132842c9bc9

Request headers

Referer: https://www.nowsecure.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 3491566
cache-control: max-age=31536000
content-encoding: br
content-length: 1044
content-type: text/html
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Wed, 13 Apr 2022 10:49:06 GMT
etag: "1635635016e428baa170305e9282c34a"
last-modified: Wed, 13 Apr 2022 10:48:29 GMT
vary: Accept-Encoding
via: 1.1 e976f829f2d1c4787d42d0595ae7cf74.cloudfront.net (CloudFront)
x-amz-cf-id: lKbS6wIbm9qreU6OVceDKUo6dinAipWx41LjvlNVSi7IvrgHRribPw==
x-amz-cf-pop: FRA2-C1
x-cache: Hit from cloudfront
x-robots-tag: none

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
444 B 143ms
45ms XHR
text/plain 2a00:1450:400c:c0c::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j96&tid=UA-4968988-13&cid=2017760781.1653338511&jid=2071636768&gjid=1342188247&_gid=1238693812.1653338511&_u=aADAAAAAQAAAAC~&z=342620542

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c0c::9d Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.nowsecure.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Mon, 23 May 2022 20:41:52 GMT
content-type: text/plain
access-control-allow-origin: https://www.nowsecure.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 3.v1.41.0.97218034158342b512cf.js Show response
edge.marker.io/latest/ 206 KB
69 KB 106ms
60ms Script
application/javascript 2a06:98c1:3120::a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://edge.marker.io/latest/3.v1.41.0.97218034158342b512cf.js
Requested by: Host: edge.marker.io
URL: https://edge.marker.io/latest/shim.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3120::a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6d04cf67fbca3484ac19460e14c40a054663124272b8d530278188ca12d0f03b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Mon, 23 May 2022 20:41:52 GMT
via: 1.1 f47fcc9b2aa47ced36c40c318e6f006a.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 2474
x-cache: Hit from cloudfront
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Fri, 13 May 2022 10:05:49 GMT
server: cloudflare
etag: W/"1e5ace0eb151d3f92a0eaeb49493b682"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PtYle0c7IbRBRU4FL2lE9aMv9aV1STE29PG4O6%2BQpWxdy0obhEQ393%2FhdTr6vvyBO06rE28eruXPXkmkytdkQND7SyUr79wTLLuXWj2QXK1JX0ZkL%2B%2BL8omAyhSLs1KeHYVtNXFKVuKF5%2F2FHw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
x-amz-cf-pop: DUS51-P2
cf-ray: 71009d648f8e9bac-FRA
x-amz-cf-id: IsbnuTqLdhTU8vdDuosy_fTZm9EvohZCiRUeZ5osYYovQk5KKZ4_IA==

GET
H3 200 4.v1.41.0.b5b6434b7601310c187f.js Show response
edge.marker.io/latest/ 227 KB
56 KB 142ms
97ms Script
application/javascript 2a06:98c1:3120::a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://edge.marker.io/latest/4.v1.41.0.b5b6434b7601310c187f.js
Requested by: Host: edge.marker.io
URL: https://edge.marker.io/latest/shim.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3120::a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fdfa75a3c45a10624d2e4bf2498822690c27d972e0f78604ca45e3c1a2e82928

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Mon, 23 May 2022 20:41:52 GMT
via: 1.1 fa544a973edca8926f95609301f23b66.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 2474
x-cache: Hit from cloudfront
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Fri, 13 May 2022 10:05:49 GMT
server: cloudflare
etag: W/"cec2cca50f5c096b4a059ab74f9f6da0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YeTxnrJFHRAI9MXA4t53XVL3Md55D9Wba1YlGlu%2FgizQYFL28Lp%2BC3u2TECq34FJK%2BkeUff8kUtfjxsg3rUZvysDBAAi4cBLHSxTxcWznlX69LA9cM%2FNiKpsWuTbmBr%2FHvj6akj6xNbaT0YQng%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
x-amz-cf-pop: DUS51-P2
cf-ray: 71009d648f909bac-FRA
x-amz-cf-id: 2Ue8BogQyPo6pvzcr0AQDfgNU80Imw8gimo9TGM3XPHr13d8Te-exQ==

GET
H2 200 forms2.min.js Show response
info.nowsecure.com/js/forms2/js/ Frame 5373 205 KB
68 KB 188ms
188ms Script
application/x-javascript 104.17.70.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://info.nowsecure.com/js/forms2/js/forms2.min.js

Requested by

Host: info.nowsecure.com
URL: https://info.nowsecure.com/index.php/form/XDFrame

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.70.206 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

54b1a318711ed45da6f1a787a0b0f601199c8676b7d565a4163674833c64b0a0

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://info.nowsecure.com/index.php/form/XDFrame
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Mon, 23 May 2022 20:41:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: REVALIDATED
last-modified: Tue, 03 May 2022 03:46:42 GMT
server: cloudflare
etag: "380850-3326e-5de135b5b2c80"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: public, max-age=14400
cf-ray: 71009d6448949bc2-FRA
expires: Tue, 24 May 2022 00:41:52 GMT

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
501 B 174ms
81ms Image
image/gif 2a00:1450:4001:80f::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-4968988-13&cid=2017760781.1653338511&jid=2071636768&_u=aADAAAAAQAAAAC~&z=1652184139

Requested by

Host: www.nowsecure.com
URL: https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 23 May 2022 20:41:52 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
107 B 184ms
77ms Image
image/gif 2a00:1450:4001:810::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-4968988-13&cid=2017760781.1653338511&jid=2071636768&_u=aADAAAAAQAAAAC~&z=1652184139

Requested by

Host: www.nowsecure.com
URL: https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 23 May 2022 20:41:52 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/884447472/ 42 B
154 B 348ms
260ms Image
image/gif 2a00:1450:4001:80f::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/884447472/?random=1653338510825&cv=9&fst=1653336000000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wg5b0&sendb=1&frm=0&url=https%3A%2F%2Fwww.nowsecure.com%2Fblog%2F2017%2F06%2F15%2Fa-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications%2F&tiba=Remote%20Code%20Execution%20using%20Arbitrary%20File%20Writes%20%26%20MultiDex%20Apps&async=1&fmt=3&is_vtc=1&random=2877909858&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Host: www.nowsecure.com
URL: https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 23 May 2022 20:41:52 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/884447472/ 42 B
548 B 162ms
60ms Image
image/gif 2a00:1450:4001:810::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/884447472/?random=1653338510825&cv=9&fst=1653336000000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wg5b0&sendb=1&frm=0&url=https%3A%2F%2Fwww.nowsecure.com%2Fblog%2F2017%2F06%2F15%2Fa-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications%2F&tiba=Remote%20Code%20Execution%20using%20Arbitrary%20File%20Writes%20%26%20MultiDex%20Apps&async=1&fmt=3&is_vtc=1&random=2877909858&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Host: www.nowsecure.com
URL: https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 23 May 2022 20:41:52 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 visit-data Show response
in.hotjar.com/api/v2/client/sites/1091679/ 147 B
322 B 234ms
66ms XHR
application/json 34.250.211.64
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://in.hotjar.com/api/v2/client/sites/1091679/visit-data?sv=7
Requested by: Host: script.hotjar.com
URL: https://script.hotjar.com/modules.9df047ec291a23154332.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.250.211.64 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-250-211-64.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 3e8e76a70b5ec0a97f60491364274ab39aebd8f949b6a310a174633b015d4738

Request headers

Referer: https://www.nowsecure.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36
Content-Type: text/plain; charset=UTF-8

Response headers

date: Mon, 23 May 2022 20:41:52 GMT
content-encoding: br
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
access-control-max-age: 86400
cache-control: no-cache, no-store
access-control-allow-credentials: true

GET
H2 204 1091679 Show response
vc.hotjar.io/sessions/ 0
256 B 226ms
66ms XHR
text/plain 13.225.80.115
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://vc.hotjar.io/sessions/1091679?s=0.25&r=0.14902905076107253
Requested by: Host: script.hotjar.com
URL: https://script.hotjar.com/modules.9df047ec291a23154332.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.80.115 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-80-115.fra2.r.cloudfront.net
Software: Python/3.7 aiohttp/3.5.4 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Mon, 23 May 2022 20:41:52 GMT
via: 1.1 2f194b62c8c43859cbf5af8e53a8d2a6.cloudfront.net (CloudFront)
server: Python/3.7 aiohttp/3.5.4
x-amz-cf-pop: FRA2-C2
x-cache: Miss from cloudfront
access-control-allow-origin: *
cache-control: no-store
x-amz-cf-id: vqUGtb65mDBMjbY2J03rkAQGw9fTao7CArT9W6x0O9ItVjz84hKtCg==

OPTIONS
H2 204 ping
api.marker.io/widget/ Frame 0
0 173ms
70ms Preflight 2a06:98c1:3120::a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://api.marker.io/widget/ping

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a06:98c1:3120::a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.nowsecure.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: X-CSRF-Token, X-Requested-With, Accept, Accept-Version, Authorization, Content-Length, Content-MD5, Content-Type, Date, X-Api-Version, _c
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE
access-control-allow-origin: https://www.nowsecure.com
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 71009d676ccc90e8-FRA
content-security-policy: default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
date: Mon, 23 May 2022 20:41:52 GMT
expect-ct: max-age=0
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: no-referrer
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ILdv%2BF4ni4exab6kD821mZ5HjLlpCRG7c1%2BTeJhdN1RivUse0SCWKaOj7k8RT5w87psgvkx%2B0a%2B1zns51c4lFuBZ6RNZNgWIEOPGoQ7jOqpdJzQPLM1uIgTMk%2BZFiqsCG4H9Y6l0c54WDKab"}],"group":"cf-nel","max_age":604800}
server: cloudflare
strict-transport-security: max-age=15552000; includeSubDomains
vary: Origin
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-download-options: noopen
x-frame-options: SAMEORIGIN
x-permitted-cross-domain-policies: none
x-xss-protection: 0

POST
H3 200 ping Show response
api.marker.io/widget/ 2 KB
2 KB 90ms
90ms Fetch
application/json 2a06:98c1:3120::a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://api.marker.io/widget/ping

Requested by

Host: edge.marker.io
URL: https://edge.marker.io/latest/4.v1.41.0.b5b6434b7601310c187f.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a06:98c1:3120::a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

be3ecdd2dc7d0ad0325582a459f86207c1969b29a61a9b830d4afee9286bd180

Security Headers

Name	Value
Content-Security-Policy	default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.nowsecure.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36
Content-Type: application/json

Response headers

date: Mon, 23 May 2022 20:41:52 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-permitted-cross-domain-policies: none
x-dns-prefetch-control: off
vary: Origin, X-HTTP-Method-Override, Accept-Encoding
x-xss-protection: 0
cf-ray: 71009d67de789bac-FRA
referrer-policy: no-referrer
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"730-pQOntKZ4fqAY1iqrf39ltYYJc3U"
expect-ct: max-age=0
strict-transport-security: max-age=15552000; includeSubDomains
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yND4z32QKJoECx1aHc2Fw26tuH4yA6aB5FhK92jLf4WlgJUGInj8HtRs2mBX8Phaqngt1j97YYDw%2BpKB8eWfbb7lwgj%2B9HZliZCcV9%2F4Y4sTuShBWDCrZn9ogKs4s7Tw7QRr34uMjsDFUxzb"}],"group":"cf-nel","max_age":604800}
x-download-options: noopen
access-control-allow-origin: https://www.nowsecure.com
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
access-control-allow-credentials: true
content-security-policy: default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
content-type: application/json; charset=utf-8

POST
H3 200 / Show response
www.facebook.com/tr/ Frame 03AF 0
18 B 81ms
38ms Document
text/plain 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Requested by

Host: www.nowsecure.com
URL: https://www.nowsecure.com/blog/2017/06/15/a-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Content-Type: application/x-www-form-urlencoded
Origin: https://www.nowsecure.com
Referer: https://www.nowsecure.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-origin: https://www.nowsecure.com
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
content-type: text/plain
cross-origin-resource-policy: cross-origin
date: Mon, 23 May 2022 20:41:52 GMT
priority: u=0
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains

GET
H2 204 website_forms Show response
jukebox.pathfactory.com/api/public/v1/ 0
337 B 144ms
143ms XHR
text/plain 18.208.17.54
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://jukebox.pathfactory.com/api/public/v1/website_forms?clientId=LB-60A06E40-10540&visitorUuid=0d4b1e65-7ec7-4db7-9191-f66858e207b2&url=https%3A%2F%2Fwww.nowsecure.com%2Fblog%2F2017%2F06%2F15%2Fa-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications%2F

Requested by

Host: cdn-app.pathfactory.com
URL: https://cdn-app.pathfactory.com/production/jukebox/current/jukebox.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

18.208.17.54 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-18-208-17-54.compute-1.amazonaws.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept: application/json
Referer: https://www.nowsecure.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36
Content-Type: application/json

Response headers

x-runtime: 0.011932
date: Mon, 23 May 2022 20:41:52 GMT
referrer-policy: no-referrer-when-downgrade
access-control-max-age: 7200
access-control-allow-methods: GET, PUT, POST, PATCH, OPTIONS
access-control-allow-origin: https://www.nowsecure.com
access-control-expose-headers
cache-control: no-cache
access-control-allow-credentials: true
vary: Origin
x-content-type-options: nosniff
x-request-id: b6c1fca7-19e2-4c10-9fa3-e0f800113643

OPTIONS
H2 200 website_forms
jukebox.pathfactory.com/api/public/v1/ Frame 0
0 132ms
132ms Preflight 18.208.17.54
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://jukebox.pathfactory.com/api/public/v1/website_forms?clientId=LB-60A06E40-10540&visitorUuid=0d4b1e65-7ec7-4db7-9191-f66858e207b2&url=https%3A%2F%2Fwww.nowsecure.com%2Fblog%2F2017%2F06%2F15%2Fa-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications%2F
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.208.17.54 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-208-17-54.compute-1.amazonaws.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://www.nowsecure.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET, PUT, POST, PATCH, OPTIONS
access-control-allow-origin: https://www.nowsecure.com
access-control-expose-headers
access-control-max-age: 7200
date: Mon, 23 May 2022 20:41:52 GMT

OPTIONS
H2 200 page_views
jukebox.pathfactory.com/api/public/v1/ Frame 0
0 127ms
127ms Preflight 18.208.17.54
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://jukebox.pathfactory.com/api/public/v1/page_views
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.208.17.54 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-208-17-54.compute-1.amazonaws.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.nowsecure.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET, PUT, POST, PATCH, OPTIONS
access-control-allow-origin: https://www.nowsecure.com
access-control-expose-headers
access-control-max-age: 7200
date: Mon, 23 May 2022 20:41:52 GMT

POST
H2 200 page_views Show response
jukebox.pathfactory.com/api/public/v1/ 2 B
542 B 142ms
142ms XHR
application/json 18.208.17.54
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://jukebox.pathfactory.com/api/public/v1/page_views

Requested by

Host: cdn-app.pathfactory.com
URL: https://cdn-app.pathfactory.com/production/jukebox/current/jukebox.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

18.208.17.54 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-18-208-17-54.compute-1.amazonaws.com

Software

Resource Hash

44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json
Referer: https://www.nowsecure.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36
Content-Type: application/json

Response headers

date: Mon, 23 May 2022 20:41:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
access-control-max-age: 7200
vary: Accept, Origin, Accept-Encoding
x-request-id: cbd7cd09-1f19-4ed4-84d8-49344fabcb09
x-runtime: 0.015821
referrer-policy: no-referrer-when-downgrade
etag: W/"44136fa355b3678a1146ad16f7e8649e"
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-methods: GET, PUT, POST, PATCH, OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.nowsecure.com
access-control-expose-headers
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true

POST
H3 204 collect
www.google-analytics.com/g/ 0
17 B 44ms
44ms Ping
text/plain 2a00:1450:4001:80e::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-TJ8H8840QM&gtm=2oe5b0&_p=1346156640&_z=ccd.tfB&cid=2017760781.1653338511&ul=en-us&sr=1600x1200&_s=2&sid=1653338510&sct=1&seg=1&dl=https%3A%2F%2Fwww.nowsecure.com%2Fblog%2F2017%2F06%2F15%2Fa-pattern-for-remote-code-execution-using-arbitrary-file-writes-and-multidex-applications%2F&dt=Remote%20Code%20Execution%20using%20Arbitrary%20File%20Writes%20%26%20MultiDex%20Apps&en=page_view&_et=3
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-TJ8H8840QM&l=dataLayer&cx=c
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:80e::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nowsecure.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 23 May 2022 20:41:56 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.nowsecure.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

102 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

38 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
info.nowsecure.com/	1969-12-31 23:59:59	Name: BIGipServerab09web-nginx-app_https Value: !4KiQ1gCJUh8N7Sjn/+ZT2Dlakae2CznpaB1haF+P00oGPEUtGgEJmmHra6nWUaTCKueACStJtc9tLw==
.info.nowsecure.com/	1970-01-20 03:15:40	Name: __cf_bm Value: EjtPQ520a2N6RPF0r0fU0Ec0UwjIbs46q_SKNmBEnFU-1653338510-0-AePNNt5s7XfH9SpiIZ2372T5s71DWqMpdX7qNpF3j57+Alr7dFHZoOiBMUWaBNU75HojoxOmJGIZTbN7q4W/tho=
.nowsecure.com/	1970-01-20 20:46:50	Name: _evga_0f86 Value: {%22uuid%22:%227a882d912fe58d56%22}
.nowsecure.com/	1970-01-20 20:46:50	Name: _sfid_c0b4 Value: {%22anonymousId%22:%227a882d912fe58d56%22%2C%22consents%22:[]}
.techtarget.com/	1970-01-20 03:15:40	Name: __cf_bm Value: 9C7QNw8x1KIB6y1wEQZohQOxJ6zBhaMLbYAzJcawszw-1653338510-0-AVRqRCVAqmXgrJ5JL8mdATiA0p31MwkQM5s4Ypp0ux0N72JxyLMEwgoBnBmQ09dwdNdrNYJE9mL8qei0SplqIm0=
www.nowsecure.com/	1970-01-24 03:14:12	Name: _omappvp Value: 7Z411NpBpbdGrlAdYHhDqi6zgb7FWMLrd4Sj6HNHRceZdDGuBIqtGp1097mbzunEbwh5vk8dPVgFbbT3Sp3hlmdlj4Xx8WuL
www.nowsecure.com/	1970-01-20 03:15:39	Name: _omappvs Value: 1653338510176
.nowsecure.com/	1970-01-20 20:46:50	Name: _mkto_trk Value: id:201-XEW-873&token:_mch-nowsecure.com-1653338510377-89343
.adnxs.com/	1970-01-20 05:25:14	Name: uuid2 Value: 4213993209352775319
.twitter.com/	1970-01-20 20:46:50	Name: personalization_id Value: "v1_vJEr5YpsravB+9AU6qa3oA=="
.t.co/	1970-01-20 20:46:50	Name: muc_ads Value: 641a6eb6-0d67-4d7f-b22a-725209fe5fb6
.linkedin.com/	1970-01-20 03:58:50	Name: UserMatchHistory Value: AQKG3xkR0rmgQwAAAYDyp5lU_GK7Vgzh_0eFjsEK6UNoObYkb8FlvVlanmCh9HOOvMY4JvAOhuS16g
.linkedin.com/	1970-01-20 03:58:50	Name: AnalyticsSyncHistory Value: AQIyK3XENKH5sQAAAYDyp5lUgPw6_3suK_VGAq_nwJSmwzuOhfq5tFoSmI8Fp5Ri1VI6MsIVJ6OJr0fKbFWnWA
.ads.linkedin.com/	1969-12-31 23:59:59	Name: lang Value: v=2&lang=en-us
.linkedin.com/	1970-01-20 20:47:32	Name: bcookie Value: "v=2&603c092e-caac-4576-8c4f-22330113dfd5"
.linkedin.com/	1970-01-20 03:17:04	Name: lidc Value: "b=OGST08:s=O:r=O:a=O:p=O:g=2313:u=1:x=1:i=1653338511:t=1653424911:v=2:sig=AQExvNnqrPAS_Kvi1Ukb6qbcZaXBZzBJ"
.nowsecure.com/	1970-01-20 20:46:50	Name: _ga_TJ8H8840QM Value: GS1.1.1653338510.1.1.1653338510.0
.nowsecure.com/	1970-01-20 20:46:50	Name: _ga Value: GA1.2.2017760781.1653338511
.nowsecure.com/	1970-01-20 03:17:04	Name: _gid Value: GA1.2.1238693812.1653338511
.nowsecure.com/	1970-01-20 03:15:38	Name: _gat_UA-4968988-13 Value: 1
.nowsecure.com/	1970-01-20 05:25:14	Name: _fbp Value: fb.1.1653338510891.57427159
nowsecure.us-4.evergage.com/	1970-01-20 03:25:43	Name: AWSALBCORS Value: atDvVcBsLDV4wUrfRU7rEm71cPF39V3SVlrt+ZzFgByYo54iF6CJuEeItbJQEkVgTUukIDeA+5iWIi5KxBYtUsJOrjTd2Nuv3QqvJ5+PDARFCvhEmB/JSz3+SRgX
.doubleclick.net/	1970-01-20 03:15:39	Name: test_cookie Value: CheckForPermission
.linkedin.com/	1969-12-31 23:59:59	Name: lang Value: v=2&lang=de-de
.www.linkedin.com/	1970-01-20 20:47:32	Name: bscookie Value: "v=1&20220523204151e443615c-a13c-49d8-864a-132ec78c153dAQEF0p5SBnM-bgl6j8sysGGKKZpA3D1H"
.linkedin.com/	1970-01-20 20:30:49	Name: li_gc Value: MTswOzE2NTMzMzg1MTE7MjswMjFHeWTADg6KHYmLjDsk6WKn7FO8g3wc8mMEinZTp5FJGQ==
.nowsecure.com/	1970-01-20 12:01:14	Name: _hjSessionUser_1091679 Value: eyJpZCI6ImNiODdmMjczLWUwZDktNWEwOS1hZjJlLTczOTAyZTU2ZjZlYSIsImNyZWF0ZWQiOjE2NTMzMzg1MTEwNjksImV4aXN0aW5nIjpmYWxzZX0=
.nowsecure.com/	1970-01-20 03:15:40	Name: _hjFirstSeen Value: 1
www.nowsecure.com/	1970-01-20 03:15:38	Name: _hjIncludedInSessionSample Value: 1
.nowsecure.com/	1970-01-20 03:15:40	Name: _hjSession_1091679 Value: eyJpZCI6IjNiMmM5ZWQwLTBjYTQtNDJiMi1hOTNiLTJmZjRhODkxODJlYSIsImNyZWF0ZWQiOjE2NTMzMzg1MTExMTAsImluU2FtcGxlIjp0cnVlfQ==
www.nowsecure.com/	1970-01-20 03:15:38	Name: _hjIncludedInPageviewSample Value: 1
.nowsecure.com/	1970-01-20 03:15:40	Name: _hjAbsoluteSessionInProgress Value: 1
.bidr.io/	1970-01-20 12:44:12	Name: bito Value: AAGAy07FF-MAAEozrDpxvQ
.bidr.io/	1970-01-20 12:44:12	Name: bitoIsSecure Value: ok
.company-target.com/	1970-01-20 20:46:50	Name: tuuid Value: c77b5edc-65f3-4d6c-b35e-5ac2d9d11ecc
.company-target.com/	1970-01-20 20:46:50	Name: tuuid_lu Value: 1653338512
www.nowsecure.com/	1970-01-20 09:44:26	Name: marker_id_623b2d5c49f5696a8193da3a Value: 89eee4d5-d8d0-4fd0-b4a2-18ae8e559568
.nowsecure.com/	1970-01-20 20:46:50	Name: vid Value: 0d4b1e65-7ec7-4db7-9191-f66858e207b2

3 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	warning	Message: Error with Feature-Policy header: Unrecognized feature: 'speaker'.
security	warning	Message: Error with Feature-Policy header: Unrecognized feature: 'vibrate'.
network	error	URL: https://id.rlcdn.com/464526.gif Message: Failed to load resource: the server responded with a status of 451 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

201-xew-873.mktoresp.com
a.omappapi.com
analytics.twitter.com
api.company-target.com
api.marker.io
api.omappapi.com
apt.techtarget.com
attr.ml-api.io
cdn-app.pathfactory.com
cdn.evgnet.com
cdnjs.cloudflare.com
connect.facebook.net
edge.marker.io
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
id.rlcdn.com
in.hotjar.com
info.nowsecure.com
jukebox.pathfactory.com
ka-p.fontawesome.com
kit.fontawesome.com
match.prod.bidr.io
maxcdn.bootstrapcdn.com
ml314.com
munchkin.marketo.net
nowsecure.us-4.evergage.com
px.ads.linkedin.com
px4.ads.linkedin.com
s.ml-attr.com
script.hotjar.com
secure.adnxs.com
segments.company-target.com
snap.licdn.com
static.ads-twitter.com
static.hotjar.com
stats.g.doubleclick.net
t.co
tag.demandbase.com
trk.techtarget.com
vars.hotjar.com
vc.hotjar.io
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googleoptimize.com
www.googletagmanager.com
www.linkedin.com
www.nowsecure.com
104.111.234.67
104.17.70.206
104.244.42.131
104.244.42.5
13.107.42.14
13.224.198.15
13.224.198.41
13.224.198.61
13.224.198.73
13.225.80.115
13.225.80.38
13.225.80.45
13.225.80.58
13.225.80.86
142.250.181.226
151.101.128.114
18.208.17.54
185.33.221.89
185.93.2.243
192.28.144.124
199.232.136.157
206.19.49.24
2600:9000:21f3:de00:12:3734:2a40:93a1
2606:4700:20::ac43:4987
2606:4700:4400::6812:2a27
2606:4700::6811:190e
2606:4700::6812:1634
2606:4700::6812:1734
2606:4700::6812:acf
2620:1ec:21::14
2a00:1450:4001:80e::200e
2a00:1450:4001:80f::2004
2a00:1450:4001:810::2003
2a00:1450:4001:828::2003
2a00:1450:4001:829::200e
2a00:1450:4001:830::2008
2a00:1450:4001:831::2002
2a00:1450:4001:831::200a
2a00:1450:400c:c0c::9d
2a02:26f0:3500:7::17d8:4dd3
2a03:2880:f01c:8012:face:b00c:0:3
2a03:2880:f11c:8183:face:b00c:0:25de
2a06:98c1:3120::a
34.111.234.236
34.250.211.64
35.244.174.68
52.208.250.69
52.88.33.114
68.67.153.60
01c0bfff80631ac74f2c10884df96abbc36324a1089d52a210db02623b2cd5d3
023e77108ac88387cda838cbeafa0108b6546dc7c60e78ce999483a6eab44249
029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300
0a9adccc17d9e34e3971bce91e3723f1fef884844fed6e6e10085e19745faef5
0ac02552a5875932b835d30e9db135a212063ee77a1723138d3a88f4158eab14
0b150d0e7595c7dc3d57192608e357c28a2b3c4947c575968ef94eef996a829f
0b901e45c2c71b37eb4e2f8db2a28dc9f5eefd092e0a5b8ee3d3bcdbdf1dfaf9
1019fe78e70e11b34296c6c0a22f0e3c7ff371af85d3e6591c50eb87ddb4c5e1
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
11618bb5a83a8fd4cd9312a653d4d2f321e3c9c6165f89b8d7d29927c3f5a9e5
14f2ec002b176e0dee403cb7dd4ef2274a1353080e1e3e4084678770f4c15b9c
1b50aa1d36ea249991fb44f8f6ad2aa74fe360df9cc04c564b5edf3b053b739c
1ba7f3c6e2c73d2f2ffce37b8fb9bae6861d1e8e56530eadfc94355aab189bbd
2008b9f1b3da9ab3352f5e76889e0d592f4e37bfe21c4d41d769f9eada9c2c0c
20550f7bcb2a817ac9a5879e04260da8268e971c0b8031a6b7a2f48a55ee60d5
207f6b04ca01a38b9f72d2384d8f6742f819272d599dac4ad21c1ae99f7fc2bc
22e8142d74fd8ad5ee6f339d0aff7c1641f83a285306b428f1232088780d5432
256e42104f48a5fa80b031da12dc56acde224fba3f9810f8f8192b39136d365a
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
2604a6f4a19dac1ad524aad3f287fa9f8f1e2982a69144403044860d6bddf7a0
2948f174a43959148792e8182d013109a7ddbeb27ad00945753244e00e64e1e1
2ba4a6b1ebfb80728d3b65bfa635d53207ea54977db48861f4b81cec562f8458
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
31c07b36cc3224a40c70dccb3db129d904b3cd7282cccae96c5690bcbe6a9265
37c65071f378cc9582aabdda3b52979ef901f2925e3f3c3dc597f41eac0f1b6d
386ab100d5c0cc50f185cbb37805c729a19f2fc0446ee6df60955db6b9022134
3a3204a64bd27e15d31af28ace5cd56d19fff5d04c0844fa15a6c2b361b943d5
3a8c5841272dc617f0fcdccbca0cf7dadc04a3ccc5606609e302242bc437b35f
3abdefb76fda3805d9685290e489c60ce60bd6eee3cecb284a48fa48b16184b9
3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1
3baac7f6496e21443822d21a036f03cbd750d24f4b6269de361fc7ef9fb81810
3d07083bd8e3c956f0bb35897a125bdb9d74fabeede0b4692ce365aff1b2b39a
3e8e76a70b5ec0a97f60491364274ab39aebd8f949b6a310a174633b015d4738
4245ecca2a4b50d7fd9adc9a965ed1f9b4ec24e9935e34c80efafc0f856d54c6
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
472ef4cfe45e17e12eeb6a45c88127e28afa97162b86f78fc931165b9319fa43
48d99405043c7efdb93cc29f66c77ebc552629b8c60289962729733f60766d81
491ee20092ce969e6785601ae4595748d4ac5ee4df19012b19b77de6c9dfd357
49fd3e0c64f247cf56cb828bc37b88cf139df6e5c7bb4c3a4507f740e9a52c17
4b39d8acc83a3e0d63197de1c41cd8c3b0f77befd854c79a0d13bdef652e43db
4b99a75a42582fd22e780855dfb50880df624ce43988616f4b19dc7ba90f1250
4bf3aca933aa233702f890083af601fb16149ec8a17f8c1b90d30450562bde08
4c8133f9ff3d5ddfa526a8a06252211430b695a31b8a02cdbaf4e538a8080610
4d9aca7a0a0df29e4ae225bfd8ec77433e5f594aae95f7482b17af62d93d77ea
513a235b91636710909b30122fd779c4346bda3c02688d05ef369ffd9ca7d9b9
54b1a318711ed45da6f1a787a0b0f601199c8676b7d565a4163674833c64b0a0
553e8e99e11b039cee67652cb4e5784c4f9c822a2fcbc18d3db57dc16f8b64c6
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
573c5017cef6a1833a540b650c2264242db032a1183ba50946c53b95268039f5
57cd46adbabd6c40823602b4513aecbe89320a769572255272abe9f008de69fa
5a1ba6ff6db12f791bbbfc4da3cb389e06f0cd53eede09ef3eb3ceb074089ef1
5a684227c1eef599cf45d875e0f906a73e0fb247aca49c0de70c1a14e7ef818f
5aa4142a40b5a1e0cdee8d5416c145c0e3d8b785254a566b5393069dcd2e0de8
5ddf5adbb7ec6cf1e6cb616308497262bcdebd5e98552dfba0f01bfbd2111fb2
5e6744806e10959204a1eb939d4f704780b86e43849fc38d38d0952673fce8d7
6163607ff0d5fd12f5c2b16a42fce3ee9595537c37deccd4cdf9a941b1286c5d
625678da4f32cce1cc042b7dc74311ac900d1ac476292184dd6d4f96bb600d94
64a348d63ce321342b3c3553529ba5bd1343e5264ae95dc6b71db3099bd7b60b
67f8c7fd7353ad063da1f3115924c458c494cb134f4d87de4407a132842c9bc9
6d04cf67fbca3484ac19460e14c40a054663124272b8d530278188ca12d0f03b
6f1f4bf3f7dff1cbb74b974f610378b5f52e212b855155741b0c4917efa56705
711f7b6da74f50c460ba881558549c74cd558bfea076857f843d80a514974fef
71f74e4f7fd376665a313e2c383a704473aa9a6b185f8cfcb08a88b37e5bfb93
7251edebcf81d5d2c55f2731548efd258e62e17605a044bd04f19624cc7e0b06
73fcfb63ea87ea02d9b1335e9a1e15398486bd4af63add386d3838e6c41921f3
742f3c909d855efefaccbdd2e733df64aa08c04bf449f5b921839e1b1d4bb5c3
751b7ed555c2b53e11f551a6ddd184f3c2c7ec7d806d7e8d50c50444ce6e7006
75d893335a1d25db1bf02e25ab904d97a3af743128850d8566b93d197e56e9e9
7626e49a61fdffe1f5b33930d03103cfa7f5a59ea4186e92be736c365e64ca5e
77704260eaefb3ee4158c2afed91f4867af90eca7d13ec84bbec1c140440d2a1
7a09f192f6cc0a70605d99c0931b2652c187feb1674de9a15cd980868c710d5d
7daf3f5acd448e33c96a746407198ccbe6eff0402f20bbf1164a1129205c13bd
7e2b3a54a5b20496afd5595c276d311267bf651d29967f5a922c33aa3db28e44
802cb14286b666bebc0198266fb91d8386c3091d3cb35ab7821f962140751cbe
805c74fa717a90cffcc1464f5464f3863e9417b4180ebcc9cb8c8d3ffbedecdb
8201b2f75e87b8b107921329ece010b6546986a5517a1530e10d455ece7b1bfa
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
85df1412ad2772b0260c2240591579588c2f9d08c44a50e937f2928be99ea3b5
873fc6e8f8edc13595db7f5d730a68b458108742a1371df8ab68470762ab7b34
8bbc0b2faa7fc7f814af324a077a85a2a5016bb39f43e2939dc13925c19ce006
8f24862077717aa659bc9f521e03cd8dbb013fcae88a3eff5a3824a064c92029
97d5a594e7f76c7e50045b67667fd6b74b268515efe6425097be1b2647079787
9b6f398f55c1b58a05c7e75e79eee7ca7d6a867677660227f86f9d318a8a485f
a0e689678664574f2a3f4a3bd3e085d27472f531e4e0b52699f6ea3a0aae5eff
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
a2222159f7d51a8387b1730a9d166751d24ffd056c7bf29bf5ed58a604efa0af
a394d95c5c1465fbcb01a45f42ab8d22cbd553163a23bbaffa21b8cf01424337
a8a00b576cc9fad532a52ecdf8024724ddaa83cb0f5ca5d1b1d6eb8841103d60
a8af1e3b2d7159da8b359c744ae8a1600eca594236d7196f3e4669038db20691
a8d079bdcacb19987fc764a5fc3504efda2fca1f33f0bd237494bb862390c2b3
ab21f912734ffdd281fadc78bdafc65d4a4ecb39ac93d629c738a7d9a70321ec
ac5000602bb127a5a07be117df96c48667d2e2a9fb1bb33d5ebb7c50e4480a88
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
acbe6770b0fc8b621a9d4f7068b241fb403fe999ea33270931ee59ec4cfdf3f1
ade38136058fcd75880d3673855aff859ee377d5915e59cccf24a973d418bebb
af31d745794104696d3a1d91dab0237d6328f5c07dd6d6fe5e776b1ea8637117
b5d7707ea8fc00aae40bf500ac7498d7f32f6b1bbff7b4fde976a40345eb5f9d
b9c979191b8407348cc7de061591b020517554fd2b12025a808aed717e4e58bd
bd03f034c6642dedafbbbd1b157b4cefe7cb46ee07aa5102043e94eacfe7d26f
bd4de6a3fc0fb68d6f76ba7b93514b96a92e585c295b5351c31ad92a4b0777ea
be3ecdd2dc7d0ad0325582a459f86207c1969b29a61a9b830d4afee9286bd180
bfb65c2bfc46002d44857fa454a4520b8363ca95d7b1c9933fc313593dc0b520
c0f5e370c43c80dd7d93dc18583a6147da8633a0e2b68a6546650b6583a90d2e
c21e5a2b32c47bc5f9d9efc97bc0e29fd081946d1d3ebffc5621cfafb1d3960e
c2aee78040b4ed46c2377e6825db12a9691a2eb584adf338e77312c8978d8537
c2d66e3a7df3e10293760e4c5bde20ac8293577b083971ce8aad47b4585d1c8d
c4c34809a5467ebde4b8560258364d032bb52821addc8a731b1c4dc007f268b0
c52cef61fc913fe9db19ce22a74b99487f80f96f7f2d6711f0aa1b25146957cd
cdbdaa122823601390c7dcbdd1afde33c2f1a432b8c5ff025c6137ee99ba541a
d0d86f70555b57cc161546d4ae356a36a0a666b3c98c25412a2255734a598ef8
d217d238f3f2648014fb12906dca5366954ffa6256d160726190d9e0e9c8376a
d435f04f716a1686cbce45925c71f32ec452c56cf849b46ee0b09b81eaeb27b2
d517cbba61aa556fe5e8a90279666121f22c5df20e95e98cc7c2fc278c077401
d53f99629c6d422544c444ce70785aa089a413c64bea95da9cdabbf398a9402a
d6382bc70b1c57b4d81778b61d35436c3c03910fc922a29d3e639585fc15e38a
db66dc8d4cd649a6a2af3d01440ff4239ceefed79d0b2d4e2883c186e0c34bb7
dc994dee64c8f1d130b9747f8fd46f9ad774e865d3656906f6c3e546918b5989
ddd9effdec180a580a131e7a1e1e40f786cf1701642deb976fc80f6368df1573
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
dedcaf1428313f932058701825b598dc3eb1b26a561b5f7bd862961b17f0c9d6
e02af7df9a190d88380e2dcec2050ecaa493ae2d23526dbeec67f6907df3a752
e116d223ab752d1118f0079694cd6abf654e9e4a25a03fa1a6acdd791628c3ff
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e737d82f6a217559a8b63521b6b07ac0c3268343b59bd99fc60d3f81ea7f4b75
ebba58d2ae23674a1c22f38a26ca6ae316c4ac05f558c68c354623c3b10556f4
ec1b955b630541c406d5b609050491a3b6e516cd8778acd053526e30cfbcd546
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
efaefbca699704ae2692aed4c8fb84c872d99c3b74e5c3c4465abc91191ec145
efdab9a4ce00bb4c5f767c604681e8961643a147b0a89994583a04aca613c4cc
f182373610354ad5cdd8ffdc647fc612e1afcfdd1883c966807e5b22eebf1f3f
f811403705aeb303a686593d0f38979db1715bfe3ae0f6fda77ffb9bf6bdcf5c
fd644f20e2890bfee73e02d814c859d48b960533d6aae7af37eb109d8a17e8d5
fdfa75a3c45a10624d2e4bf2498822690c27d972e0f78604ca45e3c1a2e82928
fe1288901615e6e296459f696f2808158ab250cdcd13fc5508ba6259f57515a3
fe8c4576ef624cf4c108d382c9c9e49a8c8001c93d0cd8a51f4bce61691b6eaa
ffe502118bc0aee7860c46e00171257b4218821138846a73d68e44f604662a8b

www.nowsecure.com Open in urlscan Pro 2606:4700:20::ac43:4987 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

157 Requests

98 %HTTPS

43 %IPv6

38 Domains

51 Subdomains

45 IPs

7 Countries

2432 kBTransfer

6032 kBSize

38 Cookies

28 Outgoing links

Page URL History

Redirected requests

157 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.nowsecure.com Open in urlscan Pro
2606:4700:20::ac43:4987 Public Scan

Screenshot
Live screenshot

Full Image

157
Requests

98 %
HTTPS

43 %
IPv6

38
Domains

51
Subdomains

45
IPs

7
Countries

2432 kB
Transfer

6032 kB
Size

38
Cookies

157 HTTP transactions
0 data transactions