Submitted URL: https://know.bishopfox.com/research/cve-2019-18935-remote-code-execution-in-telerik-ui
Effective URL: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui
Submission: On May 26 via api from US — Scanned from DE

Summary

This website contacted 28 IPs in 4 countries across 22 domains to perform 98 HTTP transactions. The main IP is 2606:4700:20::6818:362, located in United States and belongs to CLOUDFLARENET, US. The main domain is bishopfox.com. The Cisco Umbrella rank of the primary domain is 660235.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on July 5th 2021. Valid for: a year.
This is the only time bishopfox.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
2 10 2606:4700:20:... 13335 (CLOUDFLAR...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
6 52.219.176.153 16509 (AMAZON-02)
10 104.17.73.206 13335 (CLOUDFLAR...)
2 2a00:1450:400... 15169 (GOOGLE)
23 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
1 2a02:26f0:350... 20940 (AKAMAI-ASN1)
3 2a00:1450:400... 15169 (GOOGLE)
2 104.90.146.131 16625 (AKAMAI-AS)
8 104.92.74.202 16625 (AKAMAI-AS)
2 2a00:1450:400... 15169 (GOOGLE)
3 3 2620:1ec:21::14 8068 (MICROSOFT...)
1 13.107.42.14 8068 (MICROSOFT...)
1 2a00:1450:400... 15169 (GOOGLE)
2 4 2a00:1450:400... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
6 2a00:1450:400... 15169 (GOOGLE)
3 2a00:1450:400... 15169 (GOOGLE)
1 192.28.147.68 15224 (OMNITURE)
2 2a00:1450:400... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
1 37.252.172.36 29990 (ASN-APPNEX)
1 2a02:26f0:6c0... 20940 (AKAMAI-ASN1)
98 28
Apex Domain
Subdomains
Transfer
20 bishopfox.com
know.bishopfox.com
bishopfox.com — Cisco Umbrella Rank: 660235
go.bishopfox.com
501 KB
19 youtube.com
www.youtube.com — Cisco Umbrella Rank: 91
1 MB
9 6sc.co
j.6sc.co — Cisco Umbrella Rank: 6764
c.6sc.co — Cisco Umbrella Rank: 10181
ipv6.6sc.co — Cisco Umbrella Rank: 7111
b.6sc.co — Cisco Umbrella Rank: 4771
15 KB
9 googleapis.com
storage.googleapis.com — Cisco Umbrella Rank: 457
jnn-pa.googleapis.com — Cisco Umbrella Rank: 275
200 KB
7 doubleclick.net
stats.g.doubleclick.net — Cisco Umbrella Rank: 84
googleads.g.doubleclick.net — Cisco Umbrella Rank: 40
static.doubleclick.net — Cisco Umbrella Rank: 338
2 KB
6 amazonaws.com
s3.us-east-2.amazonaws.com
2 MB
4 linkedin.com
px.ads.linkedin.com — Cisco Umbrella Rank: 320
www.linkedin.com — Cisco Umbrella Rank: 560
px4.ads.linkedin.com — Cisco Umbrella Rank: 5318
3 KB
4 gstatic.com
fonts.gstatic.com
www.gstatic.com Failed
47 KB
4 google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 35
20 KB
3 google.com
www.google.com — Cisco Umbrella Rank: 2
27 KB
2 ytimg.com
i.ytimg.com — Cisco Umbrella Rank: 111
18 KB
2 ggpht.com
yt3.ggpht.com — Cisco Umbrella Rank: 213
12 KB
2 marketo.net
munchkin.marketo.net — Cisco Umbrella Rank: 3204
6 KB
2 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 64
135 KB
1 adnxs.com
secure.adnxs.com — Cisco Umbrella Rank: 391
697 B
1 snapengage.com
www.snapengage.com — Cisco Umbrella Rank: 12387
340 B
1 google.de
www.google.de — Cisco Umbrella Rank: 6117
501 B
1 mktoresp.com
136-utj-516.mktoresp.com
311 B
1 licdn.com
snap.licdn.com — Cisco Umbrella Rank: 760
3 KB
1 googleoptimize.com
www.googleoptimize.com — Cisco Umbrella Rank: 1297
38 KB
1 cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 206
29 KB
1 jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 419
1 KB
98 22
Domain Requested by
19 www.youtube.com bishopfox.com
www.youtube.com
www.googletagmanager.com
10 go.bishopfox.com bishopfox.com
go.bishopfox.com
9 bishopfox.com 1 redirects bishopfox.com
6 b.6sc.co
6 jnn-pa.googleapis.com www.youtube.com
6 s3.us-east-2.amazonaws.com bishopfox.com
4 googleads.g.doubleclick.net 2 redirects www.youtube.com
4 www.google-analytics.com www.googletagmanager.com
www.google-analytics.com
bishopfox.com
3 www.google.com www.youtube.com
bishopfox.com
3 storage.googleapis.com bishopfox.com
2 www.gstatic.com www.youtube.com
www.gstatic.com
2 i.ytimg.com www.youtube.com
2 yt3.ggpht.com www.youtube.com
2 static.doubleclick.net www.youtube.com
2 px.ads.linkedin.com 2 redirects
2 fonts.gstatic.com www.youtube.com
2 munchkin.marketo.net bishopfox.com
munchkin.marketo.net
2 www.googletagmanager.com bishopfox.com
www.googletagmanager.com
1 ipv6.6sc.co j.6sc.co
1 c.6sc.co j.6sc.co
1 secure.adnxs.com j.6sc.co
1 www.snapengage.com storage.googleapis.com
1 www.google.de bishopfox.com
1 136-utj-516.mktoresp.com munchkin.marketo.net
1 stats.g.doubleclick.net www.google-analytics.com
1 px4.ads.linkedin.com bishopfox.com
1 www.linkedin.com 1 redirects
1 j.6sc.co bishopfox.com
1 snap.licdn.com www.googletagmanager.com
1 www.googleoptimize.com www.googletagmanager.com
1 cdnjs.cloudflare.com bishopfox.com
1 cdn.jsdelivr.net bishopfox.com
1 know.bishopfox.com 1 redirects
98 33
Subject Issuer Validity Valid
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3
2021-07-05 -
2022-07-04
a year crt.sh
*.s3.us-east-2.amazonaws.com
Amazon
2021-12-17 -
2022-12-16
a year crt.sh
go.bishopfox.com
Cloudflare Inc ECC CA-3
2021-07-27 -
2022-07-26
a year crt.sh
*.google-analytics.com
GTS CA 1C3
2022-05-04 -
2022-07-27
3 months crt.sh
*.google.com
GTS CA 1C3
2022-05-04 -
2022-07-27
3 months crt.sh
snap.licdn.com
DigiCert SHA2 Secure Server CA
2022-03-01 -
2023-03-01
a year crt.sh
storage.googleapis.com
GTS CA 1C3
2022-05-04 -
2022-07-27
3 months crt.sh
*.marketo.net
DigiCert SHA2 Secure Server CA
2022-02-06 -
2023-02-07
a year crt.sh
*.6sc.co
DigiCert TLS Hybrid ECC SHA384 2020 CA1
2022-03-08 -
2023-03-11
a year crt.sh
*.gstatic.com
GTS CA 1C3
2022-05-04 -
2022-07-27
3 months crt.sh
*.g.doubleclick.net
GTS CA 1C3
2022-05-04 -
2022-07-27
3 months crt.sh
*.doubleclick.net
GTS CA 1C3
2022-05-04 -
2022-07-27
3 months crt.sh
upload.video.google.com
GTS CA 1C3
2022-05-04 -
2022-07-27
3 months crt.sh
www.google.com
GTS CA 1C3
2022-05-04 -
2022-07-27
3 months crt.sh
*.mktoresp.com
DigiCert TLS RSA SHA256 2020 CA1
2021-11-30 -
2022-11-30
a year crt.sh
*.googleusercontent.com
GTS CA 1C3
2022-05-04 -
2022-07-27
3 months crt.sh
edgestatic.com
GTS CA 1C3
2022-05-04 -
2022-07-27
3 months crt.sh
www.google.de
GTS CA 1C3
2022-05-04 -
2022-07-27
3 months crt.sh
www.snapengage.com
GTS CA 1D4
2022-05-01 -
2022-07-30
3 months crt.sh
*.adnxs.com
GeoTrust ECC CA 2018
2022-02-11 -
2023-03-14
a year crt.sh

This page contains 5 frames:

Primary Page: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui
Frame ID: 65A15910B0E126C716C791C6413611DF
Requests: 52 HTTP requests in this frame

Frame: https://www.youtube.com/embed/--6PiuvBGAU?enablejsapi=1&origin=https%3A%2F%2Fbishopfox.com
Frame ID: 0B8E6F95EE5107C21F37E7D071BDE023
Requests: 40 HTTP requests in this frame

Frame: https://storage.googleapis.com/code.snapengage.com/cd/4828764552101888/1632347706836.png
Frame ID: A22E7338E95E2B392C9CE10B3954AF76
Requests: 1 HTTP requests in this frame

Frame: https://go.bishopfox.com/dtp-1.0.4.html
Frame ID: BE92644AC930084BFEB1837CB4A6F47B
Requests: 3 HTTP requests in this frame

Frame: https://go.bishopfox.com/index.php/form/XDFrame
Frame ID: 7CBA0DF144D709E732C20177536EFDDC
Requests: 2 HTTP requests in this frame

Screenshot

Page Title

CVE-2019-18935: Remote Code Execution via Insecure… | Bishop Fox

Page URL History Show full URLs

  1. https://know.bishopfox.com/research/cve-2019-18935-remote-code-execution-in-telerik-ui HTTP 301
    https://bishopfox.com/research/cve-2019-18935-remote-code-execution-in-telerik-ui HTTP 301
    https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • adnxs\.(?:net|com)

Overall confidence: 100%
Detected patterns
  • google-analytics\.com/(?:ga|urchin|analytics)\.js

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Overall confidence: 100%
Detected patterns
  • googleoptimize\.com/optimize\.js

Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/gtm\.js
  • googletagmanager\.com/gtag/js

Overall confidence: 100%
Detected patterns
  • /(?:([\d.])+/)?highlight(?:\.min)?\.js

Overall confidence: 100%
Detected patterns
  • snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

Overall confidence: 100%
Detected patterns
  • munchkin\.marketo\.\w+/(?:([\d.]+)/)?munchkin\.js

Overall confidence: 100%
Detected patterns
  • <link [^>]*?href="?[a-zA-Z]*?:?//cdn\.jsdelivr\.net/
  • //cdn\.jsdelivr\.net/

Page Statistics

98
Requests

93 %
HTTPS

75 %
IPv6

22
Domains

33
Subdomains

28
IPs

4
Countries

4765 kB
Transfer

10347 kB
Size

27
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://know.bishopfox.com/research/cve-2019-18935-remote-code-execution-in-telerik-ui HTTP 301
    https://bishopfox.com/research/cve-2019-18935-remote-code-execution-in-telerik-ui HTTP 301
    https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 31
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=2404668&time=1653604348277&url=https%3A%2F%2Fbishopfox.com%2Fblog%2Fcve-2019-18935-remote-code-execution-in-telerik-ui HTTP 302
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D2404668%26time%3D1653604348277%26url%3Dhttps%253A%252F%252Fbishopfox.com%252Fblog%252Fcve-2019-18935-remote-code-execution-in-telerik-ui%26liSync%3Dtrue HTTP 302
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=2404668&time=1653604348277&url=https%3A%2F%2Fbishopfox.com%2Fblog%2Fcve-2019-18935-remote-code-execution-in-telerik-ui&liSync=true HTTP 302
  • https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=2404668&time=1653604348277&url=https%3A%2F%2Fbishopfox.com%2Fblog%2Fcve-2019-18935-remote-code-execution-in-telerik-ui&liSync=true&e_ipv6=AQJQLESosiEQQgAAAYECf_UNq9r1Rje_lHhx9Al4NGeR_tWM_SsOOcqucs8udbYviMjBhYE
Request Chain 35
  • https://googleads.g.doubleclick.net/pagead/id HTTP 302
  • https://googleads.g.doubleclick.net/pagead/id?slf_rd=1
Request Chain 72
  • https://googleads.g.doubleclick.net/pagead/id HTTP 302
  • https://googleads.g.doubleclick.net/pagead/id?slf_rd=1

98 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request cve-2019-18935-remote-code-execution-in-telerik-ui
bishopfox.com/blog/
Redirect Chain
  • https://know.bishopfox.com/research/cve-2019-18935-remote-code-execution-in-telerik-ui
  • https://bishopfox.com/research/cve-2019-18935-remote-code-execution-in-telerik-ui
  • https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui
191 KB
38 KB
Document
General
Full URL
https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::6818:362 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / Craft CMS SEOmatic
Resource Hash
8eb80fb9c89ef87163485116e4284f0f17c784f37fcc4ef4716befbd581a7382
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cf-apo-via
origin,no-cache
cf-cache-status
BYPASS
cf-ray
7119f7808b409128-FRA
content-encoding
br
content-type
text/html; charset=UTF-8
date
Thu, 26 May 2022 22:32:27 GMT
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
link
<https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui>; rel='canonical'
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy
no-referrer-when-downgrade
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YssiNuCaGFpwtKI0Kp1BqSY6TSRGy%2FCZ4%2Fc5i6REU574IEtA2dpv9dOkYjVcRj9gzCEgkzNKF4y9sH634yX3B7tueoD48X28v3i%2BNbgKpvQg%2BzvIC4oAiTJGa1pYAk0gVPYxAbDQgzI9J8E%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-powered-by
Craft CMS SEOmatic
x-robots-tag
all
x-xss-protection
1; mode=block

Redirect headers

cf-apo-via
origin,no-cache
cf-cache-status
BYPASS
cf-ray
7119f77ee8229128-FRA
content-type
text/html; charset=UTF-8
date
Thu, 26 May 2022 22:32:26 GMT
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
location
https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=H%2FTmdZ6bdwKQ9OFEW2wzU%2F5lg3KmE9mdIo5fTDyhSNO35f7Msyd0t0efDMjp54FYm8s%2Bh9GQjSpvnsscIicbJ8XIH017m938Br6NkvroEukKC3xg%2B2ktUJycennEXDJU%2BV3vDPSoiAovBp8%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-powered-by
Craft CMS
x-xss-protection
1; mode=block
app.css
bishopfox.com/static/styles/
60 KB
13 KB
Stylesheet
General
Full URL
https://bishopfox.com/static/styles/app.css?id=473db985458761489df6
Requested by
Host: bishopfox.com
URL: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::6818:362 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c587ac4899e5fdb91856de5b6520dd49037232c5e27efd2ae155691bae1d50e8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Thu, 26 May 2022 22:32:27 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
5710
x-xss-protection
1; mode=block
last-modified
Mon, 09 May 2022 20:19:35 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"62797757-ed5d"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MyoE1JwsbxjIErsbUni6HcvtCeX0hy%2BhQCNqEGaHWVgTHyEhwdxsz8z%2Fkz91Ex10OUHJfi%2FyFcfZrRiUJp3eMlh1KMGTAxtrnTSmWQdGuySWRDUnCGE%2FRvEcvRyPdUR%2BC5SCftqFB0OMxPs%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=14400
cf-ray
7119f7849b409128-FRA
cf-bgj
minify
main.js
bishopfox.com/static/js/
132 KB
45 KB
Script
General
Full URL
https://bishopfox.com/static/js/main.js?id=41e33dce0fcab174815c
Requested by
Host: bishopfox.com
URL: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::6818:362 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1d6bd059fec2dc8fa74d697fda6ecf6abdd4f66f6713506dc9b182db69bbdb54
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Thu, 26 May 2022 22:32:27 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
5710
x-xss-protection
1; mode=block
last-modified
Mon, 09 May 2022 20:19:35 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"62797757-21034"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mHy6P%2BbEfChFVBjaiL3xwCCpfeA4p%2BOYzTcqXVD00W9OpHuZOy53y4kR%2BftJBjtamRxo0e2JY8sWqjeg4JKgVHzKak8gQE6%2BZnd9OH%2FZ14mxgmGz9cQ6bK3U68fXB3bM2EHgRLlz5%2B5%2FQ2Q%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
cache-control
max-age=14400
cf-ray
7119f7850c159128-FRA
solarized-dark.min.css
cdn.jsdelivr.net/gh/highlightjs/cdn-release@10.1.2/build/styles/
778 B
1 KB
Stylesheet
General
Full URL
https://cdn.jsdelivr.net/gh/highlightjs/cdn-release@10.1.2/build/styles/solarized-dark.min.css
Requested by
Host: bishopfox.com
URL: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:5714 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a62395528bf1cec786343dc969b28c2f5a0046cc8e73652780a7408fbbd97a2e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://bishopfox.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Thu, 26 May 2022 22:32:27 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age
19188
x-jsd-version
10.1.2
x-cache
HIT, HIT
cross-origin-resource-policy
cross-origin
strict-transport-security
max-age=31536000; includeSubDomains; preload
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-served-by
cache-fra19139-FRA, cache-iad-kiad7000023-IAD
timing-allow-origin
*
x-jsd-version-type
version
server
cloudflare
etag
W/"30a-8gH5cmaIiZrl8M7l/yQS4GnBH5E"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MvbHQzg5j8oyUnDTi7KMv%2B9br8DkMcRWeBxxbT4hE2KaChqZxsxvh0I0MS8S%2F9pPOHMY1HFMod2LuUwKKcpMAfxANC4PcODCFHAbvf%2F9cm1%2FGnA6Sh1svPVlS9%2BQsEyQvUTA3xZv3jY%2BSkzB4qo%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=31536000, s-maxage=31536000, immutable
cf-ray
7119f7859f649040-FRA
highlight.min.js
cdnjs.cloudflare.com/ajax/libs/highlight.js/10.1.2/
98 KB
29 KB
Script
General
Full URL
https://cdnjs.cloudflare.com/ajax/libs/highlight.js/10.1.2/highlight.min.js
Requested by
Host: bishopfox.com
URL: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8a446896ed6dd5086841d19eefeb98551a65a848e961ac248050254d66e758fb
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://bishopfox.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Thu, 26 May 2022 22:32:27 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age
9220849
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
28749
timing-allow-origin
*
last-modified
Thu, 23 Jul 2020 21:15:39 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"5f19fdfb-187b4"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15780000
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CquyZ1vDsi%2FAofJgYKd2xBtNszqC6ESnbnBbiW5gJ95%2FZ0BRC4uDg8PExGSizjKBcZLDOn3WgWYuszMtPdtosmR8no1uY7CXda1apwbpJMrR%2F64xVAaN0y2JnEAD6t4mYQeXcdlOwk5XaoR4oieMb0aK"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=30672000
accept-ranges
bytes
cf-ray
7119f7859b4a9136-FRA
expires
Tue, 16 May 2023 22:32:27 GMT
bishopfox-mexico-logo.png
bishopfox.com/static/assets/images/main-menu/
25 KB
25 KB
Image
General
Full URL
https://bishopfox.com/static/assets/images/main-menu/bishopfox-mexico-logo.png
Requested by
Host: bishopfox.com
URL: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::6818:362 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a26c9e631307638ee80b6127043a351f5e1fa90a4fcd8948e27e083a3ecb72cd
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Thu, 26 May 2022 22:32:27 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
1731
cf-polished
origSize=28841
content-length
25291
x-xss-protection
1; mode=block
last-modified
Tue, 17 May 2022 17:09:29 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
"6283d6c9-70a9"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gn2%2FMpuQdV4uGUHfHynrB%2FISWtDVcko%2BcYlOS4QbEIqP4eKG2NSUTGR6u4bixRYLGDUZ%2B8y8TVTlv7HYvEuGVZIpXymOSrmb2C813wk%2Fe%2BmkgaQGyWZlpW0jK73ZV3FKV1fpyODE7ZaWvyQ%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
7119f7865e619128-FRA
cf-bgj
imgq:85,h2pri
Bishop-Fox_Blog-Post_Telerik_FI-01_2022-05-18-224348_nhah.png
s3.us-east-2.amazonaws.com/s3.bishopfox.com/prod-1437/Images/channels/blog/featured-images/
198 KB
199 KB
Image
General
Full URL
https://s3.us-east-2.amazonaws.com/s3.bishopfox.com/prod-1437/Images/channels/blog/featured-images/Bishop-Fox_Blog-Post_Telerik_FI-01_2022-05-18-224348_nhah.png
Requested by
Host: bishopfox.com
URL: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.219.176.153 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
s3.us-east-2.amazonaws.com
Software
AmazonS3 /
Resource Hash
d0199fee293acde68cccf4d274ec8b036fb35b5da377903b704ffbc42cf58d69

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date
Thu, 26 May 2022 22:32:29 GMT
Last-Modified
Wed, 18 May 2022 22:43:49 GMT
Server
AmazonS3
x-amz-request-id
AAXKRK1XZAG1YBTF
ETag
"c771bd7af872ff6fe0671624c2a7ad96"
Content-Type
image/png
Accept-Ranges
bytes
Content-Length
202981
x-amz-id-2
lGN9mS2eH0QgDUtKAjftVrFsi1njiWefCtkjclSBCazVBVa4knv6k7z5fvWLho+etHLP/B7EsAI=
caleb.jpg
s3.us-east-2.amazonaws.com/s3.bishopfox.com/prod-1437/Images/headshots/
266 KB
266 KB
Image
General
Full URL
https://s3.us-east-2.amazonaws.com/s3.bishopfox.com/prod-1437/Images/headshots/caleb.jpg
Requested by
Host: bishopfox.com
URL: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.219.176.153 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
s3.us-east-2.amazonaws.com
Software
AmazonS3 /
Resource Hash
9a40ca2af2fff49c941718d910ddbb14cfba33c61ecbbd030fb8b64338f6f83d

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date
Thu, 26 May 2022 22:32:29 GMT
Last-Modified
Tue, 02 Nov 2021 22:10:28 GMT
Server
AmazonS3
x-amz-request-id
AAXVTMZ2N6DE8RFF
ETag
"1de0ced9a82d25eaf8f9cfdb6c6c03d5"
Content-Type
image/jpeg
Accept-Ranges
bytes
Content-Length
272524
x-amz-id-2
PXaIMpoYEDsDI7R09DrAHzNn1qXRmDHKmF8ccsJX2SW9SWv2S2nwH/MxVC6ZbI+tbSYu5d6Mmo4=
Bishop-Fox-Blog-Decentralized-Finance-Blockchain-Battleground-F.jpg
s3.us-east-2.amazonaws.com/s3.bishopfox.com/prod-1437/Images/channels/blog/featured-images/
59 KB
59 KB
Image
General
Full URL
https://s3.us-east-2.amazonaws.com/s3.bishopfox.com/prod-1437/Images/channels/blog/featured-images/Bishop-Fox-Blog-Decentralized-Finance-Blockchain-Battleground-F.jpg
Requested by
Host: bishopfox.com
URL: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.219.176.153 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
s3.us-east-2.amazonaws.com
Software
AmazonS3 /
Resource Hash
ee6415815b89316a51d93b0d28318d0c9fa0e3ae52be6a4b50a06aef6a0c8710

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date
Thu, 26 May 2022 22:32:29 GMT
Last-Modified
Mon, 23 May 2022 21:19:07 GMT
Server
AmazonS3
x-amz-request-id
AAXYKBT7S7NCVRKJ
ETag
"9eecba13b8b8bd6d6902c8f2f448a3bd"
Content-Type
image/jpeg
Accept-Ranges
bytes
Content-Length
60482
x-amz-id-2
i1NkIKzUCbbRKLb4SJcu1TOJ2rCgxjl30MttefJKG+wIDncMM/iqQ2nE3gsEYpdm8xs7Q49gDQQ=
Bishop-Fox-Blog-Ruby-Vulnerabilities-F.jpg
s3.us-east-2.amazonaws.com/s3.bishopfox.com/prod-1437/Images/channels/blog/tiles/
102 KB
102 KB
Image
General
Full URL
https://s3.us-east-2.amazonaws.com/s3.bishopfox.com/prod-1437/Images/channels/blog/tiles/Bishop-Fox-Blog-Ruby-Vulnerabilities-F.jpg
Requested by
Host: bishopfox.com
URL: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.219.176.153 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
s3.us-east-2.amazonaws.com
Software
AmazonS3 /
Resource Hash
036d9addc4c8e183bb9f5ba70e27cabad16d70cbe8998c9bc71c7b92e64d9943

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date
Thu, 26 May 2022 22:32:29 GMT
Last-Modified
Thu, 12 May 2022 22:48:08 GMT
Server
AmazonS3
x-amz-request-id
AAXKJH98FYH6KW92
ETag
"0e38320ef84acd4184045de908a45314"
Content-Type
image/jpeg
Accept-Ranges
bytes
Content-Length
104175
x-amz-id-2
Qw1BS9NAXRHSKx0Ml/gnmSMuLJ1mcXWtc3DUG2T6D08REgZh5jrTzaSGVOuxA708giZ4cPsdzF4=
Bishop-Fox-Blog-Favorite-Fuzzing-Tools-F.png
s3.us-east-2.amazonaws.com/s3.bishopfox.com/prod-1437/Images/channels/blog/featured-images/
1 MB
1 MB
Image
General
Full URL
https://s3.us-east-2.amazonaws.com/s3.bishopfox.com/prod-1437/Images/channels/blog/featured-images/Bishop-Fox-Blog-Favorite-Fuzzing-Tools-F.png
Requested by
Host: bishopfox.com
URL: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.219.176.153 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
s3.us-east-2.amazonaws.com
Software
AmazonS3 /
Resource Hash
d50729450d3020ee4991730d92b237d38ea737df74fb9e5cade4561b11142ce7

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date
Thu, 26 May 2022 22:32:29 GMT
Last-Modified
Mon, 18 Apr 2022 17:17:20 GMT
Server
AmazonS3
x-amz-request-id
AAXHZWCQTE6RP0F0
ETag
"136d2d2eed19f606eea6bea1c3a23a4d"
Content-Type
image/png
Accept-Ranges
bytes
Content-Length
1395741
x-amz-id-2
XuaAvMbVVRRNOSs6F7Itx5SqwBSYd126QiFmfqj700Wq81VVFzEfBx1zBz1AtUEjuTNYhja4BKE=
Bishop-Fox-Blog-Nuclei-Tool_2022-05-18-225102_rree.png
s3.us-east-2.amazonaws.com/s3.bishopfox.com/prod-1437/Images/channels/blog/tiles/
192 KB
192 KB
Image
General
Full URL
https://s3.us-east-2.amazonaws.com/s3.bishopfox.com/prod-1437/Images/channels/blog/tiles/Bishop-Fox-Blog-Nuclei-Tool_2022-05-18-225102_rree.png
Requested by
Host: bishopfox.com
URL: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.219.176.153 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
s3.us-east-2.amazonaws.com
Software
AmazonS3 /
Resource Hash
9ad44775d8eda5561824249518bfd8a31e2ead196c3c52a36b68d2ba95785078

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date
Thu, 26 May 2022 22:32:29 GMT
Last-Modified
Wed, 18 May 2022 22:51:03 GMT
Server
AmazonS3
x-amz-request-id
AAXST4W56TT9E9WC
ETag
"6e421a55290cd63eaab167ce93a8d446"
Content-Type
image/png
Accept-Ranges
bytes
Content-Length
196287
x-amz-id-2
zH8N65XBzS8Cm+5EC9JR4m1ZtOf7yhCRTx23qSjbNsesp2vLa1EE+Bh+Y22RchH6Y6H0NpsayoA=
forms2.min.js
go.bishopfox.com/js/forms2/js/
205 KB
68 KB
Script
General
Full URL
https://go.bishopfox.com/js/forms2/js/forms2.min.js
Requested by
Host: bishopfox.com
URL: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.73.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
54b1a318711ed45da6f1a787a0b0f601199c8676b7d565a4163674833c64b0a0
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Thu, 26 May 2022 22:32:28 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
last-modified
Tue, 03 May 2022 03:46:42 GMT
server
cloudflare
age
4083
etag
"11003a3-3326e-5de135b5b2c80"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
public, max-age=14400
cf-ray
7119f78949929b34-FRA
expires
Fri, 27 May 2022 02:32:28 GMT
digitalpi-capitalizeNames.js
bishopfox.com/static/js/
848 B
689 B
Script
General
Full URL
https://bishopfox.com/static/js/digitalpi-capitalizeNames.js?id=7492045a5334c0add09f
Requested by
Host: bishopfox.com
URL: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::6818:362 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
77b6a8e22b7c2cc34b937c6810561f50ce4d59bf6689814fc2710fe418aa284e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Thu, 26 May 2022 22:32:27 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
5710
x-xss-protection
1; mode=block
last-modified
Wed, 23 Feb 2022 21:21:42 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"6216a566-350"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tFXid5wEHi8R60LD5U73cCveEH8M7tUOVdHrirkUb%2FvRqjuBlW3vrq8Tctq2qyAng71k7z%2BKkAbBqavZ1honKz5HY2lNf0fzvP2pGbrItNh5OKEidBtezuQ2qwwoCkqAvNLsu%2BK6J9o%2F9UY%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
cache-control
max-age=14400
cf-ray
7119f7861e0a9128-FRA
gtm.js
www.googletagmanager.com/
188 KB
66 KB
Script
General
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-NSTVGF3
Requested by
Host: bishopfox.com
URL: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:827::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
a254697022c008cd17aa3bf3c6fbc5d6b1c82e6a92fa319d5a74b3fd6d27e4f5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://bishopfox.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Thu, 26 May 2022 22:32:27 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
67104
x-xss-protection
0
last-modified
Thu, 26 May 2022 21:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Thu, 26 May 2022 22:32:27 GMT
UcC73FwrK3iLTeHuS_fvQtMwCp50KnMa1ZL7.woff2
bishopfox.com/fonts.gstatic.com/s/inter/v11/
37 KB
37 KB
Font
General
Full URL
https://bishopfox.com/fonts.gstatic.com/s/inter/v11/UcC73FwrK3iLTeHuS_fvQtMwCp50KnMa1ZL7.woff2
Requested by
Host: bishopfox.com
URL: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::6818:362 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b97c99a69a6275c8f90703cd4c0864089a74fd08383a1cc75a8a4d0c2cb60cce

Request headers

Referer
https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui
Origin
https://bishopfox.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Thu, 26 May 2022 22:32:27 GMT
cf-cache-status
MISS
last-modified
Tue, 26 Apr 2022 15:29:50 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=N8xF20qdTjy46sJ1zqpoAJySEa84npbVEvTMyHDFyRZgnzw0NnSnyOlsCRW2bRiGonwkipTMaxvY5CmU8yBe1qGr4eK6X7pdQn%2Bux%2FQq%2BXzsVRvZwuzsoRHT%2FpOy6ubXCxC03c%2B07zaoxJE%3D"}],"group":"cf-nel","max_age":604800}
content-type
font/woff2
cache-control
public, max-age=31536000
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-apo-via
proxy
accept-ranges
bytes
cf-ray
7119f7865e729128-FRA
content-length
37716
expires
Wed, 24 May 2023 17:07:46 GMT
--6PiuvBGAU
www.youtube.com/embed/ Frame 0B8E
63 KB
27 KB
Document
General
Full URL
https://www.youtube.com/embed/--6PiuvBGAU
Requested by
Host: bishopfox.com
URL: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:810::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
ab9e4369b7708a147c7d1ca4ab6661b7c5a3c3390f9dee80bab6268972506aa1
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
no-cache, no-store, max-age=0, must-revalidate
content-encoding
br
content-type
text/html; charset=utf-8
critical-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy-report-only
same-origin; report-to="youtube_main"
date
Thu, 26 May 2022 22:32:28 GMT
expires
Mon, 01 Jan 1990 00:00:00 GMT
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=de for more info."
permissions-policy
ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-platform=*, ch-ua-platform-version=*
pragma
no-cache
report-to
{"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]}
server
ESF
strict-transport-security
max-age=31536000
vary
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-content-type-options
nosniff
x-xss-protection
0
bg-header-shape-R-fibers.png
bishopfox.com/static/assets/images/default/backgrounds/
177 KB
178 KB
Image
General
Full URL
https://bishopfox.com/static/assets/images/default/backgrounds/bg-header-shape-R-fibers.png
Requested by
Host: bishopfox.com
URL: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::6818:362 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4d4b6a308f7020554dfd5c36f7a1ec40a7ff919487c17d885ec38e50530d8f1c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Thu, 26 May 2022 22:32:27 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
1732
cf-polished
status=not_needed
content-length
181151
x-xss-protection
1; mode=block
last-modified
Tue, 17 May 2022 17:09:29 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
"6283d6c9-2c39f"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=H3DMYLaxoDA1jjumwSmezVT6InogUolENp1iev%2B5V92da%2BBQHPtshwCFnK23tuoC0cU4WxY%2Bqkpyrd9YzBkSC9wixUcM0WQa5%2BbYXv7WpO7MQncJi7%2FxjjXRULlcT1478vAG96iCY91ITyE%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
7119f7868eda9128-FRA
cf-bgj
imgq:85,h2pri
www-player.css
www.youtube.com/s/player/d1783cbe/ Frame 0B8E
336 KB
47 KB
Stylesheet
General
Full URL
https://www.youtube.com/s/player/d1783cbe/www-player.css
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/embed/--6PiuvBGAU
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:810::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
ff7cec7fbbb44902cb946b2d77bb28bfdfeb69d5c61837fe68c6b066281a9bc5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.youtube.com/embed/--6PiuvBGAU
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Wed, 25 May 2022 16:02:49 GMT
content-encoding
br
x-content-type-options
nosniff
age
109779
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
47343
x-xss-protection
0
last-modified
Wed, 25 May 2022 00:16:59 GMT
server
sffe
vary
Accept-Encoding, Origin
report-to
{"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type
text/css
cache-control
public, max-age=31536000
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="youtube"
expires
Thu, 25 May 2023 16:02:49 GMT
js
www.googletagmanager.com/gtag/
191 KB
68 KB
Script
General
Full URL
https://www.googletagmanager.com/gtag/js?id=G-DYCTLWMS7T&l=dataLayer&cx=c
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NSTVGF3
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:827::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
3415801762419bbb07aec4d4bfd8b89fca0ac867fc900e0f09b19321ab255c55
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Thu, 26 May 2022 22:32:28 GMT
content-encoding
br
server
Google Tag Manager
access-control-allow-headers
Cache-Control
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
strict-transport-security
max-age=31536000; includeSubDomains
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
69994
x-xss-protection
0
expires
Thu, 26 May 2022 22:32:28 GMT
optimize.js
www.googleoptimize.com/
96 KB
38 KB
Script
General
Full URL
https://www.googleoptimize.com/optimize.js?id=OPT-TPVLMLB
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NSTVGF3
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80e::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
18f1b7ee7bd72fcb170820c889f76861c24585bc2b857db5cc31c23154def714
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Thu, 26 May 2022 22:32:28 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
38551
x-xss-protection
0
last-modified
Thu, 26 May 2022 21:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Thu, 26 May 2022 22:32:28 GMT
analytics.js
www.google-analytics.com/
49 KB
20 KB
Script
General
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NSTVGF3
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:810::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 13 Apr 2022 21:02:38 GMT
server
Golfe2
age
3462
date
Thu, 26 May 2022 21:34:46 GMT
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
20006
expires
Thu, 26 May 2022 23:34:46 GMT
insight.min.js
snap.licdn.com/li.lms-analytics/
8 KB
3 KB
Script
General
Full URL
https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NSTVGF3
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:3500:16::215:14a0 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
14f2ec002b176e0dee403cb7dd4ef2274a1353080e1e3e4084678770f4c15b9c

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date
Thu, 26 May 2022 22:32:28 GMT
Content-Encoding
gzip
Last-Modified
Wed, 13 Apr 2022 23:25:22 GMT
X-CDN
AKAM
Vary
Accept-Encoding
Content-Type
application/x-javascript;charset=utf-8
Cache-Control
max-age=19795
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
3085
f3f28b6e-d72e-4019-b593-e66b82625b0c.js
storage.googleapis.com/code.snapengage.com/js/
530 KB
134 KB
Script
General
Full URL
https://storage.googleapis.com/code.snapengage.com/js/f3f28b6e-d72e-4019-b593-e66b82625b0c.js
Requested by
Host: bishopfox.com
URL: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:810::2010 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
UploadServer /
Resource Hash
c357cae871839ca76f03ddcfc4eb17ed65da0d16d7fb1c2a4076fb41ead160b3

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Thu, 26 May 2022 22:32:28 GMT
content-encoding
gzip
age
0
x-guploader-uploadid
ADPycds2YJHWea_9Rpb0a1MJ6lixg9k_cIqQo72gIj295JESqhANevKTOrLhUSoNkIJHXoJNTFL6kMfwHwsIYXSNS8382w
x-goog-storage-class
STANDARD
x-goog-metageneration
1
x-goog-stored-content-encoding
gzip
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
136940
last-modified
Fri, 18 Mar 2022 19:10:47 GMT
server
UploadServer
etag
"22123b33393868500ec2c402eba6683d"
x-goog-hash
crc32c=8ikQHA==, md5=IhI7Mzk4aFAOwsQC66ZoPQ==
x-goog-generation
1647630647256948
cache-control
public, max-age=120, no-transform
x-goog-stored-content-length
136940
accept-ranges
bytes
content-type
text/javascript; charset=utf-8
expires
Thu, 26 May 2022 22:34:28 GMT
munchkin.js
munchkin.marketo.net/
1 KB
1 KB
Script
General
Full URL
https://munchkin.marketo.net/munchkin.js
Requested by
Host: bishopfox.com
URL: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.90.146.131 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-90-146-131.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
4bf3aca933aa233702f890083af601fb16149ec8a17f8c1b90d30450562bde08

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date
Thu, 26 May 2022 22:32:28 GMT
Content-Encoding
gzip
Last-Modified
Fri, 29 Oct 2021 01:24:07 GMT
Server
AkamaiNetStorage
ETag
"461ce1cffaadfebf2e7659745618ba8e:1635470647.434977"
Vary
Accept-Encoding
P3P
policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
application/x-javascript
Content-Length
753
6si.min.js
j.6sc.co/
31 KB
10 KB
Script
General
Full URL
https://j.6sc.co/6si.min.js
Requested by
Host: bishopfox.com
URL: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.92.74.202 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-92-74-202.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
8e038b564510a45dc11799f74da367733f3db7f9c0a0434f1e90c44ec5168278
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date
Thu, 26 May 2022 22:32:28 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Connection
keep-alive
Vary
Accept-Encoding
Content-Length
9715
Pragma
no-cache
Last-Modified
Thu, 05 May 2022 03:45:17 GMT
Server
nginx/1.14.0 (Ubuntu)
ETag
"6273484d-7b02"
Access-Control-Max-Age
86400
Access-Control-Allow-Methods
GET,POST
Content-Type
application/javascript
Access-Control-Allow-Origin
Cache-Control
private, no-cache, proxy-revalidate
Access-Control-Allow-Credentials
true
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Expires
Thu, 26 May 2022 22:32:28 GMT
simpledto-1.0.4.js
go.bishopfox.com/rs/136-UTJ-516/images/
2 KB
1 KB
Script
General
Full URL
https://go.bishopfox.com/rs/136-UTJ-516/images/simpledto-1.0.4.js
Requested by
Host: bishopfox.com
URL: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.73.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e0ea4dbd2c85145cacf92362ae72dc6d56be63d1a68f0d492f55699959874940
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Thu, 26 May 2022 22:32:28 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
EXPIRED
last-modified
Sat, 07 May 2022 02:00:31 GMT
server
cloudflare
etag
"1180407-8b5-5de625702a7fc"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
public, max-age=60
accept-ranges
bytes
cf-ray
7119f78949959b34-FRA
content-length
1092
expires
Thu, 26 May 2022 22:33:28 GMT
KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v18/ Frame 0B8E
15 KB
16 KB
Font
General
Full URL
https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/embed/--6PiuvBGAU
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.youtube.com/
Origin
https://www.youtube.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Tue, 24 May 2022 11:18:05 GMT
x-content-type-options
nosniff
age
213263
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15344
x-xss-protection
0
last-modified
Mon, 16 Oct 2017 17:32:55 GMT
server
sffe
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="apps-themes"
expires
Wed, 24 May 2023 11:18:05 GMT
www-embed-player.js
www.youtube.com/s/player/d1783cbe/www-embed-player.vflset/ Frame 0B8E
284 KB
87 KB
Script
General
Full URL
https://www.youtube.com/s/player/d1783cbe/www-embed-player.vflset/www-embed-player.js
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/embed/--6PiuvBGAU
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:810::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
6759eeea4a3e0dcc6883305b25d7aac20cb725231a29701e41340d6fa7b3410a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.youtube.com/embed/--6PiuvBGAU
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Wed, 25 May 2022 16:02:49 GMT
content-encoding
br
x-content-type-options
nosniff
age
109779
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
89344
x-xss-protection
0
last-modified
Wed, 25 May 2022 00:16:59 GMT
server
sffe
vary
Accept-Encoding, Origin
report-to
{"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="youtube"
expires
Thu, 25 May 2023 16:02:49 GMT
base.js
www.youtube.com/s/player/d1783cbe/player_ias.vflset/de_DE/ Frame 0B8E
2 MB
530 KB
Script
General
Full URL
https://www.youtube.com/s/player/d1783cbe/player_ias.vflset/de_DE/base.js
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/embed/--6PiuvBGAU
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:810::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
10ba2921da7a426d858ab48706a1562f80a8c96c63ebd60a27c39c2c0817355e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.youtube.com/embed/--6PiuvBGAU
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Wed, 25 May 2022 16:02:49 GMT
content-encoding
br
x-content-type-options
nosniff
age
109779
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
542859
x-xss-protection
0
last-modified
Wed, 25 May 2022 00:16:59 GMT
server
sffe
vary
Accept-Encoding, Origin
report-to
{"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="youtube"
expires
Thu, 25 May 2023 16:02:49 GMT
fetch-polyfill.js
www.youtube.com/s/player/d1783cbe/fetch-polyfill.vflset/ Frame 0B8E
9 KB
3 KB
Script
General
Full URL
https://www.youtube.com/s/player/d1783cbe/fetch-polyfill.vflset/fetch-polyfill.js
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/embed/--6PiuvBGAU
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:810::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
498b3f2a0357fbd50a80eb18b23ab4b461b791d640e5560b799f08ed960748a9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.youtube.com/embed/--6PiuvBGAU
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Wed, 25 May 2022 16:02:49 GMT
content-encoding
br
x-content-type-options
nosniff
age
109779
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2786
x-xss-protection
0
last-modified
Wed, 25 May 2022 00:16:59 GMT
server
sffe
vary
Accept-Encoding, Origin
report-to
{"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="youtube"
expires
Thu, 25 May 2023 16:02:49 GMT
collect
www.google-analytics.com/g/
0
17 B
Ping
General
Full URL
https://www.google-analytics.com/g/collect?v=2&tid=G-DYCTLWMS7T&gtm=2oe5p1&_p=1091109963&_z=ccd.tdB&cid=962519027.1653604348&ul=en-us&sr=1600x1200&_s=1&sid=1653604348&sct=1&seg=0&dl=https%3A%2F%2Fbishopfox.com%2Fblog%2Fcve-2019-18935-remote-code-execution-in-telerik-ui&dt=CVE-2019-18935%3A%20Remote%20Code%20Execution%20via%20Insecure%E2%80%A6%20%7C%20Bishop%20Fox&en=page_view&_fv=1&_nsi=1&_ss=1
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-DYCTLWMS7T&l=dataLayer&cx=c
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 26 May 2022 22:32:28 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://bishopfox.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
px4.ads.linkedin.com/
Redirect Chain
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=2404668&time=1653604348277&url=https%3A%2F%2Fbishopfox.com%2Fblog%2Fcve-2019-18935-remote-code-execution-in-telerik-ui
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D2404668%26time%3D1653604348277%26url%3Dhttps%253A%252F%252Fbishopfox.com%252Fblog...
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=2404668&time=1653604348277&url=https%3A%2F%2Fbishopfox.com%2Fblog%2Fcve-2019-18935-remote-code-execution-in-telerik-ui&liSync=true
  • https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=2404668&time=1653604348277&url=https%3A%2F%2Fbishopfox.com%2Fblog%2Fcve-2019-18935-remote-code-execution-in-telerik-ui&liSync=true&e_ipv6=AQJQLES...
0
265 B
Image
General
Full URL
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=2404668&time=1653604348277&url=https%3A%2F%2Fbishopfox.com%2Fblog%2Fcve-2019-18935-remote-code-execution-in-telerik-ui&liSync=true&e_ipv6=AQJQLESosiEQQgAAAYECf_UNq9r1Rje_lHhx9Al4NGeR_tWM_SsOOcqucs8udbYviMjBhYE
Requested by
Host: bishopfox.com
URL: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui
Protocol
H2
Server
13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Thu, 26 May 2022 22:32:29 GMT
x-li-pop
afd-prod-ltx1-x
x-msedge-ref
Ref A: 5C09778E434B475E853F70CF2B3FE357 Ref B: FRAEDGE1413 Ref C: 2022-05-26T22:32:29Z
linkedin-action
1
x-cache
CONFIG_NOCACHE
content-type
application/javascript
x-li-proto
http/2
content-length
0
x-li-uuid
AAXf8cPeatFv+9b9xGIKTQ==
x-li-fabric
prod-ltx1

Redirect headers

date
Thu, 26 May 2022 22:32:28 GMT
x-li-pop
afd-prod-ltx1-x
x-msedge-ref
Ref A: 3562515FDDAF4EFFA5274ECD7E55F79C Ref B: FRAEDGE1416 Ref C: 2022-05-26T22:32:29Z
linkedin-action
1
x-cache
CONFIG_NOCACHE
x-li-fabric
prod-ltx1
location
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=2404668&time=1653604348277&url=https%3A%2F%2Fbishopfox.com%2Fblog%2Fcve-2019-18935-remote-code-execution-in-telerik-ui&liSync=true&e_ipv6=AQJQLESosiEQQgAAAYECf_UNq9r1Rje_lHhx9Al4NGeR_tWM_SsOOcqucs8udbYviMjBhYE
x-li-proto
http/2
content-length
0
x-li-uuid
AAXf8cPVDxSJZedoRFqx1w==
munchkin.js
munchkin.marketo.net/161/
11 KB
5 KB
Script
General
Full URL
https://munchkin.marketo.net/161/munchkin.js
Requested by
Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/munchkin.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.90.146.131 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-90-146-131.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
c2aee78040b4ed46c2377e6825db12a9691a2eb584adf338e77312c8978d8537

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date
Thu, 26 May 2022 22:32:28 GMT
Content-Encoding
gzip
Last-Modified
Wed, 08 Sep 2021 00:38:21 GMT
Server
AkamaiNetStorage
ETag
"0e0eefac8daf874e8b1aa34aeb160c52:1631061501.737429"
Vary
Accept-Encoding
P3P
policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Cache-Control
max-age=8640000
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
application/x-javascript
Content-Length
4681
Expires
Sat, 03 Sep 2022 22:32:28 GMT
collect
www.google-analytics.com/j/
2 B
22 B
XHR
General
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j96&a=1091109963&t=pageview&_s=1&dl=https%3A%2F%2Fbishopfox.com%2Fblog%2Fcve-2019-18935-remote-code-execution-in-telerik-ui&ul=en-us&de=UTF-8&dt=CVE-2019-18935%3A%20Remote%20Code%20Execution%20via%20Insecure%E2%80%A6%20%7C%20Bishop%20Fox&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aADAAEABQAAAAC~&jid=1821733319&gjid=409589792&cid=962519027.1653604348&tid=UA-41346121-1&_gid=1997830729.1653604348&_r=1&gtm=2wg5p1NSTVGF3&cd1=2022-05-26T22%3A32%3A28.99%2B00%3A00&cd2=962519027.1653604348&z=1285424411
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Thu, 26 May 2022 22:32:28 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://bishopfox.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
stats.g.doubleclick.net/j/
4 B
440 B
XHR
General
Full URL
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j96&tid=UA-41346121-1&cid=962519027.1653604348&jid=1821733319&gjid=409589792&_gid=1997830729.1653604348&_u=aADAAEAAQAAAAC~&z=1893440007
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c1b::9d Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
date
Thu, 26 May 2022 22:32:28 GMT
content-type
text/plain
access-control-allow-origin
https://bishopfox.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
4
expires
Fri, 01 Jan 1990 00:00:00 GMT
id
googleads.g.doubleclick.net/pagead/ Frame 0B8E
Redirect Chain
  • https://googleads.g.doubleclick.net/pagead/id
  • https://googleads.g.doubleclick.net/pagead/id?slf_rd=1
100 B
146 B
XHR
General
Full URL
https://googleads.g.doubleclick.net/pagead/id?slf_rd=1
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/embed/--6PiuvBGAU
Protocol
H3
Server
2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
323fb9363e2724f3f9edde48742ccf0b04d95978f7ec1d13755f872c6fea8dc5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.youtube.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Thu, 26 May 2022 22:32:28 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
120
x-xss-protection
0
pragma
no-cache
server
cafe
content-type
application/json; charset=UTF-8
access-control-allow-origin
https://www.youtube.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date
Thu, 26 May 2022 22:32:28 GMT
x-content-type-options
nosniff
access-control-allow-origin
https://www.youtube.com
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
pragma
no-cache
server
cafe
content-type
text/html; charset=UTF-8
location
https://googleads.g.doubleclick.net/pagead/id?slf_rd=1
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
ad_status.js
static.doubleclick.net/instream/ Frame 0B8E
29 B
588 B
Script
General
Full URL
https://static.doubleclick.net/instream/ad_status.js
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/s/player/d1783cbe/www-embed-player.vflset/www-embed-player.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
eed0dc1fdb5d97ed188ae16fd5e1024a5bb744af47340346be2146300a6c54b9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.youtube.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Thu, 26 May 2022 22:24:57 GMT
x-content-type-options
nosniff
age
451
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
29
x-xss-protection
0
last-modified
Thu, 12 Dec 2013 23:40:16 GMT
server
sffe
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=900
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Thu, 26 May 2022 22:39:57 GMT
Create
jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/ Frame
0
0
Preflight
General
Full URL
https://jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/Create
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:813::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type,x-goog-api-key,x-user-agent
Access-Control-Request-Method
POST
Origin
https://www.youtube.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
content-type,x-goog-api-key,x-user-agent
access-control-allow-methods
DELETE,GET,HEAD,OPTIONS,PATCH,POST,PUT
access-control-allow-origin
https://www.youtube.com
access-control-max-age
3600
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
content-type
text/html
date
Thu, 26 May 2022 22:32:28 GMT
server
ESF
vary
origin referer x-origin
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-xss-protection
0
Create
jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/ Frame 0B8E
63 KB
29 KB
XHR
General
Full URL
https://jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/Create
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/s/player/d1783cbe/player_ias.vflset/de_DE/base.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
b92d195d7c1f5fa19d22bfbe43a1711d6cc14c088bb9e9ec85c42a13ed580347
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

X-User-Agent
grpc-web-javascript/0.1
Referer
https://www.youtube.com/
X-Goog-Api-Key
AIzaSyDyT5W0Jh49F30Pqqtyfdf7pDLFKLJoAnw
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
Content-Type
application/json+protobuf

Response headers

date
Thu, 26 May 2022 22:32:28 GMT
content-encoding
gzip
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
server
ESF
x-frame-options
SAMEORIGIN
content-type
application/json+protobuf; charset=UTF-8
access-control-allow-origin
https://www.youtube.com
access-control-expose-headers
vary,vary,vary,content-encoding,date,server,content-length
cache-control
private
access-control-allow-credentials
true
vary
Origin, X-Origin, Referer
content-length
29498
x-xss-protection
0
remote.js
www.youtube.com/s/player/d1783cbe/player_ias.vflset/de_DE/ Frame 0B8E
119 KB
37 KB
Script
General
Full URL
https://www.youtube.com/s/player/d1783cbe/player_ias.vflset/de_DE/remote.js
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/s/player/d1783cbe/player_ias.vflset/de_DE/base.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
de8571efbf0aea75892c4aca0fe97881568ca123b8de9a1f94ccd2d5d274c024
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.youtube.com/embed/--6PiuvBGAU
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Wed, 25 May 2022 16:04:20 GMT
content-encoding
br
x-content-type-options
nosniff
age
109688
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
37816
x-xss-protection
0
last-modified
Wed, 25 May 2022 00:16:59 GMT
server
sffe
vary
Accept-Encoding, Origin
report-to
{"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="youtube"
expires
Thu, 25 May 2023 16:04:20 GMT
_dR6-cQdUOWBmJLukezzayRozGrIW7pPDuH4VC_rm7g.js
www.google.com/js/th/ Frame 0B8E
35 KB
14 KB
Script
General
Full URL
https://www.google.com/js/th/_dR6-cQdUOWBmJLukezzayRozGrIW7pPDuH4VC_rm7g.js
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/s/player/d1783cbe/player_ias.vflset/de_DE/base.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
fdd47af9c41d50e5819892ee91ecf36b2468cc6ac85bba4f0ee1f8542feb9bb8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.youtube.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Thu, 26 May 2022 12:21:48 GMT
content-encoding
br
x-content-type-options
nosniff
age
36640
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
13552
x-xss-protection
0
last-modified
Tue, 17 May 2022 14:00:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="botguard-scs"
vary
Accept-Encoding
report-to
{"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Fri, 26 May 2023 12:21:48 GMT
embed.js
www.youtube.com/s/player/d1783cbe/player_ias.vflset/de_DE/ Frame 0B8E
27 KB
8 KB
Script
General
Full URL
https://www.youtube.com/s/player/d1783cbe/player_ias.vflset/de_DE/embed.js
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/s/player/d1783cbe/player_ias.vflset/de_DE/base.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
eb1023bea6522f4625d8873a27b30d42cea04e431fad965ff6704edf98bbd771
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.youtube.com/embed/--6PiuvBGAU
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Wed, 25 May 2022 16:02:51 GMT
content-encoding
br
x-content-type-options
nosniff
age
109777
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
8040
x-xss-protection
0
last-modified
Wed, 25 May 2022 00:16:59 GMT
server
sffe
vary
Accept-Encoding, Origin
report-to
{"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="youtube"
expires
Thu, 25 May 2023 16:02:51 GMT
visitWebPage
136-utj-516.mktoresp.com/webevents/
2 B
311 B
Ping
General
Full URL
https://136-utj-516.mktoresp.com/webevents/visitWebPage?_mchNc=1653604348488&_mchCn=&_mchId=136-UTJ-516&_mchTk=_mch-bishopfox.com-1653604348488-54652&_mchHo=bishopfox.com&_mchPo=&_mchRu=%2Fblog%2Fcve-2019-18935-remote-code-execution-in-telerik-ui&_mchPc=https%3A&_mchVr=161&_mchEcid=&_mchHa=&_mchRe=&_mchQp=
Requested by
Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/161/munchkin.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.28.147.68 , United States, ASN15224 (OMNITURE, US),
Reverse DNS
Software
nginx /
Resource Hash
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date
Thu, 26 May 2022 22:32:29 GMT
Content-Encoding
gzip
Server
nginx
Transfer-Encoding
chunked
Content-Type
text/plain; charset=UTF-8
Access-Control-Allow-Origin
*
Connection
keep-alive
X-Request-Id
d48af855-f073-4326-9dfb-3b4ed028e825
truncated
/ Frame 0B8E
175 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
67ea46bc3d15351067faccb3613bd833dd3f15137a4b4a09f2e873fd41d024d2

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Content-Type
image/png
AKedOLTnNTrlvH5lxMBnziStuFcUPvuj94BWnqOw3CIM=s68-c-k-c0x00ffffff-no-rj
yt3.ggpht.com/ytc/ Frame 0B8E
6 KB
6 KB
Image
General
Full URL
https://yt3.ggpht.com/ytc/AKedOLTnNTrlvH5lxMBnziStuFcUPvuj94BWnqOw3CIM=s68-c-k-c0x00ffffff-no-rj
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/embed/--6PiuvBGAU
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
fife /
Resource Hash
9c1162a622bc982328d9c7d2768c7c90116b2002fc8d5823ff4f06bf309f18c1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.youtube.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Thu, 26 May 2022 19:46:37 GMT
x-content-type-options
nosniff
age
9951
content-disposition
inline;filename="unnamed.jpg"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
5921
x-xss-protection
0
server
fife
etag
"v9"
vary
Origin
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Content-Length
cache-control
public, max-age=86400, no-transform
timing-allow-origin
*
expires
Sun, 08 May 2022 14:40:59 GMT
sddefault.webp
i.ytimg.com/vi_webp/--6PiuvBGAU/ Frame 0B8E
9 KB
9 KB
Image
General
Full URL
https://i.ytimg.com/vi_webp/--6PiuvBGAU/sddefault.webp
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/embed/--6PiuvBGAU
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:813::2016 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
1943f3b04a44d0c87b27581e293ae88f0550384fdedb54719cd3959251b39cac
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.youtube.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Thu, 26 May 2022 22:32:28 GMT
x-content-type-options
nosniff
age
0
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
8740
x-xss-protection
0
server
sffe
etag
"0"
vary
Origin
report-to
{"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type
image/webp
cache-control
public, max-age=7200
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="youtube"
expires
Fri, 27 May 2022 00:32:28 GMT
truncated
/
212 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
5ca272b5c51f5790821b50ebfb5f2868f20230a839431baf92f45bfff38861ea

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Content-Type
image/svg+xml;charset=utf-8
1632347706836.png
storage.googleapis.com/code.snapengage.com/cd/4828764552101888/
4 KB
4 KB
Image
General
Full URL
https://storage.googleapis.com/code.snapengage.com/cd/4828764552101888/1632347706836.png
Requested by
Host: bishopfox.com
URL: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::2010 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
UploadServer /
Resource Hash
058f6a953b55bae14a0440a4191b38f91a391724ea022353a4c1d9afcffaf3c2

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Thu, 26 May 2022 21:35:53 GMT
age
3395
x-guploader-uploadid
ADPycdtz-ECQa5JY5EUpnv2PUUF8-A9yZUviLLgB4uH5ahqmPT1oNP9GbRaw3NvrkBwQ0xstRcrZ949ROlu7P7pAdSPMng
x-goog-storage-class
STANDARD
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
4188
last-modified
Wed, 22 Sep 2021 21:55:07 GMT
server
UploadServer
etag
"66ca79fecd19b0ba4e822f81178ffa42"
x-goog-hash
crc32c=Wc43QQ==, md5=Zsp5/s0ZsLpOgi+BF4/6Qg==
x-goog-generation
1632347706994198
cache-control
public, max-age=31536000, no-transform
x-goog-stored-content-length
4188
accept-ranges
bytes
content-type
image/png
expires
Fri, 26 May 2023 21:35:53 GMT
1632347706836.png
storage.googleapis.com/code.snapengage.com/cd/4828764552101888/ Frame A22E
4 KB
4 KB
Image
General
Full URL
https://storage.googleapis.com/code.snapengage.com/cd/4828764552101888/1632347706836.png
Requested by
Host: bishopfox.com
URL: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::2010 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
UploadServer /
Resource Hash
058f6a953b55bae14a0440a4191b38f91a391724ea022353a4c1d9afcffaf3c2

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Thu, 26 May 2022 21:35:53 GMT
age
3395
x-guploader-uploadid
ADPycdtz-ECQa5JY5EUpnv2PUUF8-A9yZUviLLgB4uH5ahqmPT1oNP9GbRaw3NvrkBwQ0xstRcrZ949ROlu7P7pAdSPMng
x-goog-storage-class
STANDARD
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
4188
last-modified
Wed, 22 Sep 2021 21:55:07 GMT
server
UploadServer
etag
"66ca79fecd19b0ba4e822f81178ffa42"
x-goog-hash
crc32c=Wc43QQ==, md5=Zsp5/s0ZsLpOgi+BF4/6Qg==
x-goog-generation
1632347706994198
cache-control
public, max-age=31536000, no-transform
x-goog-stored-content-length
4188
accept-ranges
bytes
content-type
image/png
expires
Fri, 26 May 2023 21:35:53 GMT
getForm
go.bishopfox.com/index.php/form/
16 KB
4 KB
Script
General
Full URL
https://go.bishopfox.com/index.php/form/getForm?munchkinId=136-UTJ-516&form=1049&url=https%3A%2F%2Fbishopfox.com%2Fblog%2Fcve-2019-18935-remote-code-execution-in-telerik-ui&callback=jQuery11240878629650311785_1653604348509&_=1653604348510
Requested by
Host: go.bishopfox.com
URL: https://go.bishopfox.com/js/forms2/js/forms2.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.73.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2ffe4f7b01fda1d0d2b4be0e978ac397dc779570a71e70a5815e6d2d4eb6d02d

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Thu, 26 May 2022 22:32:28 GMT
content-encoding
gzip
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
cf-ray
7119f78b2c949b34-FRA
cached
true
bg-bf-logo@2x.png
bishopfox.com/static/assets/images/backgrounds/
14 KB
15 KB
Image
General
Full URL
https://bishopfox.com/static/assets/images/backgrounds/bg-bf-logo@2x.png
Requested by
Host: bishopfox.com
URL: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::6818:362 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5ec6f5a71a8fd9ffeaca919d9122324ded0d517837216256e312a7d47e46076e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Thu, 26 May 2022 22:32:28 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
1732
cf-polished
origSize=69012
content-length
14788
x-xss-protection
1; mode=block
last-modified
Tue, 17 May 2022 17:09:29 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
"6283d6c9-10d94"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dAeaE%2Fb8mooRtzASeUhL4%2FM3Qt5VrqZ8B5x4XER0u4CgtFaUhx1uiDCZYlt%2BvjRleHlqKazGI5lFHbmSCvKTGxzRziYzmM9xJU%2FNlth1zAnOniZ8edGlbwWODYON7fNoK%2FAgc3YyXH9tWSE%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
7119f78b38e29128-FRA
cf-bgj
imgq:85,h2pri
ga-audiences
www.google.com/ads/
42 B
63 B
Image
General
Full URL
https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-41346121-1&cid=962519027.1653604348&jid=1821733319&_u=aADAAEAAQAAAAC~&z=347028984
Requested by
Host: bishopfox.com
URL: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82a::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 26 May 2022 22:32:28 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.de/ads/
42 B
501 B
Image
General
Full URL
https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-41346121-1&cid=962519027.1653604348&jid=1821733319&_u=aADAAEAAQAAAAC~&z=347028984
Requested by
Host: bishopfox.com
URL: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 26 May 2022 22:32:28 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ServiceGetConfig
www.snapengage.com/chatjs/
159 B
340 B
Script
General
Full URL
https://www.snapengage.com/chatjs/ServiceGetConfig?w=f3f28b6e-d72e-4019-b593-e66b82625b0c
Requested by
Host: storage.googleapis.com
URL: https://storage.googleapis.com/code.snapengage.com/js/f3f28b6e-d72e-4019-b593-e66b82625b0c.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:802::2013 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Frontend /
Resource Hash
47eb859ff311128018b9863f90260b0bfbd573d3b31dd53af967f5a0cce49cbb
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

pragma
Public
strict-transport-security
max-age=31536000; includeSubDomains
content-encoding
gzip
server
Google Frontend
date
Thu, 26 May 2022 22:32:29 GMT
vary
Accept-Encoding
content-type
text/javascript; charset=utf-8
x-cloud-trace-context
7c985896cc3b6a573425df65742848d9
cache-control
public, max-age=30
content-length
126
cast_sender.js
www.gstatic.com/cv/js/sender/v1/ Frame 0B8E
0
0

--6PiuvBGAU
www.youtube.com/embed/ Frame 0B8E
63 KB
26 KB
Document
General
Full URL
https://www.youtube.com/embed/--6PiuvBGAU?enablejsapi=1&origin=https%3A%2F%2Fbishopfox.com
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NSTVGF3
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
cf59c87af37b168b6d28ed1ca844864144ef1936aebd210aa4837e64aa451a60
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
no-cache, no-store, max-age=0, must-revalidate
content-encoding
br
content-type
text/html; charset=utf-8
critical-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy-report-only
same-origin; report-to="youtube_main"
date
Thu, 26 May 2022 22:32:29 GMT
expires
Mon, 01 Jan 1990 00:00:00 GMT
p3p
CP="This is not a P3P policy! See g.co/p3phelp for more info."
permissions-policy
ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-platform=*, ch-ua-platform-version=*
pragma
no-cache
report-to
{"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]}
server
ESF
strict-transport-security
max-age=31536000
vary
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-content-type-options
nosniff
x-xss-protection
0
log_event
www.youtube.com/youtubei/v1/ Frame 0B8E
28 B
54 B
XHR
General
Full URL
https://www.youtube.com/youtubei/v1/log_event?alt=json&key=AIzaSyAO_FJ2SlqU8Q4STEHLGCilw_Y9_11qcW8
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/s/player/d1783cbe/www-embed-player.vflset/www-embed-player.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
scaffolding on HTTPServer2 /
Resource Hash
d7d5e54ad1e33d7ab49c664323ced79cb9723ff15e9764cd0edc3e15208e8336
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
Content-Type
application/json
X-YouTube-Utc-Offset
0
X-YouTube-Client-Name
56
Referer
https://www.youtube.com/embed/--6PiuvBGAU
X-YouTube-Client-Version
1.20220524.01.00
X-YouTube-Time-Zone
Etc/Unknown
X-Goog-Visitor-Id
CgtOdVplZEJBSklrVSj8_7-UBg%3D%3D
X-YouTube-Ad-Signals
dt=1653604348283&flash=0&frm=2&u_tz&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&bc=31&bih=-12245933&biw=-12245933&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C560%2C315&vis=1&wgl=true&ca_type=image

Response headers

date
Thu, 26 May 2022 22:32:28 GMT
content-encoding
br
x-content-type-options
nosniff
server
scaffolding on HTTPServer2
x-frame-options
SAMEORIGIN
vary
Origin, X-Origin, Referer
p3p
CP="This is not a P3P policy! See g.co/p3phelp for more info."
cache-control
private
content-type
application/json; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
31
x-xss-protection
0
expires
Thu, 26 May 2022 22:32:28 GMT
iframe_api
www.youtube.com/
980 B
515 B
Script
General
Full URL
https://www.youtube.com/iframe_api
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NSTVGF3
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
03126a706c3fc7cbe8ef2bb68e658476ee22ca0df3d1545849b531c9d55b861d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Thu, 26 May 2022 22:32:28 GMT
content-encoding
br
x-content-type-options
nosniff
p3p
CP="This is not a P3P policy! See g.co/p3phelp for more info."
critical-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
server
ESF
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=31536000
report-to
{"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]}
content-type
text/javascript; charset=utf-8
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
vary
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cache-control
private, max-age=0
permissions-policy
ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-platform=*, ch-ua-platform-version=*
cross-origin-opener-policy-report-only
same-origin; report-to="youtube_main"
expires
Thu, 26 May 2022 22:32:28 GMT
dtp-1.0.4.html
go.bishopfox.com/ Frame BE92
2 KB
940 B
Document
General
Full URL
https://go.bishopfox.com/dtp-1.0.4.html
Requested by
Host: go.bishopfox.com
URL: https://go.bishopfox.com/rs/136-UTJ-516/images/simpledto-1.0.4.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.73.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1a3d43e5d83b4956e9fb87e21b9851fb4f87bca59e71e8d8644a3a154ef16b83
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cf-cache-status
DYNAMIC
cf-ray
7119f78d2fc09b34-FRA
content-encoding
gzip
content-type
text/html; charset=utf-8
date
Thu, 26 May 2022 22:32:29 GMT
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
p3p
CP="CAO CURa ADMa DEVa TAIa OUR IND UNI COM NAV INT"
server
cloudflare
vary
*,Accept-Encoding
x-asset-type
LP
x-content-type-options
nosniff
forms2.css
go.bishopfox.com/js/forms2/css/
13 KB
3 KB
Stylesheet
General
Full URL
https://go.bishopfox.com/js/forms2/css/forms2.css
Requested by
Host: go.bishopfox.com
URL: https://go.bishopfox.com/js/forms2/js/forms2.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.73.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
256e42104f48a5fa80b031da12dc56acde224fba3f9810f8f8192b39136d365a
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Thu, 26 May 2022 22:32:29 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
4081
content-length
2623
last-modified
Tue, 03 May 2022 03:46:42 GMT
server
cloudflare
etag
"1100393-3437-5de135b5b2c80"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/css
cache-control
public, max-age=14400
accept-ranges
bytes
cf-ray
7119f78d2fc79b34-FRA
expires
Fri, 27 May 2022 02:32:28 GMT
forms2-theme-plain.css
go.bishopfox.com/js/forms2/css/
828 B
343 B
Stylesheet
General
Full URL
https://go.bishopfox.com/js/forms2/css/forms2-theme-plain.css
Requested by
Host: go.bishopfox.com
URL: https://go.bishopfox.com/js/forms2/js/forms2.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.73.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
57cd46adbabd6c40823602b4513aecbe89320a769572255272abe9f008de69fa
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Thu, 26 May 2022 22:32:28 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
4081
content-length
246
last-modified
Tue, 03 May 2022 03:46:42 GMT
server
cloudflare
etag
"1100394-33c-5de135b5b2c80"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/css
cache-control
public, max-age=14400
accept-ranges
bytes
cf-ray
7119f78d2fca9b34-FRA
expires
Fri, 27 May 2022 02:32:28 GMT
generate_204
www.youtube.com/ Frame 0B8E
0
0

atr
www.youtube.com/api/stats/ Frame 0B8E
0
0

log_event
www.youtube.com/youtubei/v1/ Frame 0B8E
0
0

www-widgetapi.js
www.youtube.com/s/player/d1783cbe/www-widgetapi.vflset/
157 KB
51 KB
Script
General
Full URL
https://www.youtube.com/s/player/d1783cbe/www-widgetapi.vflset/www-widgetapi.js
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/iframe_api
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
8698ba03b14103a8e66501c032a0e72a36c643539ad1b35671a4b3b2368868f6
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Thu, 26 May 2022 19:28:25 GMT
content-encoding
br
x-content-type-options
nosniff
age
11044
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
52188
x-xss-protection
0
last-modified
Wed, 25 May 2022 00:16:59 GMT
server
sffe
vary
Accept-Encoding, Origin
report-to
{"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="youtube"
expires
Fri, 26 May 2023 19:28:25 GMT
www-player.css
www.youtube.com/s/player/d1783cbe/ Frame 0B8E
336 KB
46 KB
Stylesheet
General
Full URL
https://www.youtube.com/s/player/d1783cbe/www-player.css
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/embed/--6PiuvBGAU?enablejsapi=1&origin=https%3A%2F%2Fbishopfox.com
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
ff7cec7fbbb44902cb946b2d77bb28bfdfeb69d5c61837fe68c6b066281a9bc5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.youtube.com/embed/--6PiuvBGAU?enablejsapi=1&origin=https%3A%2F%2Fbishopfox.com
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Wed, 25 May 2022 16:02:49 GMT
content-encoding
br
x-content-type-options
nosniff
age
109780
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
47343
x-xss-protection
0
last-modified
Wed, 25 May 2022 00:16:59 GMT
server
sffe
vary
Accept-Encoding, Origin
report-to
{"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type
text/css
cache-control
public, max-age=31536000
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="youtube"
expires
Thu, 25 May 2023 16:02:49 GMT
www-embed-player.js
www.youtube.com/s/player/d1783cbe/www-embed-player.vflset/ Frame 0B8E
284 KB
87 KB
Script
General
Full URL
https://www.youtube.com/s/player/d1783cbe/www-embed-player.vflset/www-embed-player.js
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/embed/--6PiuvBGAU?enablejsapi=1&origin=https%3A%2F%2Fbishopfox.com
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
6759eeea4a3e0dcc6883305b25d7aac20cb725231a29701e41340d6fa7b3410a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.youtube.com/embed/--6PiuvBGAU?enablejsapi=1&origin=https%3A%2F%2Fbishopfox.com
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Wed, 25 May 2022 16:02:49 GMT
content-encoding
br
x-content-type-options
nosniff
age
109780
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
89344
x-xss-protection
0
last-modified
Wed, 25 May 2022 00:16:59 GMT
server
sffe
vary
Accept-Encoding, Origin
report-to
{"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="youtube"
expires
Thu, 25 May 2023 16:02:49 GMT
base.js
www.youtube.com/s/player/d1783cbe/player_ias.vflset/de_DE/ Frame 0B8E
2 MB
530 KB
Script
General
Full URL
https://www.youtube.com/s/player/d1783cbe/player_ias.vflset/de_DE/base.js
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/embed/--6PiuvBGAU?enablejsapi=1&origin=https%3A%2F%2Fbishopfox.com
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
10ba2921da7a426d858ab48706a1562f80a8c96c63ebd60a27c39c2c0817355e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.youtube.com/embed/--6PiuvBGAU?enablejsapi=1&origin=https%3A%2F%2Fbishopfox.com
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Wed, 25 May 2022 16:02:49 GMT
content-encoding
br
x-content-type-options
nosniff
age
109780
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
542859
x-xss-protection
0
last-modified
Wed, 25 May 2022 00:16:59 GMT
server
sffe
vary
Accept-Encoding, Origin
report-to
{"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="youtube"
expires
Thu, 25 May 2023 16:02:49 GMT
fetch-polyfill.js
www.youtube.com/s/player/d1783cbe/fetch-polyfill.vflset/ Frame 0B8E
9 KB
3 KB
Script
General
Full URL
https://www.youtube.com/s/player/d1783cbe/fetch-polyfill.vflset/fetch-polyfill.js
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/embed/--6PiuvBGAU?enablejsapi=1&origin=https%3A%2F%2Fbishopfox.com
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
498b3f2a0357fbd50a80eb18b23ab4b461b791d640e5560b799f08ed960748a9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.youtube.com/embed/--6PiuvBGAU?enablejsapi=1&origin=https%3A%2F%2Fbishopfox.com
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Wed, 25 May 2022 16:02:49 GMT
content-encoding
br
x-content-type-options
nosniff
age
109780
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2786
x-xss-protection
0
last-modified
Wed, 25 May 2022 00:16:59 GMT
server
sffe
vary
Accept-Encoding, Origin
report-to
{"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="youtube"
expires
Thu, 25 May 2023 16:02:49 GMT
KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v18/ Frame 0B8E
15 KB
15 KB
Font
General
Full URL
https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/embed/--6PiuvBGAU?enablejsapi=1&origin=https%3A%2F%2Fbishopfox.com
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.youtube.com/
Origin
https://www.youtube.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Tue, 24 May 2022 11:18:05 GMT
x-content-type-options
nosniff
age
213264
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15344
x-xss-protection
0
last-modified
Mon, 16 Oct 2017 17:32:55 GMT
server
sffe
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="apps-themes"
expires
Wed, 24 May 2023 11:18:05 GMT
XDFrame
go.bishopfox.com/index.php/form/ Frame 7CBA
2 KB
867 B
Document
General
Full URL
https://go.bishopfox.com/index.php/form/XDFrame
Requested by
Host: go.bishopfox.com
URL: https://go.bishopfox.com/js/forms2/js/forms2.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.73.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c2c76750672f1668a3df60c8aff4a8276b3bd847914543ca5a32a7751e67aa76
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cache-control
max-age=3600
cf-cache-status
DYNAMIC
cf-ray
7119f78e293a9b34-FRA
content-encoding
gzip
content-type
text/html; charset=utf-8
date
Thu, 26 May 2022 22:32:29 GMT
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
vary
Accept-Encoding
x-content-type-options
nosniff
collect
www.google-analytics.com/
35 B
55 B
Image
General
Full URL
https://www.google-analytics.com/collect?v=1&_v=j96&a=1091109963&t=event&ni=0&_s=1&dl=https%3A%2F%2Fbishopfox.com%2Fblog%2Fcve-2019-18935-remote-code-execution-in-telerik-ui&ul=en-us&de=UTF-8&dt=CVE-2019-18935%3A%20Remote%20Code%20Execution%20via%20Insecure%E2%80%A6%20%7C%20Bishop%20Fox&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Forms&ea=Form%20View&el=Form%20ID%20-%201049&_u=aADAAEABQAAAAC~&jid=&gjid=&cid=962519027.1653604348&tid=UA-41346121-1&_gid=1997830729.1653604348&gtm=2wg5p1NSTVGF3&cd1=2022-05-26T22%3A32%3A29.123%2B00%3A00&cd2=962519027.1653604348&z=1491829498
Requested by
Host: bishopfox.com
URL: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 26 May 2022 01:24:30 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
76079
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
id
googleads.g.doubleclick.net/pagead/ Frame 0B8E
Redirect Chain
  • https://googleads.g.doubleclick.net/pagead/id
  • https://googleads.g.doubleclick.net/pagead/id?slf_rd=1
100 B
146 B
XHR
General
Full URL
https://googleads.g.doubleclick.net/pagead/id?slf_rd=1
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/embed/--6PiuvBGAU?enablejsapi=1&origin=https%3A%2F%2Fbishopfox.com
Protocol
H3
Server
2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
b612ef883fc8f1392eedf7eafc6f1e068f09a22d1b2dc7244c719ecb6acdee81
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.youtube.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Thu, 26 May 2022 22:32:29 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
120
x-xss-protection
0
pragma
no-cache
server
cafe
content-type
application/json; charset=UTF-8
access-control-allow-origin
https://www.youtube.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date
Thu, 26 May 2022 22:32:29 GMT
x-content-type-options
nosniff
access-control-allow-origin
https://www.youtube.com
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
pragma
no-cache
server
cafe
content-type
text/html; charset=UTF-8
location
https://googleads.g.doubleclick.net/pagead/id?slf_rd=1
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
ad_status.js
static.doubleclick.net/instream/ Frame 0B8E
29 B
54 B
Script
General
Full URL
https://static.doubleclick.net/instream/ad_status.js
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/s/player/d1783cbe/www-embed-player.vflset/www-embed-player.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
eed0dc1fdb5d97ed188ae16fd5e1024a5bb744af47340346be2146300a6c54b9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.youtube.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Thu, 26 May 2022 22:24:57 GMT
x-content-type-options
nosniff
age
452
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
29
x-xss-protection
0
last-modified
Thu, 12 Dec 2013 23:40:16 GMT
server
sffe
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=900
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Thu, 26 May 2022 22:39:57 GMT
forms2.min.js
go.bishopfox.com/js/forms2/js/ Frame 7CBA
205 KB
68 KB
Script
General
Full URL
https://go.bishopfox.com/js/forms2/js/forms2.min.js
Requested by
Host: go.bishopfox.com
URL: https://go.bishopfox.com/index.php/form/XDFrame
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.73.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
54b1a318711ed45da6f1a787a0b0f601199c8676b7d565a4163674833c64b0a0
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://go.bishopfox.com/index.php/form/XDFrame
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Thu, 26 May 2022 22:32:29 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
last-modified
Tue, 03 May 2022 03:46:42 GMT
server
cloudflare
age
4084
etag
"11003a3-3326e-5de135b5b2c80"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
public, max-age=14400
cf-ray
7119f78f9c409b34-FRA
expires
Fri, 27 May 2022 02:32:29 GMT
Create
jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/ Frame
0
0
Preflight
General
Full URL
https://jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/Create
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type,x-goog-api-key,x-user-agent
Access-Control-Request-Method
POST
Origin
https://www.youtube.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
content-type,x-goog-api-key,x-user-agent
access-control-allow-methods
DELETE,GET,HEAD,OPTIONS,PATCH,POST,PUT
access-control-allow-origin
https://www.youtube.com
access-control-max-age
3600
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
content-type
text/html
date
Thu, 26 May 2022 22:32:29 GMT
server
ESF
vary
origin referer x-origin
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-xss-protection
0
Create
jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/ Frame 0B8E
62 KB
29 KB
XHR
General
Full URL
https://jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/Create
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/s/player/d1783cbe/player_ias.vflset/de_DE/base.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
ffe7470ed93fb95f4a6edfa31438aa481e72a4540aaa59c7785ea238f3f96e80
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

X-User-Agent
grpc-web-javascript/0.1
Referer
https://www.youtube.com/
X-Goog-Api-Key
AIzaSyDyT5W0Jh49F30Pqqtyfdf7pDLFKLJoAnw
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
Content-Type
application/json+protobuf

Response headers

date
Thu, 26 May 2022 22:32:29 GMT
content-encoding
gzip
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
server
ESF
x-frame-options
SAMEORIGIN
content-type
application/json+protobuf; charset=UTF-8
access-control-allow-origin
https://www.youtube.com
access-control-expose-headers
vary,vary,vary,content-encoding,date,server,content-length
cache-control
private
access-control-allow-credentials
true
vary
Origin, X-Origin, Referer
content-length
29471
x-xss-protection
0
remote.js
www.youtube.com/s/player/d1783cbe/player_ias.vflset/de_DE/ Frame 0B8E
119 KB
37 KB
Script
General
Full URL
https://www.youtube.com/s/player/d1783cbe/player_ias.vflset/de_DE/remote.js
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/s/player/d1783cbe/player_ias.vflset/de_DE/base.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
de8571efbf0aea75892c4aca0fe97881568ca123b8de9a1f94ccd2d5d274c024
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.youtube.com/embed/--6PiuvBGAU?enablejsapi=1&origin=https%3A%2F%2Fbishopfox.com
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Wed, 25 May 2022 16:04:20 GMT
content-encoding
br
x-content-type-options
nosniff
age
109689
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
37816
x-xss-protection
0
last-modified
Wed, 25 May 2022 00:16:59 GMT
server
sffe
vary
Accept-Encoding, Origin
report-to
{"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="youtube"
expires
Thu, 25 May 2023 16:04:20 GMT
_dR6-cQdUOWBmJLukezzayRozGrIW7pPDuH4VC_rm7g.js
www.google.com/js/th/ Frame 0B8E
35 KB
13 KB
Script
General
Full URL
https://www.google.com/js/th/_dR6-cQdUOWBmJLukezzayRozGrIW7pPDuH4VC_rm7g.js
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/s/player/d1783cbe/player_ias.vflset/de_DE/base.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82a::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
fdd47af9c41d50e5819892ee91ecf36b2468cc6ac85bba4f0ee1f8542feb9bb8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.youtube.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Thu, 26 May 2022 12:21:48 GMT
content-encoding
br
x-content-type-options
nosniff
age
36641
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
13552
x-xss-protection
0
last-modified
Tue, 17 May 2022 14:00:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="botguard-scs"
vary
Accept-Encoding
report-to
{"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Fri, 26 May 2023 12:21:48 GMT
embed.js
www.youtube.com/s/player/d1783cbe/player_ias.vflset/de_DE/ Frame 0B8E
27 KB
8 KB
Script
General
Full URL
https://www.youtube.com/s/player/d1783cbe/player_ias.vflset/de_DE/embed.js
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/s/player/d1783cbe/player_ias.vflset/de_DE/base.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
eb1023bea6522f4625d8873a27b30d42cea04e431fad965ff6704edf98bbd771
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.youtube.com/embed/--6PiuvBGAU?enablejsapi=1&origin=https%3A%2F%2Fbishopfox.com
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Wed, 25 May 2022 16:02:51 GMT
content-encoding
br
x-content-type-options
nosniff
age
109778
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
8040
x-xss-protection
0
last-modified
Wed, 25 May 2022 00:16:59 GMT
server
sffe
vary
Accept-Encoding, Origin
report-to
{"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="youtube"
expires
Thu, 25 May 2023 16:02:51 GMT
truncated
/ Frame 0B8E
175 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
67ea46bc3d15351067faccb3613bd833dd3f15137a4b4a09f2e873fd41d024d2

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Content-Type
image/png
AKedOLTnNTrlvH5lxMBnziStuFcUPvuj94BWnqOw3CIM=s68-c-k-c0x00ffffff-no-rj
yt3.ggpht.com/ytc/ Frame 0B8E
6 KB
6 KB
Image
General
Full URL
https://yt3.ggpht.com/ytc/AKedOLTnNTrlvH5lxMBnziStuFcUPvuj94BWnqOw3CIM=s68-c-k-c0x00ffffff-no-rj
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/embed/--6PiuvBGAU?enablejsapi=1&origin=https%3A%2F%2Fbishopfox.com
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
fife /
Resource Hash
9c1162a622bc982328d9c7d2768c7c90116b2002fc8d5823ff4f06bf309f18c1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.youtube.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Thu, 26 May 2022 19:46:37 GMT
x-content-type-options
nosniff
age
9952
content-disposition
inline;filename="unnamed.jpg"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
5921
x-xss-protection
0
server
fife
etag
"v9"
vary
Origin
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Content-Length
cache-control
public, max-age=86400, no-transform
timing-allow-origin
*
expires
Sun, 08 May 2022 14:40:59 GMT
sddefault.webp
i.ytimg.com/vi_webp/--6PiuvBGAU/ Frame 0B8E
9 KB
9 KB
Image
General
Full URL
https://i.ytimg.com/vi_webp/--6PiuvBGAU/sddefault.webp
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/embed/--6PiuvBGAU?enablejsapi=1&origin=https%3A%2F%2Fbishopfox.com
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2016 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
1943f3b04a44d0c87b27581e293ae88f0550384fdedb54719cd3959251b39cac
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.youtube.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Thu, 26 May 2022 22:32:28 GMT
x-content-type-options
nosniff
age
1
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
8740
x-xss-protection
0
server
sffe
etag
"0"
vary
Origin
report-to
{"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type
image/webp
cache-control
public, max-age=7200
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="youtube"
expires
Fri, 27 May 2022 00:32:28 GMT
generate_204
www.youtube.com/ Frame 0B8E
0
9 B
Image
General
Full URL
https://www.youtube.com/generate_204?faFL2w
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/embed/--6PiuvBGAU?enablejsapi=1&origin=https%3A%2F%2Fbishopfox.com
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.youtube.com/embed/--6PiuvBGAU?enablejsapi=1&origin=https%3A%2F%2Fbishopfox.com
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Thu, 26 May 2022 22:32:29 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
cast_sender.js
www.gstatic.com/cv/js/sender/v1/ Frame 0B8E
4 KB
2 KB
Script
General
Full URL
https://www.gstatic.com/cv/js/sender/v1/cast_sender.js
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/s/player/d1783cbe/player_ias.vflset/de_DE/base.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
ee147e859ad0f09aa50367974e38ab53e7c7054c4a51d400a7f45b0eb251454f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.youtube.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Thu, 26 May 2022 22:32:29 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cloudview
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2007
x-xss-protection
0
last-modified
Tue, 16 Feb 2021 23:57:06 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="cloudview"
vary
Accept-Encoding
report-to
{"group":"cloudview","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cloudview"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
expires
Thu, 26 May 2022 22:32:29 GMT
GenerateIT
jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/ Frame 0B8E
98 B
142 B
XHR
General
Full URL
https://jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/GenerateIT
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/s/player/d1783cbe/player_ias.vflset/de_DE/base.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
2169dd3f2e3031452c431f1dc33ee48b8577b0cb6925096ef14fca54c81bd70b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

X-User-Agent
grpc-web-javascript/0.1
Referer
https://www.youtube.com/
X-Goog-Api-Key
AIzaSyDyT5W0Jh49F30Pqqtyfdf7pDLFKLJoAnw
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
Content-Type
application/json+protobuf

Response headers

date
Thu, 26 May 2022 22:32:29 GMT
content-encoding
gzip
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
server
ESF
x-frame-options
SAMEORIGIN
content-type
application/json+protobuf; charset=UTF-8
access-control-allow-origin
https://www.youtube.com
access-control-expose-headers
vary,vary,vary,content-encoding,date,server,content-length
cache-control
private
access-control-allow-credentials
true
vary
Origin, X-Origin, Referer
content-length
118
x-xss-protection
0
GenerateIT
jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/ Frame
0
0
Preflight
General
Full URL
https://jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/GenerateIT
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type,x-goog-api-key,x-user-agent
Access-Control-Request-Method
POST
Origin
https://www.youtube.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
content-type,x-goog-api-key,x-user-agent
access-control-allow-methods
DELETE,GET,HEAD,OPTIONS,PATCH,POST,PUT
access-control-allow-origin
https://www.youtube.com
access-control-max-age
3600
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
content-type
text/html
date
Thu, 26 May 2022 22:32:29 GMT
server
ESF
vary
origin referer x-origin
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-xss-protection
0
cast_sender.js
www.gstatic.com/eureka/clank/102/ Frame 0B8E
52 KB
15 KB
Script
General
Full URL
https://www.gstatic.com/eureka/clank/102/cast_sender.js
Requested by
Host: www.gstatic.com
URL: https://www.gstatic.com/cv/js/sender/v1/cast_sender.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
c0bc3be07587388188143cb937f57c41c1921c60d0ad0c1a278c9099b6fc26a6
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.youtube.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Thu, 26 May 2022 19:11:07 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
12082
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cloudview-release
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15092
x-xss-protection
0
last-modified
Mon, 04 Apr 2022 15:13:55 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="cloudview-release"
vary
Accept-Encoding
report-to
{"group":"cloudview-release","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cloudview-release"}]}
content-type
text/javascript
cache-control
public, max-age=86400
accept-ranges
bytes
expires
Fri, 27 May 2022 19:11:07 GMT
simpledto-1.0.4.js
go.bishopfox.com/rs/136-UTJ-516/images/ Frame BE92
2 KB
1 KB
Script
General
Full URL
https://go.bishopfox.com/rs/136-UTJ-516/images/simpledto-1.0.4.js
Requested by
Host: go.bishopfox.com
URL: https://go.bishopfox.com/dtp-1.0.4.html
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.73.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e0ea4dbd2c85145cacf92362ae72dc6d56be63d1a68f0d492f55699959874940
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://go.bishopfox.com/dtp-1.0.4.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Thu, 26 May 2022 22:32:29 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
1
content-length
1092
last-modified
Sat, 07 May 2022 02:00:31 GMT
server
cloudflare
etag
"1180407-8b5-5de625702a7fc"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
public, max-age=60
accept-ranges
bytes
cf-ray
7119f79288eb9b34-FRA
expires
Thu, 26 May 2022 22:33:29 GMT
stripmkttok.js
go.bishopfox.com/js/ Frame BE92
2 KB
821 B
Script
General
Full URL
https://go.bishopfox.com/js/stripmkttok.js
Requested by
Host: go.bishopfox.com
URL: https://go.bishopfox.com/dtp-1.0.4.html
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.73.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f7545b96ed2740220c349ae9deb614faf1f0f211d4cf710788e0790f74cc9715
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://go.bishopfox.com/dtp-1.0.4.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Thu, 26 May 2022 22:32:30 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
REVALIDATED
last-modified
Tue, 03 May 2022 03:46:42 GMT
server
cloudflare
etag
"1100d46-602-5de135b5b2c80"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
public, max-age=14400
accept-ranges
bytes
cf-ray
7119f79298ee9b34-FRA
content-length
678
expires
Fri, 27 May 2022 02:32:30 GMT
getuidj
secure.adnxs.com/
11 B
697 B
XHR
General
Full URL
https://secure.adnxs.com/getuidj
Requested by
Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
37.252.172.36 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),
Reverse DNS
692.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 26 May 2022 22:32:30 GMT
X-Proxy-Origin
80.255.7.108; 80.255.7.108; 692.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid
e4b8b096-9456-4a8b-b579-9550f6e09420
Server
nginx/1.21.3
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://bishopfox.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json; charset=utf-8
Content-Length
11
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
/
c.6sc.co/
47 B
369 B
XHR
General
Full URL
https://c.6sc.co/
Requested by
Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.92.74.202 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-92-74-202.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
86e8e73a99440d460522bee20867bf0f60a5343860f67ae9b0137c0966ae640c

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date
Thu, 26 May 2022 22:32:30 GMT
Access-Control-Max-Age
86400
Access-Control-Allow-Methods
GET,POST
Content-Type
text/plain
Access-Control-Allow-Origin
https://bishopfox.com
Access-Control-Allow-Credentials
true
Connection
keep-alive
Access-Control-Allow-Headers
*
Content-Length
47
/
ipv6.6sc.co/
19 B
251 B
XHR
General
Full URL
https://ipv6.6sc.co/
Requested by
Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:6c00:296::1c91 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
d5792801335f11b32a948d51b64bb655b16f8767f5837f2be4c406715994752f

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 26 May 2022 22:32:30 GMT
vary
Origin
content-type
text/html
access-control-allow-origin
https://bishopfox.com
cache-control
max-age=0, no-cache, no-store
6si-ipv6
2a01:4a0:1338:92::7
server-timing
cdn-cache; desc=HIT, edge; dur=1
content-length
19
expires
Thu, 26 May 2022 22:32:30 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
774 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=46da313aa8ef51ce5d666ee13565a60d&svisitor=null&session=f51cf74c-f9da-4203-87cf-9e42b28da8d0&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Thu%2C%2026%20May%202022%2022%3A32%3A28%20GMT%22%7D&isIframe=false&m=%7B%22description%22%3A%22Telerik%20UI%20for%20ASP.NET%20AJAX%20insecurely%20deserializes%20JSON%20objects%20resulting%20in%20arbitrary%20RCE.%20Learn%20how%20to%20patch%20and%20securely%20configure%20this%20software.%22%2C%22keywords%22%3A%22Bishop%20Fox%2Cbishopfox%22%2C%22title%22%3A%22CVE-2019-18935%3A%20Remote%20Code%20Execution%20via%20Insecure%E2%80%A6%20%7C%20Bishop%20Fox%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fbishopfox.com%2Fblog%2Fcve-2019-18935-remote-code-execution-in-telerik-ui&pageViewId=c26f4678-f4df-4679-80ea-e0fdb3432197&an_uid=0
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.92.74.202 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-92-74-202.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date
Thu, 26 May 2022 22:32:30 GMT
X-Content-Type-Options
nosniff
Connection
keep-alive
Content-Length
43
Pragma
no-cache
Last-Modified
Fri, 21 Feb 2020 18:57:20 GMT
Server
nginx/1.14.0 (Ubuntu)
ETag
"5e502810-2b"
Access-Control-Max-Age
86400
Access-Control-Allow-Methods
GET,POST
Content-Type
image/gif
Access-Control-Allow-Origin
Cache-Control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials
true
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Expires
Wed, 19 Apr 2000 11:43:00 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
774 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=46da313aa8ef51ce5d666ee13565a60d&svisitor=null&session=f51cf74c-f9da-4203-87cf-9e42b28da8d0&event=ipv6&q=%7B%22address%22%3A%222a01%3A4a0%3A1338%3A92%3A%3A7%22%7D&isIframe=false&m=%7B%22description%22%3A%22Telerik%20UI%20for%20ASP.NET%20AJAX%20insecurely%20deserializes%20JSON%20objects%20resulting%20in%20arbitrary%20RCE.%20Learn%20how%20to%20patch%20and%20securely%20configure%20this%20software.%22%2C%22keywords%22%3A%22Bishop%20Fox%2Cbishopfox%22%2C%22title%22%3A%22CVE-2019-18935%3A%20Remote%20Code%20Execution%20via%20Insecure%E2%80%A6%20%7C%20Bishop%20Fox%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fbishopfox.com%2Fblog%2Fcve-2019-18935-remote-code-execution-in-telerik-ui&pageViewId=c26f4678-f4df-4679-80ea-e0fdb3432197&an_uid=0
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.92.74.202 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-92-74-202.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date
Thu, 26 May 2022 22:32:30 GMT
X-Content-Type-Options
nosniff
Connection
keep-alive
Content-Length
43
Pragma
no-cache
Last-Modified
Fri, 21 Feb 2020 18:57:20 GMT
Server
nginx/1.14.0 (Ubuntu)
ETag
"5e502810-2b"
Access-Control-Max-Age
86400
Access-Control-Allow-Methods
GET,POST
Content-Type
image/gif
Access-Control-Allow-Origin
Cache-Control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials
true
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Expires
Wed, 19 Apr 2000 11:43:00 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
774 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=46da313aa8ef51ce5d666ee13565a60d&svisitor=0f58655f71460000fcff8f6283010000607a0f00&session=f51cf74c-f9da-4203-87cf-9e42b28da8d0&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2026%20May%202022%2022%3A32%3A31%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2026%20May%202022%2022%3A32%3A28%20GMT%22%2C%22timeSpent%22%3A%222528%22%2C%22totalTimeSpent%22%3A%222528%22%7D&isIframe=false&m=%7B%22description%22%3A%22Telerik%20UI%20for%20ASP.NET%20AJAX%20insecurely%20deserializes%20JSON%20objects%20resulting%20in%20arbitrary%20RCE.%20Learn%20how%20to%20patch%20and%20securely%20configure%20this%20software.%22%2C%22keywords%22%3A%22Bishop%20Fox%2Cbishopfox%22%2C%22title%22%3A%22CVE-2019-18935%3A%20Remote%20Code%20Execution%20via%20Insecure%E2%80%A6%20%7C%20Bishop%20Fox%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fbishopfox.com%2Fblog%2Fcve-2019-18935-remote-code-execution-in-telerik-ui&pageViewId=c26f4678-f4df-4679-80ea-e0fdb3432197&an_uid=0
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.92.74.202 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-92-74-202.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date
Thu, 26 May 2022 22:32:31 GMT
X-Content-Type-Options
nosniff
Connection
keep-alive
Content-Length
43
Pragma
no-cache
Last-Modified
Tue, 05 Oct 2021 22:17:52 GMT
Server
nginx/1.14.0 (Ubuntu)
ETag
"615ccf10-2b"
Access-Control-Max-Age
86400
Access-Control-Allow-Methods
GET,POST
Content-Type
image/gif
Access-Control-Allow-Origin
Cache-Control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials
true
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Expires
Wed, 19 Apr 2000 11:43:00 GMT
log_event
www.youtube.com/youtubei/v1/ Frame 0B8E
28 B
54 B
XHR
General
Full URL
https://www.youtube.com/youtubei/v1/log_event?alt=json&key=AIzaSyAO_FJ2SlqU8Q4STEHLGCilw_Y9_11qcW8
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/s/player/d1783cbe/www-embed-player.vflset/www-embed-player.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
scaffolding on HTTPServer2 /
Resource Hash
d7d5e54ad1e33d7ab49c664323ced79cb9723ff15e9764cd0edc3e15208e8336
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
Content-Type
application/json
X-YouTube-Utc-Offset
0
X-YouTube-Client-Name
56
Referer
https://www.youtube.com/embed/--6PiuvBGAU?enablejsapi=1&origin=https%3A%2F%2Fbishopfox.com
X-YouTube-Client-Version
1.20220524.01.00
X-YouTube-Time-Zone
Etc/Unknown
X-Goog-Visitor-Id
CgtOdVplZEJBSklrVSj8_7-UBg%3D%3D
X-YouTube-Ad-Signals
dt=1653604349248&flash=0&frm=2&u_tz&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&bc=31&bih=-12245933&biw=-12245933&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C560%2C315&vis=1&wgl=true&ca_type=image

Response headers

date
Thu, 26 May 2022 22:32:31 GMT
content-encoding
br
x-content-type-options
nosniff
server
scaffolding on HTTPServer2
x-frame-options
SAMEORIGIN
vary
Origin, X-Origin, Referer
p3p
CP="This is not a P3P policy! See g.co/p3phelp for more info."
cache-control
private
content-type
application/json; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
31
x-xss-protection
0
expires
Thu, 26 May 2022 22:32:31 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
774 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=46da313aa8ef51ce5d666ee13565a60d&svisitor=0f58655f71460000fcff8f6283010000607a0f00&session=f51cf74c-f9da-4203-87cf-9e42b28da8d0&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2026%20May%202022%2022%3A32%3A32%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2026%20May%202022%2022%3A32%3A31%20GMT%22%2C%22timeSpent%22%3A%221005%22%2C%22totalTimeSpent%22%3A%223533%22%7D&isIframe=false&m=%7B%22description%22%3A%22Telerik%20UI%20for%20ASP.NET%20AJAX%20insecurely%20deserializes%20JSON%20objects%20resulting%20in%20arbitrary%20RCE.%20Learn%20how%20to%20patch%20and%20securely%20configure%20this%20software.%22%2C%22keywords%22%3A%22Bishop%20Fox%2Cbishopfox%22%2C%22title%22%3A%22CVE-2019-18935%3A%20Remote%20Code%20Execution%20via%20Insecure%E2%80%A6%20%7C%20Bishop%20Fox%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fbishopfox.com%2Fblog%2Fcve-2019-18935-remote-code-execution-in-telerik-ui&pageViewId=c26f4678-f4df-4679-80ea-e0fdb3432197&an_uid=0
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.92.74.202 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-92-74-202.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date
Thu, 26 May 2022 22:32:32 GMT
X-Content-Type-Options
nosniff
Connection
keep-alive
Content-Length
43
Pragma
no-cache
Last-Modified
Sat, 05 Jun 2021 07:56:05 GMT
Server
nginx/1.14.0 (Ubuntu)
ETag
"60bb2e15-2b"
Access-Control-Max-Age
86400
Access-Control-Allow-Methods
GET,POST
Content-Type
image/gif
Access-Control-Allow-Origin
Cache-Control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials
true
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Expires
Wed, 19 Apr 2000 11:43:00 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
774 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=46da313aa8ef51ce5d666ee13565a60d&svisitor=0f58655f71460000fcff8f6283010000607a0f00&session=f51cf74c-f9da-4203-87cf-9e42b28da8d0&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2026%20May%202022%2022%3A32%3A33%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2026%20May%202022%2022%3A32%3A32%20GMT%22%2C%22timeSpent%22%3A%221004%22%2C%22totalTimeSpent%22%3A%224537%22%7D&isIframe=false&m=%7B%22description%22%3A%22Telerik%20UI%20for%20ASP.NET%20AJAX%20insecurely%20deserializes%20JSON%20objects%20resulting%20in%20arbitrary%20RCE.%20Learn%20how%20to%20patch%20and%20securely%20configure%20this%20software.%22%2C%22keywords%22%3A%22Bishop%20Fox%2Cbishopfox%22%2C%22title%22%3A%22CVE-2019-18935%3A%20Remote%20Code%20Execution%20via%20Insecure%E2%80%A6%20%7C%20Bishop%20Fox%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fbishopfox.com%2Fblog%2Fcve-2019-18935-remote-code-execution-in-telerik-ui&pageViewId=c26f4678-f4df-4679-80ea-e0fdb3432197&an_uid=0
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.92.74.202 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-92-74-202.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date
Thu, 26 May 2022 22:32:33 GMT
X-Content-Type-Options
nosniff
Connection
keep-alive
Content-Length
43
Pragma
no-cache
Last-Modified
Fri, 21 Feb 2020 18:57:20 GMT
Server
nginx/1.14.0 (Ubuntu)
ETag
"5e502810-2b"
Access-Control-Max-Age
86400
Access-Control-Allow-Methods
GET,POST
Content-Type
image/gif
Access-Control-Allow-Origin
Cache-Control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials
true
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Expires
Wed, 19 Apr 2000 11:43:00 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
774 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=46da313aa8ef51ce5d666ee13565a60d&svisitor=0f58655f71460000fcff8f6283010000607a0f00&session=f51cf74c-f9da-4203-87cf-9e42b28da8d0&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2026%20May%202022%2022%3A32%3A34%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2026%20May%202022%2022%3A32%3A33%20GMT%22%2C%22timeSpent%22%3A%221003%22%2C%22totalTimeSpent%22%3A%225540%22%7D&isIframe=false&m=%7B%22description%22%3A%22Telerik%20UI%20for%20ASP.NET%20AJAX%20insecurely%20deserializes%20JSON%20objects%20resulting%20in%20arbitrary%20RCE.%20Learn%20how%20to%20patch%20and%20securely%20configure%20this%20software.%22%2C%22keywords%22%3A%22Bishop%20Fox%2Cbishopfox%22%2C%22title%22%3A%22CVE-2019-18935%3A%20Remote%20Code%20Execution%20via%20Insecure%E2%80%A6%20%7C%20Bishop%20Fox%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fbishopfox.com%2Fblog%2Fcve-2019-18935-remote-code-execution-in-telerik-ui&pageViewId=c26f4678-f4df-4679-80ea-e0fdb3432197&an_uid=0
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.92.74.202 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-92-74-202.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date
Thu, 26 May 2022 22:32:34 GMT
X-Content-Type-Options
nosniff
Connection
keep-alive
Content-Length
43
Pragma
no-cache
Last-Modified
Tue, 05 Oct 2021 22:17:52 GMT
Server
nginx/1.14.0 (Ubuntu)
ETag
"615ccf10-2b"
Access-Control-Max-Age
86400
Access-Control-Allow-Methods
GET,POST
Content-Type
image/gif
Access-Control-Allow-Origin
Cache-Control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials
true
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Expires
Wed, 19 Apr 2000 11:43:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
www.gstatic.com
URL
https://www.gstatic.com/cv/js/sender/v1/cast_sender.js
Domain
www.youtube.com
URL
https://www.youtube.com/generate_204?audoUg
Domain
www.youtube.com
URL
https://www.youtube.com/api/stats/atr?ns=yt&el=embedded&cpn=isMhsGatc_X5GoK_&ver=2&cmt=0&fs=0&rt=0&euri=https%3A%2F%2Fbishopfox.com%2Fblog%2Fcve-2019-18935-remote-code-execution-in-telerik-ui&lact=647&cl=450771949&mos=0&volume=100&cbr=Chrome&cbrver=102.0.5005.61&c=WEB_EMBEDDED_PLAYER&cver=1.20220524.01.00&cplayer=UNIPLAYER&cos=Windows&cosver=10.0&cplatform=DESKTOP&epm=1&hl=de_DE&cr=DE&len=2634&fexp=23983296%2C24001373%2C24002022%2C24002025%2C24004644%2C24007246%2C24080738%2C24082662%2C24135310%2C24167177%2C24169501%2C24208721&muted=0&docid=--6PiuvBGAU
Domain
www.youtube.com
URL
https://www.youtube.com/youtubei/v1/log_event?alt=json&key=AIzaSyAO_FJ2SlqU8Q4STEHLGCilw_Y9_11qcW8

Verdicts & Comments Add Verdict or Comment

77 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| 3 object| 4 object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails object| navigation object| hljs object| dataLayer object| google_tag_manager string| GoogleAnalyticsObject function| ga object| google_tag_data string| _linkedin_data_partner_id object| _6si function| onYouTubeIframeAPIReady object| gaGlobal object| gaplugins function| lintrk boolean| _already_called_lintrk function| mktoMunchkinFunction object| Munchkin function| mktoMunchkin object| google_optimize object| gaData object| MunchkinTracker object| MktoForms2 function| requestChatReassignment function| clearChatReassignmentTimer function| setChatReassignmentTimer object| DS_WebFont object| chat_custom_design object| SnapABug object| SnapABugChat object| SnapEngage object| SnapEngageChat object| webpackChunk function| mainMenu function| mobileMenu function| loadForms object| Alpine object| _digitalpi function| SimpleDTO object| scriptUrl object| ttPolicy object| YT object| YTConfig function| onYTReady object| jQuery11240878629650311785 object| yt function| ytDomDomGetNextId object| ytEventsEventsListeners object| ytEventsEventsCounter object| ytglobal object| ytPubsub2Pubsub2Instance object| ytPubsub2Pubsub2SubscribedKeys object| ytPubsub2Pubsub2TopicToKeys object| ytPubsub2Pubsub2IsAsync object| ytPubsub2Pubsub2SkipSubKey object| ytNetworklessLoggingInitializationOptions object| ytPubsubPubsubInstance object| ytPubsubPubsubTopicToKeys object| ytPubsubPubsubIsSynchronous object| ytPubsubPubsubSubscribedKeys object| ytExports object| ytLoggingTransportGELQueue_ object| ytLoggingTransportGELProtoQueue_ object| ytLoggingTransportTokensToCttTargetIds_ object| ytLoggingTransportTokensToJspbCttTargetIds_ object| ytLoggingGelSequenceIdObj_ object| fEl string| f

27 Cookies

Domain/Path Name / Value
.youtube.com/ Name: YSC
Value: itM6il8NRn0
.youtube.com/ Name: VISITOR_INFO1_LIVE
Value: NuZedBAJIkU
.bishopfox.com/ Name: _ga_DYCTLWMS7T
Value: GS1.1.1653604348.1.0.1653604348.0
.bishopfox.com/ Name: _ga
Value: GA1.2.962519027.1653604348
.bishopfox.com/ Name: _gid
Value: GA1.2.1997830729.1653604348
.bishopfox.com/ Name: _gat_UA-41346121-1
Value: 1
.6sc.co/ Name: 6suuid
Value: 0f58655f71460000fcff8f6283010000607a0f00
.bishopfox.com/ Name: _mkto_trk
Value: id:136-UTJ-516&token:_mch-bishopfox.com-1653604348488-54652
.go.bishopfox.com/ Name: __cf_bm
Value: rYi4VtN5aCFaSKo_aZpfGiiL_nehDjOZaL_nWs7PTp0-1653604348-0-AYHt74cc9iikK8CasD4i9aY/a507q12Srsv77aq7O4Mil74iLAucxSRFowMhsp28IIpbE1gVlbELo3Ao2cKXpIU=
.linkedin.com/ Name: UserMatchHistory
Value: AQLIHQhBkOVwBAAAAYECf_JoVt-BbXRT77vZ5VaTpz81UeSK-4NEVJrN06T-y3bw_jlBXuKXpFYfMQ
.linkedin.com/ Name: AnalyticsSyncHistory
Value: AQLSP_dpR72QNAAAAYECf_JoD-stDk6reJ7POgG8mg6AdHA_lbrZdhhgiUOVnvl-W5Q_X7Frern1VJHcNTfQwQ
.ads.linkedin.com/ Name: lang
Value: v=2&lang=en-us
.linkedin.com/ Name: bcookie
Value: "v=2&4a2a69f2-3f58-4854-8e46-bcd982f882d4"
.linkedin.com/ Name: lidc
Value: "b=TGST05:s=T:r=T:a=T:p=T:g=2549:u=1:x=1:i=1653604348:t=1653690748:v=2:sig=AQHLi-yy49r6mpKRT2_h24JA2miFvLUf"
.bishopfox.com/ Name: SnapABugRef
Value: https%3A%2F%2Fbishopfox.com%2Fblog%2Fcve-2019-18935-remote-code-execution-in-telerik-ui%20
.bishopfox.com/ Name: SnapABugHistory
Value: 1#
.bishopfox.com/ Name: SnapABugUserAlias
Value: %23
.bishopfox.com/ Name: SnapABugVisit
Value: 1#1653604349
.bishopfox.com/ Name: dpi_utmOrigVals
Value: %7B%22Utm_Orig_Medium__c%22%3A%22none%22%2C%22Utm_Orig_Source__c%22%3A%22none%22%7D
.linkedin.com/ Name: lang
Value: v=2&lang=de-de
.www.linkedin.com/ Name: bscookie
Value: "v=1&20220526223228841a6ed6-d834-472c-8db0-689a3258901fAQGabZz0MapvBoBWsmQmyFtE36T68S8h"
.linkedin.com/ Name: li_gc
Value: MTswOzE2NTM2MDQzNDg7MjswMjFdiPnTu3+S3EUIESETlbTNkqQ3tsstY0+fO69JV4Vmng==
go.bishopfox.com/ Name: BIGipServersj36web-nginx-app_https
Value: !kDBJNSTN+ruJBhfMZROflEEG2tCikugMydAyiKZ1ioXg4JaDTQnOEEK2iKKXRuLnCFsmRyVHNnP7sqc=
bishopfox.com/ Name: _an_uid
Value: 0
bishopfox.com/ Name: _gd_visitor
Value: 064bf32b-74bb-4194-8b6a-4750d8f749d5
bishopfox.com/ Name: _gd_session
Value: f51cf74c-f9da-4203-87cf-9e42b28da8d0
bishopfox.com/ Name: _gd_svisitor
Value: 0f58655f71460000fcff8f6283010000607a0f00

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

136-utj-516.mktoresp.com
b.6sc.co
bishopfox.com
c.6sc.co
cdn.jsdelivr.net
cdnjs.cloudflare.com
fonts.gstatic.com
go.bishopfox.com
googleads.g.doubleclick.net
i.ytimg.com
ipv6.6sc.co
j.6sc.co
jnn-pa.googleapis.com
know.bishopfox.com
munchkin.marketo.net
px.ads.linkedin.com
px4.ads.linkedin.com
s3.us-east-2.amazonaws.com
secure.adnxs.com
snap.licdn.com
static.doubleclick.net
stats.g.doubleclick.net
storage.googleapis.com
www.google-analytics.com
www.google.com
www.google.de
www.googleoptimize.com
www.googletagmanager.com
www.gstatic.com
www.linkedin.com
www.snapengage.com
www.youtube.com
yt3.ggpht.com
www.gstatic.com
www.youtube.com
104.17.73.206
104.90.146.131
104.92.74.202
13.107.42.14
192.28.147.68
2606:4700:20::6818:362
2606:4700::6810:5714
2606:4700::6811:190e
2620:1ec:21::14
2a00:1450:4001:801::2006
2a00:1450:4001:802::2003
2a00:1450:4001:802::2013
2a00:1450:4001:80e::2003
2a00:1450:4001:80e::200e
2a00:1450:4001:810::2003
2a00:1450:4001:810::200e
2a00:1450:4001:810::2010
2a00:1450:4001:813::200a
2a00:1450:4001:813::2016
2a00:1450:4001:827::2008
2a00:1450:4001:828::2002
2a00:1450:4001:82a::2004
2a00:1450:4001:82f::2001
2a00:1450:400c:c1b::9d
2a02:26f0:3500:16::215:14a0
2a02:26f0:6c00:296::1c91
37.252.172.36
52.219.176.153
03126a706c3fc7cbe8ef2bb68e658476ee22ca0df3d1545849b531c9d55b861d
036d9addc4c8e183bb9f5ba70e27cabad16d70cbe8998c9bc71c7b92e64d9943
058f6a953b55bae14a0440a4191b38f91a391724ea022353a4c1d9afcffaf3c2
10ba2921da7a426d858ab48706a1562f80a8c96c63ebd60a27c39c2c0817355e
14f2ec002b176e0dee403cb7dd4ef2274a1353080e1e3e4084678770f4c15b9c
18f1b7ee7bd72fcb170820c889f76861c24585bc2b857db5cc31c23154def714
1943f3b04a44d0c87b27581e293ae88f0550384fdedb54719cd3959251b39cac
1a3d43e5d83b4956e9fb87e21b9851fb4f87bca59e71e8d8644a3a154ef16b83
1d6bd059fec2dc8fa74d697fda6ecf6abdd4f66f6713506dc9b182db69bbdb54
2169dd3f2e3031452c431f1dc33ee48b8577b0cb6925096ef14fca54c81bd70b
256e42104f48a5fa80b031da12dc56acde224fba3f9810f8f8192b39136d365a
2ffe4f7b01fda1d0d2b4be0e978ac397dc779570a71e70a5815e6d2d4eb6d02d
31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d
323fb9363e2724f3f9edde48742ccf0b04d95978f7ec1d13755f872c6fea8dc5
3415801762419bbb07aec4d4bfd8b89fca0ac867fc900e0f09b19321ab255c55
3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc
47eb859ff311128018b9863f90260b0bfbd573d3b31dd53af967f5a0cce49cbb
498b3f2a0357fbd50a80eb18b23ab4b461b791d640e5560b799f08ed960748a9
4bf3aca933aa233702f890083af601fb16149ec8a17f8c1b90d30450562bde08
4d4b6a308f7020554dfd5c36f7a1ec40a7ff919487c17d885ec38e50530d8f1c
54b1a318711ed45da6f1a787a0b0f601199c8676b7d565a4163674833c64b0a0
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
57cd46adbabd6c40823602b4513aecbe89320a769572255272abe9f008de69fa
5ca272b5c51f5790821b50ebfb5f2868f20230a839431baf92f45bfff38861ea
5ec6f5a71a8fd9ffeaca919d9122324ded0d517837216256e312a7d47e46076e
6759eeea4a3e0dcc6883305b25d7aac20cb725231a29701e41340d6fa7b3410a
67ea46bc3d15351067faccb3613bd833dd3f15137a4b4a09f2e873fd41d024d2
77b6a8e22b7c2cc34b937c6810561f50ce4d59bf6689814fc2710fe418aa284e
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
8698ba03b14103a8e66501c032a0e72a36c643539ad1b35671a4b3b2368868f6
86e8e73a99440d460522bee20867bf0f60a5343860f67ae9b0137c0966ae640c
8a446896ed6dd5086841d19eefeb98551a65a848e961ac248050254d66e758fb
8e038b564510a45dc11799f74da367733f3db7f9c0a0434f1e90c44ec5168278
8eb80fb9c89ef87163485116e4284f0f17c784f37fcc4ef4716befbd581a7382
9a40ca2af2fff49c941718d910ddbb14cfba33c61ecbbd030fb8b64338f6f83d
9ad44775d8eda5561824249518bfd8a31e2ead196c3c52a36b68d2ba95785078
9c1162a622bc982328d9c7d2768c7c90116b2002fc8d5823ff4f06bf309f18c1
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
a254697022c008cd17aa3bf3c6fbc5d6b1c82e6a92fa319d5a74b3fd6d27e4f5
a26c9e631307638ee80b6127043a351f5e1fa90a4fcd8948e27e083a3ecb72cd
a62395528bf1cec786343dc969b28c2f5a0046cc8e73652780a7408fbbd97a2e
ab9e4369b7708a147c7d1ca4ab6661b7c5a3c3390f9dee80bab6268972506aa1
b612ef883fc8f1392eedf7eafc6f1e068f09a22d1b2dc7244c719ecb6acdee81
b92d195d7c1f5fa19d22bfbe43a1711d6cc14c088bb9e9ec85c42a13ed580347
b97c99a69a6275c8f90703cd4c0864089a74fd08383a1cc75a8a4d0c2cb60cce
c0bc3be07587388188143cb937f57c41c1921c60d0ad0c1a278c9099b6fc26a6
c2aee78040b4ed46c2377e6825db12a9691a2eb584adf338e77312c8978d8537
c2c76750672f1668a3df60c8aff4a8276b3bd847914543ca5a32a7751e67aa76
c357cae871839ca76f03ddcfc4eb17ed65da0d16d7fb1c2a4076fb41ead160b3
c587ac4899e5fdb91856de5b6520dd49037232c5e27efd2ae155691bae1d50e8
cf59c87af37b168b6d28ed1ca844864144ef1936aebd210aa4837e64aa451a60
d0199fee293acde68cccf4d274ec8b036fb35b5da377903b704ffbc42cf58d69
d50729450d3020ee4991730d92b237d38ea737df74fb9e5cade4561b11142ce7
d5792801335f11b32a948d51b64bb655b16f8767f5837f2be4c406715994752f
d7d5e54ad1e33d7ab49c664323ced79cb9723ff15e9764cd0edc3e15208e8336
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
de8571efbf0aea75892c4aca0fe97881568ca123b8de9a1f94ccd2d5d274c024
e0ea4dbd2c85145cacf92362ae72dc6d56be63d1a68f0d492f55699959874940
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
eb1023bea6522f4625d8873a27b30d42cea04e431fad965ff6704edf98bbd771
ee147e859ad0f09aa50367974e38ab53e7c7054c4a51d400a7f45b0eb251454f
ee6415815b89316a51d93b0d28318d0c9fa0e3ae52be6a4b50a06aef6a0c8710
eed0dc1fdb5d97ed188ae16fd5e1024a5bb744af47340346be2146300a6c54b9
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f7545b96ed2740220c349ae9deb614faf1f0f211d4cf710788e0790f74cc9715
fdd47af9c41d50e5819892ee91ecf36b2468cc6ac85bba4f0ee1f8542feb9bb8
ff7cec7fbbb44902cb946b2d77bb28bfdfeb69d5c61837fe68c6b066281a9bc5
ffe7470ed93fb95f4a6edfa31438aa481e72a4540aaa59c7785ea238f3f96e80