positive.security Open in urlscan Pro
52.18.26.20 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://positive.security/blog/url-open-rce
Submission: On April 20 via manual (April 20th 2021, 12:01:13 pm UTC) from IE

Summary HTTP 53 Redirects Links 35 Behaviour Indicators

Summary

This website contacted 11 IPs in 3 countries across 8 domains to perform 53 HTTP transactions. The main IP is 52.18.26.20, located in Dublin, Ireland and belongs to AMAZON-02, US. The main domain is positive.security.
TLS certificate: Issued by R3 on March 15th 2021. Valid for: 3 months.

This is the only time positive.security was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1	52.18.26.20 52.18.26.20	16509 (AMAZON-02) (AMAZON-02)
24	13.224.102.90 13.224.102.90	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:827::200a	15169 (GOOGLE) (GOOGLE)
3	2606:4700::68... 2606:4700::6810:5f41	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6810:135e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	52.218.132.72 52.218.132.72	16509 (AMAZON-02) (AMAZON-02)
1	2606:4700::68... 2606:4700::6810:125e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	13.224.89.138 13.224.89.138	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:808::200a	15169 (GOOGLE) (GOOGLE)
18	2a00:1450:400... 2a00:1450:4001:828::2003	15169 (GOOGLE) (GOOGLE)
53	11

1 52.18.26.20 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-18-26-20.eu-west-1.compute.amazonaws.com

positive.security	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

24 13.224.102.90 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-224-102-90.zrh50.r.cloudfront.net

uploads-ssl.webflow.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:827::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2606:4700::6810:5f41 (United States)

ASN13335 (CLOUDFLARENET, US)

static.cloudflareinsights.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cloudflareinsights.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:135e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.218.132.72 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: s3-us-west-2.amazonaws.com

s3-us-west-2.amazonaws.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:125e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.224.89.138 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-224-89-138.zrh50.r.cloudfront.net

d3e54v103j8qbb.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:808::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

18 2a00:1450:4001:828::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
24	webflow.com uploads-ssl.webflow.com	790 KB
18	gstatic.com fonts.gstatic.com	341 KB
3	cloudflareinsights.com static.cloudflareinsights.com cloudflareinsights.com	5 KB
2	amazonaws.com s3-us-west-2.amazonaws.com	43 KB
2	cloudflare.com cdnjs.cloudflare.com	27 KB
2	googleapis.com ajax.googleapis.com fonts.googleapis.com	7 KB
1	cloudfront.net d3e54v103j8qbb.cloudfront.net	31 KB
1	positive.security positive.security	20 KB
53	8

	Domain	Requested by
24	uploads-ssl.webflow.com	positive.security
18	fonts.gstatic.com	fonts.googleapis.com
2	cloudflareinsights.com	static.cloudflareinsights.com
2	s3-us-west-2.amazonaws.com	positive.security
2	cdnjs.cloudflare.com	positive.security
1	fonts.googleapis.com	ajax.googleapis.com
1	d3e54v103j8qbb.cloudfront.net	positive.security
1	static.cloudflareinsights.com	positive.security
1	ajax.googleapis.com	positive.security
1	positive.security
53	10

This site contains links to these domains. Also see Links.

Domain
revuln.com
searchcode.com
benjamin-altpeter.de
github.com
bugs.launchpad.net
hackerone.com
nextcloud.com
core.telegram.org
winscp.net
code.videolan.org
doc.qt.io
www.videolan.org
cve.mitre.org
gitlab.com
nvd.nist.gov
twitter.com

Subject Issuer	Validity	Valid
positive.security R3	`2021-03-15` - `2021-06-13`	3 months	crt.sh
uploads-ssl.webflow.com Amazon	`2020-10-26` - `2021-11-25`	a year	crt.sh
upload.video.google.com GTS CA 1O1	`2021-03-23` - `2021-06-15`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2020-07-11` - `2021-07-11`	a year	crt.sh
*.s3-us-west-2.amazonaws.com DigiCert Baltimore CA-2 G2	`2020-07-30` - `2021-08-04`	a year	crt.sh
*.cloudfront.net DigiCert Global CA G2	`2021-02-22` - `2022-02-21`	a year	crt.sh
*.gstatic.com GTS CA 1O1	`2021-03-23` - `2021-06-15`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://positive.security/blog/url-open-rce
Frame ID: 4C72B282FF81C9839D5106411599AF04
Requests: 59 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Lua (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

headers server /openresty(?:\/([\d.]+))?/i

Varnish (Cache Tools) Expand

Overall confidence: 100%
Detected patterns

headers via /varnish(?: $Varnish\/([\d.]+)$)?/i

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /openresty(?:\/([\d.]+))?/i

OpenResty (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /openresty(?:\/([\d.]+))?/i

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i
script /googleapis\.com\/.+webfont/i

Prism (Miscellaneous) Expand

Overall confidence: 100%
Detected patterns

script /prism\.js/i

Page Statistics

53
Requests

100 %
HTTPS

60 %
IPv6

8
Domains

10
Subdomains

11
IPs

3
Countries

1263 kB
Transfer

1713 kB
Size

0
Cookies

35 Outgoing links

These are links going to different origins than the main page.

URL: http://revuln.com/files/ReVuln_Steam_Browser_Protocol_Insecurity.pdf
Title: this vulnerability in the steam:// protocol

Search URL Search Domain Scan URL

URL: https://searchcode.com/?q=QDesktopServices%3A%3AopenUrl
Title: searchcode allow to easily expand a search across millions of indexed open source projects

Search URL Search Domain Scan URL

URL: https://benjamin-altpeter.de/shell-openexternal-dangers/
Title: has the same behavior

Search URL Search Domain Scan URL

URL: https://github.com/wireapp/wire-desktop/security/advisories/GHSA-5gpx-9976-ggpm
Title: RCE in the Wire Messenger

Search URL Search Domain Scan URL

URL: https://bugs.launchpad.net/ubuntu/+source/glib2.0/+bug/378783
Title: https://bugs.launchpad.net/ubuntu/+source/glib2.0/+bug/378783

Search URL Search Domain Scan URL

URL: https://github.com/jceb/dex
Title: by associating .desktop files with dex

Search URL Search Domain Scan URL

URL: https://github.com/snapcore/snapd/blob/30ef6dd52df387d359afdcd15f96210e6e0a1d71/usersession/userd/launcher.go#L56-L118
Title: more URI schemes were added

Search URL Search Domain Scan URL

URL: https://github.com/nextcloud/desktop/blob/4b985ab3b322d18773c76e1d1afd6cbad3cdbba2/src/gui/wizard/webview.cpp#L226-L232
Title: intercepting those requests and passing them to QDesktopServices::openUrl by overwriting acceptNavigationRequest()

Search URL Search Domain Scan URL

URL: https://github.com/nextcloud/desktop/pull/2906
Title: Validate sensitive URLs to only allow http(s) schemes

Search URL Search Domain Scan URL

URL: https://hackerone.com/reports/1078002
Title: Nextcloud Desktop Client RCE via malicious URI schemes

Search URL Search Domain Scan URL

URL: https://nextcloud.com/security/advisory/?id=NC-SA-2021-008
Title: https://nextcloud.com/security/advisory/?id=NC-SA-2021-008

Search URL Search Domain Scan URL

URL: https://core.telegram.org/type/MessageEntity
Title: https://core.telegram.org/type/MessageEntity

Search URL Search Domain Scan URL

URL: https://core.telegram.org/constructor/messageEntityUrl
Title: messageEntityUrl

Search URL Search Domain Scan URL

URL: https://core.telegram.org/constructor/messageEntityTextUrl
Title: messageEntityTextUrl

Search URL Search Domain Scan URL

URL: https://winscp.net/eng/index.php
Title: Having been downloaded 150 million times

Search URL Search Domain Scan URL

URL: https://github.com/telegramdesktop/tdesktop/issues/1201
Title: a Github issue from 2015

Search URL Search Domain Scan URL

URL: https://code.videolan.org/videolan/vlc/-/blob/2090c051abb8d3b15fd1824c394897eedda63c7f/src/text/url.c#L291
Title: code that looks like it was intended to filter out UNC paths

Search URL Search Domain Scan URL

URL: https://doc.qt.io/qt-5/qurl.html#fromLocalFile
Title: FromLocalFile

Search URL Search Domain Scan URL

URL: https://doc.qt.io/qt-5/qurl.html#isLocalFile
Title: isLocalFile

Search URL Search Domain Scan URL

URL: https://www.videolan.org/security/sb-vlc3013.html
Title: https://www.videolan.org/security/sb-vlc3013.html

Search URL Search Domain Scan URL

URL: https://github.com/LibreOffice/core/blob/5e4c771c0b89452ab55d1ab30dbb1634f15d3775/shell/source/win32/SysShExec.cxx#L340
Title: file extension blacklist

Search URL Search Domain Scan URL

URL: https://github.com/LibreOffice/core/commit/f456c4dacf700e064e112ef068ff7edb04239754#diff-a145690dcc0afd8668d723e0a74793b6f19f358c3c3599b45d887973f333d94e
Title: patch the file extension blacklist bypass for Windows

Search URL Search Domain Scan URL

URL: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-27229
Title: CVE-2021-27229

Search URL Search Domain Scan URL

URL: https://github.com/mumble-voip/mumble/commit/e59ee87abe249f345908c7d568f6879d16bfd648
Title: Restricting allowed schemes to http and https

Search URL Search Domain Scan URL

URL: https://github.com/dogecoin/dogecoin/commit/b2211a41393358f496b6977df7336dd8f5fdfd78
Title: Fixed

Search URL Search Domain Scan URL

URL: https://github.com/Bitcoin-ABC/bitcoin-abc/commit/9936d093400b7be6365e828adddcde21218b65d4
Title: Fixed

Search URL Search Domain Scan URL

URL: https://gitlab.com/bitcoin-cash-node/bitcoin-cash-node/-/commit/1394a383426a5edf090f2949c70622bb10ae1a3d
Title: Fixed

Search URL Search Domain Scan URL

URL: https://github.com/BTCGPU/BTCGPU/pull/414
Title: a patch was developed and merged into master

Search URL Search Domain Scan URL

URL: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22191
Title: CVE-2021-22191

Search URL Search Domain Scan URL

URL: https://gitlab.com/wireshark/wireshark/-/commit/b2c58d020c100958beb59d9e62471efab5c3cc2d#6d973ab1ed4d54d26e69b4c965288a463af4f975
Title: Changing double-click behavior to copy URLs to the clipboard rather than opening them

Search URL Search Domain Scan URL

URL: https://winscp.net/eng/docs/integration_url#save
Title: also mentions WinSCP-specific parameters

Search URL Search Domain Scan URL

URL: https://winscp.net/eng/docs/rawsettings
Title: corresponding docs page

Search URL Search Domain Scan URL

URL: https://nvd.nist.gov/vuln/detail/CVE-2021-3331
Title: CVE-2021-3331

Search URL Search Domain Scan URL

URL: https://github.com/winscp/winscp/commit/faa96e8144e6925a380f94a97aa382c9427f688d
Title: Prevent loading session settings that can lead to remote code execution from handled URLs

Search URL Search Domain Scan URL

URL: https://twitter.com/positive_sec
Title: @positive_sec

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

53 HTTP transactions
7 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request url-open-rce Show response
positive.security/blog/ 59 KB
20 KB 215ms
82ms Document
text/html 52.18.26.20
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://positive.security/blog/url-open-rce

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

52.18.26.20 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-18-26-20.eu-west-1.compute.amazonaws.com

Software

openresty /

Resource Hash

aaf6911906ab19ed6ee5418162e059bdae66a69391ce75a3233b466d8f201e04

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Frame-Options	SAMEORIGIN

Request headers

:method: GET
:authority: positive.security
:scheme: https
:path: /blog/url-open-rce
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

server: openresty
date: Tue, 20 Apr 2021 12:00:50 GMT
content-type: text/html
content-length: 20048
content-encoding: gzip
content-security-policy: frame-ancestors 'self'
x-frame-options: SAMEORIGIN
x-lambda-id: 478a7f7f-cf06-4273-a665-d79d2e705f36
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
age: 3686
x-served-by: cache-dca17720-DCA, cache-dub4342-DUB
x-cache: MISS, HIT
x-cache-hits: 0, 2
x-timer: S1618920050.366649,VS0,VE0
vary: Accept-Encoding
x-cluster-name: eu-west-1-prod-eks-15

GET
H2 200 positive-security-staging-72d251d7bb6be.webflow.decb2cf05.css
uploads-ssl.webflow.com/5f6498c074436c50c016e745/css/ 103 KB
18 KB 86ms
36ms Stylesheet
text/css 13.224.102.90
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://uploads-ssl.webflow.com/5f6498c074436c50c016e745/css/positive-security-staging-72d251d7bb6be.webflow.decb2cf05.css
Requested by: Host: positive.security
URL: https://positive.security/blog/url-open-rce
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.102.90 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-102-90.zrh50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 8519a83a0bf9f9a7b88bd14a683d80844d60f0937d4c7be4940253f710034b50

Request headers

Referer: https://positive.security/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 20 Apr 2021 03:09:58 GMT
content-encoding: gzip
age: 31853
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 18041
last-modified: Thu, 15 Apr 2021 10:55:24 GMT
server: AmazonS3
etag: "a8a120bcb8930ca5444122bb499dddfe"
x-amz-version-id: XQLTJMWnT02fKAwVcV8I_ajTUu.Zu1It
via: 1.1 f32eaf3bf899320e0c43dee8baec79fa.cloudfront.net (CloudFront)
cache-control: max-age=84600, must-revalidate
x-amz-cf-pop: ZRH50-C1
accept-ranges: bytes
content-type: text/css
x-amz-cf-id: AqKEWpuEhGbOIP1j7-aq4eYcjCId33iJjJZu3DJSufB6OIFAoP5LsQ==

GET
H2 200 webfont.js Show response
ajax.googleapis.com/ajax/libs/webfont/1.6.26/ 13 KB
5 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:827::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/webfont/1.6.26/webfont.js

Requested by

Host: positive.security
URL: https://positive.security/blog/url-open-rce

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

81016ac6be850b72df5d4faa0c3cec8e2c1b0ba0045712144a6766adfad40bee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://positive.security/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 19 Apr 2021 18:02:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 64722
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5437
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 19 Apr 2022 18:02:08 GMT

GET
H2 200 beacon.min.js Show response
static.cloudflareinsights.com/ 13 KB
5 KB 92ms
29ms Script
text/javascript 2606:4700::6810:5f41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://static.cloudflareinsights.com/beacon.min.js
Requested by: Host: positive.security
URL: https://positive.security/blog/url-open-rce
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:5f41 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2054327b1f4678abefcf46666f6ab7d2fff992ee07e0e67aa9ee8d597c03657c

Request headers

Referer: https://positive.security/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 20 Apr 2021 12:00:50 GMT
content-encoding: gzip
last-modified: Mon, 19 Apr 2021 16:41:48 GMT
server: cloudflare
etag: W/"3ee26b93-02fc-4737-be7e-adc801e11cd3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
cf-ray: 642e36ec4a132c2a-FRA
cf-request-id: 0990c0a7af00002c2ac9368000000001

GET
H2 200 5f6498c074436cf0ef16e7ad_menu_icon_flipped.png
uploads-ssl.webflow.com/5f6498c074436c50c016e745/ 169 B
571 B 62ms
48ms Image
image/png 13.224.102.90
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://uploads-ssl.webflow.com/5f6498c074436c50c016e745/5f6498c074436cf0ef16e7ad_menu_icon_flipped.png
Requested by: Host: positive.security
URL: https://positive.security/blog/url-open-rce
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.102.90 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-102-90.zrh50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: ec472e0417348de6e89aa5195252bca83e57f8864d4a14dd4661749acb679cdd

Request headers

Referer: https://positive.security/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 20 Apr 2021 03:09:59 GMT
via: 1.1 f32eaf3bf899320e0c43dee8baec79fa.cloudfront.net (CloudFront)
last-modified: Fri, 18 Sep 2020 11:23:48 GMT
server: AmazonS3
age: 31852
etag: "ad07b15962975b581e4ea48c864decd7"
x-cache: Hit from cloudfront
x-amz-version-id: zpcElOS6U97nkKWtRrLKvkmx3Lu8rXaP
cache-control: max-age=31536000, must-revalidate
x-amz-cf-pop: ZRH50-C1
accept-ranges: bytes
content-type: image/png
content-length: 169
x-amz-cf-id: 8ExDbY8-81ewr3efAzKGOaKLa7Lcb7oTlFssjpHM1qv27mSlwiiPZA==

GET
H2 200 postscribe.min.js Show response
cdnjs.cloudflare.com/ajax/libs/postscribe/2.0.8/ 17 KB
6 KB 16ms
16ms Script
application/javascript 2606:4700::6810:135e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/postscribe/2.0.8/postscribe.min.js

Requested by

Host: positive.security
URL: https://positive.security/blog/url-open-rce

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:135e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c4e20f53f5ef0ed44b783437aa3f4638a9a56cc4aa29ae83ed9212eb2807052a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Referer: https://positive.security/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 20 Apr 2021 12:00:50 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"max_age":604800,"report_to":"cf-nel"}
age: 490834
cross-origin-resource-policy: cross-origin
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 5117
cf-request-id: 0990c0a70300004ec76a34d000000001
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:15:38 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03faa-45f4"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=W%2FDecpak%2FCePqOyF3pn5cxoVplEiaTx1lGuYFpZuMa%2BFSTm9ng98JcpL2tSfNu6Hqs8u8E1%2FLdQR5eSrfz8%2FjvV%2BjrMKWZOPnAScjl44QXMsyrkLFisRY7CmzL2WYIGAXA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 642e36eb3fd34ec7-FRA
expires: Sun, 10 Apr 2022 12:00:50 GMT

GET
H/1.1 200
OK prism.js Show response
s3-us-west-2.amazonaws.com/daily-web/ 36 KB
37 KB 820ms
212ms Script
application/javascript 52.218.132.72
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s3-us-west-2.amazonaws.com/daily-web/prism.js
Requested by: Host: positive.security
URL: https://positive.security/blog/url-open-rce
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.218.132.72 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-us-west-2.amazonaws.com
Software: AmazonS3 /
Resource Hash: 3cdf76e1b1eca61cae38592d84e5ea643354729d49b384b4868b7ac7de1ee21b

Request headers

Referer: https://positive.security/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 20 Apr 2021 12:00:52 GMT
Last-Modified: Tue, 12 Mar 2019 17:43:47 GMT
Server: AmazonS3
x-amz-request-id: 40D2Y2TFNBCQB1EE
ETag: "f3f147afcb226b6c39ecf61f843839e1"
Content-Type: application/javascript
Accept-Ranges: bytes
Content-Length: 37298
x-amz-id-2: 3Je1R77UspEfhxzPpqkdTPfKD12jqTQHSwfNEOUTTQQOLO8TmRhULmn84h7QcQsXJdchJ1cI850=

GET
H/1.1 200
OK prism.css
s3-us-west-2.amazonaws.com/daily-web/ 6 KB
6 KB 827ms
217ms Stylesheet
text/css 52.218.132.72
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s3-us-west-2.amazonaws.com/daily-web/prism.css
Requested by: Host: positive.security
URL: https://positive.security/blog/url-open-rce
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.218.132.72 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-us-west-2.amazonaws.com
Software: AmazonS3 /
Resource Hash: a841bef130ec17030c2aeebd167d596cd11e392b95ced387542b8789d36de5de

Request headers

Referer: https://positive.security/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 20 Apr 2021 12:00:52 GMT
Last-Modified: Tue, 12 Mar 2019 03:20:37 GMT
Server: AmazonS3
x-amz-request-id: 40D5SZQ225CDPWW3
ETag: "ca7d92b493e84ce5bec500c912869319"
Content-Type: text/css
Accept-Ranges: bytes
Content-Length: 6267
x-amz-id-2: JKMc/IsSApCiDmUkXjwEO9jRdOxI440RKQ9u68F6C95/md8Qhd9van608VTr5zU7BThKGOVoz+I=

GET
H3-29 200 showdown.min.js Show response
cdnjs.cloudflare.com/ajax/libs/showdown/1.9.0/ 74 KB
21 KB 37ms
19ms Script
application/javascript 2606:4700::6810:125e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/showdown/1.9.0/showdown.min.js

Requested by

Host: positive.security
URL: https://positive.security/blog/url-open-rce

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700::6810:125e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2d25294d8d2491718abdc042f646e68226e6c7735556026f0047d365bb39d665

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Referer: https://positive.security/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 20 Apr 2021 12:00:50 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"max_age":604800,"report_to":"cf-nel"}
age: 485456
cross-origin-resource-policy: cross-origin
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 20562
cf-request-id: 0990c0a77f00001f39a7a52000000001
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:16:14 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03fce-1274c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=z38Lk7B52tEVdLIHF75bTnnQ3bSuYRiAsaAhiZ6b2d5NnDDMyk3zesbqefG%2Bgdr1NU1MyYXxlnm5KP0PakyDMMdNF6W8INZZ1b64JH8WDKX%2B9eqwYiWOFxJxLEDnW%2BykRw%3D%3D"}],"max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 642e36ebf89c1f39-FRA
expires: Sun, 10 Apr 2022 12:00:50 GMT

GET
H2 200 606898a123801ecbb1861d81_nextcloud_rce_xubuntu_nfs_redacted_cropped_2-poster-00001.jpg
uploads-ssl.webflow.com/5f6498c074436c50c016e745/ 47 KB
47 KB 62ms
48ms Image
image/jpeg 13.224.102.90
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://uploads-ssl.webflow.com/5f6498c074436c50c016e745/606898a123801ecbb1861d81_nextcloud_rce_xubuntu_nfs_redacted_cropped_2-poster-00001.jpg
Requested by: Host: positive.security
URL: https://positive.security/blog/url-open-rce
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.102.90 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-102-90.zrh50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 7f36d5a2641332462ece680dcf2c39e4fa9a1f3aa1aa2dfc29310d8267b57802

Request headers

Referer: https://positive.security/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-server-side-encryption: AES256
date: Tue, 20 Apr 2021 03:09:59 GMT
via: 1.1 f32eaf3bf899320e0c43dee8baec79fa.cloudfront.net (CloudFront)
last-modified: Sat, 03 Apr 2021 16:32:53 GMT
server: AmazonS3
age: 31852
etag: "0ff40dfaed10f6f93757dcfd10ad2045"
x-cache: Hit from cloudfront
x-amz-version-id: mV9ujTPMPRGmsafrIwV9p_9C0VQ4iTkx
x-amz-cf-pop: ZRH50-C1
accept-ranges: bytes
content-type: image/jpeg
content-length: 47908
x-amz-cf-id: KNEpfVBQ-aTXX-asotcOaosEN5Vinrld5_bK2LYT8-Z1DhWa-cuaVQ==

GET
H2 200 606898ad23801e90e5861daa_nextcloud_rce_sftp_xubuntu_redacted_cropped_2-poster-00001.jpg
uploads-ssl.webflow.com/5f6498c074436c50c016e745/ 49 KB
49 KB 75ms
62ms Image
image/jpeg 13.224.102.90
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://uploads-ssl.webflow.com/5f6498c074436c50c016e745/606898ad23801e90e5861daa_nextcloud_rce_sftp_xubuntu_redacted_cropped_2-poster-00001.jpg
Requested by: Host: positive.security
URL: https://positive.security/blog/url-open-rce
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.102.90 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-102-90.zrh50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: eb8c493aa019414d4b1bbacb9bda24bf3d73b4fd1e96a4336084ab65e1e71877

Request headers

Referer: https://positive.security/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-server-side-encryption: AES256
date: Tue, 20 Apr 2021 03:09:59 GMT
via: 1.1 f32eaf3bf899320e0c43dee8baec79fa.cloudfront.net (CloudFront)
last-modified: Sat, 03 Apr 2021 16:33:29 GMT
server: AmazonS3
age: 31852
etag: "e6a1f6a22044edea78f9d7ecd5baf5f8"
x-cache: Hit from cloudfront
x-amz-version-id: xJoYj6Ya0MdU0O6AOKKDxDNU5tPOjmlO
x-amz-cf-pop: ZRH50-C1
accept-ranges: bytes
content-type: image/jpeg
content-length: 50021
x-amz-cf-id: ij5LkLJjl3Y3o9Y3xWaiKDrFYnSeytNwA-Vs1gmEc2-T1QGi7ftg3A==

GET
H2 200 60689bd94e5efd8fc40e6915_nextcloud_rce_win_redacted_cropped_3-poster-00001.jpg
uploads-ssl.webflow.com/5f6498c074436c50c016e745/ 35 KB
36 KB 80ms
67ms Image
image/jpeg 13.224.102.90
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://uploads-ssl.webflow.com/5f6498c074436c50c016e745/60689bd94e5efd8fc40e6915_nextcloud_rce_win_redacted_cropped_3-poster-00001.jpg
Requested by: Host: positive.security
URL: https://positive.security/blog/url-open-rce
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.102.90 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-102-90.zrh50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 83f85680c7e16e977d8c526d09728a72daeff03a8277c931a2a1d212d3366afe

Request headers

Referer: https://positive.security/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-server-side-encryption: AES256
date: Tue, 20 Apr 2021 03:09:58 GMT
via: 1.1 f32eaf3bf899320e0c43dee8baec79fa.cloudfront.net (CloudFront)
last-modified: Sat, 03 Apr 2021 16:46:39 GMT
server: AmazonS3
age: 31853
etag: "0da6520b0d45d99e77c4b7e1f6df0990"
x-cache: Hit from cloudfront
x-amz-version-id: HiGH2QT9mhYzML.XM0e7DujTixfYF0kv
x-amz-cf-pop: ZRH50-C1
accept-ranges: bytes
content-type: image/jpeg
content-length: 36164
x-amz-cf-id: J3SKsYm0aMtEeT7irAKOpYj5_AdJfsWg4vI4YJiG2lmI00ATcLKZQQ==

GET
H2 200 6068b58b0b7cdaa7ac6d38e9_telegram_rce_xubuntu_redacted_cropped-poster-00001.jpg
uploads-ssl.webflow.com/5f6498c074436c50c016e745/ 48 KB
49 KB 87ms
74ms Image
image/jpeg 13.224.102.90
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://uploads-ssl.webflow.com/5f6498c074436c50c016e745/6068b58b0b7cdaa7ac6d38e9_telegram_rce_xubuntu_redacted_cropped-poster-00001.jpg
Requested by: Host: positive.security
URL: https://positive.security/blog/url-open-rce
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.102.90 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-102-90.zrh50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 839e69bb67d6619ad220da56cc6cedffa6c46a17baf6be369a6f2503310e97f6

Request headers

Referer: https://positive.security/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-server-side-encryption: AES256
date: Tue, 20 Apr 2021 03:09:59 GMT
via: 1.1 f32eaf3bf899320e0c43dee8baec79fa.cloudfront.net (CloudFront)
last-modified: Sat, 03 Apr 2021 18:36:26 GMT
server: AmazonS3
age: 31852
etag: "576d8738d2b229c4eae513538d648fc4"
x-cache: Hit from cloudfront
x-amz-version-id: 85sMXy3mLpDF60iM9F0PFGGGk8huTj5K
x-amz-cf-pop: ZRH50-C1
accept-ranges: bytes
content-type: image/jpeg
content-length: 49262
x-amz-cf-id: srrCVh3wPZRq6V3uPxvkomakOAFYkpzHTDwAA0c6BPXX7JmXPpSDng==

GET
H2 200 606abaa50447307a673f4dc9_VLC_Windows_jar_RCE-poster-00001.jpg
uploads-ssl.webflow.com/5f6498c074436c50c016e745/ 24 KB
24 KB 88ms
75ms Image
image/jpeg 13.224.102.90
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://uploads-ssl.webflow.com/5f6498c074436c50c016e745/606abaa50447307a673f4dc9_VLC_Windows_jar_RCE-poster-00001.jpg
Requested by: Host: positive.security
URL: https://positive.security/blog/url-open-rce
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.102.90 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-102-90.zrh50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: d715c9697c536edbef17984aa77a12ad749700f7061823a56af39328ce86de1d

Request headers

Referer: https://positive.security/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-server-side-encryption: AES256
date: Tue, 20 Apr 2021 03:09:59 GMT
via: 1.1 f32eaf3bf899320e0c43dee8baec79fa.cloudfront.net (CloudFront)
last-modified: Mon, 05 Apr 2021 07:23:22 GMT
server: AmazonS3
age: 31852
etag: "179dff284bb993dc1f18aee254058c56"
x-cache: Hit from cloudfront
x-amz-version-id: 1JgUF1g6UOH0D4jTq.HpdMakiLeHHnSx
x-amz-cf-pop: ZRH50-C1
accept-ranges: bytes
content-type: image/jpeg
content-length: 24107
x-amz-cf-id: 9rzCnJBvQKRxhEzupgqknEAXKMT8mM5cAiehOMi7RkkpuytX1SDfeg==

GET
H2 200 6064e27325e5e3aaad9663f5_OpenOffice_Xubuntu-poster-00001.jpg
uploads-ssl.webflow.com/5f6498c074436c50c016e745/ 32 KB
32 KB 88ms
76ms Image
image/jpeg 13.224.102.90
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://uploads-ssl.webflow.com/5f6498c074436c50c016e745/6064e27325e5e3aaad9663f5_OpenOffice_Xubuntu-poster-00001.jpg
Requested by: Host: positive.security
URL: https://positive.security/blog/url-open-rce
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.102.90 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-102-90.zrh50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 6c4023ea3c54b3e24a8c64c0b286ec2f557a2004d5f8a3bb4778dc5b07f3eb78

Request headers

Referer: https://positive.security/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-server-side-encryption: AES256
date: Tue, 20 Apr 2021 03:09:58 GMT
via: 1.1 f32eaf3bf899320e0c43dee8baec79fa.cloudfront.net (CloudFront)
last-modified: Wed, 31 Mar 2021 20:59:17 GMT
server: AmazonS3
age: 31853
etag: "57706e539c59b5fcea3693b1cb5337ea"
x-cache: Hit from cloudfront
x-amz-version-id: mrrmYd4_HSJj5k8xefEJ0XzMRuxMoIAk
x-amz-cf-pop: ZRH50-C1
accept-ranges: bytes
content-type: image/jpeg
content-length: 32763
x-amz-cf-id: adrJQot5Fiqt6dsJD8GjKBr-nNly3cNeQLoCGkBsM_sBbr-ngdjuqQ==

GET
H2 200 6064e28925e5e305919663f8_OpenOffice_Windows-poster-00001.jpg
uploads-ssl.webflow.com/5f6498c074436c50c016e745/ 25 KB
25 KB 100ms
87ms Image
image/jpeg 13.224.102.90
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://uploads-ssl.webflow.com/5f6498c074436c50c016e745/6064e28925e5e305919663f8_OpenOffice_Windows-poster-00001.jpg
Requested by: Host: positive.security
URL: https://positive.security/blog/url-open-rce
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.102.90 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-102-90.zrh50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 28f66deee24c2cf12b52454b0f250f2a566ca9047941c000684641a7e2d8bfe7

Request headers

Referer: https://positive.security/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-server-side-encryption: AES256
date: Tue, 20 Apr 2021 03:09:59 GMT
via: 1.1 f32eaf3bf899320e0c43dee8baec79fa.cloudfront.net (CloudFront)
last-modified: Wed, 31 Mar 2021 20:59:27 GMT
server: AmazonS3
age: 31852
etag: "3ced09b44ec2be0256efd191a120d7ba"
x-cache: Hit from cloudfront
x-amz-version-id: TbKmoYR37dY7ToAavRzYN.iMTMgjEclB
x-amz-cf-pop: ZRH50-C1
accept-ranges: bytes
content-type: image/jpeg
content-length: 25148
x-amz-cf-id: zowrDvF4UkBtjlbXj-e9Tj-5u1lfJcBl4tacDdYIaVAtEG7voolSKw==

GET
H2 200 6064e29b49106c60d8b53779_LibreOffice_Xubuntu-poster-00001.jpg
uploads-ssl.webflow.com/5f6498c074436c50c016e745/ 35 KB
35 KB 95ms
83ms Image
image/jpeg 13.224.102.90
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://uploads-ssl.webflow.com/5f6498c074436c50c016e745/6064e29b49106c60d8b53779_LibreOffice_Xubuntu-poster-00001.jpg
Requested by: Host: positive.security
URL: https://positive.security/blog/url-open-rce
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.102.90 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-102-90.zrh50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: d1d819e2f04ad347b2c22e8d485c7a760d86639cfbf0b4b99a3594861592ed04

Request headers

Referer: https://positive.security/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-server-side-encryption: AES256
date: Tue, 20 Apr 2021 03:09:58 GMT
via: 1.1 f32eaf3bf899320e0c43dee8baec79fa.cloudfront.net (CloudFront)
last-modified: Wed, 31 Mar 2021 20:59:58 GMT
server: AmazonS3
age: 31853
etag: "aaba4c29ead86419cc8bb5e1ec591302"
x-cache: Hit from cloudfront
x-amz-version-id: c1xmhO4jbfNCjmfD2Oj94ZPewpB2mKN6
x-amz-cf-pop: ZRH50-C1
accept-ranges: bytes
content-type: image/jpeg
content-length: 35889
x-amz-cf-id: RhA7YGNW-I6vhhm6XPwre_GlG_jC5xVtUBXzBg6DR9xfVOIZsKbuew==

GET
H2 200 6064e2b4ba47d6cb3f7e0543_LibreOffice_Windows_ext_filter_bypass-poster-00001.jpg
uploads-ssl.webflow.com/5f6498c074436c50c016e745/ 45 KB
45 KB 100ms
88ms Image
image/jpeg 13.224.102.90
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://uploads-ssl.webflow.com/5f6498c074436c50c016e745/6064e2b4ba47d6cb3f7e0543_LibreOffice_Windows_ext_filter_bypass-poster-00001.jpg
Requested by: Host: positive.security
URL: https://positive.security/blog/url-open-rce
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.102.90 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-102-90.zrh50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 776b528ea0ec5389029add85b6c11b00f09537ae3493920aae5e06e7b5c485ff

Request headers

Referer: https://positive.security/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-server-side-encryption: AES256
date: Tue, 20 Apr 2021 03:09:59 GMT
via: 1.1 f32eaf3bf899320e0c43dee8baec79fa.cloudfront.net (CloudFront)
last-modified: Wed, 31 Mar 2021 21:00:52 GMT
server: AmazonS3
age: 31852
etag: "2251c24e163f79b8651eb92419be3271"
x-cache: Hit from cloudfront
x-amz-version-id: wo9fRVXwZ.eFmq5jaOI84RwSqzW2vht7
x-amz-cf-pop: ZRH50-C1
accept-ranges: bytes
content-type: image/jpeg
content-length: 46045
x-amz-cf-id: tsXBN2OZre795KHTBaVbO9bmKT4lgeHL5U9Hv3Y5zR0MPmRZxG6yLw==

GET
H2 200 6064d3c5b0d5c4768db268e3_Mumble_Windows-poster-00001.jpg
uploads-ssl.webflow.com/5f6498c074436c50c016e745/ 23 KB
24 KB 100ms
88ms Image
image/jpeg 13.224.102.90
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://uploads-ssl.webflow.com/5f6498c074436c50c016e745/6064d3c5b0d5c4768db268e3_Mumble_Windows-poster-00001.jpg
Requested by: Host: positive.security
URL: https://positive.security/blog/url-open-rce
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.102.90 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-102-90.zrh50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 90129d2ae550e56af645371ac1e647e78e7805f0b0000411a7df3b377dd802c2

Request headers

Referer: https://positive.security/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-server-side-encryption: AES256
date: Tue, 20 Apr 2021 03:09:59 GMT
via: 1.1 f32eaf3bf899320e0c43dee8baec79fa.cloudfront.net (CloudFront)
last-modified: Wed, 31 Mar 2021 19:56:50 GMT
server: AmazonS3
age: 31852
etag: "f26825673924bc1871a10e85498d2448"
x-cache: Hit from cloudfront
x-amz-version-id: e4GdQooLa070SMPa8IpQ74Hy_dTA8kE2
x-amz-cf-pop: ZRH50-C1
accept-ranges: bytes
content-type: image/jpeg
content-length: 24036
x-amz-cf-id: yKtmyh4P_Nf-O65041MTCNolt36Ybcm41UXNq0XMeOB1kdVAZJatKg==

GET
H2 200 6064d501bb822c899ffcbb55_Mumble_Xubuntu-poster-00001.jpg
uploads-ssl.webflow.com/5f6498c074436c50c016e745/ 31 KB
31 KB 100ms
89ms Image
image/jpeg 13.224.102.90
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://uploads-ssl.webflow.com/5f6498c074436c50c016e745/6064d501bb822c899ffcbb55_Mumble_Xubuntu-poster-00001.jpg
Requested by: Host: positive.security
URL: https://positive.security/blog/url-open-rce
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.102.90 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-102-90.zrh50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: f5ed36e00edda3a3632d35f8db25fbe717d14275ae027135820269a568211500

Request headers

Referer: https://positive.security/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-server-side-encryption: AES256
date: Tue, 20 Apr 2021 03:09:58 GMT
via: 1.1 f32eaf3bf899320e0c43dee8baec79fa.cloudfront.net (CloudFront)
last-modified: Wed, 31 Mar 2021 20:02:21 GMT
server: AmazonS3
age: 31853
etag: "24b94dd045cc205704877d5c75458ec7"
x-cache: Hit from cloudfront
x-amz-version-id: l3d7c5DXMggWMKXMdttjFz6ZF.psluRB
x-amz-cf-pop: ZRH50-C1
accept-ranges: bytes
content-type: image/jpeg
content-length: 31604
x-amz-cf-id: JfnXWZCwXkQrjzxzyqD9jcoXgBsqLR-Ofpso7WJEGQ77O9xsMXNjIA==

GET
H2 200 606882419c3b8513337aa30f_btc_win_java_rce_cropped-poster-00001.jpg
uploads-ssl.webflow.com/5f6498c074436c50c016e745/ 33 KB
34 KB 101ms
89ms Image
image/jpeg 13.224.102.90
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://uploads-ssl.webflow.com/5f6498c074436c50c016e745/606882419c3b8513337aa30f_btc_win_java_rce_cropped-poster-00001.jpg
Requested by: Host: positive.security
URL: https://positive.security/blog/url-open-rce
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.102.90 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-102-90.zrh50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: f1becc4ae821ee6d6e1844dd93156dae8cc5c1a078bf6595ca7f1d055bf28f10

Request headers

Referer: https://positive.security/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-server-side-encryption: AES256
date: Tue, 20 Apr 2021 03:09:59 GMT
via: 1.1 f32eaf3bf899320e0c43dee8baec79fa.cloudfront.net (CloudFront)
last-modified: Sat, 03 Apr 2021 16:16:20 GMT
server: AmazonS3
age: 31852
etag: "bd49dd0572f2b87ecf7290a2011c732d"
x-cache: Hit from cloudfront
x-amz-version-id: bwPRB8t1OpEG7esSJdGaN3ulGfYR_z8F
x-amz-cf-pop: ZRH50-C1
accept-ranges: bytes
content-type: image/jpeg
content-length: 34239
x-amz-cf-id: N-IAAJ_Ht59rOE4SQWtNkhB6PwIBe0TBYNztReoyucZtLdxPNXxN1Q==

GET
H2 200 6064e230b0d5c4488bb2ccd3_Wireshark_Windows-poster-00001.jpg
uploads-ssl.webflow.com/5f6498c074436c50c016e745/ 23 KB
24 KB 100ms
89ms Image
image/jpeg 13.224.102.90
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://uploads-ssl.webflow.com/5f6498c074436c50c016e745/6064e230b0d5c4488bb2ccd3_Wireshark_Windows-poster-00001.jpg
Requested by: Host: positive.security
URL: https://positive.security/blog/url-open-rce
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.102.90 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-102-90.zrh50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 0eec27514809087e7fb58d79375c8f02a119815a05f64be23f8b183ad5fffb24

Request headers

Referer: https://positive.security/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-server-side-encryption: AES256
date: Tue, 20 Apr 2021 03:09:59 GMT
via: 1.1 f32eaf3bf899320e0c43dee8baec79fa.cloudfront.net (CloudFront)
last-modified: Wed, 31 Mar 2021 20:58:04 GMT
server: AmazonS3
age: 31852
etag: "1cc55a6fa3f0b0b1adc4da9230e40909"
x-cache: Hit from cloudfront
x-amz-version-id: RWglEW29a2qCwhiyA312o6jBR3TwvsqQ
x-amz-cf-pop: ZRH50-C1
accept-ranges: bytes
content-type: image/jpeg
content-length: 23996
x-amz-cf-id: WU8ymi2DyyQgmCkPFB0wt3LMJ924u8byBeDaihxBkZXpQJL24yOs8w==

GET
H2 200 6064e245a3e7243f25aab019_Wireshark_Xubuntu-poster-00001.jpg
uploads-ssl.webflow.com/5f6498c074436c50c016e745/ 16 KB
17 KB 100ms
89ms Image
image/jpeg 13.224.102.90
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://uploads-ssl.webflow.com/5f6498c074436c50c016e745/6064e245a3e7243f25aab019_Wireshark_Xubuntu-poster-00001.jpg
Requested by: Host: positive.security
URL: https://positive.security/blog/url-open-rce
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.102.90 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-102-90.zrh50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 0d36d92d7d9d576f51a6f701b3af4ba12048f76bbbb6414f27c64775e5e9bb0e

Request headers

Referer: https://positive.security/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-server-side-encryption: AES256
date: Tue, 20 Apr 2021 03:09:59 GMT
via: 1.1 f32eaf3bf899320e0c43dee8baec79fa.cloudfront.net (CloudFront)
last-modified: Wed, 31 Mar 2021 20:58:37 GMT
server: AmazonS3
age: 31852
etag: "9ab0b07629b9114347dadf014e17b869"
x-cache: Hit from cloudfront
x-amz-version-id: wT3Cm9DNZPYY3Jx2z32sa6sVi6qUbgex
x-amz-cf-pop: ZRH50-C1
accept-ranges: bytes
content-type: image/jpeg
content-length: 16883
x-amz-cf-id: VaAifWrBjgIMWx8_MrazPIyqg6f81z3idO6zw0ZVRrZVPXAYzYObxA==

GET
H2 200 6068840a3013aa6c7a062804_telegram_rce_win_cropped_redacted-poster-00001.jpg
uploads-ssl.webflow.com/5f6498c074436c50c016e745/ 37 KB
37 KB 101ms
89ms Image
image/jpeg 13.224.102.90
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://uploads-ssl.webflow.com/5f6498c074436c50c016e745/6068840a3013aa6c7a062804_telegram_rce_win_cropped_redacted-poster-00001.jpg
Requested by: Host: positive.security
URL: https://positive.security/blog/url-open-rce
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.102.90 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-102-90.zrh50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: b82134c639003844fde7c5fb8c8575f1419bd789688a9cf6143837d609b68de8

Request headers

Referer: https://positive.security/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-server-side-encryption: AES256
date: Tue, 20 Apr 2021 03:09:59 GMT
via: 1.1 f32eaf3bf899320e0c43dee8baec79fa.cloudfront.net (CloudFront)
last-modified: Sat, 03 Apr 2021 15:05:03 GMT
server: AmazonS3
age: 31852
etag: "2623fa9487b4207b879ca5625602c1d0"
x-cache: Hit from cloudfront
x-amz-version-id: tmshDNBiCezmUc0Qrvc4S9OqfSTMwSYm
x-amz-cf-pop: ZRH50-C1
accept-ranges: bytes
content-type: image/jpeg
content-length: 37737
x-amz-cf-id: w9LcXsf6q7MeI9p9GGhawKZtRPN7merMBsc_eY6-oFF98i7xBi1W0w==

GET
H2 200 606883e1af2d3e13f18f7e1b_chrome_link_cropped-poster-00001.jpg
uploads-ssl.webflow.com/5f6498c074436c50c016e745/ 76 KB
77 KB 101ms
90ms Image
image/jpeg 13.224.102.90
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://uploads-ssl.webflow.com/5f6498c074436c50c016e745/606883e1af2d3e13f18f7e1b_chrome_link_cropped-poster-00001.jpg
Requested by: Host: positive.security
URL: https://positive.security/blog/url-open-rce
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.102.90 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-102-90.zrh50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 6af4c5d83ad420a883151cbfafafe1f32454d747898c7c6a8a2e0a38382e0d5d

Request headers

Referer: https://positive.security/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-server-side-encryption: AES256
date: Mon, 19 Apr 2021 20:51:28 GMT
via: 1.1 f32eaf3bf899320e0c43dee8baec79fa.cloudfront.net (CloudFront)
last-modified: Sat, 03 Apr 2021 15:04:19 GMT
server: AmazonS3
age: 54563
etag: "ec2c1da601354e04e5c343ebf151b415"
x-cache: Hit from cloudfront
x-amz-version-id: AGC.GRw2u2KKMEKj1WrcCtUOi6THi1ye
x-amz-cf-pop: ZRH50-C1
accept-ranges: bytes
content-type: image/jpeg
content-length: 78069
x-amz-cf-id: d26rWdYkuQ-M9U1lj4Y-zVPypxYEaaX1j-_zkBLFDzRHY1pENwF7xg==

GET
H2 200 5f7ddb13deeceb266b162f8d_favicon-32x32_white.png
uploads-ssl.webflow.com/5f6498c074436c50c016e745/ 1 KB
1 KB 106ms
96ms Image
image/png 13.224.102.90
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://uploads-ssl.webflow.com/5f6498c074436c50c016e745/5f7ddb13deeceb266b162f8d_favicon-32x32_white.png
Requested by: Host: positive.security
URL: https://positive.security/blog/url-open-rce
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.102.90 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-102-90.zrh50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 25b0a767ac27cbbae4a93304a133df738307dd875c7308b810df3675d3a7c4da

Request headers

Referer: https://positive.security/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-server-side-encryption: AES256
date: Tue, 20 Apr 2021 01:39:48 GMT
via: 1.1 f32eaf3bf899320e0c43dee8baec79fa.cloudfront.net (CloudFront)
last-modified: Wed, 07 Oct 2020 15:13:26 GMT
server: AmazonS3
age: 37262
etag: "3354dc192cc393c950e02a06bb4e6ba5"
x-cache: Hit from cloudfront
x-amz-version-id: Jfr90W975iQjXHITbJQNxp90pSMEJq64
cache-control: max-age=31536000, must-revalidate
x-amz-cf-pop: ZRH50-C1
accept-ranges: bytes
content-type: image/png
content-length: 1092
x-amz-cf-id: vx-iMCWec9hIdOXY_1fxDJYUg1xSMRM_ZaqSnKyJZ_qVclRMpKuBsA==

GET
H2 200 jquery-3.5.1.min.dc5e7f18c8.js Show response
d3e54v103j8qbb.cloudfront.net/js/ 87 KB
31 KB 95ms
38ms Script
application/javascript 13.224.89.138
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d3e54v103j8qbb.cloudfront.net/js/jquery-3.5.1.min.dc5e7f18c8.js?site=5f6498c074436c50c016e745
Requested by: Host: positive.security
URL: https://positive.security/blog/url-open-rce
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.89.138 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-89-138.zrh50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

Request headers

Origin: https://positive.security
Referer: https://positive.security/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 20 Apr 2021 01:12:57 GMT
content-encoding: gzip
vary: Origin,Access-Control-Request-Headers,Access-Control-Request-Method
age: 38874
x-cache: Hit from cloudfront
access-control-allow-origin: *
last-modified: Mon, 20 Jul 2020 17:53:02 GMT
server: AmazonS3
etag: W/"dc5e7f18c8d36ac1d3d4753a87c98d0a"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: application/javascript
via: 1.1 a4f3f56409fe4e0b42683dc15dd52ef8.cloudfront.net (CloudFront)
cache-control: max-age=84600, must-revalidate
x-amz-cf-pop: ZRH50-C1
x-amz-cf-id: dDurtQFJep--lOX8m3qB4eMPxo_qhLM9ehOF9Ea16aY5jbahNhCBaA==

GET
H2 200 webflow.76189d12f.js Show response
uploads-ssl.webflow.com/5f6498c074436c50c016e745/js/ 228 KB
58 KB 41ms
26ms Script
text/javascript 13.224.102.90
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://uploads-ssl.webflow.com/5f6498c074436c50c016e745/js/webflow.76189d12f.js
Requested by: Host: positive.security
URL: https://positive.security/blog/url-open-rce
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.102.90 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-102-90.zrh50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 3de5d0840172ba83544f642e220744be71488c8dec83e98897ca7941cbac0577

Request headers

Referer: https://positive.security/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 20 Apr 2021 03:09:59 GMT
content-encoding: gzip
age: 31852
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 59035
last-modified: Thu, 15 Apr 2021 10:55:24 GMT
server: AmazonS3
etag: "515efa5e0ae0647f90dc15a92dc59f08"
x-amz-version-id: hCwOqaeLbasIzgTd.zOaw0lVr593wMRE
via: 1.1 f32eaf3bf899320e0c43dee8baec79fa.cloudfront.net (CloudFront)
cache-control: max-age=84600, must-revalidate
x-amz-cf-pop: ZRH50-C1
accept-ranges: bytes
content-type: text/javascript
x-amz-cf-id: aWwWwXSB8tCPHC-AAE8FNi-0XLm5ObYkFATblAUFt-qzRNAFC0ccLA==

GET
H2 200 css
fonts.googleapis.com/ 29 KB
1 KB 28ms
15ms Stylesheet
text/css 2a00:1450:4001:808::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Montserrat:100,100italic,200,200italic,300,300italic,400,400italic,500,500italic,600,600italic,700,700italic,800,800italic,900,900italic

Requested by

Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/webfont/1.6.26/webfont.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

50d39d7981a0feeddc52b74c4f4b32e680a3e16324d5eba9f599bf304c98bf44

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://positive.security/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Tue, 20 Apr 2021 11:28:28 GMT
server: ESF
date: Tue, 20 Apr 2021 12:00:50 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 20 Apr 2021 12:00:50 GMT

GET
H2 200 5f6498c074436c270016e798_purple-p-500.png
uploads-ssl.webflow.com/5f6498c074436c50c016e745/ 23 KB
23 KB 76ms
72ms Image
image/png 13.224.102.90
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://uploads-ssl.webflow.com/5f6498c074436c50c016e745/5f6498c074436c270016e798_purple-p-500.png
Requested by: Host: positive.security
URL: https://positive.security/blog/url-open-rce
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.102.90 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-102-90.zrh50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: c8d05ff22dc9abbc2ddca82b06bbb518cad99464c0c73436645466fe4ef58a40

Request headers

Referer: https://positive.security/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 20 Apr 2021 03:09:59 GMT
via: 1.1 f32eaf3bf899320e0c43dee8baec79fa.cloudfront.net (CloudFront)
last-modified: Fri, 18 Sep 2020 11:23:46 GMT
server: AmazonS3
age: 31852
etag: "512f9876f3dd4a86c66f3d30d241b522"
x-cache: Hit from cloudfront
x-amz-version-id: 0z4tHF1qgczmisk1VOvkUj.FUYETQDjG
cache-control: max-age=31536000, must-revalidate
x-amz-cf-pop: ZRH50-C1
accept-ranges: bytes
content-type: image/png
content-length: 23532
x-amz-cf-id: luoeehTauXds1brs0Gd-rI1xU_sLiDKCmEXKM2ECfBn8DTeQ1TbxPQ==

GET
H2 200 JTUSjIg1_i6t8kCHKm459Wlhyw.woff2
fonts.gstatic.com/s/montserrat/v15/ 19 KB
19 KB 25ms
3ms Font
font/woff2 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/montserrat/v15/JTUSjIg1_i6t8kCHKm459Wlhyw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Montserrat:100,100italic,200,200italic,300,300italic,400,400italic,500,500italic,600,600italic,700,700italic,800,800italic,900,900italic

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8767f01caa430c5bd4e3b008a8e9dfe022156a4e91a23c394fdcb05c267f1b94

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://positive.security
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 18 Apr 2021 10:03:38 GMT
x-content-type-options: nosniff
last-modified: Tue, 15 Sep 2020 18:11:52 GMT
server: sffe
age: 179832
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19172
x-xss-protection: 0
expires: Mon, 18 Apr 2022 10:03:38 GMT

GET
H2 200 JTURjIg1_i6t8kCHKm45_ZpC3gnD_g.woff2
fonts.gstatic.com/s/montserrat/v15/ 19 KB
19 KB 27ms
8ms Font
font/woff2 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/montserrat/v15/JTURjIg1_i6t8kCHKm45_ZpC3gnD_g.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

965574e97c29813feaa62a0a149731306ee4725e027603b937905375d3121c89

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://positive.security
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 18 Apr 2021 10:03:38 GMT
x-content-type-options: nosniff
last-modified: Tue, 15 Sep 2020 18:11:03 GMT
server: sffe
age: 179832
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19272
x-xss-protection: 0
expires: Mon, 18 Apr 2022 10:03:38 GMT

GET
H3-29 200 JTUQjIg1_i6t8kCHKm45_QpRyS7m.woff2
fonts.gstatic.com/s/montserrat/v15/ 18 KB
18 KB 22ms
9ms Font
font/woff2 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/montserrat/v15/JTUQjIg1_i6t8kCHKm45_QpRyS7m.woff2

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

56b15344c365a6f275ca7a21ede4b71c30af52cb0702e050898930c00353133a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://positive.security
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 18 Apr 2021 04:51:54 GMT
x-content-type-options: nosniff
last-modified: Tue, 15 Sep 2020 18:10:40 GMT
server: sffe
age: 198536
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18376
x-xss-protection: 0
expires: Mon, 18 Apr 2022 04:51:54 GMT

GET
H3-29 200 JTUOjIg1_i6t8kCHKm459WxZqh7k29M.woff2
fonts.gstatic.com/s/montserrat/v15/ 18 KB
18 KB 22ms
8ms Font
font/woff2 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/montserrat/v15/JTUOjIg1_i6t8kCHKm459WxZqh7k29M.woff2

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

742edbfdefc668641fe4ba894ee8972e5f29de9e378258b4474fa1a4976df915

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://positive.security
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 18 Apr 2021 10:03:44 GMT
x-content-type-options: nosniff
last-modified: Tue, 15 Sep 2020 18:10:36 GMT
server: sffe
age: 179826
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18644
x-xss-protection: 0
expires: Mon, 18 Apr 2022 10:03:44 GMT

GET
H3-29 200 JTURjIg1_i6t8kCHKm45_aZA3gnD_g.woff2
fonts.gstatic.com/s/montserrat/v15/ 19 KB
19 KB 55ms
42ms Font
font/woff2 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/montserrat/v15/JTURjIg1_i6t8kCHKm45_aZA3gnD_g.woff2

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

dec277a0ddbe3c8a386e8c85a7b3ac3b85e9fa2067d8dc4e19287fa67631ae68

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://positive.security
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 15 Apr 2021 11:02:47 GMT
x-content-type-options: nosniff
last-modified: Tue, 15 Sep 2020 18:10:54 GMT
server: sffe
age: 435483
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18968
x-xss-protection: 0
expires: Fri, 15 Apr 2022 11:02:47 GMT

GET
H3-29 200 JTUPjIg1_i6t8kCHKm459WxZBg_z_PZw.woff2
fonts.gstatic.com/s/montserrat/v15/ 19 KB
19 KB 21ms
8ms Font
font/woff2 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/montserrat/v15/JTUPjIg1_i6t8kCHKm459WxZBg_z_PZw.woff2

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f4e7e734d4e58238bc75a6efdd29e767a380f3b767031ce8d32aa76edf1e3d86

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://positive.security
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 15 Apr 2021 02:03:08 GMT
x-content-type-options: nosniff
last-modified: Tue, 15 Sep 2020 18:10:36 GMT
server: sffe
age: 467862
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19292
x-xss-protection: 0
expires: Fri, 15 Apr 2022 02:03:08 GMT

GET
H3-29 200 JTURjIg1_i6t8kCHKm45_cJD3gnD_g.woff2
fonts.gstatic.com/s/montserrat/v15/ 19 KB
19 KB 71ms
57ms Font
font/woff2 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/montserrat/v15/JTURjIg1_i6t8kCHKm45_cJD3gnD_g.woff2

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ab9241a07a70085385b3b30dbf081ad3296f8a95a48bbf524c5eb74f0fc030a4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://positive.security
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 20 Apr 2021 00:17:42 GMT
x-content-type-options: nosniff
last-modified: Tue, 15 Sep 2020 18:13:19 GMT
server: sffe
age: 42188
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18988
x-xss-protection: 0
expires: Wed, 20 Apr 2022 00:17:42 GMT

GET
H3-29 200 JTUPjIg1_i6t8kCHKm459WxZYgzz_PZw.woff2
fonts.gstatic.com/s/montserrat/v15/ 19 KB
19 KB 70ms
57ms Font
font/woff2 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/montserrat/v15/JTUPjIg1_i6t8kCHKm459WxZYgzz_PZw.woff2

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8a8bc347505ebacb1141ff2b952479b1beacfe943752cbe90aa396fe0500fbd9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://positive.security
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 15 Apr 2021 10:45:15 GMT
x-content-type-options: nosniff
last-modified: Tue, 15 Sep 2020 18:10:37 GMT
server: sffe
age: 436535
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19388
x-xss-protection: 0
expires: Fri, 15 Apr 2022 10:45:15 GMT

GET
H3-29 200 JTUQjIg1_i6t8kCHKm459WxRyS7m.woff2
fonts.gstatic.com/s/montserrat/v15/ 19 KB
19 KB 68ms
55ms Font
font/woff2 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/montserrat/v15/JTUQjIg1_i6t8kCHKm459WxRyS7m.woff2

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0eeb4ec8571a426f7168aa0aa95f3a738a0c45f71b919cfb49f648912b2b6640

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://positive.security
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 20 Apr 2021 00:12:13 GMT
x-content-type-options: nosniff
last-modified: Tue, 15 Sep 2020 18:10:52 GMT
server: sffe
age: 42517
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19660
x-xss-protection: 0
expires: Wed, 20 Apr 2022 00:12:13 GMT

GET
H3-29 200 JTUPjIg1_i6t8kCHKm459WxZOg3z_PZw.woff2
fonts.gstatic.com/s/montserrat/v15/ 19 KB
19 KB 68ms
56ms Font
font/woff2 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/montserrat/v15/JTUPjIg1_i6t8kCHKm459WxZOg3z_PZw.woff2

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

11bfeecea66da8d57b9f331728a570a05e24f7b4ccfa7e892cd85cf8648fec10

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://positive.security
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 18 Apr 2021 10:03:39 GMT
x-content-type-options: nosniff
last-modified: Tue, 15 Sep 2020 18:11:08 GMT
server: sffe
age: 179831
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19624
x-xss-protection: 0
expires: Mon, 18 Apr 2022 10:03:39 GMT

GET
H3-29 200 JTURjIg1_i6t8kCHKm45_bZF3gnD_g.woff2
fonts.gstatic.com/s/montserrat/v15/ 19 KB
19 KB 67ms
54ms Font
font/woff2 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/montserrat/v15/JTURjIg1_i6t8kCHKm45_bZF3gnD_g.woff2

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d10e701c44ab739c7d711b6483def0c6cd47e5a3d04eda1df2c5cbb08f21d81a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://positive.security
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 19 Apr 2021 23:40:58 GMT
x-content-type-options: nosniff
last-modified: Tue, 15 Sep 2020 18:13:07 GMT
server: sffe
age: 44392
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19264
x-xss-protection: 0
expires: Tue, 19 Apr 2022 23:40:58 GMT

GET
H3-29 200 JTUPjIg1_i6t8kCHKm459WxZFgrz_PZw.woff2
fonts.gstatic.com/s/montserrat/v15/ 19 KB
19 KB 55ms
42ms Font
font/woff2 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/montserrat/v15/JTUPjIg1_i6t8kCHKm459WxZFgrz_PZw.woff2

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e25106e32025c00d1fe6cd2e188410655fa79887bd77c72da445976f9d59dc43

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://positive.security
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 19 Apr 2021 23:54:40 GMT
x-content-type-options: nosniff
last-modified: Tue, 15 Sep 2020 18:11:22 GMT
server: sffe
age: 43570
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19816
x-xss-protection: 0
expires: Tue, 19 Apr 2022 23:54:40 GMT

GET
H3-29 200 JTURjIg1_i6t8kCHKm45_dJE3gnD_g.woff2
fonts.gstatic.com/s/montserrat/v15/ 19 KB
19 KB 54ms
41ms Font
font/woff2 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/montserrat/v15/JTURjIg1_i6t8kCHKm45_dJE3gnD_g.woff2

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4545eb1dec25fe868d19dc292d417d8a9e41c0276d75a4eaf524a9db21aa705a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://positive.security
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 18 Apr 2021 04:11:30 GMT
x-content-type-options: nosniff
last-modified: Tue, 15 Sep 2020 18:10:46 GMT
server: sffe
age: 200960
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19480
x-xss-protection: 0
expires: Mon, 18 Apr 2022 04:11:30 GMT

GET
H3-29 200 JTUPjIg1_i6t8kCHKm459WxZcgvz_PZw.woff2
fonts.gstatic.com/s/montserrat/v15/ 19 KB
19 KB 79ms
66ms Font
font/woff2 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/montserrat/v15/JTUPjIg1_i6t8kCHKm459WxZcgvz_PZw.woff2

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

31d8631496cacac8ccd260ac5fb41e3e217506304f90750fd96609d91ae8720f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://positive.security
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 18 Apr 2021 03:59:23 GMT
x-content-type-options: nosniff
last-modified: Tue, 15 Sep 2020 18:11:26 GMT
server: sffe
age: 201687
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19916
x-xss-protection: 0
expires: Mon, 18 Apr 2022 03:59:23 GMT

GET
H3-29 200 JTURjIg1_i6t8kCHKm45_c5H3gnD_g.woff2
fonts.gstatic.com/s/montserrat/v15/ 19 KB
19 KB 77ms
66ms Font
font/woff2 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/montserrat/v15/JTURjIg1_i6t8kCHKm45_c5H3gnD_g.woff2

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5a8c623b34dcf729895c3bc9b6e261796bbad69555a21ad6d2f9b4e7bc27b6e7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://positive.security
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 20 Apr 2021 02:08:20 GMT
x-content-type-options: nosniff
last-modified: Tue, 15 Sep 2020 18:11:08 GMT
server: sffe
age: 35550
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19440
x-xss-protection: 0
expires: Wed, 20 Apr 2022 02:08:20 GMT

GET
H3-29 200 JTUPjIg1_i6t8kCHKm459WxZbgjz_PZw.woff2
fonts.gstatic.com/s/montserrat/v15/ 19 KB
19 KB 79ms
66ms Font
font/woff2 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/montserrat/v15/JTUPjIg1_i6t8kCHKm459WxZbgjz_PZw.woff2

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d9a4514f330f7dbff481c9d392990313b157286733633627d6e7e6f86f2f10c6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://positive.security
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 18 Apr 2021 05:04:02 GMT
x-content-type-options: nosniff
last-modified: Tue, 15 Sep 2020 18:11:33 GMT
server: sffe
age: 197808
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19836
x-xss-protection: 0
expires: Mon, 18 Apr 2022 05:04:02 GMT

GET
H3-29 200 JTURjIg1_i6t8kCHKm45_epG3gnD_g.woff2
fonts.gstatic.com/s/montserrat/v15/ 19 KB
19 KB 80ms
66ms Font
font/woff2 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/montserrat/v15/JTURjIg1_i6t8kCHKm45_epG3gnD_g.woff2

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d2fca2ae6ff4ffea8690cb747cfb9237c873b227c4ad3425a1d84598c8bd0148

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://positive.security
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 18 Apr 2021 06:04:59 GMT
x-content-type-options: nosniff
last-modified: Tue, 15 Sep 2020 18:11:21 GMT
server: sffe
age: 194151
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19240
x-xss-protection: 0
expires: Mon, 18 Apr 2022 06:04:59 GMT

GET
H3-29 200 JTUPjIg1_i6t8kCHKm459WxZSgnz_PZw.woff2
fonts.gstatic.com/s/montserrat/v15/ 19 KB
19 KB 80ms
64ms Font
font/woff2 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/montserrat/v15/JTUPjIg1_i6t8kCHKm459WxZSgnz_PZw.woff2

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1cf50fce22cab8aeb09e346375a1f60e56dad8730e09007e22d2fb363748f835

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://positive.security
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 18 Apr 2021 10:03:41 GMT
x-content-type-options: nosniff
last-modified: Tue, 15 Sep 2020 18:14:18 GMT
server: sffe
age: 179829
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19676
x-xss-protection: 0
expires: Mon, 18 Apr 2022 10:03:41 GMT

GET
DATA 200
OK truncated
/ 715 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5a3f1dd74233f605e511f1b5b244bedf85ac88ba264caf4d6401bc7ec2017dcd

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 381 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 63271dcce1a2518271ecc2b0bdcc5afc9c5f0968a8635e0f97a4c9747309eb82

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 606c3f0e0d743a40364867ab_Quick_Overview_URI_handling_white.png
uploads-ssl.webflow.com/5f6498c074436c349716e747/ 87 KB
87 KB 22ms
22ms Image
image/png 13.224.102.90
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://uploads-ssl.webflow.com/5f6498c074436c349716e747/606c3f0e0d743a40364867ab_Quick_Overview_URI_handling_white.png
Requested by: Host: positive.security
URL: https://positive.security/blog/url-open-rce
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.102.90 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-102-90.zrh50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e00d0f7929964c2fe988a07e9e2a5e52c23bf83dafaa8ca19699ae6b4833e25d

Request headers

Referer: https://positive.security/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-server-side-encryption: AES256
date: Mon, 19 Apr 2021 02:54:39 GMT
via: 1.1 f32eaf3bf899320e0c43dee8baec79fa.cloudfront.net (CloudFront)
last-modified: Tue, 06 Apr 2021 10:59:28 GMT
server: AmazonS3
age: 119173
etag: "05d3cf420dbdded0a62aea7701e23e05"
x-cache: Hit from cloudfront
x-amz-version-id: tgokLYQ286UCRYtEKOTEOUyKuDGYzV9u
cache-control: max-age=31536000, must-revalidate
x-amz-cf-pop: ZRH50-C1
accept-ranges: bytes
content-type: image/png
content-length: 89034
x-amz-cf-id: zVKUmIYMTPCR7xo-Qmnb_r-KwIt8i7yRFKT30MHdgbyvwxzgyUbl8w==

GET
DATA 200
OK truncated
/ 547 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: eb14baeac955bb11e33cd7fd3fd2f698cf20db1b450325f45ea843b6cdc82366

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 552 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 62f3f809487194fcc55a3ebd88811a604ae496027bb425d4ebd15d9ae1921945

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 178 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 3ee0806e69f2ae70a2267a58ac5fc5d52b5aa7aca6f3c0c08adad605fd8fbc16

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 352 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5f3592a8b8037ea064764a2815799612063c6722d314d1d66d3a9391c3c16d66

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 243 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9d2d8043c302d3a9da9277374a53e2285c471d5dc8397885b4931b82771d5cae

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 5f6498c074436c6cbd16e799_top-p-500.png
uploads-ssl.webflow.com/5f6498c074436c50c016e745/ 7 KB
8 KB 28ms
28ms Image
image/png 13.224.102.90
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://uploads-ssl.webflow.com/5f6498c074436c50c016e745/5f6498c074436c6cbd16e799_top-p-500.png
Requested by: Host: positive.security
URL: https://positive.security/blog/url-open-rce
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.102.90 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-102-90.zrh50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: f0707fc954dcefc706e18b72f96bd9a03d6bdc06ee76f440b518cbed5b671ac0

Request headers

Referer: https://positive.security/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 20 Apr 2021 02:50:30 GMT
via: 1.1 f32eaf3bf899320e0c43dee8baec79fa.cloudfront.net (CloudFront)
last-modified: Fri, 18 Sep 2020 11:23:46 GMT
server: AmazonS3
age: 33022
etag: "0a61272f6686bd758ac7616723059110"
x-cache: Hit from cloudfront
x-amz-version-id: DcfJ7JbOE0weYUIr.BvFqVKMZCcBO0ym
cache-control: max-age=31536000, must-revalidate
x-amz-cf-pop: ZRH50-C1
accept-ranges: bytes
content-type: image/png
content-length: 7286
x-amz-cf-id: JDAQp_ofReUn1HayIBkSE5R0JFDBmer097JVi7J_bLHdcX0eRqY7EQ==

GET
H2 200 5f6498c074436c36af16e7a5_bottom-p-500.png
uploads-ssl.webflow.com/5f6498c074436c50c016e745/ 7 KB
7 KB 19ms
19ms Image
image/png 13.224.102.90
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://uploads-ssl.webflow.com/5f6498c074436c50c016e745/5f6498c074436c36af16e7a5_bottom-p-500.png
Requested by: Host: positive.security
URL: https://positive.security/blog/url-open-rce
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.102.90 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-102-90.zrh50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 2ddafcafa9f2e74f61f452f339cd3be01d15c6953a76fd5aa7f225be91395415

Request headers

Referer: https://positive.security/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 20 Apr 2021 02:50:30 GMT
via: 1.1 f32eaf3bf899320e0c43dee8baec79fa.cloudfront.net (CloudFront)
last-modified: Fri, 18 Sep 2020 11:23:47 GMT
server: AmazonS3
age: 33022
etag: "24442bde91d7b91d8ce99f27ab3bc7df"
x-cache: Hit from cloudfront
x-amz-version-id: qBowoxulE0G38uwJnrLh0z01NA0Egatj
cache-control: max-age=31536000, must-revalidate
x-amz-cf-pop: ZRH50-C1
accept-ranges: bytes
content-type: image/png
content-length: 6672
x-amz-cf-id: UGX1OnVHP7osMOOfeI4hY8F7u_CMHeC8FBhOa-dR1x45AHkJSNNJ7A==

OPTIONS
H2 200 rum
cloudflareinsights.com/cdn-cgi/ 0
0 28ms
9ms Preflight
text/plain 2606:4700::6810:5f41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cloudflareinsights.com/cdn-cgi/rum

Protocol

Server

2606:4700::6810:5f41 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Origin: https://positive.security
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

date: Tue, 20 Apr 2021 12:00:51 GMT
content-type: text/plain
access-control-allow-origin: https://positive.security
access-control-allow-methods: POST,OPTIONS
access-control-allow-headers: Content-Type
access-control-max-age: 86400
vary: Origin
access-control-allow-credentials: true
server: cloudflare
cf-ray: 642e36f3ec9b5364-FRA
x-frame-options: DENY
x-content-type-options: nosniff
content-encoding: gzip

POST
H2 200 rum Show response
cloudflareinsights.com/cdn-cgi/ 0
78 B 13ms
13ms XHR
text/plain 2606:4700::6810:5f41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cloudflareinsights.com/cdn-cgi/rum

Requested by

Host: static.cloudflareinsights.com
URL: https://static.cloudflareinsights.com/beacon.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:5f41 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://positive.security/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
content-type: application/json

Response headers

date: Tue, 20 Apr 2021 12:00:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cloudflare
x-frame-options: DENY
access-control-allow-methods: POST,OPTIONS
content-type: text/plain
access-control-allow-origin: https://positive.security
access-control-max-age: 86400
access-control-allow-credentials: true
cf-ray: 642e36f3fcb45364-FRA
vary: Origin

Verdicts & Comments Add Verdict or Comment

30 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	frame-ancestors 'self'
X-Frame-Options	SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
cdnjs.cloudflare.com
cloudflareinsights.com
d3e54v103j8qbb.cloudfront.net
fonts.googleapis.com
fonts.gstatic.com
positive.security
s3-us-west-2.amazonaws.com
static.cloudflareinsights.com
uploads-ssl.webflow.com
13.224.102.90
13.224.89.138
2606:4700::6810:125e
2606:4700::6810:135e
2606:4700::6810:5f41
2a00:1450:4001:808::200a
2a00:1450:4001:827::200a
2a00:1450:4001:828::2003
52.18.26.20
52.218.132.72
0d36d92d7d9d576f51a6f701b3af4ba12048f76bbbb6414f27c64775e5e9bb0e
0eeb4ec8571a426f7168aa0aa95f3a738a0c45f71b919cfb49f648912b2b6640
0eec27514809087e7fb58d79375c8f02a119815a05f64be23f8b183ad5fffb24
11bfeecea66da8d57b9f331728a570a05e24f7b4ccfa7e892cd85cf8648fec10
1cf50fce22cab8aeb09e346375a1f60e56dad8730e09007e22d2fb363748f835
2054327b1f4678abefcf46666f6ab7d2fff992ee07e0e67aa9ee8d597c03657c
25b0a767ac27cbbae4a93304a133df738307dd875c7308b810df3675d3a7c4da
28f66deee24c2cf12b52454b0f250f2a566ca9047941c000684641a7e2d8bfe7
2d25294d8d2491718abdc042f646e68226e6c7735556026f0047d365bb39d665
2ddafcafa9f2e74f61f452f339cd3be01d15c6953a76fd5aa7f225be91395415
31d8631496cacac8ccd260ac5fb41e3e217506304f90750fd96609d91ae8720f
3cdf76e1b1eca61cae38592d84e5ea643354729d49b384b4868b7ac7de1ee21b
3de5d0840172ba83544f642e220744be71488c8dec83e98897ca7941cbac0577
3ee0806e69f2ae70a2267a58ac5fc5d52b5aa7aca6f3c0c08adad605fd8fbc16
4545eb1dec25fe868d19dc292d417d8a9e41c0276d75a4eaf524a9db21aa705a
50d39d7981a0feeddc52b74c4f4b32e680a3e16324d5eba9f599bf304c98bf44
56b15344c365a6f275ca7a21ede4b71c30af52cb0702e050898930c00353133a
5a3f1dd74233f605e511f1b5b244bedf85ac88ba264caf4d6401bc7ec2017dcd
5a8c623b34dcf729895c3bc9b6e261796bbad69555a21ad6d2f9b4e7bc27b6e7
5f3592a8b8037ea064764a2815799612063c6722d314d1d66d3a9391c3c16d66
62f3f809487194fcc55a3ebd88811a604ae496027bb425d4ebd15d9ae1921945
63271dcce1a2518271ecc2b0bdcc5afc9c5f0968a8635e0f97a4c9747309eb82
6af4c5d83ad420a883151cbfafafe1f32454d747898c7c6a8a2e0a38382e0d5d
6c4023ea3c54b3e24a8c64c0b286ec2f557a2004d5f8a3bb4778dc5b07f3eb78
742edbfdefc668641fe4ba894ee8972e5f29de9e378258b4474fa1a4976df915
776b528ea0ec5389029add85b6c11b00f09537ae3493920aae5e06e7b5c485ff
7f36d5a2641332462ece680dcf2c39e4fa9a1f3aa1aa2dfc29310d8267b57802
81016ac6be850b72df5d4faa0c3cec8e2c1b0ba0045712144a6766adfad40bee
839e69bb67d6619ad220da56cc6cedffa6c46a17baf6be369a6f2503310e97f6
83f85680c7e16e977d8c526d09728a72daeff03a8277c931a2a1d212d3366afe
8519a83a0bf9f9a7b88bd14a683d80844d60f0937d4c7be4940253f710034b50
8767f01caa430c5bd4e3b008a8e9dfe022156a4e91a23c394fdcb05c267f1b94
8a8bc347505ebacb1141ff2b952479b1beacfe943752cbe90aa396fe0500fbd9
90129d2ae550e56af645371ac1e647e78e7805f0b0000411a7df3b377dd802c2
965574e97c29813feaa62a0a149731306ee4725e027603b937905375d3121c89
9d2d8043c302d3a9da9277374a53e2285c471d5dc8397885b4931b82771d5cae
a841bef130ec17030c2aeebd167d596cd11e392b95ced387542b8789d36de5de
aaf6911906ab19ed6ee5418162e059bdae66a69391ce75a3233b466d8f201e04
ab9241a07a70085385b3b30dbf081ad3296f8a95a48bbf524c5eb74f0fc030a4
b82134c639003844fde7c5fb8c8575f1419bd789688a9cf6143837d609b68de8
c4e20f53f5ef0ed44b783437aa3f4638a9a56cc4aa29ae83ed9212eb2807052a
c8d05ff22dc9abbc2ddca82b06bbb518cad99464c0c73436645466fe4ef58a40
d10e701c44ab739c7d711b6483def0c6cd47e5a3d04eda1df2c5cbb08f21d81a
d1d819e2f04ad347b2c22e8d485c7a760d86639cfbf0b4b99a3594861592ed04
d2fca2ae6ff4ffea8690cb747cfb9237c873b227c4ad3425a1d84598c8bd0148
d715c9697c536edbef17984aa77a12ad749700f7061823a56af39328ce86de1d
d9a4514f330f7dbff481c9d392990313b157286733633627d6e7e6f86f2f10c6
dec277a0ddbe3c8a386e8c85a7b3ac3b85e9fa2067d8dc4e19287fa67631ae68
e00d0f7929964c2fe988a07e9e2a5e52c23bf83dafaa8ca19699ae6b4833e25d
e25106e32025c00d1fe6cd2e188410655fa79887bd77c72da445976f9d59dc43
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
eb14baeac955bb11e33cd7fd3fd2f698cf20db1b450325f45ea843b6cdc82366
eb8c493aa019414d4b1bbacb9bda24bf3d73b4fd1e96a4336084ab65e1e71877
ec472e0417348de6e89aa5195252bca83e57f8864d4a14dd4661749acb679cdd
f0707fc954dcefc706e18b72f96bd9a03d6bdc06ee76f440b518cbed5b671ac0
f1becc4ae821ee6d6e1844dd93156dae8cc5c1a078bf6595ca7f1d055bf28f10
f4e7e734d4e58238bc75a6efdd29e767a380f3b767031ce8d32aa76edf1e3d86
f5ed36e00edda3a3632d35f8db25fbe717d14275ae027135820269a568211500
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

positive.security Open in urlscan Pro 52.18.26.20 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

53 Requests

100 %HTTPS

60 %IPv6

8 Domains

10 Subdomains

11 IPs

3 Countries

1263 kBTransfer

1713 kBSize

0 Cookies

35 Outgoing links

Redirected requests

53 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 7 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

positive.security Open in urlscan Pro
52.18.26.20 Public Scan

Screenshot
Live screenshot

Full Image

53
Requests

100 %
HTTPS

60 %
IPv6

8
Domains

10
Subdomains

11
IPs

3
Countries

1263 kB
Transfer

1713 kB
Size

0
Cookies

53 HTTP transactions
7 data transactions