urlscan.io logo urlscan.io
SecurityTrails logo

blog.oversecured.com Open in urlscan Pro
143.204.89.113  Public Scan

Go To Rescan Add Verdict Report
URL: https://blog.oversecured.com/Android-arbitrary-code-execution-via-third-party-package-contexts/
Submission: On July 15 via api from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 5 IPs in 3 countries across 5 domains to perform 17 HTTP transactions. The main IP is 143.204.89.113, located in Seattle, United States and belongs to AMAZON-02, US. The main domain is blog.oversecured.com.
TLS certificate: Issued by Amazon on January 3rd 2020. Valid for: a year.
This is the only time blog.oversecured.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
12 143.204.89.113 16509 (AMAZON-02)
2 2606:4700::68... 13335 (CLOUDFLAR...)
1 2001:4de0:ac1... 20446 (HIGHWINDS3)
1 2 104.18.129.189 13335 (CLOUDFLAR...)
1 2a00:1450:400... 15169 (GOOGLE)
17 5
12    143.204.89.113 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-89-113.fra50.r.cloudfront.net
blog.oversecured.com
2    2606:4700::6810:84e5 (United States)

ASN13335 (CLOUDFLARENET, US)
cdnjs.cloudflare.com
1    2001:4de0:ac19::1:b:2a (Netherlands)

ASN20446 (HIGHWINDS3, US)
code.jquery.com
2    104.18.129.189 (United States)

ASN13335 (CLOUDFLARENET, US)
demo.ghost.io
1    2a00:1450:4001:816::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google-analytics.com
Domain Requested by
12 blog.oversecured.com blog.oversecured.com
2 demo.ghost.io 1 redirects blog.oversecured.com
2 cdnjs.cloudflare.com blog.oversecured.com
1 www.google-analytics.com blog.oversecured.com
1 code.jquery.com blog.oversecured.com
17 5

This site contains links to these domains. Also see Links.

Domain
github.com
oversecured.com
twitter.com
www.facebook.com
Subject Issuer Validity Valid
*.oversecured.com
Amazon		 2020-01-03 -
2021-02-03		 a year crt.sh
cloudflare.com
Cloudflare Inc ECC CA-3		 2020-07-04 -
2021-07-04		 a year crt.sh
jquery.org
COMODO RSA Domain Validation Secure Server CA		 2018-10-17 -
2020-10-16		 2 years crt.sh
ssl424449.cloudflaressl.com
COMODO ECC Domain Validation Secure Server CA 2		 2020-05-20 -
2020-11-26		 6 months crt.sh
*.google-analytics.com
GTS CA 1O1		 2020-06-30 -
2020-09-22		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://blog.oversecured.com/Android-arbitrary-code-execution-via-third-party-package-contexts/
Frame ID: 0FA9F517803105F2B0CDA327EAB57214
Requests: 17 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • meta generator /Jekyll (v[\d.]+)?/i
Overall confidence: 100%
Detected patterns
  • headers via /\(CloudFront\)$/i
  • headers server /^AmazonS3$/i
Overall confidence: 100%
Detected patterns
  • headers via /\(CloudFront\)$/i
Overall confidence: 100%
Detected patterns
  • headers server /^AmazonS3$/i
Overall confidence: 100%
Detected patterns
  • script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

Page Statistics

17
Requests

100 %
HTTPS

60 %
IPv6

5
Domains

5
Subdomains

5
IPs

3
Countries

1113 kB
Transfer

1194 kB
Size

2
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 12
  • https://demo.ghost.io/assets/js/jquery.fitvids.js?v=724281a32e HTTP 301
  • https://demo.ghost.io/assets/js/jquery.fitvids.js/?v=724281a32e

17 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
blog.oversecured.com/Android-arbitrary-code-execution-via-third-party-package-contexts/ 		28 KB
28 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://blog.oversecured.com/Android-arbitrary-code-execution-via-third-party-package-contexts/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
143.204.89.113 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-89-113.fra50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
8ce1553c905d3f4b820d01cbfae047ac599619f74bd75ef16b45bb398d3524b1

Request headers

:method
GET
:authority
blog.oversecured.com
:scheme
https
:path
/Android-arbitrary-code-execution-via-third-party-package-contexts/
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status
200
content-type
text/html
content-length
28358
date
Tue, 14 Jul 2020 22:52:46 GMT
last-modified
Tue, 14 Jul 2020 22:50:10 GMT
etag
"aeea86be396f4784098eaba9b2ab6e88"
server
AmazonS3
x-cache
Hit from cloudfront
via
1.1 479d15a99f4dd073131fba1516541469.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA50-C1
x-amz-cf-id
mLmUO5RV96C3vREjfD8D9ZQy7ojF33qUFLMjDxqRHz_MIa-8SerjMg==
age
60355
screen.css
blog.oversecured.com/assets/built/ 		32 KB
32 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://blog.oversecured.com/assets/built/screen.css
Requested by
Host: blog.oversecured.com
URL: https://blog.oversecured.com/Android-arbitrary-code-execution-via-third-party-package-contexts/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
143.204.89.113 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-89-113.fra50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
77ab471e1da48cd23aa95af168da97d7b946f09b67379058fc0db09049ead0d6

Request headers

Referer
https://blog.oversecured.com/Android-arbitrary-code-execution-via-third-party-package-contexts/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 14 Jul 2020 22:53:07 GMT
via
1.1 479d15a99f4dd073131fba1516541469.cloudfront.net (CloudFront)
last-modified
Tue, 14 Jul 2020 22:50:10 GMT
server
AmazonS3
age
60334
etag
"ae7f3d02c1e7bbcdd4868169d5f785eb"
x-cache
Hit from cloudfront
content-type
text/css
status
200
x-amz-cf-pop
FRA50-C1
content-length
32816
x-amz-cf-id
5IsM4dj706QNl1czxHK3aR-3vUclPZlDNqQ6ZjF4x7aPxIuT2gWimA==
screen.edited.css
blog.oversecured.com/assets/built/ 		2 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://blog.oversecured.com/assets/built/screen.edited.css
Requested by
Host: blog.oversecured.com
URL: https://blog.oversecured.com/Android-arbitrary-code-execution-via-third-party-package-contexts/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
143.204.89.113 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-89-113.fra50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
4ce9b8c78efab8fcb6314d9eef206525a0eac074f0da347ba9b8e4cb1946dcf9

Request headers

Referer
https://blog.oversecured.com/Android-arbitrary-code-execution-via-third-party-package-contexts/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 14 Jul 2020 22:53:07 GMT
via
1.1 479d15a99f4dd073131fba1516541469.cloudfront.net (CloudFront)
last-modified
Tue, 14 Jul 2020 22:50:10 GMT
server
AmazonS3
age
60334
etag
"89b4d6ad47eeb7bb3ad2e82a1ea027d7"
x-cache
Hit from cloudfront
content-type
text/css
status
200
x-amz-cf-pop
FRA50-C1
content-length
1619
x-amz-cf-id
L97I67MhjVsZXzeXAJLEsN5o51k7DimBjmNpseWBaCbhy8lOerEojg==
syntax.css
blog.oversecured.com/assets/built/ 		6 KB
6 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://blog.oversecured.com/assets/built/syntax.css
Requested by
Host: blog.oversecured.com
URL: https://blog.oversecured.com/Android-arbitrary-code-execution-via-third-party-package-contexts/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
143.204.89.113 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-89-113.fra50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
fca69ce546ab1de51cf7b013e76b3b1909bf7f7994eb2a4c49551d51a1e93289

Request headers

Referer
https://blog.oversecured.com/Android-arbitrary-code-execution-via-third-party-package-contexts/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 14 Jul 2020 22:53:07 GMT
via
1.1 479d15a99f4dd073131fba1516541469.cloudfront.net (CloudFront)
last-modified
Tue, 14 Jul 2020 22:50:10 GMT
server
AmazonS3
age
60334
etag
"fa940ae09e807f234e9b44427fc482ef"
x-cache
Hit from cloudfront
content-type
text/css
status
200
x-amz-cf-pop
FRA50-C1
content-length
5784
x-amz-cf-id
gCdLF6ej00EOZ9X3rKUlAw8waMa5EsdzIrAjWsY6VVJ_b8veu3r8MA==
default.min.css
cdnjs.cloudflare.com/ajax/libs/highlight.js/9.12.0/styles/ 		776 B
723 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/highlight.js/9.12.0/styles/default.min.css
Requested by
Host: blog.oversecured.com
URL: https://blog.oversecured.com/Android-arbitrary-code-execution-via-third-party-package-contexts/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:84e5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
65dd6271f67bd94066b0877f99471a82b98dec8379424aef87be480872105539
Security Headers
Name Value
Strict-Transport-Security max-age=15780000; includeSubDomains

Request headers

Referer
https://blog.oversecured.com/Android-arbitrary-code-execution-via-third-party-package-contexts/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 15 Jul 2020 15:38:40 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
age
22493446
status
200
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
03f4b9d24e0000324cdc864200000001
served-in-seconds
0.001
timing-allow-origin
*
last-modified
Thu, 17 May 2018 09:20:13 GMT
server
cloudflare
etag
W/"5afd494d-308"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15780000; includeSubDomains
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=30672000
cf-ray
5b349263b984324c-FRA
expires
Mon, 05 Jul 2021 15:38:40 GMT
blog-icon.png
blog.oversecured.com/assets/images/ 		11 KB
11 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.oversecured.com/assets/images/blog-icon.png
Requested by
Host: blog.oversecured.com
URL: https://blog.oversecured.com/Android-arbitrary-code-execution-via-third-party-package-contexts/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
143.204.89.113 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-89-113.fra50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
846c72e2aa14e98df4c692c84eb7515240e5b6e372115a64a2716f46d17694df

Request headers

Referer
https://blog.oversecured.com/Android-arbitrary-code-execution-via-third-party-package-contexts/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 14 Jul 2020 22:53:07 GMT
via
1.1 479d15a99f4dd073131fba1516541469.cloudfront.net (CloudFront)
last-modified
Tue, 14 Jul 2020 22:50:10 GMT
server
AmazonS3
age
60334
etag
"3e5377c89cc42ace35562fff86c91ebf"
x-cache
Hit from cloudfront
content-type
image/png
status
200
x-amz-cf-pop
FRA50-C1
content-length
11432
x-amz-cf-id
g3aSjj5xQB7Ofluw5miFQ627N1pBjCKgaZu8j4XEHmg4fpG-QXW1jw==
pic1_07-14.png
blog.oversecured.com/assets/images/ 		9 KB
9 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.oversecured.com/assets/images/pic1_07-14.png
Requested by
Host: blog.oversecured.com
URL: https://blog.oversecured.com/Android-arbitrary-code-execution-via-third-party-package-contexts/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
143.204.89.113 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-89-113.fra50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
4a8106963d0fa3c7378c81bc0ed6526e79320eac08546f8d6d8807f9ac3645dc

Request headers

Referer
https://blog.oversecured.com/Android-arbitrary-code-execution-via-third-party-package-contexts/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 14 Jul 2020 22:53:10 GMT
via
1.1 479d15a99f4dd073131fba1516541469.cloudfront.net (CloudFront)
last-modified
Tue, 14 Jul 2020 22:50:10 GMT
server
AmazonS3
age
60331
etag
"6f986a010355039353299de77008535c"
x-cache
Hit from cloudfront
content-type
image/png
status
200
x-amz-cf-pop
FRA50-C1
content-length
9019
x-amz-cf-id
b4GkENsSOOioPwD9IEsdFKmBE3QY8g07tx5uEpoCgxqoO6jsWN9utQ==
vulnerability.png
blog.oversecured.com/assets/images/ 		891 KB
892 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.oversecured.com/assets/images/vulnerability.png
Requested by
Host: blog.oversecured.com
URL: https://blog.oversecured.com/Android-arbitrary-code-execution-via-third-party-package-contexts/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
143.204.89.113 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-89-113.fra50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
215bb745b8cf9ca4c033e2ae6fe81382a7f49991dad33a8cd1ea92182ada8f5b

Request headers

Referer
https://blog.oversecured.com/Android-arbitrary-code-execution-via-third-party-package-contexts/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 14 Jul 2020 23:09:42 GMT
via
1.1 479d15a99f4dd073131fba1516541469.cloudfront.net (CloudFront)
last-modified
Tue, 14 Jul 2020 22:50:10 GMT
server
AmazonS3
age
59339
etag
"007b817a20cd3fb262e4b9a99f2f29c7"
x-cache
Hit from cloudfront
content-type
image/png
status
200
x-amz-cf-pop
FRA50-C1
content-length
912404
x-amz-cf-id
ScwP4vFuyQTh9p3eZqvfWj_IfDrPyaDooBlBDDKmDQR01gC4epYfEQ==
favicon.ico
blog.oversecured.com/assets/images/ 		15 KB
15 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.oversecured.com/assets/images/favicon.ico
Requested by
Host: blog.oversecured.com
URL: https://blog.oversecured.com/Android-arbitrary-code-execution-via-third-party-package-contexts/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
143.204.89.113 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-89-113.fra50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
f32ac2f2ed24b445e72af2cdd0ec92cbe791c28343ca55f394a3e89a7f8cba05

Request headers

Referer
https://blog.oversecured.com/Android-arbitrary-code-execution-via-third-party-package-contexts/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 14 Jul 2020 22:53:07 GMT
via
1.1 479d15a99f4dd073131fba1516541469.cloudfront.net (CloudFront)
last-modified
Tue, 14 Jul 2020 22:50:10 GMT
server
AmazonS3
age
60334
etag
"12f3560f1a2f3c9fb9e9c04e919bcf8e"
x-cache
Hit from cloudfront
content-type
image/vnd.microsoft.icon
status
200
x-amz-cf-pop
FRA50-C1
content-length
15086
x-amz-cf-id
LJ50Dz3sn440hknYtTrgNLYvrA_McvwuqlF74aku1Rzvo6ZsaqARtw==
favicon.svg
blog.oversecured.com/assets/images/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.oversecured.com/assets/images/favicon.svg
Requested by
Host: blog.oversecured.com
URL: https://blog.oversecured.com/Android-arbitrary-code-execution-via-third-party-package-contexts/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
143.204.89.113 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-89-113.fra50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
f7f545eddf2fc7da74b7aaa838f28e2fa64972d2589beb61f16b176bf5566722

Request headers

Referer
https://blog.oversecured.com/Android-arbitrary-code-execution-via-third-party-package-contexts/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 14 Jul 2020 22:53:10 GMT
via
1.1 479d15a99f4dd073131fba1516541469.cloudfront.net (CloudFront)
last-modified
Tue, 14 Jul 2020 22:50:10 GMT
server
AmazonS3
age
60331
etag
"94fa1ddf055bad5732447ce76aee9ad5"
x-cache
Hit from cloudfront
content-type
image/svg+xml
status
200
x-amz-cf-pop
FRA50-C1
content-length
1859
x-amz-cf-id
FpMPWQdZPx7s1Q4qn8OOiz8EcCe0OFcj4L6CMfdu2hXGj4cLDwZbeQ==
prism-abap.min.js
cdnjs.cloudflare.com/ajax/libs/prism/1.10.0/components/ 		8 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/prism/1.10.0/components/prism-abap.min.js
Requested by
Host: blog.oversecured.com
URL: https://blog.oversecured.com/Android-arbitrary-code-execution-via-third-party-package-contexts/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:84e5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
113ad32dec14a1f35f5fbe4a6490d9c58d49be9c31658dac53c704412eb6839a
Security Headers
Name Value
Strict-Transport-Security max-age=15780000; includeSubDomains

Request headers

Referer
https://blog.oversecured.com/Android-arbitrary-code-execution-via-third-party-package-contexts/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 15 Jul 2020 15:38:40 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
age
7293731
status
200
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
03f4b9d2540000324cdc865200000001
served-in-seconds
0.001
timing-allow-origin
*
last-modified
Thu, 17 May 2018 09:26:22 GMT
server
cloudflare
etag
W/"5afd4abe-1ef4"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15780000; includeSubDomains
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
cf-ray
5b349263b99b324c-FRA
expires
Mon, 05 Jul 2021 15:38:40 GMT
jquery-3.2.1.min.js
code.jquery.com/ 		85 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://code.jquery.com/jquery-3.2.1.min.js
Requested by
Host: blog.oversecured.com
URL: https://blog.oversecured.com/Android-arbitrary-code-execution-via-third-party-package-contexts/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4de0:ac19::1:b:2a , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software
nginx /
Resource Hash
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://blog.oversecured.com/Android-arbitrary-code-execution-via-third-party-package-contexts/
Origin
https://blog.oversecured.com

Response headers

date
Wed, 15 Jul 2020 15:38:40 GMT
content-encoding
gzip
last-modified
Mon, 20 Mar 2017 19:01:15 GMT
server
nginx
status
200
etag
W/"58d026fb-15283"
vary
Accept-Encoding
x-hw
1594827520.dop123.fr8.t,1594827520.cds233.fr8.hc,1594827520.cds133.fr8.c
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=315360000, public
accept-ranges
bytes
content-length
30125
jquery.fitvids.js
blog.oversecured.com/assets/js/ 		3 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://blog.oversecured.com/assets/js/jquery.fitvids.js
Requested by
Host: blog.oversecured.com
URL: https://blog.oversecured.com/Android-arbitrary-code-execution-via-third-party-package-contexts/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
143.204.89.113 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-89-113.fra50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
6e3fc9948343d85d59440451c12f2de1ddb6c2132ae503314f6ac6b3f87218a8

Request headers

Referer
https://blog.oversecured.com/Android-arbitrary-code-execution-via-third-party-package-contexts/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 14 Jul 2020 23:09:35 GMT
via
1.1 479d15a99f4dd073131fba1516541469.cloudfront.net (CloudFront)
last-modified
Tue, 14 Jul 2020 22:50:10 GMT
server
AmazonS3
age
59345
etag
"3cf0415f27458151d8ed390eb699752e"
x-cache
Hit from cloudfront
content-type
application/javascript
status
200
x-amz-cf-pop
FRA50-C1
content-length
3446
x-amz-cf-id
e45waXBPV9dDRl3vBPsNMN4I6e_LO1MQ4w2yor8bpHaMeDMpEHmi9g==
/
demo.ghost.io/assets/js/jquery.fitvids.js/
Redirect Chain
  • https://demo.ghost.io/assets/js/jquery.fitvids.js?v=724281a32e
  • https://demo.ghost.io/assets/js/jquery.fitvids.js/?v=724281a32e
0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://demo.ghost.io/assets/js/jquery.fitvids.js/?v=724281a32e
Requested by
Host: blog.oversecured.com
URL: https://blog.oversecured.com/Android-arbitrary-code-execution-via-third-party-package-contexts/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.129.189 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Referer
https://blog.oversecured.com/Android-arbitrary-code-execution-via-third-party-package-contexts/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Redirect headers

date
Wed, 15 Jul 2020 15:38:40 GMT
cf-cache-status
HIT
age
965003
x-cache
HIT
status
301, 301 Moved Permanently
content-length
0
cf-request-id
03f4b9d31100009c33fb220200000001
x-request-id
b53c26134eac6f276db144639f91390c, 32af2ced82a5426a8ad3ca0aa8ee2539
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
location
/assets/js/jquery.fitvids.js/?v=724281a32e
x-ghost-cache-status
[03] No Cache
cache-control
public, max-age=31536000
cf-ray
5b349264ec609c33-AMS
expires
Thu, 15 Jul 2021 15:38:40 GMT
androidBack2.svg
blog.oversecured.com/assets/images/ 		15 KB
15 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.oversecured.com/assets/images/androidBack2.svg
Requested by
Host: blog.oversecured.com
URL: https://blog.oversecured.com/Android-arbitrary-code-execution-via-third-party-package-contexts/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
143.204.89.113 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-89-113.fra50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
a86d5d2eb1b71abf4caf56ba130368e89c78d24de7e4c6ae3e5cc01eb465ccea

Request headers

Referer
https://blog.oversecured.com/Android-arbitrary-code-execution-via-third-party-package-contexts/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 14 Jul 2020 22:53:07 GMT
via
1.1 479d15a99f4dd073131fba1516541469.cloudfront.net (CloudFront)
last-modified
Tue, 14 Jul 2020 22:50:10 GMT
server
AmazonS3
age
60334
etag
"3d0259b8c851ff9dcbe0346eb89cbca7"
x-cache
Hit from cloudfront
content-type
image/svg+xml
status
200
x-amz-cf-pop
FRA50-C1
content-length
15396
x-amz-cf-id
LRltbp7hMnUpcEb95vkOap4RegeRV54EBhF-jrGjLNct8fhzqzUjhA==
helloworld.jpg
blog.oversecured.com/assets/images/ 		43 KB
43 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.oversecured.com/assets/images/helloworld.jpg
Requested by
Host: blog.oversecured.com
URL: https://blog.oversecured.com/Android-arbitrary-code-execution-via-third-party-package-contexts/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
143.204.89.113 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-89-113.fra50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
5cd43c2e6ebadb2c95b1abc582f36867e8ad138bc668a677430f7815c142c493

Request headers

Referer
https://blog.oversecured.com/Android-arbitrary-code-execution-via-third-party-package-contexts/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 14 Jul 2020 22:53:07 GMT
via
1.1 479d15a99f4dd073131fba1516541469.cloudfront.net (CloudFront)
last-modified
Tue, 14 Jul 2020 22:50:10 GMT
server
AmazonS3
age
60334
etag
"265a2ecb30a32c8692acb1e10b0f647d"
x-cache
Hit from cloudfront
content-type
image/jpeg
status
200
x-amz-cf-pop
FRA50-C1
content-length
43749
x-amz-cf-id
3vzvrzG9f8ZMpJ1tLM5LCSFAXkyTryG5jDB4nY-z_3L6kF21X6ZFtA==
analytics.js
www.google-analytics.com/ 		45 KB
18 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: blog.oversecured.com
URL: https://blog.oversecured.com/Android-arbitrary-code-execution-via-third-party-package-contexts/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:816::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
fd361b57998c76f86335afa28b8a62527d88a8200fb5c428d6f0fff73383e955
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://blog.oversecured.com/Android-arbitrary-code-execution-via-third-party-package-contexts/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 04 Jun 2020 23:38:14 GMT
server
Golfe2
age
4981
date
Wed, 15 Jul 2020 14:15:40 GMT
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=7200
alt-svc
h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
18469
expires
Wed, 15 Jul 2020 16:15:40 GMT

Verdicts & Comments Add Verdict or Comment

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery string| GoogleAnalyticsObject function| ga object| google_tag_data object| gaplugins object| gaGlobal object| gaData

2 Cookies

Domain/Path Name / Value
.oversecured.com/ Name: _gid
Value: GA1.2.1820689673.1594827521
.oversecured.com/ Name: _ga
Value: GA1.2.981901876.1594827521