www.ired.team Open in urlscan Pro
2606:4700::6812:91 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.ired.team/offensive-security/defense-evasion/retrieving-ntdll-syscall-stubs-at-run-time
Submission Tags: falconsandbox
Submission: On June 03 via api (June 3rd 2021, 3:04:39 pm UTC) from US

Summary HTTP 46 Redirects Links 9 Behaviour Indicators

Summary

This website contacted 12 IPs in 2 countries across 11 domains to perform 46 HTTP transactions. The main IP is 2606:4700::6812:91, located in United States and belongs to CLOUDFLARENET, US. The main domain is www.ired.team.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on November 27th 2020. Valid for: a year.

This is the only time www.ired.team was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1	2606:4700::68... 2606:4700::6812:91	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:802::200a	15169 (GOOGLE) (GOOGLE)
1	2606:4700::68... 2606:4700::6810:7aaf	13335 (CLOUDFLAR...) (CLOUDFLARENET)
23	2606:4700::68... 2606:4700::6812:86f	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a04:4e42::621 2a04:4e42::621	54113 (FASTLY) (FASTLY)
2	2a00:1450:400... 2a00:1450:4001:80e::2001	15169 (GOOGLE) (GOOGLE)
4	185.199.109.154 185.199.109.154	54113 (FASTLY) (FASTLY)
1	2a00:1450:400... 2a00:1450:4001:829::2003	15169 (GOOGLE) (GOOGLE)
1	2606:4700:303... 2606:4700:3035::6815:327f	13335 (CLOUDFLAR...) (CLOUDFLARENET)
7	2600:1901:0:9... 2600:1901:0:94b6::	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:827::200e	15169 (GOOGLE) (GOOGLE)
46	12

1 2606:4700::6812:91 (United States)

ASN13335 (CLOUDFLARENET, US)

www.ired.team	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:802::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:7aaf (United States)

ASN13335 (CLOUDFLARENET, US)

unpkg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

23 2606:4700::6812:86f (United States)

ASN13335 (CLOUDFLARENET, US)

gstatic.gitbook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
gblobscdn.gitbook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
app.gitbook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.gitbook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42::621 (United States)

ASN54113 (FASTLY, US)

polyfill.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:80e::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

lh5.googleusercontent.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 185.199.109.154 (United States)

ASN54113 (FASTLY, US)
PTR: cdn-185-199-109-154.github.com

opengraph.githubassets.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:829::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3035::6815:327f (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.lr-ingest.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2600:1901:0:94b6:: (Kansas City, United States)

ASN15169 (GOOGLE, US)

gitbook-28427.firebaseio.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
s-usc1c-nss-232.firebaseio.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:827::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
23	gitbook.com gstatic.gitbook.com gblobscdn.gitbook.com app.gitbook.com www.gitbook.com	4 MB
7	firebaseio.com gitbook-28427.firebaseio.com s-usc1c-nss-232.firebaseio.com	3 KB
4	githubassets.com opengraph.githubassets.com	443 KB
3	google-analytics.com www.google-analytics.com	19 KB
2	googleusercontent.com lh5.googleusercontent.com	14 KB
1	lr-ingest.io cdn.lr-ingest.io	133 KB
1	gstatic.com fonts.gstatic.com	13 KB
1	polyfill.io polyfill.io	559 B
1	unpkg.com unpkg.com	14 KB
1	googleapis.com fonts.googleapis.com	660 B
1	ired.team www.ired.team	436 KB
46	11

	Domain	Requested by
13	gblobscdn.gitbook.com	www.ired.team gstatic.gitbook.com
8	gstatic.gitbook.com	www.ired.team gstatic.gitbook.com
6	s-usc1c-nss-232.firebaseio.com	gstatic.gitbook.com
4	opengraph.githubassets.com	www.ired.team
3	www.google-analytics.com	gstatic.gitbook.com
2	lh5.googleusercontent.com	www.ired.team gstatic.gitbook.com
1	www.gitbook.com	gstatic.gitbook.com
1	gitbook-28427.firebaseio.com	gstatic.gitbook.com
1	app.gitbook.com	gstatic.gitbook.com
1	cdn.lr-ingest.io	gstatic.gitbook.com
1	fonts.gstatic.com	fonts.googleapis.com
1	polyfill.io	www.ired.team
1	unpkg.com	www.ired.team
1	fonts.googleapis.com	www.ired.team
1	www.ired.team
46	15

This site contains links to these domains. Also see Links.

Domain
www.linkedin.com
github.com
twitter.com
www.patreon.com
www.gitbook.com

Subject Issuer	Validity	Valid
www.ired.team Cloudflare Inc ECC CA-3	`2020-11-27` - `2021-11-26`	a year	crt.sh
upload.video.google.com GTS CA 1O1	`2021-05-03` - `2021-07-26`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2020-08-02` - `2021-08-02`	a year	crt.sh
f3.shared.global.fastly.net GlobalSign CloudSSL CA - SHA256 - G3	`2021-05-18` - `2022-03-26`	10 months	crt.sh
*.googleusercontent.com GTS CA 1C3	`2021-05-10` - `2021-08-02`	3 months	crt.sh
*.githubassets.com DigiCert SHA2 High Assurance Server CA	`2020-11-02` - `2021-11-09`	a year	crt.sh
*.google.com GTS CA 1O1	`2021-05-03` - `2021-07-26`	3 months	crt.sh
firebaseio.com GTS CA 1O1	`2021-01-12` - `2021-07-11`	6 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2021-05-10` - `2021-08-02`	3 months	crt.sh

This page contains 3 frames:

Primary Page: https://www.ired.team/offensive-security/defense-evasion/retrieving-ntdll-syscall-stubs-at-run-time
Frame ID: 93E9134747C764502EC142A197C7932F
Requests: 39 HTTP requests in this frame

Frame: https://gitbook-28427.firebaseio.com/.lp?start=t&ser=49915102&cb=1&v=5
Frame ID: 3E3B41D794E18C17CF68AA57190DFF7C
Requests: 6 HTTP requests in this frame

Frame: https://s-usc1c-nss-232.firebaseio.com/.lp?dframe=t&id=11243012&pw=XVsOvKIVCV&ns=gitbook-28427
Frame ID: 8E8E7CBAAD70775A6BD9E8DD2442C088
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /^cloudflare$/i

Page Statistics

46
Requests

98 %
HTTPS

91 %
IPv6

11
Domains

15
Subdomains

12
IPs

2
Countries

5403 kB
Transfer

11846 kB
Size

5
Cookies

9 Outgoing links

These are links going to different origins than the main page.

URL: https://www.linkedin.com/in/mantvydasb/
Title: linkedin

Search URL Search Domain Scan URL

URL: https://github.com/mantvydasb/RedTeam-Tactics-and-Techniques
Title: github

Search URL Search Domain Scan URL

URL: https://twitter.com/spotheplanet
Title: @spotheplanet

Search URL Search Domain Scan URL

URL: https://www.patreon.com/iredteam
Title: patreon

Search URL Search Domain Scan URL

URL: https://www.gitbook.com/?utm_source=content&utm_medium=trademark&utm_campaign=mantvydas
Title: Powered by GitBook

Search URL Search Domain Scan URL

URL: https://twitter.com/am0nsec
Title: am0nsec

Search URL Search Domain Scan URL

URL: https://twitter.com/RtlMateusz
Title: RtlMateusz

Search URL Search Domain Scan URL

URL: https://github.com/am0nsec/HellsGate
Title: https://github.com/am0nsec/HellsGate

Search URL Search Domain Scan URL

URL: https://github.com/odzhan/injection/blob/ad8e7a11899ffb2d9467a8ea44c6f3755d13b00e/syscalls/inject_dll.c#L260
Title: odzhan/injectionWindows process injection methods. Contribute to odzhan/injection development by creating an account on GitHub.github.com

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

46 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request retrieving-ntdll-syscall-stubs-at-run-time Show response
www.ired.team/offensive-security/defense-evasion/ 2 MB
436 KB 2312ms
2276ms Document
text/html 2606:4700::6812:91
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.ired.team/offensive-security/defense-evasion/retrieving-ntdll-syscall-stubs-at-run-time

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:91 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c2751a024906377b9ec771173eb7b4c2cbd91766d245781f5d1546903125b807

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' gstatic.gitbook.com .gitbook-staging.com .gitbook.com .firebaseio.com wss://.firebaseio.com .cloudfunctions.net .googleapis.com .gstatic.com data: .google.com .github.com .algolianet.com .algolia.net sentry.io .logrocket.io .lr-ingest.io .stripe.com .clearbit.com .google-analytics.com d3hb14vkzrxvla.cloudfront.net d1j8pt39hxlh3d.cloudfront.net .iframe.ly blob: cdn.jsdelivr.net cdnjs.cloudflare.com api.amplitude.com https://api.intercom.io https://api-iam.intercom.io https://api-ping.intercom.io https://nexus-websocket-a.intercom.io https://nexus-websocket-b.intercom.io https://nexus-long-poller-a.intercom.io https://nexus-long-poller-b.intercom.io wss://nexus-websocket-a.intercom.io wss://nexus-websocket-b.intercom.io https://uploads.intercomcdn.com https://uploads.intercomusercontent.com https://share.intercom.io https://intercom-sheets.com https://www.intercom-reporting.com https://www.youtube.com https://player.vimeo.com https://fast.wistia.net https://js.intercomcdn.com https://intercom.help; script-src 'self' gstatic.gitbook.com 'unsafe-inline' .firebaseio.com .google.com polyfill.io cdn.lr-ingest.io cdn.logrocket.io .stripe.com .clearbit.com .google-analytics.com .iframe.ly .gstatic.com cdnjs.cloudflare.com .intercom.io .intercomcdn.com gitbookio.github.io https://app.intercom.io https://widget.intercom.io https://js.intercomcdn.com; style-src 'self' gstatic.gitbook.com 'unsafe-inline' fonts.googleapis.com unpkg.com cdnjs.cloudflare.com cdn.jsdelivr.net; img-src * data: blob: https://js.intercomcdn.com https://static.intercomassets.com https://downloads.intercomcdn.com https://uploads.intercomusercontent.com https://gifs.intercomcdn.com https://messenger-apps.intercom.io https://.intercom-attachments.com; frame-src ; object-src 'none'; child-src 'self' blob:; worker-src 'self' blob:; frame-ancestors https:
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.ired.team
:scheme: https
:path: /offensive-security/defense-evasion/retrieving-ntdll-syscall-stubs-at-run-time
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 03 Jun 2021 15:04:20 GMT
content-type: text/html; charset=utf-8
cf-ray: 6599d02a2f6b9736-FRA
cache-control: public, max-age=86400, s-maxage=86400, stale-while-revalidate=3600, stale-if-error=43200
strict-transport-security: max-age=31536000; includeSubDomains
vary: Accept-Encoding, Authorization, Cookie, X-CDN-Host
cf-cache-status: MISS
cf-request-id: 0a74006e5900009736e6147000000001
content-security-policy: default-src 'self' gstatic.gitbook.com *.gitbook-staging.com *.gitbook.com *.firebaseio.com wss://*.firebaseio.com *.cloudfunctions.net *.googleapis.com *.gstatic.com data: *.google.com *.github.com *.algolianet.com *.algolia.net sentry.io *.logrocket.io *.lr-ingest.io *.stripe.com *.clearbit.com *.google-analytics.com d3hb14vkzrxvla.cloudfront.net d1j8pt39hxlh3d.cloudfront.net *.iframe.ly blob: cdn.jsdelivr.net cdnjs.cloudflare.com api.amplitude.com https://api.intercom.io https://api-iam.intercom.io https://api-ping.intercom.io https://nexus-websocket-a.intercom.io https://nexus-websocket-b.intercom.io https://nexus-long-poller-a.intercom.io https://nexus-long-poller-b.intercom.io wss://nexus-websocket-a.intercom.io wss://nexus-websocket-b.intercom.io https://uploads.intercomcdn.com https://uploads.intercomusercontent.com https://share.intercom.io https://intercom-sheets.com https://www.intercom-reporting.com https://www.youtube.com https://player.vimeo.com https://fast.wistia.net https://js.intercomcdn.com https://intercom.help; script-src 'self' gstatic.gitbook.com 'unsafe-inline' *.firebaseio.com *.google.com polyfill.io cdn.lr-ingest.io cdn.logrocket.io *.stripe.com *.clearbit.com *.google-analytics.com *.iframe.ly *.gstatic.com cdnjs.cloudflare.com *.intercom.io *.intercomcdn.com gitbookio.github.io https://app.intercom.io https://widget.intercom.io https://js.intercomcdn.com; style-src 'self' gstatic.gitbook.com 'unsafe-inline' fonts.googleapis.com unpkg.com cdnjs.cloudflare.com cdn.jsdelivr.net; img-src * data: blob: https://js.intercomcdn.com https://static.intercomassets.com https://downloads.intercomcdn.com https://uploads.intercomusercontent.com https://gifs.intercomcdn.com https://messenger-apps.intercom.io https://*.intercom-attachments.com; frame-src *; object-src 'none'; child-src 'self' blob:; worker-src 'self' blob:; frame-ancestors https:
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
function-execution-id: 9n8lssor3kc2
referrer-policy: no-referrer-when-downgrade
x-cdn-cache-group: -LFEMnER3fywgFHoroYn
x-cloud-trace-context: da626682a785b966e28240155285d275
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-download-options: noopen
x-permitted-cross-domain-policies: none
x-xss-protection: 1; mode=block
server: cloudflare
content-encoding: gzip

GET
H2 200 css
fonts.googleapis.com/ 2 KB
660 B 28ms
27ms Stylesheet
text/css 2a00:1450:4001:802::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Source+Code+Pro:500&display=swap

Requested by

Host: www.ired.team
URL: https://www.ired.team/offensive-security/defense-evasion/retrieving-ntdll-syscall-stubs-at-run-time

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

6da43a0ac4abcb5bc4b10164a762759e5cc81f37e00033643034a891fb490c82

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.ired.team/offensive-security/defense-evasion/retrieving-ntdll-syscall-stubs-at-run-time
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Thu, 03 Jun 2021 14:37:59 GMT
server: ESF
date: Thu, 03 Jun 2021 15:04:20 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 03 Jun 2021 15:04:20 GMT

GET
H2 200 emojione-sprite-40.min.css
unpkg.com/emojione-assets@4.0.0/sprites/ 183 KB
14 KB 29ms
28ms Stylesheet
text/css 2606:4700::6810:7aaf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://unpkg.com/emojione-assets@4.0.0/sprites/emojione-sprite-40.min.css

Requested by

Host: www.ired.team
URL: https://www.ired.team/offensive-security/defense-evasion/retrieving-ntdll-syscall-stubs-at-run-time

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7aaf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c5e939d7d3f9c9bfe632d16484c12354fa89a12738f30f738aa81c984e5b9a92

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.ired.team/offensive-security/defense-evasion/retrieving-ntdll-syscall-stubs-at-run-time
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 03 Jun 2021 15:04:20 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 6284419
vary: Accept-Encoding
cf-request-id: 0a740077bc00003140702d8000000001
last-modified: Sat, 26 Oct 1985 08:15:00 GMT
server: cloudflare
etag: W/"2dc7c-MlEndlChcp6B66cJCh5yD8CB/Fo"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/css; charset=utf-8
access-control-allow-origin: *
x-cloud-trace-context: e0ac7d85fe9bfe99ddd0e0018c758a56
cache-control: public, max-age=31536000
cf-ray: 6599d0392ce13140-FRA

GET
H2 200 6c3c9dec9383137845be0f0ea2cf1bf4.css
gstatic.gitbook.com/css/ 1 KB
1 KB 63ms
27ms Stylesheet
text/css 2606:4700::6812:86f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://gstatic.gitbook.com/css/6c3c9dec9383137845be0f0ea2cf1bf4.css
Requested by: Host: www.ired.team
URL: https://www.ired.team/offensive-security/defense-evasion/retrieving-ntdll-syscall-stubs-at-run-time
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:86f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c5ff636c13e4983198fbed7d325d1cbafbe544702de06f5874c46e359ce68b43

Request headers

Referer: https://www.ired.team/offensive-security/defense-evasion/retrieving-ntdll-syscall-stubs-at-run-time
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 03 Jun 2021 15:04:20 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 3636600
cf-polished: origSize=1701
x-guploader-uploadid: ABg5-UwiIdAcAjrmRlFxwdUIs61NAokkry_-iZ807hfyhPF7n05ywV-MhhKGJXAj1nhFXaaZ1Wx1tw1RuwfcZvRBTHA
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-type: text/css
cf-request-id: 0a740077dc00004e0d94145000000001
last-modified: Wed, 07 Apr 2021 08:43:49 GMT
server: cloudflare
etag: W/"6c3c9dec9383137845be0f0ea2cf1bf4"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-goog-hash: crc32c=hL62rA==, md5=bDyd7JODE3hFvg8Oos8b9A==
x-goog-generation: 1617785029532093
access-control-allow-origin: *
expires: Thu, 21 Apr 2022 20:23:08 GMT
cache-control: public, max-age=31536000
x-goog-stored-content-length: 1701
cf-ray: 6599d0395d594e0d-FRA
cf-bgj: minify

GET
H2 200 polyfill.min.js Show response
polyfill.io/v3/ 72 B
559 B 53ms
21ms Script
text/javascript 2a04:4e42::621
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://polyfill.io/v3/polyfill.min.js?flags=gated&features=Intl

Requested by

Host: www.ired.team
URL: https://www.ired.team/offensive-security/defense-evasion/retrieving-ntdll-syscall-stubs-at-run-time

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42::621 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

aaecd144d2b8763b2fa5c91f09778294363cef363c10504205f4203922644d11

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.ired.team/offensive-security/defense-evasion/retrieving-ntdll-syscall-stubs-at-run-time
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubdomains; preload
content-encoding: br
x-content-type-options: nosniff
content-type: text/javascript; charset=utf-8
age: 42648
detected-user-agent: Chrome/89.0.4389
server-timing: HIT-CLUSTER, fastly;desc="Edge time";dur=1, HIT, fastly;desc="Edge time";dur=1
content-length: 74
referrer-policy: origin-when-cross-origin
last-modified: Wed, 02 Jun 2021 20:10:28 GMT
date: Thu, 03 Jun 2021 15:04:20 GMT
vary: User-Agent, Accept-Encoding
access-control-allow-methods: GET,HEAD,OPTIONS
normalized-user-agent: chrome/89.0.0
access-control-allow-origin: *
cache-control: public, s-maxage=31536000, max-age=604800, stale-while-revalidate=604800, stale-if-error=604800
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 spaces%2F-LFEMnER3fywgFHoroYn%2Favatar.png
gblobscdn.gitbook.com/ 28 KB
29 KB 85ms
57ms Image
image/png 2606:4700::6812:86f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://gblobscdn.gitbook.com/spaces%2F-LFEMnER3fywgFHoroYn%2Favatar.png?alt=media
Requested by: Host: www.ired.team
URL: https://www.ired.team/offensive-security/defense-evasion/retrieving-ntdll-syscall-stubs-at-run-time
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:86f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: aee2771f5f57ecf568ffffd5c0d0fee81b7fb2b5540e10d856f2462abdbd5f92

Request headers

Referer: https://www.ired.team/offensive-security/defense-evasion/retrieving-ntdll-syscall-stubs-at-run-time
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 03 Jun 2021 15:04:20 GMT
cf-cache-status: HIT
age: 3572445
x-guploader-uploadid: ABg5-UzTfWJh6V0B0k2lFPabkrMdmvV3nYkpS2yXi96O2qwxzor09DJgESW3o58wiAWT6dRVCB72aizzWA6t6Q6FplW3MkbWYA
x-goog-storage-class: STANDARD
x-goog-metageneration: 3
x-goog-stored-content-encoding: identity
content-type: image/png
content-length: 29066
cf-request-id: 0a740077da00004a98de894000000001
last-modified: Sat, 08 Sep 2018 20:00:14 GMT
server: cloudflare
etag: "2965c5f978755802debc0291c5574853"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-goog-hash: crc32c=ALxBKw==, md5=KWXF+Xh1WALevAKRxVdIUw==
x-goog-generation: 1536436814766237
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-goog-stored-content-length: 29066
x-goog-meta-firebasestoragedownloadtokens: 1910800b-eed5-42ea-b282-39d0660128fe
accept-ranges: bytes
cf-ray: 6599d0395ae34a98-FRA
expires: Sat, 23 Apr 2022 06:43:34 GMT

GET
H2 200 photo.jpg
lh5.googleusercontent.com/-BT5DyX_LUys/AAAAAAAAAAI/AAAAAAAAAF4/wkmG-hKpMQk/ 7 KB
7 KB 45ms
11ms Image
image/jpeg 2a00:1450:4001:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh5.googleusercontent.com/-BT5DyX_LUys/AAAAAAAAAAI/AAAAAAAAAF4/wkmG-hKpMQk/photo.jpg

Requested by

Host: www.ired.team
URL: https://www.ired.team/offensive-security/defense-evasion/retrieving-ntdll-syscall-stubs-at-run-time

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

3e46dc2084ab2945b5af16a2d88abcd6fa7e8aa5ef5a43fc6c83ce561b6c9577

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.ired.team/offensive-security/defense-evasion/retrieving-ntdll-syscall-stubs-at-run-time
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 03 Jun 2021 11:23:49 GMT
x-content-type-options: nosniff
age: 13231
content-disposition: inline;filename=""
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6707
x-xss-protection: 0
server: fife
etag: "v5e"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Wed, 02 Jun 2021 19:14:53 GMT

GET
H2 200 injection
opengraph.githubassets.com/35d6f7248342d8bbd9f6b9d2ddc8b839614a0f7b0d444ef7e9fc2429367d8a67/odzhan/ 118 KB
119 KB 224ms
144ms Image
image/png 185.199.109.154
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://opengraph.githubassets.com/35d6f7248342d8bbd9f6b9d2ddc8b839614a0f7b0d444ef7e9fc2429367d8a67/odzhan/injection

Requested by

Host: www.ired.team
URL: https://www.ired.team/offensive-security/defense-evasion/retrieving-ntdll-syscall-stubs-at-run-time

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

185.199.109.154 , United States, ASN54113 (FASTLY, US),

Reverse DNS

cdn-185-199-109-154.github.com

Software

Resource Hash

bb62321e7829079dc7a637073352b1d434a71495cc87df8a799b2d27e0bb6b5c

Security Headers

Name	Value
Content-Security-Policy	default-src 'none';style-src 'unsafe-inline';font-src https://github.github.com;img-src https://avatars.githubusercontent.com https://github.githubassets.com
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.ired.team/offensive-security/defense-evasion/retrieving-ntdll-syscall-stubs-at-run-time
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-fastly-request-id: 087903c4f5df66e928fbc4ecb2a6bba1e9ec90fd
content-security-policy: default-src 'none';style-src 'unsafe-inline';font-src https://github.github.com;img-src https://avatars.githubusercontent.com https://github.githubassets.com
via: 1.1 varnish, 1.1 varnish
x-content-type-options: nosniff
x-permitted-cross-domain-policies: none
age: 20614
x-dns-prefetch-control: off
x-cache: HIT, MISS
x-ratelimit-reset: 1622712876
strict-transport-security: max-age=31536000
content-length: 120908
x-github-backend: Kubernetes
x-served-by: cache-dca17752-DCA, cache-cdg20726-CDG
referrer-policy: no-referrer
x-github-request-id: 8608:4482:86CF:82099:60B89EEE
x-frame-options: SAMEORIGIN
date: Thu, 03 Jun 2021 15:04:20 GMT
expect-ct: max-age=0
x-ratelimit-remaining: 99
x-download-options: noopen
content-type: image/png
x-xss-protection: 0
cache-control: public, max-age=21600, immutable
etag: W/"1d84c-acGUvrKTyzDmv+Gre4Ffqr06iZk"
x-ratelimit-limit: 100
accept-ranges: bytes
x-cache-hits: 1, 0

GET
H2 200 HellsGate
opengraph.githubassets.com/269b67e416d1a7536c0e1582917b602cec8f8482edbc1d76accc136cdc31b402/am0nsec/ 102 KB
103 KB 275ms
196ms Image
image/png 185.199.109.154
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://opengraph.githubassets.com/269b67e416d1a7536c0e1582917b602cec8f8482edbc1d76accc136cdc31b402/am0nsec/HellsGate

Requested by

Host: www.ired.team
URL: https://www.ired.team/offensive-security/defense-evasion/retrieving-ntdll-syscall-stubs-at-run-time

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

185.199.109.154 , United States, ASN54113 (FASTLY, US),

Reverse DNS

cdn-185-199-109-154.github.com

Software

Resource Hash

687e274451679856fccb79dc8c625dd6daaa30c2be21838216332432b4c0bf9c

Security Headers

Name	Value
Content-Security-Policy	default-src 'none';style-src 'unsafe-inline';font-src https://github.github.com;img-src https://avatars.githubusercontent.com https://github.githubassets.com
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.ired.team/offensive-security/defense-evasion/retrieving-ntdll-syscall-stubs-at-run-time
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-fastly-request-id: 9191e582701262cce45874b2eba64623a9808a22
content-security-policy: default-src 'none';style-src 'unsafe-inline';font-src https://github.github.com;img-src https://avatars.githubusercontent.com https://github.githubassets.com
via: 1.1 varnish, 1.1 varnish
x-content-type-options: nosniff
x-permitted-cross-domain-policies: none
age: 20614
x-dns-prefetch-control: off
x-cache: HIT, MISS
x-ratelimit-reset: 1622712324
strict-transport-security: max-age=31536000
content-length: 104852
x-github-backend: Kubernetes
x-served-by: cache-dca12921-DCA, cache-cdg20726-CDG
referrer-policy: no-referrer
x-github-request-id: 3462:2FAB:10917:8A9E2:60B89EEE
x-frame-options: SAMEORIGIN
date: Thu, 03 Jun 2021 15:04:20 GMT
expect-ct: max-age=0
x-ratelimit-remaining: 43
x-download-options: noopen
content-type: image/png
x-xss-protection: 0
cache-control: public, max-age=21600, immutable
etag: W/"19994-rVPJcXNh+RiA+UH1YYlqaChsfzc"
x-ratelimit-limit: 100
accept-ranges: bytes
x-cache-hits: 1, 0

GET
H2 200 f4fa50c4003f87e7dc10459e500933c3.woff
gstatic.gitbook.com/fonts/ 92 KB
93 KB 68ms
51ms Font
font/woff 2606:4700::6812:86f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://gstatic.gitbook.com/fonts/f4fa50c4003f87e7dc10459e500933c3.woff
Requested by: Host: www.ired.team
URL: https://www.ired.team/offensive-security/defense-evasion/retrieving-ntdll-syscall-stubs-at-run-time
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:86f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3e692de9565d90dd947a080d4d10cee72a83447ba053e08fdcac457d7197128a

Request headers

Origin: https://www.ired.team
Referer: https://www.ired.team/offensive-security/defense-evasion/retrieving-ntdll-syscall-stubs-at-run-time
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 03 Jun 2021 15:04:20 GMT
cf-cache-status: HIT
age: 3571159
x-guploader-uploadid: ABg5-UxyEzdcNSdaJtXWOu_1a_Udqa_IwHrRlOjvAN1WdWLiRwt_LkJphbV5J8YSQYHy5mSn7RZDeP804aUQsKcyUKyG167dEA
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-type: font/woff
content-length: 94368
cf-request-id: 0a7400782000004e3d88812000000001
last-modified: Wed, 07 Apr 2021 08:43:49 GMT
server: cloudflare
etag: "f4fa50c4003f87e7dc10459e500933c3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-goog-hash: crc32c=FUjfEA==, md5=9PpQxAA/h+fcEEWeUAkzww==
x-goog-generation: 1617785029592662
access-control-allow-origin: *
access-control-expose-headers: Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
cache-control: public, max-age=31536000
x-goog-stored-content-length: 94368
accept-ranges: bytes
cf-ray: 6599d039c9d34e3d-FRA
expires: Wed, 20 Apr 2022 06:41:18 GMT

GET
H2 200 72e37e5bf95a8dba938c78b1d7d91253.woff
gstatic.gitbook.com/fonts/ 92 KB
93 KB 51ms
35ms Font
font/woff 2606:4700::6812:86f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://gstatic.gitbook.com/fonts/72e37e5bf95a8dba938c78b1d7d91253.woff
Requested by: Host: www.ired.team
URL: https://www.ired.team/offensive-security/defense-evasion/retrieving-ntdll-syscall-stubs-at-run-time
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:86f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a18af7799b7d241fe5d00645492ccedcad39815e9f4125b7e3e90b18a1b77405

Request headers

Origin: https://www.ired.team
Referer: https://www.ired.team/offensive-security/defense-evasion/retrieving-ntdll-syscall-stubs-at-run-time
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 03 Jun 2021 15:04:20 GMT
cf-cache-status: HIT
age: 3571158
x-guploader-uploadid: ABg5-UzxMRvnWuUe4Am1soA1IEY0fTbTsCQH3JGMbwYAJB2ar3ndl9M08YuIU70qf4xw3V9sSwauwoM0moUUX62ZaFzL1i-mvQ
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-type: font/woff
content-length: 94040
cf-request-id: 0a7400782000004e3dddb5f000000001
last-modified: Fri, 19 Mar 2021 17:17:25 GMT
server: cloudflare
etag: "72e37e5bf95a8dba938c78b1d7d91253"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-goog-hash: crc32c=TBIniA==, md5=cuN+W/lajbqTjHix19kSUw==
x-goog-generation: 1616174245162428
access-control-allow-origin: *
access-control-expose-headers: Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
cache-control: public, max-age=31536000
x-goog-stored-content-length: 94040
accept-ranges: bytes
cf-ray: 6599d039c9db4e3d-FRA
expires: Wed, 06 Apr 2022 19:16:43 GMT

GET
H2 200 fc3d4b35e4d07d4e0485cc2db0e57c77.woff
gstatic.gitbook.com/fonts/ 92 KB
92 KB 57ms
42ms Font
font/woff 2606:4700::6812:86f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://gstatic.gitbook.com/fonts/fc3d4b35e4d07d4e0485cc2db0e57c77.woff
Requested by: Host: www.ired.team
URL: https://www.ired.team/offensive-security/defense-evasion/retrieving-ntdll-syscall-stubs-at-run-time
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:86f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b87e90677bdbc3c6bc296a368f57b2d72783c1a7c6e8e9325cd1645c18039cf2

Request headers

Origin: https://www.ired.team
Referer: https://www.ired.team/offensive-security/defense-evasion/retrieving-ntdll-syscall-stubs-at-run-time
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 03 Jun 2021 15:04:20 GMT
cf-cache-status: HIT
age: 1790766
x-guploader-uploadid: ABg5-UwGan3w8btTIOf0-1SNEwpK9JOOZoD4LEnV2f8danvAeKtwlLE3CqzpT_qB0OsDZnlApI2ADMahkX2V5j6snsU
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-type: font/woff
content-length: 93788
cf-request-id: 0a7400782100004e3dd4b6e000000001
last-modified: Wed, 07 Apr 2021 08:43:49 GMT
server: cloudflare
etag: "fc3d4b35e4d07d4e0485cc2db0e57c77"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-goog-hash: crc32c=7TN+QQ==, md5=/D1LNeTQfU4EhcwtsOV8dw==
x-goog-generation: 1613469465501597
access-control-allow-origin: *
access-control-expose-headers: Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
cache-control: public, max-age=31536000
x-goog-stored-content-length: 93788
accept-ranges: bytes
cf-ray: 6599d039c9d84e3d-FRA
expires: Wed, 20 Apr 2022 06:26:20 GMT

GET
H2 200 HI_XiYsKILxRpg3hIP6sJ7fM7PqtzsjDs-cq.woff2
fonts.gstatic.com/s/sourcecodepro/v14/ 13 KB
13 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:829::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcecodepro/v14/HI_XiYsKILxRpg3hIP6sJ7fM7PqtzsjDs-cq.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Code+Pro:500&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f29cd3a2bdcacf9f9f7285c9b74d89f55634f4d43752d81a48914afa7442eb66

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://www.ired.team
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 01 Jun 2021 05:22:42 GMT
x-content-type-options: nosniff
last-modified: Wed, 24 Mar 2021 17:51:24 GMT
server: sffe
age: 207698
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13540
x-xss-protection: 0
expires: Wed, 01 Jun 2022 05:22:42 GMT

GET
H2 200 assets%2F-LFEMnER3fywgFHoroYn%2F-M9E0SHUl0Up562C2Ij9%2F-M9E42HYaQ6E9k1TzWip%2Fimage.png
gblobscdn.gitbook.com/ 63 KB
63 KB 474ms
473ms Image
image/png 2606:4700::6812:86f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://gblobscdn.gitbook.com/assets%2F-LFEMnER3fywgFHoroYn%2F-M9E0SHUl0Up562C2Ij9%2F-M9E42HYaQ6E9k1TzWip%2Fimage.png?alt=media&token=c0293978-e79e-4cf8-9de6-34fc11beaa93
Requested by: Host: www.ired.team
URL: https://www.ired.team/offensive-security/defense-evasion/retrieving-ntdll-syscall-stubs-at-run-time
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:86f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f4ffb28b288f3288a4e90c3d96b77cd37aa8d264f2feb85ed356f76115e94403

Request headers

Referer: https://www.ired.team/offensive-security/defense-evasion/retrieving-ntdll-syscall-stubs-at-run-time
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 03 Jun 2021 15:04:21 GMT
cf-cache-status: MISS
x-guploader-uploadid: ABg5-UxYFCpK7t21nb3SvUpW_zVKrbL9h6tmZUbjO6eq0LN8pL2R2vuXnyTh0Isq2BqKp-Wke9GiJJUlnaRdn4gkwFumVmbuew
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-disposition: attachment; filename="image.png"
content-type: image/png
content-length: 64589
cf-request-id: 0a7400788100004a9804132000000001
last-modified: Sun, 07 Jun 2020 13:59:26 GMT
server: cloudflare
etag: "5321db205f68238d9e42c93122df3181"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-goog-hash: crc32c=GNoQ1w==, md5=UyHbIF9oI42eQskxIt8xgQ==
x-goog-generation: 1591538366277426
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-goog-stored-content-length: 64589
x-goog-meta-firebasestoragedownloadtokens: c0293978-e79e-4cf8-9de6-34fc11beaa93
accept-ranges: bytes
cf-ray: 6599d03a6e344a98-FRA
expires: Fri, 03 Jun 2022 15:04:21 GMT

GET
H2 200 assets%2F-LFEMnER3fywgFHoroYn%2F-M9E0SHUl0Up562C2Ij9%2F-M9E5PqaqdiVpKUTF6mw%2Fimage.png
gblobscdn.gitbook.com/ 54 KB
55 KB 468ms
467ms Image
image/png 2606:4700::6812:86f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://gblobscdn.gitbook.com/assets%2F-LFEMnER3fywgFHoroYn%2F-M9E0SHUl0Up562C2Ij9%2F-M9E5PqaqdiVpKUTF6mw%2Fimage.png?alt=media&token=6b28195b-c094-4cc6-8ef8-8f3d314ca11b
Requested by: Host: www.ired.team
URL: https://www.ired.team/offensive-security/defense-evasion/retrieving-ntdll-syscall-stubs-at-run-time
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:86f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6b0b8666fc1457fd6072565affee8e3bf60ad0501b18b17af5d1c29c1cce7320

Request headers

Referer: https://www.ired.team/offensive-security/defense-evasion/retrieving-ntdll-syscall-stubs-at-run-time
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 03 Jun 2021 15:04:21 GMT
cf-cache-status: MISS
x-guploader-uploadid: ABg5-UzFNMGqhtN3t_cXJ4_WnpQVjmGLGYpqFEJrEBh98_lZ0ulrAhzcXndh8V2yUqTVO7eV4XKl9-mBZV4eLeNpJHA
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-disposition: attachment; filename="image.png"
content-type: image/png
content-length: 55696
cf-request-id: 0a7400788200004a9806ad9000000001
last-modified: Sun, 07 Jun 2020 14:05:24 GMT
server: cloudflare
etag: "c996676cdb146a69086341826c8179a2"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-goog-hash: crc32c=+X4fzA==, md5=yZZnbNsUamkIY0GCbIF5og==
x-goog-generation: 1591538724930950
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-goog-stored-content-length: 55696
x-goog-meta-firebasestoragedownloadtokens: 6b28195b-c094-4cc6-8ef8-8f3d314ca11b
accept-ranges: bytes
cf-ray: 6599d03a6e364a98-FRA
expires: Fri, 03 Jun 2022 15:04:21 GMT

GET
H2 200 assets%2F-LFEMnER3fywgFHoroYn%2F-M9E0SHUl0Up562C2Ij9%2F-M9E9yV0T5M_PbOrNM54%2Fresolving-function-names.gif
gblobscdn.gitbook.com/ 301 KB
302 KB 488ms
487ms Image
image/gif 2606:4700::6812:86f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://gblobscdn.gitbook.com/assets%2F-LFEMnER3fywgFHoroYn%2F-M9E0SHUl0Up562C2Ij9%2F-M9E9yV0T5M_PbOrNM54%2Fresolving-function-names.gif?alt=media&token=4d4383bc-b79d-4b7d-aada-3ff94b214149
Requested by: Host: www.ired.team
URL: https://www.ired.team/offensive-security/defense-evasion/retrieving-ntdll-syscall-stubs-at-run-time
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:86f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0f79c8050d83c085609b218a122623fbe62c4da23f5c9d464c4cc8ddafcb0b03

Request headers

Referer: https://www.ired.team/offensive-security/defense-evasion/retrieving-ntdll-syscall-stubs-at-run-time
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 03 Jun 2021 15:04:21 GMT
cf-cache-status: MISS
x-guploader-uploadid: ABg5-UwbunHXOfilVRaQn5FGbTYzB6yoJG9O6_a5g7zTmT06F5AUGyNYEfAwV5H0K-U_aXDoPj44y8mNDUKEsLQOLTyVbcOW6Q
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-disposition: attachment; filename="resolving-function-names.gif"
content-type: image/gif
content-length: 307989
cf-request-id: 0a7400788200004a98e2194000000001
last-modified: Sun, 07 Jun 2020 14:25:22 GMT
server: cloudflare
etag: "5faead4237951817bfb6139ac263c016"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-goog-hash: crc32c=qp6aVQ==, md5=X66tQjeVGBe/thOawmPAFg==
x-goog-generation: 1591539922980947
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-goog-stored-content-length: 307989
x-goog-meta-firebasestoragedownloadtokens: 4d4383bc-b79d-4b7d-aada-3ff94b214149
accept-ranges: bytes
cf-ray: 6599d03a6e3a4a98-FRA
expires: Fri, 03 Jun 2022 15:04:20 GMT

GET
H2 200 assets%2F-LFEMnER3fywgFHoroYn%2F-M9E0SHUl0Up562C2Ij9%2F-M9EBnftDG7aijcm7wge%2Fsyscall-stub-found.gif
gblobscdn.gitbook.com/ 784 KB
785 KB 495ms
494ms Image
image/gif 2606:4700::6812:86f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://gblobscdn.gitbook.com/assets%2F-LFEMnER3fywgFHoroYn%2F-M9E0SHUl0Up562C2Ij9%2F-M9EBnftDG7aijcm7wge%2Fsyscall-stub-found.gif?alt=media&token=283c4279-2954-4236-afd5-0eff94edc43b
Requested by: Host: www.ired.team
URL: https://www.ired.team/offensive-security/defense-evasion/retrieving-ntdll-syscall-stubs-at-run-time
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:86f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: dd7ef9a64428b8cd988a1242fa13e495bdb62f422882ce94c90f9c0bc8a28096

Request headers

Referer: https://www.ired.team/offensive-security/defense-evasion/retrieving-ntdll-syscall-stubs-at-run-time
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 03 Jun 2021 15:04:21 GMT
cf-cache-status: MISS
x-guploader-uploadid: ABg5-Uxq9CsOoYyHFh_7xW5roOAqNjCBvkoTbPP2AveDm7kINOGzWqKOO_Rsz-jnhds3u90SPLX7F9_DBwA4kNdnikM
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-disposition: attachment; filename="syscall-stub-found.gif"
content-type: image/gif
content-length: 802606
cf-request-id: 0a7400788200004a981e3a0000000001
last-modified: Sun, 07 Jun 2020 14:33:23 GMT
server: cloudflare
etag: "33e3cdb9eca3bc1641e6e761f63ad876"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-goog-hash: crc32c=Rq0cBQ==, md5=M+PNueyjvBZB5udh9jrYdg==
x-goog-generation: 1591540403482975
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-goog-stored-content-length: 802606
x-goog-meta-firebasestoragedownloadtokens: 283c4279-2954-4236-afd5-0eff94edc43b
accept-ranges: bytes
cf-ray: 6599d03a6e3d4a98-FRA
expires: Fri, 03 Jun 2022 15:04:21 GMT

GET
H2 200 assets%2F-LFEMnER3fywgFHoroYn%2F-M9E0SHUl0Up562C2Ij9%2F-M9EDxs0wY-dn_TveGfj%2Fimage.png
gblobscdn.gitbook.com/ 7 KB
8 KB 477ms
476ms Image
image/png 2606:4700::6812:86f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://gblobscdn.gitbook.com/assets%2F-LFEMnER3fywgFHoroYn%2F-M9E0SHUl0Up562C2Ij9%2F-M9EDxs0wY-dn_TveGfj%2Fimage.png?alt=media&token=c2f2e939-8453-4eb9-a4a8-dac52b52d321
Requested by: Host: www.ired.team
URL: https://www.ired.team/offensive-security/defense-evasion/retrieving-ntdll-syscall-stubs-at-run-time
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:86f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b21be449e2ffa71effc34d0c605ded9903b322e8a0fd0c51dc01c5bb1c8e23a6

Request headers

Referer: https://www.ired.team/offensive-security/defense-evasion/retrieving-ntdll-syscall-stubs-at-run-time
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 03 Jun 2021 15:04:21 GMT
cf-cache-status: MISS
x-guploader-uploadid: ABg5-UyVsjtAyTxZ09lh5YtYeAdM0vnHcMLJIRdDkgQ0njlgickDoNozwvys3VFHtXJYZ40uKU8aahLD-7y9_e0_pz_mmTj4ow
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-disposition: attachment; filename="image.png"
content-type: image/png
content-length: 7450
cf-request-id: 0a7400788200004a980e0c9000000001
last-modified: Sun, 07 Jun 2020 14:42:45 GMT
server: cloudflare
etag: "0bef3b906dee89fa10af4c2b83cfaec2"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-goog-hash: crc32c=ppaTFw==, md5=C+87kG3uifoQr0wrg8+uwg==
x-goog-generation: 1591540965449395
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-goog-stored-content-length: 7450
x-goog-meta-firebasestoragedownloadtokens: c2f2e939-8453-4eb9-a4a8-dac52b52d321
accept-ranges: bytes
cf-ray: 6599d03a6e3f4a98-FRA
expires: Fri, 03 Jun 2022 15:04:21 GMT

GET
H2 200 assets%2F-LFEMnER3fywgFHoroYn%2F-M9E0SHUl0Up562C2Ij9%2F-M9EDaZfLci1MbQFYXEl%2Fcalling-syscall-stub.gif
gblobscdn.gitbook.com/ 256 KB
256 KB 434ms
433ms Image
image/gif 2606:4700::6812:86f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://gblobscdn.gitbook.com/assets%2F-LFEMnER3fywgFHoroYn%2F-M9E0SHUl0Up562C2Ij9%2F-M9EDaZfLci1MbQFYXEl%2Fcalling-syscall-stub.gif?alt=media&token=66a24151-1269-4b88-8e27-af88b59db916
Requested by: Host: www.ired.team
URL: https://www.ired.team/offensive-security/defense-evasion/retrieving-ntdll-syscall-stubs-at-run-time
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:86f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9ac38761d2279f89b6c78710233621c81c264ddb69695c7033fddb092efb14e6

Request headers

Referer: https://www.ired.team/offensive-security/defense-evasion/retrieving-ntdll-syscall-stubs-at-run-time
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 03 Jun 2021 15:04:21 GMT
cf-cache-status: MISS
x-guploader-uploadid: ABg5-UxNah6G6eaio_Nkx44-8Xp-BNMBDVEgdNStgtHUedlinrGZAUN51QhnfKC-8TTI-UtrNW5xYC4otLkZ46e3PQpGKO7DtA
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-disposition: attachment; filename="calling-syscall-stub.gif"
content-type: image/gif
content-length: 261829
cf-request-id: 0a7400788300004a98cf299000000001
last-modified: Sun, 07 Jun 2020 14:41:10 GMT
server: cloudflare
etag: "b94bc1d548c527a1be8285d49c0522b5"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-goog-hash: crc32c=Z9nhnw==, md5=uUvB1UjFJ6G+goXUnAUitQ==
x-goog-generation: 1591540870713955
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-goog-stored-content-length: 261829
x-goog-meta-firebasestoragedownloadtokens: 66a24151-1269-4b88-8e27-af88b59db916
accept-ranges: bytes
cf-ray: 6599d03a6e434a98-FRA
expires: Fri, 03 Jun 2022 15:04:21 GMT

GET
H2 200 111.f142f50e.js Show response
gstatic.gitbook.com/js/ 3 MB
945 KB 55ms
54ms Script
application/javascript 2606:4700::6812:86f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://gstatic.gitbook.com/js/111.f142f50e.js
Requested by: Host: www.ired.team
URL: https://www.ired.team/offensive-security/defense-evasion/retrieving-ntdll-syscall-stubs-at-run-time
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:86f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: eb929919479b2afe4e756a8ab718e9adbc8d94dbd0504da1cf4cea2b252833cc

Request headers

Origin: https://www.ired.team
Referer: https://www.ired.team/offensive-security/defense-evasion/retrieving-ntdll-syscall-stubs-at-run-time
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 03 Jun 2021 15:04:20 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 3572446
cf-polished: origSize=3418521
x-guploader-uploadid: ABg5-Uz3PpVS5rmLAQqyx-Bv43SHB5qBoEgLF9EGcOUffq1ADGmF9a4Yz68fHeL2roHduhQQGD7FQcctPucVTg5fsEA
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-type: application/javascript
cf-request-id: 0a740078d200004e3df9a94000000001
expires: Fri, 22 Apr 2022 15:46:59 GMT
last-modified: Wed, 07 Apr 2021 08:43:49 GMT
server: cloudflare
etag: W/"876655ac803da8f0cf014bda9a896170"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-goog-hash: crc32c=B4hFnA==, md5=h2ZVrIA9qPDPAUvamolhcA==
x-goog-generation: 1617785029720049
access-control-allow-origin: *
access-control-expose-headers: Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
cache-control: public, max-age=31536000
x-goog-stored-content-length: 3418521
cf-ray: 6599d03aeda04e3d-FRA
cf-bgj: minify

GET
H2 200 logger.min.js Show response
cdn.lr-ingest.io/ 715 KB
133 KB 74ms
48ms Script
text/javascript 2606:4700:3035::6815:327f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.lr-ingest.io/logger.min.js

Requested by

Host: gstatic.gitbook.com
URL: https://gstatic.gitbook.com/js/111.f142f50e.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3035::6815:327f , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fc6885517e1e6df36c33a5d7eb85c80c068b0049498834b74b9c7908aff43825

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926

Request headers

Referer: https://www.ired.team/offensive-security/defense-evasion/retrieving-ntdll-syscall-stubs-at-run-time
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 03 Jun 2021 15:04:21 GMT
content-encoding: br
vary: x-fh-requested-host, accept-encoding
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 79
x-cache: HIT
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id: 0a74007a270000dfe765a3e000000001
x-served-by: cache-fra19141-FRA
last-modified: Thu, 03 Jun 2021 14:16:15 GMT
server: cloudflare
x-timer: S1622729873.353141,VS0,VE1
etag: W/"2673b841717ecf4e7a6fe54b7389cf501826e2aaf9229319d1c0f99746588a2c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31556926
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=8sA8%2FuYwAzk28b35FSDL7Nlj%2F33d0ioIm5lFvzDJjAYNZZrYhFk9N3gvxig5l7aKQ7gdMHFpTbDUAfk9PUq%2FSgAVXvZyDDdxVppUBNMo0eV%2FYXXYR28gfxYuIBAUMnEEL8aOi9%2F%2Bw0ujkw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=14400
cf-ray: 6599d03d0e15dfe7-FRA
x-cache-hits: 1

GET
H2 200 __session Show response
app.gitbook.com/ 52 B
626 B 300ms
288ms Fetch
application/json 2606:4700::6812:86f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://app.gitbook.com/__session?proposed=0416d2e7-9ea9-4dac-9f48-749ef806afd1R
Requested by: Host: gstatic.gitbook.com
URL: https://gstatic.gitbook.com/js/111.f142f50e.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:86f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 750951c80e7ffc5e4c9a69a92b8ea44a8ad3e70912c361c9fc104ac4c6562e42

Request headers

Referer: https://www.ired.team/offensive-security/defense-evasion/retrieving-ntdll-syscall-stubs-at-run-time
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 03 Jun 2021 15:04:22 GMT
content-encoding: gzip
cf-cache-status: DYNAMIC
x-magic-hash: 590b4fe02dc55aa9fde6dfdbc1a33d82273fc9c6a576984b78f97aca99a7ec32
x-powered-by: Express
x-cache: MISS
x-release: gitbook-28427-6.25.11
cf-request-id: 0a74007c2700004a98ba208000000001
access-control-allow-origin: https://www.ired.team
server: cloudflare
etag: W/"34-7mtJmCC893AAsQ+kQpjXdKLKCAA"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Origin, Accept-Encoding
content-type: application/json; charset=utf-8
via: no cache
x-cloud-trace-context: 5aa636555e84643fa954c0b3dbaa0804
cache-control: private
access-control-allow-credentials: true
function-execution-id: f88wfxt77kco
cf-ray: 6599d0403a404a98-FRA
expires: Thu, 03 Jun 2021 15:04:21 GMT

GET
H/1.1 200
OK .lp Show response
gitbook-28427.firebaseio.com/ Frame 3E3B 423 B
665 B 277ms
117ms Script
application/javascript 2600:1901:0:94b6::
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://gitbook-28427.firebaseio.com/.lp?start=t&ser=49915102&cb=1&v=5

Requested by

Host: gstatic.gitbook.com
URL: https://gstatic.gitbook.com/js/111.f142f50e.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305

Server

2600:1901:0:94b6:: Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

nginx /

Resource Hash

8f6e5c507b22193f526855af76d30f10a70dd2a22608997c6eb51347772c55b3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Referer: https://www.ired.team/offensive-security/defense-evasion/retrieving-ntdll-syscall-stubs-at-run-time
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 03 Jun 2021 15:04:22 GMT
Server: nginx
Connection: keep-alive
Content-Length: 423
Strict-Transport-Security: max-age=31556926; includeSubDomains; preload
Content-Type: application/javascript; charset=utf-8

GET
BLOB 200
OK cb4e2494-6672-4638-be5a-de9f85b81ec5
https://www.ired.team/ 406 KB
0 Other
text/plain

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.ired.team/cb4e2494-6672-4638-be5a-de9f85b81ec5
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 44ebe32ebe11957105d1aad9a608156c457b879ca3d7cd6ac45bb2799b8e0aa2

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Length: 416100

GET
H2 200 assets%2F-LFEMnER3fywgFHoroYn%2F-M9E0SHUl0Up562C2Ij9%2F-M9E42HYaQ6E9k1TzWip%2Fimage.png
gblobscdn.gitbook.com/ 63 KB
63 KB 290ms
290ms Image
image/png 2606:4700::6812:86f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://gblobscdn.gitbook.com/assets%2F-LFEMnER3fywgFHoroYn%2F-M9E0SHUl0Up562C2Ij9%2F-M9E42HYaQ6E9k1TzWip%2Fimage.png?alt=media&token=c0293978-e79e-4cf8-9de6-34fc11beaa93
Requested by: Host: gstatic.gitbook.com
URL: https://gstatic.gitbook.com/js/111.f142f50e.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:86f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f4ffb28b288f3288a4e90c3d96b77cd37aa8d264f2feb85ed356f76115e94403

Request headers

Referer: https://www.ired.team/offensive-security/defense-evasion/retrieving-ntdll-syscall-stubs-at-run-time
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 03 Jun 2021 15:04:22 GMT
cf-cache-status: HIT
age: 1
x-guploader-uploadid: ABg5-UxYFCpK7t21nb3SvUpW_zVKrbL9h6tmZUbjO6eq0LN8pL2R2vuXnyTh0Isq2BqKp-Wke9GiJJUlnaRdn4gkwFumVmbuew
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-disposition: attachment; filename="image.png"
content-type: image/png
content-length: 64589
cf-request-id: 0a74007f3900004a9825028000000001
last-modified: Sun, 07 Jun 2020 13:59:26 GMT
server: cloudflare
etag: "5321db205f68238d9e42c93122df3181"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-goog-hash: crc32c=GNoQ1w==, md5=UyHbIF9oI42eQskxIt8xgQ==
x-goog-generation: 1591538366277426
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-goog-stored-content-length: 64589
x-goog-meta-firebasestoragedownloadtokens: c0293978-e79e-4cf8-9de6-34fc11beaa93
accept-ranges: bytes
cf-ray: 6599d045287e4a98-FRA
expires: Fri, 03 Jun 2022 15:04:21 GMT

GET
H2 200 assets%2F-LFEMnER3fywgFHoroYn%2F-M9E0SHUl0Up562C2Ij9%2F-M9E5PqaqdiVpKUTF6mw%2Fimage.png
gblobscdn.gitbook.com/ 54 KB
55 KB 70ms
69ms Image
image/png 2606:4700::6812:86f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://gblobscdn.gitbook.com/assets%2F-LFEMnER3fywgFHoroYn%2F-M9E0SHUl0Up562C2Ij9%2F-M9E5PqaqdiVpKUTF6mw%2Fimage.png?alt=media&token=6b28195b-c094-4cc6-8ef8-8f3d314ca11b
Requested by: Host: gstatic.gitbook.com
URL: https://gstatic.gitbook.com/js/111.f142f50e.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:86f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6b0b8666fc1457fd6072565affee8e3bf60ad0501b18b17af5d1c29c1cce7320

Request headers

Referer: https://www.ired.team/offensive-security/defense-evasion/retrieving-ntdll-syscall-stubs-at-run-time
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 03 Jun 2021 15:04:22 GMT
cf-cache-status: HIT
age: 1
x-guploader-uploadid: ABg5-UzFNMGqhtN3t_cXJ4_WnpQVjmGLGYpqFEJrEBh98_lZ0ulrAhzcXndh8V2yUqTVO7eV4XKl9-mBZV4eLeNpJHA
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-disposition: attachment; filename="image.png"
content-type: image/png
content-length: 55696
cf-request-id: 0a74007f4d00004a98e816e000000001
last-modified: Sun, 07 Jun 2020 14:05:24 GMT
server: cloudflare
etag: "c996676cdb146a69086341826c8179a2"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-goog-hash: crc32c=+X4fzA==, md5=yZZnbNsUamkIY0GCbIF5og==
x-goog-generation: 1591538724930950
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-goog-stored-content-length: 55696
x-goog-meta-firebasestoragedownloadtokens: 6b28195b-c094-4cc6-8ef8-8f3d314ca11b
accept-ranges: bytes
cf-ray: 6599d04538e04a98-FRA
expires: Fri, 03 Jun 2022 15:04:21 GMT

GET
H2 200 6c3c9dec9383137845be0f0ea2cf1bf4.css
gstatic.gitbook.com/css/ 1 KB
635 B 47ms
47ms Stylesheet
text/css 2606:4700::6812:86f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://gstatic.gitbook.com/css/6c3c9dec9383137845be0f0ea2cf1bf4.css
Requested by: Host: gstatic.gitbook.com
URL: https://gstatic.gitbook.com/js/111.f142f50e.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:86f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c5ff636c13e4983198fbed7d325d1cbafbe544702de06f5874c46e359ce68b43

Request headers

Referer: https://www.ired.team/offensive-security/defense-evasion/retrieving-ntdll-syscall-stubs-at-run-time
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 03 Jun 2021 15:04:22 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 3636602
cf-polished: origSize=1701
x-guploader-uploadid: ABg5-UwiIdAcAjrmRlFxwdUIs61NAokkry_-iZ807hfyhPF7n05ywV-MhhKGJXAj1nhFXaaZ1Wx1tw1RuwfcZvRBTHA
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-type: text/css
cf-request-id: 0a74007f5100004e0dbf9f1000000001
last-modified: Wed, 07 Apr 2021 08:43:49 GMT
server: cloudflare
etag: W/"6c3c9dec9383137845be0f0ea2cf1bf4"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-goog-hash: crc32c=hL62rA==, md5=bDyd7JODE3hFvg8Oos8b9A==
x-goog-generation: 1617785029532093
access-control-allow-origin: *
expires: Thu, 21 Apr 2022 20:23:08 GMT
cache-control: public, max-age=31536000
x-goog-stored-content-length: 1701
cf-ray: 6599d0454c204e0d-FRA
cf-bgj: minify

GET
H2 200 assets%2F-LFEMnER3fywgFHoroYn%2F-M9E0SHUl0Up562C2Ij9%2F-M9E9yV0T5M_PbOrNM54%2Fresolving-function-names.gif
gblobscdn.gitbook.com/ 301 KB
301 KB 277ms
277ms Image
image/gif 2606:4700::6812:86f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://gblobscdn.gitbook.com/assets%2F-LFEMnER3fywgFHoroYn%2F-M9E0SHUl0Up562C2Ij9%2F-M9E9yV0T5M_PbOrNM54%2Fresolving-function-names.gif?alt=media&token=4d4383bc-b79d-4b7d-aada-3ff94b214149
Requested by: Host: gstatic.gitbook.com
URL: https://gstatic.gitbook.com/js/111.f142f50e.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:86f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0f79c8050d83c085609b218a122623fbe62c4da23f5c9d464c4cc8ddafcb0b03

Request headers

Referer: https://www.ired.team/offensive-security/defense-evasion/retrieving-ntdll-syscall-stubs-at-run-time
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 03 Jun 2021 15:04:22 GMT
cf-cache-status: HIT
age: 1
x-guploader-uploadid: ABg5-UwbunHXOfilVRaQn5FGbTYzB6yoJG9O6_a5g7zTmT06F5AUGyNYEfAwV5H0K-U_aXDoPj44y8mNDUKEsLQOLTyVbcOW6Q
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-disposition: attachment; filename="resolving-function-names.gif"
content-type: image/gif
content-length: 307989
cf-request-id: 0a74007f6200004a9800206000000001
last-modified: Sun, 07 Jun 2020 14:25:22 GMT
server: cloudflare
etag: "5faead4237951817bfb6139ac263c016"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-goog-hash: crc32c=qp6aVQ==, md5=X66tQjeVGBe/thOawmPAFg==
x-goog-generation: 1591539922980947
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-goog-stored-content-length: 307989
x-goog-meta-firebasestoragedownloadtokens: 4d4383bc-b79d-4b7d-aada-3ff94b214149
accept-ranges: bytes
cf-ray: 6599d04569644a98-FRA
expires: Fri, 03 Jun 2022 15:04:20 GMT

GET
H2 200 assets%2F-LFEMnER3fywgFHoroYn%2F-M9E0SHUl0Up562C2Ij9%2F-M9EBnftDG7aijcm7wge%2Fsyscall-stub-found.gif
gblobscdn.gitbook.com/ 784 KB
785 KB 40ms
39ms Image
image/gif 2606:4700::6812:86f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://gblobscdn.gitbook.com/assets%2F-LFEMnER3fywgFHoroYn%2F-M9E0SHUl0Up562C2Ij9%2F-M9EBnftDG7aijcm7wge%2Fsyscall-stub-found.gif?alt=media&token=283c4279-2954-4236-afd5-0eff94edc43b
Requested by: Host: gstatic.gitbook.com
URL: https://gstatic.gitbook.com/js/111.f142f50e.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:86f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: dd7ef9a64428b8cd988a1242fa13e495bdb62f422882ce94c90f9c0bc8a28096

Request headers

Referer: https://www.ired.team/offensive-security/defense-evasion/retrieving-ntdll-syscall-stubs-at-run-time
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 03 Jun 2021 15:04:22 GMT
cf-cache-status: HIT
age: 1
x-guploader-uploadid: ABg5-Uxq9CsOoYyHFh_7xW5roOAqNjCBvkoTbPP2AveDm7kINOGzWqKOO_Rsz-jnhds3u90SPLX7F9_DBwA4kNdnikM
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-disposition: attachment; filename="syscall-stub-found.gif"
content-type: image/gif
content-length: 802606
cf-request-id: 0a74007f6600004a98de97d000000001
last-modified: Sun, 07 Jun 2020 14:33:23 GMT
server: cloudflare
etag: "33e3cdb9eca3bc1641e6e761f63ad876"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-goog-hash: crc32c=Rq0cBQ==, md5=M+PNueyjvBZB5udh9jrYdg==
x-goog-generation: 1591540403482975
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-goog-stored-content-length: 802606
x-goog-meta-firebasestoragedownloadtokens: 283c4279-2954-4236-afd5-0eff94edc43b
accept-ranges: bytes
cf-ray: 6599d045697d4a98-FRA
expires: Fri, 03 Jun 2022 15:04:21 GMT

GET
H2 200 assets%2F-LFEMnER3fywgFHoroYn%2F-M9E0SHUl0Up562C2Ij9%2F-M9EDxs0wY-dn_TveGfj%2Fimage.png
gblobscdn.gitbook.com/ 7 KB
8 KB 287ms
286ms Image
image/png 2606:4700::6812:86f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://gblobscdn.gitbook.com/assets%2F-LFEMnER3fywgFHoroYn%2F-M9E0SHUl0Up562C2Ij9%2F-M9EDxs0wY-dn_TveGfj%2Fimage.png?alt=media&token=c2f2e939-8453-4eb9-a4a8-dac52b52d321
Requested by: Host: gstatic.gitbook.com
URL: https://gstatic.gitbook.com/js/111.f142f50e.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:86f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b21be449e2ffa71effc34d0c605ded9903b322e8a0fd0c51dc01c5bb1c8e23a6

Request headers

Referer: https://www.ired.team/offensive-security/defense-evasion/retrieving-ntdll-syscall-stubs-at-run-time
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 03 Jun 2021 15:04:22 GMT
cf-cache-status: HIT
age: 1
x-guploader-uploadid: ABg5-UyVsjtAyTxZ09lh5YtYeAdM0vnHcMLJIRdDkgQ0njlgickDoNozwvys3VFHtXJYZ40uKU8aahLD-7y9_e0_pz_mmTj4ow
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-disposition: attachment; filename="image.png"
content-type: image/png
content-length: 7450
cf-request-id: 0a74007f7500004a989a2e7000000001
last-modified: Sun, 07 Jun 2020 14:42:45 GMT
server: cloudflare
etag: "0bef3b906dee89fa10af4c2b83cfaec2"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-goog-hash: crc32c=ppaTFw==, md5=C+87kG3uifoQr0wrg8+uwg==
x-goog-generation: 1591540965449395
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-goog-stored-content-length: 7450
x-goog-meta-firebasestoragedownloadtokens: c2f2e939-8453-4eb9-a4a8-dac52b52d321
accept-ranges: bytes
cf-ray: 6599d04589c94a98-FRA
expires: Fri, 03 Jun 2022 15:04:21 GMT

GET
H2 200 assets%2F-LFEMnER3fywgFHoroYn%2F-M9E0SHUl0Up562C2Ij9%2F-M9EDaZfLci1MbQFYXEl%2Fcalling-syscall-stub.gif
gblobscdn.gitbook.com/ 256 KB
256 KB 88ms
88ms Image
image/gif 2606:4700::6812:86f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://gblobscdn.gitbook.com/assets%2F-LFEMnER3fywgFHoroYn%2F-M9E0SHUl0Up562C2Ij9%2F-M9EDaZfLci1MbQFYXEl%2Fcalling-syscall-stub.gif?alt=media&token=66a24151-1269-4b88-8e27-af88b59db916
Requested by: Host: gstatic.gitbook.com
URL: https://gstatic.gitbook.com/js/111.f142f50e.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:86f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9ac38761d2279f89b6c78710233621c81c264ddb69695c7033fddb092efb14e6

Request headers

Referer: https://www.ired.team/offensive-security/defense-evasion/retrieving-ntdll-syscall-stubs-at-run-time
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 03 Jun 2021 15:04:22 GMT
cf-cache-status: HIT
age: 1
x-guploader-uploadid: ABg5-UxNah6G6eaio_Nkx44-8Xp-BNMBDVEgdNStgtHUedlinrGZAUN51QhnfKC-8TTI-UtrNW5xYC4otLkZ46e3PQpGKO7DtA
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-disposition: attachment; filename="calling-syscall-stub.gif"
content-type: image/gif
content-length: 261829
cf-request-id: 0a74007f7e00004a980020b000000001
last-modified: Sun, 07 Jun 2020 14:41:10 GMT
server: cloudflare
etag: "b94bc1d548c527a1be8285d49c0522b5"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-goog-hash: crc32c=Z9nhnw==, md5=uUvB1UjFJ6G+goXUnAUitQ==
x-goog-generation: 1591540870713955
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-goog-stored-content-length: 261829
x-goog-meta-firebasestoragedownloadtokens: 66a24151-1269-4b88-8e27-af88b59db916
accept-ranges: bytes
cf-ray: 6599d0459a0c4a98-FRA
expires: Fri, 03 Jun 2022 15:04:21 GMT

GET
H/1.1 200
OK .lp Show response
s-usc1c-nss-232.firebaseio.com/ Frame 8E8E 421 B
650 B 262ms
116ms Document
text/html 2600:1901:0:94b6::
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s-usc1c-nss-232.firebaseio.com/.lp?dframe=t&id=11243012&pw=XVsOvKIVCV&ns=gitbook-28427

Requested by

Host: gstatic.gitbook.com
URL: https://gstatic.gitbook.com/js/111.f142f50e.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305

Server

2600:1901:0:94b6:: Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

nginx /

Resource Hash

cadc8f91766e8b012f72a17544df82dd9ede2cafc4e39c13ab2ac1110cb65144

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Host: s-usc1c-nss-232.firebaseio.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://www.ired.team/offensive-security/defense-evasion/retrieving-ntdll-syscall-stubs-at-run-time
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.ired.team/offensive-security/defense-evasion/retrieving-ntdll-syscall-stubs-at-run-time

Response headers

Server: nginx
Date: Thu, 03 Jun 2021 15:04:22 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 421
Connection: keep-alive
Strict-Transport-Security: max-age=31556926; includeSubDomains; preload

GET
H/1.1 200
OK .lp Show response
s-usc1c-nss-232.firebaseio.com/ Frame 3E3B 15 B
256 B 254ms
118ms Script
application/javascript 2600:1901:0:94b6::
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s-usc1c-nss-232.firebaseio.com/.lp?id=11243012&pw=XVsOvKIVCV&ser=50076622&ns=gitbook-28427

Requested by

Host: gstatic.gitbook.com
URL: https://gstatic.gitbook.com/js/111.f142f50e.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305

Server

2600:1901:0:94b6:: Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

nginx /

Resource Hash

3d14e96bd08692f39b357173c908dcb0b21ee11d0bdb29b963ce7fcc836eb4fd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Referer: https://www.ired.team/offensive-security/defense-evasion/retrieving-ntdll-syscall-stubs-at-run-time
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 03 Jun 2021 15:04:22 GMT
Server: nginx
Connection: keep-alive
Content-Length: 15
Strict-Transport-Security: max-age=31556926; includeSubDomains; preload
Content-Type: application/javascript; charset=utf-8

GET
H/1.1 200
OK .lp Show response
s-usc1c-nss-232.firebaseio.com/ Frame 3E3B 58 B
299 B 255ms
119ms Script
application/javascript 2600:1901:0:94b6::
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s-usc1c-nss-232.firebaseio.com/.lp?id=11243012&pw=XVsOvKIVCV&ser=50076623&ns=gitbook-28427&seg0=0&ts0=1&d0=eyJ0IjoiZCIsImQiOnsiciI6MSwiYSI6InMiLCJiIjp7ImMiOnsic2RrLmpzLjctMTQtMSI6MX19fX0.

Requested by

Host: gstatic.gitbook.com
URL: https://gstatic.gitbook.com/js/111.f142f50e.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305

Server

2600:1901:0:94b6:: Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

nginx /

Resource Hash

ef824052cc54e24358011a6d1f363813e99264883d6a019f5c98f75e43f78dc9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Referer: https://www.ired.team/offensive-security/defense-evasion/retrieving-ntdll-syscall-stubs-at-run-time
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 03 Jun 2021 15:04:22 GMT
Server: nginx
Connection: keep-alive
Content-Length: 58
Strict-Transport-Security: max-age=31556926; includeSubDomains; preload
Content-Type: application/javascript; charset=utf-8

GET
H2 200 photo.jpg
lh5.googleusercontent.com/-BT5DyX_LUys/AAAAAAAAAAI/AAAAAAAAAF4/wkmG-hKpMQk/ 7 KB
7 KB 7ms
6ms Image
image/jpeg 2a00:1450:4001:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh5.googleusercontent.com/-BT5DyX_LUys/AAAAAAAAAAI/AAAAAAAAAF4/wkmG-hKpMQk/photo.jpg

Requested by

Host: gstatic.gitbook.com
URL: https://gstatic.gitbook.com/js/111.f142f50e.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

3e46dc2084ab2945b5af16a2d88abcd6fa7e8aa5ef5a43fc6c83ce561b6c9577

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.ired.team/offensive-security/defense-evasion/retrieving-ntdll-syscall-stubs-at-run-time
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 03 Jun 2021 11:23:49 GMT
x-content-type-options: nosniff
age: 13233
content-disposition: inline;filename=""
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6707
x-xss-protection: 0
server: fife
etag: "v5e"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Wed, 02 Jun 2021 19:14:53 GMT

GET
H2 200 injection
opengraph.githubassets.com/35d6f7248342d8bbd9f6b9d2ddc8b839614a0f7b0d444ef7e9fc2429367d8a67/odzhan/ 118 KB
119 KB 51ms
51ms Image
image/png 185.199.109.154
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://opengraph.githubassets.com/35d6f7248342d8bbd9f6b9d2ddc8b839614a0f7b0d444ef7e9fc2429367d8a67/odzhan/injection

Requested by

Host: www.ired.team
URL: https://www.ired.team/offensive-security/defense-evasion/retrieving-ntdll-syscall-stubs-at-run-time

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

185.199.109.154 , United States, ASN54113 (FASTLY, US),

Reverse DNS

cdn-185-199-109-154.github.com

Software

Resource Hash

bb62321e7829079dc7a637073352b1d434a71495cc87df8a799b2d27e0bb6b5c

Security Headers

Name	Value
Content-Security-Policy	default-src 'none';style-src 'unsafe-inline';font-src https://github.github.com;img-src https://avatars.githubusercontent.com https://github.githubassets.com
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.ired.team/offensive-security/defense-evasion/retrieving-ntdll-syscall-stubs-at-run-time
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-fastly-request-id: 6e030f9392fe04830b19005ac7c8c5a675253712
content-security-policy: default-src 'none';style-src 'unsafe-inline';font-src https://github.github.com;img-src https://avatars.githubusercontent.com https://github.githubassets.com
via: 1.1 varnish, 1.1 varnish
x-content-type-options: nosniff
x-permitted-cross-domain-policies: none
age: 20616
x-dns-prefetch-control: off
x-cache: HIT, HIT
x-ratelimit-reset: 1622712876
strict-transport-security: max-age=31536000
content-length: 120908
x-github-backend: Kubernetes
x-served-by: cache-dca17752-DCA, cache-cdg20726-CDG
referrer-policy: no-referrer
x-github-request-id: 8608:4482:86CF:82099:60B89EEE
x-frame-options: SAMEORIGIN
date: Thu, 03 Jun 2021 15:04:23 GMT
expect-ct: max-age=0
x-ratelimit-remaining: 99
x-download-options: noopen
content-type: image/png
x-xss-protection: 0
cache-control: public, max-age=21600, immutable
etag: W/"1d84c-acGUvrKTyzDmv+Gre4Ffqr06iZk"
x-ratelimit-limit: 100
accept-ranges: bytes
x-cache-hits: 1, 1

GET
H2 200 HellsGate
opengraph.githubassets.com/269b67e416d1a7536c0e1582917b602cec8f8482edbc1d76accc136cdc31b402/am0nsec/ 102 KB
103 KB 40ms
40ms Image
image/png 185.199.109.154
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://opengraph.githubassets.com/269b67e416d1a7536c0e1582917b602cec8f8482edbc1d76accc136cdc31b402/am0nsec/HellsGate

Requested by

Host: www.ired.team
URL: https://www.ired.team/offensive-security/defense-evasion/retrieving-ntdll-syscall-stubs-at-run-time

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

185.199.109.154 , United States, ASN54113 (FASTLY, US),

Reverse DNS

cdn-185-199-109-154.github.com

Software

Resource Hash

687e274451679856fccb79dc8c625dd6daaa30c2be21838216332432b4c0bf9c

Security Headers

Name	Value
Content-Security-Policy	default-src 'none';style-src 'unsafe-inline';font-src https://github.github.com;img-src https://avatars.githubusercontent.com https://github.githubassets.com
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.ired.team/offensive-security/defense-evasion/retrieving-ntdll-syscall-stubs-at-run-time
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-fastly-request-id: 805c84395adfb5fbc4f05552094e663a47f18419
content-security-policy: default-src 'none';style-src 'unsafe-inline';font-src https://github.github.com;img-src https://avatars.githubusercontent.com https://github.githubassets.com
via: 1.1 varnish, 1.1 varnish
x-content-type-options: nosniff
x-permitted-cross-domain-policies: none
age: 20616
x-dns-prefetch-control: off
x-cache: HIT, HIT
x-ratelimit-reset: 1622712324
strict-transport-security: max-age=31536000
content-length: 104852
x-github-backend: Kubernetes
x-served-by: cache-dca12921-DCA, cache-cdg20726-CDG
referrer-policy: no-referrer
x-github-request-id: 3462:2FAB:10917:8A9E2:60B89EEE
x-frame-options: SAMEORIGIN
date: Thu, 03 Jun 2021 15:04:23 GMT
expect-ct: max-age=0
x-ratelimit-remaining: 43
x-download-options: noopen
content-type: image/png
x-xss-protection: 0
cache-control: public, max-age=21600, immutable
etag: W/"19994-rVPJcXNh+RiA+UH1YYlqaChsfzc"
x-ratelimit-limit: 100
accept-ranges: bytes
x-cache-hits: 1, 1

POST
H2 200 / Show response
www.gitbook.com/__amp/ 7 B
182 B 760ms
743ms XHR
text/html 2606:4700::6812:86f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gitbook.com/__amp/

Requested by

Host: gstatic.gitbook.com
URL: https://gstatic.gitbook.com/js/111.f142f50e.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:86f , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

aee408847d35e44e99430f0979c3357b85fe8dbb4535a494301198adbee85f27

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

Referer: https://www.ired.team/offensive-security/defense-evasion/retrieving-ntdll-syscall-stubs-at-run-time
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

date: Thu, 03 Jun 2021 15:04:23 GMT
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, POST
content-type: text/html;charset=utf-8
access-control-allow-origin: *
strict-transport-security: max-age=15768000
cf-ray: 6599d048499b4e3d-FRA
content-length: 7
cf-request-id: 0a7400812e00004e3deda84000000001

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 48 KB
19 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:827::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: gstatic.gitbook.com
URL: https://gstatic.gitbook.com/js/111.f142f50e.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

2cb09c7b3e19bfc41743ca3624ef81c3258d56525647feac76aa757e0292627a

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.ired.team/offensive-security/defense-evasion/retrieving-ntdll-syscall-stubs-at-run-time
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 09 Apr 2021 23:59:54 GMT
server: Golfe2
age: 6780
date: Thu, 03 Jun 2021 13:11:23 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19569
expires: Thu, 03 Jun 2021 15:11:23 GMT

GET
H2 200 7f9239ce726764aa22093884902e018d.svg
gstatic.gitbook.com/images/ 2 KB
1 KB 31ms
30ms Image
image/svg+xml 2606:4700::6812:86f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://gstatic.gitbook.com/images/7f9239ce726764aa22093884902e018d.svg
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:86f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 863db76a201dedb75ccb6392a1664138cfb5c60d71e2073056db22ca39a56fec

Request headers

Referer: https://www.ired.team/offensive-security/defense-evasion/retrieving-ntdll-syscall-stubs-at-run-time
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 03 Jun 2021 15:04:23 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 5199155
x-guploader-uploadid: ABg5-Uwp2ZHpfP2KRh3gmr5OfeDUxp0R7u-PLsf10qcUQXhVLjI--w_PdPdPrcA3PFb9bG3JCWQm3A0kt0wXHHc68KoZV03s2A
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-type: image/svg+xml
cf-request-id: 0a7400814400004e0d8917c000000001
last-modified: Fri, 19 Mar 2021 17:17:25 GMT
server: cloudflare
etag: W/"7f9239ce726764aa22093884902e018d"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-goog-hash: crc32c=VnuT0A==, md5=f5I5znJnZKoiCTiEkC4BjQ==
x-goog-generation: 1616174245138502
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-goog-stored-content-length: 2137
cf-ray: 6599d0486bb94e0d-FRA
expires: Mon, 04 Apr 2022 10:51:47 GMT

GET
H/1.1 200
OK .lp Show response
s-usc1c-nss-232.firebaseio.com/ Frame 3E3B 58 B
299 B 120ms
119ms Script
application/javascript 2600:1901:0:94b6::
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s-usc1c-nss-232.firebaseio.com/.lp?id=11243012&pw=XVsOvKIVCV&ser=50076624&ns=gitbook-28427&seg0=1&ts0=1&d0=eyJ0IjoiZCIsImQiOnsiciI6MiwiYSI6InEiLCJiIjp7InAiOiIvc3BhY2VzLy1MRkVNbkVSM2Z5d2dGSG9yb1luL3VzZXJQYWdlUmF0aW5ncy8tTTlEdTN4c01qa2Y2a01RRWdFVi8tTWJIT3B0bVhtQjd5aFdSTFE3biIsImgiOiIifX19

Requested by

Host: gstatic.gitbook.com
URL: https://gstatic.gitbook.com/js/111.f142f50e.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305

Server

2600:1901:0:94b6:: Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

nginx /

Resource Hash

01fe65d4fd93c66f51043f540156e23f6c69ef7ca0b6a0484bb063888989eb0e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Referer: https://www.ired.team/offensive-security/defense-evasion/retrieving-ntdll-syscall-stubs-at-run-time
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 03 Jun 2021 15:04:23 GMT
Server: nginx
Connection: keep-alive
Content-Length: 58
Strict-Transport-Security: max-age=31556926; includeSubDomains; preload
Content-Type: application/javascript; charset=utf-8

POST
H3-29 200 collect Show response
www.google-analytics.com/j/ 2 B
22 B 26ms
26ms XHR
text/plain 2a00:1450:4001:827::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j90&a=1682294707&t=pageview&_s=1&dl=https%3A%2F%2Fwww.ired.team%2Foffensive-security%2Fdefense-evasion%2Fretrieving-ntdll-syscall-stubs-at-run-time&dp=%2Foffensive-security%2Fdefense-evasion%2Fretrieving-ntdll-syscall-stubs-at-run-time&ul=en-us&de=UTF-8&dt=Retrieving%20ntdll%20Syscall%20Stubs%20from%20Disk%20at%20Run-time%20-%20Red%20Teaming%20Experiments&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEDAAEABAAAAAC~&jid=908792749&gjid=1098314534&cid=997574102.1622732663&tid=UA-57505611-10&_gid=114520084.1622732663&_r=1&_slc=1&cd1=-LFEMnER3fywgFHoroYn&cd2=-LFEMnEQwqZOY6DtfrzY&cd3=-MbDwy8EprV835IFqylT&cd4=master&cd5=-M9Du3xsMjkf6kMQEgEV&z=844532462

Requested by

Host: gstatic.gitbook.com
URL: https://gstatic.gitbook.com/js/111.f142f50e.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

a048e640908046be06e00eab37742b5d5ff80964af58cfd22f7cb2de4dfe375f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.ired.team/offensive-security/defense-evasion/retrieving-ntdll-syscall-stubs-at-run-time
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 03 Jun 2021 15:04:23 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.ired.team
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3-29 200 collect Show response
www.google-analytics.com/j/ 2 B
22 B 27ms
26ms XHR
text/plain 2a00:1450:4001:827::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j90&a=1682294707&t=pageview&_s=1&dl=https%3A%2F%2Fwww.ired.team%2Foffensive-security%2Fdefense-evasion%2Fretrieving-ntdll-syscall-stubs-at-run-time&dp=%2Foffensive-security%2Fdefense-evasion%2Fretrieving-ntdll-syscall-stubs-at-run-time&ul=en-us&de=UTF-8&dt=Retrieving%20ntdll%20Syscall%20Stubs%20from%20Disk%20at%20Run-time%20-%20Red%20Teaming%20Experiments&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEDAAEABAAAAAC~&jid=1723448213&gjid=2013919841&cid=997574102.1622732663&tid=UA-128974775-1&_gid=114520084.1622732663&_r=1&_slc=1&z=451354371

Requested by

Host: gstatic.gitbook.com
URL: https://gstatic.gitbook.com/js/111.f142f50e.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

a048e640908046be06e00eab37742b5d5ff80964af58cfd22f7cb2de4dfe375f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.ired.team/offensive-security/defense-evasion/retrieving-ntdll-syscall-stubs-at-run-time
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 03 Jun 2021 15:04:23 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.ired.team
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK .lp Show response
s-usc1c-nss-232.firebaseio.com/ Frame 3E3B 47 B
288 B 256ms
255ms Script
application/javascript 2600:1901:0:94b6::
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s-usc1c-nss-232.firebaseio.com/.lp?id=11243012&pw=XVsOvKIVCV&ser=50076625&ns=gitbook-28427

Requested by

Host: gstatic.gitbook.com
URL: https://gstatic.gitbook.com/js/111.f142f50e.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305

Server

2600:1901:0:94b6:: Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

nginx /

Resource Hash

1e77c60056c5fc881da96a001d25d0a31ebacb33bbbbe6aa32d512fe25603aab

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Referer: https://www.ired.team/offensive-security/defense-evasion/retrieving-ntdll-syscall-stubs-at-run-time
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 03 Jun 2021 15:04:23 GMT
Server: nginx
Connection: keep-alive
Content-Length: 47
Strict-Transport-Security: max-age=31556926; includeSubDomains; preload
Content-Type: application/javascript; charset=utf-8

GET
H/1.1 200
OK .lp Show response
s-usc1c-nss-232.firebaseio.com/ Frame 3E3B 38 B
279 B 118ms
118ms Script
application/javascript 2600:1901:0:94b6::
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s-usc1c-nss-232.firebaseio.com/.lp?id=11243012&pw=XVsOvKIVCV&ser=50076626&ns=gitbook-28427&seg0=2&ts0=1&d0=eyJ0IjoiYyIsImQiOnsidCI6Im4iLCJkIjp7fX19

Requested by

Host: gstatic.gitbook.com
URL: https://gstatic.gitbook.com/js/111.f142f50e.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305

Server

2600:1901:0:94b6:: Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

nginx /

Resource Hash

b9ed83a68ecae92dd158107eda45ec91444645a5a0fa2350b0460a3abc3975f0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Referer: https://www.ired.team/offensive-security/defense-evasion/retrieving-ntdll-syscall-stubs-at-run-time
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 03 Jun 2021 15:04:23 GMT
Server: nginx
Connection: keep-alive
Content-Length: 38
Strict-Transport-Security: max-age=31556926; includeSubDomains; preload
Content-Type: application/javascript; charset=utf-8

GET
H2 200 chunk.966.9bcdd26c.js Show response
gstatic.gitbook.com/js/ 1 MB
135 KB 33ms
32ms Script
application/javascript 2606:4700::6812:86f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://gstatic.gitbook.com/js/chunk.966.9bcdd26c.js
Requested by: Host: gstatic.gitbook.com
URL: https://gstatic.gitbook.com/js/111.f142f50e.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:86f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5b08085db82bdd556abf8dfe2c049e433274cd77fe15cadaa1437af9b5e928eb

Request headers

Referer: https://www.ired.team/offensive-security/defense-evasion/retrieving-ntdll-syscall-stubs-at-run-time
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 03 Jun 2021 15:04:27 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 5009513
cf-polished: origSize=1540766
x-guploader-uploadid: ABg5-UwpHqO3lEk5fGY24xMrxzKaUmsztOxRaJLPxdyRgqAeFBO9HlwfZkZiK-VlxtbNPv4e6b89Z03c6mD4LNmS6aO9oovXkg
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-type: application/javascript
cf-request-id: 0a7400916e00004e0db8386000000001
last-modified: Fri, 19 Mar 2021 17:17:25 GMT
server: cloudflare
etag: W/"1ee0a04f04f79506addc6f9cc9ade2c0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-goog-hash: crc32c=6ui4QQ==, md5=HuCgTwT3lQat3G+cya3iwA==
x-goog-generation: 1616174245205973
access-control-allow-origin: *
expires: Wed, 06 Apr 2022 15:32:34 GMT
cache-control: public, max-age=31536000
x-goog-stored-content-length: 1540766
cf-ray: 6599d06248684e0d-FRA
cf-bgj: minify

Verdicts & Comments Add Verdict or Comment

36 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

5 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.ired.team/	1970-01-19 18:45:32	Name: _gat_customTracker Value: 1
.ired.team/	1970-01-19 18:45:32	Name: _gat_space Value: 1
.ired.team/	1970-01-19 18:46:59	Name: _gid Value: GA1.2.114520084.1622732663
.ired.team/	1970-01-20 12:16:44	Name: _ga Value: GA1.2.997574102.1622732663
.ired.team/	1970-01-23 10:21:32	Name: amplitude_id_fef1e872c952688acd962d30aa545b9eired.team Value: eyJkZXZpY2VJZCI6IjA0MTZkMmU3LTllYTktNGRhYy05ZjQ4LTc0OWVmODA2YWZkMVIiLCJ1c2VySWQiOm51bGwsIm9wdE91dCI6ZmFsc2UsInNlc3Npb25JZCI6MTYyMjczMjY2MjI1OCwibGFzdEV2ZW50VGltZSI6MTYyMjczMjY2MzA2NywiZXZlbnRJZCI6MSwiaWRlbnRpZnlJZCI6MCwic2VxdWVuY2VOdW1iZXIiOjF9

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://gstatic.gitbook.com/js/111.f142f50e.js(Line 1) Message: Application ready

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	default-src 'self' gstatic.gitbook.com .gitbook-staging.com .gitbook.com .firebaseio.com wss://.firebaseio.com .cloudfunctions.net .googleapis.com .gstatic.com data: .google.com .github.com .algolianet.com .algolia.net sentry.io .logrocket.io .lr-ingest.io .stripe.com .clearbit.com .google-analytics.com d3hb14vkzrxvla.cloudfront.net d1j8pt39hxlh3d.cloudfront.net .iframe.ly blob: cdn.jsdelivr.net cdnjs.cloudflare.com api.amplitude.com https://api.intercom.io https://api-iam.intercom.io https://api-ping.intercom.io https://nexus-websocket-a.intercom.io https://nexus-websocket-b.intercom.io https://nexus-long-poller-a.intercom.io https://nexus-long-poller-b.intercom.io wss://nexus-websocket-a.intercom.io wss://nexus-websocket-b.intercom.io https://uploads.intercomcdn.com https://uploads.intercomusercontent.com https://share.intercom.io https://intercom-sheets.com https://www.intercom-reporting.com https://www.youtube.com https://player.vimeo.com https://fast.wistia.net https://js.intercomcdn.com https://intercom.help; script-src 'self' gstatic.gitbook.com 'unsafe-inline' .firebaseio.com .google.com polyfill.io cdn.lr-ingest.io cdn.logrocket.io .stripe.com .clearbit.com .google-analytics.com .iframe.ly .gstatic.com cdnjs.cloudflare.com .intercom.io .intercomcdn.com gitbookio.github.io https://app.intercom.io https://widget.intercom.io https://js.intercomcdn.com; style-src 'self' gstatic.gitbook.com 'unsafe-inline' fonts.googleapis.com unpkg.com cdnjs.cloudflare.com cdn.jsdelivr.net; img-src * data: blob: https://js.intercomcdn.com https://static.intercomassets.com https://downloads.intercomcdn.com https://uploads.intercomusercontent.com https://gifs.intercomcdn.com https://messenger-apps.intercom.io https://.intercom-attachments.com; frame-src ; object-src 'none'; child-src 'self' blob:; worker-src 'self' blob:; frame-ancestors https:
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

app.gitbook.com
cdn.lr-ingest.io
fonts.googleapis.com
fonts.gstatic.com
gblobscdn.gitbook.com
gitbook-28427.firebaseio.com
gstatic.gitbook.com
lh5.googleusercontent.com
opengraph.githubassets.com
polyfill.io
s-usc1c-nss-232.firebaseio.com
unpkg.com
www.gitbook.com
www.google-analytics.com
www.ired.team
185.199.109.154
2600:1901:0:94b6::
2606:4700:3035::6815:327f
2606:4700::6810:7aaf
2606:4700::6812:86f
2606:4700::6812:91
2a00:1450:4001:802::200a
2a00:1450:4001:80e::2001
2a00:1450:4001:827::200e
2a00:1450:4001:829::2003
2a04:4e42::621
01fe65d4fd93c66f51043f540156e23f6c69ef7ca0b6a0484bb063888989eb0e
0f79c8050d83c085609b218a122623fbe62c4da23f5c9d464c4cc8ddafcb0b03
1e77c60056c5fc881da96a001d25d0a31ebacb33bbbbe6aa32d512fe25603aab
2cb09c7b3e19bfc41743ca3624ef81c3258d56525647feac76aa757e0292627a
3d14e96bd08692f39b357173c908dcb0b21ee11d0bdb29b963ce7fcc836eb4fd
3e46dc2084ab2945b5af16a2d88abcd6fa7e8aa5ef5a43fc6c83ce561b6c9577
3e692de9565d90dd947a080d4d10cee72a83447ba053e08fdcac457d7197128a
44ebe32ebe11957105d1aad9a608156c457b879ca3d7cd6ac45bb2799b8e0aa2
5b08085db82bdd556abf8dfe2c049e433274cd77fe15cadaa1437af9b5e928eb
687e274451679856fccb79dc8c625dd6daaa30c2be21838216332432b4c0bf9c
6b0b8666fc1457fd6072565affee8e3bf60ad0501b18b17af5d1c29c1cce7320
6da43a0ac4abcb5bc4b10164a762759e5cc81f37e00033643034a891fb490c82
750951c80e7ffc5e4c9a69a92b8ea44a8ad3e70912c361c9fc104ac4c6562e42
863db76a201dedb75ccb6392a1664138cfb5c60d71e2073056db22ca39a56fec
8f6e5c507b22193f526855af76d30f10a70dd2a22608997c6eb51347772c55b3
9ac38761d2279f89b6c78710233621c81c264ddb69695c7033fddb092efb14e6
a048e640908046be06e00eab37742b5d5ff80964af58cfd22f7cb2de4dfe375f
a18af7799b7d241fe5d00645492ccedcad39815e9f4125b7e3e90b18a1b77405
aaecd144d2b8763b2fa5c91f09778294363cef363c10504205f4203922644d11
aee2771f5f57ecf568ffffd5c0d0fee81b7fb2b5540e10d856f2462abdbd5f92
aee408847d35e44e99430f0979c3357b85fe8dbb4535a494301198adbee85f27
b21be449e2ffa71effc34d0c605ded9903b322e8a0fd0c51dc01c5bb1c8e23a6
b87e90677bdbc3c6bc296a368f57b2d72783c1a7c6e8e9325cd1645c18039cf2
b9ed83a68ecae92dd158107eda45ec91444645a5a0fa2350b0460a3abc3975f0
bb62321e7829079dc7a637073352b1d434a71495cc87df8a799b2d27e0bb6b5c
c2751a024906377b9ec771173eb7b4c2cbd91766d245781f5d1546903125b807
c5e939d7d3f9c9bfe632d16484c12354fa89a12738f30f738aa81c984e5b9a92
c5ff636c13e4983198fbed7d325d1cbafbe544702de06f5874c46e359ce68b43
cadc8f91766e8b012f72a17544df82dd9ede2cafc4e39c13ab2ac1110cb65144
dd7ef9a64428b8cd988a1242fa13e495bdb62f422882ce94c90f9c0bc8a28096
eb929919479b2afe4e756a8ab718e9adbc8d94dbd0504da1cf4cea2b252833cc
ef824052cc54e24358011a6d1f363813e99264883d6a019f5c98f75e43f78dc9
f29cd3a2bdcacf9f9f7285c9b74d89f55634f4d43752d81a48914afa7442eb66
f4ffb28b288f3288a4e90c3d96b77cd37aa8d264f2feb85ed356f76115e94403
fc6885517e1e6df36c33a5d7eb85c80c068b0049498834b74b9c7908aff43825

www.ired.team Open in urlscan Pro 2606:4700::6812:91 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

46 Requests

98 %HTTPS

91 %IPv6

11 Domains

15 Subdomains

12 IPs

2 Countries

5403 kBTransfer

11846 kBSize

5 Cookies

9 Outgoing links

Redirected requests

46 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

www.ired.team Open in urlscan Pro
2606:4700::6812:91 Public Scan

Screenshot
Live screenshot

Full Image

46
Requests

98 %
HTTPS

91 %
IPv6

11
Domains

15
Subdomains

12
IPs

2
Countries

5403 kB
Transfer

11846 kB
Size

5
Cookies

46 HTTP transactions
0 data transactions