posts.specterops.io Open in urlscan Pro
52.4.240.221 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb
Effective URL:
https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54...
Submission: On February 19 via api (February 19th 2024, 9:06:49 am UTC) from BE — Scanned from DE

Summary HTTP 78 Redirects Links 96 Behaviour Indicators

Summary

This website contacted 8 IPs in 2 countries across 6 domains to perform 78 HTTP transactions. The main IP is 52.4.240.221, located in Ashburn, United States and belongs to AMAZON-AES, US. The main domain is posts.specterops.io.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on November 8th 2023. Valid for: a year.

This is the only time posts.specterops.io was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 14	52.4.240.221 52.4.240.221	14618 (AMAZON-AES) (AMAZON-AES)
1 13	2606:4700:7::... 2606:4700:7::a29f:9904	13335 (CLOUDFLAR...) (CLOUDFLARENET)
46	2606:4700:7::... 2606:4700:7::a29f:9804	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:811::2008	15169 (GOOGLE) (GOOGLE)
1	108.138.26.116 108.138.26.116	16509 (AMAZON-02) (AMAZON-02)
1	2600:9000:205... 2600:9000:2057:9800:19:9934:6a80:93a1	16509 (AMAZON-02) (AMAZON-02)
1	2001:4860:480... 2001:4860:4802:32::36	15169 (GOOGLE) (GOOGLE)
3	2600:9000:249... 2600:9000:2491:e800:11:f728:3040:93a1	16509 (AMAZON-02) (AMAZON-02)
78	8

14 52.4.240.221 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-4-240-221.compute-1.amazonaws.com

posts.specterops.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 2606:4700:7::a29f:9904 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

medium.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
glyph.medium.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
miro.medium.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cdn-client.medium.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

46 2606:4700:7::a29f:9804 (United States)

ASN13335 (CLOUDFLARENET, US)

glyph.medium.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
miro.medium.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cdn-client.medium.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:811::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 108.138.26.116 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-108-138-26-116.fra56.r.cloudfront.net

cdn.branch.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2057:9800:19:9934:6a80:93a1 (United States)

ASN16509 (AMAZON-02, US)

app.link	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4860:4802:32::36 (United States)

ASN15169 (GOOGLE, US)

region1.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2600:9000:2491:e800:11:f728:3040:93a1 (United States)

ASN16509 (AMAZON-02, US)

api2.branch.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
59	medium.com 1 redirects medium.com — Cisco Umbrella Rank: 11368 glyph.medium.com — Cisco Umbrella Rank: 23106 miro.medium.com — Cisco Umbrella Rank: 15391 cdn-client.medium.com — Cisco Umbrella Rank: 24382	1 MB
14	specterops.io 1 redirects posts.specterops.io	57 KB
4	branch.io cdn.branch.io — Cisco Umbrella Rank: 1039 api2.branch.io — Cisco Umbrella Rank: 1031	25 KB
1	google-analytics.com region1.google-analytics.com — Cisco Umbrella Rank: 2000	247 B
1	app.link app.link — Cisco Umbrella Rank: 2695	634 B
1	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 52	84 KB
78	6

	Domain	Requested by
38	cdn-client.medium.com	posts.specterops.io cdn-client.medium.com
14	posts.specterops.io	1 redirects cdn-client.medium.com
11	miro.medium.com	posts.specterops.io
9	glyph.medium.com	glyph.medium.com
3	api2.branch.io	cdn-client.medium.com
1	region1.google-analytics.com	www.googletagmanager.com
1	app.link	cdn.branch.io
1	cdn.branch.io	posts.specterops.io
1	www.googletagmanager.com	cdn-client.medium.com
1	medium.com	1 redirects
78	10

This site contains links to these domains. Also see Links.

Domain
rsci.app.link
medium.com
mattifestation.medium.com
web.archive.org
msdn.microsoft.com
www.w3.org
schemas.datacontract.org
schemas.microsoft.com
gist.github.com
github.com
www.exploit-monday.com
social.msdn.microsoft.com
docs.microsoft.com
creativecommons.org
harmj0y.medium.com
detect.fyi
mthcht.medium.com
jsecurity101.medium.com
blog.filigran.io
tastypepperoni.medium.com
help.medium.com
medium.statuspage.io
blog.medium.com
policy.medium.com
speechify.com

Subject Issuer	Validity	Valid
posts.specterops.io Sectigo RSA Domain Validation Secure Server CA	`2023-11-08` - `2024-11-07`	a year	crt.sh
medium.com Cloudflare Inc ECC CA-3	`2024-02-16` - `2024-12-31`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2024-01-29` - `2024-04-22`	3 months	crt.sh
*.branch.io Amazon RSA 2048 M01	`2023-09-11` - `2024-10-09`	a year	crt.sh
appipv4.link Amazon RSA 2048 M02	`2023-04-25` - `2024-05-23`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d
Frame ID: 15813E6529FE3B30BD7CA6921263B022
Requests: 78 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Arbitrary, Unsigned Code Execution Vector in Microsoft.Workflow.Compiler.exe | by Matt Graeber | Posts By SpecterOps Team Members

Page URL History Show full URLs

https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-... HTTP 307
https://medium.com/m/global-identity-2?redirectUrl=https%3A%2F%2Fposts.specterops.io%2Farbitrar... HTTP 307
https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-... Page URL

Detected technologies

Medium (Blogs) Expand

Overall confidence: 100%
Detected patterns

medium\.com

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtag/js

Page Statistics

78
Requests

100 %
HTTPS

75 %
IPv6

6
Domains

10
Subdomains

8
IPs

2
Countries

1376 kB
Transfer

3482 kB
Size

8
Cookies

96 Outgoing links

These are links going to different origins than the main page.

URL: https://rsci.app.link/?%24canonical_url=https%3A%2F%2Fmedium.com%2Fp%2F3d9294bc5efb&%7Efeature=LoOpenInAppButton&%7Echannel=ShowPostUnderCollection&source=---two_column_layout_nav----------------------------------
Title: Open in app

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?operation=register&redirect=https%3A%2F%2Fposts.specterops.io%2Farbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb&source=post_page---two_column_layout_nav-----------------------global_nav-----------
Title: Sign up

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?operation=login&redirect=https%3A%2F%2Fposts.specterops.io%2Farbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb&source=post_page---two_column_layout_nav-----------------------global_nav-----------
Title: Sign in

Search URL Search Domain Scan URL

URL: https://medium.com/?source=---two_column_layout_nav----------------------------------

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?operation=register&redirect=https%3A%2F%2Fmedium.com%2Fnew-story&source=---two_column_layout_nav-----------------------new_post_topnav-----------
Title: Write

Search URL Search Domain Scan URL

URL: https://medium.com/search?source=---two_column_layout_nav----------------------------------

Search URL Search Domain Scan URL

URL: https://mattifestation.medium.com/?source=post_page-----3d9294bc5efb--------------------------------

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?actionUrl=https%3A%2F%2Fmedium.com%2F_%2Fsubscribe%2Fuser%2Fe8e64b89121&operation=register&redirect=https%3A%2F%2Fposts.specterops.io%2Farbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb&user=Matt+Graeber&userId=e8e64b89121&source=post_page-e8e64b89121----3d9294bc5efb---------------------post_header-----------
Title: Follow

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?actionUrl=https%3A%2F%2Fmedium.com%2F_%2Fvote%2Fspecter-ops-posts%2F3d9294bc5efb&operation=register&redirect=https%3A%2F%2Fposts.specterops.io%2Farbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb&user=Matt+Graeber&userId=e8e64b89121&source=-----3d9294bc5efb---------------------clap_footer-----------

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?actionUrl=https%3A%2F%2Fmedium.com%2F_%2Fbookmark%2Fp%2F3d9294bc5efb&operation=register&redirect=https%3A%2F%2Fposts.specterops.io%2Farbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb&source=-----3d9294bc5efb---------------------bookmark_footer-----------

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?actionUrl=https%3A%2F%2Fmedium.com%2Fplans%3Fdimension%3Dpost_audio_button%26postId%3D3d9294bc5efb&operation=register&redirect=https%3A%2F%2Fposts.specterops.io%2Farbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb&source=-----3d9294bc5efb---------------------post_audio_button-----------
Title: Listen

Search URL Search Domain Scan URL

URL: https://web.archive.org/web/20161212224652/http://subt0x10.blogspot.com/2016/09/bypassing-application-whitelisting.html
Title: msbuild.exe bypass

Search URL Search Domain Scan URL

URL: https://msdn.microsoft.com/en-us/library/h538bck7(v=vs.110).aspx
Title: Assembly.Load(byte[])

Search URL Search Domain Scan URL

URL: http://www.w3.org/2001/XMLSchema-instance
Title: http://www.w3.org/2001/XMLSchema-instance

Search URL Search Domain Scan URL

URL: http://schemas.datacontract.org/2004/07/Microsoft.Workflow.Compiler
Title: http://schemas.datacontract.org/2004/07/Microsoft.Workflow.Compiler

Search URL Search Domain Scan URL

URL: http://schemas.microsoft.com/2003/10/Serialization/Arrays
Title: http://schemas.microsoft.com/2003/10/Serialization/Arrays

Search URL Search Domain Scan URL

URL: http://schemas.datacontract.org/2004/07/System.Workflow.ComponentModel.Compiler
Title: http://schemas.datacontract.org/2004/07/System.Workflow.ComponentModel.Compiler

Search URL Search Domain Scan URL

URL: http://schemas.datacontract.org/2004/07/System.CodeDom.Compiler
Title: http://schemas.datacontract.org/2004/07/System.CodeDom.Compiler

Search URL Search Domain Scan URL

URL: http://schemas.datacontract.org/2004/07/System.Security.Policy
Title: http://schemas.datacontract.org/2004/07/System.Security.Policy

Search URL Search Domain Scan URL

URL: http://schemas.datacontract.org/2004/07/System.Reflection
Title: http://schemas.datacontract.org/2004/07/System.Reflection

Search URL Search Domain Scan URL

URL: http://schemas.datacontract.org/2004/07/System.CodeDom
Title: http://schemas.datacontract.org/2004/07/System.CodeDom

Search URL Search Domain Scan URL

URL: http://schemas.microsoft.com/winfx/2006/xaml
Title: http://schemas.microsoft.com/winfx/2006/xaml

Search URL Search Domain Scan URL

URL: http://schemas.microsoft.com/winfx/2006/xaml/workflow
Title: http://schemas.microsoft.com/winfx/2006/xaml/workflow

Search URL Search Domain Scan URL

URL: https://gist.github.com/mattifestation/67435063004effaac02809506890c7bb
Title: crude tooling

Search URL Search Domain Scan URL

URL: https://github.com/0xd4d/dnSpy
Title: dnSpy

Search URL Search Domain Scan URL

URL: http://www.exploit-monday.com/2017/07/bypassing-device-guard-with-dotnet-methods.html
Title: here

Search URL Search Domain Scan URL

URL: https://social.msdn.microsoft.com/Forums/en-US/a2281c32-9e09-4a12-95e7-4a83b90124e3/sample-xoml-file?forum=windowsworkflowfoundation
Title: this article

Search URL Search Domain Scan URL

URL: https://gist.github.com/mattifestation/3e28d391adbd7fe3e0c722a107a25aba
Title: here

Search URL Search Domain Scan URL

URL: https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules
Title: canonical blacklist policy

Search URL Search Domain Scan URL

URL: http://www.exploit-monday.com/2016/09/using-device-guard-to-mitigate-against.html
Title: merge into your base policy

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?operation=register&redirect=https%3A%2F%2Fposts.specterops.io%2Farbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb&source=---post_footer_upsell--3d9294bc5efb---------------------lo_non_moc_upsell-----------
Title: Sign up for free

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?operation=register&redirect=https%3A%2F%2Fmedium.com%2Fplans&source=---post_footer_upsell--3d9294bc5efb---------------------lo_non_moc_upsell-----------
Title: Try for $5/month

Search URL Search Domain Scan URL

URL: https://medium.com/tag/application-whitelisting?source=post_page-----3d9294bc5efb---------------application_whitelisting-----------------
Title: Application Whitelisting

Search URL Search Domain Scan URL

URL: https://medium.com/tag/computer-security?source=post_page-----3d9294bc5efb---------------computer_security-----------------
Title: Computer Security

Search URL Search Domain Scan URL

URL: http://creativecommons.org/licenses/by/4.0/
Title: Some rights reserved

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?actionUrl=%2F_%2Fapi%2Fsubscriptions%2Fnewsletters%2F7db304d15601&operation=register&redirect=https%3A%2F%2Fposts.specterops.io%2Farbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb&newsletterV3=e8e64b89121&newsletterV3Id=7db304d15601&user=Matt+Graeber&userId=e8e64b89121&source=-----3d9294bc5efb---------------------subscribe_user-----------

Search URL Search Domain Scan URL

URL: https://mattifestation.medium.com/followers?source=post_page-----3d9294bc5efb--------------------------------
Title: 614 Followers

Search URL Search Domain Scan URL

URL: https://mattifestation.medium.com/?source=author_recirc-----3d9294bc5efb----0---------------------a7208532_3bf2_40da_b6f8_5f0ffb16f05a-------

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?actionUrl=https%3A%2F%2Fmedium.com%2F_%2Fvote%2Fspecter-ops-posts%2Fbe7ad7f99a47&operation=register&redirect=https%3A%2F%2Fposts.specterops.io%2Fworking-with-sysmon-configurations-like-a-pro-through-better-tooling-be7ad7f99a47&user=Matt+Graeber&userId=e8e64b89121&source=-----be7ad7f99a47----0-----------------clap_footer----a7208532_3bf2_40da_b6f8_5f0ffb16f05a-------

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?actionUrl=https%3A%2F%2Fmedium.com%2F_%2Fbookmark%2Fp%2Fbe7ad7f99a47&operation=register&redirect=https%3A%2F%2Fposts.specterops.io%2Fworking-with-sysmon-configurations-like-a-pro-through-better-tooling-be7ad7f99a47&source=-----3d9294bc5efb----0-----------------bookmark_preview----a7208532_3bf2_40da_b6f8_5f0ffb16f05a-------

Search URL Search Domain Scan URL

URL: https://medium.com/@_wald0?source=author_recirc-----3d9294bc5efb----1---------------------a7208532_3bf2_40da_b6f8_5f0ffb16f05a-------

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?actionUrl=https%3A%2F%2Fmedium.com%2F_%2Fvote%2Fspecter-ops-posts%2Fda2b7e674ebc&operation=register&redirect=https%3A%2F%2Fposts.specterops.io%2Fmicrosoft-breach-what-happened-what-should-azure-admins-do-da2b7e674ebc&user=Andy+Robbins&userId=b9c2df322eaf&source=-----da2b7e674ebc----1-----------------clap_footer----a7208532_3bf2_40da_b6f8_5f0ffb16f05a-------

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?actionUrl=https%3A%2F%2Fmedium.com%2F_%2Fbookmark%2Fp%2Fda2b7e674ebc&operation=register&redirect=https%3A%2F%2Fposts.specterops.io%2Fmicrosoft-breach-what-happened-what-should-azure-admins-do-da2b7e674ebc&source=-----3d9294bc5efb----1-----------------bookmark_preview----a7208532_3bf2_40da_b6f8_5f0ffb16f05a-------

Search URL Search Domain Scan URL

URL: https://harmj0y.medium.com/?source=author_recirc-----3d9294bc5efb----2---------------------a7208532_3bf2_40da_b6f8_5f0ffb16f05a-------

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?actionUrl=https%3A%2F%2Fmedium.com%2F_%2Fvote%2Fspecter-ops-posts%2Fd95910965cd2&operation=register&redirect=https%3A%2F%2Fposts.specterops.io%2Fcertified-pre-owned-d95910965cd2&user=Will+Schroeder&userId=74ad66811b78&source=-----d95910965cd2----2-----------------clap_footer----a7208532_3bf2_40da_b6f8_5f0ffb16f05a-------

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?actionUrl=https%3A%2F%2Fmedium.com%2F_%2Fbookmark%2Fp%2Fd95910965cd2&operation=register&redirect=https%3A%2F%2Fposts.specterops.io%2Fcertified-pre-owned-d95910965cd2&source=-----3d9294bc5efb----2-----------------bookmark_preview----a7208532_3bf2_40da_b6f8_5f0ffb16f05a-------

Search URL Search Domain Scan URL

URL: https://mattifestation.medium.com/?source=author_recirc-----3d9294bc5efb----3---------------------a7208532_3bf2_40da_b6f8_5f0ffb16f05a-------

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?actionUrl=https%3A%2F%2Fmedium.com%2F_%2Fvote%2Fspecter-ops-posts%2F6f98657fc6ec&operation=register&redirect=https%3A%2F%2Fposts.specterops.io%2Fcode-signing-certificate-cloning-attacks-and-defenses-6f98657fc6ec&user=Matt+Graeber&userId=e8e64b89121&source=-----6f98657fc6ec----3-----------------clap_footer----a7208532_3bf2_40da_b6f8_5f0ffb16f05a-------

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?actionUrl=https%3A%2F%2Fmedium.com%2F_%2Fbookmark%2Fp%2F6f98657fc6ec&operation=register&redirect=https%3A%2F%2Fposts.specterops.io%2Fcode-signing-certificate-cloning-attacks-and-defenses-6f98657fc6ec&source=-----3d9294bc5efb----3-----------------bookmark_preview----a7208532_3bf2_40da_b6f8_5f0ffb16f05a-------

Search URL Search Domain Scan URL

URL: https://medium.com/@grayhatkiller?source=read_next_recirc-----3d9294bc5efb----0---------------------0eed1384_1423_44c3_b772_085ac77016f9-------

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?actionUrl=https%3A%2F%2Fmedium.com%2F_%2Fvote%2Fspecter-ops-posts%2F3c016d0d9922&operation=register&redirect=https%3A%2F%2Fposts.specterops.io%2Flateral-movement-abuse-the-power-of-dcom-excel-application-3c016d0d9922&user=Raj+Patel&userId=8b7cdaac6065&source=-----3c016d0d9922----0-----------------clap_footer----0eed1384_1423_44c3_b772_085ac77016f9-------

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?actionUrl=https%3A%2F%2Fmedium.com%2F_%2Fbookmark%2Fp%2F3c016d0d9922&operation=register&redirect=https%3A%2F%2Fposts.specterops.io%2Flateral-movement-abuse-the-power-of-dcom-excel-application-3c016d0d9922&source=-----3d9294bc5efb----0-----------------bookmark_preview----0eed1384_1423_44c3_b772_085ac77016f9-------

Search URL Search Domain Scan URL

URL: https://detect.fyi/detect-dll-hijacking-techniques-from-hijacklibs-with-splunk-c760d2e0656f?source=read_next_recirc-----3d9294bc5efb----1---------------------0eed1384_1423_44c3_b772_085ac77016f9-------

Search URL Search Domain Scan URL

URL: https://mthcht.medium.com/?source=read_next_recirc-----3d9294bc5efb----1---------------------0eed1384_1423_44c3_b772_085ac77016f9-------

Search URL Search Domain Scan URL

URL: https://detect.fyi/?source=read_next_recirc-----3d9294bc5efb----1---------------------0eed1384_1423_44c3_b772_085ac77016f9-------
Title: Detect FYI

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?actionUrl=https%3A%2F%2Fmedium.com%2F_%2Fvote%2Fdetect-fyi%2Fc760d2e0656f&operation=register&redirect=https%3A%2F%2Fdetect.fyi%2Fdetect-dll-hijacking-techniques-from-hijacklibs-with-splunk-c760d2e0656f&user=mthcht&userId=104861307c56&source=-----c760d2e0656f----1-----------------clap_footer----0eed1384_1423_44c3_b772_085ac77016f9-------

Search URL Search Domain Scan URL

URL: https://detect.fyi/detect-dll-hijacking-techniques-from-hijacklibs-with-splunk-c760d2e0656f?responsesOpen=true&sortBy=REVERSE_CHRON&source=read_next_recirc-----3d9294bc5efb----1---------------------0eed1384_1423_44c3_b772_085ac77016f9-------

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?actionUrl=https%3A%2F%2Fmedium.com%2F_%2Fbookmark%2Fp%2Fc760d2e0656f&operation=register&redirect=https%3A%2F%2Fdetect.fyi%2Fdetect-dll-hijacking-techniques-from-hijacklibs-with-splunk-c760d2e0656f&source=-----3d9294bc5efb----1-----------------bookmark_preview----0eed1384_1423_44c3_b772_085ac77016f9-------

Search URL Search Domain Scan URL

URL: https://medium.com/@MediumStaff/list/staff-picks-c7bc6e1ee00f?source=read_next_recirc-----3d9294bc5efb--------------------------------
Title: Staff Picks584 stories·760 saves

Search URL Search Domain Scan URL

URL: https://medium.com/@MediumStaff/list/stories-to-help-you-levelup-at-work-faca18b0622f?source=read_next_recirc-----3d9294bc5efb--------------------------------
Title: Stories to Help You Level-Up at Work19 stories·484 saves

Search URL Search Domain Scan URL

URL: https://medium.com/@MediumForTeams/list/selfimprovement-101-3c62b6cb0526?source=read_next_recirc-----3d9294bc5efb--------------------------------
Title: Self-Improvement 10120 stories·1359 saves

Search URL Search Domain Scan URL

URL: https://medium.com/@MediumForTeams/list/productivity-101-f09f1aaf38cd?source=read_next_recirc-----3d9294bc5efb--------------------------------
Title: Productivity 10120 stories·1247 saves

Search URL Search Domain Scan URL

URL: https://jsecurity101.medium.com/demystifying-dll-hijacking-understanding-the-intricate-world-of-dynamic-link-library-attacks-7146cea12d17?source=read_next_recirc-----3d9294bc5efb----0---------------------0eed1384_1423_44c3_b772_085ac77016f9-------

Search URL Search Domain Scan URL

URL: https://jsecurity101.medium.com/?source=read_next_recirc-----3d9294bc5efb----0---------------------0eed1384_1423_44c3_b772_085ac77016f9-------

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?actionUrl=https%3A%2F%2Fmedium.com%2F_%2Fvote%2Fp%2F7146cea12d17&operation=register&redirect=https%3A%2F%2Fjsecurity101.medium.com%2Fdemystifying-dll-hijacking-understanding-the-intricate-world-of-dynamic-link-library-attacks-7146cea12d17&user=Jonathan+Johnson&userId=78d2ff57ed70&source=-----7146cea12d17----0-----------------clap_footer----0eed1384_1423_44c3_b772_085ac77016f9-------

Search URL Search Domain Scan URL

URL: https://jsecurity101.medium.com/demystifying-dll-hijacking-understanding-the-intricate-world-of-dynamic-link-library-attacks-7146cea12d17?responsesOpen=true&sortBy=REVERSE_CHRON&source=read_next_recirc-----3d9294bc5efb----0---------------------0eed1384_1423_44c3_b772_085ac77016f9-------

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?actionUrl=https%3A%2F%2Fmedium.com%2F_%2Fbookmark%2Fp%2F7146cea12d17&operation=register&redirect=https%3A%2F%2Fjsecurity101.medium.com%2Fdemystifying-dll-hijacking-understanding-the-intricate-world-of-dynamic-link-library-attacks-7146cea12d17&source=-----3d9294bc5efb----0-----------------bookmark_preview----0eed1384_1423_44c3_b772_085ac77016f9-------

Search URL Search Domain Scan URL

URL: https://blog.filigran.io/dont-miss-any-vital-info-with-file-indexing-in-opencti-d066edafe7b4?source=read_next_recirc-----3d9294bc5efb----1---------------------0eed1384_1423_44c3_b772_085ac77016f9-------

Search URL Search Domain Scan URL

URL: https://medium.com/@marieflores.contact?source=read_next_recirc-----3d9294bc5efb----1---------------------0eed1384_1423_44c3_b772_085ac77016f9-------

Search URL Search Domain Scan URL

URL: https://blog.filigran.io/?source=read_next_recirc-----3d9294bc5efb----1---------------------0eed1384_1423_44c3_b772_085ac77016f9-------
Title: Filigran Blog

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?actionUrl=https%3A%2F%2Fmedium.com%2F_%2Fvote%2Ffiligran%2Fd066edafe7b4&operation=register&redirect=https%3A%2F%2Fblog.filigran.io%2Fdont-miss-any-vital-info-with-file-indexing-in-opencti-d066edafe7b4&user=Marie+Flores&userId=53b898976e01&source=-----d066edafe7b4----1-----------------clap_footer----0eed1384_1423_44c3_b772_085ac77016f9-------

Search URL Search Domain Scan URL

URL: https://blog.filigran.io/dont-miss-any-vital-info-with-file-indexing-in-opencti-d066edafe7b4?responsesOpen=true&sortBy=REVERSE_CHRON&source=read_next_recirc-----3d9294bc5efb----1---------------------0eed1384_1423_44c3_b772_085ac77016f9-------

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?actionUrl=https%3A%2F%2Fmedium.com%2F_%2Fbookmark%2Fp%2Fd066edafe7b4&operation=register&redirect=https%3A%2F%2Fblog.filigran.io%2Fdont-miss-any-vital-info-with-file-indexing-in-opencti-d066edafe7b4&source=-----3d9294bc5efb----1-----------------bookmark_preview----0eed1384_1423_44c3_b772_085ac77016f9-------

Search URL Search Domain Scan URL

URL: https://medium.com/@boutnaru/windows-process-923b9332c12?source=read_next_recirc-----3d9294bc5efb----2---------------------0eed1384_1423_44c3_b772_085ac77016f9-------

Search URL Search Domain Scan URL

URL: https://medium.com/@boutnaru?source=read_next_recirc-----3d9294bc5efb----2---------------------0eed1384_1423_44c3_b772_085ac77016f9-------

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?actionUrl=https%3A%2F%2Fmedium.com%2F_%2Fvote%2Fp%2F923b9332c12&operation=register&redirect=https%3A%2F%2Fmedium.com%2F%40boutnaru%2Fwindows-process-923b9332c12&user=Shlomi+Boutnaru%2C+Ph.D.&userId=e7d184dfba5b&source=-----923b9332c12----2-----------------clap_footer----0eed1384_1423_44c3_b772_085ac77016f9-------

Search URL Search Domain Scan URL

URL: https://medium.com/@boutnaru/windows-process-923b9332c12?responsesOpen=true&sortBy=REVERSE_CHRON&source=read_next_recirc-----3d9294bc5efb----2---------------------0eed1384_1423_44c3_b772_085ac77016f9-------

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?actionUrl=https%3A%2F%2Fmedium.com%2F_%2Fbookmark%2Fp%2F923b9332c12&operation=register&redirect=https%3A%2F%2Fmedium.com%2F%40boutnaru%2Fwindows-process-923b9332c12&source=-----3d9294bc5efb----2-----------------bookmark_preview----0eed1384_1423_44c3_b772_085ac77016f9-------

Search URL Search Domain Scan URL

URL: https://tastypepperoni.medium.com/bypassing-defenders-lsass-dump-detection-and-ppl-protection-in-go-7dd85d9a32e6?source=read_next_recirc-----3d9294bc5efb----3---------------------0eed1384_1423_44c3_b772_085ac77016f9-------

Search URL Search Domain Scan URL

URL: https://tastypepperoni.medium.com/?source=read_next_recirc-----3d9294bc5efb----3---------------------0eed1384_1423_44c3_b772_085ac77016f9-------

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?actionUrl=https%3A%2F%2Fmedium.com%2F_%2Fvote%2Fp%2F7dd85d9a32e6&operation=register&redirect=https%3A%2F%2Ftastypepperoni.medium.com%2Fbypassing-defenders-lsass-dump-detection-and-ppl-protection-in-go-7dd85d9a32e6&user=pepperoni&userId=e7fd6d08e50a&source=-----7dd85d9a32e6----3-----------------clap_footer----0eed1384_1423_44c3_b772_085ac77016f9-------

Search URL Search Domain Scan URL

URL: https://tastypepperoni.medium.com/bypassing-defenders-lsass-dump-detection-and-ppl-protection-in-go-7dd85d9a32e6?responsesOpen=true&sortBy=REVERSE_CHRON&source=read_next_recirc-----3d9294bc5efb----3---------------------0eed1384_1423_44c3_b772_085ac77016f9-------
Title: 1

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?actionUrl=https%3A%2F%2Fmedium.com%2F_%2Fbookmark%2Fp%2F7dd85d9a32e6&operation=register&redirect=https%3A%2F%2Ftastypepperoni.medium.com%2Fbypassing-defenders-lsass-dump-detection-and-ppl-protection-in-go-7dd85d9a32e6&source=-----3d9294bc5efb----3-----------------bookmark_preview----0eed1384_1423_44c3_b772_085ac77016f9-------

Search URL Search Domain Scan URL

URL: https://medium.com/?source=post_page-----3d9294bc5efb--------------------------------
Title: See more recommendations

Search URL Search Domain Scan URL

URL: https://help.medium.com/hc/en-us?source=post_page-----3d9294bc5efb--------------------------------
Title: Help

Search URL Search Domain Scan URL

URL: https://medium.statuspage.io/?source=post_page-----3d9294bc5efb--------------------------------
Title: Status

Search URL Search Domain Scan URL

URL: https://medium.com/about?autoplay=1&source=post_page-----3d9294bc5efb--------------------------------
Title: About

Search URL Search Domain Scan URL

URL: https://medium.com/jobs-at-medium/work-at-medium-959d1a85284e?source=post_page-----3d9294bc5efb--------------------------------
Title: Careers

Search URL Search Domain Scan URL

URL: https://blog.medium.com/?source=post_page-----3d9294bc5efb--------------------------------
Title: Blog

Search URL Search Domain Scan URL

URL: https://policy.medium.com/medium-privacy-policy-f03bf92035c9?source=post_page-----3d9294bc5efb--------------------------------
Title: Privacy

Search URL Search Domain Scan URL

URL: https://policy.medium.com/medium-terms-of-service-9db0094a1e0f?source=post_page-----3d9294bc5efb--------------------------------
Title: Terms

Search URL Search Domain Scan URL

URL: https://speechify.com/medium?source=post_page-----3d9294bc5efb--------------------------------
Title: Text to speech

Search URL Search Domain Scan URL

URL: https://medium.com/business?source=post_page-----3d9294bc5efb--------------------------------
Title: Teams

Search URL Search Domain Scan URL

URL: https://policy.medium.com/medium-privacy-policy-f03bf92035c9
Title: Privacy Policy

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb HTTP 307
https://medium.com/m/global-identity-2?redirectUrl=https%3A%2F%2Fposts.specterops.io%2Farbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb HTTP 307
https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

78 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb Show response
posts.specterops.io/
Redirect Chain

https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb
https://medium.com/m/global-identity-2?redirectUrl=https%3A%2F%2Fposts.specterops.io%2Farbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb
https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d

232 KB
47 KB

509ms
508ms

Document
text/html

52.4.240.221
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

52.4.240.221 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-4-240-221.compute-1.amazonaws.com

Software

nginx /

Resource Hash

783a77c4f9a5db02ae0c7f507a10c6dcda86b1c230ae75c919856928fd577e76

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://medium.com

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: gzip
content-security-policy: frame-ancestors 'self' https://medium.com
content-type: text/html; charset=utf-8
date: Mon, 19 Feb 2024 09:06:43 GMT
etag: W/"3a05f-rzvBz4ijxVWFG0jRZdAxwN6pJrI"
link: <https://glyph.medium.com/css/unbound.css>; as="style"; rel="preload"
medium-fulfilled-by: valencia/main-20240216-153936-4fe2349849, lite/main-20240216-225249-5bd4ea8c7b, rito/main-20240216-164721-dd4e97f475, tutu/main-20240216-230730-3d7808ad64
medium-missing-time: 233
sepia-upstream: medium
server: nginx
vary: Accept-Encoding
x-envoy-upstream-service-time: 412
x-request-received-at: 1708333603199

Redirect headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 857d5afa6cfc695b-FRA
content-length: 0
content-type: text/plain;charset=UTF-8
date: Mon, 19 Feb 2024 09:06:43 GMT
location: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d
medium-fulfilled-by: edgy/8.7.0, valencia/main-20240216-153936-4fe2349849
server: cloudflare
strict-transport-security: max-age=15552000; includeSubDomains; preload
vary: Accept-Encoding
worker-missing-cookies: 1
x-content-type-options: nosniff
x-envoy-upstream-service-time: 17

GET
H2 200 unbound.css
glyph.medium.com/css/ 18 KB
1 KB 28ms
28ms Stylesheet
text/css 2606:4700:7::a29f:9904
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://glyph.medium.com/css/unbound.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ca2b6c294049540bb3cf90a4425ee46c65a114fba4d1a91b0c76b644b95e4d2f

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://posts.specterops.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Mon, 19 Feb 2024 09:06:43 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
age: 326
x-envoy-upstream-service-time: 2
alt-svc: h3=":443"; ma=86400
server: cloudflare
access-control-max-age: 86400
access-control-allow-methods: GET, POST, PUT, DELETE
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=7200
access-control-allow-credentials: true
vary: Accept-Encoding
cf-ray: 857d5afe8f75695b-FRA
access-control-allow-headers: Accept, Cache-Control, Content-Type, Cookie, DNT, Origin, User-Agent, X-Client-Date, X-Obvious-Cid, X-Opentracing, X-Xsrf-Token, ot-tracer-sampled, ot-tracer-spanid, ot-tracer-traceid
expires: Mon, 19 Feb 2024 11:06:43 GMT

GET
H2 200 1*PFXJbVx5g3dvP5R9Dc9NLA.png
miro.medium.com/v2/resize:fit:720/format:webp/ 37 KB
37 KB 143ms
127ms Image
image/webp 2606:4700:7::a29f:9904
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/v2/resize:fit:720/format:webp/1*PFXJbVx5g3dvP5R9Dc9NLA.png

Requested by

Host: posts.specterops.io
URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ae6f8c5d5fff16e31b366bc606f4d030c373efad7621baad6a2b24cc3ab111e7

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Mon, 19 Feb 2024 09:06:43 GMT
content-security-policy: script-src 'none'
x-content-type-options: nosniff
cf-cache-status: HIT
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-envoy-upstream-service-time: 160
content-disposition: inline; filename="1*PFXJbVx5g3dvP5R9Dc9NLA.webp"
alt-svc: h3=":443"; ma=86400
content-length: 37914
x-request-id: 3555ff00-12ca-439a-886e-80673f6d10ff
sepia-upstream: medium
server: cloudflare
etag: "YXzh1miX4qndlYVobhq_bxorivcuaUlJ2JfvURNm1xU/RIjNjNTVjOTZkNWM3OTgzNzc2ZjNmOTQ3ZDBkY2Y0ZDJjIg"
vary: Accept-Encoding
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
medium-fulfilled-by: miro-v2/main-20240212-082148-28c8d39d66
accept-ranges: bytes
cf-ray: 857d5aff2fed695b-FRA
expires: Tue, 18 Feb 2025 09:06:43 GMT

GET
H2 200 1*f47lerhzXjZH7MAGIpkOnQ.png
miro.medium.com/v2/resize:fit:720/format:webp/ 27 KB
28 KB 150ms
134ms Image
image/webp 2606:4700:7::a29f:9904
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/v2/resize:fit:720/format:webp/1*f47lerhzXjZH7MAGIpkOnQ.png

Requested by

Host: posts.specterops.io
URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

33d8dbb87455352f1c047586550796b41b1a5dfa4d09cd8341b0c8b990f90c60

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Mon, 19 Feb 2024 09:06:43 GMT
content-security-policy: script-src 'none'
x-content-type-options: nosniff
cf-cache-status: HIT
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-envoy-upstream-service-time: 230
content-disposition: inline; filename="1*f47lerhzXjZH7MAGIpkOnQ.webp"
alt-svc: h3=":443"; ma=86400
content-length: 28150
x-request-id: 515771cc-20ab-43e5-a2e4-0a75bc3e3540
sepia-upstream: medium
server: cloudflare
etag: "YXzh1miX4qndlYVobhq_bxorivcuaUlJ2JfvURNm1xU/RIjdmOGVlNTdhYjg3MzVlMzY0N2VjYzAwNjIyOTkwZTlkIg"
vary: Accept-Encoding
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
medium-fulfilled-by: miro-v2/main-20240212-082148-28c8d39d66
accept-ranges: bytes
cf-ray: 857d5aff2fee695b-FRA
expires: Tue, 18 Feb 2025 09:06:43 GMT

GET
H3 200 sohne-700-normal.woff
glyph.medium.com/font/cf896f3/0-3j_4g_53_6bu_6c4_6c8_6c9_6cc_6cd_6ci_6cm/ 19 KB
19 KB 50ms
40ms Font
application/font-woff 2606:4700:7::a29f:9804
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://glyph.medium.com/font/cf896f3/0-3j_4g_53_6bu_6c4_6c8_6c9_6cc_6cd_6ci_6cm/sohne-700-normal.woff

Requested by

Host: glyph.medium.com
URL: https://glyph.medium.com/css/unbound.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:7::a29f:9804 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

78661d3e6871b6e5c37f3113d811cb3dfc69546449e3b2c28095b6e7f28d9a7d

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://glyph.medium.com/css/unbound.css
Origin: https://posts.specterops.io
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Mon, 19 Feb 2024 09:06:43 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
age: 7010217
x-envoy-upstream-service-time: 38
alt-svc: h3=":443"; ma=86400
server: cloudflare
access-control-max-age: 86400
access-control-allow-methods: GET, POST, PUT, DELETE
content-type: application/font-woff
access-control-allow-origin: *
cache-control: public, max-age=31536000
access-control-allow-credentials: true
vary: Accept-Encoding
cf-ray: 857d5aff2ee61965-FRA
access-control-allow-headers: Accept, Cache-Control, Content-Type, Cookie, DNT, Origin, User-Agent, X-Client-Date, X-Obvious-Cid, X-Opentracing, X-Xsrf-Token, ot-tracer-sampled, ot-tracer-spanid, ot-tracer-traceid
expires: Tue, 18 Feb 2025 09:06:43 GMT

GET
H3 200 sohne-400-normal.woff
glyph.medium.com/font/b492c44/0-3j_4g_53_6bu_6c4_6c8_6c9_6cc_6cd_6ci_6cm/ 19 KB
19 KB 44ms
35ms Font
application/font-woff 2606:4700:7::a29f:9804
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://glyph.medium.com/font/b492c44/0-3j_4g_53_6bu_6c4_6c8_6c9_6cc_6cd_6ci_6cm/sohne-400-normal.woff

Requested by

Host: glyph.medium.com
URL: https://glyph.medium.com/css/unbound.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:7::a29f:9804 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b0f424bafe993b016ea96973894f95dfc4290608478a2d7d3fdd080d9b0a60d1

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://glyph.medium.com/css/unbound.css
Origin: https://posts.specterops.io
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Mon, 19 Feb 2024 09:06:43 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
age: 8474857
x-envoy-upstream-service-time: 36
alt-svc: h3=":443"; ma=86400
server: cloudflare
access-control-max-age: 86400
access-control-allow-methods: GET, POST, PUT, DELETE
content-type: application/font-woff
access-control-allow-origin: *
cache-control: public, max-age=31536000
access-control-allow-credentials: true
vary: Accept-Encoding
cf-ray: 857d5aff2ee41965-FRA
access-control-allow-headers: Accept, Cache-Control, Content-Type, Cookie, DNT, Origin, User-Agent, X-Client-Date, X-Obvious-Cid, X-Opentracing, X-Xsrf-Token, ot-tracer-sampled, ot-tracer-spanid, ot-tracer-traceid
expires: Tue, 18 Feb 2025 09:06:43 GMT

GET
H3 200 source-serif-pro-400-normal.woff
glyph.medium.com/font/8e059b2/0-3j_4g_53_6bu_6c4_6c8_6c9_6cc_6cd_6ci_6cm/ 12 KB
12 KB 30ms
20ms Font
application/font-woff 2606:4700:7::a29f:9804
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://glyph.medium.com/font/8e059b2/0-3j_4g_53_6bu_6c4_6c8_6c9_6cc_6cd_6ci_6cm/source-serif-pro-400-normal.woff

Requested by

Host: glyph.medium.com
URL: https://glyph.medium.com/css/unbound.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:7::a29f:9804 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d5d7947aa3e6131478a97f06e72913cb7b9e19161e03502ad1de3eb67f447213

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://glyph.medium.com/css/unbound.css
Origin: https://posts.specterops.io
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Mon, 19 Feb 2024 09:06:43 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
age: 8667213
x-envoy-upstream-service-time: 71
alt-svc: h3=":443"; ma=86400
server: cloudflare
access-control-max-age: 86400
access-control-allow-methods: GET, POST, PUT, DELETE
content-type: application/font-woff
access-control-allow-origin: *
cache-control: public, max-age=31536000
access-control-allow-credentials: true
vary: Accept-Encoding
cf-ray: 857d5aff2edd1965-FRA
access-control-allow-headers: Accept, Cache-Control, Content-Type, Cookie, DNT, Origin, User-Agent, X-Client-Date, X-Obvious-Cid, X-Opentracing, X-Xsrf-Token, ot-tracer-sampled, ot-tracer-spanid, ot-tracer-traceid
expires: Tue, 18 Feb 2025 09:06:43 GMT

GET
H3 200 source-code-pro-400-normal.woff
glyph.medium.com/font/3bd49b7/0-3j_4g_53_6bu_6c4_6c8_6c9_6cc_6cd_6ci_6cm/ 7 KB
7 KB 36ms
27ms Font
application/font-woff 2606:4700:7::a29f:9804
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://glyph.medium.com/font/3bd49b7/0-3j_4g_53_6bu_6c4_6c8_6c9_6cc_6cd_6ci_6cm/source-code-pro-400-normal.woff

Requested by

Host: glyph.medium.com
URL: https://glyph.medium.com/css/unbound.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:7::a29f:9804 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d6c90ff7bddb2b437a4130fbfaad1dd6fdc87a532ed4a97b5a4484c659e632ee

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://glyph.medium.com/css/unbound.css
Origin: https://posts.specterops.io
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Mon, 19 Feb 2024 09:06:43 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
age: 7010650
x-envoy-upstream-service-time: 43
alt-svc: h3=":443"; ma=86400
server: cloudflare
access-control-max-age: 86400
access-control-allow-methods: GET, POST, PUT, DELETE
content-type: application/font-woff
access-control-allow-origin: *
cache-control: public, max-age=31536000
access-control-allow-credentials: true
vary: Accept-Encoding
cf-ray: 857d5aff2edf1965-FRA
access-control-allow-headers: Accept, Cache-Control, Content-Type, Cookie, DNT, Origin, User-Agent, X-Client-Date, X-Obvious-Cid, X-Opentracing, X-Xsrf-Token, ot-tracer-sampled, ot-tracer-spanid, ot-tracer-traceid
expires: Tue, 18 Feb 2025 09:06:43 GMT

GET
H3 200 source-serif-pro-400-italic.woff
glyph.medium.com/font/76c214a/0-3j_4g_53_6bu_6c4_6c8_6c9_6cc_6cd_6ci_6cm/ 12 KB
13 KB 37ms
28ms Font
application/font-woff 2606:4700:7::a29f:9804
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://glyph.medium.com/font/76c214a/0-3j_4g_53_6bu_6c4_6c8_6c9_6cc_6cd_6ci_6cm/source-serif-pro-400-italic.woff

Requested by

Host: glyph.medium.com
URL: https://glyph.medium.com/css/unbound.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:7::a29f:9804 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1ca820b9aa7681184130d09157ea679d1d31390bee2af294c088f6dcaa24923b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://glyph.medium.com/css/unbound.css
Origin: https://posts.specterops.io
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Mon, 19 Feb 2024 09:06:43 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
age: 7177651
x-envoy-upstream-service-time: 22
alt-svc: h3=":443"; ma=86400
server: cloudflare
access-control-max-age: 86400
access-control-allow-methods: GET, POST, PUT, DELETE
content-type: application/font-woff
access-control-allow-origin: *
cache-control: public, max-age=31536000
access-control-allow-credentials: true
vary: Accept-Encoding
cf-ray: 857d5aff2ee11965-FRA
access-control-allow-headers: Accept, Cache-Control, Content-Type, Cookie, DNT, Origin, User-Agent, X-Client-Date, X-Obvious-Cid, X-Opentracing, X-Xsrf-Token, ot-tracer-sampled, ot-tracer-spanid, ot-tracer-traceid
expires: Tue, 18 Feb 2025 09:06:43 GMT

GET
H3 200 source-serif-pro-700-normal.woff
glyph.medium.com/font/b156742/0-3j_4g_53_6bu_6c4_6c8_6c9_6cc_6cd_6ci_6cm/ 12 KB
13 KB 42ms
33ms Font
application/font-woff 2606:4700:7::a29f:9804
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://glyph.medium.com/font/b156742/0-3j_4g_53_6bu_6c4_6c8_6c9_6cc_6cd_6ci_6cm/source-serif-pro-700-normal.woff

Requested by

Host: glyph.medium.com
URL: https://glyph.medium.com/css/unbound.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:7::a29f:9804 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b0bb60d88b2542c309808da080e6c3bfe7c4c3ff03e679ab29a4394c00a11c4f

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://glyph.medium.com/css/unbound.css
Origin: https://posts.specterops.io
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Mon, 19 Feb 2024 09:06:43 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
age: 8829836
x-envoy-upstream-service-time: 49
alt-svc: h3=":443"; ma=86400
server: cloudflare
access-control-max-age: 86400
access-control-allow-methods: GET, POST, PUT, DELETE
content-type: application/font-woff
access-control-allow-origin: *
cache-control: public, max-age=31536000
access-control-allow-credentials: true
vary: Accept-Encoding
cf-ray: 857d5aff2ee21965-FRA
access-control-allow-headers: Accept, Cache-Control, Content-Type, Cookie, DNT, Origin, User-Agent, X-Client-Date, X-Obvious-Cid, X-Opentracing, X-Xsrf-Token, ot-tracer-sampled, ot-tracer-spanid, ot-tracer-traceid
expires: Tue, 18 Feb 2025 09:06:43 GMT

GET
H3 200 sohne-500-normal.woff
glyph.medium.com/font/df9ba7f/0-3j_4g_53_6bu_6c4_6c8_6c9_6cc_6cd_6ci_6cm/ 18 KB
19 KB 62ms
52ms Font
application/font-woff 2606:4700:7::a29f:9804
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://glyph.medium.com/font/df9ba7f/0-3j_4g_53_6bu_6c4_6c8_6c9_6cc_6cd_6ci_6cm/sohne-500-normal.woff

Requested by

Host: glyph.medium.com
URL: https://glyph.medium.com/css/unbound.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:7::a29f:9804 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

65f0c65b5db3aa0568c7986479a4a3e909a05a84fb34ced48d70a2d628dd1444

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://glyph.medium.com/css/unbound.css
Origin: https://posts.specterops.io
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Mon, 19 Feb 2024 09:06:43 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
age: 8749933
x-envoy-upstream-service-time: 105
alt-svc: h3=":443"; ma=86400
server: cloudflare
access-control-max-age: 86400
access-control-allow-methods: GET, POST, PUT, DELETE
content-type: application/font-woff
access-control-allow-origin: *
cache-control: public, max-age=31536000
access-control-allow-credentials: true
vary: Accept-Encoding
cf-ray: 857d5aff2ee31965-FRA
access-control-allow-headers: Accept, Cache-Control, Content-Type, Cookie, DNT, Origin, User-Agent, X-Client-Date, X-Obvious-Cid, X-Opentracing, X-Xsrf-Token, ot-tracer-sampled, ot-tracer-spanid, ot-tracer-traceid
expires: Tue, 18 Feb 2025 09:06:43 GMT

GET
H2 200 1*dmbNkD5D-u45r44go_cf0g.png
miro.medium.com/v2/resize:fill:64:64/ 1 KB
2 KB 20ms
20ms Image
image/png 2606:4700:7::a29f:9904
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/v2/resize:fill:64:64/1*dmbNkD5D-u45r44go_cf0g.png

Requested by

Host: posts.specterops.io
URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f90d19259478cca4381bea7e760845de9bcf2155ee96cd8b06049add894022d3

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Mon, 19 Feb 2024 09:06:43 GMT
content-security-policy: script-src 'none'
x-content-type-options: nosniff
cf-cache-status: HIT
strict-transport-security: max-age=15552000; includeSubDomains; preload
age: 528598
x-envoy-upstream-service-time: 57
content-disposition: inline; filename="1*dmbNkD5D-u45r44go_cf0g.png"
alt-svc: h3=":443"; ma=86400
content-length: 1310
x-request-id: 543b7090-1cf7-49de-8298-dda890ebf235
sepia-upstream: medium
server: cloudflare
etag: "qUlGJkYhB4LINmyi_TVOvM25Dy409gGbmK5EqrHhPd0/RImNiNjU3ZGRlN2RhNjI0NjU3YTVmNmQ0ZDdhNzEyMDM3Ig"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
medium-fulfilled-by: miro-v2/main-20231012-152649-b8092c91fb
accept-ranges: bytes
cf-ray: 857d5aff4ffe695b-FRA
expires: Tue, 18 Feb 2025 09:06:43 GMT

GET
H2 200 1*rzDEywT-rGMVud0vq03qfw.jpeg
miro.medium.com/v2/resize:fill:88:88/ 4 KB
5 KB 122ms
122ms Image
image/jpeg 2606:4700:7::a29f:9904
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/v2/resize:fill:88:88/1*rzDEywT-rGMVud0vq03qfw.jpeg

Requested by

Host: posts.specterops.io
URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

23851a0752a4d159babf6bd3bbe60a4166adb193c2207bddc8e6beaa461c5998

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Mon, 19 Feb 2024 09:06:43 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-content-type-options: nosniff
content-security-policy: script-src 'none'
cf-cache-status: HIT
x-envoy-upstream-service-time: 84
content-disposition: inline; filename="1*rzDEywT-rGMVud0vq03qfw.jpg"
alt-svc: h3=":443"; ma=86400
content-length: 4586
x-request-id: 1feb4410-35ec-484d-a757-0dce90f9ea09
sepia-upstream: medium
cf-bgj: h2pri
server: cloudflare
etag: "9ivaNyhTKaKecaYmZr68Fn9V98S0df7YQu7TMR33mwc/RImFmMzBjNGNiMDRmZWFjNjMxNWI5ZGQyZmFiNGRlYTdmIg"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
medium-fulfilled-by: miro-v2/main-20240212-082148-28c8d39d66
accept-ranges: bytes
cf-ray: 857d5aff4800695b-FRA
expires: Tue, 18 Feb 2025 09:06:43 GMT

GET
H2 200 1*D-FDlfkqivRBQZoESrwtqw.png
miro.medium.com/v2/resize:fill:48:48/ 2 KB
2 KB 23ms
22ms Image
image/png 2606:4700:7::a29f:9904
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/v2/resize:fill:48:48/1*D-FDlfkqivRBQZoESrwtqw.png

Requested by

Host: posts.specterops.io
URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

94e0099d1af6191fe1aadfef55debc9732f3e759f50788fd9316df0cb9d4cce7

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Mon, 19 Feb 2024 09:06:43 GMT
content-security-policy: script-src 'none'
x-content-type-options: nosniff
cf-cache-status: HIT
strict-transport-security: max-age=15552000; includeSubDomains; preload
age: 8659
x-envoy-upstream-service-time: 80
content-disposition: inline; filename="1*D-FDlfkqivRBQZoESrwtqw.png"
alt-svc: h3=":443"; ma=86400
content-length: 2270
x-request-id: d2c07e87-6b93-4554-8035-95dddd49e8f2
sepia-upstream: medium
server: cloudflare
etag: "c1CjgVkcafhdh7F-WEYEpOglzgQoBxTrHiRusf4J2s4/RIjBmZTE0Mzk1ZjkyYThhZjQ0MTQxOWEwNDRhYmMyZGFiIg"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
medium-fulfilled-by: miro-v2/main-20240212-082148-28c8d39d66
accept-ranges: bytes
cf-ray: 857d5aff4801695b-FRA
expires: Tue, 18 Feb 2025 09:06:43 GMT

GET
H2 200 manifest.1ad777a6.js Show response
cdn-client.medium.com/lite/static/js/ 13 KB
6 KB 49ms
33ms Script
application/javascript 2606:4700:7::a29f:9904
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/manifest.1ad777a6.js

Requested by

Host: posts.specterops.io
URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

08ccd5d102e7f3ccf31253865a0986f9c37133cbff42179212a66e3b5f4bc46f

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Mon, 19 Feb 2024 09:06:43 GMT
x-amz-version-id: Xzbfrmwnvdr4zIUynT2tp_u5DIXnNnxg
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-request-id: WD8VG8E51RSTQRR1
age: 208215
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
x-amz-id-2: Vh7jvvV9+Dnm98+9rGYJUSzE4GwtM2kOq8sTo6cMNfqi0a6Dmw7WmN8+USsGf21sl3EIMKbdIxA=
last-modified: Fri, 16 Feb 2024 22:59:08 GMT
server: cloudflare
etag: W/"faae5fee8169d61379a84cfcb3464935"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=31536000
cf-ray: 857d5affb841695b-FRA
expires: Tue, 18 Feb 2025 09:06:43 GMT

GET
H3 200 1*PFXJbVx5g3dvP5R9Dc9NLA.png
miro.medium.com/v2/resize:fit:720/format:webp/ 37 KB
37 KB 118ms
117ms Image
image/webp 2606:4700:7::a29f:9804
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/v2/resize:fit:720/format:webp/1*PFXJbVx5g3dvP5R9Dc9NLA.png

Requested by

Host: posts.specterops.io
URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:7::a29f:9804 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ae6f8c5d5fff16e31b366bc606f4d030c373efad7621baad6a2b24cc3ab111e7

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Mon, 19 Feb 2024 09:06:43 GMT
content-security-policy: script-src 'none'
x-content-type-options: nosniff
cf-cache-status: HIT
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-envoy-upstream-service-time: 160
content-disposition: inline; filename="1*PFXJbVx5g3dvP5R9Dc9NLA.webp"
alt-svc: h3=":443"; ma=86400
content-length: 37914
x-request-id: 3555ff00-12ca-439a-886e-80673f6d10ff
sepia-upstream: medium
server: cloudflare
etag: "YXzh1miX4qndlYVobhq_bxorivcuaUlJ2JfvURNm1xU/RIjNjNTVjOTZkNWM3OTgzNzc2ZjNmOTQ3ZDBkY2Y0ZDJjIg"
vary: Accept-Encoding
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
medium-fulfilled-by: miro-v2/main-20240212-082148-28c8d39d66
accept-ranges: bytes
cf-ray: 857d5affacf835f3-FRA
expires: Tue, 18 Feb 2025 09:06:43 GMT

GET
H3 200 1*f47lerhzXjZH7MAGIpkOnQ.png
miro.medium.com/v2/resize:fit:720/format:webp/ 27 KB
28 KB 147ms
144ms Image
image/webp 2606:4700:7::a29f:9804
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/v2/resize:fit:720/format:webp/1*f47lerhzXjZH7MAGIpkOnQ.png

Requested by

Host: posts.specterops.io
URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:7::a29f:9804 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

33d8dbb87455352f1c047586550796b41b1a5dfa4d09cd8341b0c8b990f90c60

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Mon, 19 Feb 2024 09:06:43 GMT
content-security-policy: script-src 'none'
x-content-type-options: nosniff
cf-cache-status: HIT
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-envoy-upstream-service-time: 230
content-disposition: inline; filename="1*f47lerhzXjZH7MAGIpkOnQ.webp"
alt-svc: h3=":443"; ma=86400
content-length: 28150
x-request-id: 515771cc-20ab-43e5-a2e4-0a75bc3e3540
sepia-upstream: medium
server: cloudflare
etag: "YXzh1miX4qndlYVobhq_bxorivcuaUlJ2JfvURNm1xU/RIjdmOGVlNTdhYjg3MzVlMzY0N2VjYzAwNjIyOTkwZTlkIg"
vary: Accept-Encoding
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
medium-fulfilled-by: miro-v2/main-20240212-082148-28c8d39d66
accept-ranges: bytes
cf-ray: 857d5affad0335f3-FRA
expires: Tue, 18 Feb 2025 09:06:43 GMT

GET
H2 200 3057.5e22bbb0.js Show response
cdn-client.medium.com/lite/static/js/ 659 KB
207 KB 57ms
42ms Script
application/javascript 2606:4700:7::a29f:9904
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/3057.5e22bbb0.js

Requested by

Host: posts.specterops.io
URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9d4cacc612c452bdcc10a085e37f00f77d8863cb1e8fe669ca02c1156f2cb712

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Mon, 19 Feb 2024 09:06:43 GMT
x-amz-version-id: 8U1kFgMJlUNmH8qkZNp1xniyDYQNS3lm
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-request-id: S9TRK1AHXC8W7BG5
age: 11426
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
x-amz-id-2: hkWPbHHvK1/y1PgOnLBoXr4//WBOChBIQMYHo6ZKSSXDsAgljJm06sWniTaVissh9BXx5UvePfpqj01kEJSFdQ==
last-modified: Thu, 19 Oct 2023 20:38:07 GMT
server: cloudflare
etag: W/"5cf73b47b8f9468e48683b2d39073bf2"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=31536000
cf-ray: 857d5affc847695b-FRA
expires: Tue, 18 Feb 2025 09:06:43 GMT

GET
H2 200 main.aeffcfa9.js Show response
cdn-client.medium.com/lite/static/js/ 756 KB
180 KB 49ms
35ms Script
application/javascript 2606:4700:7::a29f:9904
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/main.aeffcfa9.js

Requested by

Host: posts.specterops.io
URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

813f08cedb7ed684d4f10b10636998d3985aafc8e13239c672dd6a8d166bc899

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Mon, 19 Feb 2024 09:06:43 GMT
x-amz-version-id: o1ZLrXcfwRAilmOhcdVz9cbKQAtqxN9Y
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-request-id: WD8PJSA0CM25FDX7
age: 208215
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
x-amz-id-2: pD8n04apN+/+tWF0TjvjKYIIOhuRTwYqKZsyPF9+w+a5lE0x3aDhvMSHgJeGO6i5Wg5B1D0enZNBsDYlxV6zKA==
last-modified: Fri, 16 Feb 2024 22:59:06 GMT
server: cloudflare
etag: W/"e681cb3b9f1e582785ea5ab04f2c5bf3"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=31536000
cf-ray: 857d5affb842695b-FRA
expires: Tue, 18 Feb 2025 09:06:43 GMT

GET
H2 200 instrumentation.7c58a71f.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 3 KB
2 KB 41ms
26ms Script
application/javascript 2606:4700:7::a29f:9904
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/instrumentation.7c58a71f.chunk.js

Requested by

Host: posts.specterops.io
URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1d40ba6bcffd2d51735ad266bbcea130205c2560e34f60d204feed40bce804cb

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Mon, 19 Feb 2024 09:06:43 GMT
x-amz-version-id: UX__5BGcNKiUoyDiu_x5KKgrlZdf_eFZ
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-request-id: RZS96G6D305HFWCJ
age: 1016855
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
x-amz-id-2: ZMit9sZ1d6taGwFOE7ZT7tuMc/Te4leGtiX2A03cEV21WixO7paCt3GOiliFS4z/KjRaWHrvRUA=
last-modified: Tue, 06 Feb 2024 14:42:19 GMT
server: cloudflare
etag: W/"88ef7fedb2a5e4fc8f183b27a7395553"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=31536000
cf-ray: 857d5affb844695b-FRA
expires: Tue, 18 Feb 2025 09:06:43 GMT

GET
H2 200 reporting.2021fe63.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 1 KB
909 B 48ms
34ms Script
application/javascript 2606:4700:7::a29f:9904
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/reporting.2021fe63.chunk.js

Requested by

Host: posts.specterops.io
URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3e114382d20a02d0ca050b5fb41beeeb8d1c63762fa2f2e2b75557a48117d365

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Mon, 19 Feb 2024 09:06:43 GMT
x-amz-version-id: EAFtMMjOBNpoIMOAp_mjLfH0fLlmjqvd
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-request-id: Y7RX5VAF4TF7222R
age: 1050387
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
x-amz-id-2: JHgAZ7AHuFEoIDjuQ2DCUaiJhC8YIyDuEYQCLPaaJPNcjN8BwJh313a9RG+Xlj+hBft7icQRYuQ=
last-modified: Fri, 23 Jun 2023 16:13:42 GMT
server: cloudflare
etag: W/"4f45b39c86a2eb9ca7068099b34d3af6"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=31536000
cf-ray: 857d5affb846695b-FRA
expires: Tue, 18 Feb 2025 09:06:43 GMT

GET
H2 200 6068.e9093f2e.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 5 KB
1 KB 42ms
28ms Script
application/javascript 2606:4700:7::a29f:9904
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/6068.e9093f2e.chunk.js

Requested by

Host: posts.specterops.io
URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5a1aa5b3fe12402794e0a8981461a9a908a62d6fdea536e669147fc38bfc7be5

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Mon, 19 Feb 2024 09:06:43 GMT
x-amz-version-id: LaFo2b5tnj4iD0imA.cXIy7d6iZ0jIMl
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-request-id: ERGEX3S52MHNCRBE
age: 1137106
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
x-amz-id-2: 2YWvi8AyW7uWIT6Ae6Z5TjxEdTB1+pF+ziq9PZLMIn5+0YxWUL+kgrjI5g4609SJNTAP/vLaJpy7oMx9qzs4NQ==
last-modified: Thu, 19 Oct 2023 20:38:11 GMT
server: cloudflare
etag: W/"e18bffffe340e41dc3b596cf1d9b13ee"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=31536000
cf-ray: 857d5affc848695b-FRA
expires: Tue, 18 Feb 2025 09:06:43 GMT

GET
H3 200 4398.db4d4378.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 7 KB
3 KB 29ms
26ms Script
application/javascript 2606:4700:7::a29f:9804
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/4398.db4d4378.chunk.js

Requested by

Host: posts.specterops.io
URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:7::a29f:9804 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

25b283a69fdffec5aed19ca2a40b67f490744d4e28d1b41b14f78c7c3ca85304

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Mon, 19 Feb 2024 09:06:43 GMT
x-amz-version-id: nD1Ekxpw41hmPZGu8aCR69Fn6l56BS19
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-request-id: 710GYJMZMX9T7NGZ
age: 829308
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
x-amz-id-2: sjqpdMVqjBfESWRs5xhG/mIWiF7BOMIkvwN/mtgjm/eW0hArhYoO6C+eqOMXw5Mx3WX33F6rPgg=
last-modified: Wed, 10 Jan 2024 23:43:40 GMT
server: cloudflare
etag: W/"2a9a8cc3a5c7456e93ac9fd0734d8562"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=31536000
cf-ray: 857d5affed4435f3-FRA
expires: Tue, 18 Feb 2025 09:06:43 GMT

GET
H3 200 7883.0e445e04.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 22 KB
10 KB 30ms
28ms Script
application/javascript 2606:4700:7::a29f:9804
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/7883.0e445e04.chunk.js

Requested by

Host: posts.specterops.io
URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:7::a29f:9804 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5e45ce783ff6f2159c09545f4a3a53cfd8aa6588e53ab2e3dc894b69048128e3

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Mon, 19 Feb 2024 09:06:43 GMT
x-amz-version-id: Xo3CN7D2L9evtWunaTa_wVLneZe0Q4Yq
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-request-id: SACK8Q284PX7P1V2
age: 1167060
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
x-amz-id-2: 67ywPv5YyD9zsVly8e1VcBiH8iiSGioLpKMQkm7v57DqwwvU4COOClkIdD6jwCL6XjaXwkONehGOMgztCvymqQ==
last-modified: Mon, 05 Feb 2024 14:32:27 GMT
server: cloudflare
etag: W/"ff460fdd31cf043a5b0c5480db3156c6"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=31536000
cf-ray: 857d5affed4535f3-FRA
expires: Tue, 18 Feb 2025 09:06:43 GMT

GET
H3 200 6733.1d85727b.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 13 KB
5 KB 27ms
25ms Script
application/javascript 2606:4700:7::a29f:9804
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/6733.1d85727b.chunk.js

Requested by

Host: posts.specterops.io
URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:7::a29f:9804 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8d3e598ba737be043c5d785d54f858660c4dd4d22805b22a550876b017830f6b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Mon, 19 Feb 2024 09:06:43 GMT
x-amz-version-id: 2fJFQUTf2u12vcW9GWlwyqCzuRzGu243
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-request-id: Z11FF91V4M2BCFBZ
age: 870859
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
x-amz-id-2: 9ziG9CVVIZyQdzZY1xMarTk3Ku1fSXjirMiZpLCOMrTv+fVjKCdj96icu4JPL2y+6Zf63XHreak=
last-modified: Thu, 19 Oct 2023 20:38:12 GMT
server: cloudflare
etag: W/"637f2748bb252f63c1746748e78f94ae"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=31536000
cf-ray: 857d5affed4635f3-FRA
expires: Tue, 18 Feb 2025 09:06:43 GMT

GET
H3 200 4711.043615ac.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 8 KB
3 KB 33ms
31ms Script
application/javascript 2606:4700:7::a29f:9804
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/4711.043615ac.chunk.js

Requested by

Host: posts.specterops.io
URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:7::a29f:9804 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

36958875136eaa028381ba1b7c0169a46c0a3a80b12a2be773ec5e30479e3e87

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Mon, 19 Feb 2024 09:06:43 GMT
x-amz-version-id: qnKQzk0b9urC.8imJsDQEceRC7r1d.6v
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-request-id: Z61N02GG08QYGQQG
age: 274711
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
x-amz-id-2: TDzbgSsTQzWgXfPlSZ0VwVui8lCvcFiGQ8xRjvdtZuQYxaivYa5JC3NI/c1sA7BJ0zWkwTff7AIFSGOaGC6AGwbcYORYmGAbj7M++aatLqo=
last-modified: Thu, 19 Oct 2023 20:38:09 GMT
server: cloudflare
etag: W/"fa8866965099e179b25da758eb62a2da"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=31536000
cf-ray: 857d5affed4835f3-FRA
expires: Tue, 18 Feb 2025 09:06:43 GMT

GET
H3 200 8695.67fd587b.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 13 KB
5 KB 35ms
34ms Script
application/javascript 2606:4700:7::a29f:9804
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/8695.67fd587b.chunk.js

Requested by

Host: posts.specterops.io
URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:7::a29f:9804 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3620a054627b390ac087153c997af96ae35ef5c03662a52ec71ee5cf4a63532e

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Mon, 19 Feb 2024 09:06:43 GMT
x-amz-version-id: Ogv2L1KO9_UliWzgxfHXiEzdqkQhvvDG
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-request-id: KZYNJE2AXPTM8HDJ
age: 579720
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
x-amz-id-2: H12QgLbpleRiAcHz6vksYzpcGoty1zCUNEYro31tHpI4MaN/0CtAVCKuGA5iC4gp3OFA90BbPB0=
last-modified: Fri, 09 Feb 2024 14:55:55 GMT
server: cloudflare
etag: W/"09006e7eda560fc54e97fff75be6a28d"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=31536000
cf-ray: 857d5affed4935f3-FRA
expires: Tue, 18 Feb 2025 09:06:43 GMT

GET
H3 200 4341.e697d2a1.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 41 KB
10 KB 36ms
34ms Script
application/javascript 2606:4700:7::a29f:9804
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/4341.e697d2a1.chunk.js

Requested by

Host: posts.specterops.io
URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:7::a29f:9804 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a13833533c830de737dc8b245fa9f45199dcef87c1bd0172b63d9da0e9fea577

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Mon, 19 Feb 2024 09:06:43 GMT
x-amz-version-id: ePN3RSeIvvXVZ7Qe4JusRtAdJHrk_Rrl
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-request-id: WQ7SZ0FXVS9N7A2P
age: 410751
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
x-amz-id-2: lEiIihPR9DZ4pXBabZH4hZKoq4+MfEGjcVnI26Jr5WpxBikue9PoRJhn7jX8wGIDVVVNy5p2sUDfKy1EAbb85gfJIkmsRc+mSo5KBiCkoog=
last-modified: Mon, 12 Feb 2024 20:37:53 GMT
server: cloudflare
etag: W/"1fb8c1985abfbffe9d85fedbfe4c56e3"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=31536000
cf-ray: 857d5affed4b35f3-FRA
expires: Tue, 18 Feb 2025 09:06:43 GMT

GET
H3 200 2522.ec97cf9d.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 18 KB
6 KB 40ms
38ms Script
application/javascript 2606:4700:7::a29f:9804
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/2522.ec97cf9d.chunk.js

Requested by

Host: posts.specterops.io
URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:7::a29f:9804 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f2fca89af2edf8cde1aaf9a65187f75534f764c7bd7b420bb8b2524bf6408ba0

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Mon, 19 Feb 2024 09:06:43 GMT
x-amz-version-id: 1OnPE8r3AzdxaCHTSeARfXm.4P2sCvGt
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-request-id: S1QAHY4S72A9N1XE
age: 221895
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
x-amz-id-2: p6+WS+/rpnAymHbF7UcwFw56Cx4u2f2u2dpG2zQok7rjZCaJdvDpKZbe8R+cYW4UUUDJKoh9RTs=
last-modified: Thu, 15 Feb 2024 20:07:32 GMT
server: cloudflare
etag: W/"38bbffc847db713e40b2fdf066b4b694"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=31536000
cf-ray: 857d5affed4c35f3-FRA
expires: Tue, 18 Feb 2025 09:06:43 GMT

GET
H3 200 5203.e7a22052.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 17 KB
4 KB 41ms
39ms Script
application/javascript 2606:4700:7::a29f:9804
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/5203.e7a22052.chunk.js

Requested by

Host: posts.specterops.io
URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:7::a29f:9804 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

46e758010f351793913ddca875cd4d6b107e4fe8b263b352c1da5b2f3d151021

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Mon, 19 Feb 2024 09:06:43 GMT
x-amz-version-id: sYZi_T_vovpyjHR0HCCODg8UWAAlZCKC
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-request-id: 4G41DBY3KYNQX9MD
age: 25216
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
x-amz-id-2: hjUGm8MKzsmi3mkpcyxVF250ZoZi/eTMgnFDsjhhwRDoDDOvQtxbVG9a8TT+TtztvpcQlLGA70tB9JciD/fIWZr+k0YmBhsG
last-modified: Thu, 19 Oct 2023 20:38:10 GMT
server: cloudflare
etag: W/"4b2a2b012f01bcd5a7880043af3823bc"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=31536000
cf-ray: 857d5affed4d35f3-FRA
expires: Tue, 18 Feb 2025 09:06:43 GMT

GET
H3 200 3486.68d9a40d.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 27 KB
7 KB 42ms
40ms Script
application/javascript 2606:4700:7::a29f:9804
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/3486.68d9a40d.chunk.js

Requested by

Host: posts.specterops.io
URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:7::a29f:9804 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

07080369aba872ba059261aa7a0114bf1373a38a7c6d615fa9f17bf43a382c5a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Mon, 19 Feb 2024 09:06:43 GMT
x-amz-version-id: pfwMv_ApdQQ19fmVVC5BEx38xtUlcFDA
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-request-id: ZVDN2GCQDR4H9Y56
age: 836836
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
x-amz-id-2: HNPrklefLqrhkmyYRJHAipprFiJXZ4llhSH3SJc2z0BvFq4AGVBJrZuREPNhoWQ0UP2P23csidfg5csaJ2sfOA==
last-modified: Fri, 26 Jan 2024 16:19:10 GMT
server: cloudflare
etag: W/"c223a0c6ab36611c58be3a2de03581b5"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=31536000
cf-ray: 857d5affed5035f3-FRA
expires: Tue, 18 Feb 2025 09:06:43 GMT

GET
H3 200 3925.fae79285.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 23 KB
5 KB 43ms
41ms Script
application/javascript 2606:4700:7::a29f:9804
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/3925.fae79285.chunk.js

Requested by

Host: posts.specterops.io
URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:7::a29f:9804 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

df3a974015db7f9e9a9ea6f1708cdb5a3f54d00478801c7ba7f89cd9e72b4831

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Mon, 19 Feb 2024 09:06:43 GMT
x-amz-version-id: PhsjjQHNBjx9440Ew58X9Sy0n9gQc2ZE
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-request-id: S1Q4SF4Q8PHD4WMZ
age: 221895
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
x-amz-id-2: Rcf9wp37VntCku7jM8MyeMMHLxZy87Qr6UbYKTtuNfS0LdrVjN0AOe8vhfjChywQAS+2py652Cg=
last-modified: Thu, 15 Feb 2024 20:07:34 GMT
server: cloudflare
etag: W/"5175f18a23b480ec1a2999216124a647"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=31536000
cf-ray: 857d5affed5135f3-FRA
expires: Tue, 18 Feb 2025 09:06:43 GMT

GET
H3 200 6616.2cd253ce.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 12 KB
4 KB 46ms
43ms Script
application/javascript 2606:4700:7::a29f:9804
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/6616.2cd253ce.chunk.js

Requested by

Host: posts.specterops.io
URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:7::a29f:9804 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

df83693552dabf211bd600846206ebcc0192afd64a452c356f4b285e9392581d

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Mon, 19 Feb 2024 09:06:43 GMT
x-amz-version-id: vfRE0oIOYR4SDy2BpuaU.ii0koW5F3XF
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-request-id: S1Q3CWSN5F9PBX4M
age: 221895
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
x-amz-id-2: 7o5W6/xc8k/yrNjg/kZNddmiXlfgrlvvw5/af7Xco9O45XEkJLWPuex9KWW1SAjgW/G8MW9Rj1PMR4TnagcjDA==
last-modified: Fri, 16 Feb 2024 18:48:44 GMT
server: cloudflare
etag: W/"043f61f69e810f7f139a222cde3ee837"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=31536000
cf-ray: 857d5affed5235f3-FRA
expires: Tue, 18 Feb 2025 09:06:43 GMT

GET
H3 200 1711.b70f1a35.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 23 KB
7 KB 44ms
41ms Script
application/javascript 2606:4700:7::a29f:9804
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/1711.b70f1a35.chunk.js

Requested by

Host: posts.specterops.io
URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:7::a29f:9804 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

93efcb5760c80b2b05a06369f841dec8894aec84f393f473d4a98c97d753637c

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Mon, 19 Feb 2024 09:06:43 GMT
x-amz-version-id: an7lZshTbeizT4YvZ.H_UfpGSLFLVp6K
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-request-id: J178EJGERS581XHJ
age: 1079195
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
x-amz-id-2: 1I0RZFqis3VUg39l18/zzES9x70K/pwfl3YWM9quPJZkzqvAzZXymSFOZhptZBXkE89qOgs7zSg=
last-modified: Tue, 12 Dec 2023 20:16:53 GMT
server: cloudflare
etag: W/"be9a7f1d16e66912ad5aca0b77f43879"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=31536000
cf-ray: 857d5affed5335f3-FRA
expires: Tue, 18 Feb 2025 09:06:43 GMT

GET
H3 200 5459.80a6ee18.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 24 KB
9 KB 45ms
42ms Script
application/javascript 2606:4700:7::a29f:9804
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/5459.80a6ee18.chunk.js

Requested by

Host: posts.specterops.io
URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:7::a29f:9804 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3dfdb6f5b4806f1c38df4fe8759a9de97db51013d581eab964f30e0168c63824

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Mon, 19 Feb 2024 09:06:43 GMT
x-amz-version-id: Xo5Pr3Ij5Cgw5oTeyQue1xJQ0yv8JEXg
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-request-id: 5SCWCF2BFJVAEDN2
age: 274700
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
x-amz-id-2: wEG42IkuOdW/JSBhPM6qNeTr3sRi8FqmOp1gCTVCseEB3gto97maHH708Ll1Ttvl0w6WO6sQOIM=
last-modified: Thu, 19 Oct 2023 20:38:10 GMT
server: cloudflare
etag: W/"6e1344575b07708a7b94c40d88f89dce"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=31536000
cf-ray: 857d5affed5435f3-FRA
expires: Tue, 18 Feb 2025 09:06:43 GMT

GET
H3 200 9114.49b6b911.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 15 KB
4 KB 47ms
44ms Script
application/javascript 2606:4700:7::a29f:9804
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/9114.49b6b911.chunk.js

Requested by

Host: posts.specterops.io
URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:7::a29f:9804 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

24183a1040266651c9220130eeb24ae69eaf1aea2f6cdf2928c47c1d28ec616f

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Mon, 19 Feb 2024 09:06:43 GMT
x-amz-version-id: 5HP3EOnC9v2XvBoz8LhP.2aoPkreALV7
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-request-id: 3N219REVC9ZYPNYQ
age: 92925
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
x-amz-id-2: pMocFrYuTvZNcT+E5EWJl91OyGLMXAw6jBtIWQbO3ZI5fxKtuj3sgvOVN/RdHdqMoNtZ4/8ChKE=
last-modified: Thu, 19 Oct 2023 20:38:15 GMT
server: cloudflare
etag: W/"8b63f526f073a7a5c4fc7961b42c1594"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=31536000
cf-ray: 857d5affed5635f3-FRA
expires: Tue, 18 Feb 2025 09:06:43 GMT

GET
H3 200 6804.26341636.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 10 KB
4 KB 48ms
46ms Script
application/javascript 2606:4700:7::a29f:9804
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/6804.26341636.chunk.js

Requested by

Host: posts.specterops.io
URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:7::a29f:9804 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2db45c5c5c2aa2552b5799fd50f29c42c216c42220355c83f4d5f10eba54268d

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Mon, 19 Feb 2024 09:06:43 GMT
x-amz-version-id: 3LEgTdJuf92u9blnDwX3ZnHVJJkkEciz
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-request-id: WQ7JHN8GFJW96BV9
age: 410751
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
x-amz-id-2: z4pQxGpTMm7tUtI0ucv7QEjT4zGoKu03TxamDXOqZoPD6mpDgi+RIb2NCYr3HAu75kmCEvt2fTHkdXsoNllchIHJbY2tV1tg
last-modified: Tue, 13 Feb 2024 18:22:25 GMT
server: cloudflare
etag: W/"73e752ea0f48c842e2d82742167312e6"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=31536000
cf-ray: 857d5affed5735f3-FRA
expires: Tue, 18 Feb 2025 09:06:43 GMT

GET
H3 200 9174.b1cc3539.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 107 KB
27 KB 49ms
46ms Script
application/javascript 2606:4700:7::a29f:9804
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/9174.b1cc3539.chunk.js

Requested by

Host: posts.specterops.io
URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:7::a29f:9804 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

14c45a864427b8fb976671fb4b8e93c55984678c2fa0c087e0eb35b7ded3ff9b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Mon, 19 Feb 2024 09:06:43 GMT
x-amz-version-id: NtZOT6_fdUN18E9.niL.Jt3i3V1rP4Bs
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-request-id: SQRN8P5B08F0KSHZ
age: 486266
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
x-amz-id-2: jsEZEiMjBoG/fhcXiM0t0MRLpClGgWf1L1809L4lQDQx1qD/MDnrLy/G56or54d361XQyc/CwFaglSi+sS2C2g==
last-modified: Mon, 29 Jan 2024 22:27:28 GMT
server: cloudflare
etag: W/"9a950f7738f7e49485a73ce1b11959a9"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=31536000
cf-ray: 857d5affed5935f3-FRA
expires: Tue, 18 Feb 2025 09:06:43 GMT

GET
H3 200 4129.ee8ae2c8.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 23 KB
8 KB 50ms
47ms Script
application/javascript 2606:4700:7::a29f:9804
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/4129.ee8ae2c8.chunk.js

Requested by

Host: posts.specterops.io
URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:7::a29f:9804 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

37a92f6f729051d8f507d8e2102fb6ff65523e1cac9a02c5cf73f1503b446dfc

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Mon, 19 Feb 2024 09:06:43 GMT
x-amz-version-id: GKCEAjCz9C3rq4gDy5D41ahGcAUvJYws
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-request-id: H0EASZR7MFXZZD84
age: 184185
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
x-amz-id-2: 0GnO24kb9SA99yzr5ZJIUdJw3Hr4vBU6LXE+g6K6lbBNH1U5XI/06xIezMGpyW8JJCXm+j4p9aA=
last-modified: Tue, 31 Oct 2023 13:31:10 GMT
server: cloudflare
etag: W/"c63ba7334aaaa7c433116323b85dddd8"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=31536000
cf-ray: 857d5affed5a35f3-FRA
expires: Tue, 18 Feb 2025 09:06:43 GMT

GET
H3 200 4726.25eb663f.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 18 KB
5 KB 51ms
48ms Script
application/javascript 2606:4700:7::a29f:9804
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/4726.25eb663f.chunk.js

Requested by

Host: posts.specterops.io
URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:7::a29f:9804 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

82af9d7d76d1b453c1df2703e16fb59fd1287953eb489d584f77de963e753c5a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Mon, 19 Feb 2024 09:06:43 GMT
x-amz-version-id: ofpdkUIBDJ3EH6qR.2Nr4q7rey9rRpZP
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-request-id: WQ7VDKCXSVEQ5SVE
age: 410751
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
x-amz-id-2: b1x3+CD/kkBBFP5FlXvCXKdIJwrZAxdmrGHQwaWhA5MltbYfqF+slFBwa+FnmLthBlL8CH/h0KCZiLz3di4fOJ1iNLe+XExc
last-modified: Tue, 13 Feb 2024 18:22:26 GMT
server: cloudflare
etag: W/"773532fd06156f6ad408f1aa23e8ff4a"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=31536000
cf-ray: 857d5affed5b35f3-FRA
expires: Tue, 18 Feb 2025 09:06:43 GMT

GET
H3 200 2550.158e308d.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 21 KB
6 KB 52ms
49ms Script
application/javascript 2606:4700:7::a29f:9804
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/2550.158e308d.chunk.js

Requested by

Host: posts.specterops.io
URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:7::a29f:9804 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e453b4b0007b54b4ffc7c1af90daa81204eee14fde724baf50411b975c981e04

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Mon, 19 Feb 2024 09:06:43 GMT
x-amz-version-id: mZqKlyT1arbL6fdLrEJawqKlhFNwhyca
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-request-id: WQ7PB7BTRG4Y2XFC
age: 410751
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
x-amz-id-2: 0GEDt6m4Di6TxTS+iTEkhuC0mmYYSoKnkamDQCHoN2DrgBsW5jbuflGnn7fdHfLVf87sR6fqtFk=
last-modified: Mon, 12 Feb 2024 20:37:52 GMT
server: cloudflare
etag: W/"041b84a620fb810178df8dce43c40bc9"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=31536000
cf-ray: 857d5affed5c35f3-FRA
expires: Tue, 18 Feb 2025 09:06:43 GMT

GET
H3 200 8580.feeb2549.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 20 KB
2 KB 52ms
49ms Script
application/javascript 2606:4700:7::a29f:9804
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/8580.feeb2549.chunk.js

Requested by

Host: posts.specterops.io
URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:7::a29f:9804 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ab4e6c77ee5e6178222bb7deefc0c6d5b0e2b3ab2df5d8623da00840809e639d

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Mon, 19 Feb 2024 09:06:43 GMT
x-amz-version-id: zzAbVdzU1EHaoBWemZXYawSAaPKOliQq
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-request-id: Y65FVQ7NTEJBXQ6Y
age: 274700
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
x-amz-id-2: cZohDeNRwUgaONTLit+xJE3dfHFvPeoV85c+KqhEP6x9pyiEj9eN5SLHPyGrwvD8EB0RQ7cMwU0=
last-modified: Thu, 19 Oct 2023 20:38:14 GMT
server: cloudflare
etag: W/"807d78fe3a15361dfb7d56b056c4ff12"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=31536000
cf-ray: 857d5affed5d35f3-FRA
expires: Tue, 18 Feb 2025 09:06:43 GMT

GET
H3 200 8883.c8b03d13.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 30 KB
10 KB 53ms
50ms Script
application/javascript 2606:4700:7::a29f:9804
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/8883.c8b03d13.chunk.js

Requested by

Host: posts.specterops.io
URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:7::a29f:9804 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6371dbf8600466f6a05a06c3372f54b5df5ea4ce7e2145571a7f72886d61d879

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Mon, 19 Feb 2024 09:06:43 GMT
x-amz-version-id: rqCBYLKOv.8NNDtk1ZWJs0i2M.e6fYOU
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-request-id: 57Q85NHRR4043R5E
age: 1017015
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
x-amz-id-2: wuWZa7C2RdY4I2iSAi/fZbqSkRPfrct1na/WxR4Eo3Z8UpsLjVo7kojWZijKyuO84f5zvVpJFpU=
last-modified: Wed, 01 Nov 2023 19:54:54 GMT
server: cloudflare
etag: W/"db9f4f034f186af2c5d3eb5b06d84be1"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=31536000
cf-ray: 857d5affed5f35f3-FRA
expires: Tue, 18 Feb 2025 09:06:43 GMT

GET
H3 200 4078.da7800a7.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 10 KB
2 KB 54ms
51ms Script
application/javascript 2606:4700:7::a29f:9804
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/4078.da7800a7.chunk.js

Requested by

Host: posts.specterops.io
URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:7::a29f:9804 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e365238b8f3b49688bb6f1344496c0e25a3ebe4302c859856e937f18f403d6a2

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Mon, 19 Feb 2024 09:06:43 GMT
x-amz-version-id: rrQLGST4J4fLi10qQKaFEEGE2uCdLnIB
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-request-id: 449KG7PBSJGZC01G
age: 274700
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
x-amz-id-2: Ko8g5TRpaaJuMF3kj7RpTbSpnKQf/Toi0fRdIQ165XbAECplCvgs/h1QHuZjsQitsIsvW+5BsVA=
last-modified: Thu, 19 Oct 2023 20:38:08 GMT
server: cloudflare
etag: W/"6fe9bb13da7ba28df60248af83559170"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=31536000
cf-ray: 857d5affed6135f3-FRA
expires: Tue, 18 Feb 2025 09:06:43 GMT

GET
H3 200 4478.c2502ab2.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 41 KB
12 KB 55ms
52ms Script
application/javascript 2606:4700:7::a29f:9804
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/4478.c2502ab2.chunk.js

Requested by

Host: posts.specterops.io
URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:7::a29f:9804 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3f1825ce622717b985e1c87f2a00902896a1d5ebf117bb8f7a9325af7efa02de

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Mon, 19 Feb 2024 09:06:43 GMT
x-amz-version-id: SziXjdzEO3A8qIobgLBLLLvQyuNDK8q9
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-request-id: S1Q631K2Z6F1ABC3
age: 221895
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
x-amz-id-2: /C0IP7RIIU0YTj3jRZQjFHJ3gAorDzbT2WTl2ASbWEIE2y+hFnd/S52toLjqZykNM9D5b/eDUYA=
last-modified: Fri, 16 Feb 2024 18:48:42 GMT
server: cloudflare
etag: W/"1b8a2f051c1d8a02753cac7e34276dfb"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=31536000
cf-ray: 857d5affed6335f3-FRA
expires: Tue, 18 Feb 2025 09:06:43 GMT

GET
H3 200 9408.1c6d46ac.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 19 KB
5 KB 56ms
53ms Script
application/javascript 2606:4700:7::a29f:9804
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/9408.1c6d46ac.chunk.js

Requested by

Host: posts.specterops.io
URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:7::a29f:9804 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8cf41c0f745c69819ec5b4be13b73116190e101893f9ecd134f934d76a28ce41

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Mon, 19 Feb 2024 09:06:43 GMT
x-amz-version-id: 9a0Vl8lLKKEkTlipGC4nyQjlYhBe1bhG
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-request-id: 8BJ5QE0AXCPSRDZK
age: 1156753
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
x-amz-id-2: dczVEUzqsTOhL8GIrOjCJyW6oCWX0x8b7hd2b/bRo/T8ValCGyAPAbOiZfCi6LICuanhXxYjlAo=
last-modified: Sat, 09 Dec 2023 01:10:53 GMT
server: cloudflare
etag: W/"a3c7d15ccc33a8cd97c10896abbd6d3b"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=31536000
cf-ray: 857d5affed6435f3-FRA
expires: Tue, 18 Feb 2025 09:06:43 GMT

GET
H3 200 9150.42fafb2e.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 9 KB
2 KB 56ms
53ms Script
application/javascript 2606:4700:7::a29f:9804
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/9150.42fafb2e.chunk.js

Requested by

Host: posts.specterops.io
URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:7::a29f:9804 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3df22782693c9af50722c8e68c3bd5f0f2248d53b79cd278c2f0953d7b9d4571

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Mon, 19 Feb 2024 09:06:43 GMT
x-amz-version-id: Juh7s6eqIR5VpuEFNUcPQ7B8LwsnUpKw
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-request-id: RN7HXARNCBXX8B4K
age: 1050211
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
x-amz-id-2: JdEWkQYV5f8lXbdQuVjf4Ny8CryboZNimKTWaKr5gu64oXoUcCZKfYTDEEee4o0MurDa9dtzit4=
last-modified: Thu, 19 Oct 2023 20:38:15 GMT
server: cloudflare
etag: W/"78132c40ece3187924f4251503c0fe2e"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=31536000
cf-ray: 857d5affed6535f3-FRA
expires: Tue, 18 Feb 2025 09:06:43 GMT

GET
H3 200 5005.b5d4a37c.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 31 KB
3 KB 57ms
54ms Script
application/javascript 2606:4700:7::a29f:9804
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/5005.b5d4a37c.chunk.js

Requested by

Host: posts.specterops.io
URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:7::a29f:9804 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ed871cdd5c0d8def9f024a161b7b8e8cef778a47955c05a27fbdcf023b9fa4b1

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Mon, 19 Feb 2024 09:06:43 GMT
x-amz-version-id: RisC25ILXQZI5zUiv0YF80pfrgqVmer.
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-request-id: NEESR8DSNFTRDXX8
age: 107624
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
x-amz-id-2: gDwQxxkhjYaqXGZpDeHuM/5206TkQdKZjAI80x8uyXp+PySrrr7QAvKdE31wzprOOt+qteOAvKnB/kENdCZAkw==
last-modified: Thu, 19 Oct 2023 20:38:10 GMT
server: cloudflare
etag: W/"a72dda426ce4412cf5cdf2bd365c57c4"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=31536000
cf-ray: 857d5affed6635f3-FRA
expires: Tue, 18 Feb 2025 09:06:43 GMT

GET
H3 200 6605.26bac429.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 8 KB
3 KB 57ms
55ms Script
application/javascript 2606:4700:7::a29f:9804
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/6605.26bac429.chunk.js

Requested by

Host: posts.specterops.io
URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:7::a29f:9804 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8e9e9f2bdfb2bf8640b0a0765edb0fabb1e6142a86edf14e9dc9fa09b754a626

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Mon, 19 Feb 2024 09:06:43 GMT
x-amz-version-id: BevQc9CwSliQAK90nklBWab6bNoZ7UAM
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-request-id: WQ7MGJVD4P6THPF9
age: 410751
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
x-amz-id-2: iDnh+c6vs5OOD91OcAjc7dRQSAcIKtHL4lQ4XT5kAnsPzPFERvSTWVv/8R4nzm9Gbb8bt1560L4=
last-modified: Mon, 12 Feb 2024 20:37:55 GMT
server: cloudflare
etag: W/"21ce2d79221860873f44cc9c3eb91dc4"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=31536000
cf-ray: 857d5affed6735f3-FRA
expires: Tue, 18 Feb 2025 09:06:43 GMT

GET
H3 200 2393.aad79a0e.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 45 KB
16 KB 59ms
56ms Script
application/javascript 2606:4700:7::a29f:9804
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/2393.aad79a0e.chunk.js

Requested by

Host: posts.specterops.io
URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:7::a29f:9804 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d98bf610751e57056b2a9b24fc6782d47e5fd7fac44876893084fd6213fd9e51

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Mon, 19 Feb 2024 09:06:43 GMT
x-amz-version-id: gFjJD6qy_u6t0tTBg9WHfTo6ulxZxvAr
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-request-id: S1Q2RN3W67EEDNTX
age: 221895
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
x-amz-id-2: 7y07ubZi8KpEcI9BaO5zNUtmZZzvTY+jZPhjdmXvKo23LDQUZrLIE4aBqK8NzvIogbdjZqJ5dbq5jzYcSogHoiifPd9TR/eQRiYW+kyRaJA=
last-modified: Thu, 15 Feb 2024 20:07:32 GMT
server: cloudflare
etag: W/"4c108edac1adf97514f9256b14901eb2"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=31536000
cf-ray: 857d5affed6835f3-FRA
expires: Tue, 18 Feb 2025 09:06:43 GMT

GET
H3 200 2211.706ab0f5.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 26 KB
8 KB 59ms
56ms Script
application/javascript 2606:4700:7::a29f:9804
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/2211.706ab0f5.chunk.js

Requested by

Host: posts.specterops.io
URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:7::a29f:9804 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ade6273bd485e3fe853219534880d83799ea2b75d1db214efc7a0255a527deda

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Mon, 19 Feb 2024 09:06:43 GMT
x-amz-version-id: B6kP9.8RVerphUFyT.nGoGfeA6SG5G.t
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-request-id: E55NYKCZT4T11X0C
age: 321026
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
x-amz-id-2: WZDCRddHQni0jOCCSX3/j/Y57HKqIoOl0TIfuIP8RrhZtadXLlJrsazQbn02J3Y9ioilEuOG1v2lL9ZftIAJbg==
last-modified: Wed, 14 Feb 2024 19:59:41 GMT
server: cloudflare
etag: W/"d4ff97682dc6e96f64e56231cccc64fd"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=31536000
cf-ray: 857d5affed6a35f3-FRA
expires: Tue, 18 Feb 2025 09:06:43 GMT

GET
H3 200 PostPage.MainContent.b3cfe5f4.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 193 KB
46 KB 60ms
57ms Script
application/javascript 2606:4700:7::a29f:9804
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/PostPage.MainContent.b3cfe5f4.chunk.js

Requested by

Host: posts.specterops.io
URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:7::a29f:9804 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0b7a934f6470bd0196d1509e520deaf39b345d758c6d28783c9f733c4b31c499

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Mon, 19 Feb 2024 09:06:43 GMT
x-amz-version-id: 3uKvxCkxeaMIsrElT_GMCJ9G74oH398x
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-request-id: S1Q7GCKEN0WQ6MR7
age: 221895
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
x-amz-id-2: ejMputq1BCpDavbLckum+mdkGVJGZlkLFIfNDCyEtIpJx+N0PbK/BzngkeTEWjFLw+VVw5Os4t7kmsJGz3U+nDwNSIrJ5EWkzJcZ4nCmYww=
last-modified: Thu, 15 Feb 2024 20:07:48 GMT
server: cloudflare
etag: W/"5805ae2ae83f35b3950626fc6725b85e"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=31536000
cf-ray: 857d5affed6b35f3-FRA
expires: Tue, 18 Feb 2025 09:06:43 GMT

POST
H2 200 /
posts.specterops.io/_/clientele/reports/performance/ 0
0 110ms
109ms Fetch
application/octet-stream 52.4.240.221
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://posts.specterops.io/_/clientele/reports/performance/
Requested by: Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/main.aeffcfa9.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 52.4.240.221 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-4-240-221.compute-1.amazonaws.com
Software: nginx /
Resource Hash

Request headers

Referer: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb
Medium-Clientele-Client: lite
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
Content-Type: application/json

Response headers

date: Mon, 19 Feb 2024 09:06:44 GMT
medium-fulfilled-by: valencia/main-20240216-153936-4fe2349849, clientele/main-20240212-082148-28c8d39d66
x-envoy-upstream-service-time: 14
sepia-upstream: medium
server: nginx
content-length: 0
content-type: application/octet-stream

GET
H3 200 2230.c546f16c.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 20 KB
8 KB 21ms
20ms Script
application/javascript 2606:4700:7::a29f:9804
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/2230.c546f16c.chunk.js

Requested by

Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/manifest.1ad777a6.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:7::a29f:9804 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cf9e6a6362e194c2e0d66aec3b1e207810fcd0eb794937c01e215478b29bc182

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Mon, 19 Feb 2024 09:06:44 GMT
x-amz-version-id: xWJf__tEGtfK6SYsYt3.b.Ctl1FYrL2e
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-request-id: 85VJM3V314JWTXB9
age: 274687
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
x-amz-id-2: IXegUsVJFiW8N+jvCGcJMQ1i6PcaEnHnJxbGIZONqSETfXpgtrH/icMHvmv3j5tlIcMaDN6EdDk=
last-modified: Thu, 19 Oct 2023 20:38:05 GMT
server: cloudflare
etag: W/"5b5ebdea4bda0086b419f1dc8ca91a75"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=31536000
cf-ray: 857d5b02c8c435f3-FRA
expires: Tue, 18 Feb 2025 09:06:44 GMT

POST
H2 200 /
posts.specterops.io/_/clientele/reports/performance/ 0
0 111ms
111ms Fetch
application/octet-stream 52.4.240.221
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://posts.specterops.io/_/clientele/reports/performance/
Requested by: Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/main.aeffcfa9.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 52.4.240.221 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-4-240-221.compute-1.amazonaws.com
Software: nginx /
Resource Hash

Request headers

Referer: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb
Medium-Clientele-Client: lite
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
Content-Type: application/json

Response headers

date: Mon, 19 Feb 2024 09:06:44 GMT
medium-fulfilled-by: valencia/main-20240216-153936-4fe2349849, clientele/main-20240212-082148-28c8d39d66
x-envoy-upstream-service-time: 14
sepia-upstream: medium
server: nginx
content-length: 0
content-type: application/octet-stream

GET
H3 200 GiveTipButton.7844a2d2.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 7 KB
3 KB 20ms
20ms Script
application/javascript 2606:4700:7::a29f:9804
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/GiveTipButton.7844a2d2.chunk.js

Requested by

Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/manifest.1ad777a6.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:7::a29f:9804 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dc5cb8bee960b5d5fd591fde3730e4d20198f53a4883b19f1a36d072b7f4e0a0

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Mon, 19 Feb 2024 09:06:44 GMT
x-amz-version-id: 5wxFaPBbZuXVEH4zg8t9Fz46CDAnJYq7
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-request-id: CJ62WD4Q898WG2EE
age: 1042670
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
x-amz-id-2: IVrWCYWvwXUgDj1tmKZOMMZcJjtCthP1H7NnYiTCimppg9Qh9Ql3gbG9sRFoViGi7SUAprzsTug=
last-modified: Thu, 19 Oct 2023 20:38:24 GMT
server: cloudflare
etag: W/"c9d3c6b5a486ea6dcc919c927917cf19"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=31536000
cf-ray: 857d5b03291c35f3-FRA
expires: Tue, 18 Feb 2025 09:06:44 GMT

GET
H3 200 gt-super-400-normal.woff
glyph.medium.com/font/4a44748/0-3j_4g_53_6bu_6c4_6c8_6c9_6cc_6cd_6ci_6cm/ 13 KB
13 KB 21ms
21ms Font
application/font-woff 2606:4700:7::a29f:9804
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://glyph.medium.com/font/4a44748/0-3j_4g_53_6bu_6c4_6c8_6c9_6cc_6cd_6ci_6cm/gt-super-400-normal.woff

Requested by

Host: glyph.medium.com
URL: https://glyph.medium.com/css/unbound.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:7::a29f:9804 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

40c05a07ac09c244b63a1755d524e094c32a18072335fb6cfc7f13da9cfe3eb9

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://glyph.medium.com/css/unbound.css
Origin: https://posts.specterops.io
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Mon, 19 Feb 2024 09:06:44 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
age: 6926170
x-envoy-upstream-service-time: 29
alt-svc: h3=":443"; ma=86400
server: cloudflare
access-control-max-age: 86400
access-control-allow-methods: GET, POST, PUT, DELETE
content-type: application/font-woff
access-control-allow-origin: *
cache-control: public, max-age=31536000
access-control-allow-credentials: true
vary: Accept-Encoding
cf-ray: 857d5b033b6d1965-FRA
access-control-allow-headers: Accept, Cache-Control, Content-Type, Cookie, DNT, Origin, User-Agent, X-Client-Date, X-Obvious-Cid, X-Opentracing, X-Xsrf-Token, ot-tracer-sampled, ot-tracer-spanid, ot-tracer-traceid
expires: Tue, 18 Feb 2025 09:06:44 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 239 KB
84 KB 48ms
12ms Script
application/javascript 2a00:1450:4001:811::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-7JY7T788PK

Requested by

Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/3057.5e22bbb0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

9ac6ebdaca4a6c998ead2fa9d6a4e2646dd4363a7155cf251b815990b3fcf811

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Mon, 19 Feb 2024 09:06:44 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 85458
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Mon, 19 Feb 2024 09:06:44 GMT

GET
H2 200 branch-latest.min.js Show response
cdn.branch.io/ 74 KB
23 KB 45ms
7ms Script
text/javascript 108.138.26.116
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.branch.io/branch-latest.min.js
Requested by: Host: posts.specterops.io
URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.26.116 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-26-116.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: c44b0bbcf81f73997a5177fccd4a2216a94c0090f4761c8fda5e4438cc8fe9e2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

x-amz-version-id: L2nOma9TH2IpdTlMoU0XJTIa8fDe60A3
content-encoding: gzip
via: 1.1 4dd80d99fd5d0f6baaaf5179cd921f72.cloudfront.net (CloudFront)
date: Mon, 19 Feb 2024 09:04:11 GMT
last-modified: Thu, 15 Feb 2024 23:40:40 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-P7
age: 153
etag: "ee3f91be95d06966964c4dd5157fe1a3"
x-cache: Hit from cloudfront
content-type: text/javascript
cache-control: max-age=300
content-length: 23285
x-amz-cf-id: Wwok3Pz-ZqH3M6GJzWaApekH3KAmrDx-diaXiV4fVsFiFpW3kU2YpQ==

GET
H3 200 1*dmbNkD5D-u45r44go_cf0g.png
miro.medium.com/v2/resize:fill:32:32/ 654 B
1 KB 21ms
20ms Image
image/png 2606:4700:7::a29f:9804
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/v2/resize:fill:32:32/1*dmbNkD5D-u45r44go_cf0g.png

Requested by

Host: posts.specterops.io
URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:7::a29f:9804 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2f80202a0810222c440db2cc0e6e72c1d506ffffb2787b645f25015365c730f0

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Mon, 19 Feb 2024 09:06:44 GMT
content-security-policy: script-src 'none'
x-content-type-options: nosniff
cf-cache-status: HIT
strict-transport-security: max-age=15552000; includeSubDomains; preload
age: 274452
x-envoy-upstream-service-time: 29
content-disposition: inline; filename="1*dmbNkD5D-u45r44go_cf0g.png"
alt-svc: h3=":443"; ma=86400
content-length: 654
x-request-id: 9ff5a445-d072-4761-822c-12793b133422
sepia-upstream: medium
server: cloudflare
etag: "VTmW7ah-o-FUAvHL4e3x8h_5hymB7pNjuuPgkvYQ7_o/RImNiNjU3ZGRlN2RhNjI0NjU3YTVmNmQ0ZDdhNzEyMDM3Ig"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
medium-fulfilled-by: miro-v2/main-20231207-145203-3b70adbedf
accept-ranges: bytes
cf-ray: 857d5b03492d35f3-FRA
expires: Tue, 18 Feb 2025 09:06:44 GMT

GET
H3 200 1*rzDEywT-rGMVud0vq03qfw.jpeg
miro.medium.com/v2/resize:fill:44:44/ 1 KB
2 KB 120ms
119ms Image
image/jpeg 2606:4700:7::a29f:9804
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/v2/resize:fill:44:44/1*rzDEywT-rGMVud0vq03qfw.jpeg

Requested by

Host: posts.specterops.io
URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:7::a29f:9804 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ac2df7b03a2a865c40b86c4bab8f451a5f892d6675e8b0284fa43252ce82a0cb

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Mon, 19 Feb 2024 09:06:44 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-content-type-options: nosniff
content-security-policy: script-src 'none'
cf-cache-status: HIT
x-envoy-upstream-service-time: 46
content-disposition: inline; filename="1*rzDEywT-rGMVud0vq03qfw.jpg"
alt-svc: h3=":443"; ma=86400
content-length: 1292
x-request-id: 7127255a-334c-474f-9dc8-ebf7b12a282e
sepia-upstream: medium
cf-bgj: h2pri
server: cloudflare
etag: "VFtDBYghopYX6OCmJOe93DhtJ6cQniVvC40f8GKBXcI/RImFmMzBjNGNiMDRmZWFjNjMxNWI5ZGQyZmFiNGRlYTdmIg"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
medium-fulfilled-by: miro-v2/main-20240212-082148-28c8d39d66
accept-ranges: bytes
cf-ray: 857d5b03493135f3-FRA
expires: Tue, 18 Feb 2025 09:06:44 GMT

GET
H3 200 1*D-FDlfkqivRBQZoESrwtqw.png
miro.medium.com/v2/resize:fill:24:24/ 881 B
1 KB 116ms
114ms Image
image/png 2606:4700:7::a29f:9804
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/v2/resize:fill:24:24/1*D-FDlfkqivRBQZoESrwtqw.png

Requested by

Host: posts.specterops.io
URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:7::a29f:9804 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

26c9055ffcab89bd8635b86711bb0d0e1f4011b5f58feef87f38110e12b684f9

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Mon, 19 Feb 2024 09:06:44 GMT
content-security-policy: script-src 'none'
x-content-type-options: nosniff
cf-cache-status: HIT
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-envoy-upstream-service-time: 81
content-disposition: inline; filename="1*D-FDlfkqivRBQZoESrwtqw.png"
alt-svc: h3=":443"; ma=86400
content-length: 881
x-request-id: 8ad0bcbb-d87e-4ebe-888d-45dcd1574638
sepia-upstream: medium
server: cloudflare
etag: "P_IhR2yUFMHX7sv3yXvDaUv7gyyy3l66iaKICC0BVIA/RIjBmZTE0Mzk1ZjkyYThhZjQ0MTQxOWEwNDRhYmMyZGFiIg"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
medium-fulfilled-by: miro-v2/main-20240212-082148-28c8d39d66
accept-ranges: bytes
cf-ray: 857d5b03493335f3-FRA
expires: Tue, 18 Feb 2025 09:06:44 GMT

GET
H3 200 5c50caa54067fd622d2f0fac18392213bf92f6e2fae89b691e62bceb40885e74
miro.medium.com/v2/da:true/resize:fit:0/ 300 KB
300 KB 28ms
25ms Image
image/png 2606:4700:7::a29f:9804
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/v2/da:true/resize:fit:0/5c50caa54067fd622d2f0fac18392213bf92f6e2fae89b691e62bceb40885e74

Requested by

Host: posts.specterops.io
URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:7::a29f:9804 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

67c2e60e6e47776cd0394b8dca668b89acaadee5198bbf9172a61ecc33dec97a

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Mon, 19 Feb 2024 09:06:44 GMT
content-security-policy: script-src 'none'
x-content-type-options: nosniff
cf-cache-status: HIT
strict-transport-security: max-age=15552000; includeSubDomains; preload
age: 573345
x-envoy-upstream-service-time: 200
content-disposition: inline; filename="5c50caa54067fd622d2f0fac18392213bf92f6e2fae89b691e62bceb40885e74.png"
alt-svc: h3=":443"; ma=86400
content-length: 306868
x-request-id: 78d6a68b-8900-44cf-9475-0baae262d9b1
sepia-upstream: medium
server: cloudflare
etag: "_89iZTbMWFrDAXoszgLV1LA1pq4J7sBwEDXleeW4l1U/RIjIwZDEwN2Y4NjUyZGRjYWYzMDBkNGYxNjllNjMwODQ5Ig"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
medium-fulfilled-by: miro-v2/main-20231120-091327-e2dd1b4066
accept-ranges: bytes
cf-ray: 857d5b03493535f3-FRA
expires: Tue, 18 Feb 2025 09:06:44 GMT

POST
H2 200 graphql Show response
posts.specterops.io/_/ 129 B
425 B 120ms
120ms Fetch
application/json 52.4.240.221
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://posts.specterops.io/_/graphql

Requested by

Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/3057.5e22bbb0.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

52.4.240.221 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-4-240-221.compute-1.amazonaws.com

Software

nginx /

Resource Hash

a6f4903d9ca2145b34bfcceb5194ff941ca84eda86f73d0e715465c64c055acf

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

apollographql-client-name: lite
medium-frontend-route: post
ot-tracer-sampled: true
accept-language: de-DE,de;q=0.9
ot-tracer-traceid: 1358617a6c51d909
medium-frontend-path: /arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb
graphql-operation: VisitorQuery
content-type: application/json
accept: */*
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
Referer: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb
medium-frontend-app: lite/main-20240216-225249-5bd4ea8c7b
apollographql-client-version: main-20240216-225249-5bd4ea8c7b
ot-tracer-spanid: 6e0e16e862f7e9a0

Response headers

date: Mon, 19 Feb 2024 09:06:44 GMT
sepia-upstream: medium
server: nginx
etag: W/"81-1xNkHjsE+XVU42XGR4FNWg16OWg"
content-type: application/json; charset=utf-8
access-control-allow-origin: *
medium-fulfilled-by: valencia/main-20240216-153936-4fe2349849, rito/main-20240216-164721-dd4e97f475
x-envoy-upstream-service-time: 25
content-length: 129
x-xss-protection: 0
x-request-received-at: 1708333604498

POST
H2 200 graphql Show response
posts.specterops.io/_/ 80 B
374 B 119ms
119ms Fetch
application/json 52.4.240.221
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://posts.specterops.io/_/graphql

Requested by

Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/3057.5e22bbb0.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

52.4.240.221 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-4-240-221.compute-1.amazonaws.com

Software

nginx /

Resource Hash

f6adb47c34f420ef114d5ecdb9b7daab2948c5e9c6d7e3441fee907e5a8fef3f

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

apollographql-client-name: lite
medium-frontend-route: post
ot-tracer-sampled: true
accept-language: de-DE,de;q=0.9
ot-tracer-traceid: 1358617a6c51d909
medium-frontend-path: /arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb
graphql-operation: AvatarMenuQuery
content-type: application/json
accept: */*
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
Referer: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb
medium-frontend-app: lite/main-20240216-225249-5bd4ea8c7b
apollographql-client-version: main-20240216-225249-5bd4ea8c7b
ot-tracer-spanid: 6e0e16e862f7e9a0

Response headers

date: Mon, 19 Feb 2024 09:06:44 GMT
sepia-upstream: medium
server: nginx
etag: W/"50-uwdNQiS1cauYvMsRotgPVGuGSSE"
content-type: application/json; charset=utf-8
access-control-allow-origin: *
medium-fulfilled-by: valencia/main-20240216-153936-4fe2349849, rito/main-20240216-164721-dd4e97f475
x-envoy-upstream-service-time: 22
content-length: 80
x-xss-protection: 0
x-request-received-at: 1708333604498

POST
H2 200 graphql Show response
posts.specterops.io/_/ 1 KB
806 B 198ms
197ms Fetch
application/json 52.4.240.221
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://posts.specterops.io/_/graphql

Requested by

Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/3057.5e22bbb0.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

52.4.240.221 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-4-240-221.compute-1.amazonaws.com

Software

nginx /

Resource Hash

d8efc78070168078e6bb409e03e9d26e83b580d40271067560e91bfe66a424a5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

apollographql-client-name: lite
medium-frontend-route: post
ot-tracer-sampled: true
accept-language: de-DE,de;q=0.9
ot-tracer-traceid: 1358617a6c51d909
medium-frontend-path: /arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb
graphql-operation: ClapCountQuery
content-type: application/json
accept: */*
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
Referer: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb
medium-frontend-app: lite/main-20240216-225249-5bd4ea8c7b
apollographql-client-version: main-20240216-225249-5bd4ea8c7b
ot-tracer-spanid: 6e0e16e862f7e9a0

Response headers

date: Mon, 19 Feb 2024 09:06:44 GMT
content-encoding: gzip
sepia-upstream: medium
server: nginx
etag: W/"4a2-XtJWK5o+8OhJTmyohcO+Ko2h60Q"
content-type: application/json; charset=utf-8
access-control-allow-origin: *
medium-fulfilled-by: valencia/main-20240216-153936-4fe2349849, rito/main-20240216-164721-dd4e97f475, tutu/main-20240217-073736-7387a156bc
x-envoy-upstream-service-time: 104
x-xss-protection: 0
x-request-received-at: 1708333604494

POST
H2 200 graphql Show response
posts.specterops.io/_/ 210 B
533 B 145ms
145ms Fetch
application/json 52.4.240.221
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://posts.specterops.io/_/graphql

Requested by

Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/3057.5e22bbb0.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

52.4.240.221 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-4-240-221.compute-1.amazonaws.com

Software

nginx /

Resource Hash

4cb51f1879307eff53cd341377254f615dc1fd944b04b6f3feeb72c2f166f565

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

apollographql-client-name: lite
medium-frontend-route: post
ot-tracer-sampled: true
accept-language: de-DE,de;q=0.9
ot-tracer-traceid: 1358617a6c51d909
medium-frontend-path: /arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb
graphql-operation: NewsletterV3ViewerEdge
content-type: application/json
accept: */*
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
Referer: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb
medium-frontend-app: lite/main-20240216-225249-5bd4ea8c7b
apollographql-client-version: main-20240216-225249-5bd4ea8c7b
ot-tracer-spanid: 6e0e16e862f7e9a0

Response headers

date: Mon, 19 Feb 2024 09:06:44 GMT
sepia-upstream: medium
server: nginx
etag: W/"d2-O/pXHRrHGQV4pkLVbhLnUcGRJ+c"
content-type: application/json; charset=utf-8
access-control-allow-origin: *
medium-fulfilled-by: valencia/main-20240216-153936-4fe2349849, rito/main-20240216-164721-dd4e97f475, tutu/main-20240217-073736-7387a156bc
x-envoy-upstream-service-time: 51
content-length: 210
x-xss-protection: 0
x-request-received-at: 1708333604499

POST
H2 200 graphql Show response
posts.specterops.io/_/ 24 KB
6 KB 418ms
418ms Fetch
application/json 52.4.240.221
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://posts.specterops.io/_/graphql

Requested by

Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/3057.5e22bbb0.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

52.4.240.221 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-4-240-221.compute-1.amazonaws.com

Software

nginx /

Resource Hash

745fd9766de64fe0e3f38fcebc98ca933d55c6892cc0392de71305e8d0b2038a

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

apollographql-client-name: lite
medium-frontend-route: post
ot-tracer-sampled: true
accept-language: de-DE,de;q=0.9
ot-tracer-traceid: 1358617a6c51d909
medium-frontend-path: /arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb
graphql-operation: MoreFromMediumRecircQuery
content-type: application/json
accept: */*
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
Referer: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb
medium-frontend-app: lite/main-20240216-225249-5bd4ea8c7b
apollographql-client-version: main-20240216-225249-5bd4ea8c7b
ot-tracer-spanid: 6e0e16e862f7e9a0

Response headers

date: Mon, 19 Feb 2024 09:06:44 GMT
content-encoding: gzip
sepia-upstream: medium
server: nginx
etag: W/"5fe2-w0Qh0rBA/NX+Og9muZyRvg8YDqw"
content-type: application/json; charset=utf-8
access-control-allow-origin: *
medium-fulfilled-by: valencia/main-20240216-153936-4fe2349849, rito/main-20240216-164721-dd4e97f475, tutu/main-20240216-230730-3d7808ad64
x-envoy-upstream-service-time: 234
x-xss-protection: 0
x-request-received-at: 1708333604585

POST
H2 200 graphql Show response
posts.specterops.io/_/ 27 B
321 B 209ms
209ms Fetch
application/json 52.4.240.221
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://posts.specterops.io/_/graphql

Requested by

Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/3057.5e22bbb0.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

52.4.240.221 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-4-240-221.compute-1.amazonaws.com

Software

nginx /

Resource Hash

706e568e0c4a22004a1c177674ae9489b5a3ca9f5a97e4addb3c626c03016548

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

apollographql-client-name: lite
medium-frontend-route: post
ot-tracer-sampled: true
accept-language: de-DE,de;q=0.9
ot-tracer-traceid: 1358617a6c51d909
medium-frontend-path: /arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb
graphql-operation: ViewerQuery
content-type: application/json
accept: */*
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
Referer: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb
medium-frontend-app: lite/main-20240216-225249-5bd4ea8c7b
apollographql-client-version: main-20240216-225249-5bd4ea8c7b
ot-tracer-spanid: 6e0e16e862f7e9a0

Response headers

date: Mon, 19 Feb 2024 09:06:44 GMT
sepia-upstream: medium
server: nginx
etag: W/"1b-zcE2qsOE110W+7rHoTa9C+cwT68"
content-type: application/json; charset=utf-8
access-control-allow-origin: *
medium-fulfilled-by: valencia/main-20240216-153936-4fe2349849, rito/main-20240216-164721-dd4e97f475
x-envoy-upstream-service-time: 27
content-length: 27
x-xss-protection: 0
x-request-received-at: 1708333604591

POST
H2 200 graphql Show response
posts.specterops.io/_/ 96 B
419 B 359ms
359ms Fetch
application/json 52.4.240.221
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://posts.specterops.io/_/graphql

Requested by

Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/3057.5e22bbb0.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

52.4.240.221 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-4-240-221.compute-1.amazonaws.com

Software

nginx /

Resource Hash

8a5b1f81ec446dc6cfe70b12fd989f69fe11db066245e8e67795f7ef8b991053

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

apollographql-client-name: lite
medium-frontend-route: post
ot-tracer-sampled: true
accept-language: de-DE,de;q=0.9
ot-tracer-traceid: 1358617a6c51d909
medium-frontend-path: /arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb
graphql-operation: InteractivePostBodyQuery
content-type: application/json
accept: */*
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
Referer: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb
medium-frontend-app: lite/main-20240216-225249-5bd4ea8c7b
apollographql-client-version: main-20240216-225249-5bd4ea8c7b
ot-tracer-spanid: 6e0e16e862f7e9a0

Response headers

date: Mon, 19 Feb 2024 09:06:44 GMT
sepia-upstream: medium
server: nginx
etag: W/"60-q7+Mj5lz+lGaERY9EP5OvjkJnso"
content-type: application/json; charset=utf-8
access-control-allow-origin: *
medium-fulfilled-by: valencia/main-20240216-153936-4fe2349849, rito/main-20240216-164721-dd4e97f475, tutu/main-20240217-073736-7387a156bc
x-envoy-upstream-service-time: 89
content-length: 96
x-xss-protection: 0
x-request-received-at: 1708333604684

GET
H2 200 _r Show response
app.link/ 91 B
634 B 204ms
160ms Script
text/javascript 2600:9000:2057:9800:19:9934:6a80:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://app.link/_r?sdk=web2.82.0&branch_key=key_live_ofxXr2qTrrU9NqURK8ZwEhknBxiI6KBm&callback=branch_callback__0

Requested by

Host: cdn.branch.io
URL: https://cdn.branch.io/branch-latest.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2057:9800:19:9934:6a80:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

openresty /

Resource Hash

9440d94acd9dca664a741e68ac7ac6d2624dbb8d4b9bf5ade207dc5e52456c6d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Mon, 19 Feb 2024 09:06:44 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
via: 1.1 f038e7175be9761825b2eefc2b0a832e.cloudfront.net (CloudFront)
server: openresty
accept-ch: Sec-CH-UA-Platform-Version,Sec-CH-UA-Model
x-amz-cf-pop: FRA6-C1
etag: W/"5b-870LufEd7mJhgTC3Sn8VJ6LvGZ4"
x-cache: Miss from cloudfront
content-type: text/javascript; charset=utf-8
content-length: 91
x-amz-cf-id: GCl8alVcr9BkBan53Qkmyld8lDqyIByvBMYJ-wQT-nWL37fUQqSMlw==

POST
H2 204 collect
region1.google-analytics.com/g/ 0
247 B 40ms
14ms Ping
text/plain 2001:4860:4802:32::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-7JY7T788PK&gtm=45je42e0v9123887712za200&_p=1708333604363&gcd=13l3l3l3l1&npa=0&dma_cps=sypham&dma=1&cid=698133719.1708333604&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&pscdl=noapi&_s=1&sid=1708333604&sct=1&seg=0&dl=https%3A%2F%2Fposts.specterops.io%2Farbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb&dt=Arbitrary%2C%20Unsigned%20Code%20Execution%20Vector%20in%20Microsoft.Workflow.Compiler.exe%20%7C%20by%20Matt%20Graeber%20%7C%20Posts%20By%20SpecterOps%20Team%20Members&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&tfd=1893
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-7JY7T788PK
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 19 Feb 2024 09:06:44 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://posts.specterops.io
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 graphql Show response
posts.specterops.io/_/ 80 B
374 B 228ms
228ms Fetch
application/json 52.4.240.221
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://posts.specterops.io/_/graphql

Requested by

Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/3057.5e22bbb0.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

52.4.240.221 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-4-240-221.compute-1.amazonaws.com

Software

nginx /

Resource Hash

31ee9e6ca34f47acdb8a09360cdb267a16d36ad2105fba3945ed8a1470c309aa

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

apollographql-client-name: lite
medium-frontend-route: post
ot-tracer-sampled: true
accept-language: de-DE,de;q=0.9
ot-tracer-traceid: 1358617a6c51d909
medium-frontend-path: /arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb
graphql-operation: PostGiveTipOnExternalPlatformQuery
content-type: application/json
accept: */*
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
Referer: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb
medium-frontend-app: lite/main-20240216-225249-5bd4ea8c7b
apollographql-client-version: main-20240216-225249-5bd4ea8c7b
ot-tracer-spanid: 6e0e16e862f7e9a0

Response headers

date: Mon, 19 Feb 2024 09:06:44 GMT
sepia-upstream: medium
server: nginx
etag: W/"50-LQNXHJLe4hAeT0qUYpbC13iGHpA"
content-type: application/json; charset=utf-8
access-control-allow-origin: *
medium-fulfilled-by: valencia/main-20240216-153936-4fe2349849, rito/main-20240216-164721-dd4e97f475
x-envoy-upstream-service-time: 26
content-length: 80
x-xss-protection: 0
x-request-received-at: 1708333604673

POST
H2 200 open Show response
api2.branch.io/v1/ 316 B
691 B 195ms
162ms XHR
application/json 2600:9000:2491:e800:11:f728:3040:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api2.branch.io/v1/open

Requested by

Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/3057.5e22bbb0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2491:e800:11:f728:3040:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

f25dc92d0e01dabbc7f492c01b074cd4e046416c8076a7c9e992bebda4c4bcbd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Mon, 19 Feb 2024 09:06:44 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 45144f4effc6db6c846de623ab8b639a.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P7
x-cache: Miss from cloudfront
content-type: application/json; charset=utf-8
access-control-allow-origin: *
cache-control: no-cache
x-branch-request-id: 95d7ee40-caae-4e6b-9d69-7e4e39feb47a-2024021909
content-length: 316
x-amz-cf-id: 0ZG3S405zK26TCSs8-aS3uOqxSkowL-qAxcRdzgv-xHeQNnpU_RR7Q==

POST
H2 200 /
posts.specterops.io/_/clientele/reports/performance/ 0
0 113ms
113ms Fetch
application/octet-stream 52.4.240.221
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://posts.specterops.io/_/clientele/reports/performance/
Requested by: Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/main.aeffcfa9.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 52.4.240.221 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-4-240-221.compute-1.amazonaws.com
Software: nginx /
Resource Hash

Request headers

Referer: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb
Medium-Clientele-Client: lite
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
Content-Type: application/json

Response headers

date: Mon, 19 Feb 2024 09:06:44 GMT
medium-fulfilled-by: valencia/main-20240216-153936-4fe2349849, clientele/main-20240212-082148-28c8d39d66
x-envoy-upstream-service-time: 14
sepia-upstream: medium
server: nginx
content-length: 0
content-type: application/octet-stream

POST
H2 200 graphql Show response
posts.specterops.io/_/ 3 KB
778 B 199ms
199ms Fetch
application/json 52.4.240.221
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://posts.specterops.io/_/graphql

Requested by

Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/3057.5e22bbb0.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

52.4.240.221 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-4-240-221.compute-1.amazonaws.com

Software

nginx /

Resource Hash

e2a5d81b92930c058b40c22394543fc6149080ba43f71232e8dcbb0895d5da8e

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

apollographql-client-name: lite
medium-frontend-route: post
ot-tracer-sampled: true
accept-language: de-DE,de;q=0.9
ot-tracer-traceid: 1358617a6c51d909
medium-frontend-path: /arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb
graphql-operation: ClapCountQuery
content-type: application/json
accept: */*
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
Referer: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb
medium-frontend-app: lite/main-20240216-225249-5bd4ea8c7b
apollographql-client-version: main-20240216-225249-5bd4ea8c7b
ot-tracer-spanid: 6e0e16e862f7e9a0

Response headers

date: Mon, 19 Feb 2024 09:06:45 GMT
content-encoding: gzip
sepia-upstream: medium
server: nginx
etag: W/"d90-4BlUnIfJap5jATBg+VeBeRDagk8"
content-type: application/json; charset=utf-8
access-control-allow-origin: *
medium-fulfilled-by: valencia/main-20240216-153936-4fe2349849, rito/main-20240216-164721-dd4e97f475, tutu/main-20240217-073736-7387a156bc
x-envoy-upstream-service-time: 104
x-xss-protection: 0
x-request-received-at: 1708333605075

POST
H2 200 pageview Show response
api2.branch.io/v1/ 28 B
432 B 364ms
364ms XHR
application/json 2600:9000:2491:e800:11:f728:3040:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api2.branch.io/v1/pageview

Requested by

Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/3057.5e22bbb0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2491:e800:11:f728:3040:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

/ Express

Resource Hash

a82dc28d43942326b346f92907df3bea5e38b2325ef97176f3b6234966bf19eb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Mon, 19 Feb 2024 09:06:45 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 45144f4effc6db6c846de623ab8b639a.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P7
x-powered-by: Express
etag: W/"1c-KRZWpHfIKyIHGKJ9mp9lAyX+vFY"
x-cache: Miss from cloudfront
content-type: application/json; charset=utf-8
access-control-allow-origin: *
x-branch-request-id: dcca0cedee2f4dfc887ef3388bd730dd-2024021909
content-length: 28
x-amz-cf-id: dA7McGGMuSAekce9MnBgk5ep26f0F4y26M8rmpD7o1Am2I-cAnPlJA==

POST
H2 200 pageview Show response
api2.branch.io/v1/ 28 B
435 B 222ms
222ms XHR
application/json 2600:9000:2491:e800:11:f728:3040:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api2.branch.io/v1/pageview

Requested by

Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/3057.5e22bbb0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2491:e800:11:f728:3040:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

/ Express

Resource Hash

a82dc28d43942326b346f92907df3bea5e38b2325ef97176f3b6234966bf19eb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Mon, 19 Feb 2024 09:06:45 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 45144f4effc6db6c846de623ab8b639a.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P7
x-powered-by: Express
etag: W/"1c-KRZWpHfIKyIHGKJ9mp9lAyX+vFY"
x-cache: Miss from cloudfront
content-type: application/json; charset=utf-8
access-control-allow-origin: *
x-branch-request-id: 080f66f73b9d4f93b904e68ce6592053-2024021909
content-length: 28
x-amz-cf-id: EEANc0HvlyvIeZaGKdlrj5srt8v8INHBVO3oPs5Xjj_DL0AehlREVg==

Verdicts & Comments Add Verdict or Comment

17 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

8 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.medium.com/	1970-01-21 04:08:13	Name: uid Value: lo_6b17d51bd803
.medium.com/	1970-01-21 04:08:13	Name: sid Value: 1:ZfJwxR2cR4GrGdODWq+ghn/PJQ5vzPe6Q2UcNTGrlIR4I6EWFblKNMfj38MIIdzb
posts.specterops.io/	1970-01-21 04:08:13	Name: sid Value: 1:C2oF+r1oGGD6XDP1kAo+TlEobeM9tHzVcNXgtkJf8cz016M9jrzeuaaQ/so4uUrF
posts.specterops.io/	1970-01-21 04:08:13	Name: uid Value: lo_6b17d51bd803
posts.specterops.io/	1970-01-20 18:32:14	Name: _dd_s Value: rum=0&expire=1708334504291
.specterops.io/	1970-01-21 04:08:13	Name: _ga_7JY7T788PK Value: GS1.1.1708333604.1.0.1708333604.0.0.0
.specterops.io/	1970-01-21 04:08:13	Name: _ga Value: GA1.1.698133719.1708333604
.app.link/	1970-01-21 03:17:49	Name: _s Value: 9YzucMTyGghwaRC1T2pB5yOUKPCrajS1ZiOtC%2BO3dF0IDVKskd2VYpQTeU8LUvQL

102 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
other	warning	URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d Message: Third-party cookie will be blocked. Learn more in the Issues tab.
security	warning	URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d(Line 41) Message: document.domain mutation is ignored because the surrounding agent cluster is origin-keyed.
other	warning	URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d(Line 41) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d(Line 41) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d(Line 41) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d(Line 41) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d(Line 41) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d(Line 41) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d(Line 41) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d(Line 41) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d(Line 41) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d(Line 41) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d(Line 41) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d(Line 41) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d(Line 41) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d(Line 41) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d(Line 41) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d(Line 41) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d(Line 41) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d(Line 41) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d(Line 41) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d(Line 41) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d(Line 41) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d(Line 41) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d(Line 41) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d(Line 41) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d(Line 41) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d(Line 41) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d(Line 41) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d(Line 41) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d(Line 41) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d(Line 41) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d(Line 41) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d(Line 41) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d(Line 41) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d(Line 41) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d(Line 41) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d(Line 41) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d(Line 41) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d(Line 41) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d(Line 41) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d(Line 41) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d(Line 41) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d(Line 41) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d(Line 41) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d(Line 41) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d(Line 41) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d(Line 41) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d(Line 41) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d(Line 41) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d(Line 41) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d(Line 41) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d(Line 41) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d(Line 41) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d(Line 41) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d(Line 41) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d(Line 41) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d(Line 41) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d(Line 41) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb?gi=5c54956c884d(Line 41) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb(Line 73) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb(Line 73) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb Message: Third-party cookie will be blocked. Learn more in the Issues tab.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	frame-ancestors 'self' https://medium.com

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

api2.branch.io
app.link
cdn-client.medium.com
cdn.branch.io
glyph.medium.com
medium.com
miro.medium.com
posts.specterops.io
region1.google-analytics.com
www.googletagmanager.com
108.138.26.116
2001:4860:4802:32::36
2600:9000:2057:9800:19:9934:6a80:93a1
2600:9000:2491:e800:11:f728:3040:93a1
2606:4700:7::a29f:9804
2606:4700:7::a29f:9904
2a00:1450:4001:811::2008
52.4.240.221
07080369aba872ba059261aa7a0114bf1373a38a7c6d615fa9f17bf43a382c5a
08ccd5d102e7f3ccf31253865a0986f9c37133cbff42179212a66e3b5f4bc46f
0b7a934f6470bd0196d1509e520deaf39b345d758c6d28783c9f733c4b31c499
14c45a864427b8fb976671fb4b8e93c55984678c2fa0c087e0eb35b7ded3ff9b
1ca820b9aa7681184130d09157ea679d1d31390bee2af294c088f6dcaa24923b
1d40ba6bcffd2d51735ad266bbcea130205c2560e34f60d204feed40bce804cb
23851a0752a4d159babf6bd3bbe60a4166adb193c2207bddc8e6beaa461c5998
24183a1040266651c9220130eeb24ae69eaf1aea2f6cdf2928c47c1d28ec616f
25b283a69fdffec5aed19ca2a40b67f490744d4e28d1b41b14f78c7c3ca85304
26c9055ffcab89bd8635b86711bb0d0e1f4011b5f58feef87f38110e12b684f9
2db45c5c5c2aa2552b5799fd50f29c42c216c42220355c83f4d5f10eba54268d
2f80202a0810222c440db2cc0e6e72c1d506ffffb2787b645f25015365c730f0
31ee9e6ca34f47acdb8a09360cdb267a16d36ad2105fba3945ed8a1470c309aa
33d8dbb87455352f1c047586550796b41b1a5dfa4d09cd8341b0c8b990f90c60
3620a054627b390ac087153c997af96ae35ef5c03662a52ec71ee5cf4a63532e
36958875136eaa028381ba1b7c0169a46c0a3a80b12a2be773ec5e30479e3e87
37a92f6f729051d8f507d8e2102fb6ff65523e1cac9a02c5cf73f1503b446dfc
3df22782693c9af50722c8e68c3bd5f0f2248d53b79cd278c2f0953d7b9d4571
3dfdb6f5b4806f1c38df4fe8759a9de97db51013d581eab964f30e0168c63824
3e114382d20a02d0ca050b5fb41beeeb8d1c63762fa2f2e2b75557a48117d365
3f1825ce622717b985e1c87f2a00902896a1d5ebf117bb8f7a9325af7efa02de
40c05a07ac09c244b63a1755d524e094c32a18072335fb6cfc7f13da9cfe3eb9
46e758010f351793913ddca875cd4d6b107e4fe8b263b352c1da5b2f3d151021
4cb51f1879307eff53cd341377254f615dc1fd944b04b6f3feeb72c2f166f565
5a1aa5b3fe12402794e0a8981461a9a908a62d6fdea536e669147fc38bfc7be5
5e45ce783ff6f2159c09545f4a3a53cfd8aa6588e53ab2e3dc894b69048128e3
6371dbf8600466f6a05a06c3372f54b5df5ea4ce7e2145571a7f72886d61d879
65f0c65b5db3aa0568c7986479a4a3e909a05a84fb34ced48d70a2d628dd1444
67c2e60e6e47776cd0394b8dca668b89acaadee5198bbf9172a61ecc33dec97a
706e568e0c4a22004a1c177674ae9489b5a3ca9f5a97e4addb3c626c03016548
745fd9766de64fe0e3f38fcebc98ca933d55c6892cc0392de71305e8d0b2038a
783a77c4f9a5db02ae0c7f507a10c6dcda86b1c230ae75c919856928fd577e76
78661d3e6871b6e5c37f3113d811cb3dfc69546449e3b2c28095b6e7f28d9a7d
813f08cedb7ed684d4f10b10636998d3985aafc8e13239c672dd6a8d166bc899
82af9d7d76d1b453c1df2703e16fb59fd1287953eb489d584f77de963e753c5a
8a5b1f81ec446dc6cfe70b12fd989f69fe11db066245e8e67795f7ef8b991053
8cf41c0f745c69819ec5b4be13b73116190e101893f9ecd134f934d76a28ce41
8d3e598ba737be043c5d785d54f858660c4dd4d22805b22a550876b017830f6b
8e9e9f2bdfb2bf8640b0a0765edb0fabb1e6142a86edf14e9dc9fa09b754a626
93efcb5760c80b2b05a06369f841dec8894aec84f393f473d4a98c97d753637c
9440d94acd9dca664a741e68ac7ac6d2624dbb8d4b9bf5ade207dc5e52456c6d
94e0099d1af6191fe1aadfef55debc9732f3e759f50788fd9316df0cb9d4cce7
9ac6ebdaca4a6c998ead2fa9d6a4e2646dd4363a7155cf251b815990b3fcf811
9d4cacc612c452bdcc10a085e37f00f77d8863cb1e8fe669ca02c1156f2cb712
a13833533c830de737dc8b245fa9f45199dcef87c1bd0172b63d9da0e9fea577
a6f4903d9ca2145b34bfcceb5194ff941ca84eda86f73d0e715465c64c055acf
a82dc28d43942326b346f92907df3bea5e38b2325ef97176f3b6234966bf19eb
ab4e6c77ee5e6178222bb7deefc0c6d5b0e2b3ab2df5d8623da00840809e639d
ac2df7b03a2a865c40b86c4bab8f451a5f892d6675e8b0284fa43252ce82a0cb
ade6273bd485e3fe853219534880d83799ea2b75d1db214efc7a0255a527deda
ae6f8c5d5fff16e31b366bc606f4d030c373efad7621baad6a2b24cc3ab111e7
b0bb60d88b2542c309808da080e6c3bfe7c4c3ff03e679ab29a4394c00a11c4f
b0f424bafe993b016ea96973894f95dfc4290608478a2d7d3fdd080d9b0a60d1
c44b0bbcf81f73997a5177fccd4a2216a94c0090f4761c8fda5e4438cc8fe9e2
ca2b6c294049540bb3cf90a4425ee46c65a114fba4d1a91b0c76b644b95e4d2f
cf9e6a6362e194c2e0d66aec3b1e207810fcd0eb794937c01e215478b29bc182
d5d7947aa3e6131478a97f06e72913cb7b9e19161e03502ad1de3eb67f447213
d6c90ff7bddb2b437a4130fbfaad1dd6fdc87a532ed4a97b5a4484c659e632ee
d8efc78070168078e6bb409e03e9d26e83b580d40271067560e91bfe66a424a5
d98bf610751e57056b2a9b24fc6782d47e5fd7fac44876893084fd6213fd9e51
dc5cb8bee960b5d5fd591fde3730e4d20198f53a4883b19f1a36d072b7f4e0a0
df3a974015db7f9e9a9ea6f1708cdb5a3f54d00478801c7ba7f89cd9e72b4831
df83693552dabf211bd600846206ebcc0192afd64a452c356f4b285e9392581d
e2a5d81b92930c058b40c22394543fc6149080ba43f71232e8dcbb0895d5da8e
e365238b8f3b49688bb6f1344496c0e25a3ebe4302c859856e937f18f403d6a2
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e453b4b0007b54b4ffc7c1af90daa81204eee14fde724baf50411b975c981e04
ed871cdd5c0d8def9f024a161b7b8e8cef778a47955c05a27fbdcf023b9fa4b1
f25dc92d0e01dabbc7f492c01b074cd4e046416c8076a7c9e992bebda4c4bcbd
f2fca89af2edf8cde1aaf9a65187f75534f764c7bd7b420bb8b2524bf6408ba0
f6adb47c34f420ef114d5ecdb9b7daab2948c5e9c6d7e3441fee907e5a8fef3f
f90d19259478cca4381bea7e760845de9bcf2155ee96cd8b06049add894022d3

posts.specterops.io Open in urlscan Pro 52.4.240.221 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

78 Requests

100 %HTTPS

75 %IPv6

6 Domains

10 Subdomains

8 IPs

2 Countries

1376 kBTransfer

3482 kBSize

8 Cookies

96 Outgoing links

Page URL History

Redirected requests

78 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

posts.specterops.io Open in urlscan Pro
52.4.240.221 Public Scan

Screenshot
Live screenshot

Full Image

78
Requests

100 %
HTTPS

75 %
IPv6

6
Domains

10
Subdomains

8
IPs

2
Countries

1376 kB
Transfer

3482 kB
Size

8
Cookies

78 HTTP transactions
0 data transactions