urlscan.io logo urlscan.io
SecurityTrails logo

blog.cm2.pw Open in urlscan Pro
2606:4700:3035::6812:3b33  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://blog.cm2.pw/exploiting-post-based-xssi/
Effective URL: https://blog.cm2.pw/exploiting-post-based-xssi/
Submission: On April 18 via api from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 4 IPs in 2 countries across 4 domains to perform 17 HTTP transactions. The main IP is 2606:4700:3035::6812:3b33, located in United States and belongs to CLOUDFLARENET, US. The main domain is blog.cm2.pw.
TLS certificate: Issued by CloudFlare Inc ECC CA-2 on April 2nd 2020. Valid for: 6 months.
This is the only time blog.cm2.pw was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 9 2606:4700:303... 13335 (CLOUDFLAR...)
1 2a00:1450:400... 15169 (GOOGLE)
6 2a00:1450:400... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
17 4
Domain Requested by
9 blog.cm2.pw 1 redirects blog.cm2.pw
6 fonts.gstatic.com blog.cm2.pw
2 www.google-analytics.com www.googletagmanager.com
1 www.googletagmanager.com blog.cm2.pw
17 4
Subject Issuer Validity Valid
sni.cloudflaressl.com
CloudFlare Inc ECC CA-2		 2020-04-02 -
2020-10-09		 6 months crt.sh
*.google-analytics.com
GTS CA 1O1		 2020-04-01 -
2020-06-24		 3 months crt.sh
*.gstatic.com
GTS CA 1O1		 2020-04-01 -
2020-06-24		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://blog.cm2.pw/exploiting-post-based-xssi/
Frame ID: 306F1A3DED383E4D93848DA3970B11A7
Requests: 17 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. http://blog.cm2.pw/exploiting-post-based-xssi/ HTTP 301
    https://blog.cm2.pw/exploiting-post-based-xssi/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • meta generator /Ghost(?:\s([\d.]+))?/i
Overall confidence: 100%
Detected patterns
  • meta generator /Ghost(?:\s([\d.]+))?/i
Overall confidence: 100%
Detected patterns
  • headers server /^cloudflare$/i
Overall confidence: 100%
Detected patterns
  • script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

Page Statistics

17
Requests

100 %
HTTPS

100 %
IPv6

4
Domains

4
Subdomains

4
IPs

2
Countries

240 kB
Transfer

452 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://blog.cm2.pw/exploiting-post-based-xssi/ HTTP 301
    https://blog.cm2.pw/exploiting-post-based-xssi/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

17 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
blog.cm2.pw/exploiting-post-based-xssi/
Redirect Chain
  • http://blog.cm2.pw/exploiting-post-based-xssi/
  • https://blog.cm2.pw/exploiting-post-based-xssi/
13 KB
4 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://blog.cm2.pw/exploiting-post-based-xssi/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3035::6812:3b33 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / Express
Resource Hash
acbd28e2851a285d523651a61dfb143d40fe66eb34766627a0201f5a304404b4

Request headers

:method
GET
:authority
blog.cm2.pw
:scheme
https
:path
/exploiting-post-based-xssi/
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
__cfduid=de37e813242a1cf754104b01c4fbcb1c71587223035
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status
200
date
Sat, 18 Apr 2020 15:17:16 GMT
content-type
text/html; charset=utf-8
x-powered-by
Express
cache-control
public, max-age=0
vary
Accept-Encoding
cf-cache-status
DYNAMIC
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
585f5a039dd8c295-FRA
content-encoding
br
alt-svc
h3-27=":443"; ma=86400, h3-25=":443"; ma=86400, h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
cf-request-id
022f76963d0000c295d72ca200000001

Redirect headers

Date
Sat, 18 Apr 2020 15:17:15 GMT
Content-Type
text/html
Transfer-Encoding
chunked
Connection
keep-alive
Set-Cookie
__cfduid=de37e813242a1cf754104b01c4fbcb1c71587223035; expires=Mon, 18-May-20 15:17:15 GMT; path=/; domain=.cm2.pw; HttpOnly; SameSite=Lax
Location
https://blog.cm2.pw/exploiting-post-based-xssi/
CF-Cache-Status
DYNAMIC
Server
cloudflare
CF-RAY
585f5a01d9e71f2d-FRA
alt-svc
h3-27=":443"; ma=86400, h3-25=":443"; ma=86400, h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
cf-request-id
022f76952600001f2dc7a33200000001
style.css
blog.cm2.pw/assets/css/ 		26 KB
6 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://blog.cm2.pw/assets/css/style.css?v=df346022dd
Requested by
Host: blog.cm2.pw
URL: https://blog.cm2.pw/exploiting-post-based-xssi/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3035::6812:3b33 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / Express
Resource Hash
4bceac16a748d8bc36e454506d8c6060ac20aaeb87c38a48a98f509791c4193d

Request headers

Referer
https://blog.cm2.pw/exploiting-post-based-xssi/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Sat, 18 Apr 2020 15:17:16 GMT
content-encoding
br
cf-cache-status
HIT
age
20277
x-powered-by
Express
status
200
alt-svc
h3-27=":443"; ma=86400, h3-25=":443"; ma=86400, h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
cf-request-id
022f76987b0000c295d732c200000001
last-modified
Sat, 25 Aug 2018 06:04:40 GMT
server
cloudflare
etag
W/"12dda-1656faf3cc0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/css; charset=UTF-8
cache-control
public, max-age=31536000
cf-polished
origSize=77274
cf-ray
585f5a072f55c295-FRA
cf-bgj
minify
/
blog.cm2.pw/public/members.min.js/ 		6 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://blog.cm2.pw/public/members.min.js/?v=df346022dd
Requested by
Host: blog.cm2.pw
URL: https://blog.cm2.pw/exploiting-post-based-xssi/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3035::6812:3b33 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / Express
Resource Hash
4f0c525c00249a11038f90382c89556978864f184970f03349138c3704e2b3e0

Request headers

Referer
https://blog.cm2.pw/exploiting-post-based-xssi/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Sat, 18 Apr 2020 15:17:16 GMT
content-encoding
br
etag
W/"f64003204edd8a4364e6478f1a36ed95"
cf-cache-status
DYNAMIC
server
cloudflare
x-powered-by
Express
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
public, max-age=31536000
cf-ray
585f5a072f57c295-FRA
alt-svc
h3-27=":443"; ma=86400, h3-25=":443"; ma=86400, h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
cf-request-id
022f76987b0000c295d732d200000001
js
www.googletagmanager.com/gtag/ 		79 KB
29 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=UA-112764165-1
Requested by
Host: blog.cm2.pw
URL: https://blog.cm2.pw/exploiting-post-based-xssi/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:818::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
409290759d7a83624245121eda7606a1060bb38ccbdd68e1fa0cca4ffe31d8ad
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Referer
https://blog.cm2.pw/exploiting-post-based-xssi/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Sat, 18 Apr 2020 15:17:16 GMT
content-encoding
br
vary
Accept-Encoding
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
30047
x-xss-protection
0
last-modified
Sat, 18 Apr 2020 15:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Sat, 18 Apr 2020 15:17:16 GMT
favicon.png
blog.cm2.pw/content/images/2018/01/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.cm2.pw/content/images/2018/01/favicon.png
Requested by
Host: blog.cm2.pw
URL: https://blog.cm2.pw/exploiting-post-based-xssi/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3035::6812:3b33 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / Express
Resource Hash
e6d65a43e5ee5a05d178f442ca3bd8ae6a0cc09bc152af4ed83218b1ec47e3e7

Request headers

Referer
https://blog.cm2.pw/exploiting-post-based-xssi/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Sat, 18 Apr 2020 15:17:16 GMT
cf-cache-status
HIT
age
20277
x-powered-by
Express
status
200
alt-svc
h3-27=":443"; ma=86400, h3-25=":443"; ma=86400, h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
content-length
3409
cf-request-id
022f76988d0000c295d7332200000001
last-modified
Sat, 25 Aug 2018 06:02:44 GMT
server
cloudflare
etag
W/"d51-1656fad77a0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/png
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
585f5a074f93c295-FRA
Profile_400x400.jpg
blog.cm2.pw/content/images/2018/08/ 		35 KB
35 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.cm2.pw/content/images/2018/08/Profile_400x400.jpg
Requested by
Host: blog.cm2.pw
URL: https://blog.cm2.pw/exploiting-post-based-xssi/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3035::6812:3b33 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / Express
Resource Hash
a5704997015837ccdfff688585416a4189787d690419c6b8aa07f8a45891502f

Request headers

Referer
https://blog.cm2.pw/exploiting-post-based-xssi/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Sat, 18 Apr 2020 15:17:16 GMT
cf-cache-status
HIT
age
19887
x-powered-by
Express
status
200
alt-svc
h3-27=":443"; ma=86400, h3-25=":443"; ma=86400, h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
content-length
35846
cf-request-id
022f76988d0000c295d7333200000001
last-modified
Sat, 25 Aug 2018 06:15:38 GMT
server
cloudflare
etag
W/"8c06-1656fb94710"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/jpeg
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
585f5a074f94c295-FRA
email-decode.min.js
blog.cm2.pw/cdn-cgi/scripts/5c5dd728/cloudflare-static/ 		1 KB
858 B 		Script
General
Check archive.org
Download Go to
Full URL
https://blog.cm2.pw/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js
Requested by
Host: blog.cm2.pw
URL: https://blog.cm2.pw/exploiting-post-based-xssi/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3035::6812:3b33 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://blog.cm2.pw/exploiting-post-based-xssi/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Sat, 18 Apr 2020 15:17:16 GMT
content-encoding
gzip
vary
Accept-Encoding
last-modified
Tue, 14 Apr 2020 14:46:15 GMT
server
cloudflare
etag
W/"5e95ccb7-4d7"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options
SAMEORIGIN
content-type
application/javascript
status
200
cache-control
max-age=172800, public
cf-ray
585f5a074f87c295-FRA
cf-request-id
022f76988a0000c295d7330200000001
expires
Mon, 20 Apr 2020 15:17:16 GMT
script.js
blog.cm2.pw/assets/js/ 		157 KB
54 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://blog.cm2.pw/assets/js/script.js?v=df346022dd
Requested by
Host: blog.cm2.pw
URL: https://blog.cm2.pw/exploiting-post-based-xssi/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3035::6812:3b33 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / Express
Resource Hash
b24fb912db5a529a621c15e77c2044ee3ecc562c7e7a19ef17346405c7d2004c

Request headers

Referer
https://blog.cm2.pw/exploiting-post-based-xssi/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Sat, 18 Apr 2020 15:17:16 GMT
content-encoding
br
cf-cache-status
HIT
age
20277
x-powered-by
Express
status
200
alt-svc
h3-27=":443"; ma=86400, h3-25=":443"; ma=86400, h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
cf-request-id
022f76988d0000c295d7331200000001
last-modified
Sat, 25 Aug 2018 06:04:40 GMT
server
cloudflare
etag
W/"274ed-1656faf3cc0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
cache-control
public, max-age=31536000
cf-ray
585f5a074f92c295-FRA
cf-bgj
minify
EjsrzDkQUQCDwsBtLpcVQZBw1xU1rKptJj_0jans920.woff2
fonts.gstatic.com/s/firasans/v5/ 		11 KB
11 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/firasans/v5/EjsrzDkQUQCDwsBtLpcVQZBw1xU1rKptJj_0jans920.woff2
Requested by
Host: blog.cm2.pw
URL: https://blog.cm2.pw/exploiting-post-based-xssi/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:821::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
1a919685f477830492c3f2c830911d1d353be170731583697f807b3e2ee068b4
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
https://blog.cm2.pw/assets/css/style.css?v=df346022dd
Origin
https://blog.cm2.pw

Response headers

date
Tue, 14 Apr 2020 08:08:24 GMT
x-content-type-options
nosniff
last-modified
Tue, 19 Aug 2014 16:56:34 GMT
server
sffe
age
371332
status
200
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
11464
x-xss-protection
0
expires
Wed, 14 Apr 2021 08:08:24 GMT
icons.woff2
blog.cm2.pw/assets/font/ 		3 KB
4 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://blog.cm2.pw/assets/font/icons.woff2?58972676
Requested by
Host: blog.cm2.pw
URL: https://blog.cm2.pw/exploiting-post-based-xssi/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3035::6812:3b33 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / Express
Resource Hash
5330f9a1ad5a64f8ea34548c7401804c5e8d4d8a4c36aff8953b8046d91e5f7c

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
https://blog.cm2.pw/assets/css/style.css?v=df346022dd
Origin
https://blog.cm2.pw

Response headers

date
Sat, 18 Apr 2020 15:17:16 GMT
cf-cache-status
HIT
age
20277
x-powered-by
Express
status
200
alt-svc
h3-27=":443"; ma=86400, h3-25=":443"; ma=86400, h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
content-length
3576
cf-request-id
022f7698900000c295d7334200000001
last-modified
Sat, 25 Aug 2018 06:04:40 GMT
server
cloudflare
etag
W/"df8-1656faf3cc0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Origin, Accept-Encoding
content-type
font/woff2
access-control-allow-origin
https://blog.cm2.pw
cache-control
public, max-age=31536000
access-control-allow-credentials
true
accept-ranges
bytes
cf-ray
585f5a074f9bc295-FRA
DugPdSljmOTocZOR2CItOhampu5_7CjHW5spxoeN3Vs.woff2
fonts.gstatic.com/s/firasans/v5/ 		11 KB
12 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/firasans/v5/DugPdSljmOTocZOR2CItOhampu5_7CjHW5spxoeN3Vs.woff2
Requested by
Host: blog.cm2.pw
URL: https://blog.cm2.pw/exploiting-post-based-xssi/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:821::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
85863f3629d5a23ac20fcfd5e9f4f63b7f596fe9031573e301031c73e3c44e08
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
https://blog.cm2.pw/assets/css/style.css?v=df346022dd
Origin
https://blog.cm2.pw

Response headers

date
Thu, 16 Apr 2020 03:45:52 GMT
x-content-type-options
nosniff
last-modified
Tue, 19 Aug 2014 16:56:27 GMT
server
sffe
age
214284
status
200
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
11696
x-xss-protection
0
expires
Fri, 16 Apr 2021 03:45:52 GMT
f9GbO0_LnwwuaRC6yAh0JKCWcynf_cDxXwCLxiixG1c.woff2
fonts.gstatic.com/s/cardo/v8/ 		14 KB
14 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/cardo/v8/f9GbO0_LnwwuaRC6yAh0JKCWcynf_cDxXwCLxiixG1c.woff2
Requested by
Host: blog.cm2.pw
URL: https://blog.cm2.pw/exploiting-post-based-xssi/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:821::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
b8c5019aa0fdef3413a4ae6591e80d05564ca1f9112d1e47ab943249eaee11b9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
https://blog.cm2.pw/assets/css/style.css?v=df346022dd
Origin
https://blog.cm2.pw

Response headers

date
Sat, 11 Apr 2020 08:51:08 GMT
x-content-type-options
nosniff
last-modified
Wed, 27 Aug 2014 14:50:02 GMT
server
sffe
age
627968
status
200
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
14472
x-xss-protection
0
expires
Sun, 11 Apr 2021 08:51:08 GMT
aRpKelDgx13ov6asvC3QbgLUuEpTyoUstqEm5AMlJo4.woff2
fonts.gstatic.com/s/cardo/v8/ 		17 KB
18 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/cardo/v8/aRpKelDgx13ov6asvC3QbgLUuEpTyoUstqEm5AMlJo4.woff2
Requested by
Host: blog.cm2.pw
URL: https://blog.cm2.pw/exploiting-post-based-xssi/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:821::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
c55a7720305158b0c1a514ad83828bdbe34b8ff9d6235013cc3d45834d4d915f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
https://blog.cm2.pw/assets/css/style.css?v=df346022dd
Origin
https://blog.cm2.pw

Response headers

date
Sat, 11 Apr 2020 07:43:01 GMT
x-content-type-options
nosniff
last-modified
Wed, 27 Aug 2014 14:55:11 GMT
server
sffe
age
632055
status
200
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
17912
x-xss-protection
0
expires
Sun, 11 Apr 2021 07:43:01 GMT
X-1BEHTKpRYzad3JEXy9-nYhjbSpvc47ee6xR_80Hnw.woff2
fonts.gstatic.com/s/cardo/v8/ 		18 KB
18 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/cardo/v8/X-1BEHTKpRYzad3JEXy9-nYhjbSpvc47ee6xR_80Hnw.woff2
Requested by
Host: blog.cm2.pw
URL: https://blog.cm2.pw/exploiting-post-based-xssi/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:821::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
905d8ef0caceb6b8e7132007cab05e6048f76e438452f44c0402ea2ce960b799
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
https://blog.cm2.pw/assets/css/style.css?v=df346022dd
Origin
https://blog.cm2.pw

Response headers

date
Tue, 14 Apr 2020 23:48:23 GMT
x-content-type-options
nosniff
last-modified
Wed, 27 Aug 2014 15:25:50 GMT
server
sffe
age
314933
status
200
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
18560
x-xss-protection
0
expires
Wed, 14 Apr 2021 23:48:23 GMT
zM2u8V3CuPVwAAXFQcDi4Bampu5_7CjHW5spxoeN3Vs.woff2
fonts.gstatic.com/s/firasans/v5/ 		11 KB
12 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/firasans/v5/zM2u8V3CuPVwAAXFQcDi4Bampu5_7CjHW5spxoeN3Vs.woff2
Requested by
Host: blog.cm2.pw
URL: https://blog.cm2.pw/exploiting-post-based-xssi/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:821::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
4f324112ff76310cce479ce8942ecc7ef7c31d361b6c673f50bde19a7de1d6ea
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
https://blog.cm2.pw/assets/css/style.css?v=df346022dd
Origin
https://blog.cm2.pw

Response headers

date
Fri, 03 Apr 2020 05:16:42 GMT
x-content-type-options
nosniff
last-modified
Tue, 19 Aug 2014 17:12:32 GMT
server
sffe
age
1332034
status
200
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
11744
x-xss-protection
0
expires
Sat, 03 Apr 2021 05:16:42 GMT
analytics.js
www.google-analytics.com/ 		44 KB
18 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-112764165-1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:818::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
eaf1b128b927ac2868755cb7366d35554255c8af362235afe270f9614f8c806d
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://blog.cm2.pw/exploiting-post-based-xssi/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 06 Feb 2020 00:21:02 GMT
server
Golfe2
age
5922
date
Sat, 18 Apr 2020 13:38:34 GMT
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=7200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
18174
expires
Sat, 18 Apr 2020 15:38:34 GMT
collect
www.google-analytics.com/r/ 		35 B
101 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google-analytics.com/r/collect?v=1&_v=j81&a=1354205601&t=pageview&_s=1&dl=https%3A%2F%2Fblog.cm2.pw%2Fexploiting-post-based-xssi%2F&ul=en-us&de=UTF-8&dt=Exploiting%20POST-based%20XSSI&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&_u=IEBAAUAB~&jid=1303443301&gjid=979506254&cid=568684805.1587223037&tid=UA-112764165-1&_gid=566093485.1587223037&_r=1&gtm=2ou480&z=353699435
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:818::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://blog.cm2.pw/exploiting-post-based-xssi/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 18 Apr 2020 15:17:16 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
status
200
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
35
expires
Fri, 01 Jan 1990 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

18 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate string| disqus function| gtag object| dataLayer function| $ function| jQuery object| hljs object| jQuery111301574879901147952 object| NProgress object| google_tag_manager object| url string| GoogleAnalyticsObject function| ga object| google_tag_data object| gaplugins object| gaGlobal object| gaData

1 Cookies

Domain/Path Name / Value
.cm2.pw/ Name: __cfduid
Value: de37e813242a1cf754104b01c4fbcb1c71587223035