offsec.almond.consulting Open in urlscan Pro
2606:4700:10::6816:1066 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://offsec.almond.consulting/UAC-bypass-dotnet.html
Submission: On February 19 via api (February 19th 2024, 8:55:09 am UTC) from BE — Scanned from DE

Summary HTTP 36 Redirects Links 33 Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 36 HTTP transactions. The main IP is 2606:4700:10::6816:1066, located in United States and belongs to CLOUDFLARENET, US. The main domain is offsec.almond.consulting.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on October 29th 2023. Valid for: a year.

This is the only time offsec.almond.consulting was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
30	2606:4700:10:... 2606:4700:10::6816:1066	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:81c::200a	15169 (GOOGLE) (GOOGLE)
5	2a00:1450:400... 2a00:1450:4001:830::2003	15169 (GOOGLE) (GOOGLE)
36	3

30 2606:4700:10::6816:1066 (United States)

ASN13335 (CLOUDFLARENET, US)

offsec.almond.consulting	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
almond.consulting	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81c::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:830::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
30	almond.consulting offsec.almond.consulting almond.consulting	967 KB
5	gstatic.com fonts.gstatic.com	40 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 48	1 KB
36	3

	Domain	Requested by
26	offsec.almond.consulting	offsec.almond.consulting
5	fonts.gstatic.com	fonts.googleapis.com
4	almond.consulting	offsec.almond.consulting
1	fonts.googleapis.com	offsec.almond.consulting
36	4

This site contains links to these domains. Also see Links.

Domain
almond.consulting
twitter.com
github.com
3gstudent.github.io
subt0x10.blogspot.fr
seclists.org
gist.github.com
blogs.msdn.microsoft.com
tyranidslair.blogspot.fr
enigma0x3.net
www.slideshare.net
www.youtube.com
www.kernelmode.info
www.linkedin.com

Subject Issuer	Validity	Valid
almond.consulting Cloudflare Inc ECC CA-3	`2023-10-29` - `2024-10-28`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2024-01-29` - `2024-04-22`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2024-01-29` - `2024-04-22`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://offsec.almond.consulting/UAC-bypass-dotnet.html
Frame ID: DC269838CB21F0FCF4155B4DB40048A5
Requests: 36 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

UAC bypass via elevated .NET applications - Almond Offensive Security Blog

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

/wp-(?:content|includes)/

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Pygments (Miscellaneous) Expand

Overall confidence: 100%
Detected patterns

<link[^>]+pygments\.css["']

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jQuery Migrate (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?

Page Statistics

36
Requests

100 %
HTTPS

100 %
IPv6

3
Domains

4
Subdomains

3
IPs

2
Countries

1009 kB
Transfer

1764 kB
Size

0
Cookies

33 Outgoing links

These are links going to different origins than the main page.

URL: https://almond.consulting/
Title: Almond

Search URL Search Domain Scan URL

URL: https://almond.consulting/en/your-career-with-us/#joboffers
Title: We're hiring

Search URL Search Domain Scan URL

URL: https://twitter.com/djhohnstein
Title: @djhohnstein

Search URL Search Domain Scan URL

URL: https://github.com/djhohnstein/.NET-Profiler-DLL-Hijack
Title: C# implementation of this technique

Search URL Search Domain Scan URL

URL: https://twitter.com/3gstudent
Title: @3gstudent

Search URL Search Domain Scan URL

URL: https://3gstudent.github.io/3gstudent.github.io/Use-CLR-to-bypass-UAC/
Title: blog post in chinese

Search URL Search Domain Scan URL

URL: https://twitter.com/subTee/status/864903111952875521
Title: on twitter

Search URL Search Domain Scan URL

URL: http://subt0x10.blogspot.fr/2017/05/subvert-clr-process-listing-with-net.html
Title: on his blog

Search URL Search Domain Scan URL

URL: http://seclists.org/fulldisclosure/2017/Jul/11
Title: on Full Disclosure

Search URL Search Domain Scan URL

URL: https://gist.github.com/clavoillotte/f2fba9fa4ba8db14093a62164963d4a9
Title: Here is a PowerShell PoC

Search URL Search Domain Scan URL

URL: https://blogs.msdn.microsoft.com/cjacks/2008/07/22/per-user-com-registrations-and-elevated-processes-with-uac-on-windows-vista-sp1-part-2-ole-automation/
Title: does prevent CLSID lookups in user registry

Search URL Search Domain Scan URL

URL: https://tyranidslair.blogspot.fr/2017/05/reading-your-way-around-uac-part-1.html
Title: generic one from @tiraniddo

Search URL Search Domain Scan URL

URL: https://github.com/FuzzySecurity/PowerShell-Suite/blob/master/UAC-TokenMagic.ps1
Title: here

Search URL Search Domain Scan URL

URL: https://github.com/enigma0x3/Misc-PowerShell-Stuff/blob/master/Invoke-TokenDuplication.ps1
Title: here

Search URL Search Domain Scan URL

URL: https://twitter.com/enigma0x3
Title: @enigma0x3

Search URL Search Domain Scan URL

URL: https://enigma0x3.net/
Title: research

Search URL Search Domain Scan URL

URL: https://www.slideshare.net/enigma0x3/not-a-security-boundary-bypassing-user-account-control
Title: slides

Search URL Search Domain Scan URL

URL: https://www.youtube.com/watch?v=c8LgqtATAnE
Title: video

Search URL Search Domain Scan URL

URL: https://twitter.com/tiraniddo
Title: @tiraniddo

Search URL Search Domain Scan URL

URL: https://tyranidslair.blogspot.fr/2017/05/exploiting-environment-variables-in.html
Title: the SilentCleanup task

Search URL Search Domain Scan URL

URL: https://tyranidslair.blogspot.fr/2017/05/reading-your-way-around-uac-part-2.html
Title: part 2

Search URL Search Domain Scan URL

URL: https://tyranidslair.blogspot.fr/2017/05/reading-your-way-around-uac-part-3.html
Title: part 3

Search URL Search Domain Scan URL

URL: https://twitter.com/hfiref0x
Title: @hFireF0X

Search URL Search Domain Scan URL

URL: https://github.com/hfiref0x/UACME
Title: UACME project

Search URL Search Domain Scan URL

URL: http://www.kernelmode.info/forum/viewtopic.php?f=11&t=3643
Title: his posts on kernelmode

Search URL Search Domain Scan URL

URL: https://twitter.com/fuzzysec
Title: @FuzzySec

Search URL Search Domain Scan URL

URL: https://github.com/FuzzySecurity/DefCon25
Title: UAC workshop

Search URL Search Domain Scan URL

URL: https://github.com/FuzzySecurity/PowerShell-Suite/tree/master/Bypass-UAC
Title: Bypass-UAC project

Search URL Search Domain Scan URL

URL: https://twitter.com/subTee
Title: @subtee

Search URL Search Domain Scan URL

URL: https://twitter.com/mattifestation/
Title: @mattifestation

Search URL Search Domain Scan URL

URL: https://twitter.com/AlmondOffSec

Search URL Search Domain Scan URL

URL: https://github.com/AlmondOffSec

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/almond-consult/

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

36 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request UAC-bypass-dotnet.html Show response
offsec.almond.consulting/ 93 KB
19 KB 126ms
87ms Document
text/html 2606:4700:10::6816:1066
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://offsec.almond.consulting/UAC-bypass-dotnet.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:1066 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d9b142d4b14def2dc71c9ee1114f872d6a0cab48808017db93fac83e66144450

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; script-src 'self' https://code.jquery.com https://almond.consulting 'unsafe-inline'; connect-src 'self'; img-src 'self'; style-src 'self' https://fonts.googleapis.com 'unsafe-inline'; font-src 'self' https://fonts.googleapis.com https://fonts.gstatic.com; base-uri 'self'; form-action 'self'
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
cf-cache-status: DYNAMIC
cf-ray: 857d49f37f86bc01-FRA
content-encoding: gzip
content-length: 18610
content-security-policy: default-src 'self'; script-src 'self' https://code.jquery.com https://almond.consulting 'unsafe-inline'; connect-src 'self'; img-src 'self'; style-src 'self' https://fonts.googleapis.com 'unsafe-inline'; font-src 'self' https://fonts.googleapis.com https://fonts.gstatic.com; base-uri 'self'; form-action 'self'
content-type: text/html
date: Mon, 19 Feb 2024 08:55:05 GMT
referrer-policy: origin
server: cloudflare
strict-transport-security: max-age=2592000; includeSubDomains
vary: Accept-Encoding
x-content-type-options: nosniff
x-frame-options: DENY
x-xss-protection: 1; mode=block

GET
H2 200 style.css
offsec.almond.consulting/theme/themes/betheme/ 350 B
370 B 67ms
66ms Stylesheet
text/css 2606:4700:10::6816:1066
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://offsec.almond.consulting/theme/themes/betheme/style.css?ver=21.2.5

Requested by

Host: offsec.almond.consulting
URL: https://offsec.almond.consulting/UAC-bypass-dotnet.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:1066 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

bac123fdbc8d79bc866b302f8f217a25b2d9ddc6d860003ff30f44c0a086afce

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; script-src 'self' https://code.jquery.com https://almond.consulting 'unsafe-inline'; connect-src 'self'; img-src 'self'; style-src 'self' https://fonts.googleapis.com 'unsafe-inline'; font-src 'self' https://fonts.googleapis.com https://fonts.gstatic.com; base-uri 'self'; form-action 'self'
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offsec.almond.consulting/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Mon, 19 Feb 2024 08:55:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=2592000; includeSubDomains
cf-cache-status: REVALIDATED
content-security-policy: default-src 'self'; script-src 'self' https://code.jquery.com https://almond.consulting 'unsafe-inline'; connect-src 'self'; img-src 'self'; style-src 'self' https://fonts.googleapis.com 'unsafe-inline'; font-src 'self' https://fonts.googleapis.com https://fonts.gstatic.com; base-uri 'self'; form-action 'self'
content-length: 229
x-xss-protection: 1; mode=block
referrer-policy: origin
last-modified: Wed, 16 Feb 2022 10:11:50 GMT
server: cloudflare
vary: Accept-Encoding
x-frame-options: DENY
content-type: text/css
cache-control: max-age=1800
accept-ranges: bytes
cf-ray: 857d49f40846bc01-FRA
expires: Mon, 19 Feb 2024 09:10:05 GMT

GET
H2 200 base.css
offsec.almond.consulting/theme/themes/betheme/css/ 55 KB
12 KB 69ms
67ms Stylesheet
text/css 2606:4700:10::6816:1066
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://offsec.almond.consulting/theme/themes/betheme/css/base.css?ver=21.2.5

Requested by

Host: offsec.almond.consulting
URL: https://offsec.almond.consulting/UAC-bypass-dotnet.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:1066 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8fe175a97cf451f790fba8f1595fa34b14acc337689568afa1b73171098e6bc0

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; script-src 'self' https://code.jquery.com https://almond.consulting 'unsafe-inline'; connect-src 'self'; img-src 'self'; style-src 'self' https://fonts.googleapis.com 'unsafe-inline'; font-src 'self' https://fonts.googleapis.com https://fonts.gstatic.com; base-uri 'self'; form-action 'self'
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offsec.almond.consulting/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Mon, 19 Feb 2024 08:55:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=2592000; includeSubDomains
cf-cache-status: REVALIDATED
content-security-policy: default-src 'self'; script-src 'self' https://code.jquery.com https://almond.consulting 'unsafe-inline'; connect-src 'self'; img-src 'self'; style-src 'self' https://fonts.googleapis.com 'unsafe-inline'; font-src 'self' https://fonts.googleapis.com https://fonts.gstatic.com; base-uri 'self'; form-action 'self'
content-length: 12289
x-xss-protection: 1; mode=block
referrer-policy: origin
last-modified: Tue, 31 Oct 2023 10:31:01 GMT
server: cloudflare
vary: Accept-Encoding
x-frame-options: DENY
content-type: text/css
cache-control: max-age=1800
accept-ranges: bytes
cf-ray: 857d49f40847bc01-FRA
expires: Mon, 19 Feb 2024 09:10:05 GMT

GET
H2 200 layout.css
offsec.almond.consulting/theme/themes/betheme/css/ 115 KB
20 KB 71ms
69ms Stylesheet
text/css 2606:4700:10::6816:1066
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://offsec.almond.consulting/theme/themes/betheme/css/layout.css?ver=21.2.5

Requested by

Host: offsec.almond.consulting
URL: https://offsec.almond.consulting/UAC-bypass-dotnet.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:1066 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

12171110937515802d6cad82a5ccd5533cdc768140465ffc8b674b7f6625ac87

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; script-src 'self' https://code.jquery.com https://almond.consulting 'unsafe-inline'; connect-src 'self'; img-src 'self'; style-src 'self' https://fonts.googleapis.com 'unsafe-inline'; font-src 'self' https://fonts.googleapis.com https://fonts.gstatic.com; base-uri 'self'; form-action 'self'
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offsec.almond.consulting/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Mon, 19 Feb 2024 08:55:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=2592000; includeSubDomains
cf-cache-status: REVALIDATED
content-security-policy: default-src 'self'; script-src 'self' https://code.jquery.com https://almond.consulting 'unsafe-inline'; connect-src 'self'; img-src 'self'; style-src 'self' https://fonts.googleapis.com 'unsafe-inline'; font-src 'self' https://fonts.googleapis.com https://fonts.gstatic.com; base-uri 'self'; form-action 'self'
content-length: 19915
x-xss-protection: 1; mode=block
referrer-policy: origin
last-modified: Wed, 16 Feb 2022 10:11:50 GMT
server: cloudflare
vary: Accept-Encoding
x-frame-options: DENY
content-type: text/css
cache-control: max-age=1800
accept-ranges: bytes
cf-ray: 857d49f40849bc01-FRA
expires: Mon, 19 Feb 2024 09:10:05 GMT

GET
H2 200 shortcodes.css
offsec.almond.consulting/theme/themes/betheme/css/ 134 KB
22 KB 70ms
69ms Stylesheet
text/css 2606:4700:10::6816:1066
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://offsec.almond.consulting/theme/themes/betheme/css/shortcodes.css?ver=21.2.5

Requested by

Host: offsec.almond.consulting
URL: https://offsec.almond.consulting/UAC-bypass-dotnet.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:1066 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a35e34d7ec8cfd9fb1acc84fe91341809d276bcd1533f60cb369e86c129553cf

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; script-src 'self' https://code.jquery.com https://almond.consulting 'unsafe-inline'; connect-src 'self'; img-src 'self'; style-src 'self' https://fonts.googleapis.com 'unsafe-inline'; font-src 'self' https://fonts.googleapis.com https://fonts.gstatic.com; base-uri 'self'; form-action 'self'
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offsec.almond.consulting/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Mon, 19 Feb 2024 08:55:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=2592000; includeSubDomains
cf-cache-status: REVALIDATED
content-security-policy: default-src 'self'; script-src 'self' https://code.jquery.com https://almond.consulting 'unsafe-inline'; connect-src 'self'; img-src 'self'; style-src 'self' https://fonts.googleapis.com 'unsafe-inline'; font-src 'self' https://fonts.googleapis.com https://fonts.gstatic.com; base-uri 'self'; form-action 'self'
content-length: 22367
x-xss-protection: 1; mode=block
referrer-policy: origin
last-modified: Wed, 16 Feb 2022 10:11:50 GMT
server: cloudflare
vary: Accept-Encoding
x-frame-options: DENY
content-type: text/css
cache-control: max-age=1800
accept-ranges: bytes
cf-ray: 857d49f4084abc01-FRA
expires: Mon, 19 Feb 2024 09:10:05 GMT

GET
H2 200 animations.min.css
offsec.almond.consulting/theme/themes/betheme/assets/animations/ 57 KB
5 KB 68ms
67ms Stylesheet
text/css 2606:4700:10::6816:1066
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://offsec.almond.consulting/theme/themes/betheme/assets/animations/animations.min.css?ver=21.2.5

Requested by

Host: offsec.almond.consulting
URL: https://offsec.almond.consulting/UAC-bypass-dotnet.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:1066 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e803d4290c5baec790ecde06d9308c6bf17f967c8232e3651844bfd60dd2a9f5

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; script-src 'self' https://code.jquery.com https://almond.consulting 'unsafe-inline'; connect-src 'self'; img-src 'self'; style-src 'self' https://fonts.googleapis.com 'unsafe-inline'; font-src 'self' https://fonts.googleapis.com https://fonts.gstatic.com; base-uri 'self'; form-action 'self'
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offsec.almond.consulting/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Mon, 19 Feb 2024 08:55:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=2592000; includeSubDomains
cf-cache-status: REVALIDATED
content-security-policy: default-src 'self'; script-src 'self' https://code.jquery.com https://almond.consulting 'unsafe-inline'; connect-src 'self'; img-src 'self'; style-src 'self' https://fonts.googleapis.com 'unsafe-inline'; font-src 'self' https://fonts.googleapis.com https://fonts.gstatic.com; base-uri 'self'; form-action 'self'
content-length: 5418
x-xss-protection: 1; mode=block
referrer-policy: origin
last-modified: Wed, 16 Feb 2022 10:11:50 GMT
server: cloudflare
vary: Accept-Encoding
x-frame-options: DENY
content-type: text/css
cache-control: max-age=1800
accept-ranges: bytes
cf-ray: 857d49f4084bbc01-FRA
expires: Mon, 19 Feb 2024 09:10:05 GMT

GET
H2 200 jplayer.blue.monday.css
offsec.almond.consulting/theme/themes/betheme/assets/jplayer/css/ 10 KB
2 KB 74ms
73ms Stylesheet
text/css 2606:4700:10::6816:1066
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://offsec.almond.consulting/theme/themes/betheme/assets/jplayer/css/jplayer.blue.monday.css?ver=21.2.5

Requested by

Host: offsec.almond.consulting
URL: https://offsec.almond.consulting/UAC-bypass-dotnet.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:1066 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

593998021e5710fcc6797244da4006389ea8a5c15dc3ce7a661685cb36638844

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; script-src 'self' https://code.jquery.com https://almond.consulting 'unsafe-inline'; connect-src 'self'; img-src 'self'; style-src 'self' https://fonts.googleapis.com 'unsafe-inline'; font-src 'self' https://fonts.googleapis.com https://fonts.gstatic.com; base-uri 'self'; form-action 'self'
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offsec.almond.consulting/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Mon, 19 Feb 2024 08:55:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=2592000; includeSubDomains
cf-cache-status: REVALIDATED
content-security-policy: default-src 'self'; script-src 'self' https://code.jquery.com https://almond.consulting 'unsafe-inline'; connect-src 'self'; img-src 'self'; style-src 'self' https://fonts.googleapis.com 'unsafe-inline'; font-src 'self' https://fonts.googleapis.com https://fonts.gstatic.com; base-uri 'self'; form-action 'self'
content-length: 2087
x-xss-protection: 1; mode=block
referrer-policy: origin
last-modified: Wed, 16 Feb 2022 10:11:50 GMT
server: cloudflare
vary: Accept-Encoding
x-frame-options: DENY
content-type: text/css
cache-control: max-age=1800
accept-ranges: bytes
cf-ray: 857d49f4084cbc01-FRA
expires: Mon, 19 Feb 2024 09:10:05 GMT

GET
H2 200 responsive.css
offsec.almond.consulting/theme/themes/betheme/css/ 55 KB
10 KB 69ms
68ms Stylesheet
text/css 2606:4700:10::6816:1066
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://offsec.almond.consulting/theme/themes/betheme/css/responsive.css?ver=21.2.5

Requested by

Host: offsec.almond.consulting
URL: https://offsec.almond.consulting/UAC-bypass-dotnet.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:1066 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

46a9b5d2ada3e977bf001f2df44e39da0eadd55d116a72d4c9329f0dad62e7aa

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; script-src 'self' https://code.jquery.com https://almond.consulting 'unsafe-inline'; connect-src 'self'; img-src 'self'; style-src 'self' https://fonts.googleapis.com 'unsafe-inline'; font-src 'self' https://fonts.googleapis.com https://fonts.gstatic.com; base-uri 'self'; form-action 'self'
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offsec.almond.consulting/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Mon, 19 Feb 2024 08:55:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=2592000; includeSubDomains
cf-cache-status: REVALIDATED
content-security-policy: default-src 'self'; script-src 'self' https://code.jquery.com https://almond.consulting 'unsafe-inline'; connect-src 'self'; img-src 'self'; style-src 'self' https://fonts.googleapis.com 'unsafe-inline'; font-src 'self' https://fonts.googleapis.com https://fonts.gstatic.com; base-uri 'self'; form-action 'self'
content-length: 10076
x-xss-protection: 1; mode=block
referrer-policy: origin
last-modified: Wed, 16 Feb 2022 10:11:50 GMT
server: cloudflare
vary: Accept-Encoding
x-frame-options: DENY
content-type: text/css
cache-control: max-age=1800
accept-ranges: bytes
cf-ray: 857d49f4084dbc01-FRA
expires: Mon, 19 Feb 2024 09:10:05 GMT

GET
H2 200 css
fonts.googleapis.com/ 7 KB
1 KB 122ms
17ms Stylesheet
text/css 2a00:1450:4001:81c::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Poppins%3A1%2C300%2C400%2C400italic%2C500%2C600%2C700%2C700italic&ver=5.2.3

Requested by

Host: offsec.almond.consulting
URL: https://offsec.almond.consulting/UAC-bypass-dotnet.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

878cd7d441dcbe1129a995e463b647b1b2d71b2bfec194f6a4cf13d8292b8b8e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offsec.almond.consulting/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Mon, 19 Feb 2024 08:55:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Mon, 19 Feb 2024 08:55:05 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 19 Feb 2024 08:55:05 GMT

GET
H2 200 pygments.css
offsec.almond.consulting/theme/css/ 3 KB
468 B 75ms
75ms Stylesheet
text/css 2606:4700:10::6816:1066
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://offsec.almond.consulting/theme/css/pygments.css

Requested by

Host: offsec.almond.consulting
URL: https://offsec.almond.consulting/UAC-bypass-dotnet.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:1066 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5127e3a9305391b65d9c17cba01a9f7cfb58a571bf7b0c7714b27b74ce2badb9

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; script-src 'self' https://code.jquery.com https://almond.consulting 'unsafe-inline'; connect-src 'self'; img-src 'self'; style-src 'self' https://fonts.googleapis.com 'unsafe-inline'; font-src 'self' https://fonts.googleapis.com https://fonts.gstatic.com; base-uri 'self'; form-action 'self'
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offsec.almond.consulting/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Mon, 19 Feb 2024 08:55:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=2592000; includeSubDomains
cf-cache-status: REVALIDATED
content-security-policy: default-src 'self'; script-src 'self' https://code.jquery.com https://almond.consulting 'unsafe-inline'; connect-src 'self'; img-src 'self'; style-src 'self' https://fonts.googleapis.com 'unsafe-inline'; font-src 'self' https://fonts.googleapis.com https://fonts.gstatic.com; base-uri 'self'; form-action 'self'
content-length: 402
x-xss-protection: 1; mode=block
referrer-policy: origin
last-modified: Wed, 16 Feb 2022 10:11:50 GMT
server: cloudflare
vary: Accept-Encoding
x-frame-options: DENY
content-type: text/css
cache-control: max-age=1800
accept-ranges: bytes
cf-ray: 857d49f4084ebc01-FRA
expires: Mon, 19 Feb 2024 09:10:05 GMT

GET
H2 200 jquery.min.js Show response
almond.consulting/wp-includes/js/jquery/ 86 KB
30 KB 91ms
25ms Script
application/javascript 2606:4700:10::6816:1066
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://almond.consulting/wp-includes/js/jquery/jquery.min.js

Requested by

Host: offsec.almond.consulting
URL: https://offsec.almond.consulting/UAC-bypass-dotnet.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:1066 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cb6f2d32c49d1c2b25e9ffc9aaafa3f83075346c01bcd4ae6eb187392a4292cf

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offsec.almond.consulting/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Mon, 19 Feb 2024 08:55:05 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
age: 70617
x-xss-protection: 1
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 28 Aug 2023 17:14:23 GMT
server: cloudflare
etag: W/"64ecd5ef-15601"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), web-share=(), xr-spatial-tracking=()
cf-ray: 857d49f478b0bc01-FRA

GET
H2 200 jquery-migrate.min.js Show response
almond.consulting/wp-includes/js/jquery/ 13 KB
5 KB 89ms
23ms Script
application/javascript 2606:4700:10::6816:1066
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://almond.consulting/wp-includes/js/jquery/jquery-migrate.min.js

Requested by

Host: offsec.almond.consulting
URL: https://offsec.almond.consulting/UAC-bypass-dotnet.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:1066 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5274f11e6fb32ae0cf2dfb9f8043272865c397a7c4223b4cfa7d50ea52fbde89

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offsec.almond.consulting/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Mon, 19 Feb 2024 08:55:05 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
age: 70617
x-xss-protection: 1
referrer-policy: strict-origin-when-cross-origin
last-modified: Fri, 09 Jun 2023 05:49:24 GMT
server: cloudflare
etag: W/"6482bd64-3509"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), web-share=(), xr-spatial-tracking=()
cf-ray: 857d49f478aebc01-FRA

GET
H2 200 Almond-logo-noir.png
offsec.almond.consulting/theme/ 6 KB
6 KB 75ms
74ms Image
image/png 2606:4700:10::6816:1066
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://offsec.almond.consulting/theme/Almond-logo-noir.png

Requested by

Host: offsec.almond.consulting
URL: https://offsec.almond.consulting/UAC-bypass-dotnet.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:1066 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2d2309b81c3747a0e254469949da9945ef766e0dd85a55df72089d382efdec09

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; script-src 'self' https://code.jquery.com https://almond.consulting 'unsafe-inline'; connect-src 'self'; img-src 'self'; style-src 'self' https://fonts.googleapis.com 'unsafe-inline'; font-src 'self' https://fonts.googleapis.com https://fonts.gstatic.com; base-uri 'self'; form-action 'self'
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offsec.almond.consulting/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Mon, 19 Feb 2024 08:55:05 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
content-security-policy: default-src 'self'; script-src 'self' https://code.jquery.com https://almond.consulting 'unsafe-inline'; connect-src 'self'; img-src 'self'; style-src 'self' https://fonts.googleapis.com 'unsafe-inline'; font-src 'self' https://fonts.googleapis.com https://fonts.gstatic.com; base-uri 'self'; form-action 'self'
cf-cache-status: REVALIDATED
content-length: 5940
x-xss-protection: 1; mode=block
referrer-policy: origin
last-modified: Wed, 16 Feb 2022 10:11:50 GMT
server: cloudflare
x-frame-options: DENY
vary: Accept-Encoding
content-type: image/png
cache-control: max-age=1800
accept-ranges: bytes
cf-ray: 857d49f40851bc01-FRA
expires: Mon, 19 Feb 2024 09:10:05 GMT

GET
H2 200 UAC-bypass-dotnet-01.png
offsec.almond.consulting/images/UAC-bypass-dotnet/ 122 KB
122 KB 90ms
89ms Image
image/png 2606:4700:10::6816:1066
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://offsec.almond.consulting/images/UAC-bypass-dotnet/UAC-bypass-dotnet-01.png

Requested by

Host: offsec.almond.consulting
URL: https://offsec.almond.consulting/UAC-bypass-dotnet.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:1066 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5907fdc184c85731a8010d2a98619d1c8c7a40585a12f6bcc2bf03b95c4294cf

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; script-src 'self' https://code.jquery.com https://almond.consulting 'unsafe-inline'; connect-src 'self'; img-src 'self'; style-src 'self' https://fonts.googleapis.com 'unsafe-inline'; font-src 'self' https://fonts.googleapis.com https://fonts.gstatic.com; base-uri 'self'; form-action 'self'
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offsec.almond.consulting/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Mon, 19 Feb 2024 08:55:05 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
content-security-policy: default-src 'self'; script-src 'self' https://code.jquery.com https://almond.consulting 'unsafe-inline'; connect-src 'self'; img-src 'self'; style-src 'self' https://fonts.googleapis.com 'unsafe-inline'; font-src 'self' https://fonts.googleapis.com https://fonts.gstatic.com; base-uri 'self'; form-action 'self'
cf-cache-status: MISS
content-length: 124590
x-xss-protection: 1; mode=block
referrer-policy: origin
last-modified: Wed, 16 Feb 2022 10:11:50 GMT
server: cloudflare
x-frame-options: DENY
vary: Accept-Encoding
content-type: image/png
cache-control: max-age=1800
accept-ranges: bytes
cf-ray: 857d49f40852bc01-FRA
expires: Mon, 19 Feb 2024 09:10:05 GMT

GET
H2 200 UAC-bypass-dotnet-02.png
offsec.almond.consulting/images/UAC-bypass-dotnet/ 88 KB
88 KB 87ms
86ms Image
image/png 2606:4700:10::6816:1066
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://offsec.almond.consulting/images/UAC-bypass-dotnet/UAC-bypass-dotnet-02.png

Requested by

Host: offsec.almond.consulting
URL: https://offsec.almond.consulting/UAC-bypass-dotnet.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:1066 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

76ecab113025d0f02cf406f0c081ff00b04143fd4a57a290536e666569c5dac8

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; script-src 'self' https://code.jquery.com https://almond.consulting 'unsafe-inline'; connect-src 'self'; img-src 'self'; style-src 'self' https://fonts.googleapis.com 'unsafe-inline'; font-src 'self' https://fonts.googleapis.com https://fonts.gstatic.com; base-uri 'self'; form-action 'self'
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offsec.almond.consulting/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Mon, 19 Feb 2024 08:55:05 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
content-security-policy: default-src 'self'; script-src 'self' https://code.jquery.com https://almond.consulting 'unsafe-inline'; connect-src 'self'; img-src 'self'; style-src 'self' https://fonts.googleapis.com 'unsafe-inline'; font-src 'self' https://fonts.googleapis.com https://fonts.gstatic.com; base-uri 'self'; form-action 'self'
cf-cache-status: MISS
content-length: 90265
x-xss-protection: 1; mode=block
referrer-policy: origin
last-modified: Wed, 16 Feb 2022 10:11:50 GMT
server: cloudflare
x-frame-options: DENY
vary: Accept-Encoding
content-type: image/png
cache-control: max-age=1800
accept-ranges: bytes
cf-ray: 857d49f4e967bc01-FRA
expires: Mon, 19 Feb 2024 09:10:05 GMT

GET
H2 200 UAC-bypass-dotnet-03.png
offsec.almond.consulting/images/UAC-bypass-dotnet/ 154 KB
155 KB 99ms
99ms Image
image/png 2606:4700:10::6816:1066
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://offsec.almond.consulting/images/UAC-bypass-dotnet/UAC-bypass-dotnet-03.png

Requested by

Host: offsec.almond.consulting
URL: https://offsec.almond.consulting/UAC-bypass-dotnet.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:1066 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cbf5979ea763eb93ca0ccf053444b2ca813618354048727e8952e3d894830a33

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; script-src 'self' https://code.jquery.com https://almond.consulting 'unsafe-inline'; connect-src 'self'; img-src 'self'; style-src 'self' https://fonts.googleapis.com 'unsafe-inline'; font-src 'self' https://fonts.googleapis.com https://fonts.gstatic.com; base-uri 'self'; form-action 'self'
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offsec.almond.consulting/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Mon, 19 Feb 2024 08:55:05 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
content-security-policy: default-src 'self'; script-src 'self' https://code.jquery.com https://almond.consulting 'unsafe-inline'; connect-src 'self'; img-src 'self'; style-src 'self' https://fonts.googleapis.com 'unsafe-inline'; font-src 'self' https://fonts.googleapis.com https://fonts.gstatic.com; base-uri 'self'; form-action 'self'
cf-cache-status: MISS
content-length: 158052
x-xss-protection: 1; mode=block
referrer-policy: origin
last-modified: Wed, 16 Feb 2022 10:11:50 GMT
server: cloudflare
x-frame-options: DENY
vary: Accept-Encoding
content-type: image/png
cache-control: max-age=1800
accept-ranges: bytes
cf-ray: 857d49f4e969bc01-FRA
expires: Mon, 19 Feb 2024 09:10:05 GMT

GET
H2 200 UAC-bypass-dotnet-04.png
offsec.almond.consulting/images/UAC-bypass-dotnet/ 31 KB
31 KB 68ms
67ms Image
image/png 2606:4700:10::6816:1066
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://offsec.almond.consulting/images/UAC-bypass-dotnet/UAC-bypass-dotnet-04.png

Requested by

Host: offsec.almond.consulting
URL: https://offsec.almond.consulting/UAC-bypass-dotnet.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:1066 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8731f42d334f033b7742ca1a692741a9841d1cb929311cd3add8c11133aa9899

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; script-src 'self' https://code.jquery.com https://almond.consulting 'unsafe-inline'; connect-src 'self'; img-src 'self'; style-src 'self' https://fonts.googleapis.com 'unsafe-inline'; font-src 'self' https://fonts.googleapis.com https://fonts.gstatic.com; base-uri 'self'; form-action 'self'
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offsec.almond.consulting/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Mon, 19 Feb 2024 08:55:05 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
content-security-policy: default-src 'self'; script-src 'self' https://code.jquery.com https://almond.consulting 'unsafe-inline'; connect-src 'self'; img-src 'self'; style-src 'self' https://fonts.googleapis.com 'unsafe-inline'; font-src 'self' https://fonts.googleapis.com https://fonts.gstatic.com; base-uri 'self'; form-action 'self'
cf-cache-status: REVALIDATED
content-length: 32014
x-xss-protection: 1; mode=block
referrer-policy: origin
last-modified: Wed, 16 Feb 2022 10:11:50 GMT
server: cloudflare
x-frame-options: DENY
vary: Accept-Encoding
content-type: image/png
cache-control: max-age=1800
accept-ranges: bytes
cf-ray: 857d49f4e96bbc01-FRA
expires: Mon, 19 Feb 2024 09:10:05 GMT

GET
H2 200 UAC-bypass-dotnet-05.png
offsec.almond.consulting/images/UAC-bypass-dotnet/ 50 KB
50 KB 102ms
101ms Image
image/png 2606:4700:10::6816:1066
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://offsec.almond.consulting/images/UAC-bypass-dotnet/UAC-bypass-dotnet-05.png

Requested by

Host: offsec.almond.consulting
URL: https://offsec.almond.consulting/UAC-bypass-dotnet.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:1066 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

36dfa35cb6fad6790a77a18e1cb4a6a92aef12380be2b5e55ce5e7576960c0ba

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; script-src 'self' https://code.jquery.com https://almond.consulting 'unsafe-inline'; connect-src 'self'; img-src 'self'; style-src 'self' https://fonts.googleapis.com 'unsafe-inline'; font-src 'self' https://fonts.googleapis.com https://fonts.gstatic.com; base-uri 'self'; form-action 'self'
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offsec.almond.consulting/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Mon, 19 Feb 2024 08:55:05 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
content-security-policy: default-src 'self'; script-src 'self' https://code.jquery.com https://almond.consulting 'unsafe-inline'; connect-src 'self'; img-src 'self'; style-src 'self' https://fonts.googleapis.com 'unsafe-inline'; font-src 'self' https://fonts.googleapis.com https://fonts.gstatic.com; base-uri 'self'; form-action 'self'
cf-cache-status: MISS
content-length: 51074
x-xss-protection: 1; mode=block
referrer-policy: origin
last-modified: Wed, 16 Feb 2022 10:11:50 GMT
server: cloudflare
x-frame-options: DENY
vary: Accept-Encoding
content-type: image/png
cache-control: max-age=1800
accept-ranges: bytes
cf-ray: 857d49f4e96cbc01-FRA
expires: Mon, 19 Feb 2024 09:10:05 GMT

GET
H2 200 UAC-bypass-dotnet-06.png
offsec.almond.consulting/images/UAC-bypass-dotnet/ 156 KB
156 KB 133ms
132ms Image
image/png 2606:4700:10::6816:1066
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://offsec.almond.consulting/images/UAC-bypass-dotnet/UAC-bypass-dotnet-06.png

Requested by

Host: offsec.almond.consulting
URL: https://offsec.almond.consulting/UAC-bypass-dotnet.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:1066 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

177956654dd261354dc903a072d3fd887b26e5a84c3cac6ce20fde97df009afa

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; script-src 'self' https://code.jquery.com https://almond.consulting 'unsafe-inline'; connect-src 'self'; img-src 'self'; style-src 'self' https://fonts.googleapis.com 'unsafe-inline'; font-src 'self' https://fonts.googleapis.com https://fonts.gstatic.com; base-uri 'self'; form-action 'self'
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offsec.almond.consulting/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Mon, 19 Feb 2024 08:55:05 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
content-security-policy: default-src 'self'; script-src 'self' https://code.jquery.com https://almond.consulting 'unsafe-inline'; connect-src 'self'; img-src 'self'; style-src 'self' https://fonts.googleapis.com 'unsafe-inline'; font-src 'self' https://fonts.googleapis.com https://fonts.gstatic.com; base-uri 'self'; form-action 'self'
cf-cache-status: MISS
content-length: 159470
x-xss-protection: 1; mode=block
referrer-policy: origin
last-modified: Wed, 16 Feb 2022 10:11:50 GMT
server: cloudflare
x-frame-options: DENY
vary: Accept-Encoding
content-type: image/png
cache-control: max-age=1800
accept-ranges: bytes
cf-ray: 857d49f4e96ebc01-FRA
expires: Mon, 19 Feb 2024 09:10:05 GMT

GET
H2 200 UAC-bypass-dotnet-07.png
offsec.almond.consulting/images/UAC-bypass-dotnet/ 13 KB
13 KB 90ms
90ms Image
image/png 2606:4700:10::6816:1066
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://offsec.almond.consulting/images/UAC-bypass-dotnet/UAC-bypass-dotnet-07.png

Requested by

Host: offsec.almond.consulting
URL: https://offsec.almond.consulting/UAC-bypass-dotnet.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:1066 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0533038fb8d1924efbcf9ded30df7aa500b79ce5542d401fb098aacb74e99785

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; script-src 'self' https://code.jquery.com https://almond.consulting 'unsafe-inline'; connect-src 'self'; img-src 'self'; style-src 'self' https://fonts.googleapis.com 'unsafe-inline'; font-src 'self' https://fonts.googleapis.com https://fonts.gstatic.com; base-uri 'self'; form-action 'self'
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offsec.almond.consulting/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Mon, 19 Feb 2024 08:55:05 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
content-security-policy: default-src 'self'; script-src 'self' https://code.jquery.com https://almond.consulting 'unsafe-inline'; connect-src 'self'; img-src 'self'; style-src 'self' https://fonts.googleapis.com 'unsafe-inline'; font-src 'self' https://fonts.googleapis.com https://fonts.gstatic.com; base-uri 'self'; form-action 'self'
cf-cache-status: MISS
content-length: 12845
x-xss-protection: 1; mode=block
referrer-policy: origin
last-modified: Wed, 16 Feb 2022 10:11:50 GMT
server: cloudflare
x-frame-options: DENY
vary: Accept-Encoding
content-type: image/png
cache-control: max-age=1800
accept-ranges: bytes
cf-ray: 857d49f4e96fbc01-FRA
expires: Mon, 19 Feb 2024 09:10:05 GMT

GET
H2 200 UAC-bypass-dotnet-08.png
offsec.almond.consulting/images/UAC-bypass-dotnet/ 29 KB
30 KB 95ms
94ms Image
image/png 2606:4700:10::6816:1066
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://offsec.almond.consulting/images/UAC-bypass-dotnet/UAC-bypass-dotnet-08.png

Requested by

Host: offsec.almond.consulting
URL: https://offsec.almond.consulting/UAC-bypass-dotnet.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:1066 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

40778e66c19b99484bf187727e854059730a96961f6a93fe61234cab945f678d

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; script-src 'self' https://code.jquery.com https://almond.consulting 'unsafe-inline'; connect-src 'self'; img-src 'self'; style-src 'self' https://fonts.googleapis.com 'unsafe-inline'; font-src 'self' https://fonts.googleapis.com https://fonts.gstatic.com; base-uri 'self'; form-action 'self'
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offsec.almond.consulting/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Mon, 19 Feb 2024 08:55:05 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
content-security-policy: default-src 'self'; script-src 'self' https://code.jquery.com https://almond.consulting 'unsafe-inline'; connect-src 'self'; img-src 'self'; style-src 'self' https://fonts.googleapis.com 'unsafe-inline'; font-src 'self' https://fonts.googleapis.com https://fonts.gstatic.com; base-uri 'self'; form-action 'self'
cf-cache-status: MISS
content-length: 30140
x-xss-protection: 1; mode=block
referrer-policy: origin
last-modified: Wed, 16 Feb 2022 10:11:50 GMT
server: cloudflare
x-frame-options: DENY
vary: Accept-Encoding
content-type: image/png
cache-control: max-age=1800
accept-ranges: bytes
cf-ray: 857d49f4e970bc01-FRA
expires: Mon, 19 Feb 2024 09:10:05 GMT

GET
H2 200 UAC-bypass-dotnet-09.png
offsec.almond.consulting/images/UAC-bypass-dotnet/ 19 KB
19 KB 79ms
79ms Image
image/png 2606:4700:10::6816:1066
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://offsec.almond.consulting/images/UAC-bypass-dotnet/UAC-bypass-dotnet-09.png

Requested by

Host: offsec.almond.consulting
URL: https://offsec.almond.consulting/UAC-bypass-dotnet.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:1066 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8fad9806a28a3dc43a2b38390cd45b8374e8e19a2f3275a0ab8ccfb066a2c5a1

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; script-src 'self' https://code.jquery.com https://almond.consulting 'unsafe-inline'; connect-src 'self'; img-src 'self'; style-src 'self' https://fonts.googleapis.com 'unsafe-inline'; font-src 'self' https://fonts.googleapis.com https://fonts.gstatic.com; base-uri 'self'; form-action 'self'
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offsec.almond.consulting/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Mon, 19 Feb 2024 08:55:05 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
content-security-policy: default-src 'self'; script-src 'self' https://code.jquery.com https://almond.consulting 'unsafe-inline'; connect-src 'self'; img-src 'self'; style-src 'self' https://fonts.googleapis.com 'unsafe-inline'; font-src 'self' https://fonts.googleapis.com https://fonts.gstatic.com; base-uri 'self'; form-action 'self'
cf-cache-status: MISS
content-length: 19366
x-xss-protection: 1; mode=block
referrer-policy: origin
last-modified: Wed, 16 Feb 2022 10:11:50 GMT
server: cloudflare
x-frame-options: DENY
vary: Accept-Encoding
content-type: image/png
cache-control: max-age=1800
accept-ranges: bytes
cf-ray: 857d49f4e971bc01-FRA
expires: Mon, 19 Feb 2024 09:10:05 GMT

GET
H2 200 core.min.js Show response
almond.consulting/wp-includes/js/jquery/ui/ 21 KB
7 KB 23ms
23ms Script
application/javascript 2606:4700:10::6816:1066
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://almond.consulting/wp-includes/js/jquery/ui/core.min.js

Requested by

Host: offsec.almond.consulting
URL: https://offsec.almond.consulting/UAC-bypass-dotnet.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:1066 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ca7dce2391845e8aec7da135f33fabd10f74eed28a532ac66fd01f761fcfb42f

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offsec.almond.consulting/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Mon, 19 Feb 2024 08:55:05 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
age: 338259
x-xss-protection: 1
referrer-policy: strict-origin-when-cross-origin
last-modified: Thu, 02 Feb 2023 16:36:32 GMT
server: cloudflare
etag: W/"63dbe690-53be"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), web-share=(), xr-spatial-tracking=()
cf-ray: 857d49f488bfbc01-FRA

GET
H2 200 tabs.min.js Show response
almond.consulting/wp-includes/js/jquery/ui/ 12 KB
4 KB 25ms
25ms Script
application/javascript 2606:4700:10::6816:1066
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://almond.consulting/wp-includes/js/jquery/ui/tabs.min.js

Requested by

Host: offsec.almond.consulting
URL: https://offsec.almond.consulting/UAC-bypass-dotnet.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:1066 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6a0d53f68e013dac42a52a5264c5d28a12a06b6bc7cc1d63bc2d385558bd2dd7

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offsec.almond.consulting/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Mon, 19 Feb 2024 08:55:05 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
age: 70617
x-xss-protection: 1
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 19 Sep 2022 18:04:09 GMT
server: cloudflare
etag: W/"6328af19-2ea1"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), web-share=(), xr-spatial-tracking=()
cf-ray: 857d49f4a90bbc01-FRA

GET
H2 200 plugins.js Show response
offsec.almond.consulting/theme/themes/betheme/js/ 190 KB
52 KB 69ms
69ms Script
application/javascript 2606:4700:10::6816:1066
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://offsec.almond.consulting/theme/themes/betheme/js/plugins.js?ver=21.2.5

Requested by

Host: offsec.almond.consulting
URL: https://offsec.almond.consulting/UAC-bypass-dotnet.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:1066 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9fa6485c9703675e0ec1675558e3b9a02bb7b9d862f2680cf546f5656eee2203

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; script-src 'self' https://code.jquery.com https://almond.consulting 'unsafe-inline'; connect-src 'self'; img-src 'self'; style-src 'self' https://fonts.googleapis.com 'unsafe-inline'; font-src 'self' https://fonts.googleapis.com https://fonts.gstatic.com; base-uri 'self'; form-action 'self'
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offsec.almond.consulting/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Mon, 19 Feb 2024 08:55:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=2592000; includeSubDomains
cf-cache-status: REVALIDATED
content-security-policy: default-src 'self'; script-src 'self' https://code.jquery.com https://almond.consulting 'unsafe-inline'; connect-src 'self'; img-src 'self'; style-src 'self' https://fonts.googleapis.com 'unsafe-inline'; font-src 'self' https://fonts.googleapis.com https://fonts.gstatic.com; base-uri 'self'; form-action 'self'
content-length: 53201
x-xss-protection: 1; mode=block
referrer-policy: origin
last-modified: Wed, 16 Feb 2022 10:11:50 GMT
server: cloudflare
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/javascript
cache-control: max-age=1800
accept-ranges: bytes
cf-ray: 857d49f4b921bc01-FRA
expires: Mon, 19 Feb 2024 09:10:05 GMT

GET
H2 200 menu.js Show response
offsec.almond.consulting/theme/themes/betheme/js/ 2 KB
893 B 70ms
68ms Script
application/javascript 2606:4700:10::6816:1066
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://offsec.almond.consulting/theme/themes/betheme/js/menu.js?ver=21.2.5

Requested by

Host: offsec.almond.consulting
URL: https://offsec.almond.consulting/UAC-bypass-dotnet.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:1066 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c22005bbdf738de61a4c2ee99c2b3c4fe52f336dfc8aa274860c58c845027d50

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; script-src 'self' https://code.jquery.com https://almond.consulting 'unsafe-inline'; connect-src 'self'; img-src 'self'; style-src 'self' https://fonts.googleapis.com 'unsafe-inline'; font-src 'self' https://fonts.googleapis.com https://fonts.gstatic.com; base-uri 'self'; form-action 'self'
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offsec.almond.consulting/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Mon, 19 Feb 2024 08:55:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=2592000; includeSubDomains
cf-cache-status: REVALIDATED
content-security-policy: default-src 'self'; script-src 'self' https://code.jquery.com https://almond.consulting 'unsafe-inline'; connect-src 'self'; img-src 'self'; style-src 'self' https://fonts.googleapis.com 'unsafe-inline'; font-src 'self' https://fonts.googleapis.com https://fonts.gstatic.com; base-uri 'self'; form-action 'self'
content-length: 826
x-xss-protection: 1; mode=block
referrer-policy: origin
last-modified: Wed, 16 Feb 2022 10:11:50 GMT
server: cloudflare
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/javascript
cache-control: max-age=1800
accept-ranges: bytes
cf-ray: 857d49f4d960bc01-FRA
expires: Mon, 19 Feb 2024 09:10:05 GMT

GET
H2 200 animations.min.js Show response
offsec.almond.consulting/theme/themes/betheme/assets/animations/ 2 KB
756 B 65ms
64ms Script
application/javascript 2606:4700:10::6816:1066
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://offsec.almond.consulting/theme/themes/betheme/assets/animations/animations.min.js?ver=21.2.5

Requested by

Host: offsec.almond.consulting
URL: https://offsec.almond.consulting/UAC-bypass-dotnet.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:1066 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

602797e80613c3623325594e96463093c626554dff563622e8fbc3e795d283e0

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; script-src 'self' https://code.jquery.com https://almond.consulting 'unsafe-inline'; connect-src 'self'; img-src 'self'; style-src 'self' https://fonts.googleapis.com 'unsafe-inline'; font-src 'self' https://fonts.googleapis.com https://fonts.gstatic.com; base-uri 'self'; form-action 'self'
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offsec.almond.consulting/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Mon, 19 Feb 2024 08:55:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=2592000; includeSubDomains
cf-cache-status: REVALIDATED
content-security-policy: default-src 'self'; script-src 'self' https://code.jquery.com https://almond.consulting 'unsafe-inline'; connect-src 'self'; img-src 'self'; style-src 'self' https://fonts.googleapis.com 'unsafe-inline'; font-src 'self' https://fonts.googleapis.com https://fonts.gstatic.com; base-uri 'self'; form-action 'self'
content-length: 622
x-xss-protection: 1; mode=block
referrer-policy: origin
last-modified: Wed, 16 Feb 2022 10:11:50 GMT
server: cloudflare
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/javascript
cache-control: max-age=1800
accept-ranges: bytes
cf-ray: 857d49f4d962bc01-FRA
expires: Mon, 19 Feb 2024 09:10:05 GMT

GET
H2 200 jplayer.min.js Show response
offsec.almond.consulting/theme/themes/betheme/assets/jplayer/ 51 KB
13 KB 81ms
80ms Script
application/javascript 2606:4700:10::6816:1066
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://offsec.almond.consulting/theme/themes/betheme/assets/jplayer/jplayer.min.js?ver=21.2.5

Requested by

Host: offsec.almond.consulting
URL: https://offsec.almond.consulting/UAC-bypass-dotnet.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:1066 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c36a1d5b71cce2b22a63e9593f75c0170f2620ed7bbad0bc12739accd84d38ce

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; script-src 'self' https://code.jquery.com https://almond.consulting 'unsafe-inline'; connect-src 'self'; img-src 'self'; style-src 'self' https://fonts.googleapis.com 'unsafe-inline'; font-src 'self' https://fonts.googleapis.com https://fonts.gstatic.com; base-uri 'self'; form-action 'self'
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offsec.almond.consulting/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Mon, 19 Feb 2024 08:55:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=2592000; includeSubDomains
cf-cache-status: REVALIDATED
content-security-policy: default-src 'self'; script-src 'self' https://code.jquery.com https://almond.consulting 'unsafe-inline'; connect-src 'self'; img-src 'self'; style-src 'self' https://fonts.googleapis.com 'unsafe-inline'; font-src 'self' https://fonts.googleapis.com https://fonts.gstatic.com; base-uri 'self'; form-action 'self'
content-length: 12713
x-xss-protection: 1; mode=block
referrer-policy: origin
last-modified: Wed, 16 Feb 2022 10:11:50 GMT
server: cloudflare
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/javascript
cache-control: max-age=1800
accept-ranges: bytes
cf-ray: 857d49f4e963bc01-FRA
expires: Mon, 19 Feb 2024 09:10:05 GMT

GET
H2 200 translate3d.js Show response
offsec.almond.consulting/theme/themes/betheme/js/parallax/ 5 KB
2 KB 70ms
69ms Script
application/javascript 2606:4700:10::6816:1066
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://offsec.almond.consulting/theme/themes/betheme/js/parallax/translate3d.js?ver=21.2.5

Requested by

Host: offsec.almond.consulting
URL: https://offsec.almond.consulting/UAC-bypass-dotnet.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:1066 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f25f13e58a8709b8aa0bd7ebaa2d8f17fdfe165c55ccb8b96d862fe8f8caa90f

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; script-src 'self' https://code.jquery.com https://almond.consulting 'unsafe-inline'; connect-src 'self'; img-src 'self'; style-src 'self' https://fonts.googleapis.com 'unsafe-inline'; font-src 'self' https://fonts.googleapis.com https://fonts.gstatic.com; base-uri 'self'; form-action 'self'
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offsec.almond.consulting/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Mon, 19 Feb 2024 08:55:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=2592000; includeSubDomains
cf-cache-status: REVALIDATED
content-security-policy: default-src 'self'; script-src 'self' https://code.jquery.com https://almond.consulting 'unsafe-inline'; connect-src 'self'; img-src 'self'; style-src 'self' https://fonts.googleapis.com 'unsafe-inline'; font-src 'self' https://fonts.googleapis.com https://fonts.gstatic.com; base-uri 'self'; form-action 'self'
content-length: 1499
x-xss-protection: 1; mode=block
referrer-policy: origin
last-modified: Wed, 16 Feb 2022 10:11:50 GMT
server: cloudflare
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/javascript
cache-control: max-age=1800
accept-ranges: bytes
cf-ray: 857d49f4e965bc01-FRA
expires: Mon, 19 Feb 2024 09:10:05 GMT

GET
H2 200 scripts.js Show response
offsec.almond.consulting/theme/themes/betheme/js/ 68 KB
14 KB 71ms
70ms Script
application/javascript 2606:4700:10::6816:1066
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://offsec.almond.consulting/theme/themes/betheme/js/scripts.js?ver=21.2.5

Requested by

Host: offsec.almond.consulting
URL: https://offsec.almond.consulting/UAC-bypass-dotnet.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:1066 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a10293a258541292c522058388a56eb1911d12b4fc66fd11de39d360d6755757

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; script-src 'self' https://code.jquery.com https://almond.consulting 'unsafe-inline'; connect-src 'self'; img-src 'self'; style-src 'self' https://fonts.googleapis.com 'unsafe-inline'; font-src 'self' https://fonts.googleapis.com https://fonts.gstatic.com; base-uri 'self'; form-action 'self'
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://offsec.almond.consulting/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Mon, 19 Feb 2024 08:55:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=2592000; includeSubDomains
cf-cache-status: REVALIDATED
content-security-policy: default-src 'self'; script-src 'self' https://code.jquery.com https://almond.consulting 'unsafe-inline'; connect-src 'self'; img-src 'self'; style-src 'self' https://fonts.googleapis.com 'unsafe-inline'; font-src 'self' https://fonts.googleapis.com https://fonts.gstatic.com; base-uri 'self'; form-action 'self'
content-length: 14180
x-xss-protection: 1; mode=block
referrer-policy: origin
last-modified: Wed, 16 Feb 2022 10:11:50 GMT
server: cloudflare
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/javascript
cache-control: max-age=1800
accept-ranges: bytes
cf-ray: 857d49f4e966bc01-FRA
expires: Mon, 19 Feb 2024 09:10:05 GMT

GET
H2 200 pxiByp8kv8JHgFVrLEj6Z1xlFQ.woff2
fonts.gstatic.com/s/poppins/v20/ 8 KB
8 KB 37ms
15ms Font
font/woff2 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/poppins/v20/pxiByp8kv8JHgFVrLEj6Z1xlFQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Poppins%3A1%2C300%2C400%2C400italic%2C500%2C600%2C700%2C700italic&ver=5.2.3

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f4e80d9dfd374d02989b87a27b5ed4cb78fbb177c27f1478e9a8b0afb7513149

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://offsec.almond.consulting
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Thu, 15 Feb 2024 22:10:19 GMT
x-content-type-options: nosniff
age: 297886
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8000
x-xss-protection: 0
last-modified: Wed, 27 Apr 2022 16:59:07 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 14 Feb 2025 22:10:19 GMT

GET
H2 200 pxiGyp8kv8JHgFVrJJLucHtA.woff2
fonts.gstatic.com/s/poppins/v20/ 8 KB
9 KB 31ms
10ms Font
font/woff2 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/poppins/v20/pxiGyp8kv8JHgFVrJJLucHtA.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Poppins%3A1%2C300%2C400%2C400italic%2C500%2C600%2C700%2C700italic&ver=5.2.3

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

50d0c1742d80ac71f4cde20e8c04d41a24806af342831f479938b527fbff0972

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://offsec.almond.consulting
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 08:56:13 GMT
x-content-type-options: nosniff
age: 518332
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8668
x-xss-protection: 0
last-modified: Wed, 27 Apr 2022 16:07:02 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 12 Feb 2025 08:56:13 GMT

GET
H2 200 pxiByp8kv8JHgFVrLCz7Z1xlFQ.woff2
fonts.gstatic.com/s/poppins/v20/ 8 KB
8 KB 30ms
9ms Font
font/woff2 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/poppins/v20/pxiByp8kv8JHgFVrLCz7Z1xlFQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Poppins%3A1%2C300%2C400%2C400italic%2C500%2C600%2C700%2C700italic&ver=5.2.3

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9338e65fc077355c7a87ae0d64cc101e23b9bf8ad78ae65f0f319c857311b526

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://offsec.almond.consulting
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 14 Feb 2024 03:51:59 GMT
x-content-type-options: nosniff
age: 450186
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7816
x-xss-protection: 0
last-modified: Wed, 27 Apr 2022 16:11:40 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 13 Feb 2025 03:51:59 GMT

GET
H2 200 pxiEyp8kv8JHgFVrJJfecg.woff2
fonts.gstatic.com/s/poppins/v20/ 8 KB
8 KB 29ms
8ms Font
font/woff2 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/poppins/v20/pxiEyp8kv8JHgFVrJJfecg.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Poppins%3A1%2C300%2C400%2C400italic%2C500%2C600%2C700%2C700italic&ver=5.2.3

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7d93459d86585bfcdbb7e0376056226adb25821ee54b96236fe2123e9560929f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://offsec.almond.consulting
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 08:59:28 GMT
x-content-type-options: nosniff
age: 518137
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7884
x-xss-protection: 0
last-modified: Wed, 27 Apr 2022 17:03:52 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 12 Feb 2025 08:59:28 GMT

GET
H2 200 pxiByp8kv8JHgFVrLGT9Z1xlFQ.woff2
fonts.gstatic.com/s/poppins/v20/ 8 KB
8 KB 34ms
14ms Font
font/woff2 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/poppins/v20/pxiByp8kv8JHgFVrLGT9Z1xlFQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Poppins%3A1%2C300%2C400%2C400italic%2C500%2C600%2C700%2C700italic&ver=5.2.3

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cd36de204aca2d5fa263a731f7c20009b5e3d754ba1f1e03c33e93a48f3e7446

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://offsec.almond.consulting
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 08:55:56 GMT
x-content-type-options: nosniff
age: 518349
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7748
x-xss-protection: 0
last-modified: Wed, 27 Apr 2022 16:21:30 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 12 Feb 2025 08:55:56 GMT

GET
H2 200 mfn-icons.woff
offsec.almond.consulting/theme/themes/betheme/fonts/ 79 KB
79 KB 66ms
66ms Font
application/x-font-woff 2606:4700:10::6816:1066
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://offsec.almond.consulting/theme/themes/betheme/fonts/mfn-icons.woff?23791288

Requested by

Host: offsec.almond.consulting
URL: https://offsec.almond.consulting/theme/themes/betheme/css/base.css?ver=21.2.5

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:1066 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2a84501edf89d90c0baa41cd95dcc0528f6d63cc996929dabeb3f54a5d6b06e4

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; script-src 'self' https://code.jquery.com https://almond.consulting 'unsafe-inline'; connect-src 'self'; img-src 'self'; style-src 'self' https://fonts.googleapis.com 'unsafe-inline'; font-src 'self' https://fonts.googleapis.com https://fonts.gstatic.com; base-uri 'self'; form-action 'self'
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://offsec.almond.consulting/
Origin: https://offsec.almond.consulting
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Mon, 19 Feb 2024 08:55:05 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
content-security-policy: default-src 'self'; script-src 'self' https://code.jquery.com https://almond.consulting 'unsafe-inline'; connect-src 'self'; img-src 'self'; style-src 'self' https://fonts.googleapis.com 'unsafe-inline'; font-src 'self' https://fonts.googleapis.com https://fonts.gstatic.com; base-uri 'self'; form-action 'self'
cf-cache-status: REVALIDATED
content-length: 81192
x-xss-protection: 1; mode=block
referrer-policy: origin
last-modified: Wed, 16 Feb 2022 10:11:50 GMT
server: cloudflare
x-frame-options: DENY
vary: Accept-Encoding
content-type: application/x-font-woff
cache-control: max-age=1800
accept-ranges: bytes
cf-ray: 857d49f4e974bc01-FRA

Verdicts & Comments Add Verdict or Comment

25 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	default-src 'self'; script-src 'self' https://code.jquery.com https://almond.consulting 'unsafe-inline'; connect-src 'self'; img-src 'self'; style-src 'self' https://fonts.googleapis.com 'unsafe-inline'; font-src 'self' https://fonts.googleapis.com https://fonts.gstatic.com; base-uri 'self'; form-action 'self'
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

almond.consulting
fonts.googleapis.com
fonts.gstatic.com
offsec.almond.consulting
2606:4700:10::6816:1066
2a00:1450:4001:81c::200a
2a00:1450:4001:830::2003
0533038fb8d1924efbcf9ded30df7aa500b79ce5542d401fb098aacb74e99785
12171110937515802d6cad82a5ccd5533cdc768140465ffc8b674b7f6625ac87
177956654dd261354dc903a072d3fd887b26e5a84c3cac6ce20fde97df009afa
2a84501edf89d90c0baa41cd95dcc0528f6d63cc996929dabeb3f54a5d6b06e4
2d2309b81c3747a0e254469949da9945ef766e0dd85a55df72089d382efdec09
36dfa35cb6fad6790a77a18e1cb4a6a92aef12380be2b5e55ce5e7576960c0ba
40778e66c19b99484bf187727e854059730a96961f6a93fe61234cab945f678d
46a9b5d2ada3e977bf001f2df44e39da0eadd55d116a72d4c9329f0dad62e7aa
50d0c1742d80ac71f4cde20e8c04d41a24806af342831f479938b527fbff0972
5127e3a9305391b65d9c17cba01a9f7cfb58a571bf7b0c7714b27b74ce2badb9
5274f11e6fb32ae0cf2dfb9f8043272865c397a7c4223b4cfa7d50ea52fbde89
5907fdc184c85731a8010d2a98619d1c8c7a40585a12f6bcc2bf03b95c4294cf
593998021e5710fcc6797244da4006389ea8a5c15dc3ce7a661685cb36638844
602797e80613c3623325594e96463093c626554dff563622e8fbc3e795d283e0
6a0d53f68e013dac42a52a5264c5d28a12a06b6bc7cc1d63bc2d385558bd2dd7
76ecab113025d0f02cf406f0c081ff00b04143fd4a57a290536e666569c5dac8
7d93459d86585bfcdbb7e0376056226adb25821ee54b96236fe2123e9560929f
8731f42d334f033b7742ca1a692741a9841d1cb929311cd3add8c11133aa9899
878cd7d441dcbe1129a995e463b647b1b2d71b2bfec194f6a4cf13d8292b8b8e
8fad9806a28a3dc43a2b38390cd45b8374e8e19a2f3275a0ab8ccfb066a2c5a1
8fe175a97cf451f790fba8f1595fa34b14acc337689568afa1b73171098e6bc0
9338e65fc077355c7a87ae0d64cc101e23b9bf8ad78ae65f0f319c857311b526
9fa6485c9703675e0ec1675558e3b9a02bb7b9d862f2680cf546f5656eee2203
a10293a258541292c522058388a56eb1911d12b4fc66fd11de39d360d6755757
a35e34d7ec8cfd9fb1acc84fe91341809d276bcd1533f60cb369e86c129553cf
bac123fdbc8d79bc866b302f8f217a25b2d9ddc6d860003ff30f44c0a086afce
c22005bbdf738de61a4c2ee99c2b3c4fe52f336dfc8aa274860c58c845027d50
c36a1d5b71cce2b22a63e9593f75c0170f2620ed7bbad0bc12739accd84d38ce
ca7dce2391845e8aec7da135f33fabd10f74eed28a532ac66fd01f761fcfb42f
cb6f2d32c49d1c2b25e9ffc9aaafa3f83075346c01bcd4ae6eb187392a4292cf
cbf5979ea763eb93ca0ccf053444b2ca813618354048727e8952e3d894830a33
cd36de204aca2d5fa263a731f7c20009b5e3d754ba1f1e03c33e93a48f3e7446
d9b142d4b14def2dc71c9ee1114f872d6a0cab48808017db93fac83e66144450
e803d4290c5baec790ecde06d9308c6bf17f967c8232e3651844bfd60dd2a9f5
f25f13e58a8709b8aa0bd7ebaa2d8f17fdfe165c55ccb8b96d862fe8f8caa90f
f4e80d9dfd374d02989b87a27b5ed4cb78fbb177c27f1478e9a8b0afb7513149

offsec.almond.consulting Open in urlscan Pro 2606:4700:10::6816:1066 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

36 Requests

100 %HTTPS

100 %IPv6

3 Domains

4 Subdomains

3 IPs

2 Countries

1009 kBTransfer

1764 kBSize

0 Cookies

33 Outgoing links

Redirected requests

36 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

offsec.almond.consulting Open in urlscan Pro
2606:4700:10::6816:1066 Public Scan

Screenshot
Live screenshot

Full Image

36
Requests

100 %
HTTPS

100 %
IPv6

3
Domains

4
Subdomains

3
IPs

2
Countries

1009 kB
Transfer

1764 kB
Size

0
Cookies

36 HTTP transactions
0 data transactions