posts.specterops.io Open in urlscan Pro
52.6.3.192 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83
Effective URL:
https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83?gi=93f7ac14651e
Submission: On September 28 via api (September 28th 2020, 6:23:39 am UTC) from US

Summary HTTP 97 Redirects Links 45 Behaviour Indicators

Summary

This website contacted 14 IPs in 4 countries across 10 domains to perform 97 HTTP transactions. The main IP is 52.6.3.192, located in Ashburn, United States and belongs to AMAZON-AES, US. The main domain is posts.specterops.io.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on March 3rd 2020. Valid for: a year.

This is the only time posts.specterops.io was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 9	52.6.3.192 52.6.3.192	14618 (AMAZON-AES) (AMAZON-AES)
1 1	2606:4700::68... 2606:4700::6810:7c7f	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a02:26f0:eb:... 2a02:26f0:eb:385::13b8	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
63	2606:4700::68... 2606:4700::6810:7591	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	2a00:1450:400... 2a00:1450:4001:820::200e	15169 (GOOGLE) (GOOGLE)
1	99.86.245.186 99.86.245.186	16509 (AMAZON-02) (AMAZON-02)
1	99.86.243.7 99.86.243.7	16509 (AMAZON-02) (AMAZON-02)
1	104.108.68.187 104.108.68.187	16625 (AKAMAI-AS) (AKAMAI-AS)
1	34.232.20.147 34.232.20.147	14618 (AMAZON-AES) (AMAZON-AES)
1	2600:9000:206... 2600:9000:206e:1000:19:9934:6a80:93a1	16509 (AMAZON-02) (AMAZON-02)
4	2600:9000:206... 2600:9000:206e:7800:11:f728:3040:93a1	16509 (AMAZON-02) (AMAZON-02)
10	2606:4700:e6:... 2606:4700:e6::ac40:c21f	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2600:1f18:24e... 2600:1f18:24e6:b902:476b:b6cd:c949:4ff	14618 (AMAZON-AES) (AMAZON-AES)
1	35.168.116.164 35.168.116.164	14618 (AMAZON-AES) (AMAZON-AES)
97	14

9 52.6.3.192 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-6-3-192.compute-1.amazonaws.com

posts.specterops.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:7c7f (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

medium.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:eb:385::13b8 (Ascension Island)

ASN20940 (AKAMAI-ASN1, EU)

cdn.optimizely.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

63 2606:4700::6810:7591 (United States)

ASN13335 (CLOUDFLARENET, US)

glyph.medium.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
miro.medium.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cdn-client.medium.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:820::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 99.86.245.186 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-99-86-245-186.vie50.r.cloudfront.net

d1z2jf7jlzjs58.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 99.86.243.7 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-99-86-243-7.vie50.r.cloudfront.net

cdn.branch.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.108.68.187 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a104-108-68-187.deploy.static.akamaitechnologies.com

a16180790160.cdn.optimizely.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.232.20.147 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-232-20-147.compute-1.amazonaws.com

srv-2020-09-28-06.pixel.parsely.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:206e:1000:19:9934:6a80:93a1 (United States)

ASN16509 (AMAZON-02, US)

app.link	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2600:9000:206e:7800:11:f728:3040:93a1 (United States)

ASN16509 (AMAZON-02, US)

api2.branch.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 2606:4700:e6::ac40:c21f (United States)

ASN13335 (CLOUDFLARENET, US)

lightstep.medium.systems	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:1f18:24e6:b902:476b:b6cd:c949:4ff (Ashburn, United States)

ASN14618 (AMAZON-AES, US)

browser-http-intake.logs.datadoghq.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.168.116.164 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-35-168-116-164.compute-1.amazonaws.com

logx.optimizely.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
64	medium.com 1 redirects medium.com glyph.medium.com miro.medium.com cdn-client.medium.com	982 KB
10	medium.systems lightstep.medium.systems	1 KB
9	specterops.io 1 redirects posts.specterops.io	58 KB
5	branch.io cdn.branch.io api2.branch.io	25 KB
3	google-analytics.com www.google-analytics.com	18 KB
3	optimizely.com cdn.optimizely.com a16180790160.cdn.optimizely.com logx.optimizely.com	94 KB
2	datadoghq.com browser-http-intake.logs.datadoghq.com	93 B
1	app.link app.link	750 B
1	parsely.com srv-2020-09-28-06.pixel.parsely.com	229 B
1	cloudfront.net d1z2jf7jlzjs58.cloudfront.net	19 KB
97	10

	Domain	Requested by
42	miro.medium.com	posts.specterops.io
13	cdn-client.medium.com	posts.specterops.io cdn-client.medium.com
10	lightstep.medium.systems	cdn-client.medium.com
9	posts.specterops.io	1 redirects cdn-client.medium.com
8	glyph.medium.com	posts.specterops.io glyph.medium.com
4	api2.branch.io	cdn.branch.io
3	www.google-analytics.com	posts.specterops.io www.google-analytics.com
2	browser-http-intake.logs.datadoghq.com	cdn-client.medium.com
1	logx.optimizely.com	cdn.optimizely.com
1	app.link	cdn.branch.io
1	srv-2020-09-28-06.pixel.parsely.com	posts.specterops.io
1	a16180790160.cdn.optimizely.com	cdn.optimizely.com
1	cdn.branch.io	posts.specterops.io
1	d1z2jf7jlzjs58.cloudfront.net	cdn-client.medium.com
1	cdn.optimizely.com	posts.specterops.io
1	medium.com	1 redirects
97	16

This site contains links to these domains. Also see Links.

Domain
medium.com
rsci.app.link
www.specterops.io
twitter.com
www.thezdi.com
www.risksense.com
github.com
docs.microsoft.com
www.osronline.com
www.jackson-t.ca
help.medium.com
policy.medium.com
itunes.apple.com
play.google.com

Subject Issuer	Validity	Valid
posts.specterops.io Sectigo RSA Domain Validation Secure Server CA	`2020-03-03` - `2021-03-03`	a year	crt.sh
cdn.optimizely.com DigiCert SHA2 Secure Server CA	`2020-01-20` - `2021-03-20`	a year	crt.sh
*.medium.com DigiCert SHA2 Secure Server CA	`2020-08-19` - `2022-10-05`	2 years	crt.sh
*.google-analytics.com GTS CA 1O1	`2020-09-03` - `2020-11-26`	3 months	crt.sh
*.cloudfront.net DigiCert Global CA G2	`2020-05-26` - `2021-04-21`	a year	crt.sh
*.branch.io DigiCert SHA2 Secure Server CA	`2018-12-05` - `2020-12-08`	2 years	crt.sh
*.cdn.optimizely.com GeoTrust RSA CA 2018	`2020-03-05` - `2021-06-04`	a year	crt.sh
*.pixel.parsely.com Let's Encrypt Authority X3	`2020-07-30` - `2020-10-28`	3 months	crt.sh
appipv4.link Amazon	`2020-07-22` - `2021-08-22`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2020-08-04` - `2021-08-04`	a year	crt.sh
*.logs.datadoghq.com Sectigo RSA Domain Validation Secure Server CA	`2020-05-31` - `2022-05-31`	2 years	crt.sh
logx.optimizely.com Amazon	`2020-09-21` - `2021-10-21`	a year	crt.sh

This page contains 2 frames:

Primary Page: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83?gi=93f7ac14651e
Frame ID: 0A0D8B7E8B7DA0F90FDFB71835B4B007
Requests: 94 HTTP requests in this frame

Frame: https://a16180790160.cdn.optimizely.com/client_storage/a16180790160.html
Frame ID: BF59EFBCA5A46A34592BC8E2B8A3DAC3
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2e... HTTP 307
https://medium.com/m/global-identity?redirectUrl=https%3A%2F%2Fposts.specterops.io%2Fmethodolog... HTTP 302
https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2e... Page URL

Detected technologies

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

Optimizely (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /optimizely\.com.*\.js/i

Page Statistics

97
Requests

100 %
HTTPS

57 %
IPv6

10
Domains

16
Subdomains

14
IPs

4
Countries

1226 kB
Transfer

3461 kB
Size

12
Cookies

45 Outgoing links

These are links going to different origins than the main page.

URL: https://medium.com/?source=post_page-----3115b2efed83--------------------------------

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?operation=login&redirect=https%3A%2F%2Fposts.specterops.io%2Fmethodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83&source=--------------------------nav_reg-----------
Title: Sign in

Search URL Search Domain Scan URL

URL: https://rsci.app.link/?%24canonical_url=https%3A%2F%2Fmedium.com%2Fp%2F3115b2efed83&~feature=LoOpenInAppButton&~channel=ShowPostUnderCollection&~stage=mobileNavBar&source=--------------------------nav_reg-----------
Title: Open in app

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?operation=register&redirect=https%3A%2F%2Fposts.specterops.io%2Fmethodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83&source=--------------------------nav_reg-----------
Title: Get started

Search URL Search Domain Scan URL

URL: https://www.specterops.io/?source=post_page-----3115b2efed83--------------------------------
Title: specterops.io

Search URL Search Domain Scan URL

URL: https://medium.com/@rajat.gupta99924/outstanding-1a12510c0ba4?source=responses-----3115b2efed83----0----------------------------
Title: 4 months ago

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?actionUrl=%2F_%2Fvote%2Fp%2F1a12510c0ba4&operation=register&redirect=https%3A%2F%2Fposts.specterops.io%2Fmethodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83&source=responses-----1a12510c0ba4----0-----------------respond_sidebar-----------

Search URL Search Domain Scan URL

URL: https://medium.com/@rajat.gupta99924/outstanding-1a12510c0ba4?responsesOpen=true&source=responses-----3115b2efed83----0----------------------------

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?actionUrl=%2F_%2Fsubscribe%2Fuser%2F43fe4a5cc44&operation=register&redirect=https%3A%2F%2Fposts.specterops.io%2Fmethodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83&source=-43fe4a5cc44-------------------------follow_byline-----------
Title: Follow

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?actionUrl=%2F_%2Fbookmark%2Fp%2F3115b2efed83&operation=register&redirect=https%3A%2F%2Fposts.specterops.io%2Fmethodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83&source=post_actions_header--------------------------bookmark_preview-----------

Search URL Search Domain Scan URL

URL: https://twitter.com/TheWack0lian/status/779397840762245124
Title: CAPCOM.sys arbitrary function execution

Search URL Search Domain Scan URL

URL: https://www.thezdi.com/blog/2019/12/16/local-privilege-escalation-in-win32ksys-through-indexed-color-palettes
Title: Win32k.sys local privilege escalation

Search URL Search Domain Scan URL

URL: https://www.risksense.com/wp-content/uploads/2018/05/EternalBlue_RiskSense-Exploit-Analysis-and-Port-to-Microsoft-Windows-10_v1_2.pdf
Title: EternalBlue pool corruption

Search URL Search Domain Scan URL

URL: https://github.com/matterpreter/OffensiveCSharp/tree/master/DriverQuery
Title: DriverQuery

Search URL Search Domain Scan URL

URL: https://docs.microsoft.com/en-us/windows-hardware/drivers/kernel/defining-i-o-control-codes
Title: visual diagram

Search URL Search Domain Scan URL

URL: https://docs.microsoft.com/en-us/windows-hardware/drivers/kernel/specifying-device-types
Title: many device types defined

Search URL Search Domain Scan URL

URL: https://www.osronline.com/article.cfm%5earticle=229.htm
Title: online decoder

Search URL Search Domain Scan URL

URL: https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/-ioctldecode
Title: !ioctldecode

Search URL Search Domain Scan URL

URL: https://github.com/NationalSecurityAgency/ghidra/issues/184
Title: doesn’t include

Search URL Search Domain Scan URL

URL: https://github.com/NationalSecurityAgency/ghidra/blob/49c2010b63b56c8f20845f3970fedd95d003b1e9/Ghidra/Framework/SoftwareModeling/src/main/java/ghidra/program/database/DataTypeArchiveDB.java#L49
Title: once did

Search URL Search Domain Scan URL

URL: https://twitter.com/0x6d696368
Title: 0x6d696368

Search URL Search Domain Scan URL

URL: https://github.com/0x6d696368/ghidra-data/tree/master/typeinfo
Title: GitHub project

Search URL Search Domain Scan URL

URL: https://github.com/0x6d696368/ghidra-data/blob/master/typeinfo/ntddk_64.gdt
Title: ntddk_64.gdt

Search URL Search Domain Scan URL

URL: https://docs.microsoft.com/en-us/windows-hardware/drivers/ddi/wdm/nc-wdm-driver_initialize
Title: a pointer to a driver object

Search URL Search Domain Scan URL

URL: https://docs.microsoft.com/en-us/windows-hardware/drivers/kernel/irp-major-function-codes
Title: IRP major function codes

Search URL Search Domain Scan URL

URL: https://docs.microsoft.com/en-us/windows-hardware/drivers/ddi/wdm/ns-wdm-_irp
Title: gives us a hint

Search URL Search Domain Scan URL

URL: https://docs.microsoft.com/en-us/windows-hardware/drivers/ddi/wdm/nf-wdm-obregistercallbacks
Title: process object handler callbacks

Search URL Search Domain Scan URL

URL: http://www.jackson-t.ca/synaptics-cxutilsvc-lpe.html
Title: this is one of my favorites

Search URL Search Domain Scan URL

URL: https://twitter.com/aionescu/status/947260644528553984
Title: actually seeing

Search URL Search Domain Scan URL

URL: https://docs.microsoft.com/en-us/windows-hardware/drivers/kernel/using-buffered-i-o
Title: METHOD_BUFFERED

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?actionUrl=%2F_%2Fsubscribe%2Fcollection%2Fspecter-ops-posts%2F3115b2efed83&operation=register&redirect=https%3A%2F%2Fposts.specterops.io%2Fmethodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83&source=--------------------------follow_card-----------
Title: Follow

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?actionUrl=%2F_%2Fvote%2Fspecter-ops-posts%2F3115b2efed83&operation=register&redirect=https%3A%2F%2Fposts.specterops.io%2Fmethodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83&source=post_sidebar-----3115b2efed83---------------------clap_sidebar-----------

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?actionUrl=%2F_%2Fbookmark%2Fp%2F3115b2efed83&operation=register&redirect=https%3A%2F%2Fposts.specterops.io%2Fmethodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83&source=post_sidebar-----3115b2efed83---------------------bookmark_sidebar-----------

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?actionUrl=%2F_%2Fvote%2Fspecter-ops-posts%2F3115b2efed83&operation=register&redirect=https%3A%2F%2Fposts.specterops.io%2Fmethodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83&source=post_actions_footer-----3115b2efed83---------------------clap_footer-----------

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?actionUrl=%2F_%2Fbookmark%2Fp%2F3115b2efed83&operation=register&redirect=https%3A%2F%2Fposts.specterops.io%2Fmethodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83&source=post_actions_footer--------------------------bookmark_footer-----------

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?actionUrl=%2F_%2Fsubscribe%2Fuser%2F43fe4a5cc44%2F3115b2efed83&operation=register&redirect=https%3A%2F%2Fposts.specterops.io%2Fmethodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83&source=follow_footer-43fe4a5cc44-------------------------follow_footer-----------
Title: Follow

Search URL Search Domain Scan URL

URL: https://medium.com/about?autoplay=1&source=post_page-----3115b2efed83--------------------------------
Title: Discover Medium

Search URL Search Domain Scan URL

URL: https://medium.com/topics?source=post_page-----3115b2efed83--------------------------------
Title: Make Medium yours

Search URL Search Domain Scan URL

URL: https://medium.com/membership?source=post_page-----3115b2efed83--------------------------------
Title: Become a member

Search URL Search Domain Scan URL

URL: https://help.medium.com/hc/en-us?source=post_page-----3115b2efed83--------------------------------
Title: Help

Search URL Search Domain Scan URL

URL: https://policy.medium.com/medium-terms-of-service-9db0094a1e0f?source=post_page-----3115b2efed83--------------------------------
Title: Legal

Search URL Search Domain Scan URL

URL: https://itunes.apple.com/app/medium-everyones-stories/id828256236?pt=698524&mt=8&ct=post_page&source=post_page-----3115b2efed83--------------------------------

Search URL Search Domain Scan URL

URL: https://play.google.com/store/apps/details?id=com.medium.reader&source=post_page-----3115b2efed83--------------------------------

Search URL Search Domain Scan URL

URL: https://policy.medium.com/medium-privacy-policy-f03bf92035c9
Title: Privacy Policy

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83 HTTP 307
https://medium.com/m/global-identity?redirectUrl=https%3A%2F%2Fposts.specterops.io%2Fmethodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83 HTTP 302
https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83?gi=93f7ac14651e Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

97 HTTP transactions
4 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83 Show response
posts.specterops.io/
Redirect Chain

https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83
https://medium.com/m/global-identity?redirectUrl=https%3A%2F%2Fposts.specterops.io%2Fmethodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83
https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83?gi=93f7ac14651e

322 KB
56 KB

670ms
669ms

Document
text/html

52.6.3.192
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83?gi=93f7ac14651e

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

52.6.3.192 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-6-3-192.compute-1.amazonaws.com

Software

nginx /

Resource Hash

f0cbdc66db5736288544aac55db88fee2d338950254123f5656619eed8c1b12e

Security Headers

Name	Value
X-Frame-Options	allow-from medium.com

Request headers

:method: GET
:authority: posts.specterops.io
:scheme: https
:path: /methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83?gi=93f7ac14651e
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
server: nginx
date: Mon, 28 Sep 2020 06:23:20 GMT
content-type: text/html; charset=utf-8
sepia-upstream: medium
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: gzip
etag: W/"50848-GxiFlGlRvgjkKQ2Hnv7OZbyO1HU"
medium-fulfilled-by: valencia/main-20200925-180626-2b5f9492e9, lite/main-20200925-212814-b0cad7e4e5, rito/main-20200925-213612-84556ff27f, tutu/medium-42427
set-cookie: uid=lo_41b248243113; Path=/; Expires=Tue, 28 Sep 2021 06:23:20 GMT; HttpOnly; Secure; SameSite=None sid=1:C2oF+r1oGGD6XDP1kAo+TpTeBuqGhzxBZ3y6XdTWgG35V4nZko27/PlpCsAtwBfI; Path=/; Expires=Tue, 28 Sep 2021 06:23:20 GMT; HttpOnly; Secure; SameSite=None optimizelyEndUserId=lo_41b248243113; Path=/; Expires=Tue, 28 Sep 2021 06:23:20 GMT; Secure; SameSite=None
vary: Accept-Encoding
x-envoy-upstream-service-time: 565
x-frame-options: allow-from medium.com

Redirect headers

status: 302
date: Mon, 28 Sep 2020 06:23:19 GMT
content-type: application/octet-stream
content-length: 0
set-cookie: __cfduid=d9968fb942e531edd598fffd79dc61e361601274199; expires=Wed, 28-Oct-20 06:23:19 GMT; path=/; domain=.medium.com; HttpOnly; SameSite=Lax uid=lo_41b248243113; Path=/; Domain=medium.com; Expires=Tue, 28 Sep 2021 06:23:19 GMT; HttpOnly; Secure sid=1:XFKOUm5Ap+VYOGfBz3rfFtBgL09LqVK+Z5DbpngX6ABiVjMOOoyYy9nEBHWOuHr+; Path=/; Domain=medium.com; Expires=Tue, 28 Sep 2021 06:23:19 GMT; HttpOnly; Secure; SameSite=None optimizelyEndUserId=lo_41b248243113; Path=/; Domain=medium.com; Expires=Tue, 28 Sep 2021 06:23:19 GMT; Secure; SameSite=None __cfruid=a0804e9a9c4cedacb4209dcdc1128b358e64a83a-1601274199; path=/; domain=.medium.com; HttpOnly; Secure; SameSite=None
sepia-upstream: medium
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-security-policy: default-src 'self'; connect-src https://localhost https://*.instapaper.com https://*.stripe.com https://glyph.medium.com https://*.paypal.com https://*.braintree-api.com https://*.braintreegateway.com https://accounts.google.com https://getpocket.com https://medium.com https://*.medium.com https://*.medium.com https://medium.com https://*.medium.com https://*.algolia.net https://cdn-static-1.medium.com https://dnqgz544uhbo8.cloudfront.net https://cdn-videos-1.medium.com https://cdn-audio-1.medium.com https://collector-medium.lightstep.com https://*.branch.io 'self'; font-src data: https://*.amazonaws.com https://*.medium.com https://glyph.medium.com https://medium.com https://*.gstatic.com https://dnqgz544uhbo8.cloudfront.net https://cdn-static-1.medium.com 'self'; frame-src chromenull: https: webviewprogressproxy: medium: 'self'; img-src blob: data: https: 'self'; media-src https://*.cdn.vine.co https://d1fcbxp97j4nb2.cloudfront.net https://d262ilb51hltx0.cloudfront.net https://*.medium.com https://gomiro.medium.com https://miro.medium.com https://pbs.twimg.com 'self' blob:; object-src 'self'; script-src 'unsafe-eval' 'unsafe-inline' about: https: 'self'; style-src 'unsafe-inline' data: https: 'self'; report-uri https://csp.medium.com
expires: Thu, 09 Sep 1999 09:09:09 GMT
link: <https://medium.com/humans.txt>; rel="humans"
location: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83?gi=93f7ac14651e
medium-fulfilled-by: valencia/main-20200925-180626-2b5f9492e9
pragma: no-cache
x-content-type-options: nosniff
x-envoy-upstream-service-time: 25
x-frame-options: sameorigin
x-obvious-info: 42427-6fa63b9,6fa63b9ad52
x-obvious-tid: 1601274199865:587b331532ff
x-opentracing: {"ot-tracer-spanid":"56f68cbd1af58ff7","ot-tracer-traceid":"7b2776062b45c648","ot-tracer-sampled":"true"}
x-powered-by: Medium
x-ua-compatible: IE=edge, Chrome=1
x-xss-protection: 1; mode=block
strict-transport-security: max-age=15552000; includeSubDomains; preload
cf-cache-status: DYNAMIC
cf-request-id: 0574fa56f4000005dc8a046200000001
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 5d9b6004bc9805dc-FRA
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 16180790160.js Show response
cdn.optimizely.com/js/ 336 KB
94 KB 24ms
8ms Script
text/javascript 2a02:26f0:eb:385::13b8
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.optimizely.com/js/16180790160.js

Requested by

Host: posts.specterops.io
URL: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83?gi=93f7ac14651e

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:eb:385::13b8 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

Software

AmazonS3 /

Resource Hash

6569a9bd3c002fcb790376554bc59f0b3ed7278fc8fac98f0bddbd20bb11edf3

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

Referer: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83?gi=93f7ac14651e
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-meta-pci_enabled: False
x-amz-version-id: YLKDzfeKcz6TrCgpkNG7os_bXFpcDSoZ
content-encoding: gzip
etag: "2766929dc21a90d2a3a817ca007088e4"
x-amz-request-id: 5T3RBH5R1Y7TER0G
x-amz-server-side-encryption: AES256
status: 200
x-amz-replication-status: PENDING
access-control-allow-methods: GET, HEAD
server-timing: cdn;desc="AkamaiION";dur=0,rtt;desc="5";dur=0,cdnip;desc="2a02:26f0:eb:385::13b8";dur=0,cdnmap;desc="a5048.dsca.akamaiedge.net";dur=0,proto;desc="h2";dur=0
vary: Accept-Encoding
content-length: 95284
x-amz-id-2: hBLaKW6otLNhEXjNZoUSx6puNawiN48UnPxEoz0wT3ZBgQEtwq1XVzaHkMc5+fx3KEdBmkDzVyY=
last-modified: Fri, 25 Sep 2020 19:46:19 GMT
server: AmazonS3
date: Mon, 28 Sep 2020 06:23:20 GMT
access-control-max-age: 86400
strict-transport-security: max-age=15768000
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: x-amz-meta-revision
cache-control: max-age=120
x-amz-meta-revision: 4413
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: *

GET
H2 200 m2.css
glyph.medium.com/css/e/sr/latin/e/ssr/latin/e/ssb/latin/ 49 KB
31 KB 37ms
18ms Stylesheet
text/css 2606:4700::6810:7591
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://glyph.medium.com/css/e/sr/latin/e/ssr/latin/e/ssb/latin/m2.css

Requested by

Host: posts.specterops.io
URL: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83?gi=93f7ac14651e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7591 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c0cf1c69dbdcd8863a626a98a44418bcdab21718b8da616ab980ef2f9e1a2eee

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83?gi=93f7ac14651e
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 28 Sep 2020 06:23:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 137
status: 200
strict-transport-security: max-age=15552000; includeSubDomains; preload
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 0574fa5a360000dff720342200000001
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age: 86400
access-control-allow-methods: GET, POST, PUT, DELETE
content-type: text/css
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=14400
access-control-allow-credentials: true
cf-ray: 5d9b6009fcafdff7-FRA
access-control-allow-headers: Accept, Cache-Control, Content-Type, Cookie, DNT, Origin, User-Agent, X-Client-Date, X-Obvious-Cid, X-Opentracing, X-Xsrf-Token, ot-tracer-sampled, ot-tracer-spanid, ot-tracer-traceid
expires: Mon, 28 Sep 2020 10:23:20 GMT

GET
H2 200 1*aa0HsXZL43r95TuTJlJNPw.png
miro.medium.com/max/304/ 7 KB
7 KB 18ms
16ms Image
image/png 2606:4700::6810:7591
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/max/304/1*aa0HsXZL43r95TuTJlJNPw.png

Requested by

Host: posts.specterops.io
URL: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83?gi=93f7ac14651e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7591 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3b1c3db72fa6da00fe30f190a2b8ac5bb0bc1f8a1aa12b79d64a35c678b62b51

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83?gi=93f7ac14651e
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 28 Sep 2020 06:23:20 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 953363
status: 200
x-envoy-upstream-service-time: 60
strict-transport-security: max-age=15552000; includeSubDomains; preload
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 6883
cf-request-id: 0574fa5a4c0000dff720343200000001
pragma: public
sepia-upstream: medium
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=2592000
medium-fulfilled-by: miro/main-20200804-190312-d5d253b55e
accept-ranges: bytes
cf-ray: 5d9b600a1ce2dff7-FRA
expires: Wed, 28 Oct 2020 06:23:20 GMT

GET
H2 200 2*HFgLEKa86-RKIOoc4CfbOA.png
miro.medium.com/fit/c/96/96/ 15 KB
15 KB 16ms
15ms Image
image/png 2606:4700::6810:7591
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/fit/c/96/96/2*HFgLEKa86-RKIOoc4CfbOA.png

Requested by

Host: posts.specterops.io
URL: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83?gi=93f7ac14651e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7591 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dc15cb4d7b4d282233c525c6329cbbe303f6b369665824acfa9b2a1701009369

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83?gi=93f7ac14651e
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 28 Sep 2020 06:23:20 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 24577
status: 200
x-envoy-upstream-service-time: 49
strict-transport-security: max-age=15552000; includeSubDomains; preload
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 14970
cf-request-id: 0574fa5a4f0000dff720344200000001
pragma: public
sepia-upstream: medium
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=2592000
medium-fulfilled-by: miro/main-20200916-174204-02beecfda0
accept-ranges: bytes
cf-ray: 5d9b600a1ce8dff7-FRA
expires: Wed, 28 Oct 2020 06:23:20 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 45 KB
18 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:820::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: posts.specterops.io
URL: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83?gi=93f7ac14651e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

60863e86aa7743d1ac841da7f473a05cd57fba81d661cef658e385437f80d5ef

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83?gi=93f7ac14651e
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 09 Sep 2020 01:50:37 GMT
server: Golfe2
age: 6579
date: Mon, 28 Sep 2020 04:33:41 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18650
expires: Mon, 28 Sep 2020 06:33:41 GMT

GET
DATA 200
OK truncated
/ 156 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ced73b0f46b99eb9ff844aec40e2276202b7609e0996172cb162ed4ff1499f6d

Request headers

Referer: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83?gi=93f7ac14651e
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 10 KB
10 KB Font
font/opentype

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 705a47c18859e2c9af14403e38659a17d6e08de8d6c0a6c3cb739611e3e2be5c

Request headers

Origin: https://posts.specterops.io
Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: font/opentype

GET
H2 200 fell-400-normal.woff
glyph.medium.com/font/78ce731/0-3j_4g_6bu_6c4_6c8_6c9_6cc_6cd_6ci_6cm/ 14 KB
14 KB 40ms
23ms Font
application/font-woff 2606:4700::6810:7591
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://glyph.medium.com/font/78ce731/0-3j_4g_6bu_6c4_6c8_6c9_6cc_6cd_6ci_6cm/fell-400-normal.woff

Requested by

Host: glyph.medium.com
URL: https://glyph.medium.com/css/e/sr/latin/e/ssr/latin/e/ssb/latin/m2.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7591 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f57137897a4e676f0d2199b79def1a95b253a1a938dff9d8ba10519f3beb2b08

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Origin: https://posts.specterops.io
Referer: https://glyph.medium.com/css/e/sr/latin/e/ssr/latin/e/ssb/latin/m2.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 28 Sep 2020 06:23:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 13904134
status: 200
strict-transport-security: max-age=15552000; includeSubDomains; preload
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 0574fa5a64000016e656aee200000001
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age: 86400
access-control-allow-methods: GET, POST, PUT, DELETE
content-type: application/font-woff
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
access-control-allow-credentials: true
cf-ray: 5d9b600a3a7716e6-FRA
access-control-allow-headers: Accept, Cache-Control, Content-Type, Cookie, DNT, Origin, User-Agent, X-Client-Date, X-Obvious-Cid, X-Opentracing, X-Xsrf-Token, ot-tracer-sampled, ot-tracer-spanid, ot-tracer-traceid
expires: Tue, 28 Sep 2021 06:23:20 GMT

GET
DATA 200
OK truncated
/ 10 KB
10 KB Font
font/opentype

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b61c2c46c1b316e720610d240c7962c61c9bc9c563bfecd9757a8600b3911db0

Request headers

Origin: https://posts.specterops.io
Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: font/opentype

GET
DATA 200
OK truncated
/ 10 KB
10 KB Font
font/opentype

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a3d669b687929b3aa777fdd2c400c2b8c6b794978536a64d7e1f71edcf8037e8

Request headers

Origin: https://posts.specterops.io
Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: font/opentype

GET
H2 200 charter-700-italic.woff
glyph.medium.com/font/77a0c0c/0-3j_4g_6bu_6c4_6c8_6c9_6cc_6cd_6ci_6cm/ 11 KB
11 KB 57ms
40ms Font
application/font-woff 2606:4700::6810:7591
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://glyph.medium.com/font/77a0c0c/0-3j_4g_6bu_6c4_6c8_6c9_6cc_6cd_6ci_6cm/charter-700-italic.woff

Requested by

Host: glyph.medium.com
URL: https://glyph.medium.com/css/e/sr/latin/e/ssr/latin/e/ssb/latin/m2.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7591 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d9f4969854fa4004e00ddf84c2ca5ada59216aef292c3f6e7a5b1a73d90646f9

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Origin: https://posts.specterops.io
Referer: https://glyph.medium.com/css/e/sr/latin/e/ssr/latin/e/ssb/latin/m2.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 28 Sep 2020 06:23:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 265455
status: 200
strict-transport-security: max-age=15552000; includeSubDomains; preload
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 0574fa5a64000016e656aef200000001
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age: 86400
access-control-allow-methods: GET, POST, PUT, DELETE
content-type: application/font-woff
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
access-control-allow-credentials: true
cf-ray: 5d9b600a3a7a16e6-FRA
access-control-allow-headers: Accept, Cache-Control, Content-Type, Cookie, DNT, Origin, User-Agent, X-Client-Date, X-Obvious-Cid, X-Opentracing, X-Xsrf-Token, ot-tracer-sampled, ot-tracer-spanid, ot-tracer-traceid
expires: Tue, 28 Sep 2021 06:23:20 GMT

GET
H2 200 charter-400-italic.woff
glyph.medium.com/font/81d2bf1/0-3j_4g_6bu_6c4_6c8_6c9_6cc_6cd_6ci_6cm/ 10 KB
11 KB 38ms
22ms Font
application/font-woff 2606:4700::6810:7591
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://glyph.medium.com/font/81d2bf1/0-3j_4g_6bu_6c4_6c8_6c9_6cc_6cd_6ci_6cm/charter-400-italic.woff

Requested by

Host: glyph.medium.com
URL: https://glyph.medium.com/css/e/sr/latin/e/ssr/latin/e/ssb/latin/m2.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7591 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f0b9a9e4ea994c106a4fc595828ca1332b2cd0435d5d159d26d1773344d97367

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Origin: https://posts.specterops.io
Referer: https://glyph.medium.com/css/e/sr/latin/e/ssr/latin/e/ssb/latin/m2.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 28 Sep 2020 06:23:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 4912683
status: 200
strict-transport-security: max-age=15552000; includeSubDomains; preload
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 0574fa5a64000016e656af0200000001
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age: 86400
access-control-allow-methods: GET, POST, PUT, DELETE
content-type: application/font-woff
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
access-control-allow-credentials: true
cf-ray: 5d9b600a3a7c16e6-FRA
access-control-allow-headers: Accept, Cache-Control, Content-Type, Cookie, DNT, Origin, User-Agent, X-Client-Date, X-Obvious-Cid, X-Opentracing, X-Xsrf-Token, ot-tracer-sampled, ot-tracer-spanid, ot-tracer-traceid
expires: Tue, 28 Sep 2021 06:23:20 GMT

GET
H2 200 marat-sans-400-normal.woff
glyph.medium.com/font/d8659c9/3k-4f_4h-6bt_6bv-6c3_6c5-6c7_6ca-6cb_6ce-6ch_6cj-6cl_6cn-nvnj/ 14 KB
15 KB 25ms
24ms Font
application/font-woff 2606:4700::6810:7591
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://glyph.medium.com/font/d8659c9/3k-4f_4h-6bt_6bv-6c3_6c5-6c7_6ca-6cb_6ce-6ch_6cj-6cl_6cn-nvnj/marat-sans-400-normal.woff

Requested by

Host: glyph.medium.com
URL: https://glyph.medium.com/css/e/sr/latin/e/ssr/latin/e/ssb/latin/m2.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7591 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

12fe85ec038af8c41ba830412520589dbd125d417913c10a57838ac92ab96192

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Origin: https://posts.specterops.io
Referer: https://glyph.medium.com/css/e/sr/latin/e/ssr/latin/e/ssb/latin/m2.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 28 Sep 2020 06:23:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 28854049
status: 200
strict-transport-security: max-age=15552000; includeSubDomains; preload
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 0574fa5aad000016e656af4200000001
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age: 86400
access-control-allow-methods: GET, POST, PUT, DELETE
content-type: application/font-woff
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
access-control-allow-credentials: true
cf-ray: 5d9b600aab5616e6-FRA
access-control-allow-headers: Accept, Cache-Control, Content-Type, Cookie, DNT, Origin, User-Agent, X-Client-Date, X-Obvious-Cid, X-Opentracing, X-Xsrf-Token, ot-tracer-sampled, ot-tracer-spanid, ot-tracer-traceid
expires: Tue, 28 Sep 2021 06:23:20 GMT

GET
H2 200 0*AUN67IbYVZqTm-X5.png
miro.medium.com/max/60/ 1 KB
1 KB 107ms
103ms Image
image/png 2606:4700::6810:7591
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/max/60/0*AUN67IbYVZqTm-X5.png?q=20

Requested by

Host: posts.specterops.io
URL: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83?gi=93f7ac14651e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7591 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d089106e64ace7242b7aa6333cd807487c685785ac6f2c0184531dfa931c3fc2

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83?gi=93f7ac14651e
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 28 Sep 2020 06:23:20 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
status: 200
x-envoy-upstream-service-time: 19
strict-transport-security: max-age=15552000; includeSubDomains; preload
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 1045
cf-request-id: 0574fa5b2e0000dff720356200000001
pragma: public
sepia-upstream: production
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=2592000
medium-fulfilled-by: miro/master-20200623-203005-bf7dfed650
accept-ranges: bytes
cf-ray: 5d9b600b7faedff7-FRA
expires: Wed, 28 Oct 2020 06:23:20 GMT

GET
H2 200 1*remMMEUfYGMvCJwo_j0udg.png
miro.medium.com/max/60/ 1 KB
1 KB 120ms
115ms Image
image/png 2606:4700::6810:7591
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/max/60/1*remMMEUfYGMvCJwo_j0udg.png?q=20

Requested by

Host: posts.specterops.io
URL: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83?gi=93f7ac14651e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7591 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

512b5d561c13a1b30861ed5829c82402b73db8dfbf34befaff397c2e98953040

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83?gi=93f7ac14651e
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 28 Sep 2020 06:23:20 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
status: 200
x-envoy-upstream-service-time: 33
strict-transport-security: max-age=15552000; includeSubDomains; preload
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 1068
cf-request-id: 0574fa5b2e0000dff720357200000001
pragma: public
sepia-upstream: production
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=2592000
medium-fulfilled-by: miro/master-20200526-204632-bf3ad9f6f6
accept-ranges: bytes
cf-ray: 5d9b600b7fafdff7-FRA
expires: Wed, 28 Oct 2020 06:23:20 GMT

GET
H2 200 1*wnC7v7ZCVU8lKEecuCwgpg.png
miro.medium.com/max/60/ 2 KB
2 KB 122ms
118ms Image
image/png 2606:4700::6810:7591
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/max/60/1*wnC7v7ZCVU8lKEecuCwgpg.png?q=20

Requested by

Host: posts.specterops.io
URL: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83?gi=93f7ac14651e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7591 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a0e73b69ba783f796b06a0da951e11c8a80395c5a225510f555a6e3763a51cdd

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83?gi=93f7ac14651e
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 28 Sep 2020 06:23:20 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
status: 200
x-envoy-upstream-service-time: 11
strict-transport-security: max-age=15552000; includeSubDomains; preload
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 1760
cf-request-id: 0574fa5b2e0000dff720358200000001
pragma: public
sepia-upstream: production
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=2592000
medium-fulfilled-by: miro/master-20200415-151832-5a4843dacd
accept-ranges: bytes
cf-ray: 5d9b600b7fb2dff7-FRA
expires: Wed, 28 Oct 2020 06:23:20 GMT

GET
H2 200 1*xw9u4-aDUx3o8XBXRUp7dg.png
miro.medium.com/max/60/ 952 B
1 KB 128ms
124ms Image
image/png 2606:4700::6810:7591
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/max/60/1*xw9u4-aDUx3o8XBXRUp7dg.png?q=20

Requested by

Host: posts.specterops.io
URL: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83?gi=93f7ac14651e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7591 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c93f24bc243c24279c6d6a6964d0aec12df58deb17e57fb84585305eb847d304

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83?gi=93f7ac14651e
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 28 Sep 2020 06:23:20 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
status: 200
x-envoy-upstream-service-time: 33
strict-transport-security: max-age=15552000; includeSubDomains; preload
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 952
cf-request-id: 0574fa5b2e0000dff720359200000001
pragma: public
sepia-upstream: production
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=2592000
medium-fulfilled-by: miro/master-20200526-204632-bf3ad9f6f6
accept-ranges: bytes
cf-ray: 5d9b600b7fb3dff7-FRA
expires: Wed, 28 Oct 2020 06:23:20 GMT

GET
H2 200 1*AdlGzWRB_dQzWdT7sRTfXQ.png
miro.medium.com/max/60/ 2 KB
2 KB 109ms
105ms Image
image/png 2606:4700::6810:7591
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/max/60/1*AdlGzWRB_dQzWdT7sRTfXQ.png?q=20

Requested by

Host: posts.specterops.io
URL: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83?gi=93f7ac14651e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7591 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

46c9f6855c2d21beccec423baaafaf376661312bbe7444825f6364b9ce459efc

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83?gi=93f7ac14651e
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 28 Sep 2020 06:23:20 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
status: 200
x-envoy-upstream-service-time: 41
strict-transport-security: max-age=15552000; includeSubDomains; preload
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 1719
cf-request-id: 0574fa5b2e0000dff72035a200000001
pragma: public
sepia-upstream: medium
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=2592000
medium-fulfilled-by: miro/main-20200821-013604-403704c06c
accept-ranges: bytes
cf-ray: 5d9b600b7fb4dff7-FRA
expires: Wed, 28 Oct 2020 06:23:20 GMT

GET
H2 200 1*JjxL5kHOAbAboLqO1aGgOg.png
miro.medium.com/max/54/ 2 KB
2 KB 19ms
16ms Image
image/png 2606:4700::6810:7591
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/max/54/1*JjxL5kHOAbAboLqO1aGgOg.png?q=20

Requested by

Host: posts.specterops.io
URL: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83?gi=93f7ac14651e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7591 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

24c021e242080a6719147ac0b1348ac032d7b29f22fef35d44c610086ad06eb3

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83?gi=93f7ac14651e
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 28 Sep 2020 06:23:20 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 126
status: 200
x-envoy-upstream-service-time: 13
strict-transport-security: max-age=15552000; includeSubDomains; preload
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 2446
cf-request-id: 0574fa5b2e0000dff72035b200000001
pragma: public
sepia-upstream: medium
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=2592000
medium-fulfilled-by: miro/main-20200916-174204-02beecfda0
accept-ranges: bytes
cf-ray: 5d9b600b7fb5dff7-FRA
expires: Wed, 28 Oct 2020 06:23:20 GMT

GET
H2 200 1*A26fgJ-9oSj1zRCajbYcMQ.png
miro.medium.com/max/60/ 3 KB
3 KB 19ms
18ms Image
image/png 2606:4700::6810:7591
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/max/60/1*A26fgJ-9oSj1zRCajbYcMQ.png?q=20

Requested by

Host: posts.specterops.io
URL: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83?gi=93f7ac14651e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7591 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

abf7a5fdcf22bc470bd64c5cd0fba7695d8a97eac41c0d22e87e555c60536738

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83?gi=93f7ac14651e
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 28 Sep 2020 06:23:20 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 125
status: 200
x-envoy-upstream-service-time: 41
strict-transport-security: max-age=15552000; includeSubDomains; preload
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 3264
cf-request-id: 0574fa5b410000dff72035c200000001
pragma: public
sepia-upstream: medium
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=2592000
medium-fulfilled-by: miro/main-20200804-190312-d5d253b55e
accept-ranges: bytes
cf-ray: 5d9b600b9fe9dff7-FRA
expires: Wed, 28 Oct 2020 06:23:20 GMT

GET
H2 200 1*1Z3JWujJmzU0lJPu0bOVhg.png
miro.medium.com/max/60/ 4 KB
4 KB 18ms
16ms Image
image/png 2606:4700::6810:7591
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/max/60/1*1Z3JWujJmzU0lJPu0bOVhg.png?q=20

Requested by

Host: posts.specterops.io
URL: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83?gi=93f7ac14651e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7591 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6d6aa890b525425b22ec4ad56f272d3e4480f6be9c26a2f9f2ac325ed9099c7f

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83?gi=93f7ac14651e
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 28 Sep 2020 06:23:20 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 320692
status: 200
x-envoy-upstream-service-time: 32
strict-transport-security: max-age=15552000; includeSubDomains; preload
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 3928
cf-request-id: 0574fa5b540000dff72035d200000001
pragma: public
sepia-upstream: medium
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=2592000
medium-fulfilled-by: miro/main-20200821-013604-403704c06c
accept-ranges: bytes
cf-ray: 5d9b600bb827dff7-FRA
expires: Wed, 28 Oct 2020 06:23:20 GMT

GET
H2 200 1*3s4lrxMYZbboLPdBGqjubA.png
miro.medium.com/max/60/ 1 KB
1 KB 18ms
17ms Image
image/png 2606:4700::6810:7591
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/max/60/1*3s4lrxMYZbboLPdBGqjubA.png?q=20

Requested by

Host: posts.specterops.io
URL: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83?gi=93f7ac14651e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7591 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8e4056816307ccf2cf812b96511d9181c77cf30478b9b183210048e6a9d54116

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83?gi=93f7ac14651e
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 28 Sep 2020 06:23:20 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 320692
status: 200
x-envoy-upstream-service-time: 34
strict-transport-security: max-age=15552000; includeSubDomains; preload
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 1215
cf-request-id: 0574fa5b650000dff72035e200000001
pragma: public
sepia-upstream: medium
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=2592000
medium-fulfilled-by: miro/main-20200821-013604-403704c06c
accept-ranges: bytes
cf-ray: 5d9b600bd864dff7-FRA
expires: Wed, 28 Oct 2020 06:23:20 GMT

GET
H2 200 1*E26X8AJVQwJKSV1cWH9VUQ.png
miro.medium.com/max/60/ 1 KB
1 KB 124ms
124ms Image
image/png 2606:4700::6810:7591
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/max/60/1*E26X8AJVQwJKSV1cWH9VUQ.png?q=20

Requested by

Host: posts.specterops.io
URL: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83?gi=93f7ac14651e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7591 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b8affbc2a870d600ee7781415bdbd6a243fefe66a09bda17ead53f4f76473e6b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83?gi=93f7ac14651e
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 28 Sep 2020 06:23:21 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
status: 200
x-envoy-upstream-service-time: 23
strict-transport-security: max-age=15552000; includeSubDomains; preload
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 1109
cf-request-id: 0574fa5b770000dff720360200000001
pragma: public
sepia-upstream: production
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=2592000
medium-fulfilled-by: miro/master-20200415-151832-5a4843dacd
accept-ranges: bytes
cf-ray: 5d9b600bf8a4dff7-FRA
expires: Wed, 28 Oct 2020 06:23:21 GMT

GET
H2 200 1*iiicqHVFxA4WAgT-uQK2Wg.png
miro.medium.com/max/60/ 615 B
789 B 15ms
15ms Image
image/png 2606:4700::6810:7591
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/max/60/1*iiicqHVFxA4WAgT-uQK2Wg.png?q=20

Requested by

Host: posts.specterops.io
URL: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83?gi=93f7ac14651e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7591 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7e29b93ecff53bb5f32f1cc61885c10185740edbc3bb16d87c08048d2af7b397

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83?gi=93f7ac14651e
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 28 Sep 2020 06:23:20 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 24576
status: 200
x-envoy-upstream-service-time: 11
strict-transport-security: max-age=15552000; includeSubDomains; preload
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 615
cf-request-id: 0574fa5b960000dff720361200000001
pragma: public
sepia-upstream: production
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=2592000
medium-fulfilled-by: miro/master-20200415-151832-5a4843dacd
accept-ranges: bytes
cf-ray: 5d9b600c2907dff7-FRA
expires: Wed, 28 Oct 2020 06:23:20 GMT

GET
H2 200 1*y3dyjK5F839ZnF5kijhGzQ.png
miro.medium.com/max/60/ 1 KB
1 KB 111ms
111ms Image
image/png 2606:4700::6810:7591
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/max/60/1*y3dyjK5F839ZnF5kijhGzQ.png?q=20

Requested by

Host: posts.specterops.io
URL: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83?gi=93f7ac14651e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7591 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

13fb572d9a934cccd76326d445b51861bcd675c4e06a199775ba1c2639cd9ff6

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83?gi=93f7ac14651e
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 28 Sep 2020 06:23:21 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
status: 200
x-envoy-upstream-service-time: 58
strict-transport-security: max-age=15552000; includeSubDomains; preload
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 1034
cf-request-id: 0574fa5b980000dff720362200000001
pragma: public
sepia-upstream: medium
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=2592000
medium-fulfilled-by: miro/main-20200804-190312-d5d253b55e
accept-ranges: bytes
cf-ray: 5d9b600c2913dff7-FRA
expires: Wed, 28 Oct 2020 06:23:21 GMT

GET
H2 200 1*Cw12_w1oYBMWOIfeFaMdRA.png
miro.medium.com/max/54/ 4 KB
4 KB 15ms
15ms Image
image/png 2606:4700::6810:7591
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/max/54/1*Cw12_w1oYBMWOIfeFaMdRA.png?q=20

Requested by

Host: posts.specterops.io
URL: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83?gi=93f7ac14651e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7591 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

af706004c32c20570022c8a43ec04a25ab999dc72f7ff0ebd0a215ec5e4c29fc

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83?gi=93f7ac14651e
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 28 Sep 2020 06:23:21 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 126
status: 200
x-envoy-upstream-service-time: 31
strict-transport-security: max-age=15552000; includeSubDomains; preload
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 3951
cf-request-id: 0574fa5ba20000dff720363200000001
pragma: public
sepia-upstream: medium
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=2592000
medium-fulfilled-by: miro/main-20200821-013604-403704c06c
accept-ranges: bytes
cf-ray: 5d9b600c3932dff7-FRA
expires: Wed, 28 Oct 2020 06:23:21 GMT

GET
H2 200 1*2gS-06MMhAjp3nAg01BDOA.png
miro.medium.com/max/60/ 403 B
639 B 23ms
22ms Image
image/png 2606:4700::6810:7591
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/max/60/1*2gS-06MMhAjp3nAg01BDOA.png?q=20

Requested by

Host: posts.specterops.io
URL: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83?gi=93f7ac14651e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7591 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

aeee8a82407af2e01e0f979ad893275a17496bd5c0e851545279272249e0cfb8

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83?gi=93f7ac14651e
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 28 Sep 2020 06:23:21 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 24577
status: 200
x-envoy-upstream-service-time: 35
strict-transport-security: max-age=15552000; includeSubDomains; preload
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 403
cf-request-id: 0574fa5ba60000dff720364200000001
pragma: public
sepia-upstream: medium
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=2592000
medium-fulfilled-by: miro/main-20200916-174204-02beecfda0
accept-ranges: bytes
cf-ray: 5d9b600c393ddff7-FRA
expires: Wed, 28 Oct 2020 06:23:21 GMT

GET
H2 200 1*2BoWRJgXs25WObQ9gMQ0Qg.png
miro.medium.com/max/60/ 524 B
904 B 115ms
114ms Image
image/png 2606:4700::6810:7591
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/max/60/1*2BoWRJgXs25WObQ9gMQ0Qg.png?q=20

Requested by

Host: posts.specterops.io
URL: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83?gi=93f7ac14651e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7591 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

09bec034955887ad90a938372a861283d2d145e92c28f2de3cd2799284152471

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83?gi=93f7ac14651e
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 28 Sep 2020 06:23:21 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
status: 200
x-envoy-upstream-service-time: 72
strict-transport-security: max-age=15552000; includeSubDomains; preload
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 524
cf-request-id: 0574fa5ba70000dff720365200000001
pragma: public
sepia-upstream: medium
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=2592000
medium-fulfilled-by: miro/main-20200821-013604-403704c06c
accept-ranges: bytes
cf-ray: 5d9b600c3940dff7-FRA
expires: Wed, 28 Oct 2020 06:23:21 GMT

GET
H2 200 1*uRjnXRiTyFCdqtqeJ5Y8og.png
miro.medium.com/max/60/ 5 KB
5 KB 23ms
23ms Image
image/png 2606:4700::6810:7591
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/max/60/1*uRjnXRiTyFCdqtqeJ5Y8og.png?q=20

Requested by

Host: posts.specterops.io
URL: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83?gi=93f7ac14651e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7591 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e802d70642825aaf1ced7d5f0dabef00ccf135c78ddd0043aba5a0422868b6b2

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83?gi=93f7ac14651e
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 28 Sep 2020 06:23:21 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 126
status: 200
x-envoy-upstream-service-time: 38
strict-transport-security: max-age=15552000; includeSubDomains; preload
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 4908
cf-request-id: 0574fa5bac0000dff720367200000001
pragma: public
sepia-upstream: medium
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=2592000
medium-fulfilled-by: miro/main-20200916-174204-02beecfda0
accept-ranges: bytes
cf-ray: 5d9b600c4966dff7-FRA
expires: Wed, 28 Oct 2020 06:23:21 GMT

GET
H2 200 1*m-d2h0R-Z_v-fU77x4GbFw.png
miro.medium.com/max/60/ 3 KB
3 KB 27ms
26ms Image
image/png 2606:4700::6810:7591
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/max/60/1*m-d2h0R-Z_v-fU77x4GbFw.png?q=20

Requested by

Host: posts.specterops.io
URL: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83?gi=93f7ac14651e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7591 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ad8df3c3e61bfdf418237afe31c673cc230351d6252cf41f5392feb75fcd6c47

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83?gi=93f7ac14651e
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 28 Sep 2020 06:23:21 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 126
status: 200
x-envoy-upstream-service-time: 13
strict-transport-security: max-age=15552000; includeSubDomains; preload
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 3301
cf-request-id: 0574fa5bb20000dff720368200000001
pragma: public
sepia-upstream: medium
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=2592000
medium-fulfilled-by: miro/main-20200821-013604-403704c06c
accept-ranges: bytes
cf-ray: 5d9b600c5993dff7-FRA
expires: Wed, 28 Oct 2020 06:23:21 GMT

GET
H2 200 1*hQ4pZHfVD74c7wGiqvHi3Q.png
miro.medium.com/max/60/ 425 B
534 B 16ms
16ms Image
image/png 2606:4700::6810:7591
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/max/60/1*hQ4pZHfVD74c7wGiqvHi3Q.png?q=20

Requested by

Host: posts.specterops.io
URL: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83?gi=93f7ac14651e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7591 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

45027d3a33df916cdae6db8afc1e45ae166026e2ded58aef4d6cab23b11a3596

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83?gi=93f7ac14651e
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 28 Sep 2020 06:23:21 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 24577
status: 200
x-envoy-upstream-service-time: 16
strict-transport-security: max-age=15552000; includeSubDomains; preload
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 425
cf-request-id: 0574fa5bbd0000dff720369200000001
pragma: public
sepia-upstream: production
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=2592000
medium-fulfilled-by: miro/master-20200415-151832-5a4843dacd
accept-ranges: bytes
cf-ray: 5d9b600c69c8dff7-FRA
expires: Wed, 28 Oct 2020 06:23:21 GMT

GET
H2 200 1*IK9LCdZRRuUUjtF3kdgF9g.png
miro.medium.com/max/60/ 600 B
732 B 119ms
119ms Image
image/png 2606:4700::6810:7591
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/max/60/1*IK9LCdZRRuUUjtF3kdgF9g.png?q=20

Requested by

Host: posts.specterops.io
URL: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83?gi=93f7ac14651e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7591 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7fc6e1bc50d5155a76a21b2e663e427634a2483e02f53de5b9b9f083438c5731

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83?gi=93f7ac14651e
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 28 Sep 2020 06:23:21 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
status: 200
x-envoy-upstream-service-time: 27
strict-transport-security: max-age=15552000; includeSubDomains; preload
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 600
cf-request-id: 0574fa5bc30000dff72036a200000001
pragma: public
sepia-upstream: medium
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=2592000
medium-fulfilled-by: miro/main-20200821-013604-403704c06c
accept-ranges: bytes
cf-ray: 5d9b600c69d4dff7-FRA
expires: Wed, 28 Oct 2020 06:23:21 GMT

GET
H2 200 1*hIBVOwcvpn9wxJmRKUg2LQ.png
miro.medium.com/max/60/ 410 B
516 B 119ms
118ms Image
image/png 2606:4700::6810:7591
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/max/60/1*hIBVOwcvpn9wxJmRKUg2LQ.png?q=20

Requested by

Host: posts.specterops.io
URL: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83?gi=93f7ac14651e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7591 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5e15c5b1d86aba8b1217ae1fc038b857b6f427e873e69c536372f5e09577e6b4

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83?gi=93f7ac14651e
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 28 Sep 2020 06:23:21 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
status: 200
x-envoy-upstream-service-time: 52
strict-transport-security: max-age=15552000; includeSubDomains; preload
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 410
cf-request-id: 0574fa5bcf0000dff72036b200000001
pragma: public
sepia-upstream: medium
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=2592000
medium-fulfilled-by: miro/main-20200821-013604-403704c06c
accept-ranges: bytes
cf-ray: 5d9b600c79f2dff7-FRA
expires: Wed, 28 Oct 2020 06:23:21 GMT

GET
H2 200 1*slkdg29gpqmx-2aVGxVgLw.png
miro.medium.com/max/60/ 2 KB
2 KB 121ms
120ms Image
image/png 2606:4700::6810:7591
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/max/60/1*slkdg29gpqmx-2aVGxVgLw.png?q=20

Requested by

Host: posts.specterops.io
URL: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83?gi=93f7ac14651e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7591 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

45ef9275c0a65840fd5193bccaf0ebb52108318b7f10fd38f44351d8efa2ef26

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83?gi=93f7ac14651e
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 28 Sep 2020 06:23:21 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
status: 200
x-envoy-upstream-service-time: 21
strict-transport-security: max-age=15552000; includeSubDomains; preload
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 1900
cf-request-id: 0574fa5bcf0000dff72036c200000001
pragma: public
sepia-upstream: medium
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=2592000
medium-fulfilled-by: miro/main-20200916-174204-02beecfda0
accept-ranges: bytes
cf-ray: 5d9b600c79f6dff7-FRA
expires: Wed, 28 Oct 2020 06:23:21 GMT

GET
H2 200 1*S_GpQGyUobNhDZwYKEA93A.png
miro.medium.com/max/60/ 267 B
472 B 17ms
17ms Image
image/png 2606:4700::6810:7591
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/max/60/1*S_GpQGyUobNhDZwYKEA93A.png?q=20

Requested by

Host: posts.specterops.io
URL: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83?gi=93f7ac14651e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7591 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

357d813877619ec6286141e695e5a647f4efd2fd72123c791d2e47d75f487a1d

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83?gi=93f7ac14651e
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 28 Sep 2020 06:23:21 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 320693
status: 200
x-envoy-upstream-service-time: 47
strict-transport-security: max-age=15552000; includeSubDomains; preload
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 267
cf-request-id: 0574fa5bf60000dff72036d200000001
pragma: public
sepia-upstream: medium
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=2592000
medium-fulfilled-by: miro/main-20200916-174204-02beecfda0
accept-ranges: bytes
cf-ray: 5d9b600cba50dff7-FRA
expires: Wed, 28 Oct 2020 06:23:21 GMT

GET
H2 200 1*_cnXSZKmWR3mGTjO_0zieA.png
miro.medium.com/max/60/ 2 KB
2 KB 128ms
128ms Image
image/png 2606:4700::6810:7591
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/max/60/1*_cnXSZKmWR3mGTjO_0zieA.png?q=20

Requested by

Host: posts.specterops.io
URL: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83?gi=93f7ac14651e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7591 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9be04c105a719ee8857b9d66d60ea8332af465cdc75de4e14a1e28e0b2bf167c

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83?gi=93f7ac14651e
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 28 Sep 2020 06:23:21 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
status: 200
x-envoy-upstream-service-time: 40
strict-transport-security: max-age=15552000; includeSubDomains; preload
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 1744
cf-request-id: 0574fa5c130000dff720377200000001
pragma: public
sepia-upstream: production
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=2592000
medium-fulfilled-by: miro/master-20200415-151832-5a4843dacd
accept-ranges: bytes
cf-ray: 5d9b600ceaa1dff7-FRA
expires: Wed, 28 Oct 2020 06:23:21 GMT

GET
H2 200 2*HFgLEKa86-RKIOoc4CfbOA.png
miro.medium.com/fit/c/160/160/ 33 KB
33 KB 21ms
21ms Image
image/png 2606:4700::6810:7591
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/fit/c/160/160/2*HFgLEKa86-RKIOoc4CfbOA.png

Requested by

Host: posts.specterops.io
URL: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83?gi=93f7ac14651e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7591 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

616f3f316e3a2138ee7bbd4585cbee73d4165e163f55170074bfe3db74f50738

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83?gi=93f7ac14651e
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 28 Sep 2020 06:23:21 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 216483
status: 200
x-envoy-upstream-service-time: 44
strict-transport-security: max-age=15552000; includeSubDomains; preload
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 33837
cf-request-id: 0574fa5c1a0000dff72037b200000001
pragma: public
sepia-upstream: production
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=2592000
medium-fulfilled-by: miro/master-20200424-230724-1c1533c810
accept-ranges: bytes
cf-ray: 5d9b600cfab4dff7-FRA
expires: Wed, 28 Oct 2020 06:23:21 GMT

GET
H2 200 1*D-FDlfkqivRBQZoESrwtqw.png
miro.medium.com/fit/c/160/160/ 6 KB
7 KB 21ms
20ms Image
image/png 2606:4700::6810:7591
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/fit/c/160/160/1*D-FDlfkqivRBQZoESrwtqw.png

Requested by

Host: posts.specterops.io
URL: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83?gi=93f7ac14651e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7591 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

df55e1647aaa31dc1a9879bb336faa6f878d2af6aec095a3b0dff0bdd909218f

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83?gi=93f7ac14651e
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 28 Sep 2020 06:23:21 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 2417079
status: 200
x-envoy-upstream-service-time: 51
strict-transport-security: max-age=15552000; includeSubDomains; preload
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 6539
cf-request-id: 0574fa5c2c0000dff72037e200000001
pragma: public
sepia-upstream: production
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=2592000
medium-fulfilled-by: miro/master-20200526-204632-bf3ad9f6f6
accept-ranges: bytes
cf-ray: 5d9b600d1ae2dff7-FRA
expires: Wed, 28 Oct 2020 06:23:21 GMT

GET
H2 200 2*HFgLEKa86-RKIOoc4CfbOA.png
miro.medium.com/fit/c/80/80/ 10 KB
10 KB 19ms
18ms Image
image/png 2606:4700::6810:7591
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/fit/c/80/80/2*HFgLEKa86-RKIOoc4CfbOA.png

Requested by

Host: posts.specterops.io
URL: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83?gi=93f7ac14651e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7591 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3d1920dedabd48fcb16c1ad0c1352a745b45a07f5efbbaab45bfe371589f8496

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83?gi=93f7ac14651e
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 28 Sep 2020 06:23:21 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 1774305
status: 200
x-envoy-upstream-service-time: 69
strict-transport-security: max-age=15552000; includeSubDomains; preload
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 10085
cf-request-id: 0574fa5c310000dff72037f200000001
pragma: public
sepia-upstream: production
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=2592000
medium-fulfilled-by: miro/master-20200521-235520-8098d67ef4
accept-ranges: bytes
cf-ray: 5d9b600d1af0dff7-FRA
expires: Wed, 28 Oct 2020 06:23:21 GMT

GET
H2 200 1*D-FDlfkqivRBQZoESrwtqw.png
miro.medium.com/fit/c/80/80/ 3 KB
3 KB 21ms
19ms Image
image/png 2606:4700::6810:7591
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/fit/c/80/80/1*D-FDlfkqivRBQZoESrwtqw.png

Requested by

Host: posts.specterops.io
URL: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83?gi=93f7ac14651e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7591 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

386ff0e96e4564b30a3ba03e97878f71c9deccf8829ccfe73f80657a951aa572

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83?gi=93f7ac14651e
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 28 Sep 2020 06:23:21 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 612254
status: 200
x-envoy-upstream-service-time: 61
strict-transport-security: max-age=15552000; includeSubDomains; preload
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 2735
cf-request-id: 0574fa5c3c0000dff720381200000001
pragma: public
sepia-upstream: production
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=2592000
medium-fulfilled-by: miro/master-20200514-191947-e45d7283d4
accept-ranges: bytes
cf-ray: 5d9b600d2b12dff7-FRA
expires: Wed, 28 Oct 2020 06:23:21 GMT

GET
H2 200 0*8zXAta_r_VbLYM_k
miro.medium.com/max/60/ 2 KB
3 KB 147ms
147ms Image
image/png 2606:4700::6810:7591
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/max/60/0*8zXAta_r_VbLYM_k?q=20

Requested by

Host: posts.specterops.io
URL: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83?gi=93f7ac14651e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7591 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fa2cb9576d3fc35ea9c27219303b2319c294f370fa84de3fd1fc45cb3dafb40d

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83?gi=93f7ac14651e
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 28 Sep 2020 06:23:21 GMT
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
status: 200
x-envoy-upstream-service-time: 33
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 2482
cf-request-id: 0574fa5c410000dff720382200000001
pragma: public
sepia-upstream: medium
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/png
access-control-allow-origin: *
cache-control: public, must-revalidate, max-age=2592000
medium-fulfilled-by: miro/main-20200916-174204-02beecfda0
accept-ranges: bytes
cf-ray: 5d9b600d3b24dff7-FRA
expires: Wed, 28 Oct 2020 06:23:21 UTC

GET
H2 200 1*Rc-Ym96NMBNWktiFOVxJBQ.png
miro.medium.com/max/60/ 2 KB
2 KB 17ms
15ms Image
image/png 2606:4700::6810:7591
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/max/60/1*Rc-Ym96NMBNWktiFOVxJBQ.png?q=20

Requested by

Host: posts.specterops.io
URL: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83?gi=93f7ac14651e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7591 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

eafd6fb3d154d31515529630af541f90ce3b8104dd0a1fa4e87fb0b075eb23fa

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83?gi=93f7ac14651e
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 28 Sep 2020 06:23:21 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 2046652
status: 200
x-envoy-upstream-service-time: 30
strict-transport-security: max-age=15552000; includeSubDomains; preload
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 2045
cf-request-id: 0574fa5c450000dff720383200000001
pragma: public
sepia-upstream: medium
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=2592000
medium-fulfilled-by: miro/main-20200825-175452-20c7f3f000
accept-ranges: bytes
cf-ray: 5d9b600d3b2bdff7-FRA
expires: Wed, 28 Oct 2020 06:23:21 GMT

GET
H2 200 1*dy7MvBD79mkCTajDbSssBw.jpeg
miro.medium.com/max/60/ 993 B
1 KB 18ms
18ms Image
image/jpeg 2606:4700::6810:7591
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/max/60/1*dy7MvBD79mkCTajDbSssBw.jpeg?q=20

Requested by

Host: posts.specterops.io
URL: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83?gi=93f7ac14651e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7591 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1dd42b41715639d00fdd524dae4734968e91e05abb368514929b740af942ddb5

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83?gi=93f7ac14651e
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 28 Sep 2020 06:23:21 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 951537
status: 200
x-envoy-upstream-service-time: 38
strict-transport-security: max-age=15552000; includeSubDomains; preload
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 993
cf-request-id: 0574fa5c450000dff720384200000001
pragma: public
sepia-upstream: production
cf-bgj: h2pri
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=2592000
medium-fulfilled-by: miro/master-20200526-204632-bf3ad9f6f6
accept-ranges: bytes
cf-ray: 5d9b600d3b2ddff7-FRA
expires: Wed, 28 Oct 2020 06:23:21 GMT

GET
H2 200 0*GHniN9KHMioCdUW5
miro.medium.com/max/60/ 3 KB
3 KB 125ms
124ms Image
image/png 2606:4700::6810:7591
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/max/60/0*GHniN9KHMioCdUW5?q=20

Requested by

Host: posts.specterops.io
URL: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83?gi=93f7ac14651e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7591 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

172f5b7d6aea73d3fb57d7638c740eeeff4b607a1aa0308d04b9b8f00ab49cc6

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83?gi=93f7ac14651e
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 28 Sep 2020 06:23:21 GMT
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
status: 200
x-envoy-upstream-service-time: 13
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 2661
cf-request-id: 0574fa5c480000dff720385200000001
pragma: public
sepia-upstream: medium
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/png
access-control-allow-origin: *
cache-control: public, must-revalidate, max-age=2592000
medium-fulfilled-by: miro/main-20200916-174204-02beecfda0
accept-ranges: bytes
cf-ray: 5d9b600d4b33dff7-FRA
expires: Wed, 28 Oct 2020 06:23:21 UTC

GET
H2 200 1*ezJx8ZEu1Va14iscq_h5Gg.png
miro.medium.com/max/60/ 1 KB
1 KB 18ms
17ms Image
image/png 2606:4700::6810:7591
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/max/60/1*ezJx8ZEu1Va14iscq_h5Gg.png?q=20

Requested by

Host: posts.specterops.io
URL: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83?gi=93f7ac14651e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7591 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a373fcf6e68420792ae6977c1b7f2fe73082944f237ec333b8f45d28752507de

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83?gi=93f7ac14651e
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 28 Sep 2020 06:23:21 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 953318
status: 200
x-envoy-upstream-service-time: 37
strict-transport-security: max-age=15552000; includeSubDomains; preload
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 1304
cf-request-id: 0574fa5c510000dff720386200000001
pragma: public
sepia-upstream: production
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=2592000
medium-fulfilled-by: miro/master-20200526-204632-bf3ad9f6f6
accept-ranges: bytes
cf-ray: 5d9b600d4b5bdff7-FRA
expires: Wed, 28 Oct 2020 06:23:21 GMT

GET
H2 200 1*_yKdMthPwVpKYyHZnvrKJQ.png
miro.medium.com/max/60/ 4 KB
4 KB 16ms
15ms Image
image/png 2606:4700::6810:7591
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/max/60/1*_yKdMthPwVpKYyHZnvrKJQ.png?q=20

Requested by

Host: posts.specterops.io
URL: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83?gi=93f7ac14651e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7591 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a26fb182c4bdbe614059da22c59fbc361a8bcd754c9a370fdb031d16f0b29019

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83?gi=93f7ac14651e
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 28 Sep 2020 06:23:21 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 259840
status: 200
x-envoy-upstream-service-time: 60
strict-transport-security: max-age=15552000; includeSubDomains; preload
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 3627
cf-request-id: 0574fa5c550000dff720387200000001
pragma: public
sepia-upstream: production
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=2592000
medium-fulfilled-by: miro/master-20200514-191947-e45d7283d4
accept-ranges: bytes
cf-ray: 5d9b600d5b6cdff7-FRA
expires: Wed, 28 Oct 2020 06:23:21 GMT

GET
H2 200 0*ji6keNd2kNMsDi-Z.png
miro.medium.com/max/60/ 830 B
992 B 15ms
15ms Image
image/jpeg 2606:4700::6810:7591
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/max/60/0*ji6keNd2kNMsDi-Z.png?q=20

Requested by

Host: posts.specterops.io
URL: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83?gi=93f7ac14651e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7591 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

b3b4f1ce0d89e52e8e1e7e1005bd4ffd61a2124dbd2257a461520986b692a66d

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83?gi=93f7ac14651e
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 28 Sep 2020 06:23:21 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 1477936
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3210-6a9380d
status: 200
strict-transport-security: max-age=15552000; includeSubDomains; preload
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 830
cf-request-id: 0574fa5c580000dff720388200000001
pragma: public
cf-bgj: h2pri
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes
cf-ray: 5d9b600d5b7adff7-FRA
expires: Wed, 28 Oct 2020 06:23:21 GMT

GET
H2 200 1*YDlbuijY1qh1K0WhSIRFKw.png
miro.medium.com/max/60/ 4 KB
4 KB 20ms
19ms Image
image/png 2606:4700::6810:7591
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/max/60/1*YDlbuijY1qh1K0WhSIRFKw.png?q=20

Requested by

Host: posts.specterops.io
URL: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83?gi=93f7ac14651e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7591 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2d6656287fa1325f938441be0a1343b7946a17457f95f19770a8981ce392e307

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83?gi=93f7ac14651e
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 28 Sep 2020 06:23:21 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 1528932
status: 200
x-envoy-upstream-service-time: 39
strict-transport-security: max-age=15552000; includeSubDomains; preload
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 3749
cf-request-id: 0574fa5c630000dff720389200000001
pragma: public
sepia-upstream: production
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=2592000
medium-fulfilled-by: miro/master-20200511-225551-4419e2d569
accept-ranges: bytes
cf-ray: 5d9b600d6b9fdff7-FRA
expires: Wed, 28 Oct 2020 06:23:21 GMT

GET
H2 200 1*Crl55Tm6yDNMoucPo1tvDg.png
miro.medium.com/max/270/ 10 KB
10 KB 18ms
18ms Image
image/png 2606:4700::6810:7591
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/max/270/1*Crl55Tm6yDNMoucPo1tvDg.png

Requested by

Host: posts.specterops.io
URL: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83?gi=93f7ac14651e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7591 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3642d3805e9ba66fb550403766a10734052136d07789afe554763dc5658d41f0

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83?gi=93f7ac14651e
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 28 Sep 2020 06:23:21 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 1646062
status: 200
x-envoy-upstream-service-time: 29
strict-transport-security: max-age=15552000; includeSubDomains; preload
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 9821
cf-request-id: 0574fa5c650000dff72038a200000001
pragma: public
sepia-upstream: medium
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=2592000
medium-fulfilled-by: miro/main-20200804-190312-d5d253b55e
accept-ranges: bytes
cf-ray: 5d9b600d6ba5dff7-FRA
expires: Wed, 28 Oct 2020 06:23:21 GMT

GET
H2 200 1*W_RAPQ62h0em559zluJLdQ.png
miro.medium.com/max/270/ 7 KB
7 KB 17ms
16ms Image
image/png 2606:4700::6810:7591
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/max/270/1*W_RAPQ62h0em559zluJLdQ.png

Requested by

Host: posts.specterops.io
URL: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83?gi=93f7ac14651e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7591 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8b0c060701a878582fead05b30ef2d4786ef2dd4f61d58b56f1edd52fe91781b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83?gi=93f7ac14651e
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 28 Sep 2020 06:23:21 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 2382405
status: 200
x-envoy-upstream-service-time: 53
strict-transport-security: max-age=15552000; includeSubDomains; preload
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 6839
cf-request-id: 0574fa5c670000dff72038b200000001
pragma: public
sepia-upstream: production
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=2592000
medium-fulfilled-by: miro/main-20200728-165451-ef2e23e1e7
accept-ranges: bytes
cf-ray: 5d9b600d7babdff7-FRA
expires: Wed, 28 Oct 2020 06:23:21 GMT

GET
H2 200 charter-700-normal.woff
glyph.medium.com/font/f50d520/0-3j_4g_6bu_6c4_6c8_6c9_6cc_6cd_6ci_6cm/ 10 KB
10 KB 20ms
19ms Font
application/font-woff 2606:4700::6810:7591
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://glyph.medium.com/font/f50d520/0-3j_4g_6bu_6c4_6c8_6c9_6cc_6cd_6ci_6cm/charter-700-normal.woff

Requested by

Host: glyph.medium.com
URL: https://glyph.medium.com/css/e/sr/latin/e/ssr/latin/e/ssb/latin/m2.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7591 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

41532aec4c3a3a0747ca853b064ef7a96483a95798a6526974ec043997e2ccf9

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Origin: https://posts.specterops.io
Referer: https://glyph.medium.com/css/e/sr/latin/e/ssr/latin/e/ssb/latin/m2.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 28 Sep 2020 06:23:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 5693595
status: 200
strict-transport-security: max-age=15552000; includeSubDomains; preload
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 0574fa5b3d000016e656afd200000001
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age: 86400
access-control-allow-methods: GET, POST, PUT, DELETE
content-type: application/font-woff
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
access-control-allow-credentials: true
cf-ray: 5d9b600b9d4516e6-FRA
access-control-allow-headers: Accept, Cache-Control, Content-Type, Cookie, DNT, Origin, User-Agent, X-Client-Date, X-Obvious-Cid, X-Opentracing, X-Xsrf-Token, ot-tracer-sampled, ot-tracer-spanid, ot-tracer-traceid
expires: Tue, 28 Sep 2021 06:23:20 GMT

GET
H2 200 charter-400-normal.woff
glyph.medium.com/font/be78681/3k-4f_4h-6bt_6bv-6c3_6c5-6c7_6ca-6cb_6ce-6ch_6cj-6cl_6cn-nvnj/ 19 KB
19 KB 15ms
15ms Font
application/font-woff 2606:4700::6810:7591
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://glyph.medium.com/font/be78681/3k-4f_4h-6bt_6bv-6c3_6c5-6c7_6ca-6cb_6ce-6ch_6cj-6cl_6cn-nvnj/charter-400-normal.woff

Requested by

Host: glyph.medium.com
URL: https://glyph.medium.com/css/e/sr/latin/e/ssr/latin/e/ssb/latin/m2.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7591 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

bc72a2ca45067a3d17fed4cd8776fec5dca3b9ecd7300e107f9256a86a0c8b2f

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Origin: https://posts.specterops.io
Referer: https://glyph.medium.com/css/e/sr/latin/e/ssr/latin/e/ssb/latin/m2.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 28 Sep 2020 06:23:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 1340446
status: 200
strict-transport-security: max-age=15552000; includeSubDomains; preload
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 0574fa5b44000016e656afe200000001
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age: 86400
access-control-allow-methods: GET, POST, PUT, DELETE
content-type: application/font-woff
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
access-control-allow-credentials: true
cf-ray: 5d9b600bad5816e6-FRA
access-control-allow-headers: Accept, Cache-Control, Content-Type, Cookie, DNT, Origin, User-Agent, X-Client-Date, X-Obvious-Cid, X-Opentracing, X-Xsrf-Token, ot-tracer-sampled, ot-tracer-spanid, ot-tracer-traceid
expires: Tue, 28 Sep 2021 06:23:20 GMT

POST
H3-Q050 200 collect Show response
www.google-analytics.com/j/ 2 B
67 B 13ms
13ms XHR
text/plain 2a00:1450:4001:820::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j86&a=2040357736&t=pageview&_s=1&dl=https%3A%2F%2Fposts.specterops.io%2Fmethodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83%3Fgi%3D93f7ac14651e&ul=en-us&de=UTF-8&dt=Methodology%20for%20Static%20Reverse%20Engineering%20of%20Windows%20Kernel%20Drivers%20%7C%20by%20Matt%20Hand%20%7C%20Posts%20By%20SpecterOps%20Team%20Members&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAEABAAAAAC~&jid=542223782&gjid=231983528&cid=1307309410.1601274201&tid=UA-24232453-2&_gid=2796950.1601274201&_r=1&_slc=1&z=1169473318

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:820::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

a048e640908046be06e00eab37742b5d5ff80964af58cfd22f7cb2de4dfe375f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83?gi=93f7ac14651e
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 28 Sep 2020 06:23:20 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
status: 200
content-type: text/plain
access-control-allow-origin: https://posts.specterops.io
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 marat-sans-600-normal.woff
glyph.medium.com/font/6f4b679/3k-4f_4h-6bt_6bv-6c3_6c5-6c7_6ca-6cb_6ce-6ch_6cj-6cl_6cn-nvnj/ 15 KB
15 KB 16ms
15ms Font
application/font-woff 2606:4700::6810:7591
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://glyph.medium.com/font/6f4b679/3k-4f_4h-6bt_6bv-6c3_6c5-6c7_6ca-6cb_6ce-6ch_6cj-6cl_6cn-nvnj/marat-sans-600-normal.woff

Requested by

Host: glyph.medium.com
URL: https://glyph.medium.com/css/e/sr/latin/e/ssr/latin/e/ssb/latin/m2.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7591 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cb31d2d43efc714642919af84920177170837267c64a8fd3cec95889f83cc276

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Origin: https://posts.specterops.io
Referer: https://glyph.medium.com/css/e/sr/latin/e/ssr/latin/e/ssb/latin/m2.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 28 Sep 2020 06:23:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 265456
status: 200
strict-transport-security: max-age=15552000; includeSubDomains; preload
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 0574fa5bb1000016e656b04200000001
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age: 86400
access-control-allow-methods: GET, POST, PUT, DELETE
content-type: application/font-woff
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
access-control-allow-credentials: true
cf-ray: 5d9b600c4e7916e6-FRA
access-control-allow-headers: Accept, Cache-Control, Content-Type, Cookie, DNT, Origin, User-Agent, X-Client-Date, X-Obvious-Cid, X-Opentracing, X-Xsrf-Token, ot-tracer-sampled, ot-tracer-spanid, ot-tracer-traceid
expires: Tue, 28 Sep 2021 06:23:21 GMT

GET
H2 200 manifest.0551fee7.js Show response
cdn-client.medium.com/lite/static/js/ 5 KB
3 KB 23ms
19ms Script
application/javascript 2606:4700::6810:7591
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/manifest.0551fee7.js

Requested by

Host: posts.specterops.io
URL: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83?gi=93f7ac14651e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7591 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5f41c63f82d113b646ea8e58377b8d4956dfe19c37cd76f576bf8d462dd53cde

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83?gi=93f7ac14651e
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 28 Sep 2020 06:23:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 162461
status: 200
strict-transport-security: max-age=15552000; includeSubDomains; preload
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-request-id: 4C223000C309C087
x-amz-id-2: Riu3JvFvaBAXMEuxHOHQhUu5VYbORwe0VOjDv88fJ+mkoi6O5u1WBnPPk04UgVV8abpKZOMfpgE=
last-modified: Fri, 25 Sep 2020 21:35:53 GMT
server: cloudflare
etag: W/"7368995410420543cc32aa2fabead924"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-amz-version-id: Z_zHrO4BrUyknVIbayL5uEqGDfDy41Y6
content-type: application/javascript
cache-control: public, max-age=31536000
cf-request-id: 0574fa5c020000dff720372200000001
cf-ray: 5d9b600cda77dff7-FRA
expires: Tue, 28 Sep 2021 06:23:21 GMT

GET
H2 200 vendors~main.f6f30451.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 678 KB
177 KB 20ms
17ms Script
application/javascript 2606:4700::6810:7591
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/vendors~main.f6f30451.chunk.js

Requested by

Host: posts.specterops.io
URL: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83?gi=93f7ac14651e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7591 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c42b47db779f2a0082e6f0578b45adee12219add0b3f9cdd1ce3b35b7bec2d35

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83?gi=93f7ac14651e
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 28 Sep 2020 06:23:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 592702
status: 200
strict-transport-security: max-age=15552000; includeSubDomains; preload
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-request-id: E8D39C6066B5BDEB
x-amz-id-2: d+mog1e++8Gs+6iAb4KsblKPwu3hL7N0mj1XJ5YK8L5gSYB76n+N1Qdgahf4O4zc3t3e8CDKthg=
last-modified: Thu, 03 Sep 2020 17:47:14 GMT
server: cloudflare
etag: W/"dfe49668f4b4f49d291b68978aee4529"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-amz-version-id: TvyGAKqXL6cDXLYZTOh3UpO2fnBh0OZY
content-type: application/javascript
cache-control: public, max-age=31536000
cf-request-id: 0574fa5c020000dff72036f200000001
cf-ray: 5d9b600cda71dff7-FRA
expires: Tue, 28 Sep 2021 06:23:21 GMT

GET
H2 200 main.38ef6660.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 551 KB
125 KB 37ms
34ms Script
application/javascript 2606:4700::6810:7591
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/main.38ef6660.chunk.js

Requested by

Host: posts.specterops.io
URL: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83?gi=93f7ac14651e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7591 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a08d2d1731ee3040c8b13cf6a6dbcc0a9b613ee248d211379e55bafdd55b8365

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83?gi=93f7ac14651e
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 28 Sep 2020 06:23:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 204725
status: 200
strict-transport-security: max-age=15552000; includeSubDomains; preload
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-request-id: 2943843CE635FF31
x-amz-id-2: II7e5d2DAVRblTHxMG5a+avGRSb6l17MyN05L7dLugHYuQ11uAlyNvR4Zt6LBzMTeRa9w60Nfzw=
last-modified: Fri, 25 Sep 2020 21:23:18 GMT
server: cloudflare
etag: W/"d869946706f0b6fd8d67a91d96114044"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-amz-version-id: CFxwCQ1JiAslJWvvUqytvFvW6k5.SS3y
content-type: application/javascript
cache-control: public, max-age=31536000
cf-request-id: 0574fa5c020000dff720370200000001
cf-ray: 5d9b600cda74dff7-FRA
expires: Tue, 28 Sep 2021 06:23:21 GMT

GET
H2 200 vendors~instrumentation.9166695a.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 62 KB
16 KB 19ms
16ms Script
application/javascript 2606:4700::6810:7591
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/vendors~instrumentation.9166695a.chunk.js

Requested by

Host: posts.specterops.io
URL: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83?gi=93f7ac14651e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7591 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

863394f46d4e635e67f80f43fd3aff0489bd05c9030e7e96b01d20ebd1f04e93

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83?gi=93f7ac14651e
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 28 Sep 2020 06:23:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 235760
status: 200
strict-transport-security: max-age=15552000; includeSubDomains; preload
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-request-id: 98170F12C4DEFA8D
x-amz-id-2: SOS/mkB+UgPTWPDfDbB1lTpkfiXuiBbgaYHev6QZwxjrct2OVVLy6Eraozkm+vmFRIr3UPPdTGw=
last-modified: Thu, 20 Aug 2020 01:03:03 GMT
server: cloudflare
etag: W/"75693cd09a1437a59c5e2d3dea05e583"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-amz-version-id: 8m4nNn_NmyycryqXoIubQ36a8z_65lS7
content-type: application/javascript
cache-control: public, max-age=31536000
cf-request-id: 0574fa5c020000dff720371200000001
cf-ray: 5d9b600cda75dff7-FRA
expires: Tue, 28 Sep 2021 06:23:21 GMT

GET
H2 200 instrumentation.99d1e69e.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 5 KB
2 KB 15ms
14ms Script
application/javascript 2606:4700::6810:7591
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/instrumentation.99d1e69e.chunk.js

Requested by

Host: posts.specterops.io
URL: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83?gi=93f7ac14651e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7591 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e7fd18e9f6fab6a10e786c47f1e1b25571bad7d0c861f88177109aa9385b8f77

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83?gi=93f7ac14651e
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 28 Sep 2020 06:23:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 486876
status: 200
strict-transport-security: max-age=15552000; includeSubDomains; preload
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-request-id: 4DAFA03414E7385C
x-amz-id-2: 12s6d+3mtd0dYw+wTc5uVpvZof3gfBVh2NgSmsjUy5X4mTlvE2Cr002xZR5MNeSvM7QYlRzrN6g=
last-modified: Tue, 22 Sep 2020 15:01:35 GMT
server: cloudflare
etag: W/"66718fedbc573708038be2e6546f3031"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-amz-version-id: 8rdM.f2Hj4l0zTQqMeGhE2iHj_lnwoSc
content-type: application/javascript
cache-control: public, max-age=31536000
cf-request-id: 0574fa5c060000dff720373200000001
cf-ray: 5d9b600cda7ddff7-FRA
expires: Tue, 28 Sep 2021 06:23:21 GMT

GET
H2 200 reporting.aca69202.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 2 KB
1 KB 14ms
14ms Script
application/javascript 2606:4700::6810:7591
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/reporting.aca69202.chunk.js

Requested by

Host: posts.specterops.io
URL: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83?gi=93f7ac14651e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7591 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4b22e408f7a2bad0945b07108008c569ede0e0c5cca338f7c72b979269f9225d

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83?gi=93f7ac14651e
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 28 Sep 2020 06:23:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 229611
status: 200
strict-transport-security: max-age=15552000; includeSubDomains; preload
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-request-id: 3T6YCR2G7XDJ9Z6G
x-amz-id-2: 9ZtPHsi0jVS+km/2gCC+JEaB92fsayk8MnAEfSM+Z0aaQVbn8WszHAnq8sH+ht9dQlfWP7LN3QY=
last-modified: Thu, 20 Aug 2020 17:04:49 GMT
server: cloudflare
etag: W/"6ce8bf0e7d710fdd01825a04882d1c35"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-amz-version-id: lCOWeIHn9F3L_3U2r527.aBc3a.s6224
content-type: application/javascript
cache-control: public, max-age=31536000
cf-request-id: 0574fa5c080000dff720374200000001
cf-ray: 5d9b600cda83dff7-FRA
expires: Tue, 28 Sep 2021 06:23:21 GMT

GET
H2 200 vendors~AMPPost~CollectionAbout~CollectionHomepage~CollectionHomepagePreview~CollectionNewShortformE~f144655d.1ffacdca.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 26 KB
11 KB 16ms
15ms Script
application/javascript 2606:4700::6810:7591
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/vendors~AMPPost~CollectionAbout~CollectionHomepage~CollectionHomepagePreview~CollectionNewShortformE~f144655d.1ffacdca.chunk.js

Requested by

Host: posts.specterops.io
URL: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83?gi=93f7ac14651e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7591 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

61e21df96be90e521cbc44f59f6a6e244a6b1aab9f3206ea1e79ddad7569f231

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83?gi=93f7ac14651e
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 28 Sep 2020 06:23:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 486876
status: 200
strict-transport-security: max-age=15552000; includeSubDomains; preload
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-request-id: 37FC102A1CC225E5
x-amz-id-2: XtBgLw7gwGM3Q6BueWdX+Zf4KMH5jRlSW9FGR1tfUloNmeEBqVUSG/NLzAVDrZiXWCs7jH2umuQ=
last-modified: Tue, 22 Sep 2020 15:01:50 GMT
server: cloudflare
etag: W/"255dcfd9300edb37825e06ab40ce9d8c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-amz-version-id: Bjruy_IXSZ60XxYFapmVIf2fbuy1kZks
content-type: application/javascript
cache-control: public, max-age=31536000
cf-request-id: 0574fa5c130000dff720376200000001
cf-ray: 5d9b600cea9edff7-FRA
expires: Tue, 28 Sep 2021 06:23:21 GMT

GET
H2 200 vendors~AMPPost~CollectionHomepage~CollectionHomepagePreview~CollectionStyleEditor~CollectionTagged~~42f7530a.0dd746e8.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 16 KB
6 KB 21ms
18ms Script
application/javascript 2606:4700::6810:7591
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/vendors~AMPPost~CollectionHomepage~CollectionHomepagePreview~CollectionStyleEditor~CollectionTagged~~42f7530a.0dd746e8.chunk.js

Requested by

Host: posts.specterops.io
URL: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83?gi=93f7ac14651e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7591 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

40d12513550835dab3db2dcff4c4a22f8c116cffc432661efe9d6bf8727a044a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83?gi=93f7ac14651e
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 28 Sep 2020 06:23:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 819962
status: 200
strict-transport-security: max-age=15552000; includeSubDomains; preload
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-request-id: 7KFM1K0T2GAN2WCM
x-amz-id-2: BtiNuEb3VS2MQO3TinryvRvHFDt8avDEVUa19bAwm68Gt0XSDMWAKfPYRuQOKhRHuwWZyLh3qpQ=
last-modified: Fri, 04 Sep 2020 18:30:13 GMT
server: cloudflare
etag: W/"3a8b18e2d845e165d493b2510967b48c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-amz-version-id: rhOSi_40Rqb232a3oQpY2xeZbruPqa6o
content-type: application/javascript
cache-control: public, max-age=31536000
cf-request-id: 0574fa5c190000dff720378200000001
cf-ray: 5d9b600cfaafdff7-FRA
expires: Tue, 28 Sep 2021 06:23:21 GMT

GET
H2 200 vendors~AMPPost~CollectionNewShortformEditor~CollectionPostShortformEditor~DebugCachedPost~Post~Sequ~19f09bd3.1bf7a765.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 94 KB
26 KB 22ms
21ms Script
application/javascript 2606:4700::6810:7591
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/vendors~AMPPost~CollectionNewShortformEditor~CollectionPostShortformEditor~DebugCachedPost~Post~Sequ~19f09bd3.1bf7a765.chunk.js

Requested by

Host: posts.specterops.io
URL: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83?gi=93f7ac14651e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7591 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

915823c6c7665b13c5c5131837a5c5f4dd4571613aa272c87a2d3cd43e253a28

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83?gi=93f7ac14651e
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 28 Sep 2020 06:23:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 908028
status: 200
strict-transport-security: max-age=15552000; includeSubDomains; preload
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-request-id: 341983FF7E386945
x-amz-id-2: wqrKClAu0xVeLeIOnj6PpwB2ANp1VqlyC/nQ2ArvVaohtp4+xjZDI2fl3MVFJmL0QevIX7IVuJk=
last-modified: Thu, 03 Sep 2020 17:47:13 GMT
server: cloudflare
etag: W/"c74d9595b58a92e7917d9770dcd4ea6a"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-amz-version-id: Nw1euzNkzNjxgFu9JV3IHvpK81u0eiKp
content-type: application/javascript
cache-control: public, max-age=31536000
cf-request-id: 0574fa5c190000dff720379200000001
cf-ray: 5d9b600cfab1dff7-FRA
expires: Tue, 28 Sep 2021 06:23:21 GMT

GET
H2 200 AMPPost~CollectionHomepage~CollectionHomepagePreview~CollectionNewShortformEditor~CollectionPostShor~250d4f3e.f0c4d8cc.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 131 KB
34 KB 29ms
28ms Script
application/javascript 2606:4700::6810:7591
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/AMPPost~CollectionHomepage~CollectionHomepagePreview~CollectionNewShortformEditor~CollectionPostShor~250d4f3e.f0c4d8cc.chunk.js

Requested by

Host: posts.specterops.io
URL: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83?gi=93f7ac14651e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7591 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0e3ce8e4f396933395ed7d5b836b614aff50f0d8f61ccf34d5da970c9d66f27a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83?gi=93f7ac14651e
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 28 Sep 2020 06:23:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 204725
status: 200
strict-transport-security: max-age=15552000; includeSubDomains; preload
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-request-id: 753067DF5507533E
x-amz-id-2: /YBMahsYSLbCZBf9dBMVB6WTQLkJuITk/AUzOyHA5H4yby6uSKHCNwJeSjI89Lyq9F3pOQk1ll4=
last-modified: Fri, 25 Sep 2020 21:23:05 GMT
server: cloudflare
etag: W/"d74bd7a9efcfe6f7c8559e6eb78f6083"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-amz-version-id: Khdy_GwqTjJeM6H0BirNo4K5jcVU7lGZ
content-type: application/javascript
cache-control: public, max-age=31536000
cf-request-id: 0574fa5c1a0000dff72037a200000001
cf-ray: 5d9b600cfab2dff7-FRA
expires: Tue, 28 Sep 2021 06:23:21 GMT

GET
H2 200 Post.cd5fdb7a.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 520 KB
129 KB 19ms
19ms Script
application/javascript 2606:4700::6810:7591
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/Post.cd5fdb7a.chunk.js

Requested by

Host: posts.specterops.io
URL: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83?gi=93f7ac14651e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7591 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8729fe8a41668a585cbbcffb2e52393cb81489a966f67f7c431d9daa6d4be8f3

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83?gi=93f7ac14651e
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 28 Sep 2020 06:23:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 204725
status: 200
strict-transport-security: max-age=15552000; includeSubDomains; preload
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-request-id: 7CBC5268DABEA9A4
x-amz-id-2: YRpsa2b6+Qd49UxdQ5bmqXw0w+D6f1OjMEZPfjqTYOO+ToS5a/AD/cZ4Z4v5Tv339vaOYzRdIOI=
last-modified: Fri, 25 Sep 2020 21:23:13 GMT
server: cloudflare
etag: W/"a628be8ee4b667b80ebb2834bb38202e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-amz-version-id: 4Fcp6I8BmMXitjcZPt5ysaHO6qCTSzfj
content-type: application/javascript
cache-control: public, max-age=31536000
cf-request-id: 0574fa5c250000dff72037d200000001
cf-ray: 5d9b600d0ad5dff7-FRA
expires: Tue, 28 Sep 2021 06:23:21 GMT

POST
H2 200 graphql Show response
posts.specterops.io/_/ 94 B
385 B 209ms
208ms Fetch
application/json 52.6.3.192
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://posts.specterops.io/_/graphql
Requested by: Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/vendors~main.f6f30451.chunk.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 52.6.3.192 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-6-3-192.compute-1.amazonaws.com
Software: nginx /
Resource Hash: c9a54b8b2b208df021d5a0ec78985b64d297f0127ebc99698e8bbb04e0bc345b

Request headers

apollographql-client-name: lite
Medium-Frontend-Route: post
ot-tracer-sampled: true
ot-tracer-traceid: fc01773521b52e73
Medium-Frontend-Path: /methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83?gi=93f7ac14651e
Graphql-Operation: InteractivePostBodyQuery
content-type: application/json
accept: */*
Referer: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83?gi=93f7ac14651e
Medium-Frontend-App: lite/main-20200925-212814-b0cad7e4e5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
apollographql-client-version: main-20200925-212814-b0cad7e4e5
ot-tracer-spanid: 14b6ca6a1ba299c8

Response headers

date: Mon, 28 Sep 2020 06:23:22 GMT
sepia-upstream: medium
server: nginx
etag: W/"5e-3GrMjUO19tzvCpZBb3YhMamRpw4"
status: 200
content-type: application/json; charset=utf-8
access-control-allow-origin: *
medium-fulfilled-by: valencia/main-20200925-180626-2b5f9492e9, rito/main-20200925-213612-84556ff27f, tutu/medium-42427
x-envoy-upstream-service-time: 93
content-length: 94
x-request-received-at: 1601274201919

GET
H/1.1 200
OK p.js Show response
d1z2jf7jlzjs58.cloudfront.net/keys/medium.com/ 48 KB
19 KB 107ms
36ms Script
application/x-javascript 99.86.245.186
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d1z2jf7jlzjs58.cloudfront.net/keys/medium.com/p.js
Requested by: Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/main.38ef6660.chunk.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.245.186 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-245-186.vie50.r.cloudfront.net
Software: nginx /
Resource Hash: f69fb1f1bdac04c805e171640feeb26af4c57592cf81f5bbfb4421403e4c9c62

Request headers

Referer: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 28 Sep 2020 02:10:06 GMT
Content-Encoding: gzip
Age: 15171
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
Connection: keep-alive
Pragma: public
Last-Modified: Thu, 02 Apr 2020 00:28:20 GMT
Server: nginx
ETag: "5e8531a4-c079"
Content-Type: application/x-javascript
Via: 1.1 ccc2e147947b6e1dcaa206a56faa4bb5.cloudfront.net (CloudFront)
Cache-Control: max-age=86400, public
X-Amz-Cf-Pop: VIE50-C1
X-Amz-Cf-Id: XyRDeJLttfywhl0tyrnU8x_PwmTxs7rx2BJEdCI4U5G76i743reS6A==
Expires: Tue, 29 Sep 2020 02:10:06 GMT

POST
H3-Q050 200 collect Show response
www.google-analytics.com/j/ 2 B
47 B 13ms
13ms XHR
text/plain 2a00:1450:4001:820::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j86&a=2040357736&t=pageview&_s=1&dl=https%3A%2F%2Fposts.specterops.io%2Fmethodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83&ul=en-us&de=UTF-8&dt=Methodology%20for%20Static%20Reverse%20Engineering%20of%20Windows%20Kernel%20Drivers%20%7C%20by%20Matt%20Hand%20%7C%20Posts%20By%20SpecterOps%20Team%20Members&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=KEDAAEABAAAAAC~&jid=1678183227&gjid=809726575&cid=1307309410.1601274201&tid=UA-102239211-2&_gid=2796950.1601274201&_r=1&_slc=1&z=351401356

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:820::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

a048e640908046be06e00eab37742b5d5ff80964af58cfd22f7cb2de4dfe375f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 28 Sep 2020 06:23:22 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
status: 200
content-type: text/plain
access-control-allow-origin: https://posts.specterops.io
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 /
posts.specterops.io/_/clientele/reports/performance/ 0
0 111ms
110ms Fetch
application/octet-stream 52.6.3.192
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://posts.specterops.io/_/clientele/reports/performance/
Requested by: Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/main.38ef6660.chunk.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 52.6.3.192 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-6-3-192.compute-1.amazonaws.com
Software: nginx /
Resource Hash

Request headers

Referer: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: application/json

Response headers

date: Mon, 28 Sep 2020 06:23:22 GMT
sepia-upstream: medium
server: nginx
content-type: application/octet-stream
status: 200
medium-fulfilled-by: valencia/main-20200925-180626-2b5f9492e9, clientele/main-20200910-213456-a4255ab10d
x-envoy-upstream-service-time: 4
content-length: 0

GET
H/1.1 200
OK branch-latest.min.js Show response
cdn.branch.io/ 78 KB
24 KB 123ms
46ms Script
text/javascript 99.86.243.7
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.branch.io/branch-latest.min.js
Requested by: Host: posts.specterops.io
URL: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83?gi=93f7ac14651e
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.243.7 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-243-7.vie50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 880a547225c6b901caf46243406f9db062bdf00763c3351021c9279bce36bf3d

Request headers

Referer: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: 8_49xEBmaVmgiuHBRw3CJ6ykhmHVYUgZ
Content-Encoding: gzip
Connection: keep-alive
Last-Modified: Wed, 26 Aug 2020 18:19:31 GMT
Server: AmazonS3
Age: 200
ETag: "da329beec0cbb3d2369c47c0b28c1932"
X-Cache: Hit from cloudfront
Content-Type: text/javascript
Via: 1.1 7b574fc6db5d0840d90b97dd76cc56ec.cloudfront.net (CloudFront)
Cache-Control: max-age=300
Date: Mon, 28 Sep 2020 06:20:02 GMT
X-Amz-Cf-Pop: VIE50-C1
Content-Length: 23536
X-Amz-Cf-Id: Aida72PmTOKV4TazxVMIbBUyCINn1RC_AhoBJSMWy138y5Ut88P0xw==

POST
H2 200 /
posts.specterops.io/_/clientele/reports/performance/ 0
0 110ms
109ms Fetch
application/octet-stream 52.6.3.192
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://posts.specterops.io/_/clientele/reports/performance/
Requested by: Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/main.38ef6660.chunk.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 52.6.3.192 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-6-3-192.compute-1.amazonaws.com
Software: nginx /
Resource Hash

Request headers

Referer: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: application/json

Response headers

date: Mon, 28 Sep 2020 06:23:22 GMT
sepia-upstream: medium
server: nginx
content-type: application/octet-stream
status: 200
medium-fulfilled-by: valencia/main-20200925-180626-2b5f9492e9, clientele/main-20200910-213456-a4255ab10d
x-envoy-upstream-service-time: 4
content-length: 0

POST
H2 200 /
posts.specterops.io/_/clientele/reports/performance/ 0
0 111ms
110ms Fetch
application/octet-stream 52.6.3.192
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://posts.specterops.io/_/clientele/reports/performance/
Requested by: Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/main.38ef6660.chunk.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 52.6.3.192 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-6-3-192.compute-1.amazonaws.com
Software: nginx /
Resource Hash

Request headers

Referer: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: application/json

Response headers

date: Mon, 28 Sep 2020 06:23:22 GMT
sepia-upstream: medium
server: nginx
content-type: application/octet-stream
status: 200
medium-fulfilled-by: valencia/main-20200925-180626-2b5f9492e9, clientele/main-20200910-213456-a4255ab10d
x-envoy-upstream-service-time: 6
content-length: 0

GET
H2 200 a16180790160.html
a16180790160.cdn.optimizely.com/client_storage/ Frame BF59 0
0 81ms
24ms Document
text/html 104.108.68.187
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://a16180790160.cdn.optimizely.com/client_storage/a16180790160.html

Requested by

Host: cdn.optimizely.com
URL: https://cdn.optimizely.com/js/16180790160.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.108.68.187 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-108-68-187.deploy.static.akamaitechnologies.com

Software

AmazonS3 /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

:method: GET
:authority: a16180790160.cdn.optimizely.com
:scheme: https
:path: /client_storage/a16180790160.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83

Response headers

status: 200
x-amz-id-2: zpV8HFnfcfPcbDpqBFEBX/JzWuzzZfowioDlJ2Z05t90lU3K6jp1O0jSYR2fMfsbwLKjvfsyKAE=
x-amz-request-id: 0F54A00191E1441A
x-amz-replication-status: COMPLETED
last-modified: Fri, 25 Sep 2020 19:46:08 GMT
etag: "28b853da49bee6d09024fe3b444be4ad"
x-amz-server-side-encryption: AES256
x-amz-meta-pci_enabled: False
content-encoding: gzip
x-amz-version-id: 8Hyi0sR6UCn5LG8MGObiV7j.cxL_Llr0
accept-ranges: bytes
content-type: text/html; charset=utf-8
content-length: 781
server: AmazonS3
vary: Accept-Encoding
cache-control: max-age=120
date: Mon, 28 Sep 2020 06:23:23 GMT
server-timing: cdn;desc="AkamaiION";dur=0,rtt;desc="9";dur=0,cdnip;desc="104.108.68.187";dur=0,cdnmap;desc="a4343.x.akamaiedge.net";dur=0,proto;desc="h2";dur=0
strict-transport-security: max-age=15768000

GET
H2 200 0*AUN67IbYVZqTm-X5.png
miro.medium.com/max/1200/ 80 KB
80 KB 29ms
28ms Image
image/png 2606:4700::6810:7591
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/max/1200/0*AUN67IbYVZqTm-X5.png

Requested by

Host: posts.specterops.io
URL: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7591 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

88cff5fcdaf9d180a39e7f4d8aac5b635f6604542fc0e7921857465c6d53af76

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 28 Sep 2020 06:23:23 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 127
status: 200
x-envoy-upstream-service-time: 110
strict-transport-security: max-age=15552000; includeSubDomains; preload
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 81842
cf-request-id: 0574fa636c0000dff7203df200000001
pragma: public
sepia-upstream: medium
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=2592000
medium-fulfilled-by: miro/main-20200916-174204-02beecfda0
accept-ranges: bytes
cf-ray: 5d9b6018a879dff7-FRA
expires: Wed, 28 Oct 2020 06:23:23 GMT

GET
H/1.1 200
OK /
srv-2020-09-28-06.pixel.parsely.com/plogger/ 43 B
229 B 411ms
104ms Image
image/gif 34.232.20.147
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://srv-2020-09-28-06.pixel.parsely.com/plogger/?rand=1601274203216&plid=24269767&idsite=medium.com&url=https%3A%2F%2Fposts.specterops.io%2Fmethodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83&urlref=&screen=1600x1200%7C1600x1200%7C24&data=%7B%22viewerStatus%22%3A%22visitor%22%7D&sid=1&surl=https%3A%2F%2Fposts.specterops.io%2Fmethodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83&sref=&sts=1601274203203&slts=0&title=Methodology+for+Static+Reverse+Engineering+of+Windows+Kernel+Drivers+%7C+by+Matt+Hand+%7C+Posts+By+SpecterOps+Team+Members&date=Mon+Sep+28+2020+08%3A23%3A23+GMT%2B0200+(Central+European+Summer+Time)&action=pageview&js=1&pvid=19535684&u=pid%3De9d5908734843968f11f2e45d7ed5530
Requested by: Host: posts.specterops.io
URL: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.232.20.147 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-232-20-147.compute-1.amazonaws.com
Software: nginx /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 28 Sep 2020 06:23:09 GMT
Last-Modified: Mon, 28 Sep 1970 06:00:00 GMT
Server: nginx
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif

GET
H/1.1 200
OK _r Show response
app.link/ 90 B
750 B 258ms
208ms Script
text/javascript 2600:9000:206e:1000:19:9934:6a80:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://app.link/_r?sdk=web2.56.1&branch_key=key_live_ofxXr2qTrrU9NqURK8ZwEhknBxiI6KBm&callback=branch_callback__0

Requested by

Host: cdn.branch.io
URL: https://cdn.branch.io/branch-latest.min.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:206e:1000:19:9934:6a80:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

openresty/1.13.6.2 / Express

Resource Hash

6b753bc2a08af94616a63e7192975e30a7840862723557c131146a1ba73e0ead

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 28 Sep 2020 06:23:23 GMT
Via: 1.1 08fee972d33a4bc475aad82a2fc199cc.cloudfront.net (CloudFront)
X-Content-Type-Options: nosniff
Server: openresty/1.13.6.2
X-Amz-Cf-Pop: VIE50-C1
X-Powered-By: Express
X-Cache: Miss from cloudfront
Content-Type: text/javascript; charset=utf-8
Connection: keep-alive
Content-Length: 90
ETag: W/"5a-bCMEHcMpiRL7V2afFVHqy5btCRw"
X-Amz-Cf-Id: 27xmqwLSWu34f_hlkY4ScKKvHf3WnwSkMwmK3Jnqhm8Wrw3VES5wOA==

GET
H2 200 0*AUN67IbYVZqTm-X5.png
miro.medium.com/max/700/ 66 KB
66 KB 18ms
18ms Image
image/png 2606:4700::6810:7591
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/max/700/0*AUN67IbYVZqTm-X5.png

Requested by

Host: posts.specterops.io
URL: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7591 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8bbed4cdcb40b08a4791cf16f8738547b87e1488a6a6002cf16049b81678e6d5

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 28 Sep 2020 06:23:23 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 127
status: 200
x-envoy-upstream-service-time: 47
strict-transport-security: max-age=15552000; includeSubDomains; preload
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 67080
cf-request-id: 0574fa646d0000dff7203eb200000001
pragma: public
sepia-upstream: production
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=2592000
medium-fulfilled-by: miro/master-20200629-230611-ec9f038ff1
accept-ranges: bytes
cf-ray: 5d9b601a4bfedff7-FRA
expires: Wed, 28 Oct 2020 06:23:23 GMT

POST
H2 200 open Show response
api2.branch.io/v1/ 312 B
601 B 242ms
206ms XHR
application/json 2600:9000:206e:7800:11:f728:3040:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api2.branch.io/v1/open
Requested by: Host: cdn.branch.io
URL: https://cdn.branch.io/branch-latest.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206e:7800:11:f728:3040:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: openresty/1.13.6.2 /
Resource Hash: 968273a1c523050157799c73392cfa92039b645af420aa702397c2fb36cbe842

Request headers

Referer: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Mon, 28 Sep 2020 06:23:23 GMT
via: 1.1 f39b904b3d29bdb5e473689299f6dedd.cloudfront.net (CloudFront)
server: openresty/1.13.6.2
x-amz-cf-pop: VIE50-C1
status: 200
x-cache: Miss from cloudfront
content-type: application/json
access-control-allow-origin: *
cache-control: no-cache
content-length: 312
x-amz-cf-id: I6azDHnU-6GoVur75iOpvyWKk8MrjmVueya5mO4ZMEuR-mstS-3Luw==

POST
H2 200 /
posts.specterops.io/_/clientele/reports/performance/ 0
0 111ms
111ms Fetch
application/octet-stream 52.6.3.192
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://posts.specterops.io/_/clientele/reports/performance/
Requested by: Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/main.38ef6660.chunk.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 52.6.3.192 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-6-3-192.compute-1.amazonaws.com
Software: nginx /
Resource Hash

Request headers

Referer: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: application/json

Response headers

date: Mon, 28 Sep 2020 06:23:23 GMT
sepia-upstream: medium
server: nginx
content-type: application/octet-stream
status: 200
medium-fulfilled-by: valencia/main-20200925-180626-2b5f9492e9, clientele/main-20200910-213456-a4255ab10d
x-envoy-upstream-service-time: 5
content-length: 0

POST
H2 200 profile Show response
api2.branch.io/v1/ 180 B
540 B 211ms
210ms XHR
application/json 2600:9000:206e:7800:11:f728:3040:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api2.branch.io/v1/profile

Requested by

Host: cdn.branch.io
URL: https://cdn.branch.io/branch-latest.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:206e:7800:11:f728:3040:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

openresty/1.13.6.2 / Express

Resource Hash

ac0a7118035ab4c74bfba02343aa8a380906913e46560ca33749e7cd3f58c23c

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Mon, 28 Sep 2020 06:23:23 GMT
via: 1.1 f39b904b3d29bdb5e473689299f6dedd.cloudfront.net (CloudFront)
x-content-type-options: nosniff
server: openresty/1.13.6.2
x-amz-cf-pop: VIE50-C1
x-powered-by: Express
status: 200
x-cache: Miss from cloudfront
content-type: application/json; charset=utf-8
access-control-allow-origin: *
content-length: 180
etag: W/"b4-uLxSbe+N2+lTnx4bIXTYYX/mSuo"
x-amz-cf-id: h-xVpv_6heU5ggZeKwoWIu61OIMbfZpUzdih4PFC2vAvJHtJeWS7PA==

POST
H2 200 reports Show response
lightstep.medium.systems/api/v0/ 96 B
284 B 150ms
149ms XHR
application/json 2606:4700:e6::ac40:c21f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://lightstep.medium.systems/api/v0/reports
Requested by: Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/vendors~instrumentation.9166695a.chunk.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e6::ac40:c21f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5e9406bb74ec08e290de043960f4fbbc8aab0c0807d38d0e8b818dfbf49dd531

Request headers

Referer: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83
LightStep-Access-Token: ce5be895bef60919541332990ac9fef2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: application/json

Response headers

date: Mon, 28 Sep 2020 06:23:24 GMT
content-encoding: br
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
status: 200
access-control-allow-methods: POST
content-type: application/json
access-control-allow-origin: *
access-control-allow-credentials: true
x-envoy-upstream-service-time: 0
cf-ray: 5d9b601f3b9ddfe3-FRA
access-control-allow-headers: LightStep-Access-Token, Content-Type
cf-request-id: 0574fa67800000dfe3c9374200000001

OPTIONS
H2 200 reports
lightstep.medium.systems/api/v0/ Frame 0
0 156ms
134ms Other 2606:4700:e6::ac40:c21f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://lightstep.medium.systems/api/v0/reports
Protocol: H2
Server: 2606:4700:e6::ac40:c21f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type,lightstep-access-token
Origin: https://posts.specterops.io
Sec-Fetch-Mode: cors

Response headers

status: 200
date: Mon, 28 Sep 2020 06:23:24 GMT
content-length: 0
access-control-allow-credentials: true
access-control-allow-headers: LightStep-Access-Token, Content-Type
access-control-allow-methods: POST
access-control-allow-origin: *
x-envoy-upstream-service-time: 0
cf-cache-status: DYNAMIC
cf-request-id: 0574fa66f40000dfe3c9351200000001
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 5d9b601e59e8dfe3-FRA

OPTIONS
H2 200 pub853ea8d17ad6821d9f8f11861d23dfed
browser-http-intake.logs.datadoghq.com/v1/input/ Frame 0
0 287ms
93ms Other 2600:1f18:24e6:b902:476b:b6cd:c949:4ff
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://browser-http-intake.logs.datadoghq.com/v1/input/pub853ea8d17ad6821d9f8f11861d23dfed
Protocol: H2
Server: 2600:1f18:24e6:b902:476b:b6cd:c949:4ff Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Origin: https://posts.specterops.io
Sec-Fetch-Mode: cors

Response headers

status: 200
date: Mon, 28 Sep 2020 06:23:24 GMT
content-length: 0
access-control-allow-origin: *
access-control-allow-methods: POST
access-control-allow-headers: x-logmatic-add-useragent,x-logmatic-add-ip,content-type
access-control-max-age: 0

POST
H2 200 pub853ea8d17ad6821d9f8f11861d23dfed Show response
browser-http-intake.logs.datadoghq.com/v1/input/ 2 B
93 B 137ms
136ms Fetch
application/json 2600:1f18:24e6:b902:476b:b6cd:c949:4ff
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://browser-http-intake.logs.datadoghq.com/v1/input/pub853ea8d17ad6821d9f8f11861d23dfed
Requested by: Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/main.38ef6660.chunk.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:24e6:b902:476b:b6cd:c949:4ff Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

Referer: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: application/json

Response headers

status: 200
date: Mon, 28 Sep 2020 06:23:24 GMT
access-control-allow-origin: *
content-length: 2
content-type: application/json

POST
H2 200 pageview Show response
api2.branch.io/v1/ 28 B
363 B 447ms
447ms XHR
application/json 2600:9000:206e:7800:11:f728:3040:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api2.branch.io/v1/pageview
Requested by: Host: cdn.branch.io
URL: https://cdn.branch.io/branch-latest.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206e:7800:11:f728:3040:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: openresty/1.13.6.2 / Express
Resource Hash: a82dc28d43942326b346f92907df3bea5e38b2325ef97176f3b6234966bf19eb

Request headers

Referer: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Mon, 28 Sep 2020 06:23:24 GMT
via: 1.1 f39b904b3d29bdb5e473689299f6dedd.cloudfront.net (CloudFront)
server: openresty/1.13.6.2
x-amz-cf-pop: VIE50-C1
x-powered-by: Express
etag: W/"1c-KRZWpHfIKyIHGKJ9mp9lAyX+vFY"
status: 200
x-cache: Miss from cloudfront
content-type: application/json; charset=utf-8
access-control-allow-origin: *
content-length: 28
x-amz-cf-id: 7_9KyPM5QoI7FM1m71bFes6c8MHwDjEdZojbhI5Yt0CglY-JEAzvbA==

POST
H/1.1 204
No Content events Show response
logx.optimizely.com/v1/ 0
364 B 413ms
103ms XHR
text/plain 35.168.116.164
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://logx.optimizely.com/v1/events
Requested by: Host: cdn.optimizely.com
URL: https://cdn.optimizely.com/js/16180790160.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.168.116.164 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-168-116-164.compute-1.amazonaws.com
Software: nginx/1.17.2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Date: Mon, 28 Sep 2020 06:23:24 GMT
Server: nginx/1.17.2
Content-Type: text/plain
Access-Control-Allow-Origin: https://posts.specterops.io
Access-Control-Expose-Headers: X-Results-Data-Source
Access-Control-Allow-Credentials: true
Connection: keep-alive
Timing-Allow-Origin: *
X-Request-Id: 8e4d16aa-6606-4bb1-bbd4-76951dff0174

POST
H2 200 graphql Show response
posts.specterops.io/_/ 1 KB
1 KB 283ms
282ms Fetch
application/json 52.6.3.192
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://posts.specterops.io/_/graphql
Requested by: Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/vendors~main.f6f30451.chunk.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 52.6.3.192 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-6-3-192.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 78bb99b4f571e6b96a58b993181df548f998ad9be1d17120056a0d31b0616303

Request headers

apollographql-client-name: lite
Medium-Frontend-Route: post
ot-tracer-sampled: true
ot-tracer-traceid: fc01773521b52e73
Medium-Frontend-Path: /methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83
Graphql-Operation: PostResponsesQuery
content-type: application/json
accept: */*
Referer: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83
Medium-Frontend-App: lite/main-20200925-212814-b0cad7e4e5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
apollographql-client-version: main-20200925-212814-b0cad7e4e5
ot-tracer-spanid: 14b6ca6a1ba299c8

Response headers

date: Mon, 28 Sep 2020 06:23:24 GMT
content-encoding: gzip
sepia-upstream: medium
server: nginx
etag: W/"5f7-p4XvWcSoUZLIqKDOwZaqH3OT6WQ"
status: 200
content-type: application/json; charset=utf-8
access-control-allow-origin: *
medium-fulfilled-by: valencia/main-20200925-180626-2b5f9492e9, rito/main-20200925-213612-84556ff27f, tutu/medium-42427
x-envoy-upstream-service-time: 170
x-request-received-at: 1601274204214

POST
H2 200 pageview Show response
api2.branch.io/v1/ 28 B
363 B 236ms
236ms XHR
application/json 2600:9000:206e:7800:11:f728:3040:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api2.branch.io/v1/pageview
Requested by: Host: cdn.branch.io
URL: https://cdn.branch.io/branch-latest.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206e:7800:11:f728:3040:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: openresty/1.13.6.2 / Express
Resource Hash: a82dc28d43942326b346f92907df3bea5e38b2325ef97176f3b6234966bf19eb

Request headers

Referer: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Mon, 28 Sep 2020 06:23:24 GMT
via: 1.1 f39b904b3d29bdb5e473689299f6dedd.cloudfront.net (CloudFront)
server: openresty/1.13.6.2
x-amz-cf-pop: VIE50-C1
x-powered-by: Express
etag: W/"1c-KRZWpHfIKyIHGKJ9mp9lAyX+vFY"
status: 200
x-cache: Miss from cloudfront
content-type: application/json; charset=utf-8
access-control-allow-origin: *
content-length: 28
x-amz-cf-id: xTQfWVZ6aUnq8mjVa4LPoVonEp0hevn5GQ5ZBT9qa4VkkOqsBAvA1g==

GET
H2 200 vendors~CollectionNewShortformEditor~CollectionPostShortformEditor~responses.editor.040b5ccd.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 35 KB
12 KB 20ms
19ms Script
application/javascript 2606:4700::6810:7591
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/vendors~CollectionNewShortformEditor~CollectionPostShortformEditor~responses.editor.040b5ccd.chunk.js

Requested by

Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/manifest.0551fee7.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7591 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c57b6c25e5f956b74d8ae59c80facb76606dda637ebbe6545d700db4217d24bb

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 28 Sep 2020 06:23:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 908028
status: 200
strict-transport-security: max-age=15552000; includeSubDomains; preload
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-request-id: 1D561FCDB0367E56
x-amz-id-2: x4+Sm6EkEXDC0ulrNsQzU8EIVVmKJlYSwPmK8PrMnNTgb2Y311SAzsqNiZD9o9XXNm0F9URI8+g=
last-modified: Thu, 03 Sep 2020 17:47:13 GMT
server: cloudflare
etag: W/"de11a17d2d88403cf4eb9f1761f7fad9"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-amz-version-id: SXJdDEl1A1lOvsQBJwlHDA2V4Qa17U2Z
content-type: application/javascript
cache-control: public, max-age=31536000
cf-request-id: 0574fa695a0000dff720034200000001
cf-ray: 5d9b60222b77dff7-FRA
expires: Tue, 28 Sep 2021 06:23:24 GMT

GET
H2 200 responses.editor.f0913788.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 39 KB
12 KB 16ms
16ms Script
application/javascript 2606:4700::6810:7591
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/responses.editor.f0913788.chunk.js

Requested by

Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/manifest.0551fee7.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7591 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9364df36fb1312955d3669e26c5a296744d2b322a69054a6a3fb91c1beb44418

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 28 Sep 2020 06:23:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 229607
status: 200
strict-transport-security: max-age=15552000; includeSubDomains; preload
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-request-id: CF6936A8C96A279F
x-amz-id-2: xrYK2DLwnATdfF0djiIxFvKa46A5dhuN1eRjpjeMNHniTKe2A+Vx+YASyANOwC0fFdLG77nRiQg=
last-modified: Fri, 25 Sep 2020 14:29:25 GMT
server: cloudflare
etag: W/"5daa4d80fb879b7c48921408df4b6c64"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-amz-version-id: dV6rxPxNP8wekyc4wAtz6X8gAth3PHvp
content-type: application/javascript
cache-control: public, max-age=31536000
cf-request-id: 0574fa695a0000dff720035200000001
cf-ray: 5d9b60222b79dff7-FRA
expires: Tue, 28 Sep 2021 06:23:24 GMT

GET
H2 200 0*okar473ExXz75mZd.
miro.medium.com/fit/c/32/32/ 1 KB
1 KB 161ms
160ms Image
image/jpeg 2606:4700::6810:7591
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/fit/c/32/32/0*okar473ExXz75mZd.

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7591 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8f048dd3efc61b1ae5f855fee3024eb0fb6acdda292c5309e0751587908d73f9

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 28 Sep 2020 06:23:24 GMT
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
status: 200
x-envoy-upstream-service-time: 41
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 1184
cf-request-id: 0574fa69740000dff720036200000001
pragma: public
sepia-upstream: medium
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, must-revalidate, max-age=2592000
medium-fulfilled-by: miro/main-20200916-174204-02beecfda0
accept-ranges: bytes
cf-ray: 5d9b60225bb5dff7-FRA
expires: Wed, 28 Oct 2020 06:23:24 UTC

POST
H2 200 reports Show response
lightstep.medium.systems/api/v0/ 96 B
157 B 140ms
139ms XHR
application/json 2606:4700:e6::ac40:c21f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://lightstep.medium.systems/api/v0/reports
Requested by: Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/vendors~instrumentation.9166695a.chunk.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e6::ac40:c21f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e7f79039d300c1b7786bb1b4b016004255b1347986d7cd41d462dfc25a90ecbf

Request headers

Referer: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83
LightStep-Access-Token: ce5be895bef60919541332990ac9fef2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: application/json

Response headers

date: Mon, 28 Sep 2020 06:23:24 GMT
content-encoding: br
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
status: 200
access-control-allow-methods: POST
content-type: application/json
access-control-allow-origin: *
access-control-allow-credentials: true
x-envoy-upstream-service-time: 0
cf-ray: 5d9b60243c15dfe3-FRA
access-control-allow-headers: LightStep-Access-Token, Content-Type
cf-request-id: 0574fa6aa60000dfe3c93ca200000001

OPTIONS
H2 200 reports
lightstep.medium.systems/api/v0/ Frame 0
0 130ms
130ms Other 2606:4700:e6::ac40:c21f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://lightstep.medium.systems/api/v0/reports
Protocol: H2
Server: 2606:4700:e6::ac40:c21f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type,lightstep-access-token
Origin: https://posts.specterops.io
Sec-Fetch-Mode: cors

Response headers

status: 200
date: Mon, 28 Sep 2020 06:23:24 GMT
content-length: 0
access-control-allow-credentials: true
access-control-allow-headers: LightStep-Access-Token, Content-Type
access-control-allow-methods: POST
access-control-allow-origin: *
x-envoy-upstream-service-time: 0
cf-cache-status: DYNAMIC
cf-request-id: 0574fa6a230000dfe3c93b9200000001
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 5d9b60236ac3dfe3-FRA

POST
H2 200 reports Show response
lightstep.medium.systems/api/v0/ 96 B
271 B 135ms
135ms XHR
application/json 2606:4700:e6::ac40:c21f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://lightstep.medium.systems/api/v0/reports
Requested by: Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/vendors~instrumentation.9166695a.chunk.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e6::ac40:c21f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cc1c4291e3e43108290352d25009587b2cf250c593105246c30c6c1aecc7221f

Request headers

Referer: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83
LightStep-Access-Token: ce5be895bef60919541332990ac9fef2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: application/json

Response headers

date: Mon, 28 Sep 2020 06:23:25 GMT
content-encoding: br
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
status: 200
access-control-allow-methods: POST
content-type: application/json
access-control-allow-origin: *
access-control-allow-credentials: true
x-envoy-upstream-service-time: 0
cf-ray: 5d9b60285b64dfe3-FRA
access-control-allow-headers: LightStep-Access-Token, Content-Type
cf-request-id: 0574fa6d390000dfe3c902e200000001

OPTIONS
H2 200 reports
lightstep.medium.systems/api/v0/ Frame 0
0 130ms
130ms Other 2606:4700:e6::ac40:c21f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://lightstep.medium.systems/api/v0/reports
Protocol: H2
Server: 2606:4700:e6::ac40:c21f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type,lightstep-access-token
Origin: https://posts.specterops.io
Sec-Fetch-Mode: cors

Response headers

status: 200
date: Mon, 28 Sep 2020 06:23:25 GMT
content-length: 0
access-control-allow-credentials: true
access-control-allow-headers: LightStep-Access-Token, Content-Type
access-control-allow-methods: POST
access-control-allow-origin: *
x-envoy-upstream-service-time: 0
cf-cache-status: DYNAMIC
cf-request-id: 0574fa6cb30000dfe3c9020200000001
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 5d9b602789f5dfe3-FRA

OPTIONS
H2 200 reports
lightstep.medium.systems/api/v0/ Frame 0
0 304ms
304ms Other 2606:4700:e6::ac40:c21f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://lightstep.medium.systems/api/v0/reports
Protocol: H2
Server: 2606:4700:e6::ac40:c21f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type,lightstep-access-token
Origin: https://posts.specterops.io
Sec-Fetch-Mode: cors

Response headers

status: 200
date: Mon, 28 Sep 2020 06:23:26 GMT
content-length: 0
access-control-allow-credentials: true
access-control-allow-headers: LightStep-Access-Token, Content-Type
access-control-allow-methods: POST
access-control-allow-origin: *
x-envoy-upstream-service-time: 0
cf-cache-status: DYNAMIC
cf-request-id: 0574fa6f6e0000dfe3c904b200000001
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 5d9b602beaaddfe3-FRA

POST
H2 200 reports Show response
lightstep.medium.systems/api/v0/ 96 B
271 B 133ms
132ms XHR
application/json 2606:4700:e6::ac40:c21f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://lightstep.medium.systems/api/v0/reports
Requested by: Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/vendors~instrumentation.9166695a.chunk.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e6::ac40:c21f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2e17efb9e474f6c165a81e51f397053f906d2f3a3f6f55f902ad42c445953c73

Request headers

Referer: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83
LightStep-Access-Token: ce5be895bef60919541332990ac9fef2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: application/json

Response headers

date: Mon, 28 Sep 2020 06:23:26 GMT
content-encoding: br
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
status: 200
access-control-allow-methods: POST
content-type: application/json
access-control-allow-origin: *
access-control-allow-credentials: true
x-envoy-upstream-service-time: 0
cf-ray: 5d9b602dce2cdfe3-FRA
access-control-allow-headers: LightStep-Access-Token, Content-Type
cf-request-id: 0574fa709f0000dfe3c9070200000001

POST
H2 200 batch Show response
posts.specterops.io/_/ 17 B
246 B 275ms
274ms Fetch
application/json 52.6.3.192
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://posts.specterops.io/_/batch
Requested by: Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/main.38ef6660.chunk.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 52.6.3.192 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-6-3-192.compute-1.amazonaws.com
Software: nginx /
Resource Hash: f1ea07a1e51a389c8de07120ae5c2e432e9dd8f4fbd6f92489f185b0523a3fd4

Request headers

Referer: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83
x-xsrf-token: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
content-type: application/json

Response headers

date: Mon, 28 Sep 2020 06:23:27 GMT
sepia-upstream: medium
server: nginx
content-type: application/json
status: 200
medium-fulfilled-by: valencia/main-20200925-180626-2b5f9492e9
x-envoy-upstream-service-time: 159
content-length: 17

OPTIONS
H2 200 reports
lightstep.medium.systems/api/v0/ Frame 0
0 140ms
140ms Other 2606:4700:e6::ac40:c21f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://lightstep.medium.systems/api/v0/reports
Protocol: H2
Server: 2606:4700:e6::ac40:c21f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type,lightstep-access-token
Origin: https://posts.specterops.io
Sec-Fetch-Mode: cors

Response headers

status: 200
date: Mon, 28 Sep 2020 06:23:29 GMT
content-length: 0
access-control-allow-credentials: true
access-control-allow-headers: LightStep-Access-Token, Content-Type
access-control-allow-methods: POST
access-control-allow-origin: *
x-envoy-upstream-service-time: 0
cf-cache-status: DYNAMIC
cf-request-id: 0574fa7d1c0000dfe3c923e200000001
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 5d9b6041c9ffdfe3-FRA

POST
H2 200 reports Show response
lightstep.medium.systems/api/v0/ 96 B
274 B 176ms
176ms XHR
application/json 2606:4700:e6::ac40:c21f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://lightstep.medium.systems/api/v0/reports
Requested by: Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/vendors~instrumentation.9166695a.chunk.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e6::ac40:c21f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b8de89ff4641907615ff418b71867b8323f813ff3f909d3502b2e1bfa7b4db1f

Request headers

Referer: https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83
LightStep-Access-Token: ce5be895bef60919541332990ac9fef2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: application/json

Response headers

date: Mon, 28 Sep 2020 06:23:29 GMT
content-encoding: br
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
status: 200
access-control-allow-methods: POST
content-type: application/json
access-control-allow-origin: *
access-control-allow-credentials: true
x-envoy-upstream-service-time: 1
cf-ray: 5d9b6042ab9edfe3-FRA
access-control-allow-headers: LightStep-Access-Token, Content-Type
cf-request-id: 0574fa7da90000dfe3c9250200000001

Verdicts & Comments Add Verdict or Comment

26 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

12 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.specterops.io/	1970-01-19 17:07:06	Name: optimizelyEndUserId Value: lo_41b248243113
posts.specterops.io/	1970-01-19 21:33:30	Name: sid Value: 1:C2oF+r1oGGD6XDP1kAo+TpTeBuqGhzxBZ3y6XdTWgG35V4nZko27/PlpCsAtwBfI
posts.specterops.io/	1970-01-19 12:57:59	Name: lightstep_guid/lite-web Value: 00442f6470fbf1e9
.specterops.io/	1970-01-19 12:47:54	Name: _gat_tracker0 Value: 1
.specterops.io/	1970-01-19 12:47:56	Name: _parsely_session Value: {%22sid%22:1%2C%22surl%22:%22https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83%22%2C%22sref%22:%22%22%2C%22sts%22:1601274203203%2C%22slts%22:0}
.specterops.io/	1970-01-19 12:47:54	Name: _gat Value: 1
posts.specterops.io/	1970-01-19 21:33:30	Name: optimizelyEndUserId Value: lo_41b248243113
posts.specterops.io/	1970-01-19 21:33:30	Name: uid Value: lo_41b248243113
.specterops.io/	1970-01-19 12:49:20	Name: _gid Value: GA1.2.2796950.1601274201
posts.specterops.io/	1970-01-19 12:57:59	Name: lightstep_session_id Value: 759acdf726ec7646
.specterops.io/	1970-01-19 22:17:18	Name: _parsely_visitor Value: {%22id%22:%22pid=e9d5908734843968f11f2e45d7ed5530%22%2C%22session_count%22:1%2C%22last_session_ts%22:1601274203203}
.specterops.io/	1970-01-20 06:19:06	Name: _ga Value: GA1.2.1307309410.1601274201

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://cdn-client.medium.com/lite/static/js/main.38ef6660.chunk.js(Line 1) Message: -+++++= .+++++= .+@@@@@+ #@@@@: .@@@@@= @@@@@ @+@@@@- =#@@@@@ @ +@@@@: :% @@@@@ @ @@@@-%: @@@@@ @ @@@@- @@@@@ -@- #@@+ :@@@@@: -#@@@#- ## =@@@@@@@= ....... .........
console-api	log	URL: https://cdn-client.medium.com/lite/static/js/main.38ef6660.chunk.js(Line 1) Message: We're hiring! https://medium.com/jobs-at-medium/work-at-medium-959d1a85284e

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Frame-Options	allow-from medium.com

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

a16180790160.cdn.optimizely.com
api2.branch.io
app.link
browser-http-intake.logs.datadoghq.com
cdn-client.medium.com
cdn.branch.io
cdn.optimizely.com
d1z2jf7jlzjs58.cloudfront.net
glyph.medium.com
lightstep.medium.systems
logx.optimizely.com
medium.com
miro.medium.com
posts.specterops.io
srv-2020-09-28-06.pixel.parsely.com
www.google-analytics.com
104.108.68.187
2600:1f18:24e6:b902:476b:b6cd:c949:4ff
2600:9000:206e:1000:19:9934:6a80:93a1
2600:9000:206e:7800:11:f728:3040:93a1
2606:4700::6810:7591
2606:4700::6810:7c7f
2606:4700:e6::ac40:c21f
2a00:1450:4001:820::200e
2a02:26f0:eb:385::13b8
34.232.20.147
35.168.116.164
52.6.3.192
99.86.243.7
99.86.245.186
09bec034955887ad90a938372a861283d2d145e92c28f2de3cd2799284152471
0e3ce8e4f396933395ed7d5b836b614aff50f0d8f61ccf34d5da970c9d66f27a
12fe85ec038af8c41ba830412520589dbd125d417913c10a57838ac92ab96192
13fb572d9a934cccd76326d445b51861bcd675c4e06a199775ba1c2639cd9ff6
172f5b7d6aea73d3fb57d7638c740eeeff4b607a1aa0308d04b9b8f00ab49cc6
1dd42b41715639d00fdd524dae4734968e91e05abb368514929b740af942ddb5
24c021e242080a6719147ac0b1348ac032d7b29f22fef35d44c610086ad06eb3
2d6656287fa1325f938441be0a1343b7946a17457f95f19770a8981ce392e307
2e17efb9e474f6c165a81e51f397053f906d2f3a3f6f55f902ad42c445953c73
357d813877619ec6286141e695e5a647f4efd2fd72123c791d2e47d75f487a1d
3642d3805e9ba66fb550403766a10734052136d07789afe554763dc5658d41f0
386ff0e96e4564b30a3ba03e97878f71c9deccf8829ccfe73f80657a951aa572
3b1c3db72fa6da00fe30f190a2b8ac5bb0bc1f8a1aa12b79d64a35c678b62b51
3d1920dedabd48fcb16c1ad0c1352a745b45a07f5efbbaab45bfe371589f8496
40d12513550835dab3db2dcff4c4a22f8c116cffc432661efe9d6bf8727a044a
41532aec4c3a3a0747ca853b064ef7a96483a95798a6526974ec043997e2ccf9
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
45027d3a33df916cdae6db8afc1e45ae166026e2ded58aef4d6cab23b11a3596
45ef9275c0a65840fd5193bccaf0ebb52108318b7f10fd38f44351d8efa2ef26
46c9f6855c2d21beccec423baaafaf376661312bbe7444825f6364b9ce459efc
4b22e408f7a2bad0945b07108008c569ede0e0c5cca338f7c72b979269f9225d
512b5d561c13a1b30861ed5829c82402b73db8dfbf34befaff397c2e98953040
5e15c5b1d86aba8b1217ae1fc038b857b6f427e873e69c536372f5e09577e6b4
5e9406bb74ec08e290de043960f4fbbc8aab0c0807d38d0e8b818dfbf49dd531
5f41c63f82d113b646ea8e58377b8d4956dfe19c37cd76f576bf8d462dd53cde
60863e86aa7743d1ac841da7f473a05cd57fba81d661cef658e385437f80d5ef
616f3f316e3a2138ee7bbd4585cbee73d4165e163f55170074bfe3db74f50738
61e21df96be90e521cbc44f59f6a6e244a6b1aab9f3206ea1e79ddad7569f231
6569a9bd3c002fcb790376554bc59f0b3ed7278fc8fac98f0bddbd20bb11edf3
6b753bc2a08af94616a63e7192975e30a7840862723557c131146a1ba73e0ead
6d6aa890b525425b22ec4ad56f272d3e4480f6be9c26a2f9f2ac325ed9099c7f
705a47c18859e2c9af14403e38659a17d6e08de8d6c0a6c3cb739611e3e2be5c
78bb99b4f571e6b96a58b993181df548f998ad9be1d17120056a0d31b0616303
7e29b93ecff53bb5f32f1cc61885c10185740edbc3bb16d87c08048d2af7b397
7fc6e1bc50d5155a76a21b2e663e427634a2483e02f53de5b9b9f083438c5731
863394f46d4e635e67f80f43fd3aff0489bd05c9030e7e96b01d20ebd1f04e93
8729fe8a41668a585cbbcffb2e52393cb81489a966f67f7c431d9daa6d4be8f3
880a547225c6b901caf46243406f9db062bdf00763c3351021c9279bce36bf3d
88cff5fcdaf9d180a39e7f4d8aac5b635f6604542fc0e7921857465c6d53af76
8b0c060701a878582fead05b30ef2d4786ef2dd4f61d58b56f1edd52fe91781b
8bbed4cdcb40b08a4791cf16f8738547b87e1488a6a6002cf16049b81678e6d5
8e4056816307ccf2cf812b96511d9181c77cf30478b9b183210048e6a9d54116
8f048dd3efc61b1ae5f855fee3024eb0fb6acdda292c5309e0751587908d73f9
915823c6c7665b13c5c5131837a5c5f4dd4571613aa272c87a2d3cd43e253a28
9364df36fb1312955d3669e26c5a296744d2b322a69054a6a3fb91c1beb44418
968273a1c523050157799c73392cfa92039b645af420aa702397c2fb36cbe842
9be04c105a719ee8857b9d66d60ea8332af465cdc75de4e14a1e28e0b2bf167c
a048e640908046be06e00eab37742b5d5ff80964af58cfd22f7cb2de4dfe375f
a08d2d1731ee3040c8b13cf6a6dbcc0a9b613ee248d211379e55bafdd55b8365
a0e73b69ba783f796b06a0da951e11c8a80395c5a225510f555a6e3763a51cdd
a26fb182c4bdbe614059da22c59fbc361a8bcd754c9a370fdb031d16f0b29019
a373fcf6e68420792ae6977c1b7f2fe73082944f237ec333b8f45d28752507de
a3d669b687929b3aa777fdd2c400c2b8c6b794978536a64d7e1f71edcf8037e8
a82dc28d43942326b346f92907df3bea5e38b2325ef97176f3b6234966bf19eb
abf7a5fdcf22bc470bd64c5cd0fba7695d8a97eac41c0d22e87e555c60536738
ac0a7118035ab4c74bfba02343aa8a380906913e46560ca33749e7cd3f58c23c
ad8df3c3e61bfdf418237afe31c673cc230351d6252cf41f5392feb75fcd6c47
aeee8a82407af2e01e0f979ad893275a17496bd5c0e851545279272249e0cfb8
af706004c32c20570022c8a43ec04a25ab999dc72f7ff0ebd0a215ec5e4c29fc
b3b4f1ce0d89e52e8e1e7e1005bd4ffd61a2124dbd2257a461520986b692a66d
b61c2c46c1b316e720610d240c7962c61c9bc9c563bfecd9757a8600b3911db0
b8affbc2a870d600ee7781415bdbd6a243fefe66a09bda17ead53f4f76473e6b
b8de89ff4641907615ff418b71867b8323f813ff3f909d3502b2e1bfa7b4db1f
bc72a2ca45067a3d17fed4cd8776fec5dca3b9ecd7300e107f9256a86a0c8b2f
c0cf1c69dbdcd8863a626a98a44418bcdab21718b8da616ab980ef2f9e1a2eee
c42b47db779f2a0082e6f0578b45adee12219add0b3f9cdd1ce3b35b7bec2d35
c57b6c25e5f956b74d8ae59c80facb76606dda637ebbe6545d700db4217d24bb
c93f24bc243c24279c6d6a6964d0aec12df58deb17e57fb84585305eb847d304
c9a54b8b2b208df021d5a0ec78985b64d297f0127ebc99698e8bbb04e0bc345b
cb31d2d43efc714642919af84920177170837267c64a8fd3cec95889f83cc276
cc1c4291e3e43108290352d25009587b2cf250c593105246c30c6c1aecc7221f
ced73b0f46b99eb9ff844aec40e2276202b7609e0996172cb162ed4ff1499f6d
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d089106e64ace7242b7aa6333cd807487c685785ac6f2c0184531dfa931c3fc2
d9f4969854fa4004e00ddf84c2ca5ada59216aef292c3f6e7a5b1a73d90646f9
dc15cb4d7b4d282233c525c6329cbbe303f6b369665824acfa9b2a1701009369
df55e1647aaa31dc1a9879bb336faa6f878d2af6aec095a3b0dff0bdd909218f
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e7f79039d300c1b7786bb1b4b016004255b1347986d7cd41d462dfc25a90ecbf
e7fd18e9f6fab6a10e786c47f1e1b25571bad7d0c861f88177109aa9385b8f77
e802d70642825aaf1ced7d5f0dabef00ccf135c78ddd0043aba5a0422868b6b2
eafd6fb3d154d31515529630af541f90ce3b8104dd0a1fa4e87fb0b075eb23fa
f0b9a9e4ea994c106a4fc595828ca1332b2cd0435d5d159d26d1773344d97367
f0cbdc66db5736288544aac55db88fee2d338950254123f5656619eed8c1b12e
f1ea07a1e51a389c8de07120ae5c2e432e9dd8f4fbd6f92489f185b0523a3fd4
f57137897a4e676f0d2199b79def1a95b253a1a938dff9d8ba10519f3beb2b08
f69fb1f1bdac04c805e171640feeb26af4c57592cf81f5bbfb4421403e4c9c62
fa2cb9576d3fc35ea9c27219303b2319c294f370fa84de3fd1fc45cb3dafb40d

posts.specterops.io Open in urlscan Pro 52.6.3.192 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

97 Requests

100 %HTTPS

57 %IPv6

10 Domains

16 Subdomains

14 IPs

4 Countries

1226 kBTransfer

3461 kBSize

12 Cookies

45 Outgoing links

Page URL History

Redirected requests

97 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 4 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

posts.specterops.io Open in urlscan Pro
52.6.3.192 Public Scan

Screenshot
Live screenshot

Full Image

97
Requests

100 %
HTTPS

57 %
IPv6

10
Domains

16
Subdomains

14
IPs

4
Countries

1226 kB
Transfer

3461 kB
Size

12
Cookies

97 HTTP transactions
4 data transactions