urlscan.io logo urlscan.io
SecurityTrails logo

pentestlab.blog Open in urlscan Pro
192.0.78.24  Public Scan

Go To Rescan Add Verdict Report
URL: https://pentestlab.blog/2017/05/29/applocker-bypass-msbuild/
Submission: On February 19 via api from BE — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 13 IPs in 3 countries across 9 domains to perform 100 HTTP transactions. The main IP is 192.0.78.24, located in San Francisco, United States and belongs to AUTOMATTIC, US. The main domain is pentestlab.blog.
TLS certificate: Issued by R3 on January 7th 2024. Valid for: 3 months.
This is the only time pentestlab.blog was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
3 192.0.78.24 2635 (AUTOMATTIC)
64 192.0.77.32 2635 (AUTOMATTIC)
11 192.0.72.29 2635 (AUTOMATTIC)
3 2a04:fa87:fff... 2635 (AUTOMATTIC)
4 192.0.123.248 ()
5 192.0.76.3 2635 (AUTOMATTIC)
2 2a03:2880:f08... 32934 (FACEBOOK)
2 4 2a03:2880:f17... 32934 (FACEBOOK)
1 151.101.0.84 54113 (FASTLY)
1 192.0.78.18 2635 (AUTOMATTIC)
1 192.0.78.23 2635 (AUTOMATTIC)
2 192.0.123.249 2635 (AUTOMATTIC)
100 13
3    192.0.78.24 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)
pentestlab.blog
64    192.0.77.32 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)
PTR: wordpress.com
s0.wp.com
fonts-api.wp.com
fonts.wp.com
widgets.wp.com
11    192.0.72.29 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)
pentestlab.files.wordpress.com
3    2a04:fa87:fffe::c000:4902 (Ireland)

ASN2635 (AUTOMATTIC, US)
0.gravatar.com
4    192.0.123.248 (Los Angeles, United States)

ASN- ()
PTR: polldaddy.com
polldaddy.com
5    192.0.76.3 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)
stats.wp.com
pixel.wp.com
2    2a03:2880:f084:105:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)
connect.facebook.net
4    2a03:2880:f177:185:face:b00c:0:25de (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)
www.facebook.com
1    151.101.0.84 (United States)

ASN54113 (FASTLY, US)
api.pinterest.com
1    192.0.78.18 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)
r-login.wordpress.com
1    192.0.78.23 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)
public-api.wordpress.com
2    192.0.123.249 (Los Angeles, United States)

ASN2635 (AUTOMATTIC, US)
PTR: polldaddy.com
api.crowdsignal.com
Apex Domain
Subdomains		 Transfer
69 wp.com
s0.wp.com — Cisco Umbrella Rank: 8913
fonts-api.wp.com — Cisco Umbrella Rank: 19067
stats.wp.com — Cisco Umbrella Rank: 3005
fonts.wp.com — Cisco Umbrella Rank: 20042
widgets.wp.com — Cisco Umbrella Rank: 12628
pixel.wp.com — Cisco Umbrella Rank: 2945
916 KB
13 wordpress.com
pentestlab.files.wordpress.com
r-login.wordpress.com — Cisco Umbrella Rank: 31029
public-api.wordpress.com — Cisco Umbrella Rank: 10202
409 KB
4 facebook.com
www.facebook.com — Cisco Umbrella Rank: 114
3 KB
4 polldaddy.com
polldaddy.com — Cisco Umbrella Rank: 42863
10 KB
3 gravatar.com
0.gravatar.com — Cisco Umbrella Rank: 9659
9 KB
3 pentestlab.blog
pentestlab.blog
34 KB
2 crowdsignal.com
api.crowdsignal.com — Cisco Umbrella Rank: 630144
436 B
2 facebook.net
connect.facebook.net — Cisco Umbrella Rank: 191
89 KB
1 pinterest.com
api.pinterest.com — Cisco Umbrella Rank: 2930
385 B
100 9
Domain Requested by
56 s0.wp.com pentestlab.blog
s0.wp.com
widgets.wp.com
public-api.wordpress.com
11 pentestlab.files.wordpress.com pentestlab.blog
5 fonts.wp.com fonts-api.wp.com
4 pixel.wp.com pentestlab.blog
4 www.facebook.com 2 redirects connect.facebook.net
4 polldaddy.com pentestlab.blog
polldaddy.com
3 0.gravatar.com pentestlab.blog
0.gravatar.com
3 pentestlab.blog s0.wp.com
2 api.crowdsignal.com s0.wp.com
2 connect.facebook.net s0.wp.com
connect.facebook.net
2 fonts-api.wp.com pentestlab.blog
s0.wp.com
1 public-api.wordpress.com s0.wp.com
1 r-login.wordpress.com pentestlab.blog
1 api.pinterest.com s0.wp.com
1 widgets.wp.com pentestlab.blog
1 stats.wp.com pentestlab.blog
100 16
Subject Issuer Validity Valid
tls.automattic.com
R3		 2024-01-07 -
2024-04-06		 3 months crt.sh
*.wp.com
Sectigo ECC Domain Validation Secure Server CA		 2023-11-28 -
2024-12-28		 a year crt.sh
*.files.wordpress.com
Sectigo ECC Domain Validation Secure Server CA		 2023-12-05 -
2025-01-04		 a year crt.sh
*.gravatar.com
Sectigo ECC Domain Validation Secure Server CA		 2023-12-05 -
2025-01-04		 a year crt.sh
*.polldaddy.com
Sectigo RSA Domain Validation Secure Server CA		 2023-11-02 -
2024-12-02		 a year crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA		 2023-11-28 -
2024-02-26		 3 months crt.sh
*.pinterest.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1		 2023-07-31 -
2024-08-07		 a year crt.sh
*.wordpress.com
Sectigo ECC Domain Validation Secure Server CA		 2023-12-05 -
2025-01-04		 a year crt.sh
api.crowdsignal.com
Sectigo RSA Domain Validation Secure Server CA		 2023-10-30 -
2024-11-29		 a year crt.sh

This page contains 6 frames:

Primary Page: https://pentestlab.blog/2017/05/29/applocker-bypass-msbuild/
Frame ID: 5B75A246328125F6AC4C20ACC2EE1958
Requests: 92 HTTP requests in this frame

Frame: https://www.facebook.com/login/?next=https%3A%2F%2Fwww.facebook.com%2Fplugins%2Fpage.php%3Fapp_id%3D249643311490%26channel%3Dhttps%253A%252F%252Fstaticxx.facebook.com%252Fx%252Fconnect%252Fxd_arbiter%252F%253Fversion%253D46%2523cb%253Dff5905bfe303ff3a3%2526domain%253Dpentestlab.blog%2526is_canvas%253Dfalse%2526origin%253Dhttps%25253A%25252F%25252Fpentestlab.blog%25252Ff180de6b96a948ca7%2526relation%253Dparent.parent%26container_width%3D342%26height%3D432%26hide_cover%3Dfalse%26hide_cta%3Dfalse%26href%3Dhttps%253A%252F%252Fwww.facebook.com%252Fpentestlaboratory%252F%26locale%3Den_US%26sdk%3Djoey%26show_facepile%3Dtrue%26small_header%3Dfalse%26tabs%3Dfalse%26width%3D200
Frame ID: 9C16171F64E7502C7F7288892154D55D
Requests: 1 HTTP requests in this frame

Frame: https://widgets.wp.com/likes/master.html?ver=202402081217
Frame ID: AB25D6C86A2080071443B7B2ABCDFA7D
Requests: 3 HTTP requests in this frame

Frame: https://r-login.wordpress.com/remote-login.php?wpcom_remote_login=key&origin=aHR0cHM6Ly9wZW50ZXN0bGFiLmJsb2c%3D&wpcomid=32637504&time=1708333457
Frame ID: 2CCEE61D3B1BDEF52FE30B8F84E3B62F
Requests: 1 HTTP requests in this frame

Frame: https://public-api.wordpress.com/wp-admin/rest-proxy/
Frame ID: 96765221262EE33DE5A1F1D825408D96
Requests: 2 HTTP requests in this frame

Frame: https://www.facebook.com/login/?next=https%3A%2F%2Fwww.facebook.com%2Fplugins%2Fpage.php%3Fapp_id%3D249643311490%26channel%3Dhttps%253A%252F%252Fstaticxx.facebook.com%252Fx%252Fconnect%252Fxd_arbiter%252F%253Fversion%253D46%2523cb%253Df0aa855d4dded94ac%2526domain%253Dpentestlab.blog%2526is_canvas%253Dfalse%2526origin%253Dhttps%25253A%25252F%25252Fpentestlab.blog%25252Ff180de6b96a948ca7%2526relation%253Dparent.parent%26container_width%3D0%26height%3D432%26hide_cover%3Dfalse%26hide_cta%3Dfalse%26href%3Dhttps%253A%252F%252Fwww.facebook.com%252Fpentestlaboratory%252F%26locale%3Den_US%26sdk%3Djoey%26show_facepile%3Dtrue%26small_header%3Dfalse%26tabs%3Dfalse%26width%3D200
Frame ID: D9EE96B3715D202213744FFD01A83EAA
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

AppLocker Bypass – MSBuild – Penetration Testing Lab

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link[^>]+s\d+\.wp\.com
  • /wp-(?:content|includes)/
Overall confidence: 100%
Detected patterns
  • //connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js
Overall confidence: 100%
Detected patterns
  • (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Overall confidence: 100%
Detected patterns
  • lodash.*\.js
Overall confidence: 100%
Detected patterns
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

100
Requests

99 %
HTTPS

25 %
IPv6

9
Domains

16
Subdomains

13
IPs

3
Countries

1474 kB
Transfer

2943 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 76
  • https://www.facebook.com/v2.3/plugins/page.php?app_id=249643311490&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Dff5905bfe303ff3a3%26domain%3Dpentestlab.blog%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Fpentestlab.blog%252Ff180de6b96a948ca7%26relation%3Dparent.parent&container_width=342&height=432&hide_cover=false&hide_cta=false&href=https%3A%2F%2Fwww.facebook.com%2Fpentestlaboratory%2F&locale=en_US&sdk=joey&show_facepile=true&small_header=false&tabs=false&width=200 HTTP 302
  • https://www.facebook.com/login/?next=https%3A%2F%2Fwww.facebook.com%2Fplugins%2Fpage.php%3Fapp_id%3D249643311490%26channel%3Dhttps%253A%252F%252Fstaticxx.facebook.com%252Fx%252Fconnect%252Fxd_arbiter%252F%253Fversion%253D46%2523cb%253Dff5905bfe303ff3a3%2526domain%253Dpentestlab.blog%2526is_canvas%253Dfalse%2526origin%253Dhttps%25253A%25252F%25252Fpentestlab.blog%25252Ff180de6b96a948ca7%2526relation%253Dparent.parent%26container_width%3D342%26height%3D432%26hide_cover%3Dfalse%26hide_cta%3Dfalse%26href%3Dhttps%253A%252F%252Fwww.facebook.com%252Fpentestlaboratory%252F%26locale%3Den_US%26sdk%3Djoey%26show_facepile%3Dtrue%26small_header%3Dfalse%26tabs%3Dfalse%26width%3D200
Request Chain 91
  • https://www.facebook.com/v2.3/plugins/page.php?app_id=249643311490&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df0aa855d4dded94ac%26domain%3Dpentestlab.blog%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Fpentestlab.blog%252Ff180de6b96a948ca7%26relation%3Dparent.parent&container_width=0&height=432&hide_cover=false&hide_cta=false&href=https%3A%2F%2Fwww.facebook.com%2Fpentestlaboratory%2F&locale=en_US&sdk=joey&show_facepile=true&small_header=false&tabs=false&width=200 HTTP 302
  • https://www.facebook.com/login/?next=https%3A%2F%2Fwww.facebook.com%2Fplugins%2Fpage.php%3Fapp_id%3D249643311490%26channel%3Dhttps%253A%252F%252Fstaticxx.facebook.com%252Fx%252Fconnect%252Fxd_arbiter%252F%253Fversion%253D46%2523cb%253Df0aa855d4dded94ac%2526domain%253Dpentestlab.blog%2526is_canvas%253Dfalse%2526origin%253Dhttps%25253A%25252F%25252Fpentestlab.blog%25252Ff180de6b96a948ca7%2526relation%253Dparent.parent%26container_width%3D0%26height%3D432%26hide_cover%3Dfalse%26hide_cta%3Dfalse%26href%3Dhttps%253A%252F%252Fwww.facebook.com%252Fpentestlaboratory%252F%26locale%3Den_US%26sdk%3Djoey%26show_facepile%3Dtrue%26small_header%3Dfalse%26tabs%3Dfalse%26width%3D200

100 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
pentestlab.blog/2017/05/29/applocker-bypass-msbuild/ 		154 KB
33 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://pentestlab.blog/2017/05/29/applocker-bypass-msbuild/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.24 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
8b3a8a246c45119b67a073294f5e93182f758dacaa75dc2c628055f9d5ddc5da
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
content-encoding
br
content-type
text/html; charset=UTF-8
date
Mon, 19 Feb 2024 09:04:17 GMT
host-header
WordPress.com
link
<https://wp.me/p2cWvm-1Mf>; rel=shortlink
server
nginx
strict-transport-security
max-age=31536000
vary
Accept-Encoding accept, content-type, cookie
x-ac
2.hhn _dfw EXPIRED
x-hacker
Want root? Visit join.a8c.com/hacker and mention this header.
x-pingback
https://pentestlab.blog/xmlrpc.php
/
s0.wp.com/_static/ 		10 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://s0.wp.com/_static/??-eJzTLy/QTc7PK0nNK9HPLdUtyClNz8wr1s9KLSlITM6G8vVz8/NBREppTmqxflFqTmJJaopuQX5xCRpPL7m4WEcfu5E5mdmpCIPBPJBy+1xbQ3MDUxNjcwNzyywAYHY02w==&cssminify=yes
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/29/applocker-bypass-msbuild/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
376eacb307ddbfb56e702fe1c39363c70218d2e4ac32d7ba96f0403da942a093

Request headers

Referer
https://pentestlab.blog/
Origin
https://pentestlab.blog
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

x-nc
HIT hhn 2
date
Mon, 19 Feb 2024 09:04:17 GMT
content-encoding
br
x-ac
2.hhn _dfw BYPASS
last-modified
Tue, 16 Jan 2024 20:31:28 GMT
server
nginx
etag
W/"65a6e7a0-27f9"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
text/css;charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
timing-allow-origin
*
alt-svc
h3=":443"; ma=86400
expires
Wed, 15 Jan 2025 20:56:27 GMT
/
s0.wp.com/_static/ 		113 KB
16 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://s0.wp.com/_static/??-eJylzFsOQDAQQNEN0dEQ5UOsRWtSZfpIH8TuiS34vLnJgSvUyruMLkOgoo1LoMubEqN+T0Q4uWCCNSCLoRUkeXXUZGRc4g0p34RMpVTBPyhvaD9othMXjRjbfuja/QEnejhk&cssminify=yes
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/29/applocker-bypass-msbuild/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
b09821aed363061c36adeda7e8f1c685e6cd1abd99416c04c656d1b3a348cb7c

Request headers

Referer
https://pentestlab.blog/
Origin
https://pentestlab.blog
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

x-nc
HIT hhn 2
date
Mon, 19 Feb 2024 09:04:17 GMT
content-encoding
br
x-ac
2.hhn _dfw BYPASS
last-modified
Wed, 14 Feb 2024 18:54:24 GMT
server
nginx
etag
W/"65cd0c60-1c3a3"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
text/css;charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
timing-allow-origin
*
alt-svc
h3=":443"; ma=86400
expires
Thu, 13 Feb 2025 19:53:46 GMT
/
s0.wp.com/_static/ 		15 KB
4 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://s0.wp.com/_static/??-eJzTLy/QzcxLzilNSS3WzyrWz01NyUxMzUnNTc0rQeEU5CRWphbp5qSmJyZX6uVm5uklFxfr6OPTDpRD5sM02efaGpoZmFkYGRuZGmQBAHPvL0Y=&cssminify=yes
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/29/applocker-bypass-msbuild/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
3d2c10cf69410c10177fc6e56937d05151b182841fa6aee36f651d587d91fbb8

Request headers

Referer
https://pentestlab.blog/
Origin
https://pentestlab.blog
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

x-nc
HIT hhn 2
date
Mon, 19 Feb 2024 09:04:17 GMT
content-encoding
br
x-ac
2.hhn _dfw BYPASS
last-modified
Sun, 19 Dec 2021 04:30:58 GMT
server
nginx
etag
W/"61beb582-3ca1"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
text/css;charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
timing-allow-origin
*
alt-svc
h3=":443"; ma=86400
expires
Thu, 14 Mar 2024 19:36:42 GMT
webfont.js
s0.wp.com/wp-content/plugins/custom-fonts/js/ 		12 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s0.wp.com/wp-content/plugins/custom-fonts/js/webfont.js
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/29/applocker-bypass-msbuild/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
738223eb8c8c70913bf59775dc575c205070014babc8b174fd3ab8e6082ebe30

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pentestlab.blog/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

x-minify-cache
hit
date
Mon, 19 Feb 2024 09:04:17 GMT
content-encoding
br
x-ac
2.hhn _dca MISS
x-minify
t
alt-svc
h3=":443"; ma=86400
x-nc
HIT hhn 1
server
nginx
etag
W/12493-1684460879556.3713
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31536000
timing-allow-origin
*
expires
Wed, 29 May 2024 20:23:52 GMT
/
s0.wp.com/_static/ 		52 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://s0.wp.com/_static/??-eJyVzDEOgCAMQNELiQU1Jg7Gs2AlDYpAaInx9ro5O/7hfbiywhTFRYEcKvnIQPXN1RVSa0h4MOxOssVDBXunKoqK34DlDq5F5gb+LIoVH4k/vpyzGYe+03oyw/4AcmU1KQ==&cssminify=yes
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/29/applocker-bypass-msbuild/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
66f69ace341969d16b2b3709a823e62788c738e6170a9689dbe75b18e48d5453

Request headers

Referer
https://pentestlab.blog/
Origin
https://pentestlab.blog
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

x-nc
HIT hhn 2
date
Mon, 19 Feb 2024 09:04:17 GMT
content-encoding
br
x-ac
2.hhn _dfw BYPASS
last-modified
Wed, 26 Jan 2022 12:42:16 GMT
server
nginx
etag
W/"61f141a8-d0bc"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
text/css;charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
timing-allow-origin
*
alt-svc
h3=":443"; ma=86400
expires
Thu, 14 Mar 2024 20:18:54 GMT
/
s0.wp.com/_static/ 		369 B
673 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://s0.wp.com/_static/??/wp-content/mu-plugins/core-compat/wp-mediaelement.css,/wp-content/mu-plugins/wpcom-bbpress-premium-themes.css?m=1432920480j&cssminify=yes
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/29/applocker-bypass-msbuild/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
9c83b89ab9d2677980617afacb833a74da3050a2d3d711176b500d7922e49ab5

Request headers

Referer
https://pentestlab.blog/
Origin
https://pentestlab.blog
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

x-nc
HIT hhn 2
date
Mon, 19 Feb 2024 09:04:17 GMT
x-ac
2.hhn _dfw MISS
last-modified
Fri, 19 May 2023 03:00:34 GMT
server
nginx
etag
"6466e652-171"
access-control-allow-methods
GET, HEAD
content-type
text/css;charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
timing-allow-origin
*
alt-svc
h3=":443"; ma=86400
content-length
369
expires
Sat, 09 Nov 2024 15:12:41 GMT
verbum-comments.css
s0.wp.com/wp-content/mu-plugins/jetpack-mu-wpcom-plugin/moon/vendor/automattic/jetpack-mu-wpcom/src/build/verbum-comments/ 		26 KB
4 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://s0.wp.com/wp-content/mu-plugins/jetpack-mu-wpcom-plugin/moon/vendor/automattic/jetpack-mu-wpcom/src/build/verbum-comments/verbum-comments.css?m=1706206268i&cssminify=yes
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/29/applocker-bypass-msbuild/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
3a6eca802634248cd9896666cb3a031eabf070b1d11a7ce6bb361b1811cd67a2

Request headers

Referer
https://pentestlab.blog/
Origin
https://pentestlab.blog
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

x-minify-cache
hit
date
Mon, 19 Feb 2024 09:04:17 GMT
content-encoding
br
x-ac
2.hhn _dfw BYPASS
x-minify
t
alt-svc
h3=":443"; ma=86400
x-nc
HIT hhn 2
server
nginx
etag
W/26497-1706206277763.029
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=31536000
timing-allow-origin
*
expires
Fri, 24 Jan 2025 18:21:20 GMT
css
fonts-api.wp.com/ 		2 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts-api.wp.com/css?family=Open%2BSans%3A400%2C400italic%2C700%2C700italic%7CMontserrat%3A500&subset=latin%2Clatin-ext&ver=6.5-alpha-57492
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/29/applocker-bypass-msbuild/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
dd79ce63ce5a132125a6d7b35c694ccae6c4b9b8be39c9e34ed59ee747999575
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pentestlab.blog/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date
Mon, 19 Feb 2024 09:04:17 GMT
strict-transport-security
max-age=31536000
x-content-type-options
nosniff
content-encoding
gzip
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
x-xss-protection
0
x-nc
BYPASS hhn 1
last-modified
Mon, 19 Feb 2024 09:04:17 GMT
server
nginx
cross-origin-opener-policy
same-origin-allow-popups
vary
Accept-Encoding, Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
/
s0.wp.com/_static/ 		60 KB
14 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://s0.wp.com/_static/??-eJzTLy/QTc7PK0nNK9EvyUjNTS3WLyhKzc0szQVx0/JLi/STi4v104BKdBPLU4vzc1P1gAI6+oT1FZdU5oAV2+faGpoZG5gamBsammYBAMXNKeE=&cssminify=yes
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/29/applocker-bypass-msbuild/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
017bccf545b2ffdfa4d25b1b7a47d847a1c03c00d9a60426cdaed49cf7bbe2da

Request headers

Referer
https://pentestlab.blog/
Origin
https://pentestlab.blog
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

x-nc
HIT hhn 2
date
Mon, 19 Feb 2024 09:04:17 GMT
content-encoding
br
x-ac
2.hhn _dfw BYPASS
last-modified
Sun, 19 Dec 2021 04:32:21 GMT
server
nginx
etag
W/"61beb5d5-f188"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
text/css;charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
timing-allow-origin
*
alt-svc
h3=":443"; ma=86400
expires
Thu, 14 Mar 2024 19:39:42 GMT
/
s0.wp.com/_static/ 		3 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://s0.wp.com/_static/??-eJx9jMEKwjAQRH/IuASp1IP4LXG7hq2bbOgm9PebgocK4mWYB/MG1uJQc6VcITVXpEXOBjPVEvD9YUiqe0xNyGDlKVI1MEUO4rjr33BGsxP8Po6kThRD5f54BPeSwMs/daGnaOw1Ql8dcJce6e6v4+AvfrwN8wY7+0+0&cssminify=yes
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/29/applocker-bypass-msbuild/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
70746c461d32b81951f85b1da353e29d43410ae13916ae31b845a0bcbf4e197f

Request headers

Referer
https://pentestlab.blog/
Origin
https://pentestlab.blog
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

x-nc
HIT hhn 2
date
Mon, 19 Feb 2024 09:04:17 GMT
content-encoding
br
x-ac
2.hhn _dfw BYPASS
last-modified
Fri, 26 May 2023 20:11:51 GMT
server
nginx
etag
W/"64711287-d2a"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
text/css;charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
timing-allow-origin
*
alt-svc
h3=":443"; ma=86400
expires
Wed, 29 May 2024 16:14:12 GMT
/
s0.wp.com/_static/ 		30 KB
11 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://s0.wp.com/_static/??-eJyNjcEKwjAQRH/IuAYr9SJ+iqSbkKRudoObIP59W/EiXrwM82B4A89qULgFblC6qdRjZoU5tOrw/mEoIlv4TkFBk3sE77x/vWvmuEfVHfxvumVGUMHsyJBE0S/4sbUUyvqbBogkk6NtcC0XOx6O9jyeBjsvURNJIw==&cssminify=yes
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/29/applocker-bypass-msbuild/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
861af5dd96b652ea4e711b9377e771b5200b235ad71b216dd0ba669e640f0822

Request headers

Referer
https://pentestlab.blog/
Origin
https://pentestlab.blog
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

x-nc
HIT hhn 2
date
Mon, 19 Feb 2024 09:04:17 GMT
content-encoding
br
x-ac
2.hhn _dfw BYPASS
last-modified
Thu, 21 Dec 2023 19:39:10 GMT
server
nginx
etag
W/"6584945e-769e"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
text/css;charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
timing-allow-origin
*
alt-svc
h3=":443"; ma=86400
expires
Sat, 21 Dec 2024 13:44:10 GMT
/
s0.wp.com/_static/ 		133 KB
44 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s0.wp.com/_static/??-eJyFT0FOAzEM/BCptwdU9YB4SpXdmJXTxA62U+jvSaUFFQTiZM14POOBtxYWYUd2yAZVZioYuqHGdXCB+EV22R7gTld7aKWvxAYZvcXlvOFxLgwn4gXmTiWBYomOKTQxt+9oV4l/Go8HtHhoKu/Xz90wKz2h3Zb5taNet3Fv8KcoVFp1hP6W9k+NjTtdkJMoxO5SozstX+oLJZSmaLbVLTSDyxk5zEppxZH4XJ/2h2maDvvH45Q/AEsiiTU=
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/29/applocker-bypass-msbuild/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
cf75f45164a049900471e9bc171c299121e16f3675651b92ee8ca43dc974d64a

Request headers

Referer
https://pentestlab.blog/
Origin
https://pentestlab.blog
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

x-nc
HIT hhn 2
date
Mon, 19 Feb 2024 09:04:17 GMT
content-encoding
br
x-ac
2.hhn _dfw BYPASS
last-modified
Wed, 15 Nov 2023 18:06:41 GMT
server
nginx
etag
W/"655508b1-2146a"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31536000
timing-allow-origin
*
alt-svc
h3=":443"; ma=86400
expires
Thu, 14 Nov 2024 18:33:03 GMT
generation-of-c-shellcode.png
pentestlab.files.wordpress.com/2017/05/ 		269 KB
270 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pentestlab.files.wordpress.com/2017/05/generation-of-c-shellcode.png
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/29/applocker-bypass-msbuild/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.72.29 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
fa05d541ee61f9bb7ef491217c0832f45a6be57be62c00cbc3b7c63a7ef86603
Security Headers
Name Value
X-Content-Type-Options nosniff, nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pentestlab.blog/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

x-nc
HIT hhn 29 np
date
Mon, 19 Feb 2024 09:04:17 GMT
x-content-type-options
nosniff, nosniff
last-modified
Mon, 29 May 2017 18:24:06 GMT
server
nginx
x-orig-src
0_imageresize
vary
Accept, Origin
content-type
image/webp
access-control-allow-origin
https://pentestlab.wordpress.com
access-control-allow-credentials
true
accept-ranges
bytes
alt-svc
h3=":443"; ma=86400
content-length
275896
expires
Tue, 27 Feb 2024 06:34:00 GMT
executing-shellcode-via-msbuild.png
pentestlab.files.wordpress.com/2017/05/ 		2 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pentestlab.files.wordpress.com/2017/05/executing-shellcode-via-msbuild.png
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/29/applocker-bypass-msbuild/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.72.29 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
b2f4ce6ff2c8847c7e0c92f35ef61a5b36e5048733080b7cc1a81b8399014aff
Security Headers
Name Value
X-Content-Type-Options nosniff, nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pentestlab.blog/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

x-nc
HIT hhn 29 np
date
Mon, 19 Feb 2024 09:04:17 GMT
x-content-type-options
nosniff, nosniff
last-modified
Mon, 29 May 2017 21:21:06 GMT
server
nginx
x-orig-src
0_imageresize
vary
Accept, Origin
content-type
image/webp
access-control-allow-origin
https://pentestlab.wordpress.com
access-control-allow-credentials
true
accept-ranges
bytes
alt-svc
h3=":443"; ma=86400
content-length
2528
expires
Tue, 05 Mar 2024 06:15:48 GMT
meterpreter-via-msbuild.png
pentestlab.files.wordpress.com/2017/05/ 		67 KB
68 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pentestlab.files.wordpress.com/2017/05/meterpreter-via-msbuild.png
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/29/applocker-bypass-msbuild/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.72.29 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
4a405940a0d64eba67299cc8d915f3afbf8db9c3683d90cbfe12484dfbc26b40
Security Headers
Name Value
X-Content-Type-Options nosniff, nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pentestlab.blog/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

x-nc
HIT hhn 29 np
date
Mon, 19 Feb 2024 09:04:17 GMT
x-content-type-options
nosniff, nosniff
last-modified
Mon, 29 May 2017 21:20:03 GMT
server
nginx
x-orig-src
0_imageresize
vary
Accept, Origin
content-type
image/webp
access-control-allow-origin
https://pentestlab.wordpress.com
access-control-allow-credentials
true
accept-ranges
bytes
alt-svc
h3=":443"; ma=86400
content-length
69062
expires
Sat, 16 Mar 2024 12:51:16 GMT
hovercards.min.js
0.gravatar.com/js/hovercards/ 		13 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://0.gravatar.com/js/hovercards/hovercards.min.js?ver=202408131f6b765e798866d728f95661b78bbf269c86482ffff0fa8c08e18a1a65cc89
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/29/applocker-bypass-msbuild/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
131f6b765e798866d728f95661b78bbf269c86482ffff0fa8c08e18a1a65cc89
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubdomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pentestlab.blog/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date
Mon, 19 Feb 2024 09:04:17 GMT
strict-transport-security
max-age=31536000; includeSubdomains; preload
content-encoding
br
last-modified
Tue, 28 Nov 2023 13:47:28 GMT
server
nginx
etag
W/"6565ef70-329d"
content-type
application/javascript
cache-control
max-age=604800
alt-svc
h3=":443"; ma=86400
expires
Mon, 26 Feb 2024 09:04:17 GMT
wpgroho.js
s0.wp.com/wp-content/mu-plugins/gravatar-hovercards/ 		655 B
703 B 		Script
General
Check archive.org
Download Go to
Full URL
https://s0.wp.com/wp-content/mu-plugins/gravatar-hovercards/wpgroho.js?m=1610363240i
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/29/applocker-bypass-msbuild/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
b6e4492d3b8358a81b80908b1f84e6bd2f64a7a46d48793af99d27bf29f4c2e8

Request headers

Referer
https://pentestlab.blog/
Origin
https://pentestlab.blog
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

x-minify-cache
hit
date
Mon, 19 Feb 2024 09:04:17 GMT
content-encoding
br
x-ac
2.hhn _dfw BYPASS
x-minify
t
alt-svc
h3=":443"; ma=86400
x-nc
HIT hhn 2
server
nginx
etag
W/1125-1684460931415.6394
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31536000
timing-allow-origin
*
expires
Thu, 30 May 2024 20:22:44 GMT
wpcom-gray-white.png
s0.wp.com/i/logo/ 		8 KB
8 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s0.wp.com/i/logo/wpcom-gray-white.png
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/29/applocker-bypass-msbuild/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
c0e93b5ebf107af77d9e7d101d186b3b93e9d5ad4fbb6a74e2dea60173cc04f8

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pentestlab.blog/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

x-nc
HIT hhn 1
date
Mon, 19 Feb 2024 09:04:17 GMT
x-ac
2.hhn _dca MISS
last-modified
Fri, 19 May 2023 01:51:42 GMT
server
nginx
etag
"6466d62e-200b"
access-control-allow-methods
GET, HEAD
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3=":443"; ma=86400
content-length
8203
expires
Sat, 09 Nov 2024 15:12:16 GMT
/
s0.wp.com/_static/ 		32 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s0.wp.com/_static/??-eJzTLy/QTc7PK0nNK9EvyClNz8wr1i+uzCtJrMjITM/IAeKS1CJMEWP94uSizIISoOIM5/yiVL2sYh19yo1yKioFmldcDDTOPtfW0MzQ1MTczNLYKAsAj5w/sg==
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/29/applocker-bypass-msbuild/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
de82ba6d47c0b4495e7dc26891a7ef82f1f07730df39a5375343b341c4eec13d

Request headers

Referer
https://pentestlab.blog/
Origin
https://pentestlab.blog
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

x-nc
HIT hhn 2
date
Mon, 19 Feb 2024 09:04:17 GMT
content-encoding
br
x-ac
2.hhn _dfw BYPASS
last-modified
Fri, 19 May 2023 01:48:47 GMT
server
nginx
etag
W/"6466d57f-8144"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31536000
timing-allow-origin
*
alt-svc
h3=":443"; ma=86400
expires
Sat, 09 Nov 2024 15:26:26 GMT
/
s0.wp.com/_static/ 		177 KB
54 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://s0.wp.com/_static/??-eJyljksOwjAMRC9E6lYgAgvEWdLEhBTnozih4vakUssGiQ0bS2OP5w3MSegYCoYCvopE1brAMGFJSj9WDT7GZZhKyKBVjpWRgGeXMIuxBkPYaeYd/JG2mbbFJ9AFTdUsVmYwiu+uIbjzLnwxN6CtTY6YbbtkhOcgO9n1MFZHBnT0KYZmZ+Dy+t1c5zgbdjYoEreYPa8ZKiVSreXye/WXQfbyvD+eDvvpDcoZfjQ=&cssminify=yes
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/29/applocker-bypass-msbuild/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
d15b8523b7c7901946b1c21bc80d4c537a887402002a13ac81a8e8d228880219

Request headers

Referer
https://pentestlab.blog/
Origin
https://pentestlab.blog
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

x-nc
HIT hhn 2
date
Mon, 19 Feb 2024 09:04:17 GMT
content-encoding
br
x-ac
2.hhn _dfw BYPASS
last-modified
Wed, 14 Feb 2024 18:54:25 GMT
server
nginx
etag
W/"65cd0c61-2c5a9"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
text/css;charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
timing-allow-origin
*
alt-svc
h3=":443"; ma=86400
expires
Fri, 14 Feb 2025 16:26:58 GMT
/
s0.wp.com/_static/ 		60 KB
19 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s0.wp.com/_static/??-eJydkN1qwzAMhV9ojjJyUXox9ihDsZVWiWV5/mnp29ddmzFIYWNXRkefjw4HztFYDYVCAakm+nrgkMHzQhk+K1U6YnCeUjfnF3gOz1Qi2sU06RytymMBohrgRMFpAqxFBUthu8EhJwtjZe8anMYq7YZIu5EBc6b2uEtAYWu8otsmKUeSFjYmEq5yGyetCeYMAU98wMIa/v4n28SxrDwH66trZNs8UplE0V864Y3pk0p+NvHRzGBCS6PqYkhGcv9xuDdlMWnN5L+5VfglGC6chYoZuv5utwpT+oJvkd7l7XXX74Z93++H+Qpvbs0m
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/29/applocker-bypass-msbuild/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
4dd338d49738b699a41993a965b1e6a8755ef8d0d5252ee3341a2707227580e4

Request headers

Referer
https://pentestlab.blog/
Origin
https://pentestlab.blog
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

x-nc
HIT hhn 2
date
Mon, 19 Feb 2024 09:04:17 GMT
content-encoding
br
x-ac
2.hhn _dfw BYPASS
last-modified
Thu, 08 Feb 2024 11:01:40 GMT
server
nginx
etag
W/"65c4b494-f03c"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31536000
timing-allow-origin
*
alt-svc
h3=":443"; ma=86400
expires
Fri, 07 Feb 2025 21:36:43 GMT
lodash.min.js
s0.wp.com/wp-includes/js/dist/vendor/ 		69 KB
25 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s0.wp.com/wp-includes/js/dist/vendor/lodash.min.js?m=1690990124i&ver=4.17.21
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/29/applocker-bypass-msbuild/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
211fdb26a74dac46f2bd297c0f02953de9e69355035cad239d87acf21c5a6a0e

Request headers

Referer
https://pentestlab.blog/
Origin
https://pentestlab.blog
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

x-nc
HIT hhn 2
date
Mon, 19 Feb 2024 09:04:17 GMT
content-encoding
br
x-ac
2.hhn _dfw BYPASS
last-modified
Wed, 02 Aug 2023 15:29:04 GMT
server
nginx
etag
W/"64ca7640-115ad"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31536000
timing-allow-origin
*
alt-svc
h3=":443"; ma=86400
expires
Wed, 18 Dec 2024 12:28:46 GMT
/
s0.wp.com/_static/ 		127 KB
40 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s0.wp.com/_static/??-eJzTLy/QzcxLzilNSS3WzyrWT8ksLtEvS81LyS/SB0oV5OdUpmXm5ADVpBaV6OVm5ullFevo49FUlJqeClSbWJJfpFtUmleSmZtKjDYku6DK7XNtDc0sLY0sTYwtLbMA5bE9uw==
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/29/applocker-bypass-msbuild/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
50b14ff286671974963967fd56c5d06430fea5b81ab695665752ae76236828fe

Request headers

Referer
https://pentestlab.blog/
Origin
https://pentestlab.blog
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

x-nc
HIT hhn 2
date
Mon, 19 Feb 2024 09:04:17 GMT
content-encoding
br
x-ac
2.hhn _dfw BYPASS
last-modified
Mon, 06 Nov 2023 18:13:39 GMT
server
nginx
etag
W/"65492cd3-1fb8a"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31536000
timing-allow-origin
*
alt-svc
h3=":443"; ma=86400
expires
Tue, 05 Nov 2024 18:14:12 GMT
react.min.js
s0.wp.com/wp-content/plugins/gutenberg-core/v17.7.0/build/vendors/ 		10 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s0.wp.com/wp-content/plugins/gutenberg-core/v17.7.0/build/vendors/react.min.js?m=1707936843i&ver=18
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/29/applocker-bypass-msbuild/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
a851ac2edc584a3b08c0a057bb2d0c08ac95c4de2cc453e22a2c83305cce3694

Request headers

Referer
https://pentestlab.blog/
Origin
https://pentestlab.blog
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

x-nc
HIT hhn 2
date
Mon, 19 Feb 2024 09:04:17 GMT
content-encoding
br
x-ac
2.hhn _dfw MISS
last-modified
Wed, 14 Feb 2024 18:54:26 GMT
server
nginx
etag
W/"65cd0c62-2884"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31536000
timing-allow-origin
*
alt-svc
h3=":443"; ma=86400
expires
Thu, 13 Feb 2025 19:51:27 GMT
react-dom.min.js
s0.wp.com/wp-content/plugins/gutenberg-core/v17.7.0/build/vendors/ 		126 KB
42 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s0.wp.com/wp-content/plugins/gutenberg-core/v17.7.0/build/vendors/react-dom.min.js?m=1707936843i&ver=18
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/29/applocker-bypass-msbuild/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
dbba6c1c59954873629e196b8009f0a8256e66d755f889cf6c8ac4f1164d10c2

Request headers

Referer
https://pentestlab.blog/
Origin
https://pentestlab.blog
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

x-nc
HIT hhn 2
date
Mon, 19 Feb 2024 09:04:17 GMT
content-encoding
br
x-ac
2.hhn _dfw BYPASS
last-modified
Wed, 14 Feb 2024 18:54:25 GMT
server
nginx
etag
W/"65cd0c61-1f878"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31536000
timing-allow-origin
*
alt-svc
h3=":443"; ma=86400
expires
Thu, 13 Feb 2025 19:51:27 GMT
index.min.js
s0.wp.com/wp-content/plugins/gutenberg-core/v17.7.0/build/hooks/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s0.wp.com/wp-content/plugins/gutenberg-core/v17.7.0/build/hooks/index.min.js?m=1707936843i&ver=3aee234ea7807d8d70bc
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/29/applocker-bypass-msbuild/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
24004b1763b0275d5a1d9f66f08616a54b95aeec1f0034766bbb479679a82fc3

Request headers

Referer
https://pentestlab.blog/
Origin
https://pentestlab.blog
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

x-nc
HIT hhn 2
date
Mon, 19 Feb 2024 09:04:17 GMT
content-encoding
br
x-ac
2.hhn _dfw BYPASS
last-modified
Wed, 14 Feb 2024 18:54:26 GMT
server
nginx
etag
W/"65cd0c62-10a6"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31536000
timing-allow-origin
*
alt-svc
h3=":443"; ma=86400
expires
Thu, 13 Feb 2025 19:51:27 GMT
index.min.js
s0.wp.com/wp-content/plugins/gutenberg-core/v17.7.0/build/i18n/ 		9 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s0.wp.com/wp-content/plugins/gutenberg-core/v17.7.0/build/i18n/index.min.js?m=1707936843i&ver=5baa98e4345eccc97e24
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/29/applocker-bypass-msbuild/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
d743ad07240fdc75d2e2a357b4ff44b334f6d4c53683e31e824aaf61d3bad0c9

Request headers

Referer
https://pentestlab.blog/
Origin
https://pentestlab.blog
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

x-nc
HIT hhn 2
date
Mon, 19 Feb 2024 09:04:17 GMT
content-encoding
br
x-ac
2.hhn _dfw BYPASS
last-modified
Wed, 14 Feb 2024 18:54:26 GMT
server
nginx
etag
W/"65cd0c62-227d"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31536000
timing-allow-origin
*
alt-svc
h3=":443"; ma=86400
expires
Thu, 13 Feb 2025 19:51:27 GMT
index.min.js
s0.wp.com/wp-content/plugins/gutenberg-core/v17.7.0/build/url/ 		8 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s0.wp.com/wp-content/plugins/gutenberg-core/v17.7.0/build/url/index.min.js?m=1707936843i&ver=0e4121b969d6c7f2b6e9
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/29/applocker-bypass-msbuild/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
4184b0f4356e4605d8c0484f48c3e69f4840c601a4b1268f0499534e0e162802

Request headers

Referer
https://pentestlab.blog/
Origin
https://pentestlab.blog
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

x-nc
HIT hhn 2
date
Mon, 19 Feb 2024 09:04:17 GMT
content-encoding
br
x-ac
2.hhn _dfw BYPASS
last-modified
Wed, 14 Feb 2024 18:54:22 GMT
server
nginx
etag
W/"65cd0c5e-2017"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31536000
timing-allow-origin
*
alt-svc
h3=":443"; ma=86400
expires
Fri, 14 Feb 2025 14:27:50 GMT
index.min.js
s0.wp.com/wp-content/plugins/gutenberg-core/v17.7.0/build/api-fetch/ 		5 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s0.wp.com/wp-content/plugins/gutenberg-core/v17.7.0/build/api-fetch/index.min.js?m=1707936843i&ver=1d1bb669e2c3067cc691
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/29/applocker-bypass-msbuild/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
d6aa645764dc59ae4f0585681381d901f186cae336e44e1fbc8de1c0a529e7ff

Request headers

Referer
https://pentestlab.blog/
Origin
https://pentestlab.blog
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

x-nc
HIT hhn 2
date
Mon, 19 Feb 2024 09:04:17 GMT
content-encoding
br
x-ac
2.hhn _dfw BYPASS
last-modified
Wed, 14 Feb 2024 18:54:22 GMT
server
nginx
etag
W/"65cd0c5e-155b"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31536000
timing-allow-origin
*
alt-svc
h3=":443"; ma=86400
expires
Fri, 14 Feb 2025 14:27:50 GMT
index.min.js
s0.wp.com/wp-content/plugins/gutenberg-core/v17.7.0/build/autop/ 		5 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s0.wp.com/wp-content/plugins/gutenberg-core/v17.7.0/build/autop/index.min.js?m=1707936843i&ver=dd02809e92d21384c288
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/29/applocker-bypass-msbuild/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
499b2afc2ca8c8cd894668ae9c64b89438c8170ecd5251af73215052f5125d1a

Request headers

Referer
https://pentestlab.blog/
Origin
https://pentestlab.blog
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

x-nc
HIT hhn 2
date
Mon, 19 Feb 2024 09:04:17 GMT
content-encoding
br
x-ac
2.hhn _dfw BYPASS
last-modified
Wed, 14 Feb 2024 18:54:21 GMT
server
nginx
etag
W/"65cd0c5d-15ee"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31536000
timing-allow-origin
*
alt-svc
h3=":443"; ma=86400
expires
Thu, 13 Feb 2025 19:51:27 GMT
index.min.js
s0.wp.com/wp-content/plugins/gutenberg-core/v17.7.0/build/blob/ 		1 KB
880 B 		Script
General
Check archive.org
Download Go to
Full URL
https://s0.wp.com/wp-content/plugins/gutenberg-core/v17.7.0/build/blob/index.min.js?m=1707936843i&ver=94959d5178d135a3f178
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/29/applocker-bypass-msbuild/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
81d80f7617f35c300905e4d00edab280731bc69dc5a1bb457a3171a296f0c579

Request headers

Referer
https://pentestlab.blog/
Origin
https://pentestlab.blog
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

x-nc
HIT hhn 2
date
Mon, 19 Feb 2024 09:04:17 GMT
content-encoding
br
x-ac
2.hhn _dfw BYPASS
last-modified
Wed, 14 Feb 2024 18:54:25 GMT
server
nginx
etag
W/"65cd0c61-457"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31536000
timing-allow-origin
*
alt-svc
h3=":443"; ma=86400
expires
Thu, 13 Feb 2025 19:51:27 GMT
index.min.js
s0.wp.com/wp-content/plugins/gutenberg-core/v17.7.0/build/block-serialization-default-parser/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s0.wp.com/wp-content/plugins/gutenberg-core/v17.7.0/build/block-serialization-default-parser/index.min.js?m=1707936843i&ver=ccafd59466e043b1e67a
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/29/applocker-bypass-msbuild/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
d6480caf5f26b15563f969737af7f284bf796de4dd63c8caaa3481fe75d05b80

Request headers

Referer
https://pentestlab.blog/
Origin
https://pentestlab.blog
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

x-nc
HIT hhn 2
date
Mon, 19 Feb 2024 09:04:17 GMT
content-encoding
br
x-ac
2.hhn _dfw BYPASS
last-modified
Wed, 14 Feb 2024 18:54:22 GMT
server
nginx
etag
W/"65cd0c5e-94e"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31536000
timing-allow-origin
*
alt-svc
h3=":443"; ma=86400
expires
Thu, 13 Feb 2025 19:51:27 GMT
index.min.js
s0.wp.com/wp-content/plugins/gutenberg-core/v17.7.0/build/deprecated/ 		687 B
776 B 		Script
General
Check archive.org
Download Go to
Full URL
https://s0.wp.com/wp-content/plugins/gutenberg-core/v17.7.0/build/deprecated/index.min.js?m=1707936843i&ver=5f56b9106e825b0b4ab3
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/29/applocker-bypass-msbuild/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
fe788e0f7ae46a370ab3eb4f2a404269b1072e56135216713e39502c7dacde59

Request headers

Referer
https://pentestlab.blog/
Origin
https://pentestlab.blog
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

x-nc
HIT hhn 2
date
Mon, 19 Feb 2024 09:04:17 GMT
content-encoding
br
x-ac
2.hhn _dfw BYPASS
last-modified
Wed, 14 Feb 2024 18:54:25 GMT
server
nginx
etag
W/"65cd0c61-2af"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31536000
timing-allow-origin
*
alt-svc
h3=":443"; ma=86400
expires
Thu, 13 Feb 2025 19:51:27 GMT
index.min.js
s0.wp.com/wp-content/plugins/gutenberg-core/v17.7.0/build/dom/ 		12 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s0.wp.com/wp-content/plugins/gutenberg-core/v17.7.0/build/dom/index.min.js?m=1707936843i&ver=44e4bca27663d6dfa4f6
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/29/applocker-bypass-msbuild/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
bbc51c7d3315175c9f89d86add8afd37a09671935e0306a1fea6e0189f37901c

Request headers

Referer
https://pentestlab.blog/
Origin
https://pentestlab.blog
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

x-nc
HIT hhn 2
date
Mon, 19 Feb 2024 09:04:17 GMT
content-encoding
br
x-ac
2.hhn _dfw BYPASS
last-modified
Wed, 14 Feb 2024 18:54:22 GMT
server
nginx
etag
W/"65cd0c5e-3036"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31536000
timing-allow-origin
*
alt-svc
h3=":443"; ma=86400
expires
Thu, 13 Feb 2025 19:51:27 GMT
index.min.js
s0.wp.com/wp-content/plugins/gutenberg-core/v17.7.0/build/escape-html/ 		1003 B
851 B 		Script
General
Check archive.org
Download Go to
Full URL
https://s0.wp.com/wp-content/plugins/gutenberg-core/v17.7.0/build/escape-html/index.min.js?m=1707936843i&ver=fbad781820bda8333f76
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/29/applocker-bypass-msbuild/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
d413a32d4aad316a296461ff801272dc11512f252e5eba70da8e0673c204b235

Request headers

Referer
https://pentestlab.blog/
Origin
https://pentestlab.blog
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

x-nc
HIT hhn 2
date
Mon, 19 Feb 2024 09:04:17 GMT
content-encoding
br
x-ac
2.hhn _dfw BYPASS
last-modified
Wed, 14 Feb 2024 18:54:22 GMT
server
nginx
etag
W/"65cd0c5e-3eb"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31536000
timing-allow-origin
*
alt-svc
h3=":443"; ma=86400
expires
Thu, 13 Feb 2025 19:51:27 GMT
index.min.js
s0.wp.com/wp-content/plugins/gutenberg-core/v17.7.0/build/element/ 		11 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s0.wp.com/wp-content/plugins/gutenberg-core/v17.7.0/build/element/index.min.js?m=1707936843i&ver=30b6834ec0d0e2c24761
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/29/applocker-bypass-msbuild/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
6dc63fe3f880324c960483652ea9f872199ad3887e2e072e1925cb167bafa576

Request headers

Referer
https://pentestlab.blog/
Origin
https://pentestlab.blog
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

x-nc
HIT hhn 2
date
Mon, 19 Feb 2024 09:04:17 GMT
content-encoding
br
x-ac
2.hhn _dfw BYPASS
last-modified
Wed, 14 Feb 2024 18:54:25 GMT
server
nginx
etag
W/"65cd0c61-2dfa"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31536000
timing-allow-origin
*
alt-svc
h3=":443"; ma=86400
expires
Thu, 13 Feb 2025 19:51:27 GMT
index.min.js
s0.wp.com/wp-content/plugins/gutenberg-core/v17.7.0/build/is-shallow-equal/ 		1021 B
846 B 		Script
General
Check archive.org
Download Go to
Full URL
https://s0.wp.com/wp-content/plugins/gutenberg-core/v17.7.0/build/is-shallow-equal/index.min.js?m=1707936843i&ver=5299ef30233b42ce5199
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/29/applocker-bypass-msbuild/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
d1250ea07224819d007acda104687b92e3a5174adacf12837fc5e9ff14021286

Request headers

Referer
https://pentestlab.blog/
Origin
https://pentestlab.blog
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

x-nc
HIT hhn 2
date
Mon, 19 Feb 2024 09:04:17 GMT
content-encoding
br
x-ac
2.hhn _dfw BYPASS
last-modified
Wed, 14 Feb 2024 18:54:25 GMT
server
nginx
etag
W/"65cd0c61-3fd"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31536000
timing-allow-origin
*
alt-svc
h3=":443"; ma=86400
expires
Thu, 13 Feb 2025 19:51:27 GMT
index.min.js
s0.wp.com/wp-content/plugins/gutenberg-core/v17.7.0/build/keycodes/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s0.wp.com/wp-content/plugins/gutenberg-core/v17.7.0/build/keycodes/index.min.js?m=1707936843i&ver=54656f44cb3b10270813
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/29/applocker-bypass-msbuild/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
45a05663a6bbdacc788b036380a0ee4c7b49b7bc498d8a98d8e5748b91e59030

Request headers

Referer
https://pentestlab.blog/
Origin
https://pentestlab.blog
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

x-nc
HIT hhn 2
date
Mon, 19 Feb 2024 09:04:17 GMT
content-encoding
br
x-ac
2.hhn _dfw BYPASS
last-modified
Wed, 14 Feb 2024 18:54:21 GMT
server
nginx
etag
W/"65cd0c5d-b1b"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31536000
timing-allow-origin
*
alt-svc
h3=":443"; ma=86400
expires
Thu, 13 Feb 2025 19:51:27 GMT
index.min.js
s0.wp.com/wp-content/plugins/gutenberg-core/v17.7.0/build/priority-queue/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s0.wp.com/wp-content/plugins/gutenberg-core/v17.7.0/build/priority-queue/index.min.js?m=1707936843i&ver=c01f24e11b08ca4aff89
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/29/applocker-bypass-msbuild/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
96e284f53f584411c21ef89fa08219b4188014333413eef9f7de213669c25fa7

Request headers

Referer
https://pentestlab.blog/
Origin
https://pentestlab.blog
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

x-nc
HIT hhn 2
date
Mon, 19 Feb 2024 09:04:17 GMT
content-encoding
br
x-ac
2.hhn _dfw BYPASS
last-modified
Wed, 14 Feb 2024 18:54:26 GMT
server
nginx
etag
W/"65cd0c62-d06"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31536000
timing-allow-origin
*
alt-svc
h3=":443"; ma=86400
expires
Thu, 13 Feb 2025 19:51:27 GMT
index.min.js
s0.wp.com/wp-content/plugins/gutenberg-core/v17.7.0/build/compose/ 		36 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s0.wp.com/wp-content/plugins/gutenberg-core/v17.7.0/build/compose/index.min.js?m=1707936843i&ver=093c0dd3cc3b42e06b10
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/29/applocker-bypass-msbuild/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
2e3161cf8fb5342820617a465c6fd72afa46a0b54db3a03813a691725310dbcb

Request headers

Referer
https://pentestlab.blog/
Origin
https://pentestlab.blog
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

x-nc
HIT hhn 2
date
Mon, 19 Feb 2024 09:04:17 GMT
content-encoding
br
x-ac
2.hhn _dfw BYPASS
last-modified
Wed, 14 Feb 2024 18:54:22 GMT
server
nginx
etag
W/"65cd0c5e-8f28"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31536000
timing-allow-origin
*
alt-svc
h3=":443"; ma=86400
expires
Thu, 13 Feb 2025 19:51:27 GMT
index.min.js
s0.wp.com/wp-content/plugins/gutenberg-core/v17.7.0/build/private-apis/ 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s0.wp.com/wp-content/plugins/gutenberg-core/v17.7.0/build/private-apis/index.min.js?m=1707936843i&ver=52428a68ae244aabb6fb
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/29/applocker-bypass-msbuild/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
466ce3f481df55d5402c2179fbfff4190e0881d9a94ab5303b4978bb123bd8db

Request headers

Referer
https://pentestlab.blog/
Origin
https://pentestlab.blog
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

x-nc
HIT hhn 2
date
Mon, 19 Feb 2024 09:04:17 GMT
content-encoding
br
x-ac
2.hhn _dfw BYPASS
last-modified
Wed, 14 Feb 2024 18:54:26 GMT
server
nginx
etag
W/"65cd0c62-ad7"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31536000
timing-allow-origin
*
alt-svc
h3=":443"; ma=86400
expires
Thu, 13 Feb 2025 19:51:27 GMT
index.min.js
s0.wp.com/wp-content/plugins/gutenberg-core/v17.7.0/build/redux-routine/ 		9 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s0.wp.com/wp-content/plugins/gutenberg-core/v17.7.0/build/redux-routine/index.min.js?m=1707936843i&ver=786aeb57a8ae5605915c
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/29/applocker-bypass-msbuild/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
97cc56205ee842e64adc7912cb7e86c6b31a90ba065cf46009c09bca05293059

Request headers

Referer
https://pentestlab.blog/
Origin
https://pentestlab.blog
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

x-nc
HIT hhn 2
date
Mon, 19 Feb 2024 09:04:17 GMT
content-encoding
br
x-ac
2.hhn _dfw BYPASS
last-modified
Wed, 14 Feb 2024 18:54:22 GMT
server
nginx
etag
W/"65cd0c5e-2207"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31536000
timing-allow-origin
*
alt-svc
h3=":443"; ma=86400
expires
Thu, 13 Feb 2025 19:51:27 GMT
index.min.js
s0.wp.com/wp-content/plugins/gutenberg-core/v17.7.0/build/data/ 		26 KB
9 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s0.wp.com/wp-content/plugins/gutenberg-core/v17.7.0/build/data/index.min.js?m=1707936843i&ver=37ff78e082dd4e9ce738
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/29/applocker-bypass-msbuild/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
b7a54157378a868c322672b4365b9df14078f9a508bb2b439d1ccdd60064f3be

Request headers

Referer
https://pentestlab.blog/
Origin
https://pentestlab.blog
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

x-nc
HIT hhn 2
date
Mon, 19 Feb 2024 09:04:17 GMT
content-encoding
br
x-ac
2.hhn _dfw BYPASS
last-modified
Wed, 14 Feb 2024 18:54:22 GMT
server
nginx
etag
W/"65cd0c5e-67f5"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31536000
timing-allow-origin
*
alt-svc
h3=":443"; ma=86400
expires
Thu, 13 Feb 2025 19:51:27 GMT
index.min.js
s0.wp.com/wp-content/plugins/gutenberg-core/v17.7.0/build/html-entities/ 		791 B
754 B 		Script
General
Check archive.org
Download Go to
Full URL
https://s0.wp.com/wp-content/plugins/gutenberg-core/v17.7.0/build/html-entities/index.min.js?m=1707936843i&ver=e9ce7ebd2e4bd93c7be1
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/29/applocker-bypass-msbuild/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
a37ef75bef9c0b9ca67220a826fad8761b880347fbb763c56d38834eb1c5a302

Request headers

Referer
https://pentestlab.blog/
Origin
https://pentestlab.blog
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

x-nc
HIT hhn 2
date
Mon, 19 Feb 2024 09:04:17 GMT
content-encoding
br
x-ac
2.hhn _dfw BYPASS
last-modified
Wed, 14 Feb 2024 18:54:22 GMT
server
nginx
etag
W/"65cd0c5e-317"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31536000
timing-allow-origin
*
alt-svc
h3=":443"; ma=86400
expires
Thu, 13 Feb 2025 19:51:27 GMT
index.min.js
s0.wp.com/wp-content/plugins/gutenberg-core/v17.7.0/build/dom-ready/ 		460 B
782 B 		Script
General
Check archive.org
Download Go to
Full URL
https://s0.wp.com/wp-content/plugins/gutenberg-core/v17.7.0/build/dom-ready/index.min.js?m=1707936843i&ver=222ad38e3e5e302c8bbf
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/29/applocker-bypass-msbuild/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
52d995270969aed722e4e20184d2d424f0e1afb1040ef2273549bf0ba7c75d07

Request headers

Referer
https://pentestlab.blog/
Origin
https://pentestlab.blog
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

x-nc
HIT hhn 2
date
Mon, 19 Feb 2024 09:04:17 GMT
x-ac
2.hhn _dfw BYPASS
last-modified
Wed, 14 Feb 2024 18:54:25 GMT
server
nginx
etag
"65cd0c61-1cc"
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3=":443"; ma=86400
content-length
460
expires
Thu, 13 Feb 2025 19:51:27 GMT
index.min.js
s0.wp.com/wp-content/plugins/gutenberg-core/v17.7.0/build/a11y/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s0.wp.com/wp-content/plugins/gutenberg-core/v17.7.0/build/a11y/index.min.js?m=1707936843i&ver=9061ce25a6ee8a006b52
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/29/applocker-bypass-msbuild/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
729cb114db2bc898ebd76af066a49a76432f8ad984505e6ecfcfbc37672813cf

Request headers

Referer
https://pentestlab.blog/
Origin
https://pentestlab.blog
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

x-nc
HIT hhn 2
date
Mon, 19 Feb 2024 09:04:17 GMT
content-encoding
br
x-ac
2.hhn _dfw BYPASS
last-modified
Wed, 14 Feb 2024 18:54:22 GMT
server
nginx
etag
W/"65cd0c5e-939"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31536000
timing-allow-origin
*
alt-svc
h3=":443"; ma=86400
expires
Thu, 13 Feb 2025 19:51:27 GMT
index.min.js
s0.wp.com/wp-content/plugins/gutenberg-core/v17.7.0/build/rich-text/ 		30 KB
11 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s0.wp.com/wp-content/plugins/gutenberg-core/v17.7.0/build/rich-text/index.min.js?m=1707936843i&ver=e75ef5d97d3a0a484dab
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/29/applocker-bypass-msbuild/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
7e1a64919ef5dd0b1200faaa2ae9a69f228e67005a3731038e9cb420a1b9cdcb

Request headers

Referer
https://pentestlab.blog/
Origin
https://pentestlab.blog
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

x-nc
HIT hhn 2
date
Mon, 19 Feb 2024 09:04:17 GMT
content-encoding
br
x-ac
2.hhn _dfw BYPASS
last-modified
Wed, 14 Feb 2024 18:54:27 GMT
server
nginx
etag
W/"65cd0c63-77b0"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31536000
timing-allow-origin
*
alt-svc
h3=":443"; ma=86400
expires
Thu, 13 Feb 2025 19:51:27 GMT
index.min.js
s0.wp.com/wp-content/plugins/gutenberg-core/v17.7.0/build/shortcode/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s0.wp.com/wp-content/plugins/gutenberg-core/v17.7.0/build/shortcode/index.min.js?m=1707936843i&ver=76f6ae4ad6804e0c13db
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/29/applocker-bypass-msbuild/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
91d0022cd0ba8821088854f4e21f21ddf56c1b1017446ca6189ff7bf593e2b72

Request headers

Referer
https://pentestlab.blog/
Origin
https://pentestlab.blog
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

x-nc
HIT hhn 2
date
Mon, 19 Feb 2024 09:04:17 GMT
content-encoding
br
x-ac
2.hhn _dfw BYPASS
last-modified
Wed, 14 Feb 2024 18:54:25 GMT
server
nginx
etag
W/"65cd0c61-b57"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31536000
timing-allow-origin
*
alt-svc
h3=":443"; ma=86400
expires
Thu, 13 Feb 2025 19:51:27 GMT
index.min.js
s0.wp.com/wp-content/plugins/gutenberg-core/v17.7.0/build/blocks/ 		162 KB
52 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s0.wp.com/wp-content/plugins/gutenberg-core/v17.7.0/build/blocks/index.min.js?m=1707936843i&ver=f14168fd73cac3cb707f
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/29/applocker-bypass-msbuild/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
c4d02955d7fcc9932a937efd780b2ea0d6d8446b056d8dc04f3ac6046249014c

Request headers

Referer
https://pentestlab.blog/
Origin
https://pentestlab.blog
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

x-nc
HIT hhn 2
date
Mon, 19 Feb 2024 09:04:17 GMT
content-encoding
br
x-ac
2.hhn _dfw BYPASS
last-modified
Wed, 14 Feb 2024 18:54:22 GMT
server
nginx
etag
W/"65cd0c5e-2864e"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31536000
timing-allow-origin
*
alt-svc
h3=":443"; ma=86400
expires
Thu, 13 Feb 2025 19:51:27 GMT
/
s0.wp.com/_static/ 		30 KB
11 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s0.wp.com/_static/??-eJyljjEOwjAMRS9EcCuGwoA4CkrcUDlNYitOmuu3AxNCYmB80n9PH7oY5Fx9rpCakdgWygpYuM9KS7bRvLgkBdcozmBFom3qz0FP8F0NvorF9c2QmDM8KSO4yLgqaHOKhaQSH+uNfP8jVrx4W81GSpXLrxrawsf5aLogpw88vEe6j9Mw3S7TdRjDDhnGaow=
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/29/applocker-bypass-msbuild/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
5907cda67409e93cedea2b7f2adad9ef600150726a80e468507b3e17450e271a

Request headers

Referer
https://pentestlab.blog/
Origin
https://pentestlab.blog
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

x-nc
HIT hhn 2
date
Mon, 19 Feb 2024 09:04:17 GMT
content-encoding
br
x-ac
2.hhn _dfw BYPASS
last-modified
Wed, 14 Feb 2024 19:10:11 GMT
server
nginx
etag
W/"65cd1013-7685"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31536000
timing-allow-origin
*
alt-svc
h3=":443"; ma=86400
expires
Thu, 13 Feb 2025 19:51:17 GMT
rating.js
polldaddy.com/js/rating/ 		16 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://polldaddy.com/js/rating/rating.js?ver=13.2-a.6
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/29/applocker-bypass-msbuild/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.123.248 Los Angeles, United States, ASN (),
Reverse DNS
polldaddy.com
Software
nginx /
Resource Hash
bdb75e08b4b1eedee2847c2eafacc3089842b8735f7c6d4e99aedcb6ba828e55

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pentestlab.blog/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date
Mon, 19 Feb 2024 09:04:18 GMT
content-encoding
br
last-modified
Thu, 14 Dec 2023 16:20:27 GMT
server
nginx
etag
W/"657b2b4b-3fc5"
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=2592000
alt-svc
h3=":443"; ma=86400
expires
Wed, 20 Mar 2024 09:04:18 GMT
sharing.min.js
s0.wp.com/wp-content/mu-plugins/jetpack-plugin/moon/_inc/build/sharedaddy/ 		9 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s0.wp.com/wp-content/mu-plugins/jetpack-plugin/moon/_inc/build/sharedaddy/sharing.min.js?m=1685129444i
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/29/applocker-bypass-msbuild/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
9e1dae23d3ad3212f67d09ca79a50003c32953c36bab976f634c9b38d8a8c6dc

Request headers

Referer
https://pentestlab.blog/
Origin
https://pentestlab.blog
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

x-nc
HIT hhn 2
date
Mon, 19 Feb 2024 09:04:17 GMT
content-encoding
br
x-ac
2.hhn _dfw BYPASS
last-modified
Fri, 26 May 2023 19:31:03 GMT
server
nginx
etag
W/"647108f7-2259"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31536000
timing-allow-origin
*
alt-svc
h3=":443"; ma=86400
expires
Fri, 31 May 2024 16:25:32 GMT
w.js
stats.wp.com/ 		12 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://stats.wp.com/w.js?67
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/29/applocker-bypass-msbuild/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
79674b01741c3978417b6b9b4b98d125755e7bb468979d5cd593eac4b94cdb91

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pentestlab.blog/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

x-minify-cache
hit
x-nc
HIT hhn
date
Mon, 19 Feb 2024 09:04:17 GMT
content-encoding
br
server
nginx
x-minify
t
etag
W/12827-1705538370042.3745
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31536000
alt-svc
h3=":443"; ma=86400
expires
Fri, 17 Jan 2025 00:39:37 GMT
b8c1338f-f84e-488e-ace3-a682ac4ea324
https://pentestlab.blog/ 		1 KB
0 		Other
General
Check archive.org
Download Go to
Full URL
blob:https://pentestlab.blog/b8c1338f-f84e-488e-ace3-a682ac4ea324
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/29/applocker-bypass-msbuild/
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
453cb806084fdabec32e286af2e88899f79022125c2527afffbec507975d2c22

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Content-Length
1245
Content-Type
text/javascript
header.jpg
s0.wp.com/wp-content/themes/premium/thefour/img/ 		200 KB
200 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s0.wp.com/wp-content/themes/premium/thefour/img/header.jpg
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/29/applocker-bypass-msbuild/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
1f16434d944a6e996c5b5bf08d9061ee33eaf68dbd2f4f8f786e159f7dc5cae6

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pentestlab.blog/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

x-nc
HIT hhn 1
date
Mon, 19 Feb 2024 09:04:17 GMT
x-ac
2.hhn _dca MISS
last-modified
Fri, 19 May 2023 01:54:59 GMT
server
nginx
etag
"6466d6f3-31e2d"
access-control-allow-methods
GET, HEAD
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3=":443"; ma=86400
content-length
204333
expires
Sat, 09 Nov 2024 15:44:37 GMT
JTUHjIg1_i6t8kCHKm4532VJOt5-QNFgpCtZ6Hw5aXo.woff2
fonts.wp.com/s/montserrat/v26/ 		15 KB
15 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.wp.com/s/montserrat/v26/JTUHjIg1_i6t8kCHKm4532VJOt5-QNFgpCtZ6Hw5aXo.woff2
Requested by
Host: fonts-api.wp.com
URL: https://fonts-api.wp.com/css?family=Open%2BSans%3A400%2C400italic%2C700%2C700italic%7CMontserrat%3A500&subset=latin%2Clatin-ext&ver=6.5-alpha-57492
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
b52de70853ed4bac82f0c4cc5d6c7da8d588de61d97e8c30b99e40eefcde5a44
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts-api.wp.com/
Origin
https://pentestlab.blog
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

x-nc
HIT hhn 2
date
Mon, 19 Feb 2024 09:04:17 GMT
x-content-type-options
nosniff
last-modified
Wed, 13 Sep 2023 22:45:20 GMT
server
nginx
age
13680
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3=":443"; ma=86400
content-length
15100
x-xss-protection
0
truncated
/ 		7 KB
7 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
70c44a9df364a5e5779a64d3b6bace4a0939ad6649859f59e30d4df5bbfbf7d6

Request headers

Referer
Origin
https://pentestlab.blog
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Content-Type
application/octet-stream
fontawesome-webfont.woff2
s0.wp.com/wp-content/themes/premium/thefour/fonts/ 		70 KB
71 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://s0.wp.com/wp-content/themes/premium/thefour/fonts/fontawesome-webfont.woff2?v=4.6.3
Requested by
Host: s0.wp.com
URL: https://s0.wp.com/_static/??-eJzTLy/QTc7PK0nNK9EvyUjNTS3WLyhKzc0szQVx0/JLi/STi4v104BKdBPLU4vzc1P1gAI6+oT1FZdU5oAV2+faGpoZG5gamBsammYBAMXNKeE=&cssminify=yes
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
7dacf83f51179de8d7980a513e67ab3a08f2c6272bb5946df8fd77c0d1763b73

Request headers

Referer
https://s0.wp.com/_static/??-eJzTLy/QTc7PK0nNK9EvyUjNTS3WLyhKzc0szQVx0/JLi/STi4v104BKdBPLU4vzc1P1gAI6+oT1FZdU5oAV2+faGpoZG5gamBsammYBAMXNKeE=&cssminify=yes
Origin
https://pentestlab.blog
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

x-nc
HIT hhn 2
date
Mon, 19 Feb 2024 09:04:17 GMT
x-ac
2.hhn _dfw MISS
last-modified
Fri, 19 May 2023 03:03:26 GMT
server
nginx
etag
"6466e6fe-118d8"
access-control-allow-methods
GET, HEAD
content-type
application/font-woff2
access-control-allow-origin
*
cache-control
max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3=":443"; ma=86400
content-length
71896
expires
Sat, 09 Nov 2024 15:45:17 GMT
9161b274d6d350683293f1e03d228985ac0ff6ac6c89353f4b6bd1a7bc69daf4
0.gravatar.com/avatar/ 		2 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://0.gravatar.com/avatar/9161b274d6d350683293f1e03d228985ac0ff6ac6c89353f4b6bd1a7bc69daf4?s=32&d=identicon&r=G
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/29/applocker-bypass-msbuild/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
7d5f6f7d593191e51c8211ccee54ec6b5425e3f5ae5da264eb56f7c1a8cbd630

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pentestlab.blog/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

x-nc
HIT hhn 1
date
Mon, 19 Feb 2024 09:04:17 GMT
last-modified
Sun, 19 Nov 2023 17:53:28 GMT
server
nginx
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=300
content-disposition
inline; filename="9161b274d6d350683293f1e03d228985ac0ff6ac6c89353f4b6bd1a7bc69daf4.png"
accept-ranges
bytes
link
<https://gravatar.com/avatar/9161b274d6d350683293f1e03d228985ac0ff6ac6c89353f4b6bd1a7bc69daf4?s=32&d=identicon&r=G>; rel="canonical"
content-length
2556
alt-svc
h3=":443"; ma=86400
expires
Mon, 19 Feb 2024 09:09:17 GMT
msbuild-powershell.png
pentestlab.files.wordpress.com/2017/05/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pentestlab.files.wordpress.com/2017/05/msbuild-powershell.png
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/29/applocker-bypass-msbuild/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
192.0.72.29 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
838709124cee365353054f8fdf0aa50451ae4d8a215b9695e6d5db4298d19053
Security Headers
Name Value
X-Content-Type-Options nosniff, nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pentestlab.blog/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

x-nc
HIT hhn 29 np
date
Mon, 19 Feb 2024 09:04:17 GMT
x-content-type-options
nosniff, nosniff
last-modified
Mon, 29 May 2017 19:25:59 GMT
server
nginx
x-orig-src
0_imageresize
vary
Accept, Origin
content-type
image/webp
access-control-allow-origin
https://pentestlab.wordpress.com
access-control-allow-credentials
true
accept-ranges
bytes
alt-svc
h3=":443"; ma=86400
content-length
2608
expires
Wed, 28 Feb 2024 11:54:48 GMT
msbuild-msbuildshell.png
pentestlab.files.wordpress.com/2017/05/ 		846 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pentestlab.files.wordpress.com/2017/05/msbuild-msbuildshell.png
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/29/applocker-bypass-msbuild/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
192.0.72.29 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
c04297ce6c1a6841e4cc7884f9987c68a900bb819fd93bfd43a392cde099e234
Security Headers
Name Value
X-Content-Type-Options nosniff, nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pentestlab.blog/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

x-nc
HIT hhn 29 np
date
Mon, 19 Feb 2024 09:04:17 GMT
x-content-type-options
nosniff, nosniff
last-modified
Mon, 29 May 2017 21:06:01 GMT
server
nginx
x-orig-src
0_imageresize
vary
Accept, Origin
content-type
image/webp
access-control-allow-origin
https://pentestlab.wordpress.com
access-control-allow-credentials
true
accept-ranges
bytes
alt-svc
h3=":443"; ma=86400
content-length
846
expires
Mon, 04 Mar 2024 08:51:14 GMT
msbuildshell.png
pentestlab.files.wordpress.com/2017/05/ 		16 KB
16 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pentestlab.files.wordpress.com/2017/05/msbuildshell.png
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/29/applocker-bypass-msbuild/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
192.0.72.29 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
2d83bea79070b8f4ed432fbadad2c1214eb3e5af8a2000c375b44c7625691f5c
Security Headers
Name Value
X-Content-Type-Options nosniff, nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pentestlab.blog/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

x-nc
HIT hhn 29 np
date
Mon, 19 Feb 2024 09:04:17 GMT
x-content-type-options
nosniff, nosniff
last-modified
Mon, 29 May 2017 21:12:35 GMT
server
nginx
x-orig-src
0_imageresize
vary
Accept, Origin
content-type
image/webp
access-control-allow-origin
https://pentestlab.wordpress.com
access-control-allow-credentials
true
accept-ranges
bytes
alt-svc
h3=":443"; ma=86400
content-length
16478
expires
Wed, 28 Feb 2024 23:01:19 GMT
msbuild-executing-psattack.png
pentestlab.files.wordpress.com/2017/05/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pentestlab.files.wordpress.com/2017/05/msbuild-executing-psattack.png
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/29/applocker-bypass-msbuild/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
192.0.72.29 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
18374219c1fc61a61818bc567193b1b3c22834bd4cd071f0e681888fb444d47c
Security Headers
Name Value
X-Content-Type-Options nosniff, nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pentestlab.blog/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

x-nc
HIT hhn 29 np
date
Mon, 19 Feb 2024 09:04:17 GMT
x-content-type-options
nosniff, nosniff
last-modified
Mon, 29 May 2017 21:14:06 GMT
server
nginx
x-orig-src
0_imageresize
vary
Accept, Origin
content-type
image/webp
access-control-allow-origin
https://pentestlab.wordpress.com
access-control-allow-credentials
true
accept-ranges
bytes
alt-svc
h3=":443"; ma=86400
content-length
2992
expires
Mon, 11 Mar 2024 14:51:06 GMT
msbuild-psattack.png
pentestlab.files.wordpress.com/2017/05/ 		17 KB
17 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pentestlab.files.wordpress.com/2017/05/msbuild-psattack.png
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/29/applocker-bypass-msbuild/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
192.0.72.29 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
c24a88a723aada71fa0ebef60ff83967a98722c4ba7907dc957deb0677c4cfc2
Security Headers
Name Value
X-Content-Type-Options nosniff, nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pentestlab.blog/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

x-nc
HIT hhn 29 np
date
Mon, 19 Feb 2024 09:04:17 GMT
x-content-type-options
nosniff, nosniff
last-modified
Mon, 29 May 2017 21:14:14 GMT
server
nginx
x-orig-src
0_imageresize
vary
Accept, Origin
content-type
image/webp
access-control-allow-origin
https://pentestlab.wordpress.com
access-control-allow-credentials
true
accept-ranges
bytes
alt-svc
h3=":443"; ma=86400
content-length
17120
expires
Wed, 06 Mar 2024 02:59:59 GMT
msbuild-executing-mimikatz.png
pentestlab.files.wordpress.com/2017/05/ 		5 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pentestlab.files.wordpress.com/2017/05/msbuild-executing-mimikatz.png
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/29/applocker-bypass-msbuild/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
192.0.72.29 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
1234d1e44ba1656e2893e1520f76d89edfdb39be05a489be408a3a29673aad50
Security Headers
Name Value
X-Content-Type-Options nosniff, nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pentestlab.blog/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

x-nc
HIT hhn 29 np
date
Mon, 19 Feb 2024 09:04:17 GMT
x-content-type-options
nosniff, nosniff
last-modified
Mon, 29 May 2017 19:18:58 GMT
server
nginx
x-orig-src
0_imageresize
vary
Accept, Origin
content-type
image/webp
access-control-allow-origin
https://pentestlab.wordpress.com
access-control-allow-credentials
true
accept-ranges
bytes
alt-svc
h3=":443"; ma=86400
content-length
5526
expires
Sun, 17 Mar 2024 00:28:04 GMT
msbuild-mimikatz.png
pentestlab.files.wordpress.com/2017/05/ 		10 KB
11 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pentestlab.files.wordpress.com/2017/05/msbuild-mimikatz.png
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/29/applocker-bypass-msbuild/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
192.0.72.29 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
a649373e4789ca5cee6ed7b72fea1481882aa0805cf155c84b2f262e6e1771f9
Security Headers
Name Value
X-Content-Type-Options nosniff, nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pentestlab.blog/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

x-nc
HIT hhn 29 np
date
Mon, 19 Feb 2024 09:04:17 GMT
x-content-type-options
nosniff, nosniff
last-modified
Mon, 29 May 2017 19:20:21 GMT
server
nginx
x-orig-src
0_imageresize
vary
Accept, Origin
content-type
image/webp
access-control-allow-origin
https://pentestlab.wordpress.com
access-control-allow-credentials
true
accept-ranges
bytes
alt-svc
h3=":443"; ma=86400
content-length
10456
expires
Tue, 12 Mar 2024 16:23:34 GMT
msbuild-dumping-credentials-via-mimikatz.png
pentestlab.files.wordpress.com/2017/05/ 		6 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pentestlab.files.wordpress.com/2017/05/msbuild-dumping-credentials-via-mimikatz.png
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/29/applocker-bypass-msbuild/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
192.0.72.29 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
44fffd760753b25ef9cd03561ee719d51cb9a2e39f3d65c3db37444a60f3e0e3
Security Headers
Name Value
X-Content-Type-Options nosniff, nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pentestlab.blog/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

x-nc
HIT hhn 29 np
date
Mon, 19 Feb 2024 09:04:17 GMT
x-content-type-options
nosniff, nosniff
last-modified
Mon, 29 May 2017 19:23:00 GMT
server
nginx
x-orig-src
0_imageresize
vary
Accept, Origin
content-type
image/webp
access-control-allow-origin
https://pentestlab.wordpress.com
access-control-allow-credentials
true
accept-ranges
bytes
alt-svc
h3=":443"; ma=86400
content-length
6306
expires
Fri, 01 Mar 2024 10:21:35 GMT
css
fonts-api.wp.com/ 		7 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts-api.wp.com/css?family=Ubuntu:r,i,b,bi%7CUbuntu:r&subset=latin,latin-ext,latin,latin-ext
Requested by
Host: s0.wp.com
URL: https://s0.wp.com/wp-content/plugins/custom-fonts/js/webfont.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
1f2f5c59134b1ff5e6e60f0fb548fbc718903877cab07963851ed84ab1cf0b42
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pentestlab.blog/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date
Mon, 19 Feb 2024 09:04:17 GMT
strict-transport-security
max-age=31536000
x-content-type-options
nosniff
content-encoding
gzip
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
x-xss-protection
0
x-nc
BYPASS hhn 1
last-modified
Mon, 19 Feb 2024 09:04:17 GMT
server
nginx
cross-origin-opener-policy
same-origin-allow-popups
vary
accept-encoding, Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
4iCs6KVjbNBYlgoKfw72.woff2
fonts.wp.com/s/ubuntu/v20/ 		34 KB
34 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.wp.com/s/ubuntu/v20/4iCs6KVjbNBYlgoKfw72.woff2
Requested by
Host: fonts-api.wp.com
URL: https://fonts-api.wp.com/css?family=Ubuntu:r,i,b,bi%7CUbuntu:r&subset=latin,latin-ext,latin,latin-ext
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
7f653b3ce9d3277457fc6da4edb246ae2f6c913f088c42dcb8cd2e96267aa21a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts-api.wp.com/
Origin
https://pentestlab.blog
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

x-nc
HIT hhn 2
date
Mon, 19 Feb 2024 09:04:17 GMT
x-content-type-options
nosniff
last-modified
Wed, 27 Apr 2022 16:31:23 GMT
server
nginx
age
273448
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3=":443"; ma=86400
content-length
34852
x-xss-protection
0
4iCu6KVjbNBYlgoKej70l0k.woff2
fonts.wp.com/s/ubuntu/v20/ 		36 KB
36 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.wp.com/s/ubuntu/v20/4iCu6KVjbNBYlgoKej70l0k.woff2
Requested by
Host: fonts-api.wp.com
URL: https://fonts-api.wp.com/css?family=Ubuntu:r,i,b,bi%7CUbuntu:r&subset=latin,latin-ext,latin,latin-ext
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
af186659e415490e7eee1bd3c8d511771dbd3e03ddbebf6b6a5096ac8ba29449
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts-api.wp.com/
Origin
https://pentestlab.blog
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

x-nc
HIT hhn 2
date
Mon, 19 Feb 2024 09:04:17 GMT
x-content-type-options
nosniff
last-modified
Wed, 27 Apr 2022 16:13:13 GMT
server
nginx
age
378733
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3=":443"; ma=86400
content-length
36564
x-xss-protection
0
4iCv6KVjbNBYlgoCxCvjsGyN.woff2
fonts.wp.com/s/ubuntu/v20/ 		29 KB
29 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.wp.com/s/ubuntu/v20/4iCv6KVjbNBYlgoCxCvjsGyN.woff2
Requested by
Host: fonts-api.wp.com
URL: https://fonts-api.wp.com/css?family=Ubuntu:r,i,b,bi%7CUbuntu:r&subset=latin,latin-ext,latin,latin-ext
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
7c00752ce82d6abaed0b9766d35b906b16675facdbe24115b410d1fab975effa
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts-api.wp.com/
Origin
https://pentestlab.blog
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

x-nc
HIT hhn 2
date
Mon, 19 Feb 2024 09:04:17 GMT
x-content-type-options
nosniff
last-modified
Wed, 27 Apr 2022 17:05:11 GMT
server
nginx
age
360437
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3=":443"; ma=86400
content-length
29752
x-xss-protection
0
4iCp6KVjbNBYlgoKejZPslyPN4E.woff2
fonts.wp.com/s/ubuntu/v20/ 		30 KB
30 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.wp.com/s/ubuntu/v20/4iCp6KVjbNBYlgoKejZPslyPN4E.woff2
Requested by
Host: fonts-api.wp.com
URL: https://fonts-api.wp.com/css?family=Ubuntu:r,i,b,bi%7CUbuntu:r&subset=latin,latin-ext,latin,latin-ext
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
26918e4295cab1eaecebc5d4719c212691f040bfe31daf0c7caf08f7a0de520a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts-api.wp.com/
Origin
https://pentestlab.blog
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

x-nc
HIT hhn 2
date
Mon, 19 Feb 2024 09:04:17 GMT
x-content-type-options
nosniff
last-modified
Wed, 27 Apr 2022 16:08:03 GMT
server
nginx
age
569732
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3=":443"; ma=86400
content-length
30660
x-xss-protection
0
shCore.css
s0.wp.com/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/styles/ 		5 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://s0.wp.com/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/styles/shCore.css?ver=3.0.9b
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/29/applocker-bypass-msbuild/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
93111ec228b7cde5000f4062ac113d5c56c77b2a7ccc4ab3b6ceaf97fe340e37

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pentestlab.blog/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

x-minify-cache
hit
date
Mon, 19 Feb 2024 09:04:17 GMT
content-encoding
br
x-ac
2.hhn _dca MISS
x-minify
t
alt-svc
h3=":443"; ma=86400
x-nc
HIT hhn 1
server
nginx
etag
W/6813-1684465053565.153
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=31536000
timing-allow-origin
*
expires
Sat, 09 Nov 2024 15:12:43 GMT
shThemeDefault.css
s0.wp.com/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/styles/ 		2 KB
717 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://s0.wp.com/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/styles/shThemeDefault.css?m=1363304414i&amp;ver=3.0.9b
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/29/applocker-bypass-msbuild/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
8f892de7bd3f42587028e9a8ddd9d01c6923f3947e657710ef40a2407e718de6

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pentestlab.blog/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

x-minify-cache
miss
date
Mon, 19 Feb 2024 09:04:17 GMT
content-encoding
br
x-ac
2.hhn _dca MISS
x-minify
t
alt-svc
h3=":443"; ma=86400
x-nc
HIT hhn 1
server
nginx
etag
W/2877-1684465075125.5054
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=31536000
timing-allow-origin
*
expires
Thu, 30 May 2024 20:22:47 GMT
sdk.js
connect.facebook.net/en_US/ 		3 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/en_US/sdk.js
Requested by
Host: s0.wp.com
URL: https://s0.wp.com/_static/??-eJydkN1qwzAMhV9ojjJyUXox9ihDsZVWiWV5/mnp29ddmzFIYWNXRkefjw4HztFYDYVCAakm+nrgkMHzQhk+K1U6YnCeUjfnF3gOz1Qi2sU06RytymMBohrgRMFpAqxFBUthu8EhJwtjZe8anMYq7YZIu5EBc6b2uEtAYWu8otsmKUeSFjYmEq5yGyetCeYMAU98wMIa/v4n28SxrDwH66trZNs8UplE0V864Y3pk0p+NvHRzGBCS6PqYkhGcv9xuDdlMWnN5L+5VfglGC6chYoZuv5utwpT+oJvkd7l7XXX74Z93++H+Qpvbs0m
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f084:105:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
5e74f7913224ebf980e700c024c5688db233a79664dca28ea531e0319e1286ce
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pentestlab.blog/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

permissions-policy-report-only
clipboard-read=(), clipboard-write=(), fullscreen=(), picture-in-picture=();report-to="permissions_policy"
strict-transport-security
max-age=31536000; preload; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
date
Mon, 19 Feb 2024 09:04:17 GMT
content-md5
cy32HH1ssdYX2Zd3/19WzQ==
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
1682
reporting-endpoints
coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-debug
+v3hATOs4zmuxaW5B1pLSmRSQ2Z3+WPanJdzrHkGZQ+qSa7Bqw9oK3cUuFpu9gaOkZHFssMFw8cjj5R5avfxeQ==
cross-origin-embedder-policy-report-only
require-corp;report-to="coep_report"
x-fb-content-md5
a287fe7b87c7de5a9174e23316402179
cross-origin-opener-policy
same-origin-allow-popups;report-to="coop_report"
etag
"c56275b854a5f46a5ab6120d757fa509"
vary
Accept-Encoding
report-to
{"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type
application/x-javascript; charset=utf-8
access-control-allow-origin
*
origin-agent-cluster
?0
access-control-expose-headers
X-FB-Content-MD5
cache-control
public,max-age=1200,stale-while-revalidate=3600
permissions-policy
accelerometer=(), ambient-light-sensor=(), autoplay=(), bluetooth=(), camera=(), display-capture=(), encrypted-media=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
x-frame-options
DENY
timing-allow-origin
*
expires
Mon, 19 Feb 2024 09:21:50 GMT
sdk.js
connect.facebook.net/en_US/ 		298 KB
85 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/en_US/sdk.js?hash=ef7542adfe8a5eb42aefe1ab1456ab2f
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/sdk.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a03:2880:f084:105:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
563b3e06e230af4e6e56e31ce3f8745c198f6fbedf6851096ab85d05e95957ac
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

Referer
https://pentestlab.blog/
Origin
https://pentestlab.blog
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

permissions-policy-report-only
clipboard-read=(), clipboard-write=(), fullscreen=(), picture-in-picture=();report-to="permissions_policy"
strict-transport-security
max-age=31536000; preload; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
date
Mon, 19 Feb 2024 09:04:18 GMT
content-md5
4UbV8oEmD+wm5dSBeMMsgg==
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
87207
reporting-endpoints
coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-debug
KH9PRbl+bs/anphsscJ5JynHATclxt9wHbZTOFW0CU5WeWlp+y0/f3kXPpG1Y46IUKafk2PfCw33hAZhzI48Sw==
cross-origin-embedder-policy-report-only
require-corp;report-to="coep_report"
x-fb-content-md5
572610086257e6ded67bf617fe31789f
cross-origin-opener-policy
same-origin-allow-popups;report-to="coop_report"
etag
"ed31431694f21edda6c21df66099ece1"
vary
Accept-Encoding
report-to
{"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type
application/x-javascript; charset=utf-8
access-control-allow-origin
*
origin-agent-cluster
?0
access-control-expose-headers
X-FB-Content-MD5
cache-control
public,max-age=31536000,stale-while-revalidate=3600,immutable
permissions-policy
accelerometer=(), ambient-light-sensor=(), autoplay=(), bluetooth=(), camera=(), display-capture=(), encrypted-media=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
x-frame-options
DENY
timing-allow-origin
*
priority
u=3,i
expires
Tue, 18 Feb 2025 08:35:43 GMT
/
www.facebook.com/login/ Frame 9C16
Redirect Chain
  • https://www.facebook.com/v2.3/plugins/page.php?app_id=249643311490&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Dff5905bfe303ff3a3%26domain%3Dpente...
  • https://www.facebook.com/login/?next=https%3A%2F%2Fwww.facebook.com%2Fplugins%2Fpage.php%3Fapp_id%3D249643311490%26channel%3Dhttps%253A%252F%252Fstaticxx.facebook.com%252Fx%252Fconnect%252Fxd_arbit...
0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://www.facebook.com/login/?next=https%3A%2F%2Fwww.facebook.com%2Fplugins%2Fpage.php%3Fapp_id%3D249643311490%26channel%3Dhttps%253A%252F%252Fstaticxx.facebook.com%252Fx%252Fconnect%252Fxd_arbiter%252F%253Fversion%253D46%2523cb%253Dff5905bfe303ff3a3%2526domain%253Dpentestlab.blog%2526is_canvas%253Dfalse%2526origin%253Dhttps%25253A%25252F%25252Fpentestlab.blog%25252Ff180de6b96a948ca7%2526relation%253Dparent.parent%26container_width%3D342%26height%3D432%26hide_cover%3Dfalse%26hide_cta%3Dfalse%26href%3Dhttps%253A%252F%252Fwww.facebook.com%252Fpentestlaboratory%252F%26locale%3Den_US%26sdk%3Djoey%26show_facepile%3Dtrue%26small_header%3Dfalse%26tabs%3Dfalse%26width%3D200
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/sdk.js?hash=ef7542adfe8a5eb42aefe1ab1456ab2f
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f177:185:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
Security Headers
Name Value
Content-Security-Policy default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com *.fbcdn.net 'unsafe-eval';script-src *.facebook.com *.fbcdn.net 'unsafe-inline' blob: data: 'self' 'unsafe-eval';style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* wss://*.fbcdn.net attachment.fbsbx.com blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ *.fbsbx.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster: *.oculuscdn.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data:;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: *.fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Referer
https://pentestlab.blog/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
cache-control
private, no-cache, no-store, must-revalidate
content-encoding
br
content-security-policy
default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com *.fbcdn.net 'unsafe-eval';script-src *.facebook.com *.fbcdn.net 'unsafe-inline' blob: data: 'self' 'unsafe-eval';style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* wss://*.fbcdn.net attachment.fbsbx.com blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ *.fbsbx.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster: *.oculuscdn.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data:;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: *.fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-type
text/html; charset="utf-8"
cross-origin-embedder-policy-report-only
require-corp;report-to="coep_report"
cross-origin-opener-policy
same-origin-allow-popups;report-to="coop_report"
date
Mon, 19 Feb 2024 09:04:18 GMT
expires
Sat, 01 Jan 2000 00:00:00 GMT
origin-agent-cluster
?0
pragma
no-cache
report-to
{"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}
reporting-endpoints
coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown"
strict-transport-security
max-age=15552000; preload
vary
Accept-Encoding
x-content-type-options
nosniff
x-fb-debug
7Z6zAyuvCmLqTTOn8SQgPd2I+4a6LPyP7Yb+KbTLeuHOl7qQv07+LqyX2WO+6UNXevqcnwZ8UL9283GlLEaa2Q==
x-frame-options
DENY
x-xss-protection
0

Redirect headers

alt-svc
h3=":443"; ma=86400
cache-control
private, no-cache, no-store, must-revalidate
content-length
0
content-security-policy
default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com *.fbcdn.net 'unsafe-eval';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'unsafe-eval';style-src fonts.googleapis.com *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com;font-src data: *.gstatic.com *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com *.whatsapp.net *.fb.com *.oculuscdn.com *.tenor.co *.tenor.com *.giphy.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data: *.tenor.co *.tenor.com https://*.giphy.com;frame-src *.doubleclick.net *.google.com *.facebook.com www.googleadservices.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com/ https://sandbox.paywithmybank.com/;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
content-type
text/html; charset="utf-8"
cross-origin-embedder-policy-report-only
require-corp;report-to="coep_report"
cross-origin-opener-policy
unsafe-none;report-to="coop_report"
cross-origin-resource-policy
cross-origin
date
Mon, 19 Feb 2024 09:04:18 GMT
document-policy
force-load-at-top
expires
Sat, 01 Jan 2000 00:00:00 GMT
facebook-api-version
v13.0
location
https://www.facebook.com/login/?next=https%3A%2F%2Fwww.facebook.com%2Fplugins%2Fpage.php%3Fapp_id%3D249643311490%26channel%3Dhttps%253A%252F%252Fstaticxx.facebook.com%252Fx%252Fconnect%252Fxd_arbiter%252F%253Fversion%253D46%2523cb%253Dff5905bfe303ff3a3%2526domain%253Dpentestlab.blog%2526is_canvas%253Dfalse%2526origin%253Dhttps%25253A%25252F%25252Fpentestlab.blog%25252Ff180de6b96a948ca7%2526relation%253Dparent.parent%26container_width%3D342%26height%3D432%26hide_cover%3Dfalse%26hide_cta%3Dfalse%26href%3Dhttps%253A%252F%252Fwww.facebook.com%252Fpentestlaboratory%252F%26locale%3Den_US%26sdk%3Djoey%26show_facepile%3Dtrue%26small_header%3Dfalse%26tabs%3Dfalse%26width%3D200
origin-agent-cluster
?0
permissions-policy
accelerometer=(), ambient-light-sensor=(), autoplay=(), bluetooth=(), camera=(self), clipboard-write=(self), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(self), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), usb=(), window-management=(), xr-spatial-tracking=(self);report-to="permissions_policy"
permissions-policy-report-only
clipboard-read=(), clipboard-write=();report-to="permissions_policy"
pragma
no-cache
report-to
{"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}
reporting-endpoints
coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0"
strict-transport-security
max-age=15552000; preload
x-content-type-options
nosniff
x-fb-debug
/EgbPYcA+rBbNs9RYyuVRm8K02aejyt03N9OgGTkF2XuNv3nyWyTV12yHnAzb0QqBtQ3YW8/Zk9kP01bqVxoBA==
x-xss-protection
0
rate.php
polldaddy.com/ratings/ 		1 KB
545 B 		Script
General
Check archive.org
Download Go to
Full URL
https://polldaddy.com/ratings/rate.php?cmd=get&id=5556500&uid=wp-post-6835&item_id=_post_6835
Requested by
Host: polldaddy.com
URL: https://polldaddy.com/js/rating/rating.js?ver=13.2-a.6
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.123.248 Los Angeles, United States, ASN (),
Reverse DNS
polldaddy.com
Software
nginx /
Resource Hash
c2e686fd363725cd3fe16dcc56b11daf27127a7f651707d5fbf51f0a1c030af7

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pentestlab.blog/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

content-type
application/javascript
date
Mon, 19 Feb 2024 09:04:18 GMT
content-encoding
br
server
nginx
alt-svc
h3=":443"; ma=86400
vary
Accept-Encoding
content-language
en
master.html
widgets.wp.com/likes/ Frame AB25 		3 KB
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://widgets.wp.com/likes/master.html?ver=202402081217
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/29/applocker-bypass-msbuild/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
c21754110d328a886423cc2f20ec83de38c4f5dab11006198ec8c0d409152881

Request headers

Referer
https://pentestlab.blog/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

access-control-allow-methods
GET, HEAD
access-control-allow-origin
*
alt-svc
h3=":443"; ma=86400
content-encoding
br
content-type
text/html
date
Mon, 19 Feb 2024 09:04:18 GMT
etag
W/"65c4ba71-b04"
last-modified
Thu, 08 Feb 2024 11:26:41 GMT
server
nginx
timing-allow-origin
*
vary
Accept-Encoding
x-ac
2.hhn _dca MISS
x-nc
HIT hhn 1
g.gif
pixel.wp.com/ 		50 B
177 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.wp.com/g.gif?x_stats-initial-visibility=visible&v=wpcom-no-pv&rand=0.6947932101981324
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/29/applocker-bypass-msbuild/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pentestlab.blog/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

access-control-allow-origin
*
date
Mon, 19 Feb 2024 09:04:18 GMT
cache-control
no-cache
server
nginx
alt-svc
h3=":443"; ma=86400
content-length
50
content-type
image/gif
g.gif
pixel.wp.com/ 		50 B
177 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.wp.com/g.gif?blog=32637504&v=wpcom&tz=0&user_id=0&post=6835&subd=pentestlab&host=pentestlab.blog&ref=&rand=0.6482981915630552
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/29/applocker-bypass-msbuild/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pentestlab.blog/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

access-control-allow-origin
*
date
Mon, 19 Feb 2024 09:04:18 GMT
cache-control
no-cache
server
nginx
alt-svc
h3=":443"; ma=86400
content-length
50
content-type
image/gif
g.gif
pixel.wp.com/ 		50 B
177 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.wp.com/g.gif?crypt=UE40eW5QN0p8M2Y%2FRE1mNzc2NTVTamdsd0xoLz9RQkM2K298TXY9bERQMXc2MjhEaVZfb2wwakRoSj0mUkp1THptM1NdbkV1WjZIcU9mVWQmPUIvMlN6Jk8wW3NYVEJ3dWZOWExuWD9VW01sb1FYb1BbWjdGRC9sb0pTaVhpPWZ2M2IyL2FELmhfdExDTGlOcXY3ZUF1THxaPS1YSUpSRHNzNTcseS5GTGMwUi1HQ0cwMzFtLTM4Tn41YjcwPy1NeVpKNls5UU82dmxacEZ5bFluRmhqUl9sMm9tWC8uWWZ0blhIUT1yQXZxNkdycyVpL2dDRF9Ca0dQLFt3NEtGVEdabDVQZlcufDgrWi1rbSVXVy9Vdz1JU2gxUGQ5N0dpZll0SjZVJmNMMHB3VnhQOWxOTGJwcV1pblQ0ZHxlRXouY1twUmpSVUdaRm18NnhuX2dmST9TZUF8SGxpeWlFXUF%2BP183JmVRZw%3D%3D&v=wpcom-no-pv&rand=0.27144221278672065
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/29/applocker-bypass-msbuild/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pentestlab.blog/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

access-control-allow-origin
*
date
Mon, 19 Feb 2024 09:04:18 GMT
cache-control
no-cache
server
nginx
alt-svc
h3=":443"; ma=86400
content-length
50
content-type
image/gif
wp-emoji-release.min.js
s0.wp.com/wp-includes/js/ 		18 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s0.wp.com/wp-includes/js/wp-emoji-release.min.js?m=1677072837i&ver=6.5-alpha-57492
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/29/applocker-bypass-msbuild/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
4f79a89d16a5f717110fe080c0bf90b7e05ff95a4c4983f64d33110bf5f9c230

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pentestlab.blog/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

x-nc
HIT hhn 1
date
Mon, 19 Feb 2024 09:04:18 GMT
content-encoding
br
x-ac
2.hhn _dca MISS
last-modified
Fri, 22 Sep 2023 22:35:28 GMT
server
nginx
etag
W/"650e16b0-4904"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31536000
timing-allow-origin
*
alt-svc
h3=":443"; ma=86400
expires
Tue, 04 Feb 2025 12:37:47 GMT
/
pentestlab.blog/2017/05/29/applocker-bypass-msbuild/ 		4 KB
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://pentestlab.blog/2017/05/29/applocker-bypass-msbuild/?relatedposts=1
Requested by
Host: s0.wp.com
URL: https://s0.wp.com/_static/??-eJyFT0FOAzEM/BCptwdU9YB4SpXdmJXTxA62U+jvSaUFFQTiZM14POOBtxYWYUd2yAZVZioYuqHGdXCB+EV22R7gTld7aKWvxAYZvcXlvOFxLgwn4gXmTiWBYomOKTQxt+9oV4l/Go8HtHhoKu/Xz90wKz2h3Zb5taNet3Fv8KcoVFp1hP6W9k+NjTtdkJMoxO5SozstX+oLJZSmaLbVLTSDyxk5zEppxZH4XJ/2h2maDvvH45Q/AEsiiTU=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.24 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
b7f3d3b97e0109ba7bf322aede0d0a898e8a908ad1a4c8d706ed570be7a9d9ec
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff

Request headers

Referer
https://pentestlab.blog/2017/05/29/applocker-bypass-msbuild/
x-requested-with
XMLHttpRequest
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

x-hacker
Want root? Visit join.a8c.com/hacker and mention this header.
date
Mon, 19 Feb 2024 09:04:18 GMT
strict-transport-security
max-age=31536000
x-content-type-options
nosniff
content-encoding
br
server
nginx
x-ac
2.hhn _dfw EXPIRED
vary
Accept-Encoding, accept, content-type
x-pingback
https://pentestlab.blog/xmlrpc.php
content-type
application/json; charset=utf-8
host-header
WordPress.com
alt-svc
h3=":443"; ma=86400
hovercards.min.css
0.gravatar.com/js/hovercards/ 		3 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://0.gravatar.com/js/hovercards/hovercards.min.css?ver=202408131f6b765e798866d728f95661b78bbf269c86482ffff0fa8c08e18a1a65cc89
Requested by
Host: 0.gravatar.com
URL: https://0.gravatar.com/js/hovercards/hovercards.min.js?ver=202408131f6b765e798866d728f95661b78bbf269c86482ffff0fa8c08e18a1a65cc89
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
2bca0dae15027898dd6a7536d5b041014f928fbc60d9ce04dd2fa4c5d37d36ad
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubdomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pentestlab.blog/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date
Mon, 19 Feb 2024 09:04:18 GMT
strict-transport-security
max-age=31536000; includeSubdomains; preload
content-encoding
br
last-modified
Wed, 11 Oct 2023 03:50:13 GMT
server
nginx
etag
W/"65261b75-d5d"
content-type
text/css
cache-control
max-age=604800
alt-svc
h3=":443"; ma=86400
expires
Mon, 26 Feb 2024 09:04:18 GMT
count.json
api.pinterest.com/v1/urls/ 		117 B
385 B 		Script
General
Check archive.org
Download Go to
Full URL
https://api.pinterest.com/v1/urls/count.json?callback=WPCOMSharing.update_pinterest_count&url=https%3A%2F%2Fpentestlab.blog%2F2017%2F05%2F29%2Fapplocker-bypass-msbuild%2F
Requested by
Host: s0.wp.com
URL: https://s0.wp.com/wp-content/mu-plugins/jetpack-plugin/moon/_inc/build/sharedaddy/sharing.min.js?m=1685129444i
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.0.84 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
bd87a00a399df2fef456d5174f67d93fe74efcfbbb21ef549f294e99f112e05c
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pentestlab.blog/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date
Mon, 19 Feb 2024 09:04:18 GMT
x-content-type-options
nosniff
x-cdn
fastly
age
0
content-type
application/javascript
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
x-envoy-upstream-service-time
1
alt-svc
h3=":443";ma=600
x-pinterest-rid
1667042258323035
content-length
117
expires
Mon, 19 Feb 2024 09:19:18 GMT
g.gif
pixel.wp.com/ 		50 B
177 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.wp.com/g.gif?v=wpcom-no-pv&x_sharing-count-request=pinterest&r=0.7220721656088538
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/29/applocker-bypass-msbuild/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pentestlab.blog/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

access-control-allow-origin
*
date
Mon, 19 Feb 2024 09:04:18 GMT
cache-control
no-cache
server
nginx
alt-svc
h3=":443"; ma=86400
content-length
50
content-type
image/gif
remote-login.php
r-login.wordpress.com/ Frame 2CCE 		125 B
373 B 		Document
General
Check archive.org
Download Go to
Full URL
https://r-login.wordpress.com/remote-login.php?wpcom_remote_login=key&origin=aHR0cHM6Ly9wZW50ZXN0bGFiLmJsb2c%3D&wpcomid=32637504&time=1708333457
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/29/applocker-bypass-msbuild/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.18 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
abd210a1d68ca64fcf3b6de42a292f5d1f17a8e7856e4489389ca1c1e6ab05c2
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://pentestlab.blog/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
cache-control
no-cache, must-revalidate, max-age=0
content-encoding
br
content-type
text/html; charset=utf-8
date
Mon, 19 Feb 2024 09:04:18 GMT
expires
Wed, 11 Jan 1984 05:00:00 GMT
server
nginx
strict-transport-security
max-age=31536000
vary
Accept-Encoding Cookie
x-ac
1.hhn _dfw MISS
rlt-proxy.js
s0.wp.com/wp-content/js/ Frame AB25 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s0.wp.com/wp-content/js/rlt-proxy.js?m=20211122
Requested by
Host: widgets.wp.com
URL: https://widgets.wp.com/likes/master.html?ver=202402081217
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
f72ea1589b707feb0d369c239e89cc4ca754d70645c76e3a61ba0af9d69bba8c

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://widgets.wp.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

x-minify-cache
hit
date
Mon, 19 Feb 2024 09:04:18 GMT
content-encoding
br
x-ac
2.hhn _dca MISS
x-minify
t
alt-svc
h3=":443"; ma=86400
x-nc
HIT hhn 1
server
nginx
etag
W/7325-1684461116096.7104
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31536000
timing-allow-origin
*
expires
Thu, 30 May 2024 14:44:30 GMT
/
s0.wp.com/_static/ Frame AB25 		91 KB
23 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s0.wp.com/_static/??/wp-content/js/postmessage.js,/wp-content/js/tannin/compat.min.js,/wp-content/js/wpcom-proxy-request.js,/wp-content/js/likes-rest-nojquery.js?m=202402081217
Requested by
Host: widgets.wp.com
URL: https://widgets.wp.com/likes/master.html?ver=202402081217
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
c974898a4319cf567a20b7c8e5d07650ad3bdd2cb38665314a54d0efd666d474

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://widgets.wp.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

x-nc
HIT hhn 1
date
Mon, 19 Feb 2024 09:04:18 GMT
content-encoding
br
x-ac
2.hhn _dca MISS
last-modified
Thu, 15 Feb 2024 10:48:44 GMT
server
nginx
etag
W/"65cdec0c-16dd1"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31536000
timing-allow-origin
*
alt-svc
h3=":443"; ma=86400
expires
Fri, 14 Feb 2025 10:51:32 GMT
/
public-api.wordpress.com/wp-admin/rest-proxy/ Frame 9676 		9 KB
4 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://public-api.wordpress.com/wp-admin/rest-proxy/
Requested by
Host: s0.wp.com
URL: https://s0.wp.com/_static/??/wp-content/js/postmessage.js,/wp-content/js/tannin/compat.min.js,/wp-content/js/wpcom-proxy-request.js,/wp-content/js/likes-rest-nojquery.js?m=202402081217
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.23 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
dbe28dc9725d5374a9cfc6ad82a4e54154b2180d64602e3a6910999e5913167a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://widgets.wp.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
content-encoding
br
content-type
text/html; charset=utf-8
date
Mon, 19 Feb 2024 09:04:18 GMT
p3p
CP="CAO PSA OUR"
server
nginx
strict-transport-security
max-age=31536000
vary
Accept-Encoding
x-ac
1.hhn _dfw BYPASS
/
www.facebook.com/login/ Frame D9EE
Redirect Chain
  • https://www.facebook.com/v2.3/plugins/page.php?app_id=249643311490&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df0aa855d4dded94ac%26domain%3Dpente...
  • https://www.facebook.com/login/?next=https%3A%2F%2Fwww.facebook.com%2Fplugins%2Fpage.php%3Fapp_id%3D249643311490%26channel%3Dhttps%253A%252F%252Fstaticxx.facebook.com%252Fx%252Fconnect%252Fxd_arbit...
0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://www.facebook.com/login/?next=https%3A%2F%2Fwww.facebook.com%2Fplugins%2Fpage.php%3Fapp_id%3D249643311490%26channel%3Dhttps%253A%252F%252Fstaticxx.facebook.com%252Fx%252Fconnect%252Fxd_arbiter%252F%253Fversion%253D46%2523cb%253Df0aa855d4dded94ac%2526domain%253Dpentestlab.blog%2526is_canvas%253Dfalse%2526origin%253Dhttps%25253A%25252F%25252Fpentestlab.blog%25252Ff180de6b96a948ca7%2526relation%253Dparent.parent%26container_width%3D0%26height%3D432%26hide_cover%3Dfalse%26hide_cta%3Dfalse%26href%3Dhttps%253A%252F%252Fwww.facebook.com%252Fpentestlaboratory%252F%26locale%3Den_US%26sdk%3Djoey%26show_facepile%3Dtrue%26small_header%3Dfalse%26tabs%3Dfalse%26width%3D200
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/sdk.js?hash=ef7542adfe8a5eb42aefe1ab1456ab2f
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a03:2880:f177:185:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
Security Headers
Name Value
Content-Security-Policy default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com *.fbcdn.net 'unsafe-eval';script-src *.facebook.com *.fbcdn.net 'unsafe-inline' blob: data: 'self' 'unsafe-eval';style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* wss://*.fbcdn.net attachment.fbsbx.com blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ *.fbsbx.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster: *.oculuscdn.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data:;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: *.fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Referer
https://pentestlab.blog/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
cache-control
private, no-cache, no-store, must-revalidate
content-encoding
br
content-security-policy
default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com *.fbcdn.net 'unsafe-eval';script-src *.facebook.com *.fbcdn.net 'unsafe-inline' blob: data: 'self' 'unsafe-eval';style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* wss://*.fbcdn.net attachment.fbsbx.com blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ *.fbsbx.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster: *.oculuscdn.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data:;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: *.fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-type
text/html; charset="utf-8"
cross-origin-embedder-policy-report-only
require-corp;report-to="coep_report"
cross-origin-opener-policy
same-origin-allow-popups;report-to="coop_report"
date
Mon, 19 Feb 2024 09:04:18 GMT
expires
Sat, 01 Jan 2000 00:00:00 GMT
origin-agent-cluster
?0
pragma
no-cache
priority
u=0,i
report-to
{"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}
reporting-endpoints
coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown"
strict-transport-security
max-age=15552000; preload
vary
Accept-Encoding
x-content-type-options
nosniff
x-fb-debug
kDCs7t0sH6nyLxIceACH4mXT2g45jFhTei3PE0ZIpc56a7aYT2Gs+xgVmJBkeESDx/SdWvCz+246bX73XTrLtA==
x-frame-options
DENY
x-xss-protection
0

Redirect headers

alt-svc
h3=":443"; ma=86400
cache-control
private, no-cache, no-store, must-revalidate
content-length
0
content-security-policy
default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com *.fbcdn.net 'unsafe-eval';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'unsafe-eval';style-src fonts.googleapis.com *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com;font-src data: *.gstatic.com *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com *.whatsapp.net *.fb.com *.oculuscdn.com *.tenor.co *.tenor.com *.giphy.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data: *.tenor.co *.tenor.com https://*.giphy.com;frame-src *.doubleclick.net *.google.com *.facebook.com www.googleadservices.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com/ https://sandbox.paywithmybank.com/;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
content-type
text/html; charset="utf-8"
cross-origin-embedder-policy-report-only
require-corp;report-to="coep_report"
cross-origin-opener-policy
unsafe-none;report-to="coop_report"
cross-origin-resource-policy
cross-origin
date
Mon, 19 Feb 2024 09:04:18 GMT
document-policy
force-load-at-top
expires
Sat, 01 Jan 2000 00:00:00 GMT
facebook-api-version
v13.0
location
https://www.facebook.com/login/?next=https%3A%2F%2Fwww.facebook.com%2Fplugins%2Fpage.php%3Fapp_id%3D249643311490%26channel%3Dhttps%253A%252F%252Fstaticxx.facebook.com%252Fx%252Fconnect%252Fxd_arbiter%252F%253Fversion%253D46%2523cb%253Df0aa855d4dded94ac%2526domain%253Dpentestlab.blog%2526is_canvas%253Dfalse%2526origin%253Dhttps%25253A%25252F%25252Fpentestlab.blog%25252Ff180de6b96a948ca7%2526relation%253Dparent.parent%26container_width%3D0%26height%3D432%26hide_cover%3Dfalse%26hide_cta%3Dfalse%26href%3Dhttps%253A%252F%252Fwww.facebook.com%252Fpentestlaboratory%252F%26locale%3Den_US%26sdk%3Djoey%26show_facepile%3Dtrue%26small_header%3Dfalse%26tabs%3Dfalse%26width%3D200
origin-agent-cluster
?0
permissions-policy
accelerometer=(), ambient-light-sensor=(), autoplay=(), bluetooth=(), camera=(self), clipboard-write=(self), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(self), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), usb=(), window-management=(), xr-spatial-tracking=(self);report-to="permissions_policy"
permissions-policy-report-only
clipboard-read=(), clipboard-write=();report-to="permissions_policy"
pragma
no-cache
priority
u=0,i
report-to
{"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}
reporting-endpoints
coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0"
strict-transport-security
max-age=15552000; preload
x-content-type-options
nosniff
x-fb-debug
yNg3/faGqcaIT1miiQQYuw3IJZmNPmhOLN3xTeRtxtij14TWTQgg9ZNM2MLsg7rDmgkB+iUK+R6TeFLS5DU6oA==
x-xss-protection
0
star-yellow-sml.png
polldaddy.com/images/ratings/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://polldaddy.com/images/ratings/star-yellow-sml.png
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/29/applocker-bypass-msbuild/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.123.248 Los Angeles, United States, ASN (),
Reverse DNS
polldaddy.com
Software
nginx /
Resource Hash
67f5e3a1fe926d54a765050fbdae81d08d4908c38c3a2340322ec7f5086df9e3

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pentestlab.blog/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date
Mon, 19 Feb 2024 09:04:18 GMT
last-modified
Wed, 08 Sep 2021 04:24:13 GMT
server
nginx
etag
"61383aed-c0d"
content-type
image/png
cache-control
max-age=2592000
accept-ranges
bytes
alt-svc
h3=":443"; ma=86400
content-length
3085
expires
Wed, 20 Mar 2024 09:04:18 GMT
info.png
polldaddy.com/images/ratings/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://polldaddy.com/images/ratings/info.png
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/29/applocker-bypass-msbuild/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.123.248 Los Angeles, United States, ASN (),
Reverse DNS
polldaddy.com
Software
nginx /
Resource Hash
8d1b51a6bcf97a173884161816c19b753e0088a0926148482d8a1f371706c774

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pentestlab.blog/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date
Mon, 19 Feb 2024 09:04:18 GMT
last-modified
Wed, 08 Sep 2021 04:24:16 GMT
server
nginx
etag
"61383af0-4ca"
content-type
image/png
cache-control
max-age=2592000
accept-ranges
bytes
alt-svc
h3=":443"; ma=86400
content-length
1226
expires
Wed, 20 Mar 2024 09:04:18 GMT
rlt-proxy.js
s0.wp.com/wp-content/js/ Frame 9676 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s0.wp.com/wp-content/js/rlt-proxy.js?m=20211122
Requested by
Host: public-api.wordpress.com
URL: https://public-api.wordpress.com/wp-admin/rest-proxy/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
f72ea1589b707feb0d369c239e89cc4ca754d70645c76e3a61ba0af9d69bba8c

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://public-api.wordpress.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

x-minify-cache
hit
date
Mon, 19 Feb 2024 09:04:18 GMT
content-encoding
br
x-ac
2.hhn _dca MISS
x-minify
t
alt-svc
h3=":443"; ma=86400
x-nc
HIT hhn 1
server
nginx
etag
W/7325-1684461116096.7104
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31536000
timing-allow-origin
*
expires
Thu, 30 May 2024 14:44:30 GMT
results
api.crowdsignal.com/v3/polls/null/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://api.crowdsignal.com/v3/polls/null/results
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.123.249 Los Angeles, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
polldaddy.com
Software
nginx /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
GET
Origin
https://pentestlab.blog
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

access-control-allow-headers
X-HTTP-Method-Override,X-Requested-With,Content-Type,Accept,Origin,X-Ajax-Api-Token,X-Api-Partner-Guid,X-Api-User-Code,X-Partner-User-Id
access-control-allow-methods
OPTIONS
access-control-allow-origin
*
alt-svc
h3=":443"; ma=86400
content-encoding
br
content-language
en
content-type
text/html; charset=utf-8
date
Mon, 19 Feb 2024 09:04:19 GMT
server
nginx
strict-transport-security
max-age=31536000
vary
Accept-Encoding
actionbar.css
s0.wp.com/wp-content/mu-plugins/actionbar/ 		15 KB
4 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://s0.wp.com/wp-content/mu-plugins/actionbar/actionbar.css?v=20240115
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/29/applocker-bypass-msbuild/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
c1e62caa83381d8a3c58be2a17f28bff4176e8ddcd882bb923f3152852c06df9

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pentestlab.blog/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

x-minify-cache
hit
date
Mon, 19 Feb 2024 09:04:19 GMT
content-encoding
br
x-ac
2.hhn _dca MISS
x-minify
t
alt-svc
h3=":443"; ma=86400
x-nc
HIT hhn 1
server
nginx
etag
W/18324-1705283922318.0986
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=31536000
timing-allow-origin
*
expires
Tue, 14 Jan 2025 01:58:53 GMT
actionbar.js
s0.wp.com/wp-content/mu-plugins/actionbar/ 		8 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s0.wp.com/wp-content/mu-plugins/actionbar/actionbar.js?v=20231122
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2017/05/29/applocker-bypass-msbuild/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
28bac34917bba2f5ebef5c3a1533fdfcd9c7c6e0accef5bc18addd58adeb1181

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pentestlab.blog/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

x-minify-cache
hit
date
Mon, 19 Feb 2024 09:04:19 GMT
content-encoding
br
x-ac
2.hhn _dca MISS
x-minify
t
alt-svc
h3=":443"; ma=86400
x-nc
HIT hhn 1
server
nginx
etag
W/15129-1699585415136.014
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31536000
timing-allow-origin
*
expires
Thu, 21 Nov 2024 12:53:02 GMT
results
api.crowdsignal.com/v3/polls/null/ 		83 B
436 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://api.crowdsignal.com/v3/polls/null/results
Requested by
Host: s0.wp.com
URL: https://s0.wp.com/_static/??-eJyljjEOwjAMRS9EcCuGwoA4CkrcUDlNYitOmuu3AxNCYmB80n9PH7oY5Fx9rpCakdgWygpYuM9KS7bRvLgkBdcozmBFom3qz0FP8F0NvorF9c2QmDM8KSO4yLgqaHOKhaQSH+uNfP8jVrx4W81GSpXLrxrawsf5aLogpw88vEe6j9Mw3S7TdRjDDhnGaow=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.123.249 Los Angeles, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
polldaddy.com
Software
nginx /
Resource Hash
0cb77f6bd1273cad08e067ffed9417a11c287310733ae531deda3d43fc4f2024
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://pentestlab.blog/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
content-type
application/json

Response headers

date
Mon, 19 Feb 2024 09:04:19 GMT
content-encoding
br
strict-transport-security
max-age=31536000
server
nginx
vary
Accept-Encoding
access-control-allow-methods
OPTIONS
content-language
en
access-control-allow-origin
*
content-type
application/json
access-control-allow-headers
X-HTTP-Method-Override,X-Requested-With,Content-Type,Accept,Origin,X-Ajax-Api-Token,X-Api-Partner-Guid,X-Api-User-Code,X-Partner-User-Id
alt-svc
h3=":443"; ma=86400
admin-ajax.php
pentestlab.blog/wp-admin/ 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://pentestlab.blog/wp-admin/admin-ajax.php
Requested by
Host: s0.wp.com
URL: https://s0.wp.com/wp-content/mu-plugins/actionbar/actionbar.js?v=20231122
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
192.0.78.24 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://pentestlab.blog/2017/05/29/applocker-bypass-msbuild/
X-Requested-With
XMLHttpRequest
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

x-hacker
Want root? Visit join.a8c.com/hacker and mention this header.
date
Mon, 19 Feb 2024 09:04:20 GMT
strict-transport-security
max-age=31536000
x-content-type-options
nosniff
content-encoding
br
x-ac
2.hhn _dfw BYPASS
host-header
WordPress.com
alt-svc
h3=":443"; ma=86400
referrer-policy
strict-origin-when-cross-origin
server
nginx
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
text/html; charset=UTF-8
access-control-allow-origin
https://pentestlab.blog
cache-control
no-cache, must-revalidate, max-age=0
access-control-allow-credentials
true
x-robots-tag
noindex
expires
Wed, 11 Jan 1984 05:00:00 GMT

Verdicts & Comments Add Verdict or Comment

89 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| WebFontConfig string| wpcom_remote_login_extra_auth function| wpcom_remote_login_remove_dom_node_id function| wpcom_remote_login_remove_dom_node_classes function| wpcom_remote_login_final_cleanup function| addLoadEvent object| _wpemojiSettings object| related_posts_js_options object| videopressAjax object| actionbardata object| wpcom_mobile_user_agent_info function| rltInvalidateToken function| rltInjectToken function| rltIsAuthenticated function| rltGetToken function| rltAddInitializationListener function| rltStoreToken function| rltInitialize undefined| $ function| jQuery object| WebFont object| Gravatar object| WPGroHo object| WPCOM_sharing_counts function| XRegExp object| SyntaxHighlighter object| jpfbembed object| jetpackSwiperLibraryPath object| jetpackCarouselStrings object| VerbumComments object| jetpackLikesWidgetBatch boolean| jetpackLikesMasterReady number| jetpackLikesLookAhead object| jetpackCommentLikesLoadedWidgets object| jetpackLikesDocReadyPromise function| JetpackLikesPostMessage function| JetpackLikesBatchHandler function| JetpackLikesMessageListener function| hideLikersPopover function| JetpackLikesWidgetQueueHandler function| jetpackLoadLikeWidgetIframe function| jetpackGetUnloadedWidgetsInView function| jetpackIsScrolledIntoView function| jetpackUnloadScrolledOutWidgets function| jetpackWidgetsDelayedExec function| jetpackOnScrollStopped object| addComment function| fbAsyncInit undefined| _ function| lodash object| runtime object| regeneratorRuntime object| React object| ReactDOM object| wp function| sprintf function| vsprintf function| Mousetrap object| FB string| Jetpack_Block_Assets_Base_Url object| wpcom object| PDRTJS_settings_5556500_post_6835 object| __buffer object| pd_map function| PDRTJS_url_encode function| PDRTJS_is_defined object| ratings_text function| PDRTJS_RATING object| PDRTJS_doc string| PDRTJS_id object| PDRTJS_5556500_post_6835 object| sharing_js_options object| WPCOMSharing undefined| windowOpen object| wpcom_reblog object| _tkq object| _stq string| mobileStatsQueryString object| WP_Enqueue_Dynamic_Script object| twemoji object| icons_part object| part object| t string| className boolean| gutter number| pos object| CrowdsignalMutationObservers

1 Cookies

Domain/Path Name / Value
pentestlab.blog/2017/05/29/applocker-bypass-msbuild/ Name: jp-visit-counter
Value: 1

3 Console Messages

Source Level URL
Text
other warning URL: https://pentestlab.blog/2017/05/29/applocker-bypass-msbuild/
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://pentestlab.blog/2017/05/29/applocker-bypass-msbuild/
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other error URL: chrome-error://chromewebdata/
Message:
Refused to display 'https://www.facebook.com/' in a frame because it set 'X-Frame-Options' to 'deny'.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

0.gravatar.com
api.crowdsignal.com
api.pinterest.com
connect.facebook.net
fonts-api.wp.com
fonts.wp.com
pentestlab.blog
pentestlab.files.wordpress.com
pixel.wp.com
polldaddy.com
public-api.wordpress.com
r-login.wordpress.com
s0.wp.com
stats.wp.com
widgets.wp.com
www.facebook.com
151.101.0.84
192.0.123.248
192.0.123.249
192.0.72.29
192.0.76.3
192.0.77.32
192.0.78.18
192.0.78.23
192.0.78.24
2a03:2880:f084:105:face:b00c:0:3
2a03:2880:f177:185:face:b00c:0:25de
2a04:fa87:fffe::c000:4902
017bccf545b2ffdfa4d25b1b7a47d847a1c03c00d9a60426cdaed49cf7bbe2da
0cb77f6bd1273cad08e067ffed9417a11c287310733ae531deda3d43fc4f2024
1234d1e44ba1656e2893e1520f76d89edfdb39be05a489be408a3a29673aad50
131f6b765e798866d728f95661b78bbf269c86482ffff0fa8c08e18a1a65cc89
18374219c1fc61a61818bc567193b1b3c22834bd4cd071f0e681888fb444d47c
1f16434d944a6e996c5b5bf08d9061ee33eaf68dbd2f4f8f786e159f7dc5cae6
1f2f5c59134b1ff5e6e60f0fb548fbc718903877cab07963851ed84ab1cf0b42
211fdb26a74dac46f2bd297c0f02953de9e69355035cad239d87acf21c5a6a0e
24004b1763b0275d5a1d9f66f08616a54b95aeec1f0034766bbb479679a82fc3
26918e4295cab1eaecebc5d4719c212691f040bfe31daf0c7caf08f7a0de520a
28bac34917bba2f5ebef5c3a1533fdfcd9c7c6e0accef5bc18addd58adeb1181
2bca0dae15027898dd6a7536d5b041014f928fbc60d9ce04dd2fa4c5d37d36ad
2d83bea79070b8f4ed432fbadad2c1214eb3e5af8a2000c375b44c7625691f5c
2e3161cf8fb5342820617a465c6fd72afa46a0b54db3a03813a691725310dbcb
376eacb307ddbfb56e702fe1c39363c70218d2e4ac32d7ba96f0403da942a093
3a6eca802634248cd9896666cb3a031eabf070b1d11a7ce6bb361b1811cd67a2
3d2c10cf69410c10177fc6e56937d05151b182841fa6aee36f651d587d91fbb8
4184b0f4356e4605d8c0484f48c3e69f4840c601a4b1268f0499534e0e162802
44fffd760753b25ef9cd03561ee719d51cb9a2e39f3d65c3db37444a60f3e0e3
453cb806084fdabec32e286af2e88899f79022125c2527afffbec507975d2c22
45a05663a6bbdacc788b036380a0ee4c7b49b7bc498d8a98d8e5748b91e59030
466ce3f481df55d5402c2179fbfff4190e0881d9a94ab5303b4978bb123bd8db
499b2afc2ca8c8cd894668ae9c64b89438c8170ecd5251af73215052f5125d1a
4a405940a0d64eba67299cc8d915f3afbf8db9c3683d90cbfe12484dfbc26b40
4dd338d49738b699a41993a965b1e6a8755ef8d0d5252ee3341a2707227580e4
4f79a89d16a5f717110fe080c0bf90b7e05ff95a4c4983f64d33110bf5f9c230
50b14ff286671974963967fd56c5d06430fea5b81ab695665752ae76236828fe
52d995270969aed722e4e20184d2d424f0e1afb1040ef2273549bf0ba7c75d07
563b3e06e230af4e6e56e31ce3f8745c198f6fbedf6851096ab85d05e95957ac
5907cda67409e93cedea2b7f2adad9ef600150726a80e468507b3e17450e271a
5e74f7913224ebf980e700c024c5688db233a79664dca28ea531e0319e1286ce
66f69ace341969d16b2b3709a823e62788c738e6170a9689dbe75b18e48d5453
67f5e3a1fe926d54a765050fbdae81d08d4908c38c3a2340322ec7f5086df9e3
6dc63fe3f880324c960483652ea9f872199ad3887e2e072e1925cb167bafa576
70746c461d32b81951f85b1da353e29d43410ae13916ae31b845a0bcbf4e197f
70c44a9df364a5e5779a64d3b6bace4a0939ad6649859f59e30d4df5bbfbf7d6
729cb114db2bc898ebd76af066a49a76432f8ad984505e6ecfcfbc37672813cf
738223eb8c8c70913bf59775dc575c205070014babc8b174fd3ab8e6082ebe30
79674b01741c3978417b6b9b4b98d125755e7bb468979d5cd593eac4b94cdb91
7c00752ce82d6abaed0b9766d35b906b16675facdbe24115b410d1fab975effa
7d5f6f7d593191e51c8211ccee54ec6b5425e3f5ae5da264eb56f7c1a8cbd630
7dacf83f51179de8d7980a513e67ab3a08f2c6272bb5946df8fd77c0d1763b73
7e1a64919ef5dd0b1200faaa2ae9a69f228e67005a3731038e9cb420a1b9cdcb
7f653b3ce9d3277457fc6da4edb246ae2f6c913f088c42dcb8cd2e96267aa21a
81d80f7617f35c300905e4d00edab280731bc69dc5a1bb457a3171a296f0c579
838709124cee365353054f8fdf0aa50451ae4d8a215b9695e6d5db4298d19053
861af5dd96b652ea4e711b9377e771b5200b235ad71b216dd0ba669e640f0822
8b3a8a246c45119b67a073294f5e93182f758dacaa75dc2c628055f9d5ddc5da
8d1b51a6bcf97a173884161816c19b753e0088a0926148482d8a1f371706c774
8f892de7bd3f42587028e9a8ddd9d01c6923f3947e657710ef40a2407e718de6
91d0022cd0ba8821088854f4e21f21ddf56c1b1017446ca6189ff7bf593e2b72
93111ec228b7cde5000f4062ac113d5c56c77b2a7ccc4ab3b6ceaf97fe340e37
96e284f53f584411c21ef89fa08219b4188014333413eef9f7de213669c25fa7
97cc56205ee842e64adc7912cb7e86c6b31a90ba065cf46009c09bca05293059
9c83b89ab9d2677980617afacb833a74da3050a2d3d711176b500d7922e49ab5
9e1dae23d3ad3212f67d09ca79a50003c32953c36bab976f634c9b38d8a8c6dc
a37ef75bef9c0b9ca67220a826fad8761b880347fbb763c56d38834eb1c5a302
a649373e4789ca5cee6ed7b72fea1481882aa0805cf155c84b2f262e6e1771f9
a851ac2edc584a3b08c0a057bb2d0c08ac95c4de2cc453e22a2c83305cce3694
abd210a1d68ca64fcf3b6de42a292f5d1f17a8e7856e4489389ca1c1e6ab05c2
af186659e415490e7eee1bd3c8d511771dbd3e03ddbebf6b6a5096ac8ba29449
b09821aed363061c36adeda7e8f1c685e6cd1abd99416c04c656d1b3a348cb7c
b2f4ce6ff2c8847c7e0c92f35ef61a5b36e5048733080b7cc1a81b8399014aff
b52de70853ed4bac82f0c4cc5d6c7da8d588de61d97e8c30b99e40eefcde5a44
b6e4492d3b8358a81b80908b1f84e6bd2f64a7a46d48793af99d27bf29f4c2e8
b7a54157378a868c322672b4365b9df14078f9a508bb2b439d1ccdd60064f3be
b7f3d3b97e0109ba7bf322aede0d0a898e8a908ad1a4c8d706ed570be7a9d9ec
bbc51c7d3315175c9f89d86add8afd37a09671935e0306a1fea6e0189f37901c
bd87a00a399df2fef456d5174f67d93fe74efcfbbb21ef549f294e99f112e05c
bdb75e08b4b1eedee2847c2eafacc3089842b8735f7c6d4e99aedcb6ba828e55
c04297ce6c1a6841e4cc7884f9987c68a900bb819fd93bfd43a392cde099e234
c0e93b5ebf107af77d9e7d101d186b3b93e9d5ad4fbb6a74e2dea60173cc04f8
c1e62caa83381d8a3c58be2a17f28bff4176e8ddcd882bb923f3152852c06df9
c21754110d328a886423cc2f20ec83de38c4f5dab11006198ec8c0d409152881
c24a88a723aada71fa0ebef60ff83967a98722c4ba7907dc957deb0677c4cfc2
c2e686fd363725cd3fe16dcc56b11daf27127a7f651707d5fbf51f0a1c030af7
c4d02955d7fcc9932a937efd780b2ea0d6d8446b056d8dc04f3ac6046249014c
c974898a4319cf567a20b7c8e5d07650ad3bdd2cb38665314a54d0efd666d474
cf75f45164a049900471e9bc171c299121e16f3675651b92ee8ca43dc974d64a
d1250ea07224819d007acda104687b92e3a5174adacf12837fc5e9ff14021286
d15b8523b7c7901946b1c21bc80d4c537a887402002a13ac81a8e8d228880219
d413a32d4aad316a296461ff801272dc11512f252e5eba70da8e0673c204b235
d6480caf5f26b15563f969737af7f284bf796de4dd63c8caaa3481fe75d05b80
d6aa645764dc59ae4f0585681381d901f186cae336e44e1fbc8de1c0a529e7ff
d743ad07240fdc75d2e2a357b4ff44b334f6d4c53683e31e824aaf61d3bad0c9
dbba6c1c59954873629e196b8009f0a8256e66d755f889cf6c8ac4f1164d10c2
dbe28dc9725d5374a9cfc6ad82a4e54154b2180d64602e3a6910999e5913167a
dd79ce63ce5a132125a6d7b35c694ccae6c4b9b8be39c9e34ed59ee747999575
de82ba6d47c0b4495e7dc26891a7ef82f1f07730df39a5375343b341c4eec13d
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1
f72ea1589b707feb0d369c239e89cc4ca754d70645c76e3a61ba0af9d69bba8c
fa05d541ee61f9bb7ef491217c0832f45a6be57be62c00cbc3b7c63a7ef86603
fe788e0f7ae46a370ab3eb4f2a404269b1072e56135216713e39502c7dacde59