urlscan.io logo urlscan.io
SecurityTrails logo

0x00-0x00.github.io Open in urlscan Pro
185.199.110.153  Public Scan

Go To Rescan Add Verdict Report
URL: https://0x00-0x00.github.io/research/2018/10/28/How-to-bypass-AMSI-and-Execute-ANY-malicious-powershell-code.html
Submission: On September 22 via api from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 10 HTTP transactions. The main IP is 185.199.110.153, located in United States and belongs to FASTLY, US. The main domain is 0x00-0x00.github.io.
TLS certificate: Issued by DigiCert SHA2 High Assurance Server CA on May 6th 2020. Valid for: 2 years.
This is the only time 0x00-0x00.github.io was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
10 185.199.110.153 54113 (FASTLY)
10 1
Apex Domain
Subdomains		 Transfer
10 github.io
0x00-0x00.github.io
253 KB
10 1
Domain Requested by
10 0x00-0x00.github.io 0x00-0x00.github.io
10 1

This site contains links to these domains. Also see Links.

Domain
www.cyberark.com
github.com
www.twitter.com
Subject Issuer Validity Valid
www.github.com
DigiCert SHA2 High Assurance Server CA		 2020-05-06 -
2022-04-14		 2 years crt.sh

This page contains 1 frames:

Primary Page: https://0x00-0x00.github.io/research/2018/10/28/How-to-bypass-AMSI-and-Execute-ANY-malicious-powershell-code.html
Frame ID: E48F16328425D71E8C03F74407DC0B01
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

How to bypass AMSI and execute ANY malicious Powershell code | zc00l blog

Detected technologies

Overall confidence: 100%
Detected patterns
  • <!-- Begin Jekyll SEO tag
Overall confidence: 100%
Detected patterns
  • ^https?://[^/]+\.github\.io

Page Statistics

10
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

253 kB
Transfer

280 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request How-to-bypass-AMSI-and-Execute-ANY-malicious-powershell-code.html
0x00-0x00.github.io/research/2018/10/28/ 		27 KB
9 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://0x00-0x00.github.io/research/2018/10/28/How-to-bypass-AMSI-and-Execute-ANY-malicious-powershell-code.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
185.199.110.153 , United States, ASN54113 (FASTLY, US),
Reverse DNS
cdn-185-199-110-153.github.com
Software
GitHub.com /
Resource Hash
db5e627a81ed8ca5db113392ff1076021b06d09088f3267fe6789c9642e98ad6
Security Headers
Name Value
Strict-Transport-Security max-age=31556952

Request headers

:method
GET
:authority
0x00-0x00.github.io
:scheme
https
:path
/research/2018/10/28/How-to-bypass-AMSI-and-Execute-ANY-malicious-powershell-code.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language
de-DE,de;q=0.9
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language
de-DE,de;q=0.9

Response headers

server
GitHub.com
content-type
text/html; charset=utf-8
permissions-policy
interest-cohort=()
strict-transport-security
max-age=31556952
last-modified
Wed, 17 Jun 2020 15:20:12 GMT
access-control-allow-origin
*
etag
W/"5eea34ac-6bbc"
expires
Wed, 22 Sep 2021 18:14:47 GMT
cache-control
max-age=600
content-encoding
gzip
x-proxy-cache
MISS
x-github-request-id
FE10:DE3C:E1CF83:E8E239:614B703F
accept-ranges
bytes
date
Wed, 22 Sep 2021 18:04:59 GMT
via
1.1 varnish
age
13
x-served-by
cache-fra19152-FRA
x-cache
HIT
x-cache-hits
1
x-timer
S1632333900.872354,VS0,VE1
vary
Accept-Encoding
x-fastly-request-id
deee26af8f09522ad795ea52fc335b115c7d0c13
content-length
8483
main.css
0x00-0x00.github.io/assets/ 		7 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://0x00-0x00.github.io/assets/main.css
Requested by
Host: 0x00-0x00.github.io
URL: https://0x00-0x00.github.io/research/2018/10/28/How-to-bypass-AMSI-and-Execute-ANY-malicious-powershell-code.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
185.199.110.153 , United States, ASN54113 (FASTLY, US),
Reverse DNS
cdn-185-199-110-153.github.com
Software
GitHub.com /
Resource Hash
f861c07e386d770d235e0a7d5674e3b851103960f1b675d5ac614b01f881e02e
Security Headers
Name Value
Strict-Transport-Security max-age=31556952

Request headers

:path
/assets/main.css
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
0x00-0x00.github.io
referer
https://0x00-0x00.github.io/research/2018/10/28/How-to-bypass-AMSI-and-Execute-ANY-malicious-powershell-code.html
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://0x00-0x00.github.io/research/2018/10/28/How-to-bypass-AMSI-and-Execute-ANY-malicious-powershell-code.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-fastly-request-id
170afd32cb75e99b8fbf28cb12c1b57a202dadac
strict-transport-security
max-age=31556952
content-encoding
gzip
etag
W/"5eea34ac-1b46"
age
13
x-cache
HIT
content-length
1861
x-served-by
cache-fra19152-FRA
access-control-allow-origin
*
last-modified
Wed, 17 Jun 2020 15:20:12 GMT
server
GitHub.com
x-github-request-id
4C08:13001:6B940B:70CE82:614B703F
x-timer
S1632333900.903248,VS0,VE1
date
Wed, 22 Sep 2021 18:04:59 GMT
vary
Accept-Encoding
content-type
text/css; charset=utf-8
via
1.1 varnish
expires
Wed, 22 Sep 2021 18:14:47 GMT
cache-control
max-age=600
permissions-policy
interest-cohort=()
accept-ranges
bytes
x-proxy-cache
MISS
x-cache-hits
1
amsi_01.JPG
0x00-0x00.github.io/assets/ 		23 KB
23 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://0x00-0x00.github.io/assets/amsi_01.JPG
Requested by
Host: 0x00-0x00.github.io
URL: https://0x00-0x00.github.io/research/2018/10/28/How-to-bypass-AMSI-and-Execute-ANY-malicious-powershell-code.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
185.199.110.153 , United States, ASN54113 (FASTLY, US),
Reverse DNS
cdn-185-199-110-153.github.com
Software
GitHub.com /
Resource Hash
c3cfdfa23aaa9bbd046d124b97b20243014b115c1528edceebfe9ef6527002f2
Security Headers
Name Value
Strict-Transport-Security max-age=31556952

Request headers

:path
/assets/amsi_01.JPG
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
0x00-0x00.github.io
referer
https://0x00-0x00.github.io/research/2018/10/28/How-to-bypass-AMSI-and-Execute-ANY-malicious-powershell-code.html
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://0x00-0x00.github.io/research/2018/10/28/How-to-bypass-AMSI-and-Execute-ANY-malicious-powershell-code.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-fastly-request-id
2885c1cd6d4f5fa9d5cdc71b84ce1a7fe66e787b
strict-transport-security
max-age=31556952
via
1.1 varnish
etag
"5eea34a7-5cd5"
age
13
x-cache
HIT
content-length
23765
x-served-by
cache-fra19152-FRA
last-modified
Wed, 17 Jun 2020 15:20:07 GMT
server
GitHub.com
x-github-request-id
A1C4:8B19:B50880:BAB39F:614B703F
x-timer
S1632333900.903452,VS0,VE1
date
Wed, 22 Sep 2021 18:04:59 GMT
vary
Accept-Encoding
content-type
image/jpeg
access-control-allow-origin
*
expires
Wed, 22 Sep 2021 18:14:47 GMT
cache-control
max-age=600
permissions-policy
interest-cohort=()
accept-ranges
bytes
x-origin-cache
HIT
x-proxy-cache
MISS
x-cache-hits
1
amsi_02.JPG
0x00-0x00.github.io/assets/ 		21 KB
21 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://0x00-0x00.github.io/assets/amsi_02.JPG
Requested by
Host: 0x00-0x00.github.io
URL: https://0x00-0x00.github.io/research/2018/10/28/How-to-bypass-AMSI-and-Execute-ANY-malicious-powershell-code.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
185.199.110.153 , United States, ASN54113 (FASTLY, US),
Reverse DNS
cdn-185-199-110-153.github.com
Software
GitHub.com /
Resource Hash
5b103747c64980bbfd436b11c8fa2bdfd8560211692d65de2a881ecee7d27c4a
Security Headers
Name Value
Strict-Transport-Security max-age=31556952

Request headers

:path
/assets/amsi_02.JPG
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
0x00-0x00.github.io
referer
https://0x00-0x00.github.io/research/2018/10/28/How-to-bypass-AMSI-and-Execute-ANY-malicious-powershell-code.html
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://0x00-0x00.github.io/research/2018/10/28/How-to-bypass-AMSI-and-Execute-ANY-malicious-powershell-code.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-fastly-request-id
b72cdeccf86bce6b5e8a318ccb86f80c64066d25
strict-transport-security
max-age=31556952
via
1.1 varnish
etag
"5eea34a7-52f4"
age
13
x-cache
HIT
content-length
21236
x-served-by
cache-fra19152-FRA
last-modified
Wed, 17 Jun 2020 15:20:07 GMT
server
GitHub.com
x-github-request-id
F7A8:A3DC:8B3E4D:8F61DD:614B703F
x-timer
S1632333900.904149,VS0,VE1
date
Wed, 22 Sep 2021 18:04:59 GMT
vary
Accept-Encoding
content-type
image/jpeg
access-control-allow-origin
*
expires
Wed, 22 Sep 2021 18:14:47 GMT
cache-control
max-age=600
permissions-policy
interest-cohort=()
accept-ranges
bytes
x-proxy-cache
MISS
x-cache-hits
1
amsi_03.JPG
0x00-0x00.github.io/assets/ 		12 KB
13 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://0x00-0x00.github.io/assets/amsi_03.JPG
Requested by
Host: 0x00-0x00.github.io
URL: https://0x00-0x00.github.io/research/2018/10/28/How-to-bypass-AMSI-and-Execute-ANY-malicious-powershell-code.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
185.199.110.153 , United States, ASN54113 (FASTLY, US),
Reverse DNS
cdn-185-199-110-153.github.com
Software
GitHub.com /
Resource Hash
b91f995e7e225eda0d06ca68fde19c64ce53bc8dbf8710b7fa6498cd8b6814ac
Security Headers
Name Value
Strict-Transport-Security max-age=31556952

Request headers

:path
/assets/amsi_03.JPG
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
0x00-0x00.github.io
referer
https://0x00-0x00.github.io/research/2018/10/28/How-to-bypass-AMSI-and-Execute-ANY-malicious-powershell-code.html
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://0x00-0x00.github.io/research/2018/10/28/How-to-bypass-AMSI-and-Execute-ANY-malicious-powershell-code.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-fastly-request-id
0294f3d2e323a95016f5d11bc1bea4155fcf0be8
strict-transport-security
max-age=31556952
via
1.1 varnish
etag
"5eea34a7-315c"
age
13
x-cache
HIT
content-length
12636
x-served-by
cache-fra19152-FRA
last-modified
Wed, 17 Jun 2020 15:20:07 GMT
server
GitHub.com
x-github-request-id
CB0E:0A2B:2A4015:2B3AE5:614B703F
x-timer
S1632333900.904510,VS0,VE1
date
Wed, 22 Sep 2021 18:04:59 GMT
vary
Accept-Encoding
content-type
image/jpeg
access-control-allow-origin
*
expires
Wed, 22 Sep 2021 18:14:47 GMT
cache-control
max-age=600
permissions-policy
interest-cohort=()
accept-ranges
bytes
x-proxy-cache
MISS
x-cache-hits
1
amsi_04.JPG
0x00-0x00.github.io/assets/ 		18 KB
18 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://0x00-0x00.github.io/assets/amsi_04.JPG
Requested by
Host: 0x00-0x00.github.io
URL: https://0x00-0x00.github.io/research/2018/10/28/How-to-bypass-AMSI-and-Execute-ANY-malicious-powershell-code.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
185.199.110.153 , United States, ASN54113 (FASTLY, US),
Reverse DNS
cdn-185-199-110-153.github.com
Software
GitHub.com /
Resource Hash
fb130a57f4d5a3e62a12fdb83e2b707a71ca077b80065f463147b8ee996edfe6
Security Headers
Name Value
Strict-Transport-Security max-age=31556952

Request headers

:path
/assets/amsi_04.JPG
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
0x00-0x00.github.io
referer
https://0x00-0x00.github.io/research/2018/10/28/How-to-bypass-AMSI-and-Execute-ANY-malicious-powershell-code.html
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://0x00-0x00.github.io/research/2018/10/28/How-to-bypass-AMSI-and-Execute-ANY-malicious-powershell-code.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-fastly-request-id
372e6a5be1f354b4755b286a96c333a958c65f00
strict-transport-security
max-age=31556952
via
1.1 varnish
etag
"5eea34a7-4660"
age
13
x-cache
HIT
content-length
18016
x-served-by
cache-fra19152-FRA
last-modified
Wed, 17 Jun 2020 15:20:07 GMT
server
GitHub.com
x-github-request-id
74BC:E4B9:EB178A:F251B8:614B703F
x-timer
S1632333900.904590,VS0,VE1
date
Wed, 22 Sep 2021 18:04:59 GMT
vary
Accept-Encoding
content-type
image/jpeg
access-control-allow-origin
*
expires
Wed, 22 Sep 2021 18:14:47 GMT
cache-control
max-age=600
permissions-policy
interest-cohort=()
accept-ranges
bytes
x-proxy-cache
MISS
x-cache-hits
1
amsi_05.JPG
0x00-0x00.github.io/assets/ 		19 KB
19 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://0x00-0x00.github.io/assets/amsi_05.JPG
Requested by
Host: 0x00-0x00.github.io
URL: https://0x00-0x00.github.io/research/2018/10/28/How-to-bypass-AMSI-and-Execute-ANY-malicious-powershell-code.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
185.199.110.153 , United States, ASN54113 (FASTLY, US),
Reverse DNS
cdn-185-199-110-153.github.com
Software
GitHub.com /
Resource Hash
55942793c4789f828655418fa3864a1d8a10ad49263706e24b1e5f3cd9a7f027
Security Headers
Name Value
Strict-Transport-Security max-age=31556952

Request headers

:path
/assets/amsi_05.JPG
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
0x00-0x00.github.io
referer
https://0x00-0x00.github.io/research/2018/10/28/How-to-bypass-AMSI-and-Execute-ANY-malicious-powershell-code.html
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://0x00-0x00.github.io/research/2018/10/28/How-to-bypass-AMSI-and-Execute-ANY-malicious-powershell-code.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-fastly-request-id
0f4c2f09ab707b430b8c2c9e9ef95cb36b22c4f5
strict-transport-security
max-age=31556952
via
1.1 varnish
etag
"5eea34a7-4b9c"
age
13
x-cache
HIT
content-length
19356
x-served-by
cache-fra19152-FRA
last-modified
Wed, 17 Jun 2020 15:20:07 GMT
server
GitHub.com
x-github-request-id
F688:A3DC:8B3E4D:8F61DE:614B703F
x-timer
S1632333900.904619,VS0,VE1
date
Wed, 22 Sep 2021 18:04:59 GMT
vary
Accept-Encoding
content-type
image/jpeg
access-control-allow-origin
*
expires
Wed, 22 Sep 2021 18:14:47 GMT
cache-control
max-age=600
permissions-policy
interest-cohort=()
accept-ranges
bytes
x-proxy-cache
MISS
x-cache-hits
1
amsi_06.JPG
0x00-0x00.github.io/assets/ 		38 KB
38 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://0x00-0x00.github.io/assets/amsi_06.JPG
Requested by
Host: 0x00-0x00.github.io
URL: https://0x00-0x00.github.io/research/2018/10/28/How-to-bypass-AMSI-and-Execute-ANY-malicious-powershell-code.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
185.199.110.153 , United States, ASN54113 (FASTLY, US),
Reverse DNS
cdn-185-199-110-153.github.com
Software
GitHub.com /
Resource Hash
548a092e1a3d7dbce81a5f9135e5f30c6178c6ef01258fbad5dae784241b9af7
Security Headers
Name Value
Strict-Transport-Security max-age=31556952

Request headers

:path
/assets/amsi_06.JPG
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
0x00-0x00.github.io
referer
https://0x00-0x00.github.io/research/2018/10/28/How-to-bypass-AMSI-and-Execute-ANY-malicious-powershell-code.html
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://0x00-0x00.github.io/research/2018/10/28/How-to-bypass-AMSI-and-Execute-ANY-malicious-powershell-code.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-fastly-request-id
22e14c381a40aa3c6e9b5bf019dea26a996b27d5
strict-transport-security
max-age=31556952
via
1.1 varnish
etag
"5eea34a7-97f9"
age
13
x-cache
HIT
content-length
38905
x-served-by
cache-fra19152-FRA
last-modified
Wed, 17 Jun 2020 15:20:07 GMT
server
GitHub.com
x-github-request-id
B99C:6AF8:D92116:E0170E:614B703F
x-timer
S1632333900.904623,VS0,VE1
date
Wed, 22 Sep 2021 18:04:59 GMT
vary
Accept-Encoding
content-type
image/jpeg
access-control-allow-origin
*
expires
Wed, 22 Sep 2021 18:14:47 GMT
cache-control
max-age=600
permissions-policy
interest-cohort=()
accept-ranges
bytes
x-proxy-cache
MISS
x-cache-hits
1
amsi_07.JPG
0x00-0x00.github.io/assets/ 		106 KB
106 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://0x00-0x00.github.io/assets/amsi_07.JPG
Requested by
Host: 0x00-0x00.github.io
URL: https://0x00-0x00.github.io/research/2018/10/28/How-to-bypass-AMSI-and-Execute-ANY-malicious-powershell-code.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
185.199.110.153 , United States, ASN54113 (FASTLY, US),
Reverse DNS
cdn-185-199-110-153.github.com
Software
GitHub.com /
Resource Hash
6647ee6af809d0e2bd4bdc2cc1ba61213e969850fe1106417c7b49ca5a68773d
Security Headers
Name Value
Strict-Transport-Security max-age=31556952

Request headers

:path
/assets/amsi_07.JPG
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
0x00-0x00.github.io
referer
https://0x00-0x00.github.io/research/2018/10/28/How-to-bypass-AMSI-and-Execute-ANY-malicious-powershell-code.html
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://0x00-0x00.github.io/research/2018/10/28/How-to-bypass-AMSI-and-Execute-ANY-malicious-powershell-code.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-fastly-request-id
9120c16e3ee2e5635b46848b2c78a1e87e593f36
strict-transport-security
max-age=31556952
via
1.1 varnish
etag
"5eea34a7-1a71e"
age
13
x-cache
HIT
content-length
108318
x-served-by
cache-fra19152-FRA
last-modified
Wed, 17 Jun 2020 15:20:07 GMT
server
GitHub.com
x-github-request-id
515C:13001:6B940B:70CE83:614B703F
x-timer
S1632333900.904759,VS0,VE2
date
Wed, 22 Sep 2021 18:04:59 GMT
vary
Accept-Encoding
content-type
image/jpeg
access-control-allow-origin
*
expires
Wed, 22 Sep 2021 18:14:47 GMT
cache-control
max-age=600
permissions-policy
interest-cohort=()
accept-ranges
bytes
x-proxy-cache
MISS
x-cache-hits
1
minima-social-icons.svg
0x00-0x00.github.io/assets/ 		10 KB
4 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://0x00-0x00.github.io/assets/minima-social-icons.svg
Requested by
Host: 0x00-0x00.github.io
URL: https://0x00-0x00.github.io/research/2018/10/28/How-to-bypass-AMSI-and-Execute-ANY-malicious-powershell-code.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
185.199.110.153 , United States, ASN54113 (FASTLY, US),
Reverse DNS
cdn-185-199-110-153.github.com
Software
GitHub.com /
Resource Hash
39f87ca832d235ede52f66a4d7ae03d050e6a8b4e1ceba6a5b646fd43ee76223
Security Headers
Name Value
Strict-Transport-Security max-age=31556952

Request headers

:path
/assets/minima-social-icons.svg
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
same-origin
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
0x00-0x00.github.io
referer
https://0x00-0x00.github.io/research/2018/10/28/How-to-bypass-AMSI-and-Execute-ANY-malicious-powershell-code.html
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://0x00-0x00.github.io/research/2018/10/28/How-to-bypass-AMSI-and-Execute-ANY-malicious-powershell-code.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-fastly-request-id
263b59778acdc427d366c41a8ca176268ad9214c
strict-transport-security
max-age=31556952
content-encoding
gzip
etag
W/"5ee90dcc-26b2"
age
13
x-cache
HIT
content-length
4030
x-served-by
cache-fra19152-FRA
access-control-allow-origin
*
last-modified
Tue, 16 Jun 2020 18:22:04 GMT
server
GitHub.com
x-github-request-id
C8E2:A3DC:8B3E4D:8F61DF:614B703F
x-timer
S1632333900.905215,VS0,VE1
date
Wed, 22 Sep 2021 18:04:59 GMT
vary
Accept-Encoding
content-type
image/svg+xml
via
1.1 varnish
expires
Wed, 22 Sep 2021 18:14:47 GMT
cache-control
max-age=600
permissions-policy
interest-cohort=()
accept-ranges
bytes
x-proxy-cache
MISS
x-cache-hits
1

Verdicts & Comments Add Verdict or Comment

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect boolean| originAgentCluster

0 Cookies

1 Console Messages

Source Level URL
Text
security warning
Message:
Error with Permissions-Policy header: Unrecognized feature: 'interest-cohort'.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31556952