urlscan.io logo urlscan.io
SecurityTrails logo

posts.specterops.io Open in urlscan Pro
52.4.145.119  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb/r/nSUMM...
Effective URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb/r/nSUMM...
Submission: On December 09 via api from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 5 IPs in 2 countries across 4 domains to perform 17 HTTP transactions. The main IP is 52.4.145.119, located in Ashburn, United States and belongs to AMAZON-AES, US. The main domain is posts.specterops.io.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on March 3rd 2020. Valid for: a year.
This is the only time posts.specterops.io was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 3 52.4.145.119 14618 (AMAZON-AES)
1 1 2606:4700::68... 13335 (CLOUDFLAR...)
12 2606:4700::68... 13335 (CLOUDFLAR...)
1 2a00:1450:400... 15169 (GOOGLE)
1 65.9.73.104 16509 (AMAZON-02)
17 5
3    52.4.145.119 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
posts.specterops.io
1    2606:4700::6810:7c7f (United States)

ASN13335 (CLOUDFLARENET, US)
medium.com
12    2606:4700::6810:7991 (United States)

ASN13335 (CLOUDFLARENET, US)
glyph.medium.com
cdn-static-1.medium.com
cdn-images-1.medium.com
csp.medium.com
1    2a00:1450:4001:824::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google-analytics.com
1    65.9.73.104 (Seattle, United States)

ASN16509 (AMAZON-02, US)
cdn.branch.io
Domain Requested by
7 cdn-images-1.medium.com posts.specterops.io
3 glyph.medium.com posts.specterops.io
glyph.medium.com
3 posts.specterops.io 1 redirects posts.specterops.io
1 cdn.branch.io posts.specterops.io
1 csp.medium.com www.google-analytics.com
1 www.google-analytics.com posts.specterops.io
www.google-analytics.com
1 cdn-static-1.medium.com posts.specterops.io
1 medium.com 1 redirects
17 8

This site contains links to these domains. Also see Links.

Domain
medium.com
Subject Issuer Validity Valid
posts.specterops.io
Sectigo RSA Domain Validation Secure Server CA		 2020-03-03 -
2021-03-03		 a year crt.sh
*.medium.com
DigiCert SHA2 Secure Server CA		 2020-08-19 -
2022-10-05		 2 years crt.sh
*.google-analytics.com
GTS CA 1O1		 2020-11-03 -
2021-01-26		 3 months crt.sh
*.branch.io
DigiCert TLS RSA SHA256 2020 CA1		 2020-11-25 -
2021-12-25		 a year crt.sh

This page contains 1 frames:

Primary Page: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb/r/nSUMMARY/r/n___________________________________________________/r/n-On?gi=d494beaaf9ec
Frame ID: A1A5FE7B2DE9B99A55D414F62EA208BD
Requests: 20 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-... HTTP 307
    https://medium.com/m/global-identity?redirectUrl=https%3A%2F%2Fposts.specterops.io%2Farbitrary-... HTTP 302
    https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /nginx(?:\/([\d.]+))?/i

Page Statistics

17
Requests

94 %
HTTPS

60 %
IPv6

4
Domains

8
Subdomains

5
IPs

2
Countries

536 kB
Transfer

1104 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb/r/nSUMMARY/r/n___________________________________________________/r/n-On HTTP 307
    https://medium.com/m/global-identity?redirectUrl=https%3A%2F%2Fposts.specterops.io%2Farbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb%2Fr%2FnSUMMARY%2Fr%2Fn___________________________________________________%2Fr%2Fn-On HTTP 302
    https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb/r/nSUMMARY/r/n___________________________________________________/r/n-On?gi=d494beaaf9ec Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

17 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request n-On
posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb/r/nSUMMARY/r/n___________________________________________________/r/
Redirect Chain
  • https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb/r/nSUMMARY/r/n___________________________________________________/r/n-On
  • https://medium.com/m/global-identity?redirectUrl=https%3A%2F%2Fposts.specterops.io%2Farbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb%2Fr%2FnSUMMARY%2Fr%2Fn_...
  • https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb/r/nSUMMARY/r/n___________________________________________________/r/n-On?gi=d494...
22 KB
8 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb/r/nSUMMARY/r/n___________________________________________________/r/n-On?gi=d494beaaf9ec
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.4.145.119 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
nginx / Medium
Resource Hash
b5486e5c093088d9067bc0a071d20fbf17edbdcfb7994f06f16a63d9836fe808
Security Headers
Name Value
Content-Security-Policy default-src 'self'; connect-src https://localhost https://*.instapaper.com https://*.stripe.com https://glyph.medium.com https://*.paypal.com https://*.braintree-api.com https://*.braintreegateway.com https://accounts.google.com https://getpocket.com https://posts.specterops.io https://*.posts.specterops.io https://*.medium.com https://medium.com https://*.medium.com https://*.algolia.net https://cdn-static-1.medium.com https://dnqgz544uhbo8.cloudfront.net https://cdn-videos-1.medium.com https://cdn-audio-1.medium.com https://lightstep.medium.systems https://*.branch.io 'self'; font-src data: https://*.amazonaws.com https://*.medium.com https://glyph.medium.com https://medium.com https://*.gstatic.com https://dnqgz544uhbo8.cloudfront.net https://cdn-static-1.medium.com 'self'; frame-src chromenull: https: webviewprogressproxy: medium: 'self'; img-src blob: data: https: 'self'; media-src https://*.cdn.vine.co https://d1fcbxp97j4nb2.cloudfront.net https://d262ilb51hltx0.cloudfront.net https://*.medium.com https://gomiro.medium.com https://miro.medium.com https://pbs.twimg.com 'self' blob:; object-src 'self'; script-src 'unsafe-eval' 'unsafe-inline' about: https: 'self'; style-src 'unsafe-inline' data: https: 'self'; report-uri https://csp.medium.com
X-Content-Type-Options nosniff
X-Frame-Options
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
posts.specterops.io
:scheme
https
:path
/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb/r/nSUMMARY/r/n___________________________________________________/r/n-On?gi=d494beaaf9ec
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

server
nginx
date
Wed, 09 Dec 2020 15:28:42 GMT
content-type
text/html; charset=utf-8
sepia-upstream
medium
cache-control
no-cache, no-store, max-age=0, must-revalidate
content-security-policy
default-src 'self'; connect-src https://localhost https://*.instapaper.com https://*.stripe.com https://glyph.medium.com https://*.paypal.com https://*.braintree-api.com https://*.braintreegateway.com https://accounts.google.com https://getpocket.com https://posts.specterops.io https://*.posts.specterops.io https://*.medium.com https://medium.com https://*.medium.com https://*.algolia.net https://cdn-static-1.medium.com https://dnqgz544uhbo8.cloudfront.net https://cdn-videos-1.medium.com https://cdn-audio-1.medium.com https://lightstep.medium.systems https://*.branch.io 'self'; font-src data: https://*.amazonaws.com https://*.medium.com https://glyph.medium.com https://medium.com https://*.gstatic.com https://dnqgz544uhbo8.cloudfront.net https://cdn-static-1.medium.com 'self'; frame-src chromenull: https: webviewprogressproxy: medium: 'self'; img-src blob: data: https: 'self'; media-src https://*.cdn.vine.co https://d1fcbxp97j4nb2.cloudfront.net https://d262ilb51hltx0.cloudfront.net https://*.medium.com https://gomiro.medium.com https://miro.medium.com https://pbs.twimg.com 'self' blob:; object-src 'self'; script-src 'unsafe-eval' 'unsafe-inline' about: https: 'self'; style-src 'unsafe-inline' data: https: 'self'; report-uri https://csp.medium.com
expires
Thu, 09 Sep 1999 09:09:09 GMT
link
<https://medium.com/humans.txt>; rel="humans"
pragma
no-cache
set-cookie
uid=lo_7de5eee4a084; Path=/; Expires=Thu, 09 Dec 2021 15:28:42 GMT; HttpOnly; Secure; SameSite=None sid=1:C2oF+r1oGGD6XDP1kAo+TnW2VRS8U+ibspBlzwWaAIKK0glCY0z4xackJEQO2lB8; Path=/; Expires=Thu, 09 Dec 2021 15:28:42 GMT; HttpOnly; Secure; SameSite=None optimizelyEndUserId=lo_7de5eee4a084; Path=/; Expires=Thu, 09 Dec 2021 15:28:42 GMT; Secure; SameSite=None
x-content-type-options
nosniff
x-envoy-upstream-service-time
108
x-frame-options
x-obvious-info
20201209-0113-root,68c43429
x-obvious-tid
1607527722153:3b0063097631
x-opentracing
{"ot-tracer-spanid":"3ecc921f49bb34fb","ot-tracer-traceid":"6bb58ac941815b55","ot-tracer-sampled":"true"}
x-powered-by
Medium
x-ua-compatible
IE=edge, Chrome=1
x-xss-protection
1; mode=block
content-encoding
gzip

Redirect headers

date
Wed, 09 Dec 2020 15:28:42 GMT
content-type
application/octet-stream
content-length
0
set-cookie
__cfduid=da985a3a10d8c7bf6bf6c7022730a57181607527721; expires=Fri, 08-Jan-21 15:28:41 GMT; path=/; domain=.medium.com; HttpOnly; SameSite=Lax uid=lo_7de5eee4a084; Path=/; Domain=medium.com; Expires=Thu, 09 Dec 2021 15:28:41 GMT; HttpOnly; Secure sid=1:tOJmr0h9uT2qkjwyIbx4+tIwX4h6VnMLS4nlvC5J5cIDwdAJWozFy0bKV0jEoDVd; Path=/; Domain=medium.com; Expires=Thu, 09 Dec 2021 15:28:41 GMT; HttpOnly; Secure; SameSite=None optimizelyEndUserId=lo_7de5eee4a084; Path=/; Domain=medium.com; Expires=Thu, 09 Dec 2021 15:28:41 GMT; Secure; SameSite=None __cfruid=e7540a3823796745877ffba95b2105e318a8e430-1607527722; path=/; domain=.medium.com; HttpOnly; Secure; SameSite=None
sepia-upstream
medium
cache-control
no-cache, no-store, max-age=0, must-revalidate
content-security-policy
default-src 'self'; connect-src https://localhost https://*.instapaper.com https://*.stripe.com https://glyph.medium.com https://*.paypal.com https://*.braintree-api.com https://*.braintreegateway.com https://accounts.google.com https://getpocket.com https://medium.com https://*.medium.com https://*.medium.com https://medium.com https://*.medium.com https://*.algolia.net https://cdn-static-1.medium.com https://dnqgz544uhbo8.cloudfront.net https://cdn-videos-1.medium.com https://cdn-audio-1.medium.com https://lightstep.medium.systems https://*.branch.io 'self'; font-src data: https://*.amazonaws.com https://*.medium.com https://glyph.medium.com https://medium.com https://*.gstatic.com https://dnqgz544uhbo8.cloudfront.net https://cdn-static-1.medium.com 'self'; frame-src chromenull: https: webviewprogressproxy: medium: 'self'; img-src blob: data: https: 'self'; media-src https://*.cdn.vine.co https://d1fcbxp97j4nb2.cloudfront.net https://d262ilb51hltx0.cloudfront.net https://*.medium.com https://gomiro.medium.com https://miro.medium.com https://pbs.twimg.com 'self' blob:; object-src 'self'; script-src 'unsafe-eval' 'unsafe-inline' about: https: 'self'; style-src 'unsafe-inline' data: https: 'self'; report-uri https://csp.medium.com
expires
Thu, 09 Sep 1999 09:09:09 GMT
link
<https://medium.com/humans.txt>; rel="humans"
location
https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb/r/nSUMMARY/r/n___________________________________________________/r/n-On?gi=d494beaaf9ec
medium-fulfilled-by
valencia/main-20201208-013012-88d9391764
pragma
no-cache
x-content-type-options
nosniff
x-envoy-upstream-service-time
36
x-frame-options
sameorigin
x-obvious-info
20201209-0113-root,68c43429
x-obvious-tid
1607527721961:f7419009a862
x-opentracing
{"ot-tracer-spanid":"0d7de1cc202b4d6b","ot-tracer-traceid":"3b29f68bd29787","ot-tracer-sampled":"true"}
x-powered-by
Medium
x-ua-compatible
IE=edge, Chrome=1
x-xss-protection
1; mode=block
strict-transport-security
max-age=15552000; includeSubDomains; preload
cf-cache-status
DYNAMIC
cf-request-id
06e9b7839e000016e62f18e000000001
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
5fefc1e5ce6c16e6-FRA
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
m2-unbound.css
glyph.medium.com/css/e/sr/latin/e/ssr/latin/e/ssb/latin/ 		49 KB
31 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://glyph.medium.com/css/e/sr/latin/e/ssr/latin/e/ssb/latin/m2-unbound.css
Requested by
Host: posts.specterops.io
URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb/r/nSUMMARY/r/n___________________________________________________/r/n-On?gi=d494beaaf9ec
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:7991 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d4c1b3a35976b9be7450e76b0af5983772dfcafab6f5d03a0800fad9c29bce72
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb/r/nSUMMARY/r/n___________________________________________________/r/n-On?gi=d494beaaf9ec
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 09 Dec 2020 15:28:42 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
3166
strict-transport-security
max-age=15552000; includeSubDomains; preload
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
06e9b7857a00001f2dc0a36000000001
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age
86400
access-control-allow-methods
GET, POST, PUT, DELETE
content-type
text/css
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=14400
access-control-allow-credentials
true
cf-ray
5fefc1e8cd111f2d-FRA
access-control-allow-headers
Accept, Cache-Control, Content-Type, Cookie, DNT, Origin, User-Agent, X-Client-Date, X-Obvious-Cid, X-Opentracing, X-Xsrf-Token, ot-tracer-sampled, ot-tracer-spanid, ot-tracer-traceid
expires
Wed, 09 Dec 2020 19:28:42 GMT
main-branding-base.aSqLDiqOjAy-DLZKn3oVRg.css
cdn-static-1.medium.com/_/fp/css/ 		523 KB
66 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cdn-static-1.medium.com/_/fp/css/main-branding-base.aSqLDiqOjAy-DLZKn3oVRg.css
Requested by
Host: posts.specterops.io
URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb/r/nSUMMARY/r/n___________________________________________________/r/n-On?gi=d494beaaf9ec
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:7991 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0445c7c2c249f8f29fc462843ccba17950e45b5cd0250dde7f4bd56d6ffe91cb
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb/r/nSUMMARY/r/n___________________________________________________/r/n-On?gi=d494beaaf9ec
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 09 Dec 2020 15:28:42 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
1258875
cf-ray
5fefc1e8dacb1f39-FRA
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
67041
x-amz-id-2
/SfJG0bFW0gSGyBdTEqGu4M437xzAfBGzT/msw5NwIMoQK/unABXSW6f6qlrU0JTjVoUGauatQI=
last-modified
Wed, 25 Nov 2020 01:09:35 GMT
server
cloudflare
etag
"c2c111f16de90608a2a6aba425f802a7"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15552000; includeSubDomains; preload
x-amz-request-id
6A9E318559831CB2
vary
Accept-Encoding
cache-control
public, max-age=31536000
cf-request-id
06e9b7858700001f39f9894000000001
accept-ranges
bytes
content-type
text/css
expires
Thu, 09 Dec 2021 15:28:42 GMT
analytics.js
www.google-analytics.com/ 		46 KB
18 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: posts.specterops.io
URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb/r/nSUMMARY/r/n___________________________________________________/r/n-On?gi=d494beaaf9ec
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:824::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e441c3e2771625ba05630ab464275136a82c99650ee2145ca5aa9853bedeb01b
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb/r/nSUMMARY/r/n___________________________________________________/r/n-On?gi=d494beaaf9ec
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Fri, 23 Oct 2020 03:00:57 GMT
server
Golfe2
age
2332
date
Wed, 09 Dec 2020 14:49:50 GMT
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
18817
expires
Wed, 09 Dec 2020 16:49:50 GMT
1*8rgW0Qvy2bSGSBMlORMhQA.png
cdn-images-1.medium.com/proxy/ 		274 KB
275 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdn-images-1.medium.com/proxy/1*8rgW0Qvy2bSGSBMlORMhQA.png
Requested by
Host: posts.specterops.io
URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb/r/nSUMMARY/r/n___________________________________________________/r/n-On?gi=d494beaaf9ec
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:7991 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
646d8cb64a720e7a4867157e23cd3dd5f55cfe3c4fa33998a48821a4a8277363
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb/r/nSUMMARY/r/n___________________________________________________/r/n-On?gi=d494beaaf9ec
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 09 Dec 2020 15:28:42 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
age
376248
x-envoy-upstream-service-time
103
strict-transport-security
max-age=15552000; includeSubDomains; preload
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
280968
cf-request-id
06e9b7861600001f2d9499f000000001
pragma
public
sepia-upstream
medium
server
cloudflare
etag
"16.3"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=2592000
medium-fulfilled-by
miro/main-20201103-004404-ec640a6618
accept-ranges
bytes
cf-ray
5fefc1e9bf2d1f2d-FRA
expires
Fri, 08 Jan 2021 15:28:42 GMT
1*n9qO_wvh3fedEDcneQ-eyg.jpeg
cdn-images-1.medium.com/fit/c/36/36/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdn-images-1.medium.com/fit/c/36/36/1*n9qO_wvh3fedEDcneQ-eyg.jpeg
Requested by
Host: posts.specterops.io
URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb/r/nSUMMARY/r/n___________________________________________________/r/n-On?gi=d494beaaf9ec
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:7991 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0597b4356ce34bfd7dfc72ee308a58513000f46f5edbbc347faf0f316f1b0eb6
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb/r/nSUMMARY/r/n___________________________________________________/r/n-On?gi=d494beaaf9ec
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 09 Dec 2020 15:28:42 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
age
202834
x-envoy-upstream-service-time
40
strict-transport-security
max-age=15552000; includeSubDomains; preload
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
1537
cf-request-id
06e9b7861700001f2d77386000000001
pragma
public
sepia-upstream
medium
cf-bgj
h2pri
server
cloudflare
etag
"16.3"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
medium-fulfilled-by
miro/main-20201103-004404-ec640a6618
accept-ranges
bytes
cf-ray
5fefc1e9bf2a1f2d-FRA
expires
Fri, 08 Jan 2021 15:28:42 GMT
1*Q2D5Yg2KSzuGTngtMSLKnw.jpeg
cdn-images-1.medium.com/fit/c/36/36/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdn-images-1.medium.com/fit/c/36/36/1*Q2D5Yg2KSzuGTngtMSLKnw.jpeg
Requested by
Host: posts.specterops.io
URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb/r/nSUMMARY/r/n___________________________________________________/r/n-On?gi=d494beaaf9ec
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:7991 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ed4653c8847130744b257c6115ca516ebde535cd51a0773fd6905262df441e58
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb/r/nSUMMARY/r/n___________________________________________________/r/n-On?gi=d494beaaf9ec
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 09 Dec 2020 15:28:42 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
age
294633
x-envoy-upstream-service-time
107
strict-transport-security
max-age=15552000; includeSubDomains; preload
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
1354
cf-request-id
06e9b7865900001f2d7738f000000001
pragma
public
sepia-upstream
medium
cf-bgj
h2pri
server
cloudflare
etag
"16.3"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
medium-fulfilled-by
miro/main-20201103-004404-ec640a6618
accept-ranges
bytes
cf-ray
5fefc1ea28011f2d-FRA
expires
Fri, 08 Jan 2021 15:28:42 GMT
0*E7TD4xieWUQBhHhr.jpeg
cdn-images-1.medium.com/fit/c/36/36/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdn-images-1.medium.com/fit/c/36/36/0*E7TD4xieWUQBhHhr.jpeg
Requested by
Host: posts.specterops.io
URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb/r/nSUMMARY/r/n___________________________________________________/r/n-On?gi=d494beaaf9ec
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:7991 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / Geomyidae artificij
Resource Hash
0bf993c5e3ea7860940f23dd3093bba4030b258a866917edf344d356d8fe9924
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb/r/nSUMMARY/r/n___________________________________________________/r/n-On?gi=d494beaaf9ec
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 09 Dec 2020 15:28:42 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
age
467434
x-powered-by
Geomyidae artificij
x-obvious-info
16.3, 3192-d9ea9bb
strict-transport-security
max-age=15552000; includeSubDomains; preload
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
1405
cf-request-id
06e9b7865900001f2d560e8000000001
pragma
public
cf-bgj
h2pri
server
cloudflare
etag
"16.3"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
cf-ray
5fefc1ea28031f2d-FRA
expires
Fri, 08 Jan 2021 15:28:42 GMT
stat
posts.specterops.io/_/ 		43 B
194 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://posts.specterops.io/_/stat?event=pixel.load&origin=https%3A%2F%2Fposts.specterops.io
Requested by
Host: posts.specterops.io
URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb/r/nSUMMARY/r/n___________________________________________________/r/n-On?gi=d494beaaf9ec
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.4.145.119 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
nginx /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer
https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb/r/nSUMMARY/r/n___________________________________________________/r/n-On?gi=d494beaaf9ec
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 09 Dec 2020 15:28:42 GMT
medium-fulfilled-by
valencia/main-20201208-013012-88d9391764
x-envoy-upstream-service-time
43
sepia-upstream
medium
server
nginx
content-length
43
content-type
image/gif
1*41lmsrgI-J3FUN_8CeD8_Q.jpeg
cdn-images-1.medium.com/fit/c/400/120/ 		14 KB
14 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdn-images-1.medium.com/fit/c/400/120/1*41lmsrgI-J3FUN_8CeD8_Q.jpeg
Requested by
Host: posts.specterops.io
URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb/r/nSUMMARY/r/n___________________________________________________/r/n-On?gi=d494beaaf9ec
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:7991 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / Geomyidae artificij
Resource Hash
e8913aed788024e89722a3f7ee01dea1b3818bd75e42e58ec23fa36ad662aac8
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb/r/nSUMMARY/r/n___________________________________________________/r/n-On?gi=d494beaaf9ec
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 09 Dec 2020 15:28:42 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
age
564736
x-powered-by
Geomyidae artificij
x-obvious-info
16.3, 3192-d9ea9bb
strict-transport-security
max-age=15552000; includeSubDomains; preload
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
14223
cf-request-id
06e9b786c400001f2d799d2000000001
pragma
public
cf-bgj
h2pri
server
cloudflare
etag
"16.3"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
cf-ray
5fefc1ead95a1f2d-FRA
expires
Fri, 08 Jan 2021 15:28:42 GMT
1*hCm_B1zGl62QdwHDzaZ5eg.jpeg
cdn-images-1.medium.com/fit/c/400/120/ 		21 KB
21 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdn-images-1.medium.com/fit/c/400/120/1*hCm_B1zGl62QdwHDzaZ5eg.jpeg
Requested by
Host: posts.specterops.io
URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb/r/nSUMMARY/r/n___________________________________________________/r/n-On?gi=d494beaaf9ec
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:7991 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
77e549b69ec4f742aeb5d9337fac59b73dc02e45266ddb2be395a04a096f7203
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb/r/nSUMMARY/r/n___________________________________________________/r/n-On?gi=d494beaaf9ec
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 09 Dec 2020 15:28:42 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
age
117334
x-envoy-upstream-service-time
51
strict-transport-security
max-age=15552000; includeSubDomains; preload
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
21101
cf-request-id
06e9b786c500001f2d7e12a000000001
pragma
public
sepia-upstream
medium
cf-bgj
h2pri
server
cloudflare
etag
"16.3"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
medium-fulfilled-by
miro/main-20201103-004404-ec640a6618
accept-ranges
bytes
cf-ray
5fefc1ead95c1f2d-FRA
expires
Fri, 08 Jan 2021 15:28:42 GMT
1*rvqLiaFu4-7ngQqVl9cYHw.jpeg
cdn-images-1.medium.com/fit/c/400/120/ 		16 KB
16 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdn-images-1.medium.com/fit/c/400/120/1*rvqLiaFu4-7ngQqVl9cYHw.jpeg
Requested by
Host: posts.specterops.io
URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb/r/nSUMMARY/r/n___________________________________________________/r/n-On?gi=d494beaaf9ec
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:7991 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / Geomyidae artificij
Resource Hash
0e4bb089c23a0f7b6eb462d5a7c80ffa18be5a1bf600e4cbb1d013efec2537f9
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb/r/nSUMMARY/r/n___________________________________________________/r/n-On?gi=d494beaaf9ec
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 09 Dec 2020 15:28:42 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
age
393634
x-powered-by
Geomyidae artificij
x-obvious-info
16.3, 3203-7aaf868
strict-transport-security
max-age=15552000; includeSubDomains; preload
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
16259
cf-request-id
06e9b786c500001f2dbfa3c000000001
pragma
public
cf-bgj
h2pri
server
cloudflare
etag
"16.3"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
cf-ray
5fefc1ead95e1f2d-FRA
expires
Fri, 08 Jan 2021 15:28:42 GMT
truncated
/ 		10 KB
10 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
705a47c18859e2c9af14403e38659a17d6e08de8d6c0a6c3cb739611e3e2be5c

Request headers

Origin
https://posts.specterops.io
Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
font/opentype
gt-super-400-normal.woff
glyph.medium.com/font/4a44748/0-3j_4g_6bu_6c4_6c8_6c9_6cc_6cd_6ci_6cm/ 		13 KB
14 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://glyph.medium.com/font/4a44748/0-3j_4g_6bu_6c4_6c8_6c9_6cc_6cd_6ci_6cm/gt-super-400-normal.woff
Requested by
Host: glyph.medium.com
URL: https://glyph.medium.com/css/e/sr/latin/e/ssr/latin/e/ssb/latin/m2-unbound.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:7991 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6e414dc1f4307ae04462c1dee3112f05b8344ae152fb1dee89ccbcff83d04057
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Origin
https://posts.specterops.io
Referer
https://glyph.medium.com/css/e/sr/latin/e/ssr/latin/e/ssb/latin/m2-unbound.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 09 Dec 2020 15:28:42 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
116128
strict-transport-security
max-age=15552000; includeSubDomains; preload
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
06e9b786c40000dfbbca1ba000000001
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age
86400
access-control-allow-methods
GET, POST, PUT, DELETE
content-type
application/font-woff
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
access-control-allow-credentials
true
cf-ray
5fefc1ead9b1dfbb-FRA
access-control-allow-headers
Accept, Cache-Control, Content-Type, Cookie, DNT, Origin, User-Agent, X-Client-Date, X-Obvious-Cid, X-Opentracing, X-Xsrf-Token, ot-tracer-sampled, ot-tracer-spanid, ot-tracer-traceid
expires
Thu, 09 Dec 2021 15:28:42 GMT
truncated
/ 		10 KB
10 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b61c2c46c1b316e720610d240c7962c61c9bc9c563bfecd9757a8600b3911db0

Request headers

Origin
https://posts.specterops.io
Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
font/opentype
truncated
/ 		10 KB
10 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
a3d669b687929b3aa777fdd2c400c2b8c6b794978536a64d7e1f71edcf8037e8

Request headers

Origin
https://posts.specterops.io
Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
font/opentype
marat-sans-400-normal.woff
glyph.medium.com/font/d8659c9/3k-4f_4h-6bt_6bv-6c3_6c5-6c7_6ca-6cb_6ce-6ch_6cj-6cl_6cn-nvnj/ 		14 KB
15 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://glyph.medium.com/font/d8659c9/3k-4f_4h-6bt_6bv-6c3_6c5-6c7_6ca-6cb_6ce-6ch_6cj-6cl_6cn-nvnj/marat-sans-400-normal.woff
Requested by
Host: glyph.medium.com
URL: https://glyph.medium.com/css/e/sr/latin/e/ssr/latin/e/ssb/latin/m2-unbound.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:7991 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
12fe85ec038af8c41ba830412520589dbd125d417913c10a57838ac92ab96192
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Origin
https://posts.specterops.io
Referer
https://glyph.medium.com/css/e/sr/latin/e/ssr/latin/e/ssb/latin/m2-unbound.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 09 Dec 2020 15:28:43 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
271279
strict-transport-security
max-age=15552000; includeSubDomains; preload
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
06e9b7881a0000dfbb049e2000000001
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age
86400
access-control-allow-methods
GET, POST, PUT, DELETE
content-type
application/font-woff
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
access-control-allow-credentials
true
cf-ray
5fefc1ecff04dfbb-FRA
access-control-allow-headers
Accept, Cache-Control, Content-Type, Cookie, DNT, Origin, User-Agent, X-Client-Date, X-Obvious-Cid, X-Opentracing, X-Xsrf-Token, ot-tracer-sampled, ot-tracer-spanid, ot-tracer-traceid
expires
Thu, 09 Dec 2021 15:28:43 GMT
/
csp.medium.com/ 		0
0 		Other
General
Check archive.org
Download Go to
Full URL
https://csp.medium.com/
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:7991 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb/r/nSUMMARY/r/n___________________________________________________/r/n-On?gi=d494beaaf9ec
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
application/csp-report

Response headers
collect
www.google-analytics.com/j/ 		0
0
branch-latest.min.js
cdn.branch.io/ 		78 KB
24 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.branch.io/branch-latest.min.js
Requested by
Host: posts.specterops.io
URL: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb/r/nSUMMARY/r/n___________________________________________________/r/n-On?gi=d494beaaf9ec
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
65.9.73.104 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
3ff0169292598bec1751fce80d0024e2c9e55c406b7456ef3aefae30bf3a4efb

Request headers

Referer
https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb/r/nSUMMARY/r/n___________________________________________________/r/n-On?gi=d494beaaf9ec
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id
c7Vvzbb8uKgHcC4eD_pqp123QB.GvKI.
Content-Encoding
gzip
Connection
keep-alive
Last-Modified
Thu, 19 Nov 2020 17:43:28 GMT
Server
AmazonS3
Age
35
ETag
"d4ba055ba82c0baa510053e92eb83211"
X-Cache
Hit from cloudfront
Content-Type
text/javascript
Via
1.1 f5046bb9ebd1a8f25b2025d7d9a283f3.cloudfront.net (CloudFront)
Cache-Control
max-age=300
Date
Wed, 09 Dec 2020 15:28:10 GMT
X-Amz-Cf-Pop
AMS1-C1
Content-Length
23541
X-Amz-Cf-Id
aenE_Wp0bhTh99daM30oSHZdKCrsi-0D0ILMOP_453rp8T1h2zRanw==

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
www.google-analytics.com
URL
https://www.google-analytics.com/j/collect?v=1&_v=j87&a=1016924818&t=pageview&_s=1&dl=https%3A%2F%2Fposts.specterops.io%2Farbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb%2Fr%2FnSUMMARY%2Fr%2Fn___________________________________________________%2Fr%2Fn-On%3Fgi%3Dd494beaaf9ec&ul=en-us&de=UTF-8&dt=Not%20Found%20%E2%80%93%20Medium&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAEABAAAAAC~&jid=543003173&gjid=1392483484&cid=1979541478.1607527723&tid=UA-24232453-2&_gid=2707750.1607527723&_r=1&_slc=1&z=349467751

Verdicts & Comments Add Verdict or Comment

21 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated object| perfMetrics number| OB_startTime object| OB_loadErrors function| _onerror function| _asyncScript function| _asyncStyles function| ga object| google_tag_data object| gaplugins object| gaGlobal object| gaData object| branch

0 Cookies

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy default-src 'self'; connect-src https://localhost https://*.instapaper.com https://*.stripe.com https://glyph.medium.com https://*.paypal.com https://*.braintree-api.com https://*.braintreegateway.com https://accounts.google.com https://getpocket.com https://posts.specterops.io https://*.posts.specterops.io https://*.medium.com https://medium.com https://*.medium.com https://*.algolia.net https://cdn-static-1.medium.com https://dnqgz544uhbo8.cloudfront.net https://cdn-videos-1.medium.com https://cdn-audio-1.medium.com https://lightstep.medium.systems https://*.branch.io 'self'; font-src data: https://*.amazonaws.com https://*.medium.com https://glyph.medium.com https://medium.com https://*.gstatic.com https://dnqgz544uhbo8.cloudfront.net https://cdn-static-1.medium.com 'self'; frame-src chromenull: https: webviewprogressproxy: medium: 'self'; img-src blob: data: https: 'self'; media-src https://*.cdn.vine.co https://d1fcbxp97j4nb2.cloudfront.net https://d262ilb51hltx0.cloudfront.net https://*.medium.com https://gomiro.medium.com https://miro.medium.com https://pbs.twimg.com 'self' blob:; object-src 'self'; script-src 'unsafe-eval' 'unsafe-inline' about: https: 'self'; style-src 'unsafe-inline' data: https: 'self'; report-uri https://csp.medium.com
X-Content-Type-Options nosniff
X-Frame-Options
X-Xss-Protection 1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn-images-1.medium.com
cdn-static-1.medium.com
cdn.branch.io
csp.medium.com
glyph.medium.com
medium.com
posts.specterops.io
www.google-analytics.com
www.google-analytics.com
2606:4700::6810:7991
2606:4700::6810:7c7f
2a00:1450:4001:824::200e
52.4.145.119
65.9.73.104
0445c7c2c249f8f29fc462843ccba17950e45b5cd0250dde7f4bd56d6ffe91cb
0597b4356ce34bfd7dfc72ee308a58513000f46f5edbbc347faf0f316f1b0eb6
0bf993c5e3ea7860940f23dd3093bba4030b258a866917edf344d356d8fe9924
0e4bb089c23a0f7b6eb462d5a7c80ffa18be5a1bf600e4cbb1d013efec2537f9
12fe85ec038af8c41ba830412520589dbd125d417913c10a57838ac92ab96192
3ff0169292598bec1751fce80d0024e2c9e55c406b7456ef3aefae30bf3a4efb
646d8cb64a720e7a4867157e23cd3dd5f55cfe3c4fa33998a48821a4a8277363
6e414dc1f4307ae04462c1dee3112f05b8344ae152fb1dee89ccbcff83d04057
705a47c18859e2c9af14403e38659a17d6e08de8d6c0a6c3cb739611e3e2be5c
77e549b69ec4f742aeb5d9337fac59b73dc02e45266ddb2be395a04a096f7203
a3d669b687929b3aa777fdd2c400c2b8c6b794978536a64d7e1f71edcf8037e8
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b5486e5c093088d9067bc0a071d20fbf17edbdcfb7994f06f16a63d9836fe808
b61c2c46c1b316e720610d240c7962c61c9bc9c563bfecd9757a8600b3911db0
d4c1b3a35976b9be7450e76b0af5983772dfcafab6f5d03a0800fad9c29bce72
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e441c3e2771625ba05630ab464275136a82c99650ee2145ca5aa9853bedeb01b
e8913aed788024e89722a3f7ee01dea1b3818bd75e42e58ec23fa36ad662aac8
ed4653c8847130744b257c6115ca516ebde535cd51a0773fd6905262df441e58