claroty.com Open in urlscan Pro
138.197.228.97  Public Scan

11 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 63

• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1162802&time=1670995184602&url=https%3A%2F%2Fclaroty.com%2Fteam82%2Fresearch%2Fjs-on-security-off-abusing-json-based-sql-to-bypass-waf HTTP 302
• https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=1162802&time=1670995184602&url=https%3A%2F%2Fclaroty.com%2Fteam82%2Fresearch%2Fjs-on-security-off-abusing-json-based-sql-to-bypass-waf&e_ipv6=AQIkEgSZMU1UlAAAAYUPEwxoiy2Kl3zQvYxHNCfB_UhcV1SG0NlJXjjH8uHsl_x2jLejXjo

Request Chain 67

• https://aorta.clickagy.com/pixel.gif?clkgypv=jstag HTTP 302
• https://cm.g.doubleclick.net/pixel?google_nid=clickagy&google_sc&google_cm&google_hm=YzpjZGM4NjUwZjZlNDIxOWQxMDMzNjRhOTAxZjg5NjEwNQ HTTP 302
• https://cm.g.doubleclick.net/pixel?google_nid=clickagy&google_sc=&google_cm=&google_hm=YzpjZGM4NjUwZjZlNDIxOWQxMDMzNjRhOTAxZjg5NjEwNQ&google_tc= HTTP 302
• https://aorta.clickagy.com/pixel.gif?ch=8&cm=CAESEIcqx3BS-00j6S_WofVZEAg&google_cver=1 HTTP 302
• https://pixel-sync.sitescout.com/connectors/clickagy/usersync?redir=https%3A%2F%2Faorta.clickagy.com%2Fpixel.gif%3Fclkgypv%3Dpxl%26ch%3D5%26cm%3D%7BuserId%7D

Request Chain 68

• https://aorta.clickagy.com/liveramp_redir HTTP 302
• https://id.rlcdn.com/711861.gif

100 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
7 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request js-on-security-off-abusing-json-based-sql-to-bypass-waf Show response claroty.com/team82/research/	122 KB 22 KB	411ms 192ms	Document text/html	138.197.228.97 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://claroty.com/team82/research/js-on-security-off-abusing-json-based-sql-to-bypass-waf Protocol H2 Security TLS 1.3, , AES_128_GCM Server 138.197.228.97 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software nginx / Statamic Resource Hash 56f28db624ec19f3ca55c1cada4e8c14948595f48bb73bd1b00b1547f7262a1d Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; upgrade-insecure-requests Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff nosniff X-Frame-Options sameorigin SAMEORIGIN X-Xss-Protection 1; mode=block 1; mode=block Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers cache-control no-cache, private content-encoding gzip content-security-policy frame-ancestors 'self'; upgrade-insecure-requests content-type text/html; charset=UTF-8 date Wed, 14 Dec 2022 05:19:43 GMT permissions-policy accelerometer=(self), ambient-light-sensor=(self), autoplay=(self), battery=(self), camera=(self), cross-origin-isolated=(self), display-capture=(self), document-domain=*, encrypted-media=(self), execution-while-not-rendered=*, execution-while-out-of-viewport=*, fullscreen=(self), geolocation=(self), gyroscope=(self), magnetometer=(self), microphone=(self), midi=(self), navigation-override=(self), payment=(self), picture-in-picture=*, publickey-credentials-get=(self), screen-wake-lock=(self), sync-xhr=*, usb=(self), web-share=(self), xr-spatial-tracking=(self) referrer-policy no-referrer server nginx strict-transport-security max-age=31536000; includeSubDomains; preload vary Accept-Encoding x-content-type-options nosniff nosniff x-download-options noopen x-frame-options sameorigin SAMEORIGIN x-permitted-cross-domain-policies none x-powered-by Statamic x-xss-protection 1; mode=block 1; mode=block
GET H2	200	claroty.css claroty.com/css/	46 KB 10 KB	98ms 97ms	Stylesheet text/css	138.197.228.97 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://claroty.com/css/claroty.css?id=3caf5a9b80c0f5a06a580753a916b217 Requested by Host: claroty.com URL: https://claroty.com/team82/research/js-on-security-off-abusing-json-based-sql-to-bypass-waf Protocol H2 Security TLS 1.3, , AES_128_GCM Server 138.197.228.97 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software nginx / Resource Hash 015cc3990a044cd42cbc58ef33e2193f7c5d8bf33ee0071196e57ba2fd19b394 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Response headers date Wed, 14 Dec 2022 05:19:43 GMT content-encoding gzip x-content-type-options nosniff last-modified Thu, 08 Dec 2022 20:53:25 GMT server nginx etag W/"63924ec5-b66d" vary Accept-Encoding x-frame-options SAMEORIGIN content-type text/css x-xss-protection 1; mode=block
GET H2	200	yty7mat.css use.typekit.net/	5 KB 1 KB	187ms 41ms	Stylesheet text/css	2a02:26f0:780::210:ca78 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://use.typekit.net/yty7mat.css Requested by Host: claroty.com URL: https://claroty.com/team82/research/js-on-security-off-abusing-json-based-sql-to-bypass-waf Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:780::210:ca78 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software nginx / Resource Hash 39961d4c61d179baa0dbf39258390c27d3bc52330da365f9051c044d8715a898 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains; content-encoding gzip date Wed, 14 Dec 2022 05:19:44 GMT server nginx vary Accept-Encoding content-type text/css;charset=utf-8 access-control-allow-origin * cache-control private, max-age=600, stale-while-revalidate=604800 cross-origin-resource-policy cross-origin timing-allow-origin * content-length 805
GET H2	200	js Show response www.googletagmanager.com/gtag/	109 KB 43 KB	41ms 20ms	Script application/javascript	2a00:1450:4001:828::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=UA-23917942-3 Requested by Host: claroty.com URL: https://claroty.com/team82/research/js-on-security-off-abusing-json-based-sql-to-bypass-waf Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:828::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 9d6e18a64fcbea9692efc134af02023e9281fcdafc32310b404311c85f5087c3 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Response headers date Wed, 14 Dec 2022 05:19:44 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 43591 x-xss-protection 0 last-modified Wed, 14 Dec 2022 03:00:00 GMT server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Wed, 14 Dec 2022 05:19:44 GMT
GET H2	200	js Show response www.googletagmanager.com/gtag/	224 KB 77 KB	23ms 22ms	Script application/javascript	2a00:1450:4001:828::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=G-H6L2YY031Z Requested by Host: claroty.com URL: https://claroty.com/team82/research/js-on-security-off-abusing-json-based-sql-to-bypass-waf Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:828::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash b37796d51f47ed94e11b1b87fbc92e906c58a4ac28be57aabfa57a9e49c1cce4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Response headers date Wed, 14 Dec 2022 05:19:44 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true cross-origin-resource-policy cross-origin access-control-allow-headers Cache-Control content-length 79017 x-xss-protection 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" expires Wed, 14 Dec 2022 05:19:44 GMT
GET H2	200	bizible.js Show response cdn.bizible.com/scripts/	83 KB 32 KB	52ms 6ms	Script application/x-javascript	152.195.15.58 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://cdn.bizible.com/scripts/bizible.js Requested by Host: claroty.com URL: https://claroty.com/team82/research/js-on-security-off-abusing-json-based-sql-to-bypass-waf Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.195.15.58 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECS (frb/67D4) / Resource Hash 3511de47d3250e54206caa8bfd8b2401d7ae512f821258d06a52d5e9584690f9 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Response headers date Wed, 14 Dec 2022 05:19:44 GMT content-encoding gzip last-modified Mon, 12 Dec 2022 18:11:12 GMT server ECS (frb/67D4) age 21706 etag "b32e51e55ed91:0" vary Accept-Encoding x-cache HIT content-type application/x-javascript cache-control max-age=86400 accept-ranges bytes content-length 32316
GET H2	200	qualified.js Show response js.qualified.com/	249 KB 72 KB	477ms 449ms	Script text/javascript	2606:4700::6812:1105 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js.qualified.com/qualified.js?token=PaboXyMA4piyRkBp Requested by Host: claroty.com URL: https://claroty.com/team82/research/js-on-security-off-abusing-json-based-sql-to-bypass-waf Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:1105 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash db34ab9cb6818cfeccec4909740386111040211743f1b8e2f88ac340afaf0f10 Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Response headers date Wed, 14 Dec 2022 05:19:44 GMT content-encoding gzip via 1.1 spaces-router (e13668ca8eb7) strict-transport-security max-age=63072000; includeSubDomains cf-cache-status MISS x-content-type-options nosniff x-permitted-cross-domain-policies none x-xss-protection 1; mode=block x-request-id 50104c95-5e83-ae8e-8ce7-47ad24c5347f x-runtime 0.015912 referrer-policy strict-origin-when-cross-origin server cloudflare etag W/"db34ab9cb6818cfeccec490974038611" x-download-options noopen vary Accept,Accept-Encoding x-frame-options SAMEORIGIN content-type text/javascript; charset=utf-8 cache-control public, max-age=14400 cf-ray 77947c7e18a89b9e-FRA expires Wed, 14 Dec 2022 09:19:44 GMT
GET H2	200	20307279.js Show response js.hs-scripts.com/	2 KB 920 B	163ms 138ms	Script application/javascript	2606:4700::6811:d4cc CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js.hs-scripts.com/20307279.js?businessUnitId=556099 Requested by Host: claroty.com URL: https://claroty.com/team82/research/js-on-security-off-abusing-json-based-sql-to-bypass-waf Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:d4cc , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 588cb5d832526b9f8fcb848bf4e8746140b2239da13e931931a3196631ed96b1 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Response headers date Wed, 14 Dec 2022 05:19:44 GMT content-encoding br cf-cache-status EXPIRED last-modified Wed, 14 Dec 2022 04:37:58 GMT server cloudflare x-hubspot-correlation-id ff9c0048-64ba-4aa6-a904-7a8fa5b19e1e x-trace 2B394E66C9E8C2FC70BE224CDB86E3A4AF729F6B3E000000000000000000 vary origin, Accept-Encoding access-control-max-age 3600 content-type application/javascript;charset=utf-8 cache-control public, max-age=60 access-control-allow-credentials true cf-ray 77947c7e1dee906a-FRA expires Wed, 14 Dec 2022 05:20:44 GMT
GET H2	200	team82-logo.svg claroty.com/img/	9 KB 4 KB	97ms 96ms	Image image/svg+xml	138.197.228.97 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Show image Full URL https://claroty.com/img/team82-logo.svg Requested by Host: claroty.com URL: https://claroty.com/team82/research/js-on-security-off-abusing-json-based-sql-to-bypass-waf Protocol H2 Security TLS 1.3, , AES_128_GCM Server 138.197.228.97 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software nginx / Resource Hash 15318489f738027dd0096a2041613173aa128360c2e0903ef879c36fa7ecd18b Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Response headers date Wed, 14 Dec 2022 05:19:44 GMT content-encoding gzip x-content-type-options nosniff last-modified Wed, 27 Jul 2022 14:31:27 GMT server nginx etag W/"62e14c3f-24b0" vary Accept-Encoding x-frame-options SAMEORIGIN content-type image/svg+xml x-xss-protection 1; mode=block
GET H2	200	logo-solid-white.svg claroty.com/img/	2 KB 1 KB	98ms 97ms	Image image/svg+xml	138.197.228.97 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Show image Full URL https://claroty.com/img/logo-solid-white.svg Requested by Host: claroty.com URL: https://claroty.com/team82/research/js-on-security-off-abusing-json-based-sql-to-bypass-waf Protocol H2 Security TLS 1.3, , AES_128_GCM Server 138.197.228.97 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software nginx / Resource Hash 60bdc532cad265a116b2b590c86a9679ed86fe5a1ac3764e08c521cf6ccb1784 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Response headers date Wed, 14 Dec 2022 05:19:44 GMT content-encoding gzip x-content-type-options nosniff last-modified Wed, 27 Jul 2022 14:31:27 GMT server nginx etag W/"62e14c3f-9cb" vary Accept-Encoding x-frame-options SAMEORIGIN content-type image/svg+xml x-xss-protection 1; mode=block
GET H2	200	logo-white.svg claroty.com/img/	2 KB 1 KB	99ms 98ms	Image image/svg+xml	138.197.228.97 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Show image Full URL https://claroty.com/img/logo-white.svg Requested by Host: claroty.com URL: https://claroty.com/team82/research/js-on-security-off-abusing-json-based-sql-to-bypass-waf Protocol H2 Security TLS 1.3, , AES_128_GCM Server 138.197.228.97 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software nginx / Resource Hash 95cbdd8d48ccc73ee5d0c5aba8bca4485b7fc0b58713923e92b97a325fc68538 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Response headers date Wed, 14 Dec 2022 05:19:44 GMT content-encoding gzip x-content-type-options nosniff last-modified Wed, 27 Jul 2022 14:31:27 GMT server nginx etag W/"62e14c3f-9d1" vary Accept-Encoding x-frame-options SAMEORIGIN content-type image/svg+xml x-xss-protection 1; mode=block
GET H2	200	claroty.js Show response claroty.com/js/	95 KB 29 KB	101ms 100ms	Script application/javascript	138.197.228.97 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://claroty.com/js/claroty.js?id=b3a15e6db0a0ad4966646f18a1977826 Requested by Host: claroty.com URL: https://claroty.com/team82/research/js-on-security-off-abusing-json-based-sql-to-bypass-waf Protocol H2 Security TLS 1.3, , AES_128_GCM Server 138.197.228.97 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software nginx / Resource Hash d0d985efa4c305854612f0950d4c6a3f8cacc1e59b64ed507931aaf8c315514f Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Response headers date Wed, 14 Dec 2022 05:19:44 GMT content-encoding gzip x-content-type-options nosniff last-modified Wed, 30 Nov 2022 20:20:53 GMT server nginx etag W/"6387bb25-17aab" vary Accept-Encoding x-frame-options SAMEORIGIN content-type application/javascript; charset=utf-8 x-xss-protection 1; mode=block
GET H2	200	8175422aa5.js Show response kit.fontawesome.com/	11 KB 4 KB	88ms 56ms	Script text/javascript	2606:4700::6812:1634 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://kit.fontawesome.com/8175422aa5.js Requested by Host: claroty.com URL: https://claroty.com/team82/research/js-on-security-off-abusing-json-based-sql-to-bypass-waf Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:1634 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6e8e28ad81eacf66ac4712c52ef775ebb47ddfe60c2699408cdf30993d2fe19b Security Headers Name Value Strict-Transport-Security max-age=31536000; preload Request headers Referer Origin https://claroty.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Response headers date Wed, 14 Dec 2022 05:19:44 GMT strict-transport-security max-age=31536000; preload content-encoding gzip cf-cache-status REVALIDATED server cloudflare access-control-max-age 3000 access-control-allow-methods GET, OPTIONS content-type text/javascript access-control-allow-origin * cache-control max-age=60, public, must-revalidate vary origin, accept-encoding, access-control-request-headers, access-control-request-method cf-ray 77947c7d0d1592b7-FRA access-control-allow-headers accept, accept-langauge, content-language, content-type, fa-kit-token x-request-id Fy6hzswSt7_prWoHRX_C
GET H2	200	p.css p.typekit.net/	5 B 181 B	178ms 34ms	Stylesheet text/css	2a02:26f0:780::5f65:3679 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://p.typekit.net/p.css?s=1&k=yty7mat&ht=tk&f=139.173.175.176.25136.25137&a=18291&app=typekit&e=css Requested by Host: use.typekit.net URL: https://use.typekit.net/yty7mat.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:780::5f65:3679 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software nginx / Resource Hash 1c0ff118a4290c99f39c90abb38703a866e47251b23cca20266c69c812ccafeb Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Response headers date Wed, 14 Dec 2022 05:19:44 GMT last-modified Sat, 16 Oct 2021 08:18:43 GMT server nginx etag "616a8ae3-5" content-type text/css access-control-allow-origin * cache-control public, max-age=604800 cross-origin-resource-policy cross-origin accept-ranges bytes content-length 5
GET H3	200	gtm.js Show response www.googletagmanager.com/	148 KB 53 KB	23ms 22ms	Script application/javascript	2a00:1450:4001:828::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtm.js?id=GTM-MWHFVG2 Requested by Host: claroty.com URL: https://claroty.com/team82/research/js-on-security-off-abusing-json-based-sql-to-bypass-waf Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:828::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 8b07c278a6efbd1b20864379b7e5a6ec1de8523e62968358a22aa62e3fed3c57 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Response headers date Wed, 14 Dec 2022 05:19:44 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 54612 x-xss-protection 0 last-modified Wed, 14 Dec 2022 03:00:00 GMT server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Wed, 14 Dec 2022 05:19:44 GMT
GET H2	200	jilEnH5CqVK0j3M3GHR5 Show response ws.zoominfo.com/pixel/	3 KB 2 KB	174ms 149ms	Script text/javascript	2606:4700::6810:650c CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://ws.zoominfo.com/pixel/jilEnH5CqVK0j3M3GHR5 Requested by Host: claroty.com URL: https://claroty.com/team82/research/js-on-security-off-abusing-json-based-sql-to-bypass-waf Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:650c , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Express Resource Hash 48fadaea73b8ae90a928bf8b8c20273b8cc9e15f7035d417327a0ec52f0e1f3a Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://claroty.com/team82/research/js-on-security-off-abusing-json-based-sql-to-bypass-waf User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Response headers date Wed, 14 Dec 2022 05:19:44 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status DYNAMIC via 1.1 google server cloudflare x-powered-by Express vary Accept-Encoding content-type text/javascript access-control-allow-origin * access-control-allow-credentials true cf-ray 77947c7e1f329241-FRA access-control-allow-headers Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for, x-ws-collect-type
GET H2	200	6si.min.js Show response j.6sc.co/	31 KB 10 KB	56ms 7ms	Script application/javascript	184.24.7.242 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://j.6sc.co/6si.min.js Requested by Host: claroty.com URL: https://claroty.com/team82/research/js-on-security-off-abusing-json-based-sql-to-bypass-waf Protocol H2 Security TLS 1.3, , AES_256_GCM Server 184.24.7.242 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a184-24-7-242.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash eea93734d5f0032479fa252394415d53cbcd4e7bd6d54764543eaa8b7c9fd10c Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Response headers pragma no-cache date Wed, 14 Dec 2022 05:19:44 GMT content-encoding gzip x-content-type-options nosniff last-modified Thu, 01 Dec 2022 20:20:43 GMT server nginx/1.14.0 (Ubuntu) etag "63890c9b-7ad6" vary Accept-Encoding content-type application/javascript cache-control private, no-cache, proxy-revalidate accept-ranges bytes content-length 10143 expires Wed, 14 Dec 2022 05:19:44 GMT
GET H2	200	l use.typekit.net/af/efe4a5/00000000000000007735e609/30/	29 KB 29 KB	126ms 32ms	Font application/font-woff2	2a02:26f0:780::210:ca78 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://use.typekit.net/af/efe4a5/00000000000000007735e609/30/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n4&v=3 Requested by Host: use.typekit.net URL: https://use.typekit.net/yty7mat.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:780::210:ca78 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software nginx / Resource Hash c4d04d2b6a041dde11c80d8332f983a58c1031c663ab4f42230899cb82adf4a7 Request headers Referer https://use.typekit.net/yty7mat.css Origin https://claroty.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Response headers date Wed, 14 Dec 2022 05:19:44 GMT server nginx etag "6aeae62b893768150f3460329dc461358e8ab2f5" content-type application/font-woff2 access-control-allow-origin * cache-control public, max-age=31536000 cross-origin-resource-policy cross-origin timing-allow-origin * content-length 29820
GET H2	200	l use.typekit.net/af/78aca8/00000000000000007735e60d/30/	29 KB 29 KB	125ms 32ms	Font application/font-woff2	2a02:26f0:780::210:ca78 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://use.typekit.net/af/78aca8/00000000000000007735e60d/30/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n6&v=3 Requested by Host: use.typekit.net URL: https://use.typekit.net/yty7mat.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:780::210:ca78 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software nginx / Resource Hash b07871da02311868c31ab6ac5a4e78cc877f118acd854857f6f51519f3ddbbc9 Request headers Referer https://use.typekit.net/yty7mat.css Origin https://claroty.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Response headers date Wed, 14 Dec 2022 05:19:44 GMT server nginx etag "1d1aed9a298449b26ef6d57c78caa88b6b5de306" content-type application/font-woff2 access-control-allow-origin * cache-control public, max-age=31536000 cross-origin-resource-policy cross-origin timing-allow-origin * content-length 29764
GET H2	200	1756cb5fe495affedbf1ef724ea3c283.webp claroty-statamic-assets-cache.nyc3.digitaloceanspaces.com/containers/assets/claroty-blog-graphics_12-22-01.png/	22 KB 23 KB	366ms 181ms	Image image/webp	162.243.189.2 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Show image Full URL https://claroty-statamic-assets-cache.nyc3.digitaloceanspaces.com/containers/assets/claroty-blog-graphics_12-22-01.png/1756cb5fe495affedbf1ef724ea3c283.webp Requested by Host: claroty.com URL: https://claroty.com/team82/research/js-on-security-off-abusing-json-based-sql-to-bypass-waf Protocol H2 Security TLS 1.3, , AES_128_GCM Server 162.243.189.2 , United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS nyc3.digitaloceanspaces.com Software / Resource Hash e154f7afd078f24a90631542585b931ea7ecfc89c16ad03c9fce0dc38e9ec290 Security Headers Name Value Strict-Transport-Security max-age=15552000; includeSubDomains; preload Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Response headers date Wed, 14 Dec 2022 05:19:44 GMT strict-transport-security max-age=15552000; includeSubDomains; preload last-modified Thu, 08 Dec 2022 14:17:53 GMT x-amz-request-id tx0000000000002082d84c2-0063995cf0-3f19a6f7-nyc3c etag "40d620d7896ffb65b194b07bbdaeaf9d" vary Origin, Access-Control-Request-Headers, Access-Control-Request-Method content-type image/webp x-rgw-object-type Normal accept-ranges bytes content-length 22984
GET H3	200	js Show response www.googletagmanager.com/gtag/	109 KB 43 KB	20ms 19ms	Script application/javascript	2a00:1450:4001:828::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=UA-84224451-1&l=dataLayer&cx=c Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=UA-23917942-3 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:828::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 80e24a6188db992ca53cdcbfef26230bd11a88dbf0a61fa629466f9c61ec2b00 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Response headers date Wed, 14 Dec 2022 05:19:44 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 43624 x-xss-protection 0 last-modified Wed, 14 Dec 2022 03:00:00 GMT server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Wed, 14 Dec 2022 05:19:44 GMT
GET H2	200	735c823f610089038acc02d64d29faa1.webp claroty-statamic-assets-cache.nyc3.digitaloceanspaces.com/containers/assets/cnmaestro-1670516981.png/	9 KB 9 KB	259ms 94ms	Image image/webp	162.243.189.2 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Show image Full URL https://claroty-statamic-assets-cache.nyc3.digitaloceanspaces.com/containers/assets/cnmaestro-1670516981.png/735c823f610089038acc02d64d29faa1.webp Requested by Host: claroty.com URL: https://claroty.com/team82/research/js-on-security-off-abusing-json-based-sql-to-bypass-waf Protocol H2 Security TLS 1.3, , AES_128_GCM Server 162.243.189.2 , United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS nyc3.digitaloceanspaces.com Software / Resource Hash 20ccac8589a6d6f653e0aa5d5b5661e336af6d319d105cb4a55602817a693618 Security Headers Name Value Strict-Transport-Security max-age=15552000; includeSubDomains; preload Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Response headers date Wed, 14 Dec 2022 05:19:44 GMT strict-transport-security max-age=15552000; includeSubDomains; preload last-modified Thu, 08 Dec 2022 16:29:54 GMT x-amz-request-id tx00000000000020814d43c-0063995cf0-3f1a061f-nyc3c etag "ab114968f130af244c18e5e0e275a69f" vary Origin, Access-Control-Request-Headers, Access-Control-Request-Method content-type image/webp x-rgw-object-type Normal accept-ranges bytes content-length 9264
GET H2	200	09a23531e42beb2db8b10b445fb8cbc1.webp claroty-statamic-assets-cache.nyc3.digitaloceanspaces.com/containers/assets/claroty-blog-graphics_12-22-02.png/	77 KB 77 KB	432ms 268ms	Image image/webp	162.243.189.2 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Show image Full URL https://claroty-statamic-assets-cache.nyc3.digitaloceanspaces.com/containers/assets/claroty-blog-graphics_12-22-02.png/09a23531e42beb2db8b10b445fb8cbc1.webp Requested by Host: claroty.com URL: https://claroty.com/team82/research/js-on-security-off-abusing-json-based-sql-to-bypass-waf Protocol H2 Security TLS 1.3, , AES_128_GCM Server 162.243.189.2 , United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS nyc3.digitaloceanspaces.com Software / Resource Hash 06a2c76b6238437753b020ff011bfa46045f62e882945f9fd6d73da73467c4ac Security Headers Name Value Strict-Transport-Security max-age=15552000; includeSubDomains; preload Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Response headers date Wed, 14 Dec 2022 05:19:44 GMT strict-transport-security max-age=15552000; includeSubDomains; preload last-modified Tue, 06 Dec 2022 17:16:23 GMT x-amz-request-id tx00000000000020821e637-0063995cf0-3f2aaee4-nyc3c etag "b8029a91607a5f5d915a027c07b9b6c9" vary Origin, Access-Control-Request-Headers, Access-Control-Request-Method content-type image/webp x-rgw-object-type Normal accept-ranges bytes content-length 78874
POST H2	204	collect region1.google-analytics.com/g/	0 344 B	41ms 13ms	Ping text/plain	2001:4860:4802:34::36 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://region1.google-analytics.com/g/collect?v=2&tid=G-H6L2YY031Z&gtm=2oebu0&_p=62323&cid=193442435.1670995184&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=1&sid=1670995184&sct=1&seg=0&dl=https%3A%2F%2Fclaroty.com%2Fteam82%2Fresearch%2Fjs-on-security-off-abusing-json-based-sql-to-bypass-waf&dt=%7BJS-ON%3A%20Security-OFF%7D%3A%20Abusing%20JSON-Based%20SQL%20to%20Bypass%20WAF%20%7C%20Claroty&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=G-H6L2YY031Z Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Response headers pragma no-cache date Wed, 14 Dec 2022 05:19:44 GMT server Golfe2 content-type text/plain access-control-allow-origin https://claroty.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	pro-v4-shims.min.js Show response ka-p.fontawesome.com/releases/v6.2.1/js/	26 KB 8 KB	39ms 30ms	Fetch application/javascript	2606:4700::6812:1634 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://ka-p.fontawesome.com/releases/v6.2.1/js/pro-v4-shims.min.js?token=8175422aa5 Requested by Host: kit.fontawesome.com URL: https://kit.fontawesome.com/8175422aa5.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:1634 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 5e7f62f8cf00b418866eb5273e08de1017c2accd5541247e55fba5615b37c2f6 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Response headers date Wed, 14 Dec 2022 05:19:44 GMT content-encoding gzip cf-cache-status HIT last-modified Mon, 14 Nov 2022 15:06:08 GMT server cloudflare age 115232 etag "63725960-1dc0" vary Origin, Accept-Encoding, Access-Control-Request-Headers, Access-Control-Request-Method content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=31556926 accept-ranges bytes cf-ray 77947c7e889792b7-FRA content-length 7616
GET H2	200	pro.min.js Show response ka-p.fontawesome.com/releases/v6.2.1/js/	60 KB 18 KB	31ms 23ms	Fetch application/javascript	2606:4700::6812:1634 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://ka-p.fontawesome.com/releases/v6.2.1/js/pro.min.js?token=8175422aa5 Requested by Host: kit.fontawesome.com URL: https://kit.fontawesome.com/8175422aa5.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:1634 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 676d715208b0e7359351e069f11b31c8600eb109724949a235a0a74cadf5caf2 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Response headers date Wed, 14 Dec 2022 05:19:44 GMT content-encoding gzip cf-cache-status HIT last-modified Mon, 14 Nov 2022 15:06:08 GMT server cloudflare age 944340 etag "63725960-4514" vary Origin, Accept-Encoding, Access-Control-Request-Headers, Access-Control-Request-Method content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=31556926 accept-ranges bytes cf-ray 77947c7e889892b7-FRA content-length 17684
GET DATA	200 OK	truncated /	715 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 5a3f1dd74233f605e511f1b5b244bedf85ac88ba264caf4d6401bc7ec2017dcd Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	380 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 717f6bb5f6cc69c444f54376a72dee0ca7968b2a12e7c9475247ec85c0e75a53 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Response headers Content-Type image/svg+xml
GET H2	206	sqlmap_waf_bypass.mp4 claroty-statamic-assets.nyc3.digitaloceanspaces.com/	160 KB 0	370ms 183ms	Media video/mp4	162.243.189.2 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://claroty-statamic-assets.nyc3.digitaloceanspaces.com/sqlmap_waf_bypass.mp4 Requested by Host: claroty.com URL: https://claroty.com/team82/research/js-on-security-off-abusing-json-based-sql-to-bypass-waf Protocol H2 Security TLS 1.3, , AES_128_GCM Server 162.243.189.2 , United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS nyc3.digitaloceanspaces.com Software / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=15552000; includeSubDomains; preload Request headers Referer Accept-Encoding identity;q=1, *;q=0 accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Range bytes=0- Response headers date Wed, 14 Dec 2022 05:19:44 GMT strict-transport-security max-age=15552000; includeSubDomains; preload last-modified Thu, 01 Dec 2022 18:38:11 GMT x-amz-request-id tx00000000000020814d48f-0063995cf0-3f1a061f-nyc3c etag "bf52c8b136ea82fb2d9daf0725b94bf4" vary Origin, Access-Control-Request-Headers, Access-Control-Request-Method content-type video/mp4 Content-Range bytes 0-1181517/1181518 x-rgw-object-type Normal accept-ranges bytes Content-Length 1181518
GET DATA	200 OK	truncated /	547 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash eb14baeac955bb11e33cd7fd3fd2f698cf20db1b450325f45ea843b6cdc82366 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	552 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 62f3f809487194fcc55a3ebd88811a604ae496027bb425d4ebd15d9ae1921945 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	177 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash d692a67352a3dfa80010c86a62761cfff05c0b1086618106a8576cc45a6a8115 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	351 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 145287b36883dd3061ca7aa9229a8fa9ace2cccd50e0382b4b6201f3916b57c5 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	242 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 1f4513a435d6a3047d20a50c1e7d4263de42146c74be227f774b5e82e6357e75 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Response headers Content-Type image/svg+xml
GET H2	200	ipv cdn.bizible.com/m/	43 B 305 B	7ms 7ms	Image image/gif	152.195.15.58 EDGECAST
General Check archive.org Show headers Download Go to Show image Full URL https://cdn.bizible.com/m/ipv?_biz_r=&_biz_h=-1906410348&_biz_u=37299957c76b414faaf859345aad7b5c&_biz_s=81f594&_biz_l=https%3A%2F%2Fclaroty.com%2Fteam82%2Fresearch%2Fjs-on-security-off-abusing-json-based-sql-to-bypass-waf&_biz_t=1670995184431&_biz_i=%7BJS-ON%3A%20Security-OFF%7D%3A%20Abusing%20JSON-Based%20SQL%20to%20Bypass%20WAF%20%7C%20Claroty&_biz_n=0&rnd=157479&cdn_o=a&_biz_z=1670995184431 Requested by Host: claroty.com URL: https://claroty.com/team82/research/js-on-security-off-abusing-json-based-sql-to-bypass-waf Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.195.15.58 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECS (frb/6760) / Resource Hash afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Response headers pragma no-cache date Wed, 14 Dec 2022 05:19:44 GMT last-modified Wed, 07 Dec 2022 14:12:16 GMT server ECS (frb/6760) age 572848 x-cache HIT p3p CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" content-type Image/GIF cache-control no-cache, no-store accept-ranges bytes content-length 43 expires -1
GET H2	200	u cdn.bizibly.com/	43 B 203 B	19ms 7ms	Image image/gif	152.195.15.58 EDGECAST
General Check archive.org Show headers Download Go to Show image Full URL https://cdn.bizibly.com/u?_biz_u=37299957c76b414faaf859345aad7b5c&_biz_s=81f594&_biz_l=https%3A%2F%2Fclaroty.com%2Fteam82%2Fresearch%2Fjs-on-security-off-abusing-json-based-sql-to-bypass-waf&_biz_t=1670995184432&_biz_i=%7BJS-ON%3A%20Security-OFF%7D%3A%20Abusing%20JSON-Based%20SQL%20to%20Bypass%20WAF%20%7C%20Claroty&rnd=704641&cdn_o=a&_biz_z=1670995184432 Requested by Host: claroty.com URL: https://claroty.com/team82/research/js-on-security-off-abusing-json-based-sql-to-bypass-waf Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.195.15.58 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECS (frb/67C2) / Resource Hash afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Response headers pragma no-cache date Wed, 14 Dec 2022 05:19:44 GMT last-modified Thu, 08 Dec 2022 23:58:39 GMT server ECS (frb/67C2) age 451265 x-cache HIT p3p CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" content-type Image/GIF cache-control no-cache, no-store accept-ranges bytes content-length 43 expires -1
GET H2	200	insight.min.js Show response snap.licdn.com/li.lms-analytics/	1017 B 657 B	121ms 32ms	Script application/x-javascript	2a02:26f0:780::210:ca7a AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://snap.licdn.com/li.lms-analytics/insight.min.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-MWHFVG2 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:780::210:ca7a Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash 188df28d9a43df9305e789776e4eed7f4afdd7c1d391dc5706d816af46554ede Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Response headers date Wed, 14 Dec 2022 05:19:44 GMT content-encoding gzip last-modified Tue, 13 Dec 2022 16:28:43 GMT x-cdn AKAM vary Accept-Encoding content-type application/x-javascript;charset=utf-8 cache-control max-age=40163 accept-ranges bytes content-length 489
GET H2	200	6563.js Show response script.crazyegg.com/pages/scripts/0111/	6 KB 2 KB	450ms 404ms	Script text/javascript	2606:4700::6813:9408 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://script.crazyegg.com/pages/scripts/0111/6563.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-MWHFVG2 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6813:9408 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash cca1501b017402a98ba098efb96abbb84a0d74c3be8d62fdae0ec3d1422a2a86 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Response headers date Wed, 14 Dec 2022 05:19:44 GMT content-encoding gzip cf-cache-status EXPIRED last-modified Wed, 14 Dec 2022 05:19:44 GMT server cloudflare vary Accept-Encoding content-type text/javascript ce-version 11.5.9 access-control-allow-origin * access-control-expose-headers CE-Version cache-control public, max-age=300, s-maxage=1209600 accept-ranges bytes timing-allow-origin * cf-ray 77947c7f197192a8-FRA content-length 2202
GET H2	200	/ insight.adsrvr.org/track/pxl/	70 B 261 B	106ms 32ms	Image image/gif	3.33.220.150 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://insight.adsrvr.org/track/pxl/?adv=fmojdlh&ct=0:hz6aipu&fmt=3 Requested by Host: claroty.com URL: https://claroty.com/team82/research/js-on-security-off-abusing-json-based-sql-to-bypass-waf Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 3.33.220.150 , United States, ASN16509 (AMAZON-02, US), Reverse DNS a12b7a488abeaa9e4.awsglobalaccelerator.com Software / Resource Hash 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Response headers content-type image/gif pragma no-cache date Wed, 14 Dec 2022 05:19:44 GMT cache-control private,no-cache, must-revalidate x-aspnet-version 4.0.30319 p3p CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
GET H/1.1	200 OK	getuidj Show response secure.adnxs.com/	11 B 699 B	58ms 13ms	XHR application/json	185.89.210.20 ASN-APPNEX
General Check archive.org Show headers Download Go to Full URL https://secure.adnxs.com/getuidj Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 185.89.210.20 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US), Reverse DNS 944.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net Software nginx/1.21.3 / Resource Hash 31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d Security Headers Name Value X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Response headers Pragma no-cache Date Wed, 14 Dec 2022 05:19:44 GMT AN-X-Request-Uuid 21f788c1-2c8e-4aaa-8025-51a1b7cc8897 Server nginx/1.21.3 Content-Type application/json; charset=utf-8 P3P policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Access-Control-Allow-Origin https://claroty.com Cache-Control no-store, no-cache, private Access-Control-Allow-Credentials true Connection keep-alive X-Proxy-Origin 146.70.117.110; 146.70.117.110; 944.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com Content-Length 11 X-XSS-Protection 0 Expires Sat, 15 Nov 2008 16:00:00 GMT
GET H2	200	/ Show response c.6sc.co/	7 B 199 B	26ms 6ms	XHR text/html	184.24.7.242 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://c.6sc.co/ Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 184.24.7.242 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a184-24-7-242.deploy.static.akamaitechnologies.com Software / Resource Hash fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Response headers date Wed, 14 Dec 2022 05:19:44 GMT access-control-max-age 86400 access-control-allow-methods GET,POST content-type text/html access-control-allow-origin https://claroty.com access-control-allow-credentials true access-control-allow-headers * content-length 7
GET H2	200	/ Show response ipv6.6sc.co/	19 B 250 B	94ms 21ms	XHR text/html	2a02:26f0:480:389::1c91 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://ipv6.6sc.co/ Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:480:389::1c91 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash ac8d539fa2691c69c61152294bdd1bfb5c36c4235d4856ef737533f3f562ef17 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Response headers pragma no-cache date Wed, 14 Dec 2022 05:19:44 GMT vary Origin content-type text/html access-control-allow-origin https://claroty.com cache-control max-age=0, no-cache, no-store 6si-ipv6 2001:ac8:20:272::2e server-timing cdn-cache; desc=HIT, edge; dur=1 content-length 19 expires Wed, 14 Dec 2022 05:19:44 GMT
GET H2	200	analytics.js Show response www.google-analytics.com/	49 KB 20 KB	29ms 6ms	Script text/javascript	2a00:1450:4001:808::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/analytics.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=UA-84224451-1&l=dataLayer&cx=c Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:808::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash b42e4a056cb5b80c5a315040826866445ec9332f0749e184509ab2d9d3b86719 Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Response headers strict-transport-security max-age=10886400; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff date Wed, 14 Dec 2022 05:15:46 GMT last-modified Tue, 27 Sep 2022 22:01:05 GMT server Golfe2 age 238 vary Accept-Encoding content-type text/javascript cache-control public, max-age=7200 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 20039 expires Wed, 14 Dec 2022 07:15:46 GMT
GET H2	200	xdc.js Show response cdn.bizible.com/	84 B 517 B	116ms 116ms	Script text/javascript	152.195.15.58 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://cdn.bizible.com/xdc.js?_biz_u=37299957c76b414faaf859345aad7b5c&_biz_h=-1906410348&cdn_o=a&jsVer=4.22.11.18 Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.195.15.58 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECS (frb/6711) / Resource Hash 6d22e660ead72f14b0aa8e3dfc8de1da35f17e3559b489e00692f15f50faa1a6 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Response headers date Wed, 14 Dec 2022 05:19:43 GMT content-encoding gzip server ECS (frb/6711) etag EFEDFBC3 vary Accept-Encoding p3p CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" content-type text/javascript; charset=utf-8 cache-control private, must-revalidate, max-age=21600 content-length 186
GET H2	200	plus.svg Show response ka-p.fontawesome.com/releases/v6.2.1/svgs/regular/	495 B 413 B	38ms 37ms	Fetch image/svg+xml	2606:4700::6812:1634 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://ka-p.fontawesome.com/releases/v6.2.1/svgs/regular/plus.svg?token=8175422aa5 Requested by Host: claroty.com URL: https://claroty.com/team82/research/js-on-security-off-abusing-json-based-sql-to-bypass-waf Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:1634 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 89e2ad1f492effcd4ce0c8198bd310375cb39e2d51b8cb1663b3eea9ad313870 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Response headers date Wed, 14 Dec 2022 05:19:44 GMT content-encoding gzip cf-cache-status HIT last-modified Mon, 14 Nov 2022 15:10:04 GMT server cloudflare age 509948 etag W/"63725a4c-1ef" vary Origin, Accept-Encoding, Access-Control-Request-Headers, Access-Control-Request-Method content-type image/svg+xml access-control-allow-origin * cache-control max-age=31556926 cf-ray 77947c7f3a1b92b7-FRA
GET H2	200	linkedin.svg Show response ka-p.fontawesome.com/releases/v6.2.1/svgs/brands/	672 B 520 B	27ms 26ms	Fetch image/svg+xml	2606:4700::6812:1634 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://ka-p.fontawesome.com/releases/v6.2.1/svgs/brands/linkedin.svg?token=8175422aa5 Requested by Host: claroty.com URL: https://claroty.com/team82/research/js-on-security-off-abusing-json-based-sql-to-bypass-waf Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:1634 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 01989d228587f9b45204822fc891ecffa28376754b41c76ef440c89e7fc7b18b Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Response headers date Wed, 14 Dec 2022 05:19:44 GMT content-encoding gzip cf-cache-status HIT last-modified Mon, 14 Nov 2022 15:06:13 GMT server cloudflare age 944338 etag W/"63725965-2a0" vary Origin, Accept-Encoding, Access-Control-Request-Headers, Access-Control-Request-Method content-type image/svg+xml access-control-allow-origin * cache-control max-age=31556926 cf-ray 77947c7f4a2692b7-FRA
GET H2	200	twitter.svg Show response ka-p.fontawesome.com/releases/v6.2.1/svgs/brands/	1 KB 697 B	26ms 25ms	Fetch image/svg+xml	2606:4700::6812:1634 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://ka-p.fontawesome.com/releases/v6.2.1/svgs/brands/twitter.svg?token=8175422aa5 Requested by Host: claroty.com URL: https://claroty.com/team82/research/js-on-security-off-abusing-json-based-sql-to-bypass-waf Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:1634 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 70adb98cf9f0fc24b0add9bd7a0da94b9c9cd85cf84949ea8568c1837723d621 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Response headers date Wed, 14 Dec 2022 05:19:44 GMT content-encoding gzip cf-cache-status HIT last-modified Mon, 14 Nov 2022 15:06:15 GMT server cloudflare age 944337 etag W/"63725967-40f" vary Origin, Accept-Encoding, Access-Control-Request-Headers, Access-Control-Request-Method content-type image/svg+xml access-control-allow-origin * cache-control max-age=31556926 cf-ray 77947c7f4a2b92b7-FRA
GET H2	200	facebook.svg Show response ka-p.fontawesome.com/releases/v6.2.1/svgs/brands/	512 B 444 B	24ms 24ms	Fetch image/svg+xml	2606:4700::6812:1634 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://ka-p.fontawesome.com/releases/v6.2.1/svgs/brands/facebook.svg?token=8175422aa5 Requested by Host: claroty.com URL: https://claroty.com/team82/research/js-on-security-off-abusing-json-based-sql-to-bypass-waf Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:1634 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 8a5869b19f54e9904b39fdd58621e2c991bd2d1c549f39c15ec4759694e44d66 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Response headers date Wed, 14 Dec 2022 05:19:44 GMT content-encoding gzip cf-cache-status HIT last-modified Mon, 14 Nov 2022 15:06:12 GMT server cloudflare age 2458270 etag W/"63725964-200" vary Origin, Accept-Encoding, Access-Control-Request-Headers, Access-Control-Request-Method content-type image/svg+xml access-control-allow-origin * cache-control max-age=31556926 cf-ray 77947c7f4a2e92b7-FRA
GET H2	200	envelope.svg Show response ka-p.fontawesome.com/releases/v6.2.1/svgs/regular/	567 B 475 B	24ms 23ms	Fetch image/svg+xml	2606:4700::6812:1634 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://ka-p.fontawesome.com/releases/v6.2.1/svgs/regular/envelope.svg?token=8175422aa5 Requested by Host: claroty.com URL: https://claroty.com/team82/research/js-on-security-off-abusing-json-based-sql-to-bypass-waf Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:1634 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 3d36bb49efb5d212f2f21185d283f86396ea66879013d24bd547caa325438445 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Response headers date Wed, 14 Dec 2022 05:19:44 GMT content-encoding gzip cf-cache-status HIT last-modified Mon, 14 Nov 2022 15:09:47 GMT server cloudflare age 509948 etag W/"63725a3b-237" vary Origin, Accept-Encoding, Access-Control-Request-Headers, Access-Control-Request-Method content-type image/svg+xml access-control-allow-origin * cache-control max-age=31556926 cf-ray 77947c7f4a2f92b7-FRA
GET H2	200	xmark-large.svg Show response ka-p.fontawesome.com/releases/v6.2.1/svgs/regular/	621 B 432 B	57ms 57ms	Fetch image/svg+xml	2606:4700::6812:1634 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://ka-p.fontawesome.com/releases/v6.2.1/svgs/regular/xmark-large.svg?token=8175422aa5 Requested by Host: claroty.com URL: https://claroty.com/team82/research/js-on-security-off-abusing-json-based-sql-to-bypass-waf Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:1634 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 1a99d3713009c7b6625299aab5f34d0ce93abdc0de73fa933ee3322a000dbcad Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Response headers date Wed, 14 Dec 2022 05:19:44 GMT content-encoding gzip cf-cache-status HIT last-modified Mon, 14 Nov 2022 15:11:03 GMT server cloudflare age 944337 etag W/"63725a87-26d" vary Origin, Accept-Encoding, Access-Control-Request-Headers, Access-Control-Request-Method content-type image/svg+xml access-control-allow-origin * cache-control max-age=31556926 cf-ray 77947c7f4a3092b7-FRA
GET H2	200	angle-down.svg Show response ka-p.fontawesome.com/releases/v6.2.1/svgs/solid/	416 B 374 B	67ms 67ms	Fetch image/svg+xml	2606:4700::6812:1634 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://ka-p.fontawesome.com/releases/v6.2.1/svgs/solid/angle-down.svg?token=8175422aa5 Requested by Host: claroty.com URL: https://claroty.com/team82/research/js-on-security-off-abusing-json-based-sql-to-bypass-waf Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:1634 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash f350642e874d828ca40dd163124b8d66d6481990ba5ceebdc885789d171e4cbc Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Response headers date Wed, 14 Dec 2022 05:19:44 GMT content-encoding gzip cf-cache-status HIT last-modified Mon, 14 Nov 2022 15:12:30 GMT server cloudflare age 2415624 etag W/"63725ade-1a0" vary Origin, Accept-Encoding, Access-Control-Request-Headers, Access-Control-Request-Method content-type image/svg+xml access-control-allow-origin * cache-control max-age=31556926 cf-ray 77947c7f4a3392b7-FRA
GET H2	200	search.svg Show response ka-p.fontawesome.com/releases/v6.2.1/svgs/regular/	584 B 465 B	21ms 21ms	Fetch image/svg+xml	2606:4700::6812:1634 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://ka-p.fontawesome.com/releases/v6.2.1/svgs/regular/search.svg?token=8175422aa5 Requested by Host: claroty.com URL: https://claroty.com/team82/research/js-on-security-off-abusing-json-based-sql-to-bypass-waf Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:1634 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash badf81c86489d6eee2ca730fccb6bfd76a532a38942b1c80f06029367374eca1 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Response headers date Wed, 14 Dec 2022 05:19:44 GMT content-encoding gzip cf-cache-status HIT last-modified Mon, 14 Nov 2022 15:10:07 GMT server cloudflare age 2458270 etag W/"63725a4f-248" vary Origin, Accept-Encoding, Access-Control-Request-Headers, Access-Control-Request-Method content-type image/svg+xml access-control-allow-origin * cache-control max-age=31556926 cf-ray 77947c7f4a3692b7-FRA
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 493 B	285ms 261ms	Image image/gif	184.24.7.242 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=1a8619a294ad37fe81fcb7766ed37dc1&svisitor=null&visitor=ed5363f0-7b01-4ffc-8c71-8e288313d01e&session=2d337936-4281-47f8-8087-75bbdb0593df&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Wed%2C%2014%20Dec%202022%2005%3A19%3A44%20GMT%22%7D&isIframe=false&m=%7B%22description%22%3A%22Team82%20developed%20a%20generic%20web%20application%20firewall%20bypass%20that%20exploits%20a%20lack%20of%20JSON%20syntax%20support%20in%20leading%20vendors%27%20SQL%20injection%20inspection%20process.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22%7BJS-ON%3A%20Security-OFF%7D%3A%20Abusing%20JSON-Based%20SQL%20to%20Bypass%20WAF%20%7C%20Claroty%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fclaroty.com%2Fteam82%2Fresearch%2Fjs-on-security-off-abusing-json-based-sql-to-bypass-waf&pageViewId=b6218204-ff75-4244-85fd-c88be5b2554d&an_uid=0 Requested by Host: claroty.com URL: https://claroty.com/team82/research/js-on-security-off-abusing-json-based-sql-to-bypass-waf Protocol H2 Security TLS 1.3, , AES_256_GCM Server 184.24.7.242 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a184-24-7-242.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Response headers date Wed, 14 Dec 2022 05:19:44 GMT x-content-type-options nosniff content-length 43 pragma no-cache last-modified Fri, 21 Feb 2020 18:57:20 GMT server nginx/1.14.0 (Ubuntu) etag "5e502810-2b" access-control-max-age 86400 access-control-allow-methods GET,POST content-type image/gif access-control-allow-origin cache-control private, no-cache, no-cache=Set-Cookie, proxy-revalidate access-control-allow-credentials true accept-ranges bytes access-control-allow-headers * expires Wed, 19 Apr 2000 11:43:00 GMT
GET H2	200	fb.js Show response js.hsadspixel.net/	6 KB 3 KB	51ms 26ms	Script application/javascript	2606:4700::6811:72b0 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js.hsadspixel.net/fb.js Requested by Host: js.hs-scripts.com URL: https://js.hs-scripts.com/20307279.js?businessUnitId=556099 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:72b0 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 923f82635a75547c368b300c684da5f5f36164446310142d67c520c18d1b8f3d Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Response headers date Wed, 14 Dec 2022 05:19:44 GMT x-amz-version-id uc7chkM909y9_fdLpHcf_jlYEUuyZ4oj via 1.1 736ad67f05a9a5a8fd5ed8cba30196f4.cloudfront.net (CloudFront) cf-cache-status HIT content-encoding br x-amz-cf-pop IAD12-P3 age 197 x-amz-server-side-encryption AES256 content-security-policy-report-only frame-ancestors 'self'; report-uri https://exceptions.hubspot.com/csp/report?resource=adsscriptloaderstatic/static-1.303/bundles/pixels-release.js&cfRay=779477ab5d38927d-IAD x-cache Hit from cloudfront cache-tag staticjsapp-AdsScriptLoaderCloudflare-web-prod,staticjsapp-prod x-amz-replication-status COMPLETED last-modified Wed, 07 Dec 2022 03:25:35 UTC server cloudflare etag W/"cac538694d8cb071669002abe101c1fa" vary Accept-Encoding content-type application/javascript; charset=utf-8 x-hs-cache-status HIT cache-control max-age=600 cf-ray 77947c7f7a21928f-FRA x-amz-cf-id 5B-NZnTbkxpsG8H1a9uyq6wYBKc1Beu2DKQFCKsbxfmO8Mm7Hy0Lyg== x-hs-target-asset adsscriptloaderstatic/static-1.303/bundles/pixels-release.js
GET H2	200	556099.js Show response js.hs-banner.com/20307279/	60 KB 15 KB	311ms 294ms	Script text/plain	2606:4700:4400::ac40:9a55 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js.hs-banner.com/20307279/556099.js Requested by Host: js.hs-scripts.com URL: https://js.hs-scripts.com/20307279.js?businessUnitId=556099 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::ac40:9a55 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 4c5a507a93faf161c3b4c94346aa04fc4f4f99f9ca59ce17ff652b1aa814f977 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Response headers date Wed, 14 Dec 2022 05:19:44 GMT content-encoding br cf-cache-status EXPIRED x-hubspot-correlation-id cb4daec2-cdff-4beb-9a66-baac4ceb784b last-modified Tue, 13 Dec 2022 17:49:58 GMT server cloudflare vary origin, Accept-Encoding access-control-allow-methods GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD content-type text/plain; charset=utf-8 access-control-max-age 604800 access-control-expose-headers x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing cache-control max-age=300, public access-control-allow-credentials true timing-allow-origin * access-control-allow-headers Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer, X-HubSpot-Correlation-Id cf-ray 77947c7f6ba3bb4f-FRA expires Wed, 14 Dec 2022 05:24:44 GMT
GET H2	200	collectedforms.js Show response js.hscollectedforms.net/	68 KB 25 KB	147ms 126ms	Script application/javascript	2606:4700::6811:81ab CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js.hscollectedforms.net/collectedforms.js Requested by Host: js.hs-scripts.com URL: https://js.hs-scripts.com/20307279.js?businessUnitId=556099 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:81ab , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 3999cf864b43937c278afeae5b60b6db69bb234d5641202c9e7a2385029aa3b7 Request headers Referer Origin https://claroty.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Response headers date Wed, 14 Dec 2022 05:19:44 GMT x-amz-version-id SN4HXBautbT5xHa4DdPckLpyluwLE8QR via 1.1 bcfffcf7e0fc8cd9cfe4125369a9f036.cloudfront.net (CloudFront) cf-cache-status EXPIRED content-encoding br x-amz-cf-pop IAD12-P3 x-amz-server-side-encryption AES256 content-security-policy-report-only frame-ancestors 'self'; report-uri https://exceptions.hubspot.com/csp/report?resource=collected-forms-embed-js/static-1.312/bundles/project.js&cfRay=77947c7f78d76909-FRA x-cache Hit from cloudfront cache-tag staticjsapp-collected-forms-embed-js-web-prod,staticjsapp-prod x-amz-replication-status COMPLETED last-modified Wed, 07 Dec 2022 02:49:13 UTC server cloudflare etag W/"349cabd549e2249f8fb6ac3ac6f08e00" vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * x-hs-cache-status HIT cache-control s-maxage=600, max-age=300 cf-ray 77947c7f78d76909-FRA x-amz-cf-id dfX9vhcgROC4srk9ZLIjZ6onKEQ84VOAk-anh3WFXaIF8kbkcxLaFA== x-hs-target-asset collected-forms-embed-js/static-1.312/bundles/project.js
GET H2	200	20307279.js Show response js.hs-analytics.net/analytics/1670994900000/	64 KB 20 KB	190ms 170ms	Script text/javascript	2606:4700::6811:43b0 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js.hs-analytics.net/analytics/1670994900000/20307279.js Requested by Host: js.hs-scripts.com URL: https://js.hs-scripts.com/20307279.js?businessUnitId=556099 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:43b0 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6da9c785ed0b70c5e92fd41b85436c4d4f2454b80251b308d927e19aac4f00a9 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Response headers date Wed, 14 Dec 2022 05:19:44 GMT x-amz-version-id null content-encoding br cf-cache-status MISS x-amz-request-id 9VSX643Q96PJGD16 x-amz-server-side-encryption AES256 x-amz-id-2 fLaPfTDqEW+K/mNmtyXU41+NhbJvYudZOTXwJxbdfD3wUwA/iLDyExW3RrAtUn6QxMFTHzoQZXE= last-modified Thu, 01 Dec 2022 15:06:31 GMT server cloudflare etag W/"9d5b8631b7b84213e2d206142cce4adb" vary origin, Accept-Encoding content-type text/javascript cache-control max-age=300, public access-control-allow-credentials false cf-ray 77947c7fac79bb67-FRA expires Wed, 14 Dec 2022 05:24:44 GMT
GET H2	200	data.js Show response tags.clickagy.com/	38 KB 14 KB	66ms 39ms	Script application/javascript	2606:4700::6812:3eb CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://tags.clickagy.com/data.js?rnd=62fe5c0e6ad95 Requested by Host: ws.zoominfo.com URL: https://ws.zoominfo.com/pixel/jilEnH5CqVK0j3M3GHR5 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:3eb , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash b600f1dc62b172effa1611f27da2410354b23d9bc79f34a525821752fafcde83 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Response headers date Wed, 14 Dec 2022 05:19:44 GMT x-amz-version-id eiH8z613.BRzukjofzW7pfMQ5QqyyUJw content-encoding gzip cf-cache-status DYNAMIC via 1.1 a23dafbbb9a61c77bda1d66d97f24e2e.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-C2 age 41089 x-cache Hit from cloudfront alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 last-modified Fri, 07 Oct 2022 12:51:20 GMT server cloudflare etag W/"39cbfce65efed785f567d3a64646eed5" vary Accept-Encoding content-type application/javascript cf-ray 77947c7fdadb5c2c-FRA x-amz-cf-id gMG5Os3Wdxgk-DrjbserZCgZiYbsALv_ZAVoBcMzlEAkAJCHNRse9A==
POST H3	200	collect Show response www.google-analytics.com/j/	2 B 22 B	28ms 14ms	XHR text/plain	2a00:1450:4001:808::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/j/collect?v=1&_v=j98&a=62323&t=pageview&_s=1&dl=https%3A%2F%2Fclaroty.com%2Fteam82%2Fresearch%2Fjs-on-security-off-abusing-json-based-sql-to-bypass-waf&ul=en-us&de=UTF-8&dt=%7BJS-ON%3A%20Security-OFF%7D%3A%20Abusing%20JSON-Based%20SQL%20to%20Bypass%20WAF%20%7C%20Claroty&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YADAAUABAAAAACAAI~&jid=215077916&gjid=2054893329&cid=193442435.1670995184&tid=UA-84224451-1&_gid=1983602653.1670995185&_r=1&gtm=2oubu0&z=341391995 Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:808::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Wed, 14 Dec 2022 05:19:44 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 content-type text/plain access-control-allow-origin https://claroty.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 2 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 493 B	243ms 243ms	Image image/gif	184.24.7.242 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=1a8619a294ad37fe81fcb7766ed37dc1&svisitor=null&visitor=ed5363f0-7b01-4ffc-8c71-8e288313d01e&session=2d337936-4281-47f8-8087-75bbdb0593df&event=ipv6&q=%7B%22address%22%3A%222001%3Aac8%3A20%3A272%3A%3A2e%22%7D&isIframe=false&m=%7B%22description%22%3A%22Team82%20developed%20a%20generic%20web%20application%20firewall%20bypass%20that%20exploits%20a%20lack%20of%20JSON%20syntax%20support%20in%20leading%20vendors%27%20SQL%20injection%20inspection%20process.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22%7BJS-ON%3A%20Security-OFF%7D%3A%20Abusing%20JSON-Based%20SQL%20to%20Bypass%20WAF%20%7C%20Claroty%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fclaroty.com%2Fteam82%2Fresearch%2Fjs-on-security-off-abusing-json-based-sql-to-bypass-waf&pageViewId=b6218204-ff75-4244-85fd-c88be5b2554d&an_uid=0 Requested by Host: claroty.com URL: https://claroty.com/team82/research/js-on-security-off-abusing-json-based-sql-to-bypass-waf Protocol H2 Security TLS 1.3, , AES_256_GCM Server 184.24.7.242 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a184-24-7-242.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Response headers date Wed, 14 Dec 2022 05:19:44 GMT x-content-type-options nosniff content-length 43 pragma no-cache last-modified Tue, 05 Oct 2021 22:17:52 GMT server nginx/1.14.0 (Ubuntu) etag "615ccf10-2b" access-control-max-age 86400 access-control-allow-methods GET,POST content-type image/gif access-control-allow-origin cache-control private, no-cache, no-cache=Set-Cookie, proxy-revalidate access-control-allow-credentials true accept-ranges bytes access-control-allow-headers * expires Wed, 19 Apr 2000 11:43:00 GMT
GET H2	200	insight.beta.min.js Show response snap.licdn.com/li.lms-analytics/	13 KB 5 KB	32ms 32ms	Script application/x-javascript	2a02:26f0:780::210:ca7a AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://snap.licdn.com/li.lms-analytics/insight.beta.min.js Requested by Host: snap.licdn.com URL: https://snap.licdn.com/li.lms-analytics/insight.min.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:780::210:ca7a Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash 3e6ef4f3484f029b4d1a989163d6bb29899184f008431adb932c43ff3543368a Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Response headers date Wed, 14 Dec 2022 05:19:44 GMT content-encoding gzip last-modified Tue, 13 Dec 2022 16:12:55 GMT x-cdn AKAM vary Accept-Encoding content-type application/x-javascript;charset=utf-8 cache-control max-age=39376 accept-ranges bytes content-length 4654
POST H2	200	collect Show response stats.g.doubleclick.net/j/	4 B 439 B	62ms 21ms	XHR text/plain	2a00:1450:400c:c00::9b GOOGLE
General Check archive.org Show headers Download Go to Full URL https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j98&tid=UA-84224451-1&cid=193442435.1670995184&jid=215077916&gjid=2054893329&_gid=1983602653.1670995185&_u=YADAAUAAAAAAACAAI~&z=2093769492 Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:400c:c00::9b Brussels, Belgium, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80 Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Content-Type text/plain Response headers pragma no-cache strict-transport-security max-age=10886400; includeSubDomains; preload date Wed, 14 Dec 2022 05:19:44 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 content-type text/plain access-control-allow-origin https://claroty.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 4 expires Fri, 01 Jan 1990 00:00:00 GMT
OPTIONS H2	200	token cdn.linkedin.oribi.io/partner/1162802/domain/claroty.com/ Frame	0 0	52ms 7ms	Preflight	2600:9000:225e:3800:2:53b2:240:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://cdn.linkedin.oribi.io/partner/1162802/domain/claroty.com/token Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225e:3800:2:53b2:240:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software / Resource Hash Request headers Accept */* Access-Control-Request-Headers content-type Access-Control-Request-Method GET Origin https://claroty.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Response headers access-control-allow-headers content-type access-control-allow-methods GET access-control-allow-origin * access-control-max-age 1800 age 81409 allow GET, HEAD, POST, PUT, DELETE, OPTIONS, PATCH content-length 0 date Tue, 13 Dec 2022 06:42:55 GMT via 1.1 da78abc509aafffb42eec33ca2dc60d4.cloudfront.net (CloudFront) x-amz-cf-id XtO6Q6YDCaZE9zmo2BU1L-o6aGJV7VMmRYZiKyNPJWQsrg3HtbFJiA== x-amz-cf-pop FRA60-P4 x-cache Hit from cloudfront
GET H2	200	token Show response cdn.linkedin.oribi.io/partner/1162802/domain/claroty.com/	36 B 376 B	7ms 7ms	XHR application/json	2600:9000:225e:3800:2:53b2:240:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://cdn.linkedin.oribi.io/partner/1162802/domain/claroty.com/token Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225e:3800:2:53b2:240:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software / Resource Hash 7b1eaaaf180a13c29b6dddc3b0ae23333b4397e0f3c065b4c86da2f2530a5f89 Request headers Accept * Referer accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Content-Type application/json Response headers date Wed, 14 Dec 2022 00:13:58 GMT content-encoding gzip via 1.1 da78abc509aafffb42eec33ca2dc60d4.cloudfront.net (CloudFront) x-amz-cf-pop FRA60-P4 age 18345 vary accept-encoding x-cache Hit from cloudfront content-type application/json access-control-allow-origin * cache-control public, max-age=20666 x-amz-cf-id m-0Bi4mFeZUQ9fgAVtFld-4E0QGE-yCEpQPMvURomr6kjgSQIf8UKw==
GET H2	200	collect px4.ads.linkedin.com/ Redirect Chain https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1162802&time=1670995184602&url=https%3A%2F%2Fclaroty.com%2Fteam82%2Fresearch%2Fjs-on-security-off-abusing-json-based-sql-to-bypass-waf https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=1162802&time=1670995184602&url=https%3A%2F%2Fclaroty.com%2Fteam82%2Fresearch%2Fjs-on-security-off-abusing-json-based-sql-to-bypass-waf&e_ipv6=AQI...	0 266 B	138ms 107ms	Image application/javascript	13.107.42.14 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=1162802&time=1670995184602&url=https%3A%2F%2Fclaroty.com%2Fteam82%2Fresearch%2Fjs-on-security-off-abusing-json-based-sql-to-bypass-waf&e_ipv6=AQIkEgSZMU1UlAAAAYUPEwxoiy2Kl3zQvYxHNCfB_UhcV1SG0NlJXjjH8uHsl_x2jLejXjo Requested by Host: claroty.com URL: https://claroty.com/team82/research/js-on-security-off-abusing-json-based-sql-to-bypass-waf Protocol H2 Server 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Response headers date Wed, 14 Dec 2022 05:19:44 GMT x-li-pop afd-prod-lva1-x x-msedge-ref Ref A: 5082813AA6EC45C895FADC5696AE34A2 Ref B: FRAEDGE1817 Ref C: 2022-12-14T05:19:44Z linkedin-action 1 x-cache CONFIG_NOCACHE content-type application/javascript x-li-fabric prod-lva1 x-li-proto http/2 content-length 0 x-li-uuid AAXvwuJqez7+UBgRrvRpxA== Redirect headers date Wed, 14 Dec 2022 05:19:43 GMT x-li-pop afd-prod-lva1-x x-msedge-ref Ref A: A50B20745A40419291FD901C8BE03B48 Ref B: FRAEDGE2019 Ref C: 2022-12-14T05:19:44Z linkedin-action 1 x-cache CONFIG_NOCACHE x-li-fabric prod-lva1 location https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=1162802&time=1670995184602&url=https%3A%2F%2Fclaroty.com%2Fteam82%2Fresearch%2Fjs-on-security-off-abusing-json-based-sql-to-bypass-waf&e_ipv6=AQIkEgSZMU1UlAAAAYUPEwxoiy2Kl3zQvYxHNCfB_UhcV1SG0NlJXjjH8uHsl_x2jLejXjo x-li-proto http/2 content-length 0 x-li-uuid AAXvwuJoQUs8PeR0OtrFzQ==
GET H2	200	ga-audiences www.google.com/ads/	42 B 501 B	41ms 20ms	Image image/gif	2a00:1450:4001:810::2004 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j98&tid=UA-84224451-1&cid=193442435.1670995184&jid=215077916&_u=YADAAUAAAAAAACAAI~&z=1165983623 Requested by Host: claroty.com URL: https://claroty.com/team82/research/js-on-security-off-abusing-json-based-sql-to-bypass-waf Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:810::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Response headers pragma no-cache date Wed, 14 Dec 2022 05:19:44 GMT x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	ga-audiences www.google.de/ads/	42 B 501 B	42ms 21ms	Image image/gif	2a00:1450:4001:828::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j98&tid=UA-84224451-1&cid=193442435.1670995184&jid=215077916&_u=YADAAUAAAAAAACAAI~&z=1165983623 Requested by Host: claroty.com URL: https://claroty.com/team82/research/js-on-security-off-abusing-json-based-sql-to-bypass-waf Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Response headers pragma no-cache date Wed, 14 Dec 2022 05:19:44 GMT x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
POST H2	200	data Show response aorta.clickagy.com/	57 B 502 B	323ms 99ms	XHR application/json	54.156.212.180 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://aorta.clickagy.com/data Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.156.212.180 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-54-156-212-180.compute-1.amazonaws.com Software Aorta/20221212.e40ee77a0 / Resource Hash 3b272a882c6070ba57825003edd71ef9e9ba9f1945ffc9db8f37617d4d3fb6df Request headers Referer accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Content-type application/x-www-form-urlencoded Response headers date Wed, 14 Dec 2022 05:19:44 GMT content-encoding gzip server Aorta/20221212.e40ee77a0 expect 0 access-control-max-age 31536000 access-control-allow-methods POST, GET, OPTIONS content-type application/json access-control-allow-origin https://claroty.com access-control-expose-headers Set-Cookie cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true x-aorta-region us-east-1 x-aorta-host 0590cf1917ea access-control-allow-headers Origin,cache-control,content-type,man,messagetype,soapaction content-length 82
GET H2	204	usersync pixel-sync.sitescout.com/connectors/clickagy/ Redirect Chain https://aorta.clickagy.com/pixel.gif?clkgypv=jstag https://cm.g.doubleclick.net/pixel?google_nid=clickagy&google_sc&google_cm&google_hm=YzpjZGM4NjUwZjZlNDIxOWQxMDMzNjRhOTAxZjg5NjEwNQ https://cm.g.doubleclick.net/pixel?google_nid=clickagy&google_sc=&google_cm=&google_hm=YzpjZGM4NjUwZjZlNDIxOWQxMDMzNjRhOTAxZjg5NjEwNQ&google_tc= https://aorta.clickagy.com/pixel.gif?ch=8&cm=CAESEIcqx3BS-00j6S_WofVZEAg&google_cver=1 https://pixel-sync.sitescout.com/connectors/clickagy/usersync?redir=https%3A%2F%2Faorta.clickagy.com%2Fpixel.gif%3Fclkgypv%3Dpxl%26ch%3D5%26cm%3D%7BuserId%7D	0 191 B	51ms 12ms	Image text/plain	98.98.134.242 ZEN-ECN
General Check archive.org Show headers Download Go to Show image Full URL https://pixel-sync.sitescout.com/connectors/clickagy/usersync?redir=https%3A%2F%2Faorta.clickagy.com%2Fpixel.gif%3Fclkgypv%3Dpxl%26ch%3D5%26cm%3D%7BuserId%7D Requested by Host: claroty.com URL: https://claroty.com/team82/research/js-on-security-off-abusing-json-based-sql-to-bypass-waf Protocol H2 Server 98.98.134.242 , United States, ASN21859 (ZEN-ECN, US), Reverse DNS Software AC1.1 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Response headers p3p CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml" pragma no-cache date Wed, 14 Dec 2022 05:19:44 GMT cache-control max-age=0,no-cache,no-store server AC1.1 expires Tue, 11 Oct 1977 12:34:56 GMT Redirect headers date Wed, 14 Dec 2022 05:19:45 GMT server Aorta/20221212.e40ee77a0 expect 0 access-control-max-age 31536000 access-control-allow-methods POST, GET, OPTIONS content-type application/json location https://pixel-sync.sitescout.com/connectors/clickagy/usersync?redir=https%3A%2F%2Faorta.clickagy.com%2Fpixel.gif%3Fclkgypv%3Dpxl%26ch%3D5%26cm%3D%7BuserId%7D access-control-allow-origin access-control-expose-headers Set-Cookie cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true x-aorta-region us-east-1 x-aorta-host cff0e88d4299 access-control-allow-headers Origin,cache-control,content-type,man,messagetype,soapaction content-length 0
GET H2	451	711861.gif id.rlcdn.com/ Redirect Chain https://aorta.clickagy.com/liveramp_redir https://id.rlcdn.com/711861.gif	0 98 B	61ms 15ms	Image text/plain	35.244.174.68 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://id.rlcdn.com/711861.gif Requested by Host: claroty.com URL: https://claroty.com/team82/research/js-on-security-off-abusing-json-based-sql-to-bypass-waf Protocol H2 Server 35.244.174.68 Kansas City, United States, ASN15169 (GOOGLE, US), Reverse DNS 68.174.244.35.bc.googleusercontent.com Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Response headers date Wed, 14 Dec 2022 05:19:45 GMT via 1.1 google alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 0 Redirect headers date Wed, 14 Dec 2022 05:19:44 GMT server Aorta/20221212.e40ee77a0 expect 0 access-control-max-age 31536000 access-control-allow-methods POST, GET, OPTIONS content-type application/json location https://id.rlcdn.com/711861.gif access-control-allow-origin access-control-expose-headers Set-Cookie cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true x-aorta-region us-east-1 x-aorta-host f7dc472ddc68 access-control-allow-headers Origin,cache-control,content-type,man,messagetype,soapaction content-length 0
GET H2	200	json Show response forms.hubspot.com/collected-forms/v1/config/	116 B 1022 B	155ms 130ms	XHR application/json	2606:4700::6813:9b53 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://forms.hubspot.com/collected-forms/v1/config/json?portalId=20307279&utk= Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6813:9b53 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 943ded0a2adddb140465921e9f3a050f1fb064974efebe3ef311e9e75b6a2fa5 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers Accept application/json, text/plain, */* Referer accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Response headers date Wed, 14 Dec 2022 05:19:44 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-encoding br cf-cache-status DYNAMIC nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} x-hubspot-correlation-id 72cbaf39-f2ba-4702-a88b-17ef3b8641c0 alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 server cloudflare vary origin access-control-allow-methods GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD content-type application/json;charset=utf-8 access-control-allow-origin https://claroty.com report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6L9gimvdTNxnvyGZQB7BC9QWh9W1PLiCgMi5AMIkB8z%2Fg5WPd1%2FObsCB8brFyvdqobIKtyq63MlfZJFbEWTKPB4xKcMBj32IG3J0y%2Fkfmt7y%2BP%2BRXvJWGwNOmj7PP9CsUAnC%2FkVD2mD7NVchW3Ro"}],"group":"cf-nel","max_age":604800} access-control-max-age 180 access-control-allow-credentials false x-robots-tag none access-control-allow-headers * cf-ray 77947c80abb891fc-FRA
GET H2	200	hasHashes Show response hemsync.clickagy.com/external/	2 B 323 B	320ms 97ms	XHR text/plain	34.198.103.136 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://hemsync.clickagy.com/external/hasHashes?clkgypv=jstag&cb=null Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.198.103.136 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-198-103-136.compute-1.amazonaws.com Software / Resource Hash 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Response headers date Wed, 14 Dec 2022 05:19:45 GMT content-encoding gzip vary origin content-type text/plain; charset=utf-8 access-control-allow-origin https://claroty.com access-control-expose-headers content-length, last-modified, expires, content-type access-control-allow-credentials true content-length 28
GET H2	200	json Show response api.hubapi.com/hs-script-loader-public/v1/config/pixel/	132 B 866 B	158ms 142ms	XHR application/json	2606:4700::6811:c8cc CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://api.hubapi.com/hs-script-loader-public/v1/config/pixel/json?portalId=20307279 Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:c8cc , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 5bbfa051c9c86d3a7696d8abcfbb8ce0c82db5853a9f637dfe2ba58030d4a4c2 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Response headers date Wed, 14 Dec 2022 05:19:44 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-encoding br cf-cache-status DYNAMIC nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} x-hubspot-correlation-id 86f66826-a7cb-462f-88d1-ab51ba623c3b alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 server cloudflare x-trace 2B5F388D72663E74304DA81CA46C43C10C55B63835000000000000000000 vary origin, Accept-Encoding access-control-allow-methods GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD content-type application/json;charset=utf-8 access-control-allow-origin https://claroty.com report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Sv4unqvG4wGsm4hxhvzaH5cCS2p6yb8lPiG1vexc%2FrCYLGNseP5BdJEvTT9Sk%2F0TH4cZMwCM9XO1s%2FEtC0ewLYG96D69UHlu3iA2%2B%2FcJdZFgkQdnHHOtKvX7o9EzE3Tzheb9QJMMlu8pZjNu"}],"group":"cf-nel","max_age":604800} access-control-max-age 180 access-control-allow-credentials false cf-ray 77947c816ae79b57-FRA access-control-allow-headers *
GET H2	200	claroty.com.json Show response script.crazyegg.com/pages/data-scripts/0111/6563/site/ Frame 9F71	4 KB 2 KB	41ms 25ms	XHR application/json	2606:4700::6813:9408 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://script.crazyegg.com/pages/data-scripts/0111/6563/site/claroty.com.json?t=1 Requested by Host: script.crazyegg.com URL: https://script.crazyegg.com/pages/scripts/0111/6563.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6813:9408 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash f14bfc41aeca5b792ddb8e30a90994a592ed0be31640d235d2b8f206f3b50bf5 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Response headers date Wed, 14 Dec 2022 05:19:44 GMT content-encoding gzip cf-cache-status HIT age 30250 ce-version 11.5.9 content-length 1549 last-modified Tue, 13 Dec 2022 20:55:34 GMT server cloudflare vary Accept-Encoding content-type application/json access-control-allow-origin * access-control-expose-headers CE-Version cache-control public, max-age=300, s-maxage=1209600 accept-ranges bytes timing-allow-origin * cf-ray 77947c81fe8c9c01-FRA
GET H2	200	051214b1ee034dc81c1493c28aa557bd.js Show response script.crazyegg.com/pages/versioned/common-scripts/	77 KB 26 KB	19ms 19ms	Script text/javascript	2606:4700::6813:9408 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://script.crazyegg.com/pages/versioned/common-scripts/051214b1ee034dc81c1493c28aa557bd.js Requested by Host: script.crazyegg.com URL: https://script.crazyegg.com/pages/scripts/0111/6563.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6813:9408 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 24d256e41daf93aa8f841558593376434d6f1ba705376eb33d2e34ad6fea5d27 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Response headers date Wed, 14 Dec 2022 05:19:44 GMT content-encoding gzip cf-cache-status HIT last-modified Fri, 18 Nov 2022 16:53:01 GMT server cloudflare age 36710 vary Accept-Encoding content-type text/javascript access-control-allow-origin * cache-control public, max-age=31536000, s-maxage=31536000 accept-ranges bytes timing-allow-origin * cf-ray 77947c822c1d92a8-FRA content-length 26836
GET H3	200	js Show response www.googletagmanager.com/gtag/	135 KB 52 KB	22ms 21ms	Script application/javascript	2a00:1450:4001:828::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=AW-704543109 Requested by Host: js.hsadspixel.net URL: https://js.hsadspixel.net/fb.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:828::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 8637f4a072b25822111d87deca552c4edf4e89569451ad6a5c34fcec2ab0320b Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Response headers date Wed, 14 Dec 2022 05:19:45 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 52881 x-xss-protection 0 last-modified Wed, 14 Dec 2022 03:00:00 GMT server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Wed, 14 Dec 2022 05:19:45 GMT
GET H3	200	js Show response www.googletagmanager.com/gtag/	135 KB 52 KB	24ms 21ms	Script application/javascript	2a00:1450:4001:828::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=AW-704543109&l=dataLayer&cx=c Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=UA-23917942-3 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:828::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 03b606d82badbfcc75f985edc40d6abe52bdf4e26865e8f5e8b1cf2af9faaeba Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Response headers date Wed, 14 Dec 2022 05:19:45 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 52912 x-xss-protection 0 last-modified Wed, 14 Dec 2022 03:00:00 GMT server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Wed, 14 Dec 2022 05:19:45 GMT
OPTIONS H2	200	token cdn.linkedin.oribi.io/partner/1126090,1162802/domain/claroty.com/ Frame	0 0	7ms 7ms	Preflight	2600:9000:225e:3800:2:53b2:240:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://cdn.linkedin.oribi.io/partner/1126090,1162802/domain/claroty.com/token Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225e:3800:2:53b2:240:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software / Resource Hash Request headers Accept */* Access-Control-Request-Headers content-type Access-Control-Request-Method GET Origin https://claroty.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Response headers access-control-allow-headers content-type access-control-allow-methods GET access-control-allow-origin * access-control-max-age 1800 age 8947 allow GET, HEAD, POST, PUT, DELETE, OPTIONS, PATCH content-length 0 date Wed, 14 Dec 2022 02:50:38 GMT via 1.1 da78abc509aafffb42eec33ca2dc60d4.cloudfront.net (CloudFront) x-amz-cf-id zpAXoRzUrIbOJcTHlvbcvEFqXGdJrTxfZsy7OoQzN9jHoFwXPtx5yg== x-amz-cf-pop FRA60-P4 x-cache Hit from cloudfront
GET H2	200	token Show response cdn.linkedin.oribi.io/partner/1126090,1162802/domain/claroty.com/	36 B 375 B	8ms 7ms	XHR application/json	2600:9000:225e:3800:2:53b2:240:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://cdn.linkedin.oribi.io/partner/1126090,1162802/domain/claroty.com/token Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225e:3800:2:53b2:240:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software / Resource Hash 7b1eaaaf180a13c29b6dddc3b0ae23333b4397e0f3c065b4c86da2f2530a5f89 Request headers Accept * Referer accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Content-Type application/json Response headers date Wed, 14 Dec 2022 04:57:21 GMT content-encoding gzip via 1.1 da78abc509aafffb42eec33ca2dc60d4.cloudfront.net (CloudFront) x-amz-cf-pop FRA60-P4 age 1344 vary accept-encoding x-cache Hit from cloudfront content-type application/json access-control-allow-origin * cache-control public, max-age=3600 x-amz-cf-id R1bpwpHpSYjK9HRE4ZxI8cpKGFUbT0HsGPqa1zX5lQC-nhwydmXg-g==
GET H2	200	claroty.com.json Show response script.crazyegg.com/pages/data-scripts/0111/6563/sampling/ Frame 9F71	156 B 256 B	17ms 17ms	XHR application/json	2606:4700::6813:9408 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://script.crazyegg.com/pages/data-scripts/0111/6563/sampling/claroty.com.json?t=464165 Requested by Host: script.crazyegg.com URL: https://script.crazyegg.com/pages/versioned/common-scripts/051214b1ee034dc81c1493c28aa557bd.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6813:9408 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 232c7c3c0e6edf726bd3b06cf7ee4dbba50af11e6b131e8b95eee7b26f176d91 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Response headers date Wed, 14 Dec 2022 05:19:45 GMT content-encoding gzip cf-cache-status HIT age 30250 ce-version 11.5.9 content-length 145 last-modified Tue, 13 Dec 2022 20:55:35 GMT server cloudflare vary Accept-Encoding content-type application/json access-control-allow-origin * access-control-expose-headers CE-Version cache-control public, max-age=300, s-maxage=1209600 accept-ranges bytes timing-allow-origin * cf-ray 77947c82bfdc9c01-FRA
GET H2	200	/ Show response googleads.g.doubleclick.net/pagead/viewthroughconversion/704543109/	2 KB 2 KB	45ms 24ms	Script text/javascript	2a00:1450:4001:806::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/pagead/viewthroughconversion/704543109/?random=1670995185082&cv=11&fst=1670995185082&bg=ffffff&guid=ON&async=1&gtm=2oabu0&u_w=1600&u_h=1200&hn=www.googleadservices.com&frm=0&url=https%3A%2F%2Fclaroty.com%2Fteam82%2Fresearch%2Fjs-on-security-off-abusing-json-based-sql-to-bypass-waf&tiba=%7BJS-ON%3A%20Security-OFF%7D%3A%20Abusing%20JSON-Based%20SQL%20to%20Bypass%20WAF%20%7C%20Claroty&did=dZTQ1Zm&gdid=dZTQ1Zm&auid=446965719.1670995185&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=AW-704543109 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 75238ace69fce54e29b9fb67c945efbf9c2a55d7e7f6882b5d996dfe83811ee5 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Response headers pragma no-cache date Wed, 14 Dec 2022 05:19:45 GMT content-encoding br x-content-type-options nosniff server cafe content-type text/javascript; charset=UTF-8 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 967 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	healthcheck Show response pagestates-tracking.crazyegg.com/ Frame 9F71	19 B 463 B	44ms 7ms	XHR application/json	18.66.97.4 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://pagestates-tracking.crazyegg.com/healthcheck Requested by Host: script.crazyegg.com URL: https://script.crazyegg.com/pages/versioned/common-scripts/051214b1ee034dc81c1493c28aa557bd.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.97.4 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-97-4.fra56.r.cloudfront.net Software AmazonS3 / Resource Hash 830e67bda2532cd5880ee86e3b33e69721082f8458bb0df0cd4edbb1577fd375 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Response headers date Mon, 11 Jul 2022 15:00:41 GMT via 1.1 0baa339c02d06988c65d8623d1b3c6ec.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P2 age 13443545 x-cache Hit from cloudfront content-length 19 last-modified Fri, 08 Jul 2022 22:25:51 GMT server AmazonS3 etag "d06f04fccf68d0b228a5923187ce1afd" access-control-max-age 31536000 access-control-allow-methods GET, HEAD content-type application/json access-control-allow-origin * access-control-expose-headers Access-Control-Allow-Origin accept-ranges bytes x-amz-cf-id u_t3fiJUxtvSZm6RRDkYoZw65pSbP-R_BZJ63wHrZ_D6p5xBurYtgg==
GET H2	200	healthcheck Show response assets-tracking.crazyegg.com/ Frame 9F71	19 B 388 B	43ms 6ms	XHR application/json	18.66.122.72 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://assets-tracking.crazyegg.com/healthcheck Requested by Host: script.crazyegg.com URL: https://script.crazyegg.com/pages/versioned/common-scripts/051214b1ee034dc81c1493c28aa557bd.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.122.72 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-122-72.fra60.r.cloudfront.net Software AmazonS3 / Resource Hash 830e67bda2532cd5880ee86e3b33e69721082f8458bb0df0cd4edbb1577fd375 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Response headers date Sat, 05 Nov 2022 03:10:02 GMT via 1.1 3072267d18c4d0ed9e535752800364e0.cloudfront.net (CloudFront) last-modified Fri, 08 Jul 2022 22:25:51 GMT server AmazonS3 x-amz-cf-pop FRA60-P2 age 3377384 etag "d06f04fccf68d0b228a5923187ce1afd" x-cache Hit from cloudfront content-type application/json access-control-allow-origin * access-control-expose-headers * accept-ranges bytes content-length 19 x-amz-cf-id zzsy8p41QKpCpWkf75usPg5pGJ9KjrE4BFN_lBTiYdJXm7F_A_Pd9g==
GET BLOB	200 OK	8d0465be-9257-4833-822b-0fb853c5e05c https://claroty.com/	45 B 0		Other text/javascript
General Check archive.org Show headers Download Go to Full URL blob:https://claroty.com/8d0465be-9257-4833-822b-0fb853c5e05c Requested by Host: claroty.com URL: https://claroty.com/team82/research/js-on-security-off-abusing-json-based-sql-to-bypass-waf Protocol BLOB Server -, , ASN (), Reverse DNS Software / Resource Hash 86551808dbfbf8bc9b23ab3d0725794c2e1f2b4265c96715f2945638160edc2b Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Response headers Content-Length 45 Content-Type text/javascript
GET H3	200	/ www.google.com/pagead/1p-user-list/704543109/	42 B 64 B	37ms 21ms	Image image/gif	2a00:1450:4001:810::2004 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/pagead/1p-user-list/704543109/?random=1670995185082&cv=11&fst=1670994000000&bg=ffffff&guid=ON&async=1&gtm=2oabu0&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Fclaroty.com%2Fteam82%2Fresearch%2Fjs-on-security-off-abusing-json-based-sql-to-bypass-waf&tiba=%7BJS-ON%3A%20Security-OFF%7D%3A%20Abusing%20JSON-Based%20SQL%20to%20Bypass%20WAF%20%7C%20Claroty&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=1741884516&rmt_tld=0&ipr=y Requested by Host: claroty.com URL: https://claroty.com/team82/research/js-on-security-off-abusing-json-based-sql-to-bypass-waf Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:810::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Response headers pragma no-cache date Wed, 14 Dec 2022 05:19:45 GMT content-security-policy script-src 'none'; object-src 'none' x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3	200	/ www.google.de/pagead/1p-user-list/704543109/	42 B 64 B	35ms 19ms	Image image/gif	2a00:1450:4001:828::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/pagead/1p-user-list/704543109/?random=1670995185082&cv=11&fst=1670994000000&bg=ffffff&guid=ON&async=1&gtm=2oabu0&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Fclaroty.com%2Fteam82%2Fresearch%2Fjs-on-security-off-abusing-json-based-sql-to-bypass-waf&tiba=%7BJS-ON%3A%20Security-OFF%7D%3A%20Abusing%20JSON-Based%20SQL%20to%20Bypass%20WAF%20%7C%20Claroty&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=1741884516&rmt_tld=1&ipr=y Requested by Host: claroty.com URL: https://claroty.com/team82/research/js-on-security-off-abusing-json-based-sql-to-bypass-waf Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Response headers pragma no-cache date Wed, 14 Dec 2022 05:19:45 GMT content-security-policy script-src 'none'; object-src 'none' x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	clock Show response tracking.crazyegg.com/ Frame 9F71	28 B 135 B	126ms 52ms	XHR text/plain	185.48.121.228 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://tracking.crazyegg.com/clock?t=1670995185164&tk=undefined Requested by Host: script.crazyegg.com URL: https://script.crazyegg.com/pages/versioned/common-scripts/051214b1ee034dc81c1493c28aa557bd.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 185.48.121.228 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-185-48-121-228.eu-west-1.compute.amazonaws.com Software awselb/2.0 / Resource Hash 46caec47ae2618137d46228494fb841d8b5d6cb90617d3632dca7d19d09a05fc Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Response headers access-control-allow-origin * date Wed, 14 Dec 2022 05:19:45 GMT cache-control no-store server awselb/2.0 content-length 28 content-type text/plain
GET H/1.1	200 OK	pd.js Show response pi.pardot.com/	5 KB 2 KB	339ms 98ms	Script application/javascript	3.215.172.219 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://pi.pardot.com/pd.js Requested by Host: claroty.com URL: https://claroty.com/team82/research/js-on-security-off-abusing-json-based-sql-to-bypass-waf Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 3.215.172.219 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-3-215-172-219.compute-1.amazonaws.com Software PardotServer / Resource Hash 3b91e6a4b14493d67f9660e6d4a2e27c1eea54d97ccb7c30acf3b89998b3be99 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Response headers Date Wed, 14 Dec 2022 05:19:45 GMT content-encoding gzip X-Pardot-Route 16b0ab393667a33fe86adedc3141e88c last-modified Tue, 13 Dec 2022 17:36:11 GMT Server PardotServer etag "1547-gzip" vary Accept-Encoding,User-Agent Content-Type application/javascript cache-control max-age=63072000 Connection keep-alive accept-ranges bytes Content-Length 1946 expires Fri, 13 Dec 2024 05:19:45 GMT
GET H2	200	__ptq.gif track.hubspot.com/	45 B 898 B	152ms 136ms	Image image/gif	2606:4700::6813:9a53 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://track.hubspot.com/__ptq.gif?k=1&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=1375660896&v=1.1&a=20307279&rcu=https%3A%2F%2Fclaroty.com%2Fteam82%2Fresearch%2Fjs-on-security-off-abusing-json-based-sql-to-bypass-waf&pu=https%3A%2F%2Fclaroty.com%2Fteam82%2Fresearch%2Fjs-on-security-off-abusing-json-based-sql-to-bypass-waf&t=%7BJS-ON%3A+Security-OFF%7D%3A+Abusing+JSON-Based+SQL+to+Bypass+WAF+%7C+Claroty&cts=1670995185277&vi=04f03ae85ca0eee32b7f3bfdc7f01c7f&nc=true&u=125082197.04f03ae85ca0eee32b7f3bfdc7f01c7f.1670995185275.1670995185275.1670995185275.1&b=125082197.1.1670995185275&cc=15 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6813:9a53 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Response headers date Wed, 14 Dec 2022 05:19:45 GMT strict-transport-security max-age=31536000; includeSubDomains; preload cf-cache-status DYNAMIC nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} x-hubspot-correlation-id 8baca788-55a9-4cba-bb6b-ab93f2528181 p3p CP="NOI CUR ADM OUR NOR STA NID" alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 45 server cloudflare vary origin, Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SMYO6VE7vOOgHdi0Z5ZxgMMoVQt%2F87kaeZEMpDekprhcpYUdw5%2FB2x3wYnfeHxv2WnG79cC0XtkwktdVJ4Wq1%2BhIeordmZprSQIscsBo%2Fwxlg7pVUR3DYEgAgVfgRSXBv2xaYTyFQXghCf%2BCxXph"}],"group":"cf-nel","max_age":604800} content-type image/gif cache-control no-cache, no-store, no-transform access-control-allow-credentials false cf-ray 77947c841e375be5-FRA x-robots-tag none
GET BLOB	200 OK	ea4dd437-6d3b-4b69-8f84-474440931dab https://claroty.com/	241 B 0		Other text/javascript
General Check archive.org Show headers Download Go to Full URL blob:https://claroty.com/ea4dd437-6d3b-4b69-8f84-474440931dab Protocol BLOB Server -, , ASN (), Reverse DNS Software / Resource Hash d3b4ddb98df7288a34fcb65b2345c4f441a26d7f52beb7dd0b83c9cff3910a54 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Response headers Content-Length 241 Content-Type text/javascript
GET H/1.1	200 OK	messenger Show response app.qualified.com/w/1/PaboXyMA4piyRkBp/ Frame F1F3	5 KB 2 KB	365ms 119ms	Document text/html	34.226.2.205 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://app.qualified.com/w/1/PaboXyMA4piyRkBp/messenger?uuid=59511085-a416-4e91-a8a4-c61a19eff1e1 Requested by Host: js.qualified.com URL: https://js.qualified.com/qualified.js?token=PaboXyMA4piyRkBp Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 34.226.2.205 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-226-2-205.compute-1.amazonaws.com Software nginx / Resource Hash b44df10f91f26c68a841d74bfffc123c5b960e12fa5076ba4f32a448fd12bfe9 Security Headers Name Value Content-Security-Policy Strict-Transport-Security max-age=63072000; includeSubDomains X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Cache-Control max-age=0, private, must-revalidate Content-Encoding gzip Content-Length 1537 Content-Security-Policy Content-Type text/html; charset=utf-8 Date Wed, 14 Dec 2022 05:19:45 GMT Etag W/"b44df10f91f26c68a841d74bfffc123c" Link <https://assets.qualified.com/packs/css/6-37427f7c.chunk.css>; rel=preload; as=style; nopush,<https://assets.qualified.com/packs/css/widget/sandboxed/messenger-94c2122d.chunk.css>; rel=preload; as=style; nopush Referrer-Policy strict-origin-when-cross-origin Server nginx Strict-Transport-Security max-age=63072000; includeSubDomains Vary Accept-Encoding Via 1.1 spaces-router (e13668ca8eb7) X-Content-Type-Options nosniff X-Download-Options noopen X-Permitted-Cross-Domain-Policies none X-Request-Id a2cab738-116c-a922-9fff-4b6ebcbb354f X-Runtime 0.015874 X-Xss-Protection 1; mode=block
GET H/1.1	200 OK	dc.js Show response security.claroty.com/dcjs/902751/547/	46 B 588 B	395ms 170ms	Script text/javascript	18.208.125.13 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://security.claroty.com/dcjs/902751/547/dc.js Requested by Host: js.qualified.com URL: https://js.qualified.com/qualified.js?token=PaboXyMA4piyRkBp Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 18.208.125.13 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-18-208-125-13.compute-1.amazonaws.com Software PardotServer / Resource Hash 7bba17b490076798f613f9b01da8d6a2eb79808ae687d3e56543ba95fff3b16c Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Response headers pragma no-cache Date Wed, 14 Dec 2022 05:19:45 GMT X-Pardot-Route e8229a0ff18ebffc83a98010d2521dd5 x-pardot-rsp 0/0/1 Server PardotServer vary User-Agent Content-Type text/javascript; charset=utf-8 p3p CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT", policyref="/w3c/p3p.xml" cache-control no-store, no-cache, must-revalidate Connection keep-alive Content-Length 46 expires Thu, 19 Nov 1981 08:52:00 GMT
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 493 B	266ms 266ms	Image image/gif	184.24.7.242 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=1a8619a294ad37fe81fcb7766ed37dc1&svisitor=null&visitor=ed5363f0-7b01-4ffc-8c71-8e288313d01e&session=2d337936-4281-47f8-8087-75bbdb0593df&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2014%20Dec%202022%2005%3A19%3A45%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2014%20Dec%202022%2005%3A19%3A44%20GMT%22%2C%22timeSpent%22%3A%221042%22%2C%22totalTimeSpent%22%3A%221042%22%7D&isIframe=false&m=%7B%22description%22%3A%22Team82%20developed%20a%20generic%20web%20application%20firewall%20bypass%20that%20exploits%20a%20lack%20of%20JSON%20syntax%20support%20in%20leading%20vendors%27%20SQL%20injection%20inspection%20process.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22%7BJS-ON%3A%20Security-OFF%7D%3A%20Abusing%20JSON-Based%20SQL%20to%20Bypass%20WAF%20%7C%20Claroty%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fclaroty.com%2Fteam82%2Fresearch%2Fjs-on-security-off-abusing-json-based-sql-to-bypass-waf&pageViewId=b6218204-ff75-4244-85fd-c88be5b2554d&an_uid=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 184.24.7.242 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a184-24-7-242.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Response headers date Wed, 14 Dec 2022 05:19:45 GMT x-content-type-options nosniff content-length 43 pragma no-cache last-modified Tue, 05 Oct 2021 22:17:52 GMT server nginx/1.14.0 (Ubuntu) etag "615ccf10-2b" access-control-max-age 86400 access-control-allow-methods GET,POST content-type image/gif access-control-allow-origin cache-control private, no-cache, no-cache=Set-Cookie, proxy-revalidate access-control-allow-credentials true accept-ranges bytes access-control-allow-headers * expires Wed, 19 Apr 2000 11:43:00 GMT
GET H/1.1	200 OK	analytics Show response pi.pardot.com/	2 KB 1 KB	174ms 172ms	Script text/javascript	3.215.172.219 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://pi.pardot.com/analytics?ver=3&visitor_id=&visitor_id_sign=&pi_opt_in=&campaign_id=5725&account_id=903751&title=%7BJS-ON%3A%20Security-OFF%7D%3A%20Abusing%20JSON-Based%20SQL%20to%20Bypass%20WAF%20%7C%20Claroty&url=https%3A%2F%2Fclaroty.com%2Fteam82%2Fresearch%2Fjs-on-security-off-abusing-json-based-sql-to-bypass-waf&referrer= Requested by Host: pi.pardot.com URL: https://pi.pardot.com/pd.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 3.215.172.219 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-3-215-172-219.compute-1.amazonaws.com Software PardotServer / Resource Hash d7f0006485c76d46fc1a153846bbeb395302a26f20488094c935cdf55eb3c81e Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Response headers pragma no-cache Date Wed, 14 Dec 2022 05:19:45 GMT strict-transport-security max-age=31536000; includeSubDomains content-encoding gzip X-Pardot-Route 9b06e8e2308c32c7bf9ba8adfb7be2e1 x-pardot-rsp 0/0/1 Server PardotServer vary Accept-Encoding,User-Agent Content-Type text/javascript; charset=utf-8 p3p CP="CAO DSP AND SO ON" policyref="/w3c/p3p.xml", CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT", policyref="/w3c/p3p.xml" cache-control no-store, no-cache, must-revalidate Connection keep-alive Content-Length 725 expires Thu, 19 Nov 1981 08:52:00 GMT
GET H2	200	6-37427f7c.chunk.css assets.qualified.com/packs/css/ Frame F1F3	35 KB 7 KB	41ms 31ms	Stylesheet text/css	2606:4700::6812:1105 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://assets.qualified.com/packs/css/6-37427f7c.chunk.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:1105 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6a07ba6298a82984a8c4fe8b19c118b16c7fdeb8e60519738e6c91e02f496fc6 Request headers accept-language de-DE,de;q=0.9 Referer https://app.qualified.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Response headers date Wed, 14 Dec 2022 05:19:45 GMT x-amz-version-id 5SOdMND4XkI4ePv.xYfVa0PR.hqQa3CK content-encoding gzip cf-cache-status HIT last-modified Mon, 12 Dec 2022 20:54:01 GMT server cloudflare x-amz-request-id 1RAAKBBVR2NKF72J age 4504 etag W/"02e82a000181a6edf9321b244dc6ce82" vary Accept-Encoding content-type text/css cache-control public, max-age=14400 cf-ray 77947c87af4a9b9e-FRA x-amz-id-2 RedthO4bg1M6No3lHwwAadg9Gka/a0jNeEwy6vDftPpN0VKkf/tjTN8bYEbUppDjbihAp18po5Y= expires Wed, 14 Dec 2022 09:19:45 GMT
GET H2	200	messenger-94c2122d.chunk.css assets.qualified.com/packs/css/widget/sandboxed/ Frame F1F3	5 KB 1 KB	40ms 30ms	Stylesheet text/css	2606:4700::6812:1105 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://assets.qualified.com/packs/css/widget/sandboxed/messenger-94c2122d.chunk.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:1105 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6ec35ab99388f6afab345622a22772619b83b7d63705d98df3c404da782fcabb Request headers accept-language de-DE,de;q=0.9 Referer https://app.qualified.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Response headers date Wed, 14 Dec 2022 05:19:45 GMT x-amz-version-id LXH4ULc1J7HkXTuPsGuM3gUpD83ojdTD content-encoding gzip cf-cache-status HIT last-modified Mon, 12 Dec 2022 20:54:01 GMT server cloudflare x-amz-request-id 1RA0TBKGD0CMD5PP age 4504 etag W/"22d5f23e695250d3c5a5b1e76a015c5e" vary Accept-Encoding content-type text/css cache-control public, max-age=14400 cf-ray 77947c87af4d9b9e-FRA x-amz-id-2 RHNrOET95E9iFWUG+bxitA6iLJTzAikSmUQOGuppj2Jh3ryIcrBbYKhKPbOinBiq0YhVOvvXpHI= expires Wed, 14 Dec 2022 09:19:45 GMT
GET H2	200	messenger~runtime-9cf503f5a2a9ddfa01b0.js Show response assets.qualified.com/packs/js/widget/sandboxed/ Frame F1F3	2 KB 1 KB	45ms 43ms	Script application/javascript	2606:4700::6812:1105 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://assets.qualified.com/packs/js/widget/sandboxed/messenger~runtime-9cf503f5a2a9ddfa01b0.js Requested by Host: app.qualified.com URL: https://app.qualified.com/w/1/PaboXyMA4piyRkBp/messenger?uuid=59511085-a416-4e91-a8a4-c61a19eff1e1 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:1105 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 1290021284086aced3b7e79e8ecb17ae11e54e75cacc618220021dad21e72c34 Request headers accept-language de-DE,de;q=0.9 Referer https://app.qualified.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Response headers date Wed, 14 Dec 2022 05:19:45 GMT x-amz-version-id Xa0u2AVVZVGcNv_4IzJmEl4loGVOuPi1 content-encoding gzip cf-cache-status HIT last-modified Mon, 12 Dec 2022 20:51:13 GMT server cloudflare x-amz-request-id VGV6FH1ATCN6YFSV age 4504 etag W/"ae3c09c062ad8781f1ac4242e389056a" vary Accept-Encoding content-type application/javascript cache-control public, max-age=14400 cf-ray 77947c87af4f9b9e-FRA x-amz-id-2 aC0okHhae9FOocCzC07JOFe70oeU+ad4P1pvB5DO6Ns6SFys4NQuSuKFXKpgC/k9IO7RjgDlRoc= expires Wed, 14 Dec 2022 09:19:45 GMT
GET H2	200	6-ef20632702203042e41c.chunk.js Show response assets.qualified.com/packs/js/widget-sandboxed-chunks/ Frame F1F3	1 MB 409 KB	35ms 34ms	Script application/javascript	2606:4700::6812:1105 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://assets.qualified.com/packs/js/widget-sandboxed-chunks/6-ef20632702203042e41c.chunk.js Requested by Host: app.qualified.com URL: https://app.qualified.com/w/1/PaboXyMA4piyRkBp/messenger?uuid=59511085-a416-4e91-a8a4-c61a19eff1e1 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:1105 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 808bb0fe940cca41a0c1c4985e272d1b9e8ec1cfb041c359e131d2b76160cf22 Request headers accept-language de-DE,de;q=0.9 Referer https://app.qualified.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Response headers date Wed, 14 Dec 2022 05:19:45 GMT x-amz-version-id DTu.D_CJyH9UYU0KJIanauiZ6nfl5vCL content-encoding gzip cf-cache-status HIT last-modified Mon, 12 Dec 2022 20:51:13 GMT server cloudflare x-amz-request-id VGV61WPZZW9KJV1T age 4449 etag W/"8e4ba90b37d1d523a239a2e34c58412d" vary Accept-Encoding content-type application/javascript cache-control public, max-age=14400 cf-ray 77947c87af509b9e-FRA x-amz-id-2 P2xE+E/nwBYixtZ1hXC/V+521gc7+6bBOmf3GxsaON7DiCKfyQJq1surrEzgHmDmyBLzWs/hSuE= expires Wed, 14 Dec 2022 09:19:45 GMT
GET H2	200	messenger-905a6114975e2559c3a0.chunk.js Show response assets.qualified.com/packs/js/widget-sandboxed-chunks/widget/sandboxed/ Frame F1F3	575 KB 140 KB	52ms 52ms	Script application/javascript	2606:4700::6812:1105 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://assets.qualified.com/packs/js/widget-sandboxed-chunks/widget/sandboxed/messenger-905a6114975e2559c3a0.chunk.js Requested by Host: app.qualified.com URL: https://app.qualified.com/w/1/PaboXyMA4piyRkBp/messenger?uuid=59511085-a416-4e91-a8a4-c61a19eff1e1 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:1105 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 8a12bf85dd6f79cf316785210927d18f55fd9208898ef1e091aaf75ab9bebf45 Request headers accept-language de-DE,de;q=0.9 Referer https://app.qualified.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Response headers date Wed, 14 Dec 2022 05:19:45 GMT x-amz-version-id jm9LGGW6IiebpSO5XAg_Mv2wqy.BX4_Q content-encoding gzip cf-cache-status HIT last-modified Mon, 12 Dec 2022 20:54:02 GMT server cloudflare x-amz-request-id EMNM3NCBVJ82PK6F age 4504 etag W/"04ade399b7e4fb3cf2ef2cf8823a6501" vary Accept-Encoding content-type application/javascript cache-control public, max-age=14400 cf-ray 77947c87df9b9b9e-FRA x-amz-id-2 AVes3a7hLPBuGmYdkCuIQ108cXmym930G7kThktbWT1E8dsNSxL03uPdVBULFuHfgZ0aVBNWppvn5XZ31pKm3A== expires Wed, 14 Dec 2022 09:19:45 GMT
GET H2	200	Inter-Regular-c8ba52b05a9ef10f47584d08ece2ec5c.woff2 assets.qualified.com/packs/media/fonts/inter/ Frame F1F3	97 KB 97 KB	50ms 30ms	Font font/woff2	2606:4700::6812:1105 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://assets.qualified.com/packs/media/fonts/inter/Inter-Regular-c8ba52b05a9ef10f47584d08ece2ec5c.woff2 Requested by Host: app.qualified.com URL: https://app.qualified.com/w/1/PaboXyMA4piyRkBp/messenger?uuid=59511085-a416-4e91-a8a4-c61a19eff1e1 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:1105 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash d612f1212b452af07f1a5defb2b672e76a91f7139e7499fa48bb9b2b985c22d6 Request headers Referer https://app.qualified.com/ Origin https://app.qualified.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Response headers date Wed, 14 Dec 2022 05:19:45 GMT x-amz-version-id Ts0p7fbKsZIFu_VEk6HOvm9iYpTRKuos cf-cache-status HIT x-amz-request-id 41Z3KJK24K5VH2VW age 444974 content-length 98868 x-amz-id-2 Ta7QduaUx53oJBC61pF3hnNKwZ0PRiLBlPs9GI8HcAGX1x9nffwkEv3HAik928cdZO2VmzvSgxE= last-modified Thu, 08 Dec 2022 23:17:25 GMT server cloudflare etag "dc131113894217b5031000575d9de002" access-control-max-age 3600 access-control-allow-methods GET content-type font/woff2 access-control-allow-origin * vary Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding cache-control public, max-age=31557600 accept-ranges bytes cf-ray 77947c87ccf491e7-FRA expires Thu, 14 Dec 2023 11:19:45 GMT
GET H2	200	Inter-SemiBold-b5f0f109bc88052d4000c58ca615671d.woff2 assets.qualified.com/packs/media/fonts/inter/ Frame F1F3	103 KB 104 KB	58ms 37ms	Font font/woff2	2606:4700::6812:1105 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://assets.qualified.com/packs/media/fonts/inter/Inter-SemiBold-b5f0f109bc88052d4000c58ca615671d.woff2 Requested by Host: app.qualified.com URL: https://app.qualified.com/w/1/PaboXyMA4piyRkBp/messenger?uuid=59511085-a416-4e91-a8a4-c61a19eff1e1 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:1105 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 152261291c938aa5aad6a56d52b47ffcb893d1c0387e76d7f270a7382ff786d5 Request headers Referer https://app.qualified.com/ Origin https://app.qualified.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Response headers date Wed, 14 Dec 2022 05:19:45 GMT x-amz-version-id ePBeoMCujYBxKBCWHO9COs36tHcpJSw9 cf-cache-status HIT x-amz-request-id 41ZAEPSASVRWE7WH age 444974 content-length 105804 x-amz-id-2 5VSgC9Mw4REY8GZ6uAI42W2NJLJBvgLpcHOSRC9Hjr+DyNQgR1jJmI5lpArjAwk2L8TTULEGfmY= last-modified Thu, 08 Dec 2022 23:17:25 GMT server cloudflare etag "007ad31a53f4ab3f58ee74f2308482ce" access-control-max-age 3600 access-control-allow-methods GET content-type font/woff2 access-control-allow-origin * vary Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding cache-control public, max-age=31557600 accept-ranges bytes cf-ray 77947c87ccf591e7-FRA expires Thu, 14 Dec 2023 11:19:45 GMT
POST H/1.1	200 OK	/ Show response sentry.io/api/1332833/envelope/ Frame F1F3	2 B 407 B	478ms 117ms	Fetch application/json	35.188.42.15 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://sentry.io/api/1332833/envelope/?sentry_key=b5158ee3382d49b28a864fb2b91bcaaf&sentry_version=7&sentry_client=sentry.javascript.browser%2F7.11.1 Requested by Host: assets.qualified.com URL: https://assets.qualified.com/packs/js/widget-sandboxed-chunks/6-ef20632702203042e41c.chunk.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 35.188.42.15 Council Bluffs, United States, ASN15169 (GOOGLE, US), Reverse DNS 15.42.188.35.bc.googleusercontent.com Software nginx / Resource Hash 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers Referer https://app.qualified.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers Date Wed, 14 Dec 2022 05:19:46 GMT Strict-Transport-Security max-age=31536000; includeSubDomains; preload Server nginx vary Origin Content-Type application/json access-control-allow-origin https://app.qualified.com access-control-expose-headers x-sentry-error, x-sentry-rate-limits, retry-after x-envoy-upstream-service-time 0 Connection keep-alive Content-Length 2
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 494 B	266ms 266ms	Image image/gif	184.24.7.242 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=1a8619a294ad37fe81fcb7766ed37dc1&svisitor=null&visitor=ed5363f0-7b01-4ffc-8c71-8e288313d01e&session=2d337936-4281-47f8-8087-75bbdb0593df&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2014%20Dec%202022%2005%3A19%3A46%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2014%20Dec%202022%2005%3A19%3A45%20GMT%22%2C%22timeSpent%22%3A%221002%22%2C%22totalTimeSpent%22%3A%222044%22%7D&isIframe=false&m=%7B%22description%22%3A%22Team82%20developed%20a%20generic%20web%20application%20firewall%20bypass%20that%20exploits%20a%20lack%20of%20JSON%20syntax%20support%20in%20leading%20vendors%27%20SQL%20injection%20inspection%20process.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22%7BJS-ON%3A%20Security-OFF%7D%3A%20Abusing%20JSON-Based%20SQL%20to%20Bypass%20WAF%20%7C%20Claroty%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fclaroty.com%2Fteam82%2Fresearch%2Fjs-on-security-off-abusing-json-based-sql-to-bypass-waf&pageViewId=b6218204-ff75-4244-85fd-c88be5b2554d&an_uid=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 184.24.7.242 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a184-24-7-242.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Response headers date Wed, 14 Dec 2022 05:19:46 GMT x-content-type-options nosniff content-length 43 pragma no-cache last-modified Sat, 05 Jun 2021 07:56:05 GMT server nginx/1.14.0 (Ubuntu) etag "60bb2e15-2b" access-control-max-age 86400 access-control-allow-methods GET,POST content-type image/gif access-control-allow-origin cache-control private, no-cache, no-cache=Set-Cookie, proxy-revalidate access-control-allow-credentials true accept-ranges bytes access-control-allow-headers * expires Wed, 19 Apr 2000 11:43:00 GMT
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 493 B	246ms 245ms	Image image/gif	184.24.7.242 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=1a8619a294ad37fe81fcb7766ed37dc1&svisitor=null&visitor=ed5363f0-7b01-4ffc-8c71-8e288313d01e&session=2d337936-4281-47f8-8087-75bbdb0593df&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2014%20Dec%202022%2005%3A19%3A47%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2014%20Dec%202022%2005%3A19%3A46%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%223045%22%7D&isIframe=false&m=%7B%22description%22%3A%22Team82%20developed%20a%20generic%20web%20application%20firewall%20bypass%20that%20exploits%20a%20lack%20of%20JSON%20syntax%20support%20in%20leading%20vendors%27%20SQL%20injection%20inspection%20process.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22%7BJS-ON%3A%20Security-OFF%7D%3A%20Abusing%20JSON-Based%20SQL%20to%20Bypass%20WAF%20%7C%20Claroty%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fclaroty.com%2Fteam82%2Fresearch%2Fjs-on-security-off-abusing-json-based-sql-to-bypass-waf&pageViewId=b6218204-ff75-4244-85fd-c88be5b2554d&an_uid=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 184.24.7.242 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a184-24-7-242.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Response headers date Wed, 14 Dec 2022 05:19:47 GMT x-content-type-options nosniff content-length 43 pragma no-cache last-modified Tue, 05 Oct 2021 22:17:52 GMT server nginx/1.14.0 (Ubuntu) etag "615ccf10-2b" access-control-max-age 86400 access-control-allow-methods GET,POST content-type image/gif access-control-allow-origin cache-control private, no-cache, no-cache=Set-Cookie, proxy-revalidate access-control-allow-credentials true accept-ranges bytes access-control-allow-headers * expires Wed, 19 Apr 2000 11:43:00 GMT
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 493 B	245ms 245ms	Image image/gif	184.24.7.242 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=1a8619a294ad37fe81fcb7766ed37dc1&svisitor=null&visitor=ed5363f0-7b01-4ffc-8c71-8e288313d01e&session=2d337936-4281-47f8-8087-75bbdb0593df&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2014%20Dec%202022%2005%3A19%3A48%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2014%20Dec%202022%2005%3A19%3A47%20GMT%22%2C%22timeSpent%22%3A%221003%22%2C%22totalTimeSpent%22%3A%224048%22%7D&isIframe=false&m=%7B%22description%22%3A%22Team82%20developed%20a%20generic%20web%20application%20firewall%20bypass%20that%20exploits%20a%20lack%20of%20JSON%20syntax%20support%20in%20leading%20vendors%27%20SQL%20injection%20inspection%20process.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22%7BJS-ON%3A%20Security-OFF%7D%3A%20Abusing%20JSON-Based%20SQL%20to%20Bypass%20WAF%20%7C%20Claroty%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fclaroty.com%2Fteam82%2Fresearch%2Fjs-on-security-off-abusing-json-based-sql-to-bypass-waf&pageViewId=b6218204-ff75-4244-85fd-c88be5b2554d&an_uid=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 184.24.7.242 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a184-24-7-242.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Response headers date Wed, 14 Dec 2022 05:19:48 GMT x-content-type-options nosniff content-length 43 pragma no-cache last-modified Fri, 21 Feb 2020 18:57:20 GMT server nginx/1.14.0 (Ubuntu) etag "5e502810-2b" access-control-max-age 86400 access-control-allow-methods GET,POST content-type image/gif access-control-allow-origin cache-control private, no-cache, no-cache=Set-Cookie, proxy-revalidate access-control-allow-credentials true accept-ranges bytes access-control-allow-headers * expires Wed, 19 Apr 2000 11:43:00 GMT
GET H/1.1	200 OK	beefcbd7329ae856071625427ba59d5881d293b41b0b1548a5972b4a1755b68f.png qualified-production.s3.us-east-1.amazonaws.com/uploads/ Frame F1F3	7 KB 7 KB	340ms 118ms	Image image/png	52.217.13.40
General Check archive.org Show headers Download Go to Show image Full URL https://qualified-production.s3.us-east-1.amazonaws.com/uploads/beefcbd7329ae856071625427ba59d5881d293b41b0b1548a5972b4a1755b68f.png Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.217.13.40 -, , ASN (), Reverse DNS Software AmazonS3 / Resource Hash 4995a77940c0b604877e7065a447a55d449fa52c6ee9228a019f1375b468e0cf Request headers accept-language de-DE,de;q=0.9 Referer https://app.qualified.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Response headers Date Wed, 14 Dec 2022 05:19:50 GMT Last-Modified Fri, 03 Jun 2022 16:07:37 GMT Server AmazonS3 x-amz-request-id WYDPQQF3ZF8BWAM4 ETag "2a5261e86c85a804a11daf4143746628" Content-Type image/png Cache-Control Cache-Control: public, max-age=31536000 Accept-Ranges bytes Content-Length 6684 x-amz-id-2 sDrFIQAeWgC+Lwnro/qIDxnylsDa9SAMwCQ3Gz3AcyXw9HK10VcqH9o1RRu++2qGotPoSmXJGLg=
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 493 B	252ms 252ms	Image image/gif	184.24.7.242 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=1a8619a294ad37fe81fcb7766ed37dc1&svisitor=null&visitor=ed5363f0-7b01-4ffc-8c71-8e288313d01e&session=2d337936-4281-47f8-8087-75bbdb0593df&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2014%20Dec%202022%2005%3A19%3A49%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2014%20Dec%202022%2005%3A19%3A48%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%225049%22%7D&isIframe=false&m=%7B%22description%22%3A%22Team82%20developed%20a%20generic%20web%20application%20firewall%20bypass%20that%20exploits%20a%20lack%20of%20JSON%20syntax%20support%20in%20leading%20vendors%27%20SQL%20injection%20inspection%20process.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22%7BJS-ON%3A%20Security-OFF%7D%3A%20Abusing%20JSON-Based%20SQL%20to%20Bypass%20WAF%20%7C%20Claroty%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fclaroty.com%2Fteam82%2Fresearch%2Fjs-on-security-off-abusing-json-based-sql-to-bypass-waf&pageViewId=b6218204-ff75-4244-85fd-c88be5b2554d&an_uid=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 184.24.7.242 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a184-24-7-242.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Response headers date Wed, 14 Dec 2022 05:19:49 GMT x-content-type-options nosniff content-length 43 pragma no-cache last-modified Fri, 21 Feb 2020 18:57:20 GMT server nginx/1.14.0 (Ubuntu) etag "5e502810-2b" access-control-max-age 86400 access-control-allow-methods GET,POST content-type image/gif access-control-allow-origin cache-control private, no-cache, no-cache=Set-Cookie, proxy-revalidate access-control-allow-credentials true accept-ranges bytes access-control-allow-headers * expires Wed, 19 Apr 2000 11:43:00 GMT