pentestlaboratories.com Open in urlscan Pro
192.0.78.25 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://pentestlaboratories.com/2021/05/17/amsi-bypass-methods/
Effective URL:
https://pentestlaboratories.com/2021/05/17/amsi-bypass-methods/
Submission: On January 03 via manual (January 3rd 2023, 7:33:31 am UTC) from IN — Scanned from DE

Summary HTTP 91 Redirects Links 43 Behaviour Indicators

Summary

This website contacted 18 IPs in 3 countries across 12 domains to perform 91 HTTP transactions. The main IP is 192.0.78.25, located in San Francisco, United States and belongs to AUTOMATTIC, US. The main domain is pentestlaboratories.com.
TLS certificate: Issued by R3 on December 16th 2022. Valid for: 3 months.

This is the only time pentestlaboratories.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	192.0.78.24 192.0.78.24	2635 (AUTOMATTIC) (AUTOMATTIC)
3	192.0.78.25 192.0.78.25	2635 (AUTOMATTIC) (AUTOMATTIC)
37	192.0.77.32 192.0.77.32	2635 (AUTOMATTIC) (AUTOMATTIC)
14	192.0.72.27 192.0.72.27	2635 (AUTOMATTIC) (AUTOMATTIC)
1 6	2a04:fa87:fff... 2a04:fa87:fffe::c000:4902	2635 (AUTOMATTIC) (AUTOMATTIC)
4	192.0.123.248 192.0.123.248	2635 (AUTOMATTIC) (AUTOMATTIC)
4	192.0.76.3 192.0.76.3	2635 (AUTOMATTIC) (AUTOMATTIC)
9	2a00:1450:400... 2a00:1450:400d:80d::200e	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:400d:80c::2003	15169 (GOOGLE) (GOOGLE)
1 2	2a00:1450:400... 2a00:1450:400d:80e::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:80b::2006	15169 (GOOGLE) (GOOGLE)
4	2a00:1450:400... 2a00:1450:4001:82b::200a	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:400d:807::2004	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:813::2001	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:400d:804::2016	15169 (GOOGLE) (GOOGLE)
1	192.0.78.19 192.0.78.19	2635 (AUTOMATTIC) (AUTOMATTIC)
2	2a00:1450:400... 2a00:1450:400d:80e::2003	15169 (GOOGLE) (GOOGLE)
1	192.0.78.23 192.0.78.23	2635 (AUTOMATTIC) (AUTOMATTIC)
91	18

1 192.0.78.24 (San Francisco, United States) 1 redirects

ASN2635 (AUTOMATTIC, US)

pentestlaboratories.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 192.0.78.25 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)

pentestlaboratories.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

37 192.0.77.32 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)
PTR: wordpress.com

s0.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
fonts-api.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
fonts.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
widgets.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 192.0.72.27 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)

pentestlaboratories.files.wordpress.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a04:fa87:fffe::c000:4902 (Ireland) 1 redirects

ASN2635 (AUTOMATTIC, US)

1.gravatar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
0.gravatar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 192.0.123.248 (Los Angeles, United States)

ASN2635 (AUTOMATTIC, US)
PTR: polldaddy.com

polldaddy.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 192.0.76.3 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)

stats.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pixel.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2a00:1450:400d:80d::200e (Ireland)

ASN15169 (GOOGLE, US)

www.youtube.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:400d:80c::2003 (Ireland)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:400d:80e::2002 (Ireland) 1 redirects

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80b::2006 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

static.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:82b::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

jnn-pa.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400d:807::2004 (Ireland)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:813::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

yt3.ggpht.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400d:804::2016 (Ireland)

ASN15169 (GOOGLE, US)

i.ytimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.0.78.19 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)

r-login.wordpress.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:400d:80e::2003 (Ireland)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.0.78.23 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)

public-api.wordpress.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
41	wp.com s0.wp.com — Cisco Umbrella Rank: 8151 fonts-api.wp.com — Cisco Umbrella Rank: 22690 stats.wp.com — Cisco Umbrella Rank: 3525 fonts.wp.com — Cisco Umbrella Rank: 24089 widgets.wp.com — Cisco Umbrella Rank: 16264 pixel.wp.com — Cisco Umbrella Rank: 2942	453 KB
16	wordpress.com pentestlaboratories.files.wordpress.com r-login.wordpress.com — Cisco Umbrella Rank: 40383 public-api.wordpress.com — Cisco Umbrella Rank: 10576	382 KB
9	youtube.com www.youtube.com — Cisco Umbrella Rank: 98	827 KB
6	gravatar.com 1 redirects 1.gravatar.com — Cisco Umbrella Rank: 11002 0.gravatar.com — Cisco Umbrella Rank: 11199	12 KB
4	googleapis.com jnn-pa.googleapis.com — Cisco Umbrella Rank: 323	31 KB
4	gstatic.com fonts.gstatic.com www.gstatic.com	48 KB
4	polldaddy.com polldaddy.com — Cisco Umbrella Rank: 30350	9 KB
4	pentestlaboratories.com 1 redirects pentestlaboratories.com	34 KB
3	doubleclick.net 1 redirects googleads.g.doubleclick.net — Cisco Umbrella Rank: 64 static.doubleclick.net — Cisco Umbrella Rank: 393	1 KB
1	ytimg.com i.ytimg.com — Cisco Umbrella Rank: 105	18 KB
1	ggpht.com yt3.ggpht.com — Cisco Umbrella Rank: 204	3 KB
1	google.com www.google.com — Cisco Umbrella Rank: 16	15 KB
91	12

	Domain	Requested by
23	s0.wp.com	pentestlaboratories.com widgets.wp.com public-api.wordpress.com
14	pentestlaboratories.files.wordpress.com	pentestlaboratories.com
9	www.youtube.com	pentestlaboratories.com www.youtube.com
9	fonts.wp.com	fonts-api.wp.com
4	jnn-pa.googleapis.com	www.youtube.com
4	polldaddy.com	pentestlaboratories.com polldaddy.com
4	fonts-api.wp.com	pentestlaboratories.com s0.wp.com
4	pentestlaboratories.com	1 redirects s0.wp.com
3	pixel.wp.com	pentestlaboratories.com
3	0.gravatar.com	pentestlaboratories.com 0.gravatar.com
3	1.gravatar.com	1 redirects pentestlaboratories.com
2	www.gstatic.com	www.youtube.com www.gstatic.com
2	googleads.g.doubleclick.net	1 redirects www.youtube.com
2	fonts.gstatic.com	www.youtube.com
1	public-api.wordpress.com	s0.wp.com
1	r-login.wordpress.com	pentestlaboratories.com
1	widgets.wp.com	pentestlaboratories.com
1	i.ytimg.com	www.youtube.com
1	yt3.ggpht.com	www.youtube.com
1	www.google.com	www.youtube.com
1	static.doubleclick.net	www.youtube.com
1	stats.wp.com	pentestlaboratories.com
91	22

This site contains links to these domains. Also see Links.

Domain
twitter.com
github.com
fatrodzianko.com
www.contextis.com
docs.microsoft.com
www.mdsec.co.uk
amsi.fail
sensepost.com
gist.github.com
attack.mitre.org
pentestlab.blog
gravatar.com
akismet.com
www.youtube.com
www.instagram.com
www.linkedin.com
www.facebook.com
discord.gg
wordpress.com
pentestlaboratories.wordpress.com
wp.me
en.wordpress.com
subscribe.wordpress.com

Subject Issuer	Validity	Valid
tls.automattic.com R3	`2022-12-16` - `2023-03-16`	3 months	crt.sh
*.wp.com Sectigo ECC Domain Validation Secure Server CA	`2022-11-14` - `2023-12-15`	a year	crt.sh
*.files.wordpress.com Sectigo ECC Domain Validation Secure Server CA	`2022-11-23` - `2023-12-24`	a year	crt.sh
*.gravatar.com Sectigo ECC Domain Validation Secure Server CA	`2022-11-23` - `2023-12-24`	a year	crt.sh
*.polldaddy.com Sectigo RSA Domain Validation Secure Server CA	`2022-10-21` - `2023-11-21`	a year	crt.sh
*.google.com GTS CA 1C3	`2022-11-28` - `2023-02-20`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2022-11-28` - `2023-02-20`	3 months	crt.sh
*.doubleclick.net GTS CA 1C3	`2022-11-28` - `2023-02-20`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2022-11-28` - `2023-02-20`	3 months	crt.sh
www.google.com GTS CA 1C3	`2022-11-28` - `2023-02-20`	3 months	crt.sh
*.googleusercontent.com GTS CA 1C3	`2022-11-28` - `2023-02-20`	3 months	crt.sh
edgestatic.com GTS CA 1C3	`2022-11-28` - `2023-02-20`	3 months	crt.sh
*.wordpress.com Sectigo ECC Domain Validation Secure Server CA	`2022-11-23` - `2023-12-24`	a year	crt.sh

This page contains 5 frames:

Primary Page: https://pentestlaboratories.com/2021/05/17/amsi-bypass-methods/
Frame ID: 4F996C230498B3FCCDAA9514F5548291
Requests: 66 HTTP requests in this frame

Frame: https://www.youtube.com/embed/6WBkBU0733o?version=3&rel=1&showsearch=0&showinfo=1&iv_load_policy=1&fs=1&hl=en&autohide=2&wmode=transparent
Frame ID: 002DE664DA543FDDB211C8A582DB056C
Requests: 21 HTTP requests in this frame

Frame: https://widgets.wp.com/likes/master.html?ver=20220105
Frame ID: 993C794BABF87F8BC7CF6F3BEB98F59E
Requests: 3 HTTP requests in this frame

Frame: https://r-login.wordpress.com/remote-login.php?wpcom_remote_login=key&origin=aHR0cHM6Ly9wZW50ZXN0bGFib3JhdG9yaWVzLmNvbQ%3D%3D&wpcomid=151987412&time=1672731205
Frame ID: 133251BC1394103159A3DA7ECF9A0CAB
Requests: 1 HTTP requests in this frame

Frame: https://public-api.wordpress.com/wp-admin/rest-proxy/
Frame ID: 0E15DA46B2EB7007F2F9357C3B8D4B30
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

AMSI Bypass Methods | Pentest LaboratoriesAMSI Bypass Methods – Pentest Laboratories

Page URL History Show full URLs

http://pentestlaboratories.com/2021/05/17/amsi-bypass-methods/ HTTP 301
https://pentestlaboratories.com/2021/05/17/amsi-bypass-methods/ Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

<link[^>]+s\d+\.wp\.com
/wp-(?:content|includes)/

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

91
Requests

98 %
HTTPS

56 %
IPv6

12
Domains

22
Subdomains

18
IPs

3
Countries

1870 kB
Transfer

5085 kB
Size

2
Cookies

43 Outgoing links

These are links going to different origins than the main page.

URL: https://twitter.com/ShitSecure
Title: Fabian Mosch

Search URL Search Domain Scan URL

URL: https://twitter.com/mattifestation
Title: Matt Graeber

Search URL Search Domain Scan URL

URL: https://twitter.com/_RastaMouse
Title: Daniel Duggan

Search URL Search Domain Scan URL

URL: https://github.com/rasta-mouse/AmsiScanBufferBypass
Title: AMSI bypass

Search URL Search Domain Scan URL

URL: https://github.com/RythmStick/AMSITrigger
Title: AMSITrigger

Search URL Search Domain Scan URL

URL: https://fatrodzianko.com/2020/08/25/getting-rastamouses-amsiscanbufferbypass-to-work-again/
Title: article

Search URL Search Domain Scan URL

URL: https://www.contextis.com/us/blog/amsi-bypass
Title: bypass

Search URL Search Domain Scan URL

URL: https://twitter.com/am0nsec
Title: Paul Laine

Search URL Search Domain Scan URL

URL: https://docs.microsoft.com/en-us/windows/win32/api/amsi/ne-amsi-amsi_result
Title: AMSI_RESULT

Search URL Search Domain Scan URL

URL: https://twitter.com/_xpn_
Title: Adam Chester

Search URL Search Domain Scan URL

URL: https://www.mdsec.co.uk/2018/06/exploring-powershell-amsi-and-logging-evasion/
Title: Exploring PowerShell AMSI and Logging Evasion

Search URL Search Domain Scan URL

URL: https://amsi.fail/
Title: amsi.fail

Search URL Search Domain Scan URL

URL: https://twitter.com/Flangvik
Title: Melvin Langvik

Search URL Search Domain Scan URL

URL: https://sensepost.com/blog/2020/resurrecting-an-old-amsi-bypass/
Title: SensePost

Search URL Search Domain Scan URL

URL: https://gist.github.com/FatRodzianko/c8a76537b5a87b850c7d158728717998
Title: AmsiOpcodeBytes

Search URL Search Domain Scan URL

URL: https://gist.github.com/am0nsec/986db36000d82b39c73218facc557628
Title: AMSI-Bypass

Search URL Search Domain Scan URL

URL: https://gist.github.com/am0nsec/854a6662f9df165789c8ed2b556e9597
Title: AMSI-Bypass

Search URL Search Domain Scan URL

URL: https://github.com/med0x2e/NoAmci
Title: NoAmci

Search URL Search Domain Scan URL

URL: https://github.com/tomcarver16/AmsiHook
Title: AmsiHook

Search URL Search Domain Scan URL

URL: https://attack.mitre.org/techniques/T1059/001/
Title: T1059.001

Search URL Search Domain Scan URL

URL: https://attack.mitre.org/techniques/T1106/
Title: T1106

Search URL Search Domain Scan URL

URL: https://attack.mitre.org/techniques/T1055/001/
Title: T1055.001

Search URL Search Domain Scan URL

URL: https://attack.mitre.org/techniques/T1027/
Title: T1027

Search URL Search Domain Scan URL

URL: https://attack.mitre.org/techniques/T1562/001/
Title: T1562.001

Search URL Search Domain Scan URL

URL: https://attack.mitre.org/techniques/T1574/001/
Title: T1574.001

Search URL Search Domain Scan URL

URL: https://attack.mitre.org/techniques/T1132/001/
Title: T1132.001

Search URL Search Domain Scan URL

URL: http://pentestlab.blog/2021/05/17/persistence-amsi/
Title: Persistence – AMSI – Penetration Testing Lab

Search URL Search Domain Scan URL

URL: https://gravatar.com/site/signup/

Search URL Search Domain Scan URL

URL: https://akismet.com/privacy/
Title: Learn how your comment data is processed

Search URL Search Domain Scan URL

URL: https://twitter.com/pentestlabltd
Title: Twitter

Search URL Search Domain Scan URL

URL: https://www.youtube.com/c/PentestLaboratories
Title: YouTube

Search URL Search Domain Scan URL

URL: https://www.instagram.com/pentestlaboratories/
Title: Instagram

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/26271095
Title: LinkedIn

Search URL Search Domain Scan URL

URL: https://www.facebook.com/pentestlaboratory/
Title: Facebook

Search URL Search Domain Scan URL

URL: https://discord.gg/rR6FJBH
Title: Discord

Search URL Search Domain Scan URL

URL: https://wordpress.com/?ref=footer_custom_powered
Title: Website Powered by WordPress.com

Search URL Search Domain Scan URL

URL: https://wordpress.com/log-in?redirect_to=https%3A%2F%2Fr-login.wordpress.com%2Fremote-login.php%3Faction%3Dlink%26back%3Dhttps%253A%252F%252Fpentestlaboratories.com%252F2021%252F05%252F17%252Famsi-bypass-methods%252F
Title: Log in now.

Search URL Search Domain Scan URL

URL: https://pentestlaboratories.wordpress.com/wp-admin/customize.php?url=https%3A%2F%2Fpentestlaboratories.wordpress.com%2F2021%2F05%2F17%2Famsi-bypass-methods%2F
Title: Customize

Search URL Search Domain Scan URL

URL: https://wordpress.com/start/
Title: Sign up

Search URL Search Domain Scan URL

URL: https://wp.me/pahIRS-JS
Title: Copy shortlink

Search URL Search Domain Scan URL

URL: http://en.wordpress.com/abuse/
Title: Report this content

Search URL Search Domain Scan URL

URL: https://wordpress.com/read/blogs/151987412/posts/2844
Title: View post in Reader

Search URL Search Domain Scan URL

URL: https://subscribe.wordpress.com/
Title: Manage subscriptions

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://pentestlaboratories.com/2021/05/17/amsi-bypass-methods/ HTTP 301
https://pentestlaboratories.com/2021/05/17/amsi-bypass-methods/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 26

https://1.gravatar.com/avatar/4d92b4bfeaf6c579afbdd84ba473b8a8?s=48&d=https%3A%2F%2F1.gravatar.com%2Favatar%2Fad516503a11cd5ca435acc9bb6523536%3Fs%3D48&r=G HTTP 302
https://1.gravatar.com/avatar/ad516503a11cd5ca435acc9bb6523536?s=48

Request Chain 60

https://googleads.g.doubleclick.net/pagead/id HTTP 302
https://googleads.g.doubleclick.net/pagead/id?slf_rd=1

91 HTTP transactions
4 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
pentestlaboratories.com/2021/05/17/amsi-bypass-methods/
Redirect Chain

http://pentestlaboratories.com/2021/05/17/amsi-bypass-methods/
https://pentestlaboratories.com/2021/05/17/amsi-bypass-methods/

146 KB
33 KB

381ms
363ms

Document
text/html

192.0.78.25
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://pentestlaboratories.com/2021/05/17/amsi-bypass-methods/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.78.25 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

081727d8c0267246faae14d54ca3404fedf52468fa1c565bf3bf23e58dd4142a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

content-encoding: br
content-type: text/html; charset=UTF-8
date: Tue, 03 Jan 2023 07:33:26 GMT
host-header: WordPress.com
link: <https://wp.me/pahIRS-JS>; rel=shortlink
server: nginx
strict-transport-security: max-age=31536000
vary: Accept-Encoding Cookie
x-ac: 2.hhn _dfw EXPIRED
x-hacker: If you're reading this, you should visit automattic.com/jobs and apply to join the fun, mention this header.
x-pingback: https://pentestlaboratories.com/xmlrpc.php

Redirect headers

Connection: keep-alive
Content-Length: 162
Content-Type: text/html
Date: Tue, 03 Jan 2023 07:33:25 GMT
Location: https://pentestlaboratories.com/2021/05/17/amsi-bypass-methods/
Server: nginx
X-ac: 2.hhn _dfw BYPASS

GET
H2 200 webfont.js Show response
s0.wp.com/wp-content/plugins/custom-fonts/js/ 12 KB
5 KB 42ms
7ms Script
application/javascript 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/wp-content/plugins/custom-fonts/js/webfont.js
Requested by: Host: pentestlaboratories.com
URL: https://pentestlaboratories.com/2021/05/17/amsi-bypass-methods/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: c41211d42b7dadb793e39e8ad877e5f76645c7ea200e25625ebbddc050df0c4b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pentestlaboratories.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Tue, 03 Jan 2023 07:33:26 GMT
content-encoding: br
x-ac: 2.hhn _dca BYPASS
server: nginx
etag: W/"6390e6a9-30cd"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
expires: Thu, 07 Dec 2023 19:17:32 GMT

GET
H2 200 wp-emoji-release.min.js Show response
s0.wp.com/wp-includes/js/ 18 KB
5 KB 30ms
8ms Script
application/javascript 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/wp-includes/js/wp-emoji-release.min.js?m=1652185836h&ver=6.1.1-alpha-54813
Requested by: Host: pentestlaboratories.com
URL: https://pentestlaboratories.com/2021/05/17/amsi-bypass-methods/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: 5aad5fbd4238981a9ff5e2772ff1353dfe1a801fb49542fe157418c1438f7782

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pentestlaboratories.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Tue, 03 Jan 2023 07:33:26 GMT
content-encoding: br
x-ac: 2.hhn _dca BYPASS
server: nginx
etag: W/"627a5af9-48b9"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
expires: Fri, 01 Dec 2023 15:51:53 GMT

GET
H2 200 /
s0.wp.com/_static/ 264 KB
31 KB 31ms
9ms Stylesheet
text/css 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/_static/??-eJyNUltSwzAMvBCOCAVaPpiexbE1Qa38GMtuJ7fHDW0J6Ysfj1fSrlayYR+VCT6jz+CKilx68gL7aIJT4ohxmKHGiDzBddoGc9Rme8QQU7DFZAoeXL0xCiRkndGqGCTP0D1hpi3+yo/oovxU25cKO0x9zSSEXfvaLJsFdIXYQsdhFOiSTgNIHhjPQuQNF3voI+DQkkZGNxqZgMh6wKQYe22GxpF/TK+5Kf5Dum1+dDqZWQ+hZNUnsjPb/5ZIOpPv5QHdhCPtpWlXTauEXGRUCXd1iZYknyvUjfXVABjWImRU/qozy9WRJ897eKgad1FfbusO7edfdl1MKKLq6ai4U8vKW7vP9n3ZPi/ePtrV5htCGhjb?cssminify=yes
Requested by: Host: pentestlaboratories.com
URL: https://pentestlaboratories.com/2021/05/17/amsi-bypass-methods/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: 54fc8c0001538652e81928046509ad35aaef219ae4bc5f84291fee40fa71e7b1

Request headers

Referer: https://pentestlaboratories.com/
Origin: https://pentestlaboratories.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Tue, 03 Jan 2023 07:33:26 GMT
content-encoding: br
x-ac: 2.hhn _dfw BYPASS
last-modified: Wed, 14 Dec 2022 16:38:51 GMT
server: nginx
etag: W/"6399fc1b-41fb5"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/css;charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
expires: Thu, 14 Dec 2023 17:22:24 GMT

GET
H2 200 /
s0.wp.com/_static/ 130 KB
47 KB 31ms
10ms Stylesheet
text/css 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/_static/??-eJydUdEOwiAM/CGx0eiSPRg/xTBWsQ4oAZbFv7fbjBo1e/Dt7tq7HgGGqAyHgqGA71V0vaWQwbD3IilHHQrLH8palBUQBC4k7vwE8+B35hVL1KZ7cIiJ294U4gAnCgYsBkxz2k/4FV0u6KVc7BuwnHSAXG4Ol9awlbvjrWlTDVEe9V9jL8hJ6kCtxZIhsyHt1Nz5nSzFW2Tl2Ogp8Z2os9OUlqwJG8dWoJ0+50VH09EfNtW+2m3rutpc74DXtgc=?cssminify=yes
Requested by: Host: pentestlaboratories.com
URL: https://pentestlaboratories.com/2021/05/17/amsi-bypass-methods/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: 3092272824986601c7f713fd492c0dcc2dd20bdba98e32704937cd52699d8931

Request headers

Referer: https://pentestlaboratories.com/
Origin: https://pentestlaboratories.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Tue, 03 Jan 2023 07:33:26 GMT
content-encoding: br
x-ac: 2.hhn _dfw
last-modified: Tue, 28 Jun 2022 15:26:22 GMT
server: nginx
etag: W/"62bb1d9e-20660"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/css;charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
expires: Fri, 11 Aug 2023 17:16:20 GMT

GET
H2 200 global-print.css
s0.wp.com/wp-content/mu-plugins/global-print/ 5 KB
2 KB 12ms
8ms Stylesheet
text/css 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/wp-content/mu-plugins/global-print/global-print.css?m=1465851035h&cssminify=yes
Requested by: Host: pentestlaboratories.com
URL: https://pentestlaboratories.com/2021/05/17/amsi-bypass-methods/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: 7d08e9159f7d2bf0835085cbd1ffb0252b0e11de45ed07db4447f8e63f181dbf

Request headers

Referer: https://pentestlaboratories.com/
Origin: https://pentestlaboratories.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Tue, 03 Jan 2023 07:33:26 GMT
content-encoding: br
x-ac: 2.hhn _dfw BYPASS
server: nginx
etag: W/"61beb5a4-1f6c"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
expires: Fri, 10 Nov 2023 15:12:14 GMT

GET
H2 200 css
fonts-api.wp.com/ 9 KB
908 B 65ms
27ms Stylesheet
text/css 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts-api.wp.com/css?family=Noto+Sans%3A400%2C700%2C400italic%2C700italic&subset=latin%2Clatin-ext

Requested by

Host: pentestlaboratories.com
URL: https://pentestlaboratories.com/2021/05/17/amsi-bypass-methods/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

df8af7ec931befc8ef9048a7a2cbcd041376d93839f8edc45c65a48d34af7039

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pentestlaboratories.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 03 Jan 2023 07:33:26 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-encoding: gzip
cross-origin-resource-policy: cross-origin
x-xss-protection: 0
x-nc: BYPASS hhn 1
last-modified: Tue, 03 Jan 2023 06:41:54 GMT
server: nginx
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding, Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin

GET
H2 200 css
fonts-api.wp.com/ 8 KB
826 B 64ms
26ms Stylesheet
text/css 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts-api.wp.com/css?family=Noto+Serif%3A400%2C700%2C400italic%2C700italic&subset=latin%2Clatin-ext

Requested by

Host: pentestlaboratories.com
URL: https://pentestlaboratories.com/2021/05/17/amsi-bypass-methods/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

c02253ec55f516b5e6d6e9bdad89d0fb193dd36e7c9ea1db8b849f02c7941759

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pentestlaboratories.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 03 Jan 2023 07:33:26 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-encoding: gzip
cross-origin-resource-policy: cross-origin
x-xss-protection: 0
x-nc: BYPASS hhn 1
last-modified: Tue, 03 Jan 2023 07:31:12 GMT
server: nginx
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding, Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin

GET
H2 200 css
fonts-api.wp.com/ 385 B
606 B 63ms
25ms Stylesheet
text/css 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts-api.wp.com/css?family=Droid+Sans+Mono

Requested by

Host: pentestlaboratories.com
URL: https://pentestlaboratories.com/2021/05/17/amsi-bypass-methods/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

329ae504f343511bd1469c2c9ae28c0f7c8e13a68a5efe6b7d71b1a16e621249

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pentestlaboratories.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 03 Jan 2023 07:33:26 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-encoding: gzip
cross-origin-resource-policy: cross-origin
x-xss-protection: 0
x-nc: BYPASS hhn 1
last-modified: Tue, 03 Jan 2023 06:22:30 GMT
server: nginx
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding, Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin

GET
H2 200 style-wpcom.css
s0.wp.com/wp-content/themes/pub/goran/inc/ 5 KB
1021 B 30ms
9ms Stylesheet
text/css 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/wp-content/themes/pub/goran/inc/style-wpcom.css?m=1453284068h&cssminify=yes
Requested by: Host: pentestlaboratories.com
URL: https://pentestlaboratories.com/2021/05/17/amsi-bypass-methods/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: 75e485d4939193b87d2c1fcb13b8a2c4a6e74efd10363dbf6bd462b0a8b65467

Request headers

Referer: https://pentestlaboratories.com/
Origin: https://pentestlaboratories.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Tue, 03 Jan 2023 07:33:26 GMT
content-encoding: br
x-ac: 2.hhn _dfw BYPASS
server: nginx
etag: W/"60aef1c9-16d8"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
expires: Fri, 10 Nov 2023 15:13:24 GMT

GET
H2 200 /
s0.wp.com/_static/ 28 KB
11 KB 30ms
10ms Stylesheet
text/css 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/_static/??-eJyVjUEKwjAQRS9kHCo10IV4FImTkKROZkInQby9bXEjrty9B5/34VkNCrfADUo3lXrMrDCHVh0+Pg51Ed+xZWEoK1FQ0OSW4J33rx0zxyOqHuDf3i0zggpmR4Ykin7JT7OlUNb3NEIkuTvaBtdyGezZjqdpssP8Bj+XTks=?cssminify=yes
Requested by: Host: pentestlaboratories.com
URL: https://pentestlaboratories.com/2021/05/17/amsi-bypass-methods/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: 9f8c6a2819eac6c58810947b91f4478530193f6df053d0996c455661ca76d669

Request headers

Referer: https://pentestlaboratories.com/
Origin: https://pentestlaboratories.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Tue, 03 Jan 2023 07:33:26 GMT
content-encoding: br
x-ac: 2.hhn _dfw BYPASS
last-modified: Tue, 28 Jun 2022 15:26:24 GMT
server: nginx
etag: W/"62bb1da0-7086"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/css;charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
expires: Sat, 21 Oct 2023 18:28:15 GMT

GET
H2 200 / Show response
s0.wp.com/_static/ 123 KB
40 KB 30ms
11ms Script
application/javascript 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/_static/??-eJx1jt0KwjAMRl/ILM7h7sRHka2NI7V/tim6t7dChSl4Fb58h5PgI4IKXsgLmowuzGwJSqY0LXUH7K+hM3mHG84ViLYs7DMakjipW8sYU9BFCQePF/YK58JWYyI7CWmIIUv+Tp1j/6uvbyQrUF3P9dNVmS2a8rs090JpbWMr+AuB4yXVow0+u1M/juNwPAz73rwAclZf4w==
Requested by: Host: pentestlaboratories.com
URL: https://pentestlaboratories.com/2021/05/17/amsi-bypass-methods/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: 6c9d1697011b0c4a04902ee4f71ed38d49bf3be5afb3c10a8b96758e169c4145

Request headers

Referer: https://pentestlaboratories.com/
Origin: https://pentestlaboratories.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Tue, 03 Jan 2023 07:33:26 GMT
content-encoding: br
x-ac: 2.hhn _dfw BYPASS
last-modified: Fri, 21 Oct 2022 11:38:28 GMT
server: nginx
etag: W/"635284b4-1eba9"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
expires: Wed, 25 Oct 2023 14:40:21 GMT

GET
H2 200 style.css
s0.wp.com/wp-content/mu-plugins/highlander-comments/ 15 KB
3 KB 29ms
11ms Stylesheet
text/css 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/wp-content/mu-plugins/highlander-comments/style.css?m=1663315160h&cssminify=yes
Requested by: Host: pentestlaboratories.com
URL: https://pentestlaboratories.com/2021/05/17/amsi-bypass-methods/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: 8e657c0ef1763965fb05ff2d31c111675fc2869e3b32b2cb09ba9a0dacc34c76

Request headers

Referer: https://pentestlaboratories.com/
Origin: https://pentestlaboratories.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Tue, 03 Jan 2023 07:33:26 GMT
content-encoding: br
x-ac: 2.hhn _dfw
server: nginx
etag: W/"63242ce6-45a9"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
expires: Sat, 16 Sep 2023 07:59:40 GMT

GET
H2 200 amsi-powershell-flowchart-1.png
pentestlaboratories.files.wordpress.com/2021/05/ 64 KB
64 KB 84ms
8ms Image
image/webp 192.0.72.27
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pentestlaboratories.files.wordpress.com/2021/05/amsi-powershell-flowchart-1.png?w=1024

Requested by

Host: pentestlaboratories.com
URL: https://pentestlaboratories.com/2021/05/17/amsi-bypass-methods/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.72.27 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

aec496e71ea6e5703c970e8e47b322e79d6e88a5b21d9c54ea02fb153650562f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pentestlaboratories.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-nc: HIT hhn 27 np
date: Tue, 03 Jan 2023 07:33:26 GMT
x-content-type-options: nosniff
last-modified: Sat, 15 May 2021 18:10:16 GMT
server: nginx
x-orig-src: 0_imageresize
vary: Accept, Origin
content-type: image/webp
access-control-allow-origin: https://pentestlaboratories.wordpress.com
access-control-allow-credentials: true
accept-ranges: bytes
content-length: 65094
expires: Fri, 13 Jan 2023 07:16:28 GMT

GET
H2 200 amsi-powershell-bypass-powershell-downgrade.png
pentestlaboratories.files.wordpress.com/2021/05/ 81 KB
81 KB 84ms
8ms Image
image/webp 192.0.72.27
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pentestlaboratories.files.wordpress.com/2021/05/amsi-powershell-bypass-powershell-downgrade.png?w=1024

Requested by

Host: pentestlaboratories.com
URL: https://pentestlaboratories.com/2021/05/17/amsi-bypass-methods/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.72.27 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

78f0fa75221c9cb4b5aefc71f0762fabba0805ed79e349873d385ff8cb07be2b

Security Headers

Name	Value
X-Content-Type-Options	nosniff, nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pentestlaboratories.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-nc: HIT hhn 27 np
date: Tue, 03 Jan 2023 07:33:26 GMT
x-content-type-options: nosniff, nosniff
last-modified: Fri, 30 Dec 2022 05:43:42 GMT
server: nginx
vary: Accept, Origin
content-type: image/webp
access-control-allow-origin: https://pentestlaboratories.wordpress.com
access-control-allow-credentials: true
accept-ranges: bytes
content-length: 82472
expires: Mon, 30 Jan 2023 23:12:43 GMT

GET
H2 200 amsi-powershell-bypass-base64.png
pentestlaboratories.files.wordpress.com/2021/05/ 21 KB
21 KB 84ms
8ms Image
image/png 192.0.72.27
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pentestlaboratories.files.wordpress.com/2021/05/amsi-powershell-bypass-base64.png

Requested by

Host: pentestlaboratories.com
URL: https://pentestlaboratories.com/2021/05/17/amsi-bypass-methods/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.72.27 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

d6c0efac1552cf9ce1e72037bb4c380f60df0006b661c630905629d7cd6a99ff

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pentestlaboratories.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-nc: HIT hhn 27 np
date: Tue, 03 Jan 2023 07:33:26 GMT
x-content-type-options: nosniff
last-modified: Wed, 12 May 2021 19:41:46 GMT
server: nginx
x-orig-src: 01_mogdir
vary: Origin
content-type: image/png
access-control-allow-origin: https://pentestlaboratories.wordpress.com
access-control-allow-credentials: true
accept-ranges: bytes
content-length: 21679
expires: Mon, 23 Jan 2023 03:58:05 GMT

GET
H2 200 amsi-powershell-bypass-hooking.png
pentestlaboratories.files.wordpress.com/2021/05/ 16 KB
16 KB 84ms
9ms Image
image/png 192.0.72.27
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pentestlaboratories.files.wordpress.com/2021/05/amsi-powershell-bypass-hooking.png

Requested by

Host: pentestlaboratories.com
URL: https://pentestlaboratories.com/2021/05/17/amsi-bypass-methods/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.72.27 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

bee5d8829e9cf6df09534f86d82c8cc2c2cb533463bd053ca52e6554222bef3d

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pentestlaboratories.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-nc: HIT hhn 27 np
date: Tue, 03 Jan 2023 07:33:26 GMT
x-content-type-options: nosniff
last-modified: Wed, 12 May 2021 23:57:17 GMT
server: nginx
x-orig-src: 01_mogdir
vary: Origin
content-type: image/png
access-control-allow-origin: https://pentestlaboratories.wordpress.com
access-control-allow-credentials: true
accept-ranges: bytes
content-length: 15949
expires: Mon, 09 Jan 2023 01:40:06 GMT

GET
H2 200 amsi-powershell-bypass-asb.png
pentestlaboratories.files.wordpress.com/2021/05/ 19 KB
19 KB 84ms
9ms Image
image/png 192.0.72.27
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pentestlaboratories.files.wordpress.com/2021/05/amsi-powershell-bypass-asb.png

Requested by

Host: pentestlaboratories.com
URL: https://pentestlaboratories.com/2021/05/17/amsi-bypass-methods/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.72.27 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

f9be1a2a5f709f1eae59ec9e12dfd874254bca56d23cb9e71f4c18988fa0975b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pentestlaboratories.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-nc: HIT hhn 27 np
date: Tue, 03 Jan 2023 07:33:26 GMT
x-content-type-options: nosniff
last-modified: Thu, 13 May 2021 12:25:03 GMT
server: nginx
x-orig-src: 01_mogdir
vary: Origin
content-type: image/png
access-control-allow-origin: https://pentestlaboratories.wordpress.com
access-control-allow-credentials: true
accept-ranges: bytes
content-length: 19253
expires: Fri, 13 Jan 2023 10:22:03 GMT

GET
H2 200 amsi-powershell-bypass-asb-strings.png
pentestlaboratories.files.wordpress.com/2021/05/ 12 KB
12 KB 94ms
19ms Image
image/png 192.0.72.27
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pentestlaboratories.files.wordpress.com/2021/05/amsi-powershell-bypass-asb-strings.png

Requested by

Host: pentestlaboratories.com
URL: https://pentestlaboratories.com/2021/05/17/amsi-bypass-methods/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.72.27 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

8345f58fec20fd5cedad8cc2b2d437279b8efd362a7c0217b9e042a04e0208ff

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pentestlaboratories.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-nc: HIT hhn 27 np
date: Tue, 03 Jan 2023 07:33:26 GMT
x-content-type-options: nosniff
last-modified: Thu, 13 May 2021 16:17:33 GMT
server: nginx
x-orig-src: 01_mogdir
vary: Origin
content-type: image/png
access-control-allow-origin: https://pentestlaboratories.wordpress.com
access-control-allow-credentials: true
accept-ranges: bytes
content-length: 12331
expires: Mon, 09 Jan 2023 04:22:57 GMT

GET
H2 200 amsi-bypass-powershell-memory-patching.png
pentestlaboratories.files.wordpress.com/2021/05/ 14 KB
14 KB 11ms
10ms Image
image/png 192.0.72.27
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pentestlaboratories.files.wordpress.com/2021/05/amsi-bypass-powershell-memory-patching.png

Requested by

Host: pentestlaboratories.com
URL: https://pentestlaboratories.com/2021/05/17/amsi-bypass-methods/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.72.27 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

7761931c76f4b5ddc840305164dbc3d0e7007bc8eaa9e5f3a9b0f77abf320d26

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pentestlaboratories.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-nc: HIT hhn 27 np
date: Tue, 03 Jan 2023 07:33:26 GMT
x-content-type-options: nosniff
last-modified: Thu, 13 May 2021 15:55:25 GMT
server: nginx
x-orig-src: 01_mogdir
vary: Origin
content-type: image/png
access-control-allow-origin: https://pentestlaboratories.wordpress.com
access-control-allow-credentials: true
accept-ranges: bytes
content-length: 14392
expires: Wed, 18 Jan 2023 20:18:31 GMT

GET
H2 200 amsi-powershell-bypass-memory-patching-opcode-bytes-2.png
pentestlaboratories.files.wordpress.com/2021/05/ 14 KB
14 KB 11ms
10ms Image
image/png 192.0.72.27
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pentestlaboratories.files.wordpress.com/2021/05/amsi-powershell-bypass-memory-patching-opcode-bytes-2.png

Requested by

Host: pentestlaboratories.com
URL: https://pentestlaboratories.com/2021/05/17/amsi-bypass-methods/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.72.27 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

87038e9753d96ab7638aba8f47ac23f504584e1a90bcd8750beca4536bb1b186

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pentestlaboratories.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-nc: HIT hhn 27 np
date: Tue, 03 Jan 2023 07:33:26 GMT
x-content-type-options: nosniff
last-modified: Thu, 13 May 2021 18:32:43 GMT
server: nginx
x-orig-src: 01_mogdir
vary: Origin
content-type: image/png
access-control-allow-origin: https://pentestlaboratories.wordpress.com
access-control-allow-credentials: true
accept-ranges: bytes
content-length: 14593
expires: Sun, 22 Jan 2023 12:47:36 GMT

GET
H2 200 amsi-powershell-bypass-memory-patching.png
pentestlaboratories.files.wordpress.com/2021/05/ 19 KB
19 KB 11ms
11ms Image
image/png 192.0.72.27
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pentestlaboratories.files.wordpress.com/2021/05/amsi-powershell-bypass-memory-patching.png

Requested by

Host: pentestlaboratories.com
URL: https://pentestlaboratories.com/2021/05/17/amsi-bypass-methods/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.72.27 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

ca5ee39ab86fb6225cb8071038c46f17f032043f2b3472bec0ff4c63a8d456a0

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pentestlaboratories.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-nc: HIT hhn 27 np
date: Tue, 03 Jan 2023 07:33:26 GMT
x-content-type-options: nosniff
last-modified: Fri, 14 May 2021 09:31:06 GMT
server: nginx
x-orig-src: 01_mogdir
vary: Origin
content-type: image/png
access-control-allow-origin: https://pentestlaboratories.wordpress.com
access-control-allow-credentials: true
accept-ranges: bytes
content-length: 19525
expires: Fri, 27 Jan 2023 10:07:51 GMT

GET
H2 200 amsi-powershell-bypass-amsiinitfailed-1.png
pentestlaboratories.files.wordpress.com/2021/05/ 21 KB
21 KB 12ms
11ms Image
image/png 192.0.72.27
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pentestlaboratories.files.wordpress.com/2021/05/amsi-powershell-bypass-amsiinitfailed-1.png

Requested by

Host: pentestlaboratories.com
URL: https://pentestlaboratories.com/2021/05/17/amsi-bypass-methods/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.72.27 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

cccb8b1d9d06718fb877a63e6eb7c122361ea0bd4efaa5615f2e2a329e4dc3a3

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pentestlaboratories.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-nc: HIT hhn 27 np
date: Tue, 03 Jan 2023 07:33:26 GMT
x-content-type-options: nosniff
last-modified: Fri, 14 May 2021 01:33:00 GMT
server: nginx
x-orig-src: 01_mogdir
vary: Origin
content-type: image/png
access-control-allow-origin: https://pentestlaboratories.wordpress.com
access-control-allow-credentials: true
accept-ranges: bytes
content-length: 21419
expires: Sat, 21 Jan 2023 10:16:04 GMT

GET
H2 200 amsi-powershell-bypass-forcing-an-error.png
pentestlaboratories.files.wordpress.com/2021/05/ 34 KB
34 KB 12ms
11ms Image
image/png 192.0.72.27
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pentestlaboratories.files.wordpress.com/2021/05/amsi-powershell-bypass-forcing-an-error.png

Requested by

Host: pentestlaboratories.com
URL: https://pentestlaboratories.com/2021/05/17/amsi-bypass-methods/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.72.27 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

7313f3202672c68b87d4cf9d06bfc1e4f7f598f3fd7b2ac88c14b1725b6e9284

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pentestlaboratories.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-nc: HIT hhn 27 np
date: Tue, 03 Jan 2023 07:33:26 GMT
x-content-type-options: nosniff
last-modified: Fri, 14 May 2021 00:08:04 GMT
server: nginx
x-orig-src: 01_mogdir
vary: Origin
content-type: image/png
access-control-allow-origin: https://pentestlaboratories.wordpress.com
access-control-allow-credentials: true
accept-ranges: bytes
content-length: 34733
expires: Mon, 06 Feb 2023 12:28:29 GMT

GET
H2 200 amsi-bypass-amsi-provider-registry-key.png
pentestlaboratories.files.wordpress.com/2021/05/ 24 KB
24 KB 12ms
12ms Image
image/png 192.0.72.27
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pentestlaboratories.files.wordpress.com/2021/05/amsi-bypass-amsi-provider-registry-key.png

Requested by

Host: pentestlaboratories.com
URL: https://pentestlaboratories.com/2021/05/17/amsi-bypass-methods/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.72.27 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

58667b4b6376e5c368adbe92c87dc6d1f2852a4ff66f5892288096f785e5a8c8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pentestlaboratories.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-nc: HIT hhn 27 np
date: Tue, 03 Jan 2023 07:33:26 GMT
x-content-type-options: nosniff
last-modified: Fri, 14 May 2021 02:02:07 GMT
server: nginx
x-orig-src: 01_mogdir
vary: Origin
content-type: image/png
access-control-allow-origin: https://pentestlaboratories.wordpress.com
access-control-allow-credentials: true
accept-ranges: bytes
content-length: 24334
expires: Mon, 09 Jan 2023 12:02:05 GMT

GET
H2 200 amsi-bypass-registry-key-modification.png
pentestlaboratories.files.wordpress.com/2021/05/ 8 KB
8 KB 14ms
14ms Image
image/png 192.0.72.27
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pentestlaboratories.files.wordpress.com/2021/05/amsi-bypass-registry-key-modification.png

Requested by

Host: pentestlaboratories.com
URL: https://pentestlaboratories.com/2021/05/17/amsi-bypass-methods/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.72.27 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

211420a1dbb3e44bdf5645f57ce2ff299fd192af394b9655d5ceed6a1f1108aa

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pentestlaboratories.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-nc: HIT hhn 27 np
date: Tue, 03 Jan 2023 07:33:26 GMT
x-content-type-options: nosniff
last-modified: Fri, 14 May 2021 02:02:54 GMT
server: nginx
x-orig-src: 01_mogdir
vary: Origin
content-type: image/png
access-control-allow-origin: https://pentestlaboratories.wordpress.com
access-control-allow-credentials: true
accept-ranges: bytes
content-length: 8227
expires: Mon, 09 Jan 2023 15:30:02 GMT

GET
H2 200 amsi-bypass-dll-hijacking-1.png
pentestlaboratories.files.wordpress.com/2021/05/ 30 KB
30 KB 17ms
16ms Image
image/png 192.0.72.27
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pentestlaboratories.files.wordpress.com/2021/05/amsi-bypass-dll-hijacking-1.png

Requested by

Host: pentestlaboratories.com
URL: https://pentestlaboratories.com/2021/05/17/amsi-bypass-methods/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.72.27 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

1a070cec9a1aefbe6df4a16255698632282e76f0aa8136b7957c7b3de4ac2a42

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pentestlaboratories.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-nc: HIT hhn 27 np
date: Tue, 03 Jan 2023 07:33:26 GMT
x-content-type-options: nosniff
last-modified: Fri, 14 May 2021 20:02:07 GMT
server: nginx
x-orig-src: 01_mogdir
vary: Origin
content-type: image/png
access-control-allow-origin: https://pentestlaboratories.wordpress.com
access-control-allow-credentials: true
accept-ranges: bytes
content-length: 30907
expires: Fri, 20 Jan 2023 22:10:57 GMT

GET
H2

200

ad516503a11cd5ca435acc9bb6523536
1.gravatar.com/avatar/
Redirect Chain

https://1.gravatar.com/avatar/4d92b4bfeaf6c579afbdd84ba473b8a8?s=48&d=https%3A%2F%2F1.gravatar.com%2Favatar%2Fad516503a11cd5ca435acc9bb6523536%3Fs%3D48&r=G
https://1.gravatar.com/avatar/ad516503a11cd5ca435acc9bb6523536?s=48

755 B
858 B

8ms
8ms

Image
image/png

2a04:fa87:fffe::c000:4902
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://1.gravatar.com/avatar/ad516503a11cd5ca435acc9bb6523536?s=48
Requested by: Host: pentestlaboratories.com
URL: https://pentestlaboratories.com/2021/05/17/amsi-bypass-methods/
Protocol: H2
Server: 2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: c671e170afd2025838a074ebdc63ac3ac8822cbdf102651f813a6ac49a357e66

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pentestlaboratories.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Tue, 03 Jan 2023 07:33:26 GMT
last-modified: Sat, 01 Mar 2008 02:44:06 GMT
server: nginx
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=300
content-disposition: inline; filename="ad516503a11cd5ca435acc9bb6523536.png"
accept-ranges: bytes
link: <https://www.gravatar.com/avatar/ad516503a11cd5ca435acc9bb6523536?s=48>; rel="canonical"
content-length: 755
expires: Tue, 03 Jan 2023 07:38:26 GMT

Redirect headers

x-nc: HIT hhn 2
date: Tue, 03 Jan 2023 07:33:26 GMT
last-modified: Wed, 11 Jan 1984 08:00:00 GMT
server: nginx
content-type: text/html; charset=utf-8
location: https://1.gravatar.com/avatar/ad516503a11cd5ca435acc9bb6523536?s=48
cache-control: max-age=300
link: <https://www.gravatar.com/avatar/4d92b4bfeaf6c579afbdd84ba473b8a8?s=48&d=https%3A%2F%2F1.gravatar.com%2Favatar%2Fad516503a11cd5ca435acc9bb6523536%3Fs%3D48&r=G>; rel="canonical"
content-length: 0
expires: Tue, 03 Jan 2023 07:38:26 GMT

GET
H2 200 ad516503a11cd5ca435acc9bb6523536
1.gravatar.com/avatar/ 439 B
664 B 24ms
9ms Image
image/png 2a04:fa87:fffe::c000:4902
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://1.gravatar.com/avatar/ad516503a11cd5ca435acc9bb6523536?s=25
Requested by: Host: pentestlaboratories.com
URL: https://pentestlaboratories.com/2021/05/17/amsi-bypass-methods/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: d3ddd29db765914b449b4573e5a3c24e1982838d9f55befd894cb73333f8149a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pentestlaboratories.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Tue, 03 Jan 2023 07:33:26 GMT
last-modified: Sat, 01 Mar 2008 02:44:06 GMT
server: nginx
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=300
content-disposition: inline; filename="ad516503a11cd5ca435acc9bb6523536.png"
accept-ranges: bytes
link: <https://www.gravatar.com/avatar/ad516503a11cd5ca435acc9bb6523536?s=25>; rel="canonical"
content-length: 439
expires: Tue, 03 Jan 2023 07:38:26 GMT

GET
H2 200 gprofiles.js Show response
0.gravatar.com/js/ 23 KB
7 KB 27ms
7ms Script
application/javascript 2a04:fa87:fffe::c000:4902
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://0.gravatar.com/js/gprofiles.js?ver=202301z
Requested by: Host: pentestlaboratories.com
URL: https://pentestlaboratories.com/2021/05/17/amsi-bypass-methods/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1a72c573becfb1e8529cc987d0508245574afed28a710b3ca816d0f52028c66d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pentestlaboratories.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 03 Jan 2023 07:33:26 GMT
content-encoding: br
last-modified: Thu, 15 Sep 2022 11:48:47 GMT
server: nginx
etag: W/"6323111f-5deb"
content-type: application/javascript
cache-control: max-age=604800
expires: Tue, 10 Jan 2023 07:33:26 GMT

GET
H2 200 wpgroho.js Show response
s0.wp.com/wp-content/mu-plugins/gravatar-hovercards/ 868 B
492 B 7ms
7ms Script
application/javascript 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/wp-content/mu-plugins/gravatar-hovercards/wpgroho.js?m=1610363240h
Requested by: Host: pentestlaboratories.com
URL: https://pentestlaboratories.com/2021/05/17/amsi-bypass-methods/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: 9a90398fe43db7f3effe146858ff7f8c16d1402a2d28090223edd0c50da27087

Request headers

Referer: https://pentestlaboratories.com/
Origin: https://pentestlaboratories.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Tue, 03 Jan 2023 07:33:26 GMT
content-encoding: br
x-ac: 2.hhn _dfw BYPASS
server: nginx
etag: W/"61be9ff8-465"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
expires: Fri, 10 Nov 2023 15:12:14 GMT

GET
H2 200 / Show response
s0.wp.com/_static/ 41 KB
11 KB 10ms
4ms Script
application/javascript 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/_static/??/wp-content/js/textarea-autosize.min.js,/wp-content/mu-plugins/highlander-comments/script.js?m=1663141412j
Requested by: Host: pentestlaboratories.com
URL: https://pentestlaboratories.com/2021/05/17/amsi-bypass-methods/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: 822183b6912f8ef43349d897aa66f65f840a059a488c1dae834f2e1b4d847c1c

Request headers

Referer: https://pentestlaboratories.com/
Origin: https://pentestlaboratories.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Tue, 03 Jan 2023 07:33:26 GMT
content-encoding: br
x-ac: 2.hhn _dfw
last-modified: Wed, 14 Sep 2022 07:43:47 GMT
server: nginx
etag: W/"63218633-a4f5"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
expires: Thu, 14 Sep 2023 07:43:50 GMT

GET
H2 200 wpcom-gray-white.png
s0.wp.com/i/logo/ 8 KB
8 KB 11ms
7ms Image
image/png 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s0.wp.com/i/logo/wpcom-gray-white.png
Requested by: Host: pentestlaboratories.com
URL: https://pentestlaboratories.com/2021/05/17/amsi-bypass-methods/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: c0e93b5ebf107af77d9e7d101d186b3b93e9d5ad4fbb6a74e2dea60173cc04f8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pentestlaboratories.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Tue, 03 Jan 2023 07:33:26 GMT
x-ac: 2.hhn _dca BYPASS
last-modified: Wed, 28 Nov 2018 18:48:45 GMT
server: nginx
etag: "5bfee30d-200b"
access-control-allow-methods: GET, HEAD
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
content-length: 8203
expires: Fri, 10 Nov 2023 15:12:15 GMT

GET
H2 200 / Show response
s0.wp.com/_static/ 36 KB
13 KB 13ms
6ms Script
application/javascript 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/_static/??-eJzTLy/QTc7PK0nNK9EvyClNz8wr1i+uzCtJrMjITM/IAeKS1CJMEWP94uSizIISoOIM5/yiVL2sYh19yo1yKiotzgjIL08tCs5IzcmhpqnOwRmJRQVUNbEAZJx9rq2hmaGpibmZpbFRFgCTxoHC
Requested by: Host: pentestlaboratories.com
URL: https://pentestlaboratories.com/2021/05/17/amsi-bypass-methods/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: c7c8d60039d7921710eea8eb6008659defc6b9a7b332dd3e34a53d61d3c3f769

Request headers

Referer: https://pentestlaboratories.com/
Origin: https://pentestlaboratories.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Tue, 03 Jan 2023 07:33:26 GMT
content-encoding: br
x-ac: 2.hhn _dfw BYPASS
last-modified: Sun, 19 Dec 2021 04:31:03 GMT
server: nginx
etag: W/"61beb587-8fb8"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
expires: Sat, 11 Nov 2023 08:38:54 GMT

GET
H2 200 /
s0.wp.com/_static/ 32 KB
7 KB 13ms
7ms Stylesheet
text/css 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/_static/??-eJytjUsOwjAMRC9EsKAqnwXiLG1igUtiW7HTXh+Q6I4VYjfzNHoDi4Yo7MgOpQXN7UZsMKHrEB+fDloltegkDOWVMhr4HQsGF8kGFU2FjWYMMyWUL2QbzTbw61kcqjTDDLaQYg1j45TxT851uoK39louu8Nx3/X9+dRNT290cAs=?cssminify=yes
Requested by: Host: pentestlaboratories.com
URL: https://pentestlaboratories.com/2021/05/17/amsi-bypass-methods/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: 3c1cca9c590864565f4ab7f65c81f2f7ebfeefb96e0ff786724d5143034898e9

Request headers

Referer: https://pentestlaboratories.com/
Origin: https://pentestlaboratories.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Tue, 03 Jan 2023 07:33:26 GMT
content-encoding: br
x-ac: 2.hhn _dfw BYPASS
last-modified: Thu, 29 Dec 2022 23:19:53 GMT
server: nginx
etag: W/"63ae2099-7e14"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/css;charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
expires: Fri, 29 Dec 2023 23:22:23 GMT

GET
H2 200 / Show response
s0.wp.com/_static/ 110 KB
31 KB 14ms
8ms Script
application/javascript 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/_static/??-eJyNUllSwzAMvRCOGsIUfhiOwji2mirxhmWn5fa4SVsg00n7Jz2/RbINhyCUdwldgp5B40gKw7Hq+Qn+HNksgskdOQZDAzJ8Zcy4l04bjCtk5a0tkJhF/QJYCn9VrfFqYHiu6reqFkw2GBQRx6oBTZxmp5lUrLp9av2xsuSWjmmPtgSH3AJqcicdDxSKxg1i51VmsaPrtuSUyfr/oBGD+b5j3fkoJ28nR+pkIv8QeypWLk/qEitaGcFKThhLJVKUZecVUY8pFMq5hxC9zuo0EdhSmTLDNIpI3huGiBy8YxpRjKTR30Bu7f5Q3me5TmgzGQ1KRp8ZzZV9Ae6Yy4HYYhJNtZntLsAuTmS99vXOEeIQylsu2qL7sO/19rXeNs3mZdv/AD8bImw=
Requested by: Host: pentestlaboratories.com
URL: https://pentestlaboratories.com/2021/05/17/amsi-bypass-methods/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: adf99b2efdeab093d82cefceda180b764f99fbdb41d78442f8631e7e3dff0886

Request headers

Referer: https://pentestlaboratories.com/
Origin: https://pentestlaboratories.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Tue, 03 Jan 2023 07:33:26 GMT
content-encoding: br
x-ac: 2.hhn _dfw BYPASS
last-modified: Wed, 21 Dec 2022 14:30:57 GMT
server: nginx
etag: W/"63a318a1-1b96b"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
expires: Fri, 22 Dec 2023 06:13:58 GMT

GET
H2 200 rating.js Show response
polldaddy.com/js/rating/ 16 KB
4 KB 484ms
152ms Script
application/javascript 192.0.123.248
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://polldaddy.com/js/rating/rating.js?ver=wpcom
Requested by: Host: pentestlaboratories.com
URL: https://pentestlaboratories.com/2021/05/17/amsi-bypass-methods/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.123.248 Los Angeles, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: polldaddy.com
Software: nginx /
Resource Hash: e0808e40b97ef765f6cb946aaf1b816cec41aa339c1b841e64aa32413276383d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pentestlaboratories.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 03 Jan 2023 07:33:26 GMT
content-encoding: br
last-modified: Mon, 12 Sep 2022 08:38:32 GMT
server: nginx
etag: W/"631ef008-3fe3"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000
expires: Thu, 02 Feb 2023 07:33:26 GMT

GET
H2 200 sharing.min.js Show response
s0.wp.com/wp-content/mu-plugins/jetpack-plugin/production/_inc/build/sharedaddy/ 8 KB
3 KB 14ms
8ms Script
application/javascript 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/wp-content/mu-plugins/jetpack-plugin/production/_inc/build/sharedaddy/sharing.min.js?m=1656348725h
Requested by: Host: pentestlaboratories.com
URL: https://pentestlaboratories.com/2021/05/17/amsi-bypass-methods/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: 9eff412c1198930f1d219490894e17733ccd8b992e9ddb7546971f783c00431e

Request headers

Referer: https://pentestlaboratories.com/
Origin: https://pentestlaboratories.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Tue, 03 Jan 2023 07:33:26 GMT
content-encoding: br
x-ac: 2.hhn _dfw BYPASS
server: nginx
etag: W/"62b9e048-2145"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
expires: Sat, 21 Oct 2023 18:28:17 GMT

GET
H2 200 w.js Show response
stats.wp.com/ 11 KB
4 KB 66ms
7ms Script
application/javascript 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.wp.com/w.js?63
Requested by: Host: pentestlaboratories.com
URL: https://pentestlaboratories.com/2021/05/17/amsi-bypass-methods/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ec7c4c90e31092c6253cddb718655a1e3ac5f4f83425b1e16d54b25ff80f263f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pentestlaboratories.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-nc: HIT hhn
date: Tue, 03 Jan 2023 07:33:26 GMT
content-encoding: br
server: nginx
etag: W/"61dc645f-2a3d"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
expires: Fri, 10 Nov 2023 15:19:01 GMT

GET
H2 200 css
fonts-api.wp.com/ 7 KB
724 B 27ms
26ms Stylesheet
text/css 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts-api.wp.com/css?family=Ubuntu:b%7CUbuntu:r,i,b,bi&subset=latin,latin-ext,latin,latin-ext

Requested by

Host: s0.wp.com
URL: https://s0.wp.com/wp-content/plugins/custom-fonts/js/webfont.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

29277809a9470ef4944c6f7a51ba3c15fed2080daec85b946287d91526690f3d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pentestlaboratories.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 03 Jan 2023 07:33:26 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-encoding: gzip
cross-origin-resource-policy: cross-origin
x-xss-protection: 0
x-nc: BYPASS hhn 1
last-modified: Tue, 03 Jan 2023 07:13:26 GMT
server: nginx
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding, Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin

GET
H2 200 4iCv6KVjbNBYlgoCxCvjsGyN.woff2
fonts.wp.com/s/ubuntu/v20/ 29 KB
29 KB 48ms
8ms Font
font/woff2 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.wp.com/s/ubuntu/v20/4iCv6KVjbNBYlgoCxCvjsGyN.woff2

Requested by

Host: fonts-api.wp.com
URL: https://fonts-api.wp.com/css?family=Ubuntu:b%7CUbuntu:r,i,b,bi&subset=latin,latin-ext,latin,latin-ext

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

7c00752ce82d6abaed0b9766d35b906b16675facdbe24115b410d1fab975effa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts-api.wp.com/
Origin: https://pentestlaboratories.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Tue, 03 Jan 2023 07:33:26 GMT
x-content-type-options: nosniff
last-modified: Wed, 27 Apr 2022 17:05:11 GMT
server: nginx
age: 288515
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
content-length: 29752
x-xss-protection: 0

GET
H2 200 4iCs6KVjbNBYlgoKfw72.woff2
fonts.wp.com/s/ubuntu/v20/ 34 KB
34 KB 47ms
7ms Font
font/woff2 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.wp.com/s/ubuntu/v20/4iCs6KVjbNBYlgoKfw72.woff2

Requested by

Host: fonts-api.wp.com
URL: https://fonts-api.wp.com/css?family=Ubuntu:b%7CUbuntu:r,i,b,bi&subset=latin,latin-ext,latin,latin-ext

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

7f653b3ce9d3277457fc6da4edb246ae2f6c913f088c42dcb8cd2e96267aa21a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts-api.wp.com/
Origin: https://pentestlaboratories.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Tue, 03 Jan 2023 07:33:26 GMT
x-content-type-options: nosniff
last-modified: Wed, 27 Apr 2022 16:31:23 GMT
server: nginx
age: 217452
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
content-length: 34852
x-xss-protection: 0

GET
H2 200 4iCu6KVjbNBYlgoKej70l0k.woff2
fonts.wp.com/s/ubuntu/v20/ 36 KB
36 KB 47ms
7ms Font
font/woff2 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.wp.com/s/ubuntu/v20/4iCu6KVjbNBYlgoKej70l0k.woff2

Requested by

Host: fonts-api.wp.com
URL: https://fonts-api.wp.com/css?family=Ubuntu:b%7CUbuntu:r,i,b,bi&subset=latin,latin-ext,latin,latin-ext

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

af186659e415490e7eee1bd3c8d511771dbd3e03ddbebf6b6a5096ac8ba29449

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts-api.wp.com/
Origin: https://pentestlaboratories.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Tue, 03 Jan 2023 07:33:26 GMT
x-content-type-options: nosniff
last-modified: Wed, 27 Apr 2022 16:13:13 GMT
server: nginx
age: 5165
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
content-length: 36564
x-xss-protection: 0

GET
H2 200 4iCp6KVjbNBYlgoKejZPslyPN4E.woff2
fonts.wp.com/s/ubuntu/v20/ 30 KB
30 KB 46ms
7ms Font
font/woff2 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.wp.com/s/ubuntu/v20/4iCp6KVjbNBYlgoKejZPslyPN4E.woff2

Requested by

Host: fonts-api.wp.com
URL: https://fonts-api.wp.com/css?family=Ubuntu:b%7CUbuntu:r,i,b,bi&subset=latin,latin-ext,latin,latin-ext

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

26918e4295cab1eaecebc5d4719c212691f040bfe31daf0c7caf08f7a0de520a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts-api.wp.com/
Origin: https://pentestlaboratories.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Tue, 03 Jan 2023 07:33:26 GMT
x-content-type-options: nosniff
last-modified: Wed, 27 Apr 2022 16:08:03 GMT
server: nginx
age: 78060
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
content-length: 30660
x-xss-protection: 0

GET
H2 200 6WBkBU0733o Show response
www.youtube.com/embed/ Frame 002D 70 KB
30 KB 174ms
76ms Document
text/html 2a00:1450:400d:80d::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/embed/6WBkBU0733o?version=3&rel=1&showsearch=0&showinfo=1&iv_load_policy=1&fs=1&hl=en&autohide=2&wmode=transparent

Requested by

Host: pentestlaboratories.com
URL: https://pentestlaboratories.com/2021/05/17/amsi-bypass-methods/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:80d::200e , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

86c1754a5162e5ff5b6c75c8708c5212e9628f93d5949a5f1c4f30053c4c38f9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://pentestlaboratories.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: br
content-type: text/html; charset=utf-8
cross-origin-opener-policy-report-only: same-origin; report-to="youtube_main"
cross-origin-resource-policy: cross-origin
date: Tue, 03 Jan 2023 07:33:26 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=en for more info."
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-platform=*, ch-ua-platform-version=*
pragma: no-cache
report-to: {"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]}
server: ESF
strict-transport-security: max-age=31536000
vary: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 shCore.css
s0.wp.com/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/styles/ 6 KB
1 KB 7ms
7ms Stylesheet
text/css 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/styles/shCore.css?ver=3.0.9b
Requested by: Host: pentestlaboratories.com
URL: https://pentestlaboratories.com/2021/05/17/amsi-bypass-methods/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: 17daa2fbe0ec2b4646e8406f654772645d0be2759a5137e175fbe95a1387455a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pentestlaboratories.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Tue, 03 Jan 2023 07:33:26 GMT
content-encoding: br
x-ac: 2.hhn _dca BYPASS
server: nginx
etag: W/"62bc9430-1a9d"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
expires: Fri, 10 Nov 2023 15:12:41 GMT

GET
H2 200 shThemeDefault.css
s0.wp.com/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/styles/ 2 KB
492 B 8ms
7ms Stylesheet
text/css 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/styles/shThemeDefault.css?m=1363304414h&ver=3.0.9b
Requested by: Host: pentestlaboratories.com
URL: https://pentestlaboratories.com/2021/05/17/amsi-bypass-methods/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: 923e3009de4c32eb9cad94e6d350b077cb806a3bb02b31fb0595ef3adef0b35c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pentestlaboratories.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Tue, 03 Jan 2023 07:33:26 GMT
content-encoding: br
x-ac: 2.hhn _dca BYPASS
server: nginx
etag: W/"5c066eb2-b3d"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
expires: Fri, 10 Nov 2023 15:12:32 GMT

GET
H2 200 o-0IIpQlx3QUlC5A4PNr5TRA.woff2
fonts.wp.com/s/notosans/v27/ 13 KB
13 KB 8ms
8ms Font
font/woff2 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.wp.com/s/notosans/v27/o-0IIpQlx3QUlC5A4PNr5TRA.woff2

Requested by

Host: fonts-api.wp.com
URL: https://fonts-api.wp.com/css?family=Noto+Sans%3A400%2C700%2C400italic%2C700italic&subset=latin%2Clatin-ext

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

88f00438d26021a325247c4427898f7c778a22976df9f1a9d9876429778bf265

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts-api.wp.com/
Origin: https://pentestlaboratories.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Tue, 03 Jan 2023 07:33:26 GMT
x-content-type-options: nosniff
last-modified: Mon, 09 May 2022 18:27:55 GMT
server: nginx
age: 344818
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
content-length: 12860
x-xss-protection: 0

GET
H2 200 o-0NIpQlx3QUlC5A4PNjXhFVZNyB.woff2
fonts.wp.com/s/notosans/v27/ 12 KB
12 KB 7ms
7ms Font
font/woff2 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.wp.com/s/notosans/v27/o-0NIpQlx3QUlC5A4PNjXhFVZNyB.woff2

Requested by

Host: fonts-api.wp.com
URL: https://fonts-api.wp.com/css?family=Noto+Sans%3A400%2C700%2C400italic%2C700italic&subset=latin%2Clatin-ext

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

c1c30918a861cb6a985ab55d54ad7e861682354197f164cb3b7194f20eed67ac

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts-api.wp.com/
Origin: https://pentestlaboratories.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Tue, 03 Jan 2023 07:33:26 GMT
x-content-type-options: nosniff
last-modified: Mon, 09 May 2022 18:28:04 GMT
server: nginx
age: 3556
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
content-length: 12684
x-xss-protection: 0

GET
H2 200 6NUO8FuJNQ2MbkrZ5-J8lKFrp7pRef2r.woff2
fonts.wp.com/s/droidsansmono/v20/ 18 KB
18 KB 7ms
7ms Font
font/woff2 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.wp.com/s/droidsansmono/v20/6NUO8FuJNQ2MbkrZ5-J8lKFrp7pRef2r.woff2

Requested by

Host: fonts-api.wp.com
URL: https://fonts-api.wp.com/css?family=Droid+Sans+Mono

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

1a8e7108949ee83e8eeadd9cd0ed0f98bd8870f2afa75c26ccdc9e795fb58e30

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts-api.wp.com/
Origin: https://pentestlaboratories.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Tue, 03 Jan 2023 07:33:26 GMT
x-content-type-options: nosniff
last-modified: Tue, 19 Apr 2022 17:56:00 GMT
server: nginx
age: 411948
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
content-length: 18400
x-xss-protection: 0

GET
H2 200 o-0OIpQlx3QUlC5A4PNr4ARCQ_k.woff2
fonts.wp.com/s/notosans/v27/ 11 KB
11 KB 7ms
7ms Font
font/woff2 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.wp.com/s/notosans/v27/o-0OIpQlx3QUlC5A4PNr4ARCQ_k.woff2

Requested by

Host: fonts-api.wp.com
URL: https://fonts-api.wp.com/css?family=Noto+Sans%3A400%2C700%2C400italic%2C700italic&subset=latin%2Clatin-ext

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

420f8e3b772990108a7a5e260b53420123a1bd22a82848984595452c9355ab1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts-api.wp.com/
Origin: https://pentestlaboratories.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Tue, 03 Jan 2023 07:33:26 GMT
x-content-type-options: nosniff
last-modified: Mon, 09 May 2022 18:27:33 GMT
server: nginx
age: 42835
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
content-length: 11652
x-xss-protection: 0

GET
H2 200 o-0TIpQlx3QUlC5A4PNr4Az5ZuyDzW0.woff2
fonts.wp.com/s/notosans/v27/ 11 KB
11 KB 8ms
7ms Font
font/woff2 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.wp.com/s/notosans/v27/o-0TIpQlx3QUlC5A4PNr4Az5ZuyDzW0.woff2

Requested by

Host: fonts-api.wp.com
URL: https://fonts-api.wp.com/css?family=Noto+Sans%3A400%2C700%2C400italic%2C700italic&subset=latin%2Clatin-ext

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

8c357781bf89d971e4aced299202c71c94eccae63401887400dd3a89d7f336e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts-api.wp.com/
Origin: https://pentestlaboratories.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Tue, 03 Jan 2023 07:33:26 GMT
x-content-type-options: nosniff
last-modified: Mon, 09 May 2022 18:28:17 GMT
server: nginx
age: 407891
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
content-length: 11252
x-xss-protection: 0

GET
DATA 200
OK truncated
/ 7 KB
7 KB Font
application/font-woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: cdf3f88beb166e98d2656e957b247c886d1702027559a290e74a02d58d950c8c

Request headers

Referer
Origin: https://pentestlaboratories.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Content-Type: application/font-woff;charset=utf-8

GET
DATA 200
OK truncated
/ 14 KB
14 KB Font
application/x-font-woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1cfd32e37f8aba263101f06e8f702adfaef55a6601857cf5e2c6dd0b0388dcd6

Request headers

Referer
Origin: https://pentestlaboratories.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Content-Type: application/x-font-woff;charset=utf-8

GET
DATA 200
OK truncated
/ 18 KB
18 KB Font
application/x-font-woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 05914b956e9d0107351bca1ace8c4288c28c331338dc746b93f70bbe058502cf

Request headers

Referer
Origin: https://pentestlaboratories.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Content-Type: application/x-font-woff;charset=utf-8

GET
H2 200 www-player.css
www.youtube.com/s/player/21149d65/ Frame 002D 360 KB
49 KB 21ms
20ms Stylesheet
text/css 2a00:1450:400d:80d::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/21149d65/www-player.css

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/6WBkBU0733o?version=3&rel=1&showsearch=0&showinfo=1&iv_load_policy=1&fs=1&hl=en&autohide=2&wmode=transparent

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:80d::200e , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b12df28928ae6402d9d672b356057877a9829fb5701e913e162c03774ab4cec7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.youtube.com/embed/6WBkBU0733o?version=3&rel=1&showsearch=0&showinfo=1&iv_load_policy=1&fs=1&hl=en&autohide=2&wmode=transparent
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Mon, 02 Jan 2023 10:19:40 GMT
content-encoding: br
x-content-type-options: nosniff
age: 76426
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 49901
x-xss-protection: 0
last-modified: Mon, 19 Dec 2022 01:17:46 GMT
server: sffe
vary: Accept-Encoding, Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: text/css
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Tue, 02 Jan 2024 10:19:40 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v18/ Frame 002D 15 KB
16 KB 91ms
23ms Font
font/woff2 2a00:1450:400d:80c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/6WBkBU0733o?version=3&rel=1&showsearch=0&showinfo=1&iv_load_policy=1&fs=1&hl=en&autohide=2&wmode=transparent

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:80c::2003 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.youtube.com/
Origin: https://www.youtube.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Fri, 30 Dec 2022 09:20:58 GMT
x-content-type-options: nosniff
age: 339148
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15344
x-xss-protection: 0
last-modified: Mon, 16 Oct 2017 17:32:55 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 30 Dec 2023 09:20:58 GMT

GET
H2 200 KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v18/ Frame 002D 15 KB
15 KB 97ms
30ms Font
font/woff2 2a00:1450:400d:80c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/6WBkBU0733o?version=3&rel=1&showsearch=0&showinfo=1&iv_load_policy=1&fs=1&hl=en&autohide=2&wmode=transparent

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:80c::2003 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5a8c1e7681318caa29e9f44e8a6e271f6a4067a2703e9916dfd4fe9099241db7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.youtube.com/
Origin: https://www.youtube.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Thu, 29 Dec 2022 22:15:01 GMT
x-content-type-options: nosniff
age: 379105
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15552
x-xss-protection: 0
last-modified: Mon, 16 Oct 2017 17:33:02 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 29 Dec 2023 22:15:01 GMT

GET
H2 200 www-embed-player.js Show response
www.youtube.com/s/player/21149d65/www-embed-player.vflset/ Frame 002D 338 KB
106 KB 28ms
27ms Script
text/javascript 2a00:1450:400d:80d::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/21149d65/www-embed-player.vflset/www-embed-player.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/6WBkBU0733o?version=3&rel=1&showsearch=0&showinfo=1&iv_load_policy=1&fs=1&hl=en&autohide=2&wmode=transparent

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:80d::200e , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

49df9116f57b85bfe106cfc8d6356ccaa0ffb99177b05906a7ed90dc15ecbd5f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.youtube.com/embed/6WBkBU0733o?version=3&rel=1&showsearch=0&showinfo=1&iv_load_policy=1&fs=1&hl=en&autohide=2&wmode=transparent
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 18:32:30 GMT
content-encoding: br
x-content-type-options: nosniff
age: 565256
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 108885
x-xss-protection: 0
last-modified: Mon, 19 Dec 2022 01:17:46 GMT
server: sffe
vary: Accept-Encoding, Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Wed, 27 Dec 2023 18:32:30 GMT

GET
H2 200 base.js Show response
www.youtube.com/s/player/21149d65/player_ias.vflset/en_US/ Frame 002D 2 MB
594 KB 57ms
56ms Script
text/javascript 2a00:1450:400d:80d::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/21149d65/player_ias.vflset/en_US/base.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/6WBkBU0733o?version=3&rel=1&showsearch=0&showinfo=1&iv_load_policy=1&fs=1&hl=en&autohide=2&wmode=transparent

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:80d::200e , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2c3ad5227fcc5b11a4f7298ea9c74cf1060b50f9aa475508ee7a532c6dc4260a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.youtube.com/embed/6WBkBU0733o?version=3&rel=1&showsearch=0&showinfo=1&iv_load_policy=1&fs=1&hl=en&autohide=2&wmode=transparent
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 18:38:30 GMT
content-encoding: br
x-content-type-options: nosniff
age: 564896
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 607695
x-xss-protection: 0
last-modified: Mon, 19 Dec 2022 01:17:46 GMT
server: sffe
vary: Accept-Encoding, Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Wed, 27 Dec 2023 18:38:30 GMT

GET
H2 200 fetch-polyfill.js Show response
www.youtube.com/s/player/21149d65/fetch-polyfill.vflset/ Frame 002D 9 KB
3 KB 60ms
59ms Script
text/javascript 2a00:1450:400d:80d::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/21149d65/fetch-polyfill.vflset/fetch-polyfill.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/6WBkBU0733o?version=3&rel=1&showsearch=0&showinfo=1&iv_load_policy=1&fs=1&hl=en&autohide=2&wmode=transparent

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:80d::200e , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

498b3f2a0357fbd50a80eb18b23ab4b461b791d640e5560b799f08ed960748a9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.youtube.com/embed/6WBkBU0733o?version=3&rel=1&showsearch=0&showinfo=1&iv_load_policy=1&fs=1&hl=en&autohide=2&wmode=transparent
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 18:32:30 GMT
content-encoding: br
x-content-type-options: nosniff
age: 565256
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2786
x-xss-protection: 0
last-modified: Mon, 19 Dec 2022 01:17:46 GMT
server: sffe
vary: Accept-Encoding, Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Wed, 27 Dec 2023 18:32:30 GMT

GET
H3

200

id Show response
googleads.g.doubleclick.net/pagead/ Frame 002D
Redirect Chain

https://googleads.g.doubleclick.net/pagead/id
https://googleads.g.doubleclick.net/pagead/id?slf_rd=1

100 B
146 B

88ms
40ms

XHR
application/json

2a00:1450:400d:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/id?slf_rd=1

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/6WBkBU0733o?version=3&rel=1&showsearch=0&showinfo=1&iv_load_policy=1&fs=1&hl=en&autohide=2&wmode=transparent

Protocol

Server

2a00:1450:400d:80e::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0f30d02d592fbfaadb7838c508b0b1681300befaa5cbdb03362d948eba55f71f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.youtube.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 03 Jan 2023 07:33:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 120
x-xss-protection: 0
pragma: no-cache
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://www.youtube.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Tue, 03 Jan 2023 07:33:26 GMT
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
pragma: no-cache
server: cafe
content-type: text/html; charset=UTF-8
location: https://googleads.g.doubleclick.net/pagead/id?slf_rd=1
access-control-allow-origin: https://www.youtube.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ad_status.js Show response
static.doubleclick.net/instream/ Frame 002D 29 B
588 B 47ms
8ms Script
text/javascript 2a00:1450:4001:80b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.doubleclick.net/instream/ad_status.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/21149d65/www-embed-player.vflset/www-embed-player.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eed0dc1fdb5d97ed188ae16fd5e1024a5bb744af47340346be2146300a6c54b9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.youtube.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 03 Jan 2023 07:28:52 GMT
x-content-type-options: nosniff
age: 274
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 29
x-xss-protection: 0
last-modified: Thu, 12 Dec 2013 23:40:16 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=900
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 03 Jan 2023 07:43:52 GMT

OPTIONS
H2 200 Create
jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/ Frame 0
0 71ms
16ms Preflight
text/html 2a00:1450:4001:82b::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/Create

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: content-type,x-goog-api-key,x-user-agent
Access-Control-Request-Method: POST
Origin: https://www.youtube.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type,x-goog-api-key,x-user-agent
access-control-allow-methods: DELETE,GET,HEAD,OPTIONS,PATCH,POST,PUT
access-control-allow-origin: https://www.youtube.com
access-control-max-age: 3600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
content-type: text/html
date: Tue, 03 Jan 2023 07:33:26 GMT
server: ESF
vary: origin referer x-origin
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 0

POST
H3 200 Create Show response
jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/ Frame 002D 66 KB
30 KB 45ms
22ms XHR
application/json+protobuf 2a00:1450:4001:82b::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/Create

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/21149d65/player_ias.vflset/en_US/base.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

450b724e9d7720d3cd1092a28571b69cac24fc933e7b505dbb17833c3688006b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

X-User-Agent: grpc-web-javascript/0.1
Referer: https://www.youtube.com/
X-Goog-Api-Key: AIzaSyDyT5W0Jh49F30Pqqtyfdf7pDLFKLJoAnw
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
Content-Type: application/json+protobuf

Response headers

date: Tue, 03 Jan 2023 07:33:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: ESF
vary: Origin, X-Origin, Referer
x-frame-options: SAMEORIGIN
content-type: application/json+protobuf; charset=UTF-8
access-control-allow-origin: https://www.youtube.com
access-control-expose-headers: vary,vary,vary,content-encoding,date,server,content-length
cache-control: private
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 31132
x-xss-protection: 0

GET
H3 200 remote.js Show response
www.youtube.com/s/player/21149d65/player_ias.vflset/en_US/ Frame 002D 119 KB
36 KB 20ms
20ms Script
text/javascript 2a00:1450:400d:80d::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/21149d65/player_ias.vflset/en_US/remote.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/21149d65/player_ias.vflset/en_US/base.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80d::200e , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b268937863e37505eb86ab385f49d8a4233a91ec0ffe7b4a57cf48629e5e2fac

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.youtube.com/embed/6WBkBU0733o?version=3&rel=1&showsearch=0&showinfo=1&iv_load_policy=1&fs=1&hl=en&autohide=2&wmode=transparent
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 18:33:41 GMT
content-encoding: br
x-content-type-options: nosniff
age: 565185
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37194
x-xss-protection: 0
last-modified: Mon, 19 Dec 2022 01:17:46 GMT
server: sffe
vary: Accept-Encoding, Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Wed, 27 Dec 2023 18:33:41 GMT

GET
H2 200 YkfklCtf3s5-_1quWHAnTHHVaBZ-i7ToAeXFpu3i2Ro.js Show response
www.google.com/js/th/ Frame 002D 36 KB
15 KB 93ms
23ms Script
text/javascript 2a00:1450:400d:807::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/js/th/YkfklCtf3s5-_1quWHAnTHHVaBZ-i7ToAeXFpu3i2Ro.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/21149d65/player_ias.vflset/en_US/base.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:807::2004 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6247e4942b5fdece7eff5aae5870274c71d568167e8bb4e801e5c5a6ede2d91a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.youtube.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Sat, 31 Dec 2022 10:10:49 GMT
content-encoding: br
x-content-type-options: nosniff
age: 249757
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14349
x-xss-protection: 0
last-modified: Thu, 03 Nov 2022 10:00:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sun, 31 Dec 2023 10:10:49 GMT

GET
H3 200 embed.js Show response
www.youtube.com/s/player/21149d65/player_ias.vflset/en_US/ Frame 002D 26 KB
8 KB 21ms
21ms Script
text/javascript 2a00:1450:400d:80d::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/21149d65/player_ias.vflset/en_US/embed.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/21149d65/player_ias.vflset/en_US/base.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80d::200e , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b163003fc3dc866d9bd2facbf4d3ad0d33f3faa58cd5fb9737889c46f151a85b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.youtube.com/embed/6WBkBU0733o?version=3&rel=1&showsearch=0&showinfo=1&iv_load_policy=1&fs=1&hl=en&autohide=2&wmode=transparent
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 18:34:59 GMT
content-encoding: br
x-content-type-options: nosniff
age: 565107
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8344
x-xss-protection: 0
last-modified: Mon, 19 Dec 2022 01:17:46 GMT
server: sffe
vary: Accept-Encoding, Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Wed, 27 Dec 2023 18:34:59 GMT

GET
DATA 200
OK truncated
/ Frame 002D 175 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 67ea46bc3d15351067faccb3613bd833dd3f15137a4b4a09f2e873fd41d024d2

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 azxhMQOt6Q5lgvu7IydlKijsY4YY9w2kJpl2sUSUsMBqv4Exu1qBU_QRA_0uRytZMUYvsCocew=s68-c-k-c0x00ffffff-no-rj
yt3.ggpht.com/ Frame 002D 3 KB
3 KB 48ms
10ms Image
image/jpeg 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://yt3.ggpht.com/azxhMQOt6Q5lgvu7IydlKijsY4YY9w2kJpl2sUSUsMBqv4Exu1qBU_QRA_0uRytZMUYvsCocew=s68-c-k-c0x00ffffff-no-rj

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/6WBkBU0733o?version=3&rel=1&showsearch=0&showinfo=1&iv_load_policy=1&fs=1&hl=en&autohide=2&wmode=transparent

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

c3413729373769431562e4c111825dcfaae274e3fff8bb73a9c368486168345b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.youtube.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 03 Jan 2023 06:46:37 GMT
x-content-type-options: nosniff
age: 2809
content-disposition: inline;filename="channels4_profile.jpg"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3001
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Sun, 13 Nov 2022 07:32:17 GMT

GET
H2 200 sddefault.jpg
i.ytimg.com/vi/6WBkBU0733o/ Frame 002D 18 KB
18 KB 125ms
49ms Image
image/jpeg 2a00:1450:400d:804::2016
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i.ytimg.com/vi/6WBkBU0733o/sddefault.jpg?sqp=-oaymwEmCIAFEOAD8quKqQMa8AEB-AH-DoACuAiKAgwIABABGBMgOSh_MA8=&rs=AOn4CLCIGt2X1EMNj86vQLd5swWv4uyTBA

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/6WBkBU0733o?version=3&rel=1&showsearch=0&showinfo=1&iv_load_policy=1&fs=1&hl=en&autohide=2&wmode=transparent

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:804::2016 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6ddafbc321a2365019d527d58495a010a5dbe7b0790ff971c1c533e0de079ba9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.youtube.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 03 Jan 2023 07:33:26 GMT
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18196
x-xss-protection: 0
server: sffe
etag: "0"
vary: Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: image/jpeg
cache-control: public, max-age=7200
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Tue, 03 Jan 2023 09:33:26 GMT

GET
H2 200 rate.php Show response
polldaddy.com/ratings/ 1 KB
422 B 154ms
154ms Script
application/javascript 192.0.123.248
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://polldaddy.com/ratings/rate.php?cmd=get&id=8796967&uid=wp-post-2844&item_id=_post_2844
Requested by: Host: polldaddy.com
URL: https://polldaddy.com/js/rating/rating.js?ver=wpcom
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.123.248 Los Angeles, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: polldaddy.com
Software: nginx /
Resource Hash: 2f6a4b6a275bd50624cf197d354fb5d21c09cb138e0917e0500c4b625e13002a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pentestlaboratories.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

content-type: application/javascript
date: Tue, 03 Jan 2023 07:33:26 GMT
content-encoding: br
server: nginx
vary: Accept-Encoding
content-language: en

GET
H2 200 master.html Show response
widgets.wp.com/likes/ Frame 993C 3 KB
1 KB 21ms
7ms Document
text/html 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://widgets.wp.com/likes/master.html?ver=20220105
Requested by: Host: pentestlaboratories.com
URL: https://pentestlaboratories.com/2021/05/17/amsi-bypass-methods/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: b24220a1cbe811e074f353e3e39612513c31cf3cfdd51cda1d247e55dcf73611

Request headers

Referer: https://pentestlaboratories.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-methods: GET, HEAD
access-control-allow-origin: *
content-encoding: br
content-type: text/html
date: Tue, 03 Jan 2023 07:33:26 GMT
etag: W/"61d59762-ae1"
last-modified: Wed, 05 Jan 2022 13:04:34 GMT
server: nginx
timing-allow-origin: *
vary: Accept-Encoding
x-ac: 2.hhn _dca
x-nc: HIT hhn 1

GET
H2 200 g.gif
pixel.wp.com/ 50 B
93 B 25ms
11ms Image
image/gif 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.wp.com/g.gif?x_stats-initial-visibility=visible&v=wpcom-no-pv&rand=0.3544938324411715
Requested by: Host: pentestlaboratories.com
URL: https://pentestlaboratories.com/2021/05/17/amsi-bypass-methods/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pentestlaboratories.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

access-control-allow-origin: *
date: Tue, 03 Jan 2023 07:33:26 GMT
cache-control: no-cache
server: nginx
content-length: 50
content-type: image/gif

GET
H2 200 g.gif
pixel.wp.com/ 50 B
75 B 25ms
11ms Image
image/gif 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.wp.com/g.gif?blog=151987412&v=wpcom&tz=0&user_id=0&post=2844&subd=pentestlaboratories&host=pentestlaboratories.com&ref=&rand=0.40484971022075333
Requested by: Host: pentestlaboratories.com
URL: https://pentestlaboratories.com/2021/05/17/amsi-bypass-methods/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pentestlaboratories.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

access-control-allow-origin: *
date: Tue, 03 Jan 2023 07:33:26 GMT
cache-control: no-cache
server: nginx
content-length: 50
content-type: image/gif

GET
H2 200 g.gif
pixel.wp.com/ 50 B
75 B 25ms
12ms Image
image/gif 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.wp.com/g.gif?crypt=UE40eW5QN0p8M2Y%2FRE1mNzc2NTVTamdsd0xoLz9RQkM2K298TXY9bERQMXc2MjhEaVZfb2wwakRoSj0mUkp1THptM1NdbkV1WjZIcU9mVWQmPUIvMlN6Jk8wW3NYVEJ3dWZOWExuWD9yL3dPVDRCOHlLX3IxTHI5WHl%2BamhyX1F6dHROc2lBVDVbYmkwfEVac0dkRGVIRFk9VU5qSmNidEN6N3lsPUk9QXl8RVhqTXdhLnJSME9OK3lbfDksRmtXTD9DLF1qL0RLYjNuQzZ5UVlGclY5cFl8OVImWUN4fmY3R110MT8wSnEmWzVUYzhuVTBGK2NKUTRjRmlVJWRsY0wrNE5HTlEtN0s5aDFmUWZGcF9DNSZbfnU9UXpjeUN0YW1fOWw2MG9CeXZlK0NxQU9rLjJzenptUmpmdVdKQmJvTSYvP0tbXVl0b3g%3D&v=wpcom-no-pv&rand=0.18881536144552147
Requested by: Host: pentestlaboratories.com
URL: https://pentestlaboratories.com/2021/05/17/amsi-bypass-methods/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pentestlaboratories.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

access-control-allow-origin: *
date: Tue, 03 Jan 2023 07:33:26 GMT
cache-control: no-cache
server: nginx
content-length: 50
content-type: image/gif

GET
H2 200 / Show response
pentestlaboratories.com/2021/05/17/amsi-bypass-methods/ 3 KB
1 KB 295ms
295ms XHR
application/json 192.0.78.25
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://pentestlaboratories.com/2021/05/17/amsi-bypass-methods/?relatedposts=1

Requested by

Host: s0.wp.com
URL: https://s0.wp.com/_static/??-eJx1jt0KwjAMRl/ILM7h7sRHka2NI7V/tim6t7dChSl4Fb58h5PgI4IKXsgLmowuzGwJSqY0LXUH7K+hM3mHG84ViLYs7DMakjipW8sYU9BFCQePF/YK58JWYyI7CWmIIUv+Tp1j/6uvbyQrUF3P9dNVmS2a8rs090JpbWMr+AuB4yXVow0+u1M/juNwPAz73rwAclZf4w==

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.78.25 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

cca55783947aa901ce0ea1dd5bb95db0642eedd9b94646b5bf3581b2563d6556

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Referer: https://pentestlaboratories.com/2021/05/17/amsi-bypass-methods/
x-requested-with: XMLHttpRequest
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-hacker: If you're reading this, you should visit automattic.com/jobs and apply to join the fun, mention this header.
date: Tue, 03 Jan 2023 07:33:27 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-encoding: br
server: nginx
x-ac: 2.hhn _dfw EXPIRED
vary: Accept-Encoding
x-pingback: https://pentestlaboratories.com/xmlrpc.php
content-type: application/json; charset=utf-8
host-header: WordPress.com

GET
H2 200 hovercard.min.css
0.gravatar.com/dist/css/ 8 KB
2 KB 8ms
7ms Stylesheet
text/css 2a04:fa87:fffe::c000:4902
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://0.gravatar.com/dist/css/hovercard.min.css?ver=202301z
Requested by: Host: 0.gravatar.com
URL: https://0.gravatar.com/js/gprofiles.js?ver=202301z
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: d4b66a62cc3561450a099afc2a59321b0f7ac23a0e4c9ad6c11d78b68debebc4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pentestlaboratories.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 03 Jan 2023 07:33:26 GMT
content-encoding: br
last-modified: Tue, 13 Dec 2022 09:45:35 GMT
server: nginx
etag: W/"639849bf-1fb4"
content-type: text/css
cache-control: max-age=604800
expires: Tue, 10 Jan 2023 07:33:26 GMT

GET
H2 200 services.min.css
0.gravatar.com/dist/css/ 3 KB
702 B 8ms
8ms Stylesheet
text/css 2a04:fa87:fffe::c000:4902
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://0.gravatar.com/dist/css/services.min.css?ver=202301z
Requested by: Host: 0.gravatar.com
URL: https://0.gravatar.com/js/gprofiles.js?ver=202301z
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 7d65ae8ac56b24bc044ecdfb0b54028621ad4c322efac68d2a4aa81edb8007d0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pentestlaboratories.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 03 Jan 2023 07:33:26 GMT
content-encoding: br
last-modified: Mon, 26 Dec 2022 09:44:48 GMT
server: nginx
etag: W/"63a96d10-ca6"
content-type: text/css
cache-control: max-age=604800
expires: Tue, 10 Jan 2023 07:33:26 GMT

GET
H2 200 remote-login.php Show response
r-login.wordpress.com/ Frame 1332 133 B
297 B 205ms
154ms Document
text/html 192.0.78.19
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://r-login.wordpress.com/remote-login.php?wpcom_remote_login=key&origin=aHR0cHM6Ly9wZW50ZXN0bGFib3JhdG9yaWVzLmNvbQ%3D%3D&wpcomid=151987412&time=1672731205

Requested by

Host: pentestlaboratories.com
URL: https://pentestlaboratories.com/2021/05/17/amsi-bypass-methods/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.78.19 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

95fddf05b0a4211a795d0d4e3774dc4a865e624f845917dc5add7f4b45893edf

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://pentestlaboratories.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-cache, must-revalidate, max-age=0
content-encoding: br
content-type: text/html; charset=utf-8
date: Tue, 03 Jan 2023 07:33:26 GMT
expires: Wed, 11 Jan 1984 05:00:00 GMT
server: nginx
strict-transport-security: max-age=15552000
vary: Accept-Encoding Cookie
x-ac: 1.hhn _dfw MISS

GET
H2 200 rlt-proxy.js Show response
s0.wp.com/wp-content/js/ Frame 993C 5 KB
1 KB 10ms
8ms Script
application/javascript 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/wp-content/js/rlt-proxy.js?m=20211122
Requested by: Host: widgets.wp.com
URL: https://widgets.wp.com/likes/master.html?ver=20220105
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: a1dbbafdc3544cc1a9eafad30123a7da4f4dc92a9c282efea53821cb648a4aa3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://widgets.wp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Tue, 03 Jan 2023 07:33:26 GMT
content-encoding: br
x-ac: 2.hhn _dca BYPASS
server: nginx
etag: W/"619d635a-1c9d"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
expires: Thu, 23 Nov 2023 21:55:44 GMT

GET
H2 200 / Show response
s0.wp.com/_static/ Frame 993C 81 KB
20 KB 9ms
8ms Script
application/javascript 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/_static/??/wp-content/js/postmessage.js,/wp-content/js/tannin/compat.min.js,/wp-content/js/wpcom-proxy-request.js,/wp-content/js/likes-rest-nojquery.js?m=20220105
Requested by: Host: widgets.wp.com
URL: https://widgets.wp.com/likes/master.html?ver=20220105
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: 6fb1ebf7d05d7235b6cff049056242de93930660c9e79677045fcb13942eb9b0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://widgets.wp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Tue, 03 Jan 2023 07:33:26 GMT
content-encoding: br
x-ac: 2.hhn _dca
last-modified: Wed, 05 Jan 2022 12:39:57 GMT
server: nginx
etag: W/"61d5919d-142fa"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
expires: Thu, 05 Jan 2023 13:04:47 GMT

GET
H2 200 cast_sender.js Show response
www.gstatic.com/cv/js/sender/v1/ Frame 002D 4 KB
3 KB 161ms
90ms Script
text/javascript 2a00:1450:400d:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/cv/js/sender/v1/cast_sender.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/21149d65/player_ias.vflset/en_US/base.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:80e::2003 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ee147e859ad0f09aa50367974e38ab53e7c7054c4a51d400a7f45b0eb251454f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.youtube.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 03 Jan 2023 07:33:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cloudview
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2007
x-xss-protection: 0
last-modified: Tue, 16 Feb 2021 23:57:06 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="cloudview"
vary: Accept-Encoding
report-to: {"group":"cloudview","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cloudview"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Tue, 03 Jan 2023 07:33:26 GMT

POST
H3 200 GenerateIT Show response
jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/ Frame 002D 90 B
134 B 21ms
21ms XHR
application/json+protobuf 2a00:1450:4001:82b::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/GenerateIT

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/21149d65/player_ias.vflset/en_US/base.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

6a99500d18db6941219756b2d7f329dd5840701f43ec2461acf5edc4914336ab

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

X-User-Agent: grpc-web-javascript/0.1
Referer: https://www.youtube.com/
X-Goog-Api-Key: AIzaSyDyT5W0Jh49F30Pqqtyfdf7pDLFKLJoAnw
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
Content-Type: application/json+protobuf

Response headers

date: Tue, 03 Jan 2023 07:33:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: ESF
vary: Origin, X-Origin, Referer
x-frame-options: SAMEORIGIN
content-type: application/json+protobuf; charset=UTF-8
access-control-allow-origin: https://www.youtube.com
access-control-expose-headers: vary,vary,vary,content-encoding,date,server,content-length
cache-control: private
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 110
x-xss-protection: 0

OPTIONS
H3 200 GenerateIT
jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/ Frame 0
0 15ms
15ms Preflight
text/html 2a00:1450:4001:82b::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/GenerateIT

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: content-type,x-goog-api-key,x-user-agent
Access-Control-Request-Method: POST
Origin: https://www.youtube.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type,x-goog-api-key,x-user-agent
access-control-allow-methods: DELETE,GET,HEAD,OPTIONS,PATCH,POST,PUT
access-control-allow-origin: https://www.youtube.com
access-control-max-age: 3600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
content-type: text/html
date: Tue, 03 Jan 2023 07:33:26 GMT
server: ESF
vary: origin referer x-origin
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 0

GET
H2 200 / Show response
public-api.wordpress.com/wp-admin/rest-proxy/ Frame 0E15 8 KB
4 KB 179ms
146ms Document
text/html 192.0.78.23
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://public-api.wordpress.com/wp-admin/rest-proxy/

Requested by

Host: s0.wp.com
URL: https://s0.wp.com/_static/??/wp-content/js/postmessage.js,/wp-content/js/tannin/compat.min.js,/wp-content/js/wpcom-proxy-request.js,/wp-content/js/likes-rest-nojquery.js?m=20220105

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.78.23 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

daacb651039d6a470a0c6ece531e838d3b9eb9c5a2ff2f966a2495cb7bcde14e

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://widgets.wp.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

content-encoding: br
content-type: text/html; charset=utf-8
date: Tue, 03 Jan 2023 07:33:27 GMT
p3p: CP="CAO PSA OUR"
server: nginx
strict-transport-security: max-age=15552000
vary: Accept-Encoding
x-ac: 1.hhn _dfw BYPASS

GET
H3 204 generate_204
www.youtube.com/ Frame 002D 0
10 B 22ms
20ms Image
text/plain 2a00:1450:400d:80d::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.youtube.com/generate_204?cxvB5A
Requested by: Host: www.youtube.com
URL: https://www.youtube.com/embed/6WBkBU0733o?version=3&rel=1&showsearch=0&showinfo=1&iv_load_policy=1&fs=1&hl=en&autohide=2&wmode=transparent
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:400d:80d::200e , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.youtube.com/embed/6WBkBU0733o?version=3&rel=1&showsearch=0&showinfo=1&iv_load_policy=1&fs=1&hl=en&autohide=2&wmode=transparent
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 03 Jan 2023 07:33:26 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0

GET
H2 200 star-yellow-sml.png
polldaddy.com/images/ratings/ 3 KB
3 KB 150ms
150ms Image
image/png 192.0.123.248
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://polldaddy.com/images/ratings/star-yellow-sml.png
Requested by: Host: pentestlaboratories.com
URL: https://pentestlaboratories.com/2021/05/17/amsi-bypass-methods/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.123.248 Los Angeles, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: polldaddy.com
Software: nginx /
Resource Hash: 67f5e3a1fe926d54a765050fbdae81d08d4908c38c3a2340322ec7f5086df9e3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pentestlaboratories.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 03 Jan 2023 07:33:27 GMT
last-modified: Wed, 08 Sep 2021 02:43:59 GMT
server: nginx
etag: "6138236f-c0d"
content-type: image/png
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 3085
expires: Thu, 02 Feb 2023 07:33:27 GMT

GET
H2 200 info.png
polldaddy.com/images/ratings/ 1 KB
1 KB 151ms
150ms Image
image/png 192.0.123.248
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://polldaddy.com/images/ratings/info.png
Requested by: Host: pentestlaboratories.com
URL: https://pentestlaboratories.com/2021/05/17/amsi-bypass-methods/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.123.248 Los Angeles, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: polldaddy.com
Software: nginx /
Resource Hash: 8d1b51a6bcf97a173884161816c19b753e0088a0926148482d8a1f371706c774

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pentestlaboratories.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 03 Jan 2023 07:33:27 GMT
last-modified: Wed, 08 Sep 2021 04:24:16 GMT
server: nginx
etag: "61383af0-4ca"
content-type: image/png
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 1226
expires: Thu, 02 Feb 2023 07:33:27 GMT

GET
H3 200 cast_sender.js Show response
www.gstatic.com/eureka/clank/108/ Frame 002D 52 KB
15 KB 69ms
20ms Script
text/javascript 2a00:1450:400d:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/eureka/clank/108/cast_sender.js

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/cv/js/sender/v1/cast_sender.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80e::2003 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a174ce3d0e66cfea95ba4288c928291b37bd679f3044ac1a7f4dc3958036be11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.youtube.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 03 Jan 2023 05:34:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 7137
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cloudview-release
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15164
x-xss-protection: 0
last-modified: Tue, 08 Nov 2022 00:45:53 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="cloudview-release"
vary: Accept-Encoding
report-to: {"group":"cloudview-release","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cloudview-release"}]}
content-type: text/javascript
cache-control: public, max-age=86400
accept-ranges: bytes
expires: Wed, 04 Jan 2023 05:34:30 GMT

GET
H2 200 rlt-proxy.js Show response
s0.wp.com/wp-content/js/ Frame 0E15 5 KB
1 KB 7ms
7ms Script
application/javascript 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/wp-content/js/rlt-proxy.js?m=20211122
Requested by: Host: public-api.wordpress.com
URL: https://public-api.wordpress.com/wp-admin/rest-proxy/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: a1dbbafdc3544cc1a9eafad30123a7da4f4dc92a9c282efea53821cb648a4aa3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://public-api.wordpress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Tue, 03 Jan 2023 07:33:27 GMT
content-encoding: br
x-ac: 2.hhn _dca BYPASS
server: nginx
etag: W/"619d635a-1c9d"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
expires: Thu, 23 Nov 2023 21:55:44 GMT

GET
H2 200 actionbar.css
s0.wp.com/wp-content/mu-plugins/actionbar/ 15 KB
3 KB 8ms
7ms Stylesheet
text/css 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/wp-content/mu-plugins/actionbar/actionbar.css?v=20210915
Requested by: Host: pentestlaboratories.com
URL: https://pentestlaboratories.com/2021/05/17/amsi-bypass-methods/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: a2da270bc79a1290e19d4eba107784f6587dfcf542e0a96f7efca31c1f1fb9df

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pentestlaboratories.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Tue, 03 Jan 2023 07:33:27 GMT
content-encoding: br
x-ac: 2.hhn _dca BYPASS
server: nginx
etag: W/"61439ab3-4620"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
expires: Fri, 10 Nov 2023 15:12:14 GMT

GET
H2 200 actionbar.js Show response
s0.wp.com/wp-content/mu-plugins/actionbar/ 11 KB
3 KB 9ms
8ms Script
application/javascript 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/wp-content/mu-plugins/actionbar/actionbar.js?v=20220329
Requested by: Host: pentestlaboratories.com
URL: https://pentestlaboratories.com/2021/05/17/amsi-bypass-methods/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: 963611a5916c6de2cd9580b3ec43a961b9171c5d0fe8a7177181a8335924a88b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pentestlaboratories.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Tue, 03 Jan 2023 07:33:27 GMT
content-encoding: br
x-ac: 2.hhn _dca
server: nginx
etag: W/"624b18ae-346d"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
expires: Tue, 04 Apr 2023 16:11:33 GMT

POST
H2 200 admin-ajax.php
pentestlaboratories.com/wp-admin/ 0
0 232ms
232ms Fetch
text/html 192.0.78.25
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://pentestlaboratories.com/wp-admin/admin-ajax.php

Requested by

Host: s0.wp.com
URL: https://s0.wp.com/wp-content/mu-plugins/actionbar/actionbar.js?v=20220329

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.78.25 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://pentestlaboratories.com/2021/05/17/amsi-bypass-methods/
X-Requested-With: XMLHttpRequest
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

x-hacker: If you're reading this, you should visit automattic.com/jobs and apply to join the fun, mention this header.
date: Tue, 03 Jan 2023 07:33:27 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-encoding: br
x-ac: 2.hhn _dfw BYPASS
host-header: WordPress.com
referrer-policy: strict-origin-when-cross-origin
server: nginx
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/html; charset=UTF-8
access-control-allow-origin: https://pentestlaboratories.com
cache-control: no-cache, must-revalidate, max-age=0
access-control-allow-credentials: true
x-robots-tag: noindex
expires: Wed, 11 Jan 1984 05:00:00 GMT

POST
H3 200 log_event Show response
www.youtube.com/youtubei/v1/ Frame 002D 28 B
54 B 47ms
47ms XHR
application/json 2a00:1450:400d:80d::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/youtubei/v1/log_event?alt=json&key=AIzaSyAO_FJ2SlqU8Q4STEHLGCilw_Y9_11qcW8

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/21149d65/www-embed-player.vflset/www-embed-player.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80d::200e , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

scaffolding on HTTPServer2 /

Resource Hash

d7d5e54ad1e33d7ab49c664323ced79cb9723ff15e9764cd0edc3e15208e8336

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
X-Goog-Request-Time: 1672731209088
Content-Type: application/json
X-YouTube-Utc-Offset: 0
X-YouTube-Client-Name: 56
Referer: https://www.youtube.com/embed/6WBkBU0733o?version=3&rel=1&showsearch=0&showinfo=1&iv_load_policy=1&fs=1&hl=en&autohide=2&wmode=transparent
X-YouTube-Client-Version: 1.20221218.00.00
X-YouTube-Time-Zone: Etc/Unknown
X-Goog-Visitor-Id: CgtQNXZFcm1BNTZpZyjGtM-dBg%3D%3D
X-YouTube-Ad-Signals: dt=1672731206516&flash=0&frm=2&u_tz&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&bc=31&bih=-12245933&biw=-12245933&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C700%2C394&vis=1&wgl=true&ca_type=image

Response headers

date: Tue, 03 Jan 2023 07:33:29 GMT
content-encoding: br
x-content-type-options: nosniff
server: scaffolding on HTTPServer2
x-frame-options: SAMEORIGIN
vary: Origin, X-Origin, Referer
content-type: application/json; charset=UTF-8
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
cache-control: private
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 31
x-xss-protection: 0
expires: Tue, 03 Jan 2023 07:33:29 GMT

Verdicts & Comments Add Verdict or Comment

105 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.youtube.com/	1969-12-31 23:59:59	Name: YSC Value: 1JjGDGWsLW8
			.youtube.com/	1970-01-20 12:58:03	Name: VISITOR_INFO1_LIVE Value: P5vErmA56ig

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

0.gravatar.com
1.gravatar.com
fonts-api.wp.com
fonts.gstatic.com
fonts.wp.com
googleads.g.doubleclick.net
i.ytimg.com
jnn-pa.googleapis.com
pentestlaboratories.com
pentestlaboratories.files.wordpress.com
pixel.wp.com
polldaddy.com
public-api.wordpress.com
r-login.wordpress.com
s0.wp.com
static.doubleclick.net
stats.wp.com
widgets.wp.com
www.google.com
www.gstatic.com
www.youtube.com
yt3.ggpht.com
192.0.123.248
192.0.72.27
192.0.76.3
192.0.77.32
192.0.78.19
192.0.78.23
192.0.78.24
192.0.78.25
2a00:1450:4001:80b::2006
2a00:1450:4001:813::2001
2a00:1450:4001:82b::200a
2a00:1450:400d:804::2016
2a00:1450:400d:807::2004
2a00:1450:400d:80c::2003
2a00:1450:400d:80d::200e
2a00:1450:400d:80e::2002
2a00:1450:400d:80e::2003
2a04:fa87:fffe::c000:4902
05914b956e9d0107351bca1ace8c4288c28c331338dc746b93f70bbe058502cf
081727d8c0267246faae14d54ca3404fedf52468fa1c565bf3bf23e58dd4142a
0f30d02d592fbfaadb7838c508b0b1681300befaa5cbdb03362d948eba55f71f
17daa2fbe0ec2b4646e8406f654772645d0be2759a5137e175fbe95a1387455a
1a070cec9a1aefbe6df4a16255698632282e76f0aa8136b7957c7b3de4ac2a42
1a72c573becfb1e8529cc987d0508245574afed28a710b3ca816d0f52028c66d
1a8e7108949ee83e8eeadd9cd0ed0f98bd8870f2afa75c26ccdc9e795fb58e30
1cfd32e37f8aba263101f06e8f702adfaef55a6601857cf5e2c6dd0b0388dcd6
211420a1dbb3e44bdf5645f57ce2ff299fd192af394b9655d5ceed6a1f1108aa
26918e4295cab1eaecebc5d4719c212691f040bfe31daf0c7caf08f7a0de520a
29277809a9470ef4944c6f7a51ba3c15fed2080daec85b946287d91526690f3d
2c3ad5227fcc5b11a4f7298ea9c74cf1060b50f9aa475508ee7a532c6dc4260a
2f6a4b6a275bd50624cf197d354fb5d21c09cb138e0917e0500c4b625e13002a
3092272824986601c7f713fd492c0dcc2dd20bdba98e32704937cd52699d8931
329ae504f343511bd1469c2c9ae28c0f7c8e13a68a5efe6b7d71b1a16e621249
3c1cca9c590864565f4ab7f65c81f2f7ebfeefb96e0ff786724d5143034898e9
3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc
420f8e3b772990108a7a5e260b53420123a1bd22a82848984595452c9355ab1f
450b724e9d7720d3cd1092a28571b69cac24fc933e7b505dbb17833c3688006b
498b3f2a0357fbd50a80eb18b23ab4b461b791d640e5560b799f08ed960748a9
49df9116f57b85bfe106cfc8d6356ccaa0ffb99177b05906a7ed90dc15ecbd5f
54fc8c0001538652e81928046509ad35aaef219ae4bc5f84291fee40fa71e7b1
58667b4b6376e5c368adbe92c87dc6d1f2852a4ff66f5892288096f785e5a8c8
5a8c1e7681318caa29e9f44e8a6e271f6a4067a2703e9916dfd4fe9099241db7
5aad5fbd4238981a9ff5e2772ff1353dfe1a801fb49542fe157418c1438f7782
6247e4942b5fdece7eff5aae5870274c71d568167e8bb4e801e5c5a6ede2d91a
67ea46bc3d15351067faccb3613bd833dd3f15137a4b4a09f2e873fd41d024d2
67f5e3a1fe926d54a765050fbdae81d08d4908c38c3a2340322ec7f5086df9e3
6a99500d18db6941219756b2d7f329dd5840701f43ec2461acf5edc4914336ab
6c9d1697011b0c4a04902ee4f71ed38d49bf3be5afb3c10a8b96758e169c4145
6ddafbc321a2365019d527d58495a010a5dbe7b0790ff971c1c533e0de079ba9
6fb1ebf7d05d7235b6cff049056242de93930660c9e79677045fcb13942eb9b0
7313f3202672c68b87d4cf9d06bfc1e4f7f598f3fd7b2ac88c14b1725b6e9284
75e485d4939193b87d2c1fcb13b8a2c4a6e74efd10363dbf6bd462b0a8b65467
7761931c76f4b5ddc840305164dbc3d0e7007bc8eaa9e5f3a9b0f77abf320d26
78f0fa75221c9cb4b5aefc71f0762fabba0805ed79e349873d385ff8cb07be2b
7c00752ce82d6abaed0b9766d35b906b16675facdbe24115b410d1fab975effa
7d08e9159f7d2bf0835085cbd1ffb0252b0e11de45ed07db4447f8e63f181dbf
7d65ae8ac56b24bc044ecdfb0b54028621ad4c322efac68d2a4aa81edb8007d0
7f653b3ce9d3277457fc6da4edb246ae2f6c913f088c42dcb8cd2e96267aa21a
822183b6912f8ef43349d897aa66f65f840a059a488c1dae834f2e1b4d847c1c
8345f58fec20fd5cedad8cc2b2d437279b8efd362a7c0217b9e042a04e0208ff
86c1754a5162e5ff5b6c75c8708c5212e9628f93d5949a5f1c4f30053c4c38f9
87038e9753d96ab7638aba8f47ac23f504584e1a90bcd8750beca4536bb1b186
88f00438d26021a325247c4427898f7c778a22976df9f1a9d9876429778bf265
8c357781bf89d971e4aced299202c71c94eccae63401887400dd3a89d7f336e5
8d1b51a6bcf97a173884161816c19b753e0088a0926148482d8a1f371706c774
8e657c0ef1763965fb05ff2d31c111675fc2869e3b32b2cb09ba9a0dacc34c76
923e3009de4c32eb9cad94e6d350b077cb806a3bb02b31fb0595ef3adef0b35c
95fddf05b0a4211a795d0d4e3774dc4a865e624f845917dc5add7f4b45893edf
963611a5916c6de2cd9580b3ec43a961b9171c5d0fe8a7177181a8335924a88b
9a90398fe43db7f3effe146858ff7f8c16d1402a2d28090223edd0c50da27087
9eff412c1198930f1d219490894e17733ccd8b992e9ddb7546971f783c00431e
9f8c6a2819eac6c58810947b91f4478530193f6df053d0996c455661ca76d669
a174ce3d0e66cfea95ba4288c928291b37bd679f3044ac1a7f4dc3958036be11
a1dbbafdc3544cc1a9eafad30123a7da4f4dc92a9c282efea53821cb648a4aa3
a2da270bc79a1290e19d4eba107784f6587dfcf542e0a96f7efca31c1f1fb9df
adf99b2efdeab093d82cefceda180b764f99fbdb41d78442f8631e7e3dff0886
aec496e71ea6e5703c970e8e47b322e79d6e88a5b21d9c54ea02fb153650562f
af186659e415490e7eee1bd3c8d511771dbd3e03ddbebf6b6a5096ac8ba29449
b12df28928ae6402d9d672b356057877a9829fb5701e913e162c03774ab4cec7
b163003fc3dc866d9bd2facbf4d3ad0d33f3faa58cd5fb9737889c46f151a85b
b24220a1cbe811e074f353e3e39612513c31cf3cfdd51cda1d247e55dcf73611
b268937863e37505eb86ab385f49d8a4233a91ec0ffe7b4a57cf48629e5e2fac
bee5d8829e9cf6df09534f86d82c8cc2c2cb533463bd053ca52e6554222bef3d
c02253ec55f516b5e6d6e9bdad89d0fb193dd36e7c9ea1db8b849f02c7941759
c0e93b5ebf107af77d9e7d101d186b3b93e9d5ad4fbb6a74e2dea60173cc04f8
c1c30918a861cb6a985ab55d54ad7e861682354197f164cb3b7194f20eed67ac
c3413729373769431562e4c111825dcfaae274e3fff8bb73a9c368486168345b
c41211d42b7dadb793e39e8ad877e5f76645c7ea200e25625ebbddc050df0c4b
c671e170afd2025838a074ebdc63ac3ac8822cbdf102651f813a6ac49a357e66
c7c8d60039d7921710eea8eb6008659defc6b9a7b332dd3e34a53d61d3c3f769
ca5ee39ab86fb6225cb8071038c46f17f032043f2b3472bec0ff4c63a8d456a0
cca55783947aa901ce0ea1dd5bb95db0642eedd9b94646b5bf3581b2563d6556
cccb8b1d9d06718fb877a63e6eb7c122361ea0bd4efaa5615f2e2a329e4dc3a3
cdf3f88beb166e98d2656e957b247c886d1702027559a290e74a02d58d950c8c
d3ddd29db765914b449b4573e5a3c24e1982838d9f55befd894cb73333f8149a
d4b66a62cc3561450a099afc2a59321b0f7ac23a0e4c9ad6c11d78b68debebc4
d6c0efac1552cf9ce1e72037bb4c380f60df0006b661c630905629d7cd6a99ff
d7d5e54ad1e33d7ab49c664323ced79cb9723ff15e9764cd0edc3e15208e8336
daacb651039d6a470a0c6ece531e838d3b9eb9c5a2ff2f966a2495cb7bcde14e
df8af7ec931befc8ef9048a7a2cbcd041376d93839f8edc45c65a48d34af7039
e0808e40b97ef765f6cb946aaf1b816cec41aa339c1b841e64aa32413276383d
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ec7c4c90e31092c6253cddb718655a1e3ac5f4f83425b1e16d54b25ff80f263f
ee147e859ad0f09aa50367974e38ab53e7c7054c4a51d400a7f45b0eb251454f
eed0dc1fdb5d97ed188ae16fd5e1024a5bb744af47340346be2146300a6c54b9
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1
f9be1a2a5f709f1eae59ec9e12dfd874254bca56d23cb9e71f4c18988fa0975b

pentestlaboratories.com Open in urlscan Pro 192.0.78.25 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

91 Requests

98 %HTTPS

56 %IPv6

12 Domains

22 Subdomains

18 IPs

3 Countries

1870 kBTransfer

5085 kBSize

2 Cookies

43 Outgoing links

Page URL History

Redirected requests

91 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 4 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

pentestlaboratories.com Open in urlscan Pro
192.0.78.25 Public Scan

Screenshot
Live screenshot

Full Image

91
Requests

98 %
HTTPS

56 %
IPv6

12
Domains

22
Subdomains

18
IPs

3
Countries

1870 kB
Transfer

5085 kB
Size

2
Cookies

91 HTTP transactions
4 data transactions