URL: https://labs.integrity.pt/advisories/cve-2022-37720/
Submission: On December 06 via api from US — Scanned from DE

Summary

This website contacted 4 IPs in 2 countries across 3 domains to perform 15 HTTP transactions. The main IP is 34.251.15.206, located in Dublin, Ireland and belongs to AMAZON-02, US. The main domain is labs.integrity.pt.
TLS certificate: Issued by Amazon on May 31st 2022. Valid for: a year.
This is the only time labs.integrity.pt was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
11 34.251.15.206 16509 (AMAZON-02)
1 2a00:1450:400... 15169 (GOOGLE)
3 2a00:1450:400... 15169 (GOOGLE)
15 4
Apex Domain
Subdomains
Transfer
11 integrity.pt
labs.integrity.pt
263 KB
3 gstatic.com
fonts.gstatic.com
41 KB
1 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 51
13 KB
15 3
Domain Requested by
11 labs.integrity.pt labs.integrity.pt
3 fonts.gstatic.com fonts.googleapis.com
1 fonts.googleapis.com labs.integrity.pt
15 3

This site contains links to these domains. Also see Links.

Domain
github.com
www.integrity.pt
www.linkedin.com
www.youtube.com
Subject Issuer Validity Valid
*.integrity.pt
Amazon
2022-05-31 -
2023-06-29
a year crt.sh
upload.video.google.com
GTS CA 1C3
2022-11-02 -
2023-01-25
3 months crt.sh
*.gstatic.com
GTS CA 1C3
2022-11-02 -
2023-01-25
3 months crt.sh

This page contains 1 frames:

Primary Page: https://labs.integrity.pt/advisories/cve-2022-37720/
Frame ID: 48F62EDCC4F53E4D9ADD707FFAE0FD9D
Requests: 16 HTTP requests in this frame

Screenshot

Page Title

CVE-2022-37720 - Stored Cross-Site Scripting in OrchardCMS | INTEGRITY Labs

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
  • <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
  • (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

15
Requests

100 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

4
IPs

2
Countries

317 kB
Transfer

658 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

15 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
labs.integrity.pt/advisories/cve-2022-37720/
16 KB
5 KB
Document
General
Full URL
https://labs.integrity.pt/advisories/cve-2022-37720/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.251.15.206 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-251-15-206.eu-west-1.compute.amazonaws.com
Software
null /
Resource Hash
6214c86c4fca278eb74ed0cd4f6901eee29d10deaf2815b67421a3c604735c13
Security Headers
Name Value
Content-Security-Policy default-src 'self'; script-src 'self' https://www.google-analytics.com 'unsafe-inline'; connect-src 'self' https://www.google-analytics.com/; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com/; frame-src 'self'; img-src 'self' https://www.google-analytics.com data: blob:; font-src 'self' data: 'unsafe-inline' https://fonts.gstatic.com/; media-src 'self' https://videos.integrity.pt;
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.94 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ranges
bytes
cache-control
max-age=60, must-revalidate
content-encoding
gzip
content-length
4635
content-security-policy
default-src 'self'; script-src 'self' https://www.google-analytics.com 'unsafe-inline'; connect-src 'self' https://www.google-analytics.com/; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com/; frame-src 'self'; img-src 'self' https://www.google-analytics.com data: blob:; font-src 'self' data: 'unsafe-inline' https://fonts.gstatic.com/; media-src 'self' https://videos.integrity.pt;
content-type
text/html
date
Tue, 06 Dec 2022 00:01:32 GMT
etag
"2016207661"
frame-options
SAMEORIGIN
last-modified
Wed, 23 Nov 2022 17:53:44 GMT
referrer-policy
origin-when-cross-origin
server
null
strict-transport-security
max-age=31536000
vary
Accept-Encoding
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-xss-protection
1; mode=block
css2
fonts.googleapis.com/
52 KB
13 KB
Stylesheet
General
Full URL
https://fonts.googleapis.com/css2?family=Gugi&family=Red+Hat+Mono:wght@400;500&display=swap
Requested by
Host: labs.integrity.pt
URL: https://labs.integrity.pt/advisories/cve-2022-37720/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
c151fa4b514d32163a3047a225d432c937d28b40f1fde074e6308a10bd474f9e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://labs.integrity.pt/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.94 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Tue, 06 Dec 2022 00:01:32 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Tue, 06 Dec 2022 00:01:32 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Tue, 06 Dec 2022 00:01:32 GMT
bootstrap.min.css
labs.integrity.pt/assets/css/
161 KB
24 KB
Stylesheet
General
Full URL
https://labs.integrity.pt/assets/css/bootstrap.min.css
Requested by
Host: labs.integrity.pt
URL: https://labs.integrity.pt/advisories/cve-2022-37720/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.251.15.206 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-251-15-206.eu-west-1.compute.amazonaws.com
Software
null /
Resource Hash
a535ac470f0701cf77bd0217692e77c6401ad9a35e62bebab062ff76060be302
Security Headers
Name Value
Content-Security-Policy default-src 'self'; script-src 'self' https://www.google-analytics.com 'unsafe-inline'; connect-src 'self' https://www.google-analytics.com/; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com/; frame-src 'self'; img-src 'self' https://www.google-analytics.com data: blob:; font-src 'self' data: 'unsafe-inline' https://fonts.gstatic.com/; media-src 'self' https://videos.integrity.pt;
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://labs.integrity.pt/advisories/cve-2022-37720/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.94 Safari/537.36

Response headers

date
Tue, 06 Dec 2022 00:01:32 GMT
strict-transport-security
max-age=31536000
x-content-type-options
nosniff
frame-options
SAMEORIGIN
content-encoding
gzip
content-security-policy
default-src 'self'; script-src 'self' https://www.google-analytics.com 'unsafe-inline'; connect-src 'self' https://www.google-analytics.com/; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com/; frame-src 'self'; img-src 'self' https://www.google-analytics.com data: blob:; font-src 'self' data: 'unsafe-inline' https://fonts.gstatic.com/; media-src 'self' https://videos.integrity.pt;
content-length
23918
x-xss-protection
1; mode=block
referrer-policy
origin-when-cross-origin
last-modified
Wed, 23 Nov 2022 17:54:42 GMT
server
null
etag
"979570584"
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
content-type
text/css; charset=utf-8
cache-control
max-age=60, must-revalidate
accept-ranges
bytes
font-awesome.min.css
labs.integrity.pt/assets/css/
58 KB
13 KB
Stylesheet
General
Full URL
https://labs.integrity.pt/assets/css/font-awesome.min.css
Requested by
Host: labs.integrity.pt
URL: https://labs.integrity.pt/advisories/cve-2022-37720/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.251.15.206 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-251-15-206.eu-west-1.compute.amazonaws.com
Software
null /
Resource Hash
f19a9fd07af2f1663239f35205055dab6d49e4725abd107b6a34278566538998
Security Headers
Name Value
Content-Security-Policy default-src 'self'; script-src 'self' https://www.google-analytics.com 'unsafe-inline'; connect-src 'self' https://www.google-analytics.com/; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com/; frame-src 'self'; img-src 'self' https://www.google-analytics.com data: blob:; font-src 'self' data: 'unsafe-inline' https://fonts.gstatic.com/; media-src 'self' https://videos.integrity.pt;
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://labs.integrity.pt/advisories/cve-2022-37720/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.94 Safari/537.36

Response headers

date
Tue, 06 Dec 2022 00:01:32 GMT
strict-transport-security
max-age=31536000
x-content-type-options
nosniff
frame-options
SAMEORIGIN
content-encoding
gzip
content-security-policy
default-src 'self'; script-src 'self' https://www.google-analytics.com 'unsafe-inline'; connect-src 'self' https://www.google-analytics.com/; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com/; frame-src 'self'; img-src 'self' https://www.google-analytics.com data: blob:; font-src 'self' data: 'unsafe-inline' https://fonts.gstatic.com/; media-src 'self' https://videos.integrity.pt;
content-length
12867
x-xss-protection
1; mode=block
referrer-policy
origin-when-cross-origin
last-modified
Wed, 23 Nov 2022 17:54:42 GMT
server
null
etag
"2379999650"
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
content-type
text/css; charset=utf-8
cache-control
max-age=60, must-revalidate
accept-ranges
bytes
main.css
labs.integrity.pt/assets/
3 KB
2 KB
Stylesheet
General
Full URL
https://labs.integrity.pt/assets/main.css
Requested by
Host: labs.integrity.pt
URL: https://labs.integrity.pt/advisories/cve-2022-37720/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.251.15.206 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-251-15-206.eu-west-1.compute.amazonaws.com
Software
null /
Resource Hash
9b4d8a9301f09a353eed5163627df10178bf8cb830f3b95b87706619deb87b0c
Security Headers
Name Value
Content-Security-Policy default-src 'self'; script-src 'self' https://www.google-analytics.com 'unsafe-inline'; connect-src 'self' https://www.google-analytics.com/; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com/; frame-src 'self'; img-src 'self' https://www.google-analytics.com data: blob:; font-src 'self' data: 'unsafe-inline' https://fonts.gstatic.com/; media-src 'self' https://videos.integrity.pt;
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://labs.integrity.pt/advisories/cve-2022-37720/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.94 Safari/537.36

Response headers

date
Tue, 06 Dec 2022 00:01:32 GMT
strict-transport-security
max-age=31536000
x-content-type-options
nosniff
frame-options
SAMEORIGIN
content-encoding
gzip
content-security-policy
default-src 'self'; script-src 'self' https://www.google-analytics.com 'unsafe-inline'; connect-src 'self' https://www.google-analytics.com/; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com/; frame-src 'self'; img-src 'self' https://www.google-analytics.com data: blob:; font-src 'self' data: 'unsafe-inline' https://fonts.gstatic.com/; media-src 'self' https://videos.integrity.pt;
content-length
1007
x-xss-protection
1; mode=block
referrer-policy
origin-when-cross-origin
last-modified
Wed, 23 Nov 2022 17:54:41 GMT
server
null
etag
"3084319425"
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
content-type
text/css; charset=utf-8
cache-control
max-age=60, must-revalidate
accept-ranges
bytes
logo-black.svg
labs.integrity.pt/images/
10 KB
10 KB
Image
General
Full URL
https://labs.integrity.pt/images/logo-black.svg
Requested by
Host: labs.integrity.pt
URL: https://labs.integrity.pt/advisories/cve-2022-37720/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.251.15.206 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-251-15-206.eu-west-1.compute.amazonaws.com
Software
null /
Resource Hash
872a466a84a9a9c88e44fa519f53f6f1c43931580b9e061043629a7c002e696e
Security Headers
Name Value
Content-Security-Policy default-src 'self'; script-src 'self' https://www.google-analytics.com 'unsafe-inline'; connect-src 'self' https://www.google-analytics.com/; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com/; frame-src 'self'; img-src 'self' https://www.google-analytics.com data: blob:; font-src 'self' data: 'unsafe-inline' https://fonts.gstatic.com/; media-src 'self' https://videos.integrity.pt;
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://labs.integrity.pt/advisories/cve-2022-37720/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.94 Safari/537.36

Response headers

date
Tue, 06 Dec 2022 00:01:32 GMT
strict-transport-security
max-age=31536000
x-content-type-options
nosniff
frame-options
SAMEORIGIN
last-modified
Wed, 22 Dec 2021 10:02:43 GMT
referrer-policy
origin-when-cross-origin
content-security-policy
default-src 'self'; script-src 'self' https://www.google-analytics.com 'unsafe-inline'; connect-src 'self' https://www.google-analytics.com/; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com/; frame-src 'self'; img-src 'self' https://www.google-analytics.com data: blob:; font-src 'self' data: 'unsafe-inline' https://fonts.gstatic.com/; media-src 'self' https://videos.integrity.pt;
server
null
etag
"4261633358"
x-frame-options
SAMEORIGIN
content-type
image/svg+xml
cache-control
max-age=60, must-revalidate
accept-ranges
bytes
content-length
9748
x-xss-protection
1; mode=block
jquery-3.6.0.min.js
labs.integrity.pt/assets/js/
87 KB
31 KB
Script
General
Full URL
https://labs.integrity.pt/assets/js/jquery-3.6.0.min.js
Requested by
Host: labs.integrity.pt
URL: https://labs.integrity.pt/advisories/cve-2022-37720/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.251.15.206 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-251-15-206.eu-west-1.compute.amazonaws.com
Software
null /
Resource Hash
52914962d50676f6088820a088f55a326d0b733f05ef6f5c358256f5d09388ca
Security Headers
Name Value
Content-Security-Policy default-src 'self'; script-src 'self' https://www.google-analytics.com 'unsafe-inline'; connect-src 'self' https://www.google-analytics.com/; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com/; frame-src 'self'; img-src 'self' https://www.google-analytics.com data: blob:; font-src 'self' data: 'unsafe-inline' https://fonts.gstatic.com/; media-src 'self' https://videos.integrity.pt;
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://labs.integrity.pt/advisories/cve-2022-37720/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.94 Safari/537.36

Response headers

date
Tue, 06 Dec 2022 00:01:32 GMT
strict-transport-security
max-age=31536000
x-content-type-options
nosniff
frame-options
SAMEORIGIN
content-encoding
gzip
content-security-policy
default-src 'self'; script-src 'self' https://www.google-analytics.com 'unsafe-inline'; connect-src 'self' https://www.google-analytics.com/; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com/; frame-src 'self'; img-src 'self' https://www.google-analytics.com data: blob:; font-src 'self' data: 'unsafe-inline' https://fonts.gstatic.com/; media-src 'self' https://videos.integrity.pt;
content-length
30887
x-xss-protection
1; mode=block
referrer-policy
origin-when-cross-origin
last-modified
Wed, 23 Nov 2022 17:54:40 GMT
server
null
etag
"2161898106"
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=60, must-revalidate
accept-ranges
bytes
bootstrap.bundle.min.js
labs.integrity.pt/assets/js/
76 KB
23 KB
Script
General
Full URL
https://labs.integrity.pt/assets/js/bootstrap.bundle.min.js
Requested by
Host: labs.integrity.pt
URL: https://labs.integrity.pt/advisories/cve-2022-37720/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.251.15.206 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-251-15-206.eu-west-1.compute.amazonaws.com
Software
null /
Resource Hash
f5210fa3e7f0245a4c51eb7f280092c0ef99fdd28c45e17dab8cc5854fdf4fd3
Security Headers
Name Value
Content-Security-Policy default-src 'self'; script-src 'self' https://www.google-analytics.com 'unsafe-inline'; connect-src 'self' https://www.google-analytics.com/; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com/; frame-src 'self'; img-src 'self' https://www.google-analytics.com data: blob:; font-src 'self' data: 'unsafe-inline' https://fonts.gstatic.com/; media-src 'self' https://videos.integrity.pt;
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://labs.integrity.pt/advisories/cve-2022-37720/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.94 Safari/537.36

Response headers

date
Tue, 06 Dec 2022 00:01:32 GMT
strict-transport-security
max-age=31536000
x-content-type-options
nosniff
frame-options
SAMEORIGIN
content-encoding
gzip
content-security-policy
default-src 'self'; script-src 'self' https://www.google-analytics.com 'unsafe-inline'; connect-src 'self' https://www.google-analytics.com/; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com/; frame-src 'self'; img-src 'self' https://www.google-analytics.com data: blob:; font-src 'self' data: 'unsafe-inline' https://fonts.gstatic.com/; media-src 'self' https://videos.integrity.pt;
content-length
23051
x-xss-protection
1; mode=block
referrer-policy
origin-when-cross-origin
last-modified
Wed, 22 Dec 2021 10:02:39 GMT
server
null
etag
"3359313280"
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=60, must-revalidate
accept-ranges
bytes
switch.js
labs.integrity.pt/assets/js/
3 KB
2 KB
Script
General
Full URL
https://labs.integrity.pt/assets/js/switch.js
Requested by
Host: labs.integrity.pt
URL: https://labs.integrity.pt/advisories/cve-2022-37720/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.251.15.206 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-251-15-206.eu-west-1.compute.amazonaws.com
Software
null /
Resource Hash
9565417850d35f0e6d26f7e5d66a226b9480f79f345f2d961b6e235afd0a8380
Security Headers
Name Value
Content-Security-Policy default-src 'self'; script-src 'self' https://www.google-analytics.com 'unsafe-inline'; connect-src 'self' https://www.google-analytics.com/; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com/; frame-src 'self'; img-src 'self' https://www.google-analytics.com data: blob:; font-src 'self' data: 'unsafe-inline' https://fonts.gstatic.com/; media-src 'self' https://videos.integrity.pt;
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://labs.integrity.pt/advisories/cve-2022-37720/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.94 Safari/537.36

Response headers

date
Tue, 06 Dec 2022 00:01:32 GMT
strict-transport-security
max-age=31536000
x-content-type-options
nosniff
frame-options
SAMEORIGIN
content-encoding
gzip
content-security-policy
default-src 'self'; script-src 'self' https://www.google-analytics.com 'unsafe-inline'; connect-src 'self' https://www.google-analytics.com/; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com/; frame-src 'self'; img-src 'self' https://www.google-analytics.com data: blob:; font-src 'self' data: 'unsafe-inline' https://fonts.gstatic.com/; media-src 'self' https://videos.integrity.pt;
content-length
868
x-xss-protection
1; mode=block
referrer-policy
origin-when-cross-origin
last-modified
Wed, 22 Dec 2021 10:02:39 GMT
server
null
etag
"2397244364"
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=60, must-revalidate
accept-ranges
bytes
main.js
labs.integrity.pt/assets/js/
175 B
832 B
Script
General
Full URL
https://labs.integrity.pt/assets/js/main.js
Requested by
Host: labs.integrity.pt
URL: https://labs.integrity.pt/advisories/cve-2022-37720/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.251.15.206 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-251-15-206.eu-west-1.compute.amazonaws.com
Software
null /
Resource Hash
904974b11f00d5cd6bd5131dcea0316f831f32858e39d7a09374acce3d78b01a
Security Headers
Name Value
Content-Security-Policy default-src 'self'; script-src 'self' https://www.google-analytics.com 'unsafe-inline'; connect-src 'self' https://www.google-analytics.com/; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com/; frame-src 'self'; img-src 'self' https://www.google-analytics.com data: blob:; font-src 'self' data: 'unsafe-inline' https://fonts.gstatic.com/; media-src 'self' https://videos.integrity.pt;
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://labs.integrity.pt/advisories/cve-2022-37720/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.94 Safari/537.36

Response headers

date
Tue, 06 Dec 2022 00:01:32 GMT
strict-transport-security
max-age=31536000
x-content-type-options
nosniff
frame-options
SAMEORIGIN
last-modified
Wed, 23 Nov 2022 17:54:37 GMT
referrer-policy
origin-when-cross-origin
content-security-policy
default-src 'self'; script-src 'self' https://www.google-analytics.com 'unsafe-inline'; connect-src 'self' https://www.google-analytics.com/; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com/; frame-src 'self'; img-src 'self' https://www.google-analytics.com data: blob:; font-src 'self' data: 'unsafe-inline' https://fonts.gstatic.com/; media-src 'self' https://videos.integrity.pt;
server
null
etag
"1124230353"
x-frame-options
SAMEORIGIN
content-type
application/javascript
cache-control
max-age=60, must-revalidate
accept-ranges
bytes
content-length
175
x-xss-protection
1; mode=block
truncated
/
108 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
8f27b2160255b0a3bbe960f0af6a1772a8514e2b3ba0acbeea1e622ebb5f3e4a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://labs.integrity.pt/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.94 Safari/537.36

Response headers

Content-Type
image/svg+xml
A2BVn5dXywshVAvo4jMQ8c2HNvL_56t4zTCEuE6pbA.119.woff2
fonts.gstatic.com/s/gugi/v13/
9 KB
9 KB
Font
General
Full URL
https://fonts.gstatic.com/s/gugi/v13/A2BVn5dXywshVAvo4jMQ8c2HNvL_56t4zTCEuE6pbA.119.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Gugi&family=Red+Hat+Mono:wght@400;500&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f8323d65f8a210afa590db3c0384294ee096519c791a609042bf89899019721d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://labs.integrity.pt
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.94 Safari/537.36

Response headers

date
Fri, 02 Dec 2022 01:48:14 GMT
x-content-type-options
nosniff
age
339198
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
8908
x-xss-protection
0
last-modified
Thu, 21 Apr 2022 16:52:50 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sat, 02 Dec 2023 01:48:14 GMT
jVyN7nDnA2uf2zVvFAhhzEsUWOxS.woff2
fonts.gstatic.com/s/redhatmono/v10/
21 KB
21 KB
Font
General
Full URL
https://fonts.gstatic.com/s/redhatmono/v10/jVyN7nDnA2uf2zVvFAhhzEsUWOxS.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Gugi&family=Red+Hat+Mono:wght@400;500&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
faf8db01f840cc3722c80c1fe9f1061de28175042644ced80c6229388522d1f7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://labs.integrity.pt
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.94 Safari/537.36

Response headers

date
Tue, 29 Nov 2022 05:01:59 GMT
x-content-type-options
nosniff
age
586773
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
21336
x-xss-protection
0
last-modified
Mon, 15 Aug 2022 18:17:16 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 29 Nov 2023 05:01:59 GMT
fa-solid-900.woff2
labs.integrity.pt/assets/webfonts/
76 KB
77 KB
Font
General
Full URL
https://labs.integrity.pt/assets/webfonts/fa-solid-900.woff2
Requested by
Host: labs.integrity.pt
URL: https://labs.integrity.pt/assets/css/font-awesome.min.css
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.251.15.206 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-251-15-206.eu-west-1.compute.amazonaws.com
Software
null /
Resource Hash
d0b4256abed72481585662971262eabee345c19f837af00d7ce24239d3b40eef
Security Headers
Name Value
Content-Security-Policy default-src 'self'; script-src 'self' https://www.google-analytics.com 'unsafe-inline'; connect-src 'self' https://www.google-analytics.com/; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com/; frame-src 'self'; img-src 'self' https://www.google-analytics.com data: blob:; font-src 'self' data: 'unsafe-inline' https://fonts.gstatic.com/; media-src 'self' https://videos.integrity.pt;
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://labs.integrity.pt/assets/css/font-awesome.min.css
Origin
https://labs.integrity.pt
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.94 Safari/537.36

Response headers

date
Tue, 06 Dec 2022 00:01:32 GMT
strict-transport-security
max-age=31536000
x-content-type-options
nosniff
frame-options
SAMEORIGIN
last-modified
Wed, 22 Dec 2021 10:02:39 GMT
referrer-policy
origin-when-cross-origin
content-security-policy
default-src 'self'; script-src 'self' https://www.google-analytics.com 'unsafe-inline'; connect-src 'self' https://www.google-analytics.com/; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com/; frame-src 'self'; img-src 'self' https://www.google-analytics.com data: blob:; font-src 'self' data: 'unsafe-inline' https://fonts.gstatic.com/; media-src 'self' https://videos.integrity.pt;
server
null
etag
"2822442373"
x-frame-options
SAMEORIGIN
content-type
font/woff2
cache-control
max-age=60, must-revalidate
accept-ranges
bytes
content-length
78196
x-xss-protection
1; mode=block
fa-brands-400.woff2
labs.integrity.pt/assets/webfonts/
75 KB
76 KB
Font
General
Full URL
https://labs.integrity.pt/assets/webfonts/fa-brands-400.woff2
Requested by
Host: labs.integrity.pt
URL: https://labs.integrity.pt/assets/css/font-awesome.min.css
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.251.15.206 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-251-15-206.eu-west-1.compute.amazonaws.com
Software
null /
Resource Hash
43c072c16c9ee6d67acdfa6c6d6685ff1e74eb4237b7cc3c1348ab1c108b26af
Security Headers
Name Value
Content-Security-Policy default-src 'self'; script-src 'self' https://www.google-analytics.com 'unsafe-inline'; connect-src 'self' https://www.google-analytics.com/; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com/; frame-src 'self'; img-src 'self' https://www.google-analytics.com data: blob:; font-src 'self' data: 'unsafe-inline' https://fonts.gstatic.com/; media-src 'self' https://videos.integrity.pt;
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://labs.integrity.pt/assets/css/font-awesome.min.css
Origin
https://labs.integrity.pt
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.94 Safari/537.36

Response headers

date
Tue, 06 Dec 2022 00:01:32 GMT
strict-transport-security
max-age=31536000
x-content-type-options
nosniff
frame-options
SAMEORIGIN
last-modified
Wed, 22 Dec 2021 10:02:39 GMT
referrer-policy
origin-when-cross-origin
content-security-policy
default-src 'self'; script-src 'self' https://www.google-analytics.com 'unsafe-inline'; connect-src 'self' https://www.google-analytics.com/; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com/; frame-src 'self'; img-src 'self' https://www.google-analytics.com data: blob:; font-src 'self' data: 'unsafe-inline' https://fonts.gstatic.com/; media-src 'self' https://videos.integrity.pt;
server
null
etag
"2822470671"
x-frame-options
SAMEORIGIN
content-type
font/woff2
cache-control
max-age=60, must-revalidate
accept-ranges
bytes
content-length
76764
x-xss-protection
1; mode=block
A2BVn5dXywshVAvo4jMQ8c2HNvL_56t4zTCEuE6pbA.118.woff2
fonts.gstatic.com/s/gugi/v13/
11 KB
11 KB
Font
General
Full URL
https://fonts.gstatic.com/s/gugi/v13/A2BVn5dXywshVAvo4jMQ8c2HNvL_56t4zTCEuE6pbA.118.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Gugi&family=Red+Hat+Mono:wght@400;500&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
b5cf8222cc29efa056a9a94f4428040d102f0781f1fa4b46b5c36139d5bfb467
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://labs.integrity.pt
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.94 Safari/537.36

Response headers

date
Sat, 03 Dec 2022 03:50:37 GMT
x-content-type-options
nosniff
age
245455
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
10792
x-xss-protection
0
last-modified
Thu, 21 Apr 2022 16:59:04 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 03 Dec 2023 03:50:37 GMT

Verdicts & Comments Add Verdict or Comment

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontentvisibilityautostatechange function| $ function| jQuery number| uidEvent object| bootstrap string| cookieName string| cookieValue number| cookieExpireDays

0 Cookies

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy default-src 'self'; script-src 'self' https://www.google-analytics.com 'unsafe-inline'; connect-src 'self' https://www.google-analytics.com/; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com/; frame-src 'self'; img-src 'self' https://www.google-analytics.com data: blob:; font-src 'self' data: 'unsafe-inline' https://fonts.gstatic.com/; media-src 'self' https://videos.integrity.pt;
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block