bishopfox.com Open in urlscan Pro
2606:4700:20::ac43:532a Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui
Effective URL:
https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui
Submission: On November 30 via api (November 30th 2024, 12:16:38 am UTC) from BG — Scanned from DE

Summary HTTP 106 Redirects Links 35 Behaviour Indicators

Summary

This website contacted 35 IPs in 4 countries across 25 domains to perform 106 HTTP transactions. The main IP is 2606:4700:20::ac43:532a, located in United States and belongs to CLOUDFLARENET, US. The main domain is bishopfox.com.
TLS certificate: Issued by WE1 on November 25th 2024. Valid for: 3 months.

This is the only time bishopfox.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
8	2606:4700:20:... 2606:4700:20::ac43:532a	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	104.17.24.14 104.17.24.14	13335 (CLOUDFLAR...) (CLOUDFLARENET)
5	152.195.15.58 152.195.15.58	15133 (EDGECAST) (EDGECAST)
6	2600:9000:20e... 2600:9000:20eb:3000:16:ce50:9480:93a1	16509 (AMAZON-02) (AMAZON-02)
2	2a00:1450:400... 2a00:1450:4001:831::2008	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:809::200e	15169 (GOOGLE) (GOOGLE)
9	104.17.73.206 104.17.73.206	13335 (CLOUDFLAR...) (CLOUDFLARENET)
26	95.101.111.170 95.101.111.170	20940 (AKAMAI-AS...) (AKAMAI-ASN1 Akamai International B.V.)
1	2a02:26f0:480... 2a02:26f0:480:15::213:7e4a	20940 (AKAMAI-AS...) (AKAMAI-ASN1 Akamai International B.V.)
1	13.32.27.15 13.32.27.15	16509 (AMAZON-02) (AMAZON-02)
3	2a04:4e42:200... 2a04:4e42:200::396	54113 (FASTLY) (FASTLY)
2	104.102.43.106 104.102.43.106	16625 (AKAMAI-AS) (AKAMAI-AS)
1	2a04:4e42:200... 2a04:4e42:200::644	54113 (FASTLY) (FASTLY)
1	3.160.150.119 3.160.150.119	16509 (AMAZON-02) (AMAZON-02)
5	2a02:26f0:480... 2a02:26f0:480:980::1e80	20940 (AKAMAI-AS...) (AKAMAI-ASN1 Akamai International B.V.)
1	142.250.184.232 142.250.184.232	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:827::200e	15169 (GOOGLE) (GOOGLE)
1	151.101.65.140 151.101.65.140	54113 (FASTLY) (FASTLY)
2	2001:4860:480... 2001:4860:4802:34::36	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:400c:c06::9b	15169 (GOOGLE) (GOOGLE)
1	216.58.206.67 216.58.206.67	15169 (GOOGLE) (GOOGLE)
2	2a02:26f0:480... 2a02:26f0:480:23::1726:629c	20940 (AKAMAI-AS...) (AKAMAI-ASN1 Akamai International B.V.)
1 3	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	13.107.42.14 13.107.42.14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	13.33.187.92 13.33.187.92	16509 (AMAZON-02) (AMAZON-02)
1	23.22.90.252 23.22.90.252	14618 (AMAZON-AES) (AMAZON-AES)
1	18.66.112.79 18.66.112.79	16509 (AMAZON-02) (AMAZON-02)
1	192.28.147.68 192.28.147.68	15224 (OMNITURE) (OMNITURE)
3	75.2.108.141 75.2.108.141	16509 (AMAZON-02) (AMAZON-02)
1	37.252.172.123 37.252.172.123	29990 (ASN-APPNEX) (ASN-APPNEX)
2	13.35.58.85 13.35.58.85	16509 (AMAZON-02) (AMAZON-02)
4	20.186.185.227 20.186.185.227	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
3	2a02:26f0:480... 2a02:26f0:480:f::213:7ec6	20940 (AKAMAI-AS...) (AKAMAI-ASN1 Akamai International B.V.)
1	2a02:26f0:480... 2a02:26f0:480:f::213:7edb	20940 (AKAMAI-AS...) (AKAMAI-ASN1 Akamai International B.V.)
106	35

8 2606:4700:20::ac43:532a (United States)

ASN13335 (CLOUDFLARENET, US)

bishopfox.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.17.24.14 (None, )

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 152.195.15.58 (United States)

ASN15133 (EDGECAST, US)

cdn.bizible.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cdn.bizibly.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2600:9000:20eb:3000:16:ce50:9480:93a1 (United States)

ASN16509 (AMAZON-02, US)

assets.bishopfox.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:831::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:809::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.youtube.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 104.17.73.206 (None, )

ASN13335 (CLOUDFLARENET, US)

go.bishopfox.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

26 95.101.111.170 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL)
PTR: a95-101-111-170.deploy.static.akamaitechnologies.com

j.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
c.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
b.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:480:15::213:7e4a (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.32.27.15 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-27-15.fra56.r.cloudfront.net

static.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a04:4e42:200::396 (United States)

ASN54113 (FASTLY, US)

www.redditstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pixel-config.reddit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.102.43.106 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-102-43-106.deploy.static.akamaitechnologies.com

munchkin.marketo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:200::644 (United States)

ASN54113 (FASTLY, US)

fast.wistia.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.160.150.119 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-3-160-150-119.fra60.r.cloudfront.net

static.oktopost.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a02:26f0:480:980::1e80 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL)

assets.adoberesources.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.184.232 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s12-in-f8.1e100.net

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:827::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.youtube.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.65.140 (San Francisco, United States)

ASN54113 (FASTLY, US)

alb.reddit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2001:4860:4802:34::36 (United States)

ASN15169 (GOOGLE, US)

region1.analytics.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c06::9b (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 216.58.206.67 (United States)

ASN15169 (GOOGLE, US)
PTR: lhr35s11-in-f3.1e100.net

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:26f0:480:23::1726:629c (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL)

ipv6.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:1ec:21::14 (United States) 1 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.107.42.14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px4.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.33.187.92 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-33-187-92.fra60.r.cloudfront.net

script.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.22.90.252 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-23-22-90-252.compute-1.amazonaws.com

okt.to	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.66.112.79 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-112-79.fra56.r.cloudfront.net

vc.hotjar.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.28.147.68 (United States)

ASN15224 (OMNITURE, US)

136-utj-516.mktoresp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 75.2.108.141 (United States)

ASN16509 (AMAZON-02, US)
PTR: afe865822f884bb48.awsglobalaccelerator.com

eps.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 37.252.172.123 (Frankfurt am Main, Germany)

ASN29990 (ASN-APPNEX, US)
PTR: 868.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

secure.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 13.35.58.85 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-35-58-85.fra60.r.cloudfront.net

v.eps.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 20.186.185.227 (Boydton, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

hummingbirdwebsocket-va7.cloud.adobe.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a02:26f0:480:f::213:7ec6 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL)

use.typekit.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:480:f::213:7edb (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL)

p.typekit.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
33	6sc.co j.6sc.co — Cisco Umbrella Rank: 5557 c.6sc.co — Cisco Umbrella Rank: 6739 ipv6.6sc.co — Cisco Umbrella Rank: 5633 b.6sc.co — Cisco Umbrella Rank: 3603 eps.6sc.co — Cisco Umbrella Rank: 9024 v.eps.6sc.co — Cisco Umbrella Rank: 16220	32 KB
23	bishopfox.com bishopfox.com assets.bishopfox.com go.bishopfox.com	3 MB
5	adoberesources.net assets.adoberesources.net — Cisco Umbrella Rank: 49448	106 KB
4	typekit.net use.typekit.net — Cisco Umbrella Rank: 460 p.typekit.net — Cisco Umbrella Rank: 571	49 KB
4	adobe.io hummingbirdwebsocket-va7.cloud.adobe.io — Cisco Umbrella Rank: 50386	7 KB
4	linkedin.com 1 redirects px.ads.linkedin.com — Cisco Umbrella Rank: 333 px4.ads.linkedin.com — Cisco Umbrella Rank: 7032	2 KB
4	bizible.com cdn.bizible.com — Cisco Umbrella Rank: 9821	26 KB
3	youtube.com www.youtube.com — Cisco Umbrella Rank: 79	12 KB
3	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 39	229 KB
2	google.com region1.analytics.google.com — Cisco Umbrella Rank: 4108
2	reddit.com pixel-config.reddit.com — Cisco Umbrella Rank: 2010 alb.reddit.com — Cisco Umbrella Rank: 1418	761 B
2	marketo.net munchkin.marketo.net — Cisco Umbrella Rank: 3671	6 KB
2	redditstatic.com www.redditstatic.com — Cisco Umbrella Rank: 1095	13 KB
2	hotjar.com static.hotjar.com — Cisco Umbrella Rank: 888 script.hotjar.com — Cisco Umbrella Rank: 1185	61 KB
2	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 225	36 KB
1	adnxs.com secure.adnxs.com — Cisco Umbrella Rank: 495	697 B
1	mktoresp.com 136-utj-516.mktoresp.com	318 B
1	hotjar.io vc.hotjar.io — Cisco Umbrella Rank: 3181	231 B
1	okt.to okt.to — Cisco Umbrella Rank: 33982	100 B
1	google.de www.google.de — Cisco Umbrella Rank: 10745	63 B
1	doubleclick.net stats.g.doubleclick.net — Cisco Umbrella Rank: 135	543 B
1	oktopost.com static.oktopost.com — Cisco Umbrella Rank: 39581	4 KB
1	wistia.net fast.wistia.net — Cisco Umbrella Rank: 9224	144 KB
1	licdn.com snap.licdn.com — Cisco Umbrella Rank: 831	14 KB
1	bizibly.com cdn.bizibly.com — Cisco Umbrella Rank: 14108	204 B
106	25

	Domain	Requested by
21	b.6sc.co	bishopfox.com
9	go.bishopfox.com	bishopfox.com go.bishopfox.com
8	bishopfox.com	bishopfox.com
6	assets.bishopfox.com	bishopfox.com
5	assets.adoberesources.net	www.googletagmanager.com assets.adoberesources.net
4	hummingbirdwebsocket-va7.cloud.adobe.io	assets.adoberesources.net
4	cdn.bizible.com	bishopfox.com cdn.bizible.com
3	use.typekit.net	assets.adoberesources.net use.typekit.net
3	eps.6sc.co	cdn.bizible.com
3	px.ads.linkedin.com	1 redirects cdn.bizible.com
3	c.6sc.co	cdn.bizible.com
3	www.youtube.com	bishopfox.com www.googletagmanager.com www.youtube.com
3	www.googletagmanager.com	bishopfox.com www.googletagmanager.com
2	v.eps.6sc.co	cdn.bizible.com
2	ipv6.6sc.co	cdn.bizible.com
2	region1.analytics.google.com	www.googletagmanager.com
2	munchkin.marketo.net	bishopfox.com munchkin.marketo.net
2	www.redditstatic.com	www.googletagmanager.com cdn.bizible.com
2	j.6sc.co	www.googletagmanager.com bishopfox.com
2	cdnjs.cloudflare.com	bishopfox.com
1	p.typekit.net	use.typekit.net
1	secure.adnxs.com	cdn.bizible.com
1	136-utj-516.mktoresp.com	munchkin.marketo.net
1	vc.hotjar.io	cdn.bizible.com
1	okt.to	static.oktopost.com
1	script.hotjar.com	static.hotjar.com
1	px4.ads.linkedin.com	bishopfox.com
1	www.google.de	bishopfox.com
1	stats.g.doubleclick.net	www.googletagmanager.com
1	alb.reddit.com	bishopfox.com
1	pixel-config.reddit.com	cdn.bizible.com
1	static.oktopost.com	bishopfox.com
1	fast.wistia.net	bishopfox.com
1	static.hotjar.com	www.googletagmanager.com
1	snap.licdn.com	www.googletagmanager.com
1	cdn.bizibly.com	bishopfox.com
106	36

This site contains links to these domains. Also see Links.

Domain
www.facebook.com
twitter.com
www.linkedin.com
github.com
www.telerik.com
codewhitesec.blogspot.com
docs.microsoft.com
www.slideshare.net
www.blackhat.com
thewover.github.io
portswigger.net
docs.telerik.com
www.defense.gov
facebook.com
linkedin.com
youtube.com

Subject Issuer	Validity	Valid
bishopfox.com WE1	`2024-11-25` - `2025-02-23`	3 months	crt.sh
cdnjs.cloudflare.com WE1	`2024-11-26` - `2025-02-24`	3 months	crt.sh
io.bizible.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-06-07` - `2025-07-08`	a year	crt.sh
assets.bishopfox.com Amazon RSA 2048 M03	`2024-05-09` - `2025-06-07`	a year	crt.sh
*.google-analytics.com WR2	`2024-10-21` - `2025-01-13`	3 months	crt.sh
*.google.com WR2	`2024-10-21` - `2025-01-13`	3 months	crt.sh
go.bishopfox.com E6	`2024-10-20` - `2025-01-18`	3 months	crt.sh
6sc.co R10	`2024-09-23` - `2024-12-22`	3 months	crt.sh
snap.licdn.com DigiCert SHA2 Secure Server CA	`2023-12-13` - `2024-12-12`	a year	crt.sh
*.hotjar.com Amazon RSA 2048 M03	`2024-05-22` - `2025-06-20`	a year	crt.sh
www.redditstatic.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-10-06` - `2025-04-03`	6 months	crt.sh
*.marketo.net DigiCert TLS RSA SHA256 2020 CA1	`2024-10-22` - `2025-10-24`	a year	crt.sh
fast.wistia.net GlobalSign Atlas R3 DV TLS CA 2024 Q1	`2024-04-04` - `2025-05-06`	a year	crt.sh
*.oktopost.com Amazon RSA 2048 M02	`2024-07-29` - `2025-08-28`	a year	crt.sh
assets.adobedtm.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-07-09` - `2025-08-09`	a year	crt.sh
*.reddit.com DigiCert TLS RSA SHA256 2020 CA1	`2024-10-13` - `2025-04-11`	6 months	crt.sh
*.g.doubleclick.net WR2	`2024-10-21` - `2025-01-13`	3 months	crt.sh
*.google.de WR2	`2024-10-21` - `2025-01-13`	3 months	crt.sh
www.linkedin.com DigiCert SHA2 Secure Server CA	`2024-10-14` - `2025-04-14`	6 months	crt.sh
okt.to R11	`2024-11-01` - `2025-01-30`	3 months	crt.sh
*.hotjar.io Amazon ECDSA 256 M02	`2024-02-07` - `2025-03-08`	a year	crt.sh
*.mktoresp.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-08-15` - `2025-09-15`	a year	crt.sh
eps.6sc.co Amazon RSA 2048 M02	`2024-08-29` - `2025-09-27`	a year	crt.sh
*.adnxs.com GeoTrust ECC CA 2018	`2024-02-14` - `2025-03-16`	a year	crt.sh
v.eps.6sc.co Amazon RSA 2048 M03	`2024-09-06` - `2025-10-05`	a year	crt.sh
*.cloud.adobe.io DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-10-06` - `2025-01-04`	3 months	crt.sh
use.typekit.net DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-10-17` - `2025-11-17`	a year	crt.sh

This page contains 4 frames:

Primary Page: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui
Frame ID: 4475F14DE537135FF6F825ADB042D664
Requests: 98 HTTP requests in this frame

Frame: https://www.youtube.com/embed/--6PiuvBGAU
Frame ID: 5CA7AD920A9D4B311BD538C99BFA46E5
Requests: 1 HTTP requests in this frame

Frame: https://go.bishopfox.com/index.php/form/XDFrame
Frame ID: 60E2E023BA012D6651F5E68A2CEF935A
Requests: 2 HTTP requests in this frame

Frame: https://go.bishopfox.com/dtp-1.0.4.html
Frame ID: 0F0FE7A1756A965F182C4A664F11F27B
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

CVE-2019-18935: Remote Code Execution via Insecure… | Bishop Fox

Page URL History Show full URLs

http://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui HTTP 307
https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui Page URL

Detected technologies

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Highlight.js (Miscellaneous) Expand

Overall confidence: 100%
Detected patterns

/(?:([\d.])+/)?highlight(?:\.min)?\.js

Hotjar (Analytics) Expand

Overall confidence: 100%
Detected patterns

//static\.hotjar\.com/

Linkedin Insight Tag (Analytics) Expand

Overall confidence: 100%
Detected patterns

snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

Marketo (Marketing Automation) Expand

Overall confidence: 100%
Detected patterns

munchkin\.marketo\.\w+/(?:([\d.]+)/)?munchkin\.js

Page Statistics

106
Requests

97 %
HTTPS

44 %
IPv6

25
Domains

36
Subdomains

35
IPs

4
Countries

3616 kB
Transfer

6193 kB
Size

25
Cookies

35 Outgoing links

These are links going to different origins than the main page.

URL: https://www.facebook.com/share.php?u=https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui&utm_medium=social&utm_source=facebook

Search URL Search Domain Scan URL

URL: https://twitter.com/intent/tweet?url=https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui&utm_medium=social&utm_source=twitter&source=tweetbutton&text=

Search URL Search Domain Scan URL

URL: http://www.linkedin.com/shareArticle?mini=true&url=https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui&utm_medium=social&utm_source=linkedin

Search URL Search Domain Scan URL

URL: https://github.com/noperator/CVE-2019-18935
Title: CVE-2019-18935 GitHub repo

Search URL Search Domain Scan URL

URL: https://www.telerik.com/products/aspnet-ajax.aspx
Title: Telerik UI for ASP.NET AJAX

Search URL Search Domain Scan URL

URL: https://www.telerik.com/support/kb/aspnet-ajax/details/allows-javascriptserializer-deserialization
Title: security advisory for CVE-2019-18935

Search URL Search Domain Scan URL

URL: https://twitter.com/mwulftange
Title: @mwulftange

Search URL Search Domain Scan URL

URL: https://github.com/bao7uo
Title: (@bao7uo

Search URL Search Domain Scan URL

URL: https://github.com/straightblast/UnRadAsyncUpload/wiki
Title: @straightblast's write-up

Search URL Search Domain Scan URL

URL: https://www.telerik.com/support/kb/aspnet-ajax/upload-(async)/details/unrestricted-file-upload
Title: security advisory

Search URL Search Domain Scan URL

URL: https://codewhitesec.blogspot.com/2019/02/telerik-revisited.html
Title: took a closer look

Search URL Search Domain Scan URL

URL: https://docs.microsoft.com/en-us/dotnet/api/system.web.script.serialization.javascriptserializer.deserialize?view=netframework-4.8
Title: JavaScriptSerializer.Deserialize()

Search URL Search Domain Scan URL

URL: https://www.slideshare.net/frohoff1/appseccali-2015-marshalling-pickles
Title: gadget

Search URL Search Domain Scan URL

URL: https://docs.microsoft.com/en-us/dotnet/api/system.configuration.install.assemblyinstaller?view=netframework-4.8
Title: path

Search URL Search Domain Scan URL

URL: https://docs.microsoft.com/en-us/windows/win32/dlls/dllmain
Title: DDLMain()

Search URL Search Domain Scan URL

URL: https://www.blackhat.com/docs/us-17/thursday/us-17-Munoz-Friday-The-13th-JSON-Attacks-wp.pdf
Title: Friday the 13th JSON Attacks

Search URL Search Domain Scan URL

URL: https://docs.microsoft.com/en-us/cpp/dotnet/mixed-native-and-managed-assemblies?view=vs-2019
Title: mixed mode assembly

Search URL Search Domain Scan URL

URL: https://docs.microsoft.com/en-us/dotnet/standard/assembly/
Title: assembly

Search URL Search Domain Scan URL

URL: https://thewover.github.io/Introducing-Donut/
Title: article about injecting .NET assemblies

Search URL Search Domain Scan URL

URL: https://thewover.github.io/Mixed-Assemblies/
Title: mixed assemblies

Search URL Search Domain Scan URL

URL: https://www.telerik.com/support/whats-new/aspnet-ajax/release-history
Title: release history

Search URL Search Domain Scan URL

URL: https://portswigger.net/burp/documentation/desktop/functions/search
Title: search

Search URL Search Domain Scan URL

URL: https://github.com/bao7uo/RAU_crypto
Title: RAU_crypto

Search URL Search Domain Scan URL

URL: https://github.com/noperator/CVE-2019-18935/blob/master/sleep.c
Title: sleep.c

Search URL Search Domain Scan URL

URL: https://github.com/noperator/CVE-2019-18935/blob/master/CVE-2019-18935.py
Title: CVE-2019-18935.py

Search URL Search Domain Scan URL

URL: https://www.telerik.com/support/whats-new/aspnet-ajax/release-history/ui-for-asp-net-ajax-r3-2019-sp1-(version-2019-3-1023)
Title: R3 2019 SP1

Search URL Search Domain Scan URL

URL: https://docs.telerik.com/devtools/aspnet-ajax/controls/asyncupload/security
Title: RadAsyncUpload security guide

Search URL Search Domain Scan URL

URL: https://docs.telerik.com/devtools/aspnet-ajax/controls/asyncupload/security#recommended-settings
Title: recommended security settings

Search URL Search Domain Scan URL

URL: https://www.defense.gov/
Title: US Department of Defense

Search URL Search Domain Scan URL

URL: https://twitter.com/noperator

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/in/caleb-gross/

Search URL Search Domain Scan URL

URL: https://facebook.com/BishopFoxConsulting

Search URL Search Domain Scan URL

URL: https://twitter.com/bishopfox

Search URL Search Domain Scan URL

URL: https://linkedin.com/company/bishop-fox

Search URL Search Domain Scan URL

URL: https://youtube.com/c/Bishopfox

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui HTTP 307
https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 50

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=2404668&time=1732925792757&url=https%3A%2F%2Fbishopfox.com%2Fblog%2Fcve-2019-18935-remote-code-execution-in-telerik-ui&tm=gtmv2 HTTP 302
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=2404668&time=1732925792757&url=https%3A%2F%2Fbishopfox.com%2Fblog%2Fcve-2019-18935-remote-code-execution-in-telerik-ui&tm=gtmv2&e_ipv6=AQI5pxvgIKo3OAAAAZN6bSLBtGYj4R5IwJ6TmmSex5XhjSPE8jkZE3uhbm4Kt-Ru

106 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request cve-2019-18935-remote-code-execution-in-telerik-ui Show response
bishopfox.com/blog/
Redirect Chain

http://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui
https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui

220 KB
35 KB

71ms
28ms

Document
text/html

2606:4700:20::ac43:532a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:532a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

81f4d966b3823e18a9f948d189f763dce1325f94ecbd6df8282df67daeeab449

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

age: 183094
cache-control: max-age=14400
cf-apo-via: tcache
cf-cache-status: HIT
cf-ray: 8ea6a636fa27dc62-FRA
content-encoding: br
content-type: text/html; charset=UTF-8
date: Sat, 30 Nov 2024 00:16:31 GMT
last-modified: Wed, 27 Nov 2024 18:00:51 GMT
link: <https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui>; rel='canonical'
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: no-referrer-when-downgrade strict-origin-when-cross-origin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yZIii0wiXdTtFdaZkF6ZlE%2FfVAv2AlwogpkBM9Q%2FjCXRH4XQ85aD%2BHFNtv411fzhcOS%2F7pIe%2FGtVWFlHfDiU3g35ZrGrYi0hEt0Y8DZOgx84KuWBF9%2BpUe3bWLtOe0ejmC5WcrtKop%2FoHOM%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
server-timing: cfL4;desc="?proto=TCP&rtt=6332&min_rtt=6236&rtt_var=1060&sent=8&recv=12&lost=0&retrans=0&sent_bytes=4014&recv_bytes=2355&delivery_rate=616054&cwnd=251&unsent_bytes=0&cid=37b9743f00a41fe8&ts=34&x=0"
vary: Accept-Encoding
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-robots-tag: all
x-xss-protection: 1; mode=block

Redirect headers

Location: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui
Non-Authoritative-Reason: HttpsUpgrades

GET
H2 200 app.css
bishopfox.com/static/styles/ 70 KB
15 KB 20ms
18ms Stylesheet
text/css 2606:4700:20::ac43:532a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://bishopfox.com/static/styles/app.css?id=6ea5486134c2929e97b9

Requested by

Host: bishopfox.com
URL: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:532a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e73bc7b9895bd73f0e62e9654f6d01295c874f1a2a2011f741ed9c6ea9930c29

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"67114ea1-1194e"
age: 5410
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BqeH3SmX6tJPnSy6P8Pxd1VBpnKEi1vrLpob40tuqTQFBCKGTU2uIr0P9s9WMQYsCUBtDgPd16JYHV9h9MMRajtYpr9%2BDhUck71OTaBufeNrmEegl0juLswOwG9Ds2O%2B4nXDP8URCl0gFuA%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
server-timing: cfL4;desc="?proto=TCP&rtt=6333&min_rtt=6165&rtt_var=62&sent=102&recv=60&lost=0&retrans=0&sent_bytes=42040&recv_bytes=2778&delivery_rate=11999383&cwnd=301&unsent_bytes=0&cid=37b9743f00a41fe8&ts=79&x=0"
date: Sat, 30 Nov 2024 00:16:31 GMT
content-type: text/css
last-modified: Thu, 17 Oct 2024 17:51:29 GMT
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8ea6a6374a90dc62-FRA
x-xss-protection: 1; mode=block
server: cloudflare

GET
H2 200 main.js Show response
bishopfox.com/static/js/ 363 KB
120 KB 20ms
18ms Script
application/javascript 2606:4700:20::ac43:532a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://bishopfox.com/static/js/main.js?id=7aa8c6f2b92f3ccf7139

Requested by

Host: bishopfox.com
URL: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:532a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

59eabacb6366edf0795eec24fb521d41ea071bc70b1c90540235209c8b96e864

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"67114ea1-5ad68"
age: 5410
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=q7IfSodzOcnmi%2BaPiJwjzKsnOGen1uy%2FGTmuYQVNl7OTRmeed3TFBJKvfWBajnoyucBF%2F%2BtJLltnpQKduuCZiw2N9mx5KFqCq1BM9UJQbmFK%2BdsUi5Nsmp5y0Brh4ekf26d9SoscogJbEUg%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
server-timing: cfL4;desc="?proto=TCP&rtt=6333&min_rtt=6165&rtt_var=62&sent=116&recv=60&lost=0&retrans=0&sent_bytes=57576&recv_bytes=2778&delivery_rate=11999383&cwnd=301&unsent_bytes=0&cid=37b9743f00a41fe8&ts=79&x=0"
date: Sat, 30 Nov 2024 00:16:31 GMT
content-type: application/javascript; charset=utf-8
last-modified: Thu, 17 Oct 2024 17:51:29 GMT
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8ea6a6374a93dc62-FRA
x-xss-protection: 1; mode=block
server: cloudflare

GET
H3 200 atom-one-dark.min.css
cdnjs.cloudflare.com/ajax/libs/highlight.js/10.1.2/styles/ 792 B
940 B 33ms
17ms Stylesheet
text/css 104.17.24.14
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/highlight.js/10.1.2/styles/atom-one-dark.min.css

Requested by

Host: bishopfox.com
URL: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui

Protocol

Security

QUIC, , AES_128_GCM

Server

104.17.24.14 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f7543874fd85ac54022e92bff1f3e54326ad7a136685439729114cd42b44ed2c

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://bishopfox.com/

Response headers

cf-cdnjs-via: cfworker/kv
content-encoding: br
cf-cache-status: HIT
etag: "5f19fdfb-318"
age: 794696
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PRc1WS23NgHzV3f9WPiVsDL8ratQMGvkuR15suAurUeFDkL4HC7Eg6v5w7ZY8vtK4dvGhqArd89RNZ8mNcK3TrTEtz1sOiRnmbDuFLlfIjc44t49TJKzJDqlu7BhEORPmUoO%2F9Jd"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
expires: Thu, 20 Nov 2025 00:16:31 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Sat, 30 Nov 2024 00:16:31 GMT
content-type: text/css; charset=utf-8
last-modified: Thu, 23 Jul 2020 21:15:39 GMT
vary: Accept-Encoding
priority: u=0,i=?0
strict-transport-security: max-age=15780000
cache-control: public, max-age=30672000
timing-allow-origin: *
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cross-origin-resource-policy: cross-origin
cf-ray: 8ea6a63759954d3d-FRA
accept-ranges: bytes
access-control-allow-origin: *
content-length: 287
server: cloudflare

GET
H3 200 highlight.min.js Show response
cdnjs.cloudflare.com/ajax/libs/highlight.js/11.8.0/ 118 KB
36 KB 33ms
18ms Script
application/javascript 104.17.24.14
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/highlight.js/11.8.0/highlight.min.js

Requested by

Host: bishopfox.com
URL: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui

Protocol

Security

QUIC, , AES_128_GCM

Server

104.17.24.14 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4499ff936d4fd562adca5a5cbe512dc19eb80942eee8618dafbcebc4f7974bdb

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://bishopfox.com/

Response headers

cf-cdnjs-via: cfworker/kv
content-encoding: br
cf-cache-status: HIT
etag: "659a3ea7-8bb6"
age: 68707
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=symAuM8VYAJNifTxtAssfWGwwZa31tFR4aMNKRXAIg%2BXIIhdBV%2Ff7FhimYf8QPtND6f4Ck6tjVCor8Aa8CJfdDQjftukSE0KsiQvQDdBNgYK%2FbPcYFm%2BL5ARHcX8wbyBo1r6bI22"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
expires: Thu, 20 Nov 2025 00:16:31 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Sat, 30 Nov 2024 00:16:31 GMT
content-type: application/javascript; charset=utf-8
last-modified: Sun, 07 Jan 2024 07:03:19 GMT
vary: Accept-Encoding
priority: u=1,i=?0
strict-transport-security: max-age=15780000
cache-control: public, max-age=30672000
timing-allow-origin: *
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cross-origin-resource-policy: cross-origin
cf-ray: 8ea6a63759924d3d-FRA
accept-ranges: bytes
access-control-allow-origin: *
content-length: 35766
server: cloudflare

GET
H2 200 bizible.js Show response
cdn.bizible.com/scripts/ 67 KB
25 KB 112ms
7ms Script
application/x-javascript 152.195.15.58
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.bizible.com/scripts/bizible.js

Requested by

Host: bishopfox.com
URL: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

152.195.15.58 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (frb/67D4) /

Resource Hash

240d410aca3cee565e1ed42102cbb6a42922fdc9ad93f35a542d66168bf12d63

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSub

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://bishopfox.com/

Response headers

strict-transport-security: max-age=31536000; includeSub
cache-control: max-age=86400
content-encoding: gzip
etag: "4797a1a44a3cdb1:0"
age: 10861
accept-ranges: bytes
x-cache: HIT
content-length: 25393
date: Sat, 30 Nov 2024 00:16:32 GMT
content-type: application/x-javascript
last-modified: Thu, 21 Nov 2024 19:22:02 GMT
server: ECS (frb/67D4)
vary: Accept-Encoding

GET
H2 200 bishopfox-mexico-logo.png
bishopfox.com/static/assets/images/main-menu/ 24 KB
24 KB 29ms
28ms Image
image/png 2606:4700:20::ac43:532a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bishopfox.com/static/assets/images/main-menu/bishopfox-mexico-logo.png

Requested by

Host: bishopfox.com
URL: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:532a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f45cdb3a12560d3dc31a9a244fda2f02526af5f2ac0afd78da98bb65553e0e0a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui

Response headers

cf-bgj: imgq:85,h2pri
etag: "67114ea1-70a9"
age: 5408
cf-cache-status: HIT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Zl8IKRMXw%2FGinakeF8CUit6BWqFAM9SmtgLLuxd1PoE53A4bi1gBtEUDSYq5k1klj0LeRHiiewo%2Bj9Ok03jovNi4xT44cw%2Flz4eBMMW8WkWSMmVZVK6RoB1bDOfoWSV4ru9khGHRS1MckBw%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
cf-polished: origSize=28841
server-timing: cfL4;desc="?proto=TCP&rtt=6333&min_rtt=6165&rtt_var=62&sent=155&recv=60&lost=0&retrans=0&sent_bytes=105684&recv_bytes=2778&delivery_rate=11999383&cwnd=301&unsent_bytes=32425&cid=37b9743f00a41fe8&ts=80&x=0"
date: Sat, 30 Nov 2024 00:16:31 GMT
content-type: image/png
last-modified: Thu, 17 Oct 2024 17:51:29 GMT
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8ea6a6374a91dc62-FRA
accept-ranges: bytes
content-length: 24419
x-xss-protection: 1; mode=block
server: cloudflare

GET
H2 200 Bishop-Fox_Blog-Post_Telerik_FI-01_2022-05-18-224348_nhah.jpg
assets.bishopfox.com/prod-1437/Images/channels/blog/tiles/ 80 KB
80 KB 553ms
488ms Image
image/jpeg 2600:9000:20eb:3000:16:ce50:9480:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.bishopfox.com/prod-1437/Images/channels/blog/tiles/Bishop-Fox_Blog-Post_Telerik_FI-01_2022-05-18-224348_nhah.jpg
Requested by: Host: bishopfox.com
URL: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:3000:16:ce50:9480:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 365f167a75f0de021be3c1a8a7cc99a3e21cc666f2889ccce438c3f013e0c10c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui

Response headers

etag: "d05a60bbb3ffb2e82a234a6ba3112e43"
via: 1.1 c379418fd6100691807f32f274ebe9ce.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Miss from cloudfront
content-length: 81912
x-amz-cf-id: ngADNr5glP4IFSEQTbmFLjdsDGWpdgsE8q8LoqzLUosg8JANoAMWWw==
date: Sat, 30 Nov 2024 00:16:33 GMT
content-type: image/jpeg
last-modified: Fri, 27 May 2022 16:36:53 GMT
server: AmazonS3
x-amz-cf-pop: FRA2-C1

GET
H2 200 Caleb-Gross-Light-Gray.jpg
assets.bishopfox.com/prod-1437/Images/author-photos/ 126 KB
127 KB 544ms
516ms Image
image/jpeg 2600:9000:20eb:3000:16:ce50:9480:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.bishopfox.com/prod-1437/Images/author-photos/Caleb-Gross-Light-Gray.jpg
Requested by: Host: bishopfox.com
URL: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:3000:16:ce50:9480:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 264de9951d101b21f39220bec07e8e0654052142a85c59ec9ae0589d24eae70f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui

Response headers

etag: "7646c3554bf40a137c730efc27e68112"
via: 1.1 c379418fd6100691807f32f274ebe9ce.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Miss from cloudfront
content-length: 129331
x-amz-cf-id: uWYDWgLsw29MB_SwGPSrkXvjsRj_266KPcWNhDsvD5NfTFT90P0h2w==
date: Sat, 30 Nov 2024 00:16:33 GMT
content-type: image/jpeg
last-modified: Thu, 06 Jul 2023 18:58:30 GMT
server: AmazonS3
x-amz-cf-pop: FRA2-C1
x-amz-server-side-encryption: AES256

GET
H2 200 Featured_Tile_2024-11-26-151225_erap.png
assets.bishopfox.com/prod-1437/Images/channels/blog/featured-images/ 255 KB
255 KB 467ms
464ms Image
image/png 2600:9000:20eb:3000:16:ce50:9480:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.bishopfox.com/prod-1437/Images/channels/blog/featured-images/Featured_Tile_2024-11-26-151225_erap.png
Requested by: Host: bishopfox.com
URL: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:3000:16:ce50:9480:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: ff565c71f3c768cc25eeffcb7aad55834fef188f4ccbdf295589608aa5ae97f8

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui

Response headers

etag: "e6db8fd1d9ce84421b720a2fe030d55b"
via: 1.1 c379418fd6100691807f32f274ebe9ce.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Miss from cloudfront
content-length: 260664
x-amz-cf-id: SBmVYR6Fn-c_2Jn1UfQHeb1j_CHwiH2Xtj7LIsBFhzBtqNELQk9row==
date: Sat, 30 Nov 2024 00:16:33 GMT
content-type: image/png
last-modified: Tue, 26 Nov 2024 15:12:27 GMT
server: AmazonS3
x-amz-cf-pop: FRA2-C1
x-amz-server-side-encryption: AES256

GET
H2 200 Bishop-Fox-Blog-Fortijump.jpg
assets.bishopfox.com/prod-1437/Images/channels/blog/tiles/ 189 KB
190 KB 460ms
458ms Image
image/jpeg 2600:9000:20eb:3000:16:ce50:9480:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.bishopfox.com/prod-1437/Images/channels/blog/tiles/Bishop-Fox-Blog-Fortijump.jpg
Requested by: Host: bishopfox.com
URL: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:3000:16:ce50:9480:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 01d05adf19a7f6884bea90a5630127f932a74e235fe9368ef602481f1e2984d8

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui

Response headers

etag: "ec34c3ec4ce0f3f9c0960cac5fd1681a"
via: 1.1 c379418fd6100691807f32f274ebe9ce.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Miss from cloudfront
content-length: 194043
x-amz-cf-id: st3ZLd9i9wEWJ51OB3DhF8LurzZ3cNRsP3ppeNkP_9c1Qtv7H5i4tA==
date: Sat, 30 Nov 2024 00:16:33 GMT
content-type: image/jpeg
last-modified: Fri, 01 Nov 2024 18:56:45 GMT
server: AmazonS3
x-amz-cf-pop: FRA2-C1
x-amz-server-side-encryption: AES256

GET
H2 200 BishopFox-Blog-Tools-BrokenHill-F.jpg
assets.bishopfox.com/prod-1437/Images/channels/blog/tiles/ 2 MB
2 MB 455ms
453ms Image
image/jpeg 2600:9000:20eb:3000:16:ce50:9480:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.bishopfox.com/prod-1437/Images/channels/blog/tiles/BishopFox-Blog-Tools-BrokenHill-F.jpg
Requested by: Host: bishopfox.com
URL: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:3000:16:ce50:9480:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 86f55ad6b90ad8ce93f7ea64a50306367d20470f43cae86ddd101ed6c7820c6e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui

Response headers

etag: "6ed46e2facdb97c7fd7d868f4277de6b"
via: 1.1 c379418fd6100691807f32f274ebe9ce.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Miss from cloudfront
content-length: 1687150
x-amz-cf-id: 2kK1x23NgAJFk0q_YyuNpjQHv9r-CWxNrNdXqisZje8700kYBLSJ2Q==
date: Sat, 30 Nov 2024 00:16:33 GMT
content-type: image/jpeg
last-modified: Mon, 23 Sep 2024 19:14:28 GMT
server: AmazonS3
x-amz-cf-pop: FRA2-C1
x-amz-server-side-encryption: AES256

GET
H2 200 BishopFox-Blog-Large-Language-Models-Lab-F.jpg
assets.bishopfox.com/prod-1437/Images/channels/blog/tiles/ 56 KB
57 KB 454ms
453ms Image
image/jpeg 2600:9000:20eb:3000:16:ce50:9480:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.bishopfox.com/prod-1437/Images/channels/blog/tiles/BishopFox-Blog-Large-Language-Models-Lab-F.jpg
Requested by: Host: bishopfox.com
URL: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:3000:16:ce50:9480:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: cd20510505fb1ae6d197c9183becce66a7cfdc41d4ffb833ecb4dc458e8bf4fd

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui

Response headers

etag: "97abf7eb2bc4edfeb946bd4f2ee6b15d"
via: 1.1 c379418fd6100691807f32f274ebe9ce.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Miss from cloudfront
content-length: 57828
x-amz-cf-id: MLlgg4KrNytdtOfc4crobLSH1elNwuXzBQdXObvzXPURG6sxkputLA==
date: Sat, 30 Nov 2024 00:16:33 GMT
content-type: image/jpeg
last-modified: Thu, 05 Sep 2024 18:20:10 GMT
server: AmazonS3
x-amz-cf-pop: FRA2-C1
x-amz-server-side-encryption: AES256

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 310 KB
98 KB 55ms
31ms Script
application/javascript 2a00:1450:4001:831::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-NSTVGF3

Requested by

Host: bishopfox.com
URL: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

22cfce9d9ab7490b5b130e3acda48c6b0087a43bb695cbedcafe351a4879efe6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://bishopfox.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1080:0"}],}
expires: Sat, 30 Nov 2024 00:16:31 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 30 Nov 2024 00:16:31 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Sat, 30 Nov 2024 00:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1080:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 99551
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 --6PiuvBGAU
www.youtube.com/embed/ Frame 5CA7 0
0 100ms
80ms Document
text/html 2a00:1450:4001:809::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/embed/--6PiuvBGAU

Requested by

Host: bishopfox.com
URL: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script'
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: br
content-security-policy: require-trusted-types-for 'script'
content-type: text/html; charset=utf-8
cross-origin-opener-policy-report-only: same-origin; report-to="youtube_main"
cross-origin-resource-policy: cross-origin
date: Sat, 30 Nov 2024 00:16:32 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
origin-trial: AmhMBR6zCLzDDxpW+HfpP67BqwIknWnyMOXOQGfzYswFmJe+fgaI6XZgAzcxOrzNtP7hEDsOo1jdjFnVr2IdxQ4AAAB4eyJvcmlnaW4iOiJodHRwczovL3lvdXR1YmUuY29tOjQ0MyIsImZlYXR1cmUiOiJXZWJWaWV3WFJlcXVlc3RlZFdpdGhEZXByZWNhdGlvbiIsImV4cGlyeSI6MTc1ODA2NzE5OSwiaXNTdWJkb21haW4iOnRydWV9
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=de for more info."
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
pragma: no-cache
report-to: {"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]}
server: ESF
strict-transport-security: max-age=31536000
vary: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 bg-header-shape-R-fibers.png
bishopfox.com/static/assets/images/default/backgrounds/ 177 KB
178 KB 409ms
409ms Image
image/png 2606:4700:20::ac43:532a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bishopfox.com/static/assets/images/default/backgrounds/bg-header-shape-R-fibers.png

Requested by

Host: bishopfox.com
URL: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:532a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4d4b6a308f7020554dfd5c36f7a1ec40a7ff919487c17d885ec38e50530d8f1c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui

Response headers

cf-cache-status: MISS
etag: "67114ea1-2c39f"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ZulL9nGyoRyEsppVYpoCtNTSbZXv%2FGiNl5fkt3jRmgArZZIAjUbMsxfgyVtdAgH2fTavNA3yClpv9Ljsg%2FSwsIVuQis9gUE6KjodG%2BR%2BiQlM06JvyICMLXqYkoQ3cy%2FPlOyNzc7vKhSIOrE%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
server-timing: cfL4;desc="?proto=TCP&rtt=9179&min_rtt=6165&rtt_var=465&sent=277&recv=130&lost=0&retrans=0&sent_bytes=254910&recv_bytes=3018&delivery_rate=12782888&cwnd=327&unsent_bytes=0&cid=37b9743f00a41fe8&ts=539&x=0"
date: Sat, 30 Nov 2024 00:16:32 GMT
content-type: image/png
last-modified: Thu, 17 Oct 2024 17:51:29 GMT
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8ea6a637bb21dc62-FRA
accept-ranges: bytes
content-length: 181151
x-xss-protection: 1; mode=block
server: cloudflare

GET
H2 200 UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7.woff2
bishopfox.com/fonts.gstatic.com/s/inter/v18/ 47 KB
48 KB 25ms
25ms Font
font/woff2 2606:4700:20::ac43:532a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://bishopfox.com/fonts.gstatic.com/s/inter/v18/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7.woff2
Requested by: Host: bishopfox.com
URL: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:532a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f052ee44c3728dfd23aba8a4567150bc314d23903026fbb6ad089422c2df56af

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://bishopfox.com
Referer: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui

Response headers

cf-cache-status: HIT
age: 195544
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DyFYGAACt1y0PeiyGqowx2m3ftEVnDsRqR5fZgAwlveaX9Kxa7oi2DeasdRttk5hIfl3jTg1PCveqOXB6zYqAMFEYeg2XkUJnQZlY2ZIkdRk2QjOEUWi8S7xcvpGnOUU8bHfiPYNCAc96MM%3D"}],"group":"cf-nel","max_age":604800}
expires: Wed, 26 Nov 2025 06:43:06 GMT
server-timing: cfL4;desc="?proto=TCP&rtt=6841&min_rtt=6165&rtt_var=115&sent=237&recv=110&lost=0&retrans=0&sent_bytes=205712&recv_bytes=3018&delivery_rate=12782888&cwnd=325&unsent_bytes=0&cid=37b9743f00a41fe8&ts=211&x=0"
date: Sat, 30 Nov 2024 00:16:32 GMT
content-type: font/woff2
last-modified: Mon, 29 Jul 2024 22:51:01 GMT
vary: Accept-Encoding
cache-control: public, max-age=31536000
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 8ea6a6381ba4dc62-FRA
accept-ranges: bytes
content-length: 48444
cf-apo-via: proxy
server: cloudflare

GET
DATA 200
OK truncated
/ 212 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5ca272b5c51f5790821b50ebfb5f2868f20230a839431baf92f45bfff38861ea

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/svg+xml;charset=utf-8

GET
H2 200 getForm Show response
go.bishopfox.com/index.php/form/ 16 KB
4 KB 451ms
60ms Script
application/javascript 104.17.73.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://go.bishopfox.com/index.php/form/getForm?munchkinId=136-UTJ-516&form=1049&url=https%3A%2F%2Fbishopfox.com%2Fblog%2Fcve-2019-18935-remote-code-execution-in-telerik-ui&callback=jQuery112405612347715927215_1732925792033&_=1732925792034
Requested by: Host: bishopfox.com
URL: https://bishopfox.com/static/js/main.js?id=7aa8c6f2b92f3ccf7139
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 104.17.73.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4cd9e7223f5db688cfc2941b58f58cba75e045dc75935841d70fe3207df0186a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui

Response headers

cf-ray: 8ea6a63b18f635e1-FRA
cached: true
content-encoding: gzip
date: Sat, 30 Nov 2024 00:16:32 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 bg-bf-logo@2x.png
bishopfox.com/static/assets/images/backgrounds/ 12 KB
12 KB 19ms
19ms Image
image/png 2606:4700:20::ac43:532a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bishopfox.com/static/assets/images/backgrounds/bg-bf-logo@2x.png

Requested by

Host: bishopfox.com
URL: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:532a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7eb812bb352bdb0639450b6143b46593f3d7e01891baf0b864d3adcb3fcf9cc8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui

Response headers

cf-bgj: imgq:85,h2pri
etag: "67114ea1-10d94"
age: 5409
cf-cache-status: HIT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wzKpfhKSpQ4O95f%2BwX9CNdUbuGtSwTOeyWnwVB1LndUi6OTpLA3TakUyhcfPj3w0ywJ90aV9feCrXJzYO35EEJYt6O1o4mcKCxRYSlu0SGXGlhqk2mV%2F8O1SwxlwMKVTKK1reXOuhZSRBUs%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
cf-polished: origSize=69012
server-timing: cfL4;desc="?proto=TCP&rtt=7082&min_rtt=6165&rtt_var=220&sent=315&recv=150&lost=0&retrans=0&sent_bytes=302749&recv_bytes=3105&delivery_rate=12782888&cwnd=327&unsent_bytes=0&cid=37b9743f00a41fe8&ts=598&x=0"
date: Sat, 30 Nov 2024 00:16:32 GMT
content-type: image/png
last-modified: Thu, 17 Oct 2024 17:51:29 GMT
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8ea6a63a8eb7dc62-FRA
accept-ranges: bytes
content-length: 11874
x-xss-protection: 1; mode=block
server: cloudflare

GET
H2 200 ipv
cdn.bizible.com/ 43 B
304 B 8ms
8ms Image
image/gif 152.195.15.58
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.bizible.com/ipv?_biz_r=&_biz_h=-1906410348&_biz_u=9374a1b7d40c4cfbd6ba2ccfa1a19391&_biz_l=https%3A%2F%2Fbishopfox.com%2Fblog%2Fcve-2019-18935-remote-code-execution-in-telerik-ui&_biz_t=1732925792509&_biz_i=CVE-2019-18935%3A%20Remote%20Code%20Execution%20via%20Insecure%E2%80%A6%20%7C%20Bishop%20Fox&_biz_n=0&rnd=646891&cdn_o=a&_biz_z=1732925792513

Requested by

Host: bishopfox.com
URL: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

152.195.15.58 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (frb/67BA) /

Resource Hash

afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSub

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui

Response headers

strict-transport-security: max-age=31536000; includeSub
cache-control: no-cache, no-store
pragma: no-cache
age: 10867
expires: -1
accept-ranges: bytes
x-cache: HIT
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
content-length: 43
date: Sat, 30 Nov 2024 00:16:32 GMT
content-type: Image/GIF
last-modified: Fri, 29 Nov 2024 21:15:25 GMT
server: ECS (frb/67BA)

GET
H2 200 u
cdn.bizibly.com/ 43 B
204 B 53ms
8ms Image
image/gif 152.195.15.58
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.bizibly.com/u?_biz_u=9374a1b7d40c4cfbd6ba2ccfa1a19391&_biz_l=https%3A%2F%2Fbishopfox.com%2Fblog%2Fcve-2019-18935-remote-code-execution-in-telerik-ui&_biz_t=1732925792516&_biz_i=CVE-2019-18935%3A%20Remote%20Code%20Execution%20via%20Insecure%E2%80%A6%20%7C%20Bishop%20Fox&rnd=872179&cdn_o=a&_biz_z=1732925792516

Requested by

Host: bishopfox.com
URL: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

152.195.15.58 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (frb/67C2) /

Resource Hash

afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSub

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui

Response headers

strict-transport-security: max-age=31536000; includeSub
cache-control: no-cache, no-store
pragma: no-cache
age: 515447
expires: -1
accept-ranges: bytes
x-cache: HIT
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
content-length: 43
date: Sat, 30 Nov 2024 00:16:32 GMT
content-type: Image/GIF
last-modified: Sun, 24 Nov 2024 01:05:45 GMT
server: ECS (frb/67C2)

GET
H2 200 6f09130d-7972-4a5f-8f14-2c3cb7605834.js Show response
j.6sc.co/j/ 4 KB
5 KB 461ms
398ms Script
application/javascript 95.101.111.170
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to

Full URL: https://j.6sc.co/j/6f09130d-7972-4a5f-8f14-2c3cb7605834.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NSTVGF3
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 95.101.111.170 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS: a95-101-111-170.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: aeb175fdbf6a9899f2d66b87c9d94ff35988926b1a5ae7de18f663d474d092db

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui

Response headers

x-amz-server-side-encryption: AES256
cache-control: private, max-age=1800
etag: "b071a6c0ffec2adfe5d0814cd3711d0f"
x-amz-version-id: o7J08Mcv7l84s3QP.Ixodt_BplaIwzAh
expires: Sat, 30 Nov 2024 00:46:32 GMT
accept-ranges: bytes
content-length: 4528
x-amz-cf-id: fogCG3wh2OqsIktR-X9x_JECI1byFvpmK1_V9-oYeW-SHn6bGS9pbw==
date: Sat, 30 Nov 2024 00:16:32 GMT
last-modified: Tue, 03 Oct 2023 16:56:24 GMT
x-amz-cf-pop: FRA60-P1
server: AmazonS3
content-type: application/javascript
x-amz-meta-content-type: application/json

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 412 KB
131 KB 38ms
38ms Script
application/javascript 2a00:1450:4001:831::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-DYCTLWMS7T&l=dataLayer&cx=c&gtm=45He4bk0v852362024za200

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NSTVGF3

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

bf85fc51636dd0c0211812a23f4122aa2d61e0c3934ddd43b5939046a07b4c2a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Sat, 30 Nov 2024 00:16:32 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 30 Nov 2024 00:16:32 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 133907
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 40 KB
14 KB 80ms
9ms Script
application/javascript 2a02:26f0:480:15::213:7e4a
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to

Full URL

https://snap.licdn.com/li.lms-analytics/insight.min.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NSTVGF3

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:480:15::213:7e4a Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

Software

Resource Hash

8a27dc7b44ebe886390bfa0a9beeea36ea5a3f37479f0e0836b6c9b80d9b35ed

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui

Response headers

cache-control: max-age=38327
content-encoding: gzip
x-cdn: AKAM
x-content-type-options: nosniff
accept-ranges: bytes
content-length: 14628
date: Sat, 30 Nov 2024 00:16:32 GMT
last-modified: Thu, 22 Aug 2024 10:43:55 GMT
content-type: application/javascript;charset=utf-8
vary: Accept-Encoding
x-amz-server-side-encryption: AES256

GET
H2 200 hotjar-3197627.js Show response
static.hotjar.com/c/ 13 KB
6 KB 104ms
40ms Script
application/javascript 13.32.27.15
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://static.hotjar.com/c/hotjar-3197627.js?sv=7

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NSTVGF3

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.32.27.15 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-32-27-15.fra56.r.cloudfront.net

Software

Resource Hash

30777fec6d7682e924cca7808d8effdad171ece801cf2fb0509077fd9532c4f2

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui

Response headers

strict-transport-security: max-age=2592000; includeSubDomains
cache-control: max-age=60
content-encoding: br
etag: W/956be1981e604584c1a0ee723a578137
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
x-cache-hit: 1
via: 1.1 bfa7dfbe8ca6d4eb3690c4c82ca6c0fa.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-cache: RefreshHit from cloudfront
x-amz-cf-id: SpOKvUnB98DWos7Cts788IV4efih64Nc9K45xMnAevHFA3BbW0un_Q==
date: Sat, 30 Nov 2024 00:16:32 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
x-amz-cf-pop: FRA56-C2

GET
H2 200 pixel.js Show response
www.redditstatic.com/ads/ 43 KB
13 KB 51ms
7ms Script
application/javascript 2a04:4e42:200::396
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://www.redditstatic.com/ads/pixel.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NSTVGF3
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:200::396 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: snooserv /
Resource Hash: 10429db431cbd2fc042c7397c8f1e62996d636ddeef2702c912d9fb7fc650c35

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui

Response headers

cache-control: public, max-age=60
nel: {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.02, "failure_fraction": 0.02}
content-encoding: gzip
etag: "1a001f3a066bff47a766099b87253911"
report-to: {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]}
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
content-length: 12220
date: Sat, 30 Nov 2024 00:16:32 GMT
last-modified: Mon, 18 Nov 2024 21:16:35 GMT
content-type: application/javascript
vary: Accept-Encoding,Origin
server: snooserv
x-amz-server-side-encryption: AES256

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/ 1 KB
1 KB 149ms
8ms Script
application/x-javascript 104.102.43.106
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/munchkin.js
Requested by: Host: bishopfox.com
URL: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.102.43.106 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-102-43-106.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: a2091f1ff92cc073e178dca31707853e0cc6cd913a5344a8978f040fa373efa6

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui

Response headers

Content-Encoding: gzip
ETag: "e75e5ba140b1c7e6ea79786633c1ba0d:1731465879.778595"
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 741
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Date: Sat, 30 Nov 2024 00:16:32 GMT
Content-Type: application/x-javascript
Last-Modified: Wed, 13 Nov 2024 02:44:39 GMT
Server: AkamaiNetStorage
Vary: Accept-Encoding

GET
H2 200 simpledto-1.0.4.js Show response
go.bishopfox.com/rs/136-UTJ-516/images/ 2 KB
1 KB 316ms
315ms Script
application/x-javascript 104.17.73.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://go.bishopfox.com/rs/136-UTJ-516/images/simpledto-1.0.4.js

Requested by

Host: bishopfox.com
URL: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.73.206 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e0ea4dbd2c85145cacf92362ae72dc6d56be63d1a68f0d492f55699959874940

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui

Response headers

cache-control: public, max-age=60
content-encoding: gzip
cf-cache-status: REVALIDATED
etag: "36a0049-8b5-623b1337890de"
x-content-type-options: nosniff
cf-ray: 8ea6a63b792635e1-FRA
expires: Sat, 30 Nov 2024 00:17:32 GMT
accept-ranges: bytes
content-length: 1092
date: Sat, 30 Nov 2024 00:16:32 GMT
content-type: application/x-javascript
last-modified: Sat, 05 Oct 2024 02:03:59 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 E-v1.js Show response
fast.wistia.net/assets/external/ 843 KB
144 KB 49ms
8ms Script
text/javascript 2a04:4e42:200::644
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://fast.wistia.net/assets/external/E-v1.js

Requested by

Host: bishopfox.com
URL: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:200::644 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

8bde8c262105b0b4001279d19d0aeab2915799d7869b34e2a07bfe6834aeefe3

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui

Response headers

content-encoding: br
etag: "cfd47b28ccfe165b0a5c5a018a4ea672"
age: 2895
x-cache: HIT, HIT
date: Sat, 30 Nov 2024 00:16:32 GMT
last-modified: Wed, 27 Nov 2024 19:27:31 GMT
x-served-by: cache-iad-kjyo7100095-IAD, cache-fra-etou8220101-FRA
x-cache-hits: 29, 16
content-type: text/javascript
vary: Accept-Encoding
strict-transport-security: max-age=0
cache-control: public, max-age=3600
timing-allow-origin: *
x-timer: S1732925793.617738,VS0,VE0
via: 1.1 varnish, 1.1 varnish
x-browser: chrome
x-ecma-v: modern
x-browser-version: 131
accept-ranges: bytes
access-control-allow-origin: *
content-length: 146816
asset-version: 40669335fc221c473cbbda5170bd8173445157ee
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 6si.min.js Show response
j.6sc.co/ 68 KB
19 KB 10ms
9ms Script
application/javascript 95.101.111.170
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to

Full URL

https://j.6sc.co/6si.min.js

Requested by

Host: bishopfox.com
URL: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

95.101.111.170 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a95-101-111-170.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

56df5bf2317bc2156b954c3fd2913afcce23eb4947c47f3ac401017dc4a0151d

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui

Response headers

cache-control: private, proxy-revalidate, max-age=10800
content-encoding: gzip
etag: "66fb91ae-111d7"
x-content-type-options: nosniff
expires: Sat, 30 Nov 2024 03:16:32 GMT
accept-ranges: bytes
content-length: 18830
date: Sat, 30 Nov 2024 00:16:32 GMT
content-type: application/javascript
vary: Accept-Encoding
server: nginx/1.14.0 (Ubuntu)
last-modified: Tue, 01 Oct 2024 06:07:42 GMT

GET
H2 200 oktrk.js Show response
static.oktopost.com/ 9 KB
4 KB 89ms
10ms Script
application/javascript 3.160.150.119
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.oktopost.com/oktrk.js
Requested by: Host: bishopfox.com
URL: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.160.150.119 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-160-150-119.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 09016600a13dd4825b72516765a8da53d1ab896f7582c4619d014e8ee147ea84

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui

Response headers

content-encoding: gzip
etag: W/"57315c24d6fec75c4d46a8cc3fa6e0d5"
age: 69570
via: 1.1 1903071a927324e2fb28199ee96c4bb2.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: SJi4QZQX13In3e3TNWTMakRtxz7s0NION147ml92lJRP5WsH6Ucnvg==
date: Fri, 29 Nov 2024 04:57:03 GMT
content-type: application/javascript
last-modified: Mon, 27 Jan 2020 09:47:41 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P7
vary: accept-encoding

GET
H2 200 loader.js Show response
assets.adoberesources.net/ 16 KB
6 KB 465ms
340ms Script
application/x-javascript 2a02:26f0:480:980::1e80
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adoberesources.net/loader.js?orgId=C4C8CBC15571F3C07F000101%40AdobeOrg&instanceId=bishopfox&env=prod&geo=va7
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NSTVGF3
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:480:980::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: d35a955dab9185e7b6171395335d054656e2d0006f6131d8cef6562ec18664e5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui

Response headers

cache-control: max-age=600
content-encoding: gzip
etag: "15ef6a329f89cdb27da45240f0a960ac:1731912352.978694"
expires: Sat, 30 Nov 2024 00:26:33 GMT
accept-ranges: bytes
content-length: 5890
date: Sat, 30 Nov 2024 00:16:33 GMT
content-type: application/x-javascript
last-modified: Mon, 18 Nov 2024 06:45:52 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H3 204 td
www.googletagmanager.com/ 0
18 B 16ms
15ms Image
text/plain 142.250.184.232
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.googletagmanager.com/td?id=GTM-NSTVGF3&v=3&t=t&pid=1263700351&dl=bishopfox.com%2Fblog%2Fcve-2019-18935-remote-code-execution-in-telerik-ui&tdp=GTM-NSTVGF3;52362024;0;0;0&frm=0&rtg=52362024&slo=3&hlo=5&lst=1&z=0
Requested by: Host: bishopfox.com
URL: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.184.232 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra24s12-in-f8.1e100.net
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgtc:59:0"}],}
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgtc:59:0
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
date: Sat, 30 Nov 2024 00:16:32 GMT
content-type: text/plain
server: Golfe2

GET
H2 200 xdc.js Show response
cdn.bizible.com/ 111 B
321 B 124ms
123ms Script
text/javascript 152.195.15.58
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.bizible.com/xdc.js?_biz_u=9374a1b7d40c4cfbd6ba2ccfa1a19391&_biz_h=-1906410348&cdn_o=a&jsVer=4.24.11.21

Requested by

Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

152.195.15.58 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (frb/6711) /

Resource Hash

3d811f5800a3e6af41835100774bcf8bd7c5dfde0e4fa368a8a77eeb1051d524

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSub

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui

Response headers

strict-transport-security: max-age=31536000; includeSub
cache-control: private, must-revalidate, max-age=21600
content-encoding: gzip
etag: 2E858EAD
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
content-length: 214
date: Sat, 30 Nov 2024 00:16:32 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding
server: ECS (frb/6711)

GET
H2 200 iframe_api Show response
www.youtube.com/ 993 B
2 KB 50ms
22ms Script
text/javascript 2a00:1450:4001:827::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/iframe_api

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NSTVGF3

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

95202acb1dba479b44d42a18e4cc5cea755d755d6bfba29a6ebb9a46c63b7804

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script'
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui

Response headers

content-encoding: br
origin-trial: AmhMBR6zCLzDDxpW+HfpP67BqwIknWnyMOXOQGfzYswFmJe+fgaI6XZgAzcxOrzNtP7hEDsOo1jdjFnVr2IdxQ4AAAB4eyJvcmlnaW4iOiJodHRwczovL3lvdXR1YmUuY29tOjQ0MyIsImZlYXR1cmUiOiJXZWJWaWV3WFJlcXVlc3RlZFdpdGhEZXByZWNhdGlvbiIsImV4cGlyeSI6MTc1ODA2NzE5OSwiaXNTdWJkb21haW4iOnRydWV9
x-content-type-options: nosniff
report-to: {"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]}
expires: Sat, 30 Nov 2024 00:16:32 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 30 Nov 2024 00:16:32 GMT
content-type: text/javascript; charset=utf-8
vary: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
content-security-policy: require-trusted-types-for 'script'
cache-control: private, max-age=0
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
cross-origin-opener-policy-report-only: same-origin; report-to="youtube_main"
x-xss-protection: 0
server: ESF

GET
H2 200 forms2.css
go.bishopfox.com/js/forms2/css/ 13 KB
3 KB 382ms
379ms Stylesheet
text/css 104.17.73.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://go.bishopfox.com/js/forms2/css/forms2.css

Requested by

Host: bishopfox.com
URL: https://bishopfox.com/static/js/main.js?id=7aa8c6f2b92f3ccf7139

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.73.206 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

256e42104f48a5fa80b031da12dc56acde224fba3f9810f8f8192b39136d365a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui

Response headers

cache-control: public, max-age=14400
content-encoding: gzip
cf-cache-status: REVALIDATED
etag: "10204ec-3437-62370c030d900"
x-content-type-options: nosniff
cf-ray: 8ea6a63b993735e1-FRA
expires: Sat, 30 Nov 2024 04:16:32 GMT
accept-ranges: bytes
content-length: 2623
date: Sat, 30 Nov 2024 00:16:32 GMT
content-type: text/css
last-modified: Tue, 01 Oct 2024 21:10:28 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 forms2-theme-plain.css
go.bishopfox.com/js/forms2/css/ 828 B
448 B 24ms
22ms Stylesheet
text/css 104.17.73.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://go.bishopfox.com/js/forms2/css/forms2-theme-plain.css

Requested by

Host: bishopfox.com
URL: https://bishopfox.com/static/js/main.js?id=7aa8c6f2b92f3ccf7139

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.73.206 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

57cd46adbabd6c40823602b4513aecbe89320a769572255272abe9f008de69fa

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui

Response headers

cache-control: public, max-age=14400
content-encoding: gzip
cf-cache-status: HIT
etag: "35e1f2c-33c-62370c030d900"
age: 947
x-content-type-options: nosniff
cf-ray: 8ea6a63b993935e1-FRA
expires: Sat, 30 Nov 2024 04:16:32 GMT
accept-ranges: bytes
content-length: 246
date: Sat, 30 Nov 2024 00:16:32 GMT
content-type: text/css
last-modified: Tue, 01 Oct 2024 21:10:28 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 config Show response
pixel-config.reddit.com/pixels/t2_br2ex/ 3 B
124 B 143ms
111ms XHR
application/json 2a04:4e42:200::396
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://pixel-config.reddit.com/pixels/t2_br2ex/config
Requested by: Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:200::396 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui

Response headers

cache-control: max-age=14400
content-encoding: gzip
via: 1.1 varnish
accept-ranges: bytes
access-control-allow-origin: *
content-length: 27
date: Sat, 30 Nov 2024 00:16:32 GMT
content-type: application/json

GET
H2 200 t2_br2ex_telemetry Show response
www.redditstatic.com/ads/conversions-config/v1/pixel/config/ 86 B
700 B 30ms
13ms XHR
application/json 2a04:4e42:200::396
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://www.redditstatic.com/ads/conversions-config/v1/pixel/config/t2_br2ex_telemetry
Requested by: Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:200::396 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: snooserv /
Resource Hash: 98d77039ea9249b3dce91ad7b467ee382f29daa61213c3e2737bd4a8786c8801

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui

Response headers

cache-control: max-age=300
nel: {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.02, "failure_fraction": 0.02}
content-encoding: gzip
report-to: {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]}
via: 1.1 varnish
accept-ranges: bytes
access-control-allow-origin: *
content-length: 98
date: Sat, 30 Nov 2024 00:16:32 GMT
content-type: application/json
vary: Accept-Encoding,Origin
server: snooserv

GET
H2 200 rp.gif
alb.reddit.com/ 42 B
637 B 144ms
107ms Image
image/gif 151.101.65.140
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://alb.reddit.com/rp.gif?ts=1732925792602&id=t2_br2ex&event=PageVisit&m.itemCount=undefined&m.value=&m.valueDecimal=undefined&m.currency=undefined&m.transactionId=&m.customEventName=&m.products=&m.conversionId=&uuid=d2d6697a-c746-41dc-b7ea-879dd680ccfe&aaid=&em=&external_id=&idfa=&integration=gtm&opt_out=0&sh=1600&sw=1200&v=rdt_b192616d&dpm=&dpcc=&dprc=
Requested by: Host: bishopfox.com
URL: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.65.140 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Varnish /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui

Response headers

nel: {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.3, "failure_fraction": 0.3}
retry-after: 0
cross-origin-resource-policy: cross-origin
report-to: {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]}
via: 1.1 varnish
accept-ranges: bytes
content-length: 42
date: Sat, 30 Nov 2024 00:16:32 GMT
content-type: image/gif
server: Varnish

GET
H2 200 XDFrame Show response
go.bishopfox.com/index.php/form/ Frame 60E2 2 KB
873 B 302ms
302ms Document
text/html 104.17.73.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://go.bishopfox.com/index.php/form/XDFrame

Requested by

Host: bishopfox.com
URL: https://bishopfox.com/static/js/main.js?id=7aa8c6f2b92f3ccf7139

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.73.206 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c2c76750672f1668a3df60c8aff4a8276b3bd847914543ca5a32a7751e67aa76

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

cache-control: max-age=3600
cf-cache-status: DYNAMIC
cf-ray: 8ea6a63c096c35e1-FRA
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Sat, 30 Nov 2024 00:16:32 GMT
server: cloudflare
vary: Accept-Encoding
x-content-type-options: nosniff

POST
H2 204 collect
region1.analytics.google.com/g/ 0
0 50ms
14ms Fetch
text/plain 2001:4860:4802:34::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-DYCTLWMS7T&gtm=45je4bk0v888887061z8852362024za200zb852362024&_p=1732925791941&_gaz=1&gcd=13l3l3l2l1l1&npa=1&dma_cps=syphamo&dma=1&tag_exp=101925629~102067555~102067808~102077855~102081485&cid=1225279321.1732925793&ul=de-de&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1732925792&sct=1&seg=0&dl=https%3A%2F%2Fbishopfox.com%2Fblog%2Fcve-2019-18935-remote-code-execution-in-telerik-ui&dt=CVE-2019-18935%3A%20Remote%20Code%20Execution%20via%20Insecure%E2%80%A6%20%7C%20Bishop%20Fox&en=page_view&_fv=1&_nsi=1&_ss=1&tfd=926
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-DYCTLWMS7T&l=dataLayer&cx=c&gtm=45He4bk0v852362024za200
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:136:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:136:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://bishopfox.com
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 30 Nov 2024 00:16:32 GMT
content-type: text/plain
server: Golfe2

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
543 B 64ms
20ms Ping
text/plain 2a00:1450:400c:c06::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-DYCTLWMS7T&cid=1225279321.1732925793&gtm=45je4bk0v888887061z8852362024za200zb852362024&aip=1&dma=1&dma_cps=syphamo&gcd=13l3l3l2l1l1&npa=1&frm=0&tag_exp=101925629~102067555~102067808~102077855~102081485
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-DYCTLWMS7T&l=dataLayer&cx=c&gtm=45He4bk0v852362024za200
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:400c:c06::9b Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:111:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:111:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://bishopfox.com
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 30 Nov 2024 00:16:32 GMT
content-type: text/plain
server: Golfe2

GET
H3 200 ga-audiences
www.google.de/ads/ 42 B
63 B 47ms
24ms Image
image/gif 216.58.206.67
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-DYCTLWMS7T&cid=1225279321.1732925793&gtm=45je4bk0v888887061z8852362024za200zb852362024&aip=1&dma=1&dma_cps=syphamo&gcd=13l3l3l2l1l1&npa=1&frm=0&tag_exp=101925629~102067555~102067808~102077855~102081485&tag_exp=101925629~102067555~102067808~102077855~102081485&z=234061040

Requested by

Host: bishopfox.com
URL: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.206.67 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr35s11-in-f3.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui

Response headers

cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Sat, 30 Nov 2024 00:16:32 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 / Show response
c.6sc.co/ 7 B
191 B 65ms
9ms XHR
text/html 95.101.111.170
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to

Full URL: https://c.6sc.co/
Requested by: Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 95.101.111.170 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS: a95-101-111-170.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui

Response headers

access-control-max-age: 86400
access-control-allow-credentials: true
access-control-allow-methods: GET,POST
access-control-allow-origin: https://bishopfox.com
content-length: 7
date: Sat, 30 Nov 2024 00:16:32 GMT
content-type: text/html
access-control-allow-headers: *

GET
H2 200 / Show response
ipv6.6sc.co/ 14 B
298 B 75ms
10ms XHR
text/html 2a02:26f0:480:23::1726:629c
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to

Full URL: https://ipv6.6sc.co/
Requested by: Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:480:23::1726:629c Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS
Software: /
Resource Hash: fbb3bcb80a056423c4e9c19e56998a54ac7444913f387f2294acd76786fad9dc

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui

Response headers

cache-control: max-age=0, no-cache, no-store
pragma: no-cache
6si-ipv6: 2a01:4a0:5a::4
expires: Sat, 30 Nov 2024 00:16:32 GMT
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1732925792788_388391900_684641349_22_926_6_11_219";dur=1
access-control-allow-origin: https://bishopfox.com
content-length: 14
date: Sat, 30 Nov 2024 00:16:32 GMT
content-type: text/html
vary: Origin

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 136ms
100ms Image
image/gif 95.101.111.170
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=46da313aa8ef51ce5d666ee13565a60d&svisitor=null&visitor=3bd058d4-4f59-4b4c-83d5-233cdbb3de9d&session=c8e116c6-e717-4332-8135-72d1e897871f&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Sat%2C%2030%20Nov%202024%2000%3A16%3A32%20GMT%22%7D&isIframe=false&m=%7B%22description%22%3A%22Telerik%20UI%20for%20ASP.NET%20AJAX%20insecurely%20deserializes%20JSON%20objects%20resulting%20in%20arbitrary%20RCE.%20Learn%20how%20to%20patch%20and%20securely%20configure%20this%20software.%22%2C%22keywords%22%3A%22Bishop%20Fox%2Cbishopfox%22%2C%22title%22%3A%22CVE-2019-18935%3A%20Remote%20Code%20Execution%20via%20Insecure%E2%80%A6%20%7C%20Bishop%20Fox%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fbishopfox.com%2Fblog%2Fcve-2019-18935-remote-code-execution-in-telerik-ui&pageViewId=5f9e516b-bc34-46b9-8658-0bbd346dd798&v=1.1.29

Requested by

Host: bishopfox.com
URL: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

95.101.111.170 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a95-101-111-170.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "60bb2e15-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Sat, 30 Nov 2024 00:16:32 GMT
accept-ranges: bytes
content-length: 43
date: Sat, 30 Nov 2024 00:16:32 GMT
content-type: image/gif
last-modified: Sat, 05 Jun 2021 07:56:05 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 135ms
99ms Image
image/gif 95.101.111.170
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=46da313aa8ef51ce5d666ee13565a60d&svisitor=null&visitor=3bd058d4-4f59-4b4c-83d5-233cdbb3de9d&session=c8e116c6-e717-4332-8135-72d1e897871f&event=ni%3AasyncSettingsAudit&q=%7B%22settings%22%3A%22%5B%7B%5C%22name%5C%22%3A%5C%22enableEventTracking%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Sat%2C%2030%20Nov%202024%2000%3A16%3A32%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setToken%5C%22%2C%5C%22value%5C%22%3A%5C%2246da313aa8ef51ce5d666ee13565a60d%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Sat%2C%2030%20Nov%202024%2000%3A16%3A32%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEpsilonKey%5C%22%2C%5C%22value%5C%22%3A%5C%220caaefc3332fdd4eec18425690340c8e6e833c79%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Sat%2C%2030%20Nov%202024%2000%3A16%3A32%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEndpoint%5C%22%2C%5C%22value%5C%22%3A%5C%22b.6sc.co%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Sat%2C%2030%20Nov%202024%2000%3A16%3A32%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableCompanyDetails%5C%22%2C%5C%22value%5C%22%3A%5C%22%5Btrue%2Cnull%2C3%5D%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Sat%2C%2030%20Nov%202024%2000%3A16%3A32%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%5D%22%7D&isIframe=false&m=%7B%22description%22%3A%22Telerik%20UI%20for%20ASP.NET%20AJAX%20insecurely%20deserializes%20JSON%20objects%20resulting%20in%20arbitrary%20RCE.%20Learn%20how%20to%20patch%20and%20securely%20configure%20this%20software.%22%2C%22keywords%22%3A%22Bishop%20Fox%2Cbishopfox%22%2C%22title%22%3A%22CVE-2019-18935%3A%20Remote%20Code%20Execution%20via%20Insecure%E2%80%A6%20%7C%20Bishop%20Fox%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fbishopfox.com%2Fblog%2Fcve-2019-18935-remote-code-execution-in-telerik-ui&pageViewId=5f9e516b-bc34-46b9-8658-0bbd346dd798&v=1.1.29

Requested by

Host: bishopfox.com
URL: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

95.101.111.170 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a95-101-111-170.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "60bb2e15-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Sat, 30 Nov 2024 00:16:32 GMT
accept-ranges: bytes
content-length: 43
date: Sat, 30 Nov 2024 00:16:32 GMT
content-type: image/gif
last-modified: Sat, 05 Jun 2021 07:56:05 GMT
server: nginx/1.14.0 (Ubuntu)

POST
H2 204 / Show response
px.ads.linkedin.com/wa/ 0
699 B 238ms
112ms XHR
text/plain 2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://px.ads.linkedin.com/wa/
Requested by: Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Accept: *
Content-Type: text/plain;charset=UTF-8

Response headers

linkedin-action: 1
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: 30E4950F53054C08B640AE126E1EDFB4 Ref B: FRAEDGE1407 Ref C: 2024-11-30T00:16:32Z
x-li-fabric: prod-lva1
access-control-allow-credentials: true
x-li-uuid: AAYoFjpPThvxkE3r1tdTPg==
x-li-proto: http/2
access-control-allow-origin: https://bishopfox.com
x-cache: CONFIG_NOCACHE
date: Sat, 30 Nov 2024 00:16:32 GMT
vary: Origin

GET
H2 200 attribution_trigger Show response
px.ads.linkedin.com/ 2 B
812 B 289ms
165ms XHR
application/json 2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://px.ads.linkedin.com/attribution_trigger?pid=2404668&time=1732925792757&url=https%3A%2F%2Fbishopfox.com%2Fblog%2Fcve-2019-18935-remote-code-execution-in-telerik-ui&tm=gtmv2
Requested by: Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Accept: *
Referer: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui

Response headers

x-li-pop: afd-prod-ltx1-x
content-encoding: gzip
x-fs-uuid: 000628163a4fa76415ab6e6b89a1000e
x-msedge-ref: Ref A: B49F4602E1F64D9CA909E2F9F2482E5D Ref B: FRAEDGE1611 Ref C: 2024-11-30T00:16:32Z
x-li-fabric: prod-ltx1
x-restli-protocol-version: 1.0.0
access-control-allow-methods: GET, OPTIONS
x-li-uuid: AAYoFjpPp2QVq25riaEADg==
x-li-proto: http/2
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
date: Sat, 30 Nov 2024 00:16:32 GMT
content-type: application/json
access-control-allow-headers: *

GET
H2

200

collect
px4.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=2404668&time=1732925792757&url=https%3A%2F%2Fbishopfox.com%2Fblog%2Fcve-2019-18935-remote-code-execution-in-telerik-ui&tm=gtmv2
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=2404668&time=1732925792757&url=https%3A%2F%2Fbishopfox.com%2Fblog%2Fcve-2019-18935-remote-code-execution-in-telerik-ui&tm=gtmv2&e_ipv6=AQI5pxvgIK...

0
265 B

229ms
154ms

Image
application/javascript

13.107.42.14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=2404668&time=1732925792757&url=https%3A%2F%2Fbishopfox.com%2Fblog%2Fcve-2019-18935-remote-code-execution-in-telerik-ui&tm=gtmv2&e_ipv6=AQI5pxvgIKo3OAAAAZN6bSLBtGYj4R5IwJ6TmmSex5XhjSPE8jkZE3uhbm4Kt-Ru
Requested by: Host: bishopfox.com
URL: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui
Protocol: H2
Server: 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui

Response headers

linkedin-action: 1
x-li-pop: afd-prod-ltx1-x
x-msedge-ref: Ref A: 607C401D5AEC475AB9E84CAE3E5C8CB9 Ref B: FRAEDGE1922 Ref C: 2024-11-30T00:16:33Z
x-li-fabric: prod-ltx1
x-li-uuid: AAYoFjpTMfEBNaTiaN2T4g==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
date: Sat, 30 Nov 2024 00:16:32 GMT
content-type: application/javascript

Redirect headers

linkedin-action: 1
x-li-pop: afd-prod-ltx1-x
location: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=2404668&time=1732925792757&url=https%3A%2F%2Fbishopfox.com%2Fblog%2Fcve-2019-18935-remote-code-execution-in-telerik-ui&tm=gtmv2&e_ipv6=AQI5pxvgIKo3OAAAAZN6bSLBtGYj4R5IwJ6TmmSex5XhjSPE8jkZE3uhbm4Kt-Ru
x-msedge-ref: Ref A: F47D6013D87E4EE78819801E4B8E1B2F Ref B: FRAEDGE1407 Ref C: 2024-11-30T00:16:32Z
x-li-fabric: prod-ltx1
x-li-uuid: AAYoFjpPqeKRfkfqjuS70g==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
date: Sat, 30 Nov 2024 00:16:32 GMT

GET
H2 200 modules.86621fa4aeada5bcf025.js Show response
script.hotjar.com/ 222 KB
55 KB 41ms
7ms Script
application/javascript 13.33.187.92
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://script.hotjar.com/modules.86621fa4aeada5bcf025.js

Requested by

Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-3197627.js?sv=7

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.33.187.92 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-33-187-92.fra60.r.cloudfront.net

Software

Resource Hash

feb5c0ee05ef970a3cf34bac95d465e96ccb3a3df353b3a641d9391c168e68ad

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui

Response headers

x-robots-tag: none
content-encoding: br
etag: "ff8702986a1c41356391628a5f5d6f03"
age: 813866
x-content-type-options: nosniff
x-cache: Hit from cloudfront
x-amz-cf-id: ccwSm5Y3K2Xncip95xe40W2P7gfpwGkzc6Soqnl-NSuIhXqu9X6gSA==
date: Wed, 20 Nov 2024 14:12:06 GMT
content-type: application/javascript; charset=utf-8
last-modified: Wed, 20 Nov 2024 14:11:55 GMT
vary: Accept-Encoding
strict-transport-security: max-age=2592000; includeSubDomains
cache-control: max-age=31536000
cross-origin-resource-policy: cross-origin
via: 1.1 3677df2c828d68a6a84555cd8a40cf50.cloudfront.net (CloudFront)
accept-ranges: bytes
access-control-allow-origin: *
content-length: 56243
x-amz-cf-pop: FRA60-P9

GET
H2 200 ping Show response
okt.to/ 0
100 B 393ms
100ms Script
text/javascript 23.22.90.252
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://okt.to/ping?uri=%2Fblog%2Fcve-2019-18935-remote-code-execution-in-telerik-ui&aid=001dzcq4hiuk8ev&ts=1732925792823

Requested by

Host: static.oktopost.com
URL: https://static.oktopost.com/oktrk.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.22.90.252 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-23-22-90-252.compute-1.amazonaws.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui

Response headers

date: Sat, 30 Nov 2024 00:16:33 GMT
strict-transport-security: max-age=31536000;
content-type: text/javascript;charset=UTF-8

GET
H2 200 www-widgetapi.js Show response
www.youtube.com/s/player/b46bb280/www-widgetapi.vflset/ 30 KB
10 KB 9ms
7ms Script
text/javascript 2a00:1450:4001:827::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/b46bb280/www-widgetapi.vflset/www-widgetapi.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/iframe_api

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

14939503c8a97bef459ce94218f0e65933ab569f7b1d726bcb0b3c1031ebccf9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui

Response headers

content-encoding: br
age: 6414
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
x-content-type-options: nosniff
expires: Sat, 29 Nov 2025 22:29:38 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 29 Nov 2024 22:29:38 GMT
last-modified: Mon, 25 Nov 2024 05:12:10 GMT
content-type: text/javascript
vary: Accept-Encoding, Origin
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
content-length: 10165
x-xss-protection: 0
server: sffe

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/163/ 11 KB
5 KB 9ms
8ms Script
application/x-javascript 104.102.43.106
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/163/munchkin.js
Requested by: Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/munchkin.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.102.43.106 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-102-43-106.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 68cc280ce370c6f1f51a4fc5950103fc38df80a429552c549add04ebd8bd3a23

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui

Response headers

Cache-Control: max-age=8640000
Content-Encoding: gzip
ETag: "ea7826f34518d7c2295738f39c7640fa:1672972000.238769"
Connection: keep-alive
Expires: Mon, 10 Mar 2025 00:16:32 GMT
Accept-Ranges: bytes
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Content-Length: 4741
Date: Sat, 30 Nov 2024 00:16:32 GMT
Content-Type: application/x-javascript
Last-Modified: Fri, 06 Jan 2023 02:26:40 GMT
Server: AkamaiNetStorage
Vary: Accept-Encoding

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 103ms
103ms Image
image/gif 95.101.111.170
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=46da313aa8ef51ce5d666ee13565a60d&svisitor=null&visitor=3bd058d4-4f59-4b4c-83d5-233cdbb3de9d&session=c8e116c6-e717-4332-8135-72d1e897871f&event=ipv6&q=%7B%22address%22%3A%222a01%3A4a0%3A5a%3A%3A4%22%7D&isIframe=false&m=%7B%22description%22%3A%22Telerik%20UI%20for%20ASP.NET%20AJAX%20insecurely%20deserializes%20JSON%20objects%20resulting%20in%20arbitrary%20RCE.%20Learn%20how%20to%20patch%20and%20securely%20configure%20this%20software.%22%2C%22keywords%22%3A%22Bishop%20Fox%2Cbishopfox%22%2C%22title%22%3A%22CVE-2019-18935%3A%20Remote%20Code%20Execution%20via%20Insecure%E2%80%A6%20%7C%20Bishop%20Fox%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fbishopfox.com%2Fblog%2Fcve-2019-18935-remote-code-execution-in-telerik-ui&pageViewId=5f9e516b-bc34-46b9-8658-0bbd346dd798&ipv6=2a01%3A4a0%3A5a%3A%3A4&v=1.1.29

Requested by

Host: bishopfox.com
URL: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

95.101.111.170 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a95-101-111-170.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "63f02dad-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Sat, 30 Nov 2024 00:16:32 GMT
accept-ranges: bytes
content-length: 43
date: Sat, 30 Nov 2024 00:16:32 GMT
content-type: image/gif
last-modified: Sat, 18 Feb 2023 01:45:17 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 204 3197627 Show response
vc.hotjar.io/sessions/ 0
231 B 91ms
35ms XHR
text/plain 18.66.112.79
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://vc.hotjar.io/sessions/3197627?s=0.25&r=0.010267888436428008
Requested by: Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.112.79 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-112-79.fra56.r.cloudfront.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui

Response headers

via: 1.1 1fd323b9134f7d940dac0d007036a604.cloudfront.net (CloudFront)
access-control-allow-origin: *
cache-control: no-store
x-cache: Miss from cloudfront
x-amz-cf-id: y752VSo2zrE0AmZmsmOrlNjiIkGkKW3M0psisxnzkRC1bHp-xQB3tw==
date: Sat, 30 Nov 2024 00:16:32 GMT
x-amz-cf-pop: FRA56-P5

POST
H/1.1 200
OK visitWebPage
136-utj-516.mktoresp.com/webevents/ 2 B
318 B 969ms
156ms Ping
text/plain 192.28.147.68
OMNITURE

General

Check archive.org

Show headers Download Go to

Full URL: https://136-utj-516.mktoresp.com/webevents/visitWebPage?_mchNc=1732925792898&_mchCn=&_mchId=136-UTJ-516&_mchTk=_mch-bishopfox.com-1732925792897-42054&_mchHo=bishopfox.com&_mchPo=&_mchRu=%2Fblog%2Fcve-2019-18935-remote-code-execution-in-telerik-ui&_mchPc=https%3A&_mchVr=163&_mchEcid=&_mchHa=&_mchRe=&_mchQp=
Requested by: Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/163/munchkin.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 192.28.147.68 , United States, ASN15224 (OMNITURE, US),
Reverse DNS
Software: nginx/1.20.1 /
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui

Response headers

Transfer-Encoding: chunked
X-Request-Id: 2ecf4f6f-3456-4673-adf0-05fab2d8a67c
Content-Encoding: gzip
Connection: keep-alive
Access-Control-Allow-Origin: *
Date: Sat, 30 Nov 2024 00:16:33 GMT
Content-Type: text/plain; charset=UTF-8
Server: nginx/1.20.1

GET
H2 200 details Show response
eps.6sc.co/v3/company/ 740 B
650 B 62ms
45ms XHR
application/json 75.2.108.141
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://eps.6sc.co/v3/company/details
Requested by: Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 75.2.108.141 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afe865822f884bb48.awsglobalaccelerator.com
Software: /
Resource Hash: a16a8eb1006deca6a9a6ccedf5176d374b3ea8d35ff08cf29321623d0c943f69

Request headers

Authorization: Token 0caaefc3332fdd4eec18425690340c8e6e833c79
X-6s-CustomID: WebTag1.0 46da313aa8ef51ce5d666ee13565a60d
Referer: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

access-control-expose-headers: X-6si-Region
timing-allow-origin: https://6sense.com
content-encoding: gzip
x-6si-region
access-control-allow-credentials: true
access-control-allow-origin: https://bishopfox.com
content-length: 393
date: Sat, 30 Nov 2024 00:16:33 GMT
content-type: application/json
vary: Origin, Accept-Encoding

OPTIONS
H2 200 details
eps.6sc.co/v3/company/ Frame 0
0 60ms
11ms Preflight 75.2.108.141
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://eps.6sc.co/v3/company/details
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 75.2.108.141 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afe865822f884bb48.awsglobalaccelerator.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,x-6s-customid
Access-Control-Request-Method: GET
Origin: https://bishopfox.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: authorization,x-6s-customid
access-control-allow-methods: OPTIONS,GET
access-control-allow-origin: https://bishopfox.com
access-control-expose-headers: X-6si-Region
access-control-max-age: 1800
content-length: 0
date: Sat, 30 Nov 2024 00:16:32 GMT
timing-allow-origin: https://6sense.com
x-6si-region

GET
H2 200 dtp-1.0.4.html Show response
go.bishopfox.com/ Frame 0F0F 2 KB
962 B 370ms
369ms Document
text/html 104.17.73.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://go.bishopfox.com/dtp-1.0.4.html

Requested by

Host: go.bishopfox.com
URL: https://go.bishopfox.com/rs/136-UTJ-516/images/simpledto-1.0.4.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.73.206 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1a3d43e5d83b4956e9fb87e21b9851fb4f87bca59e71e8d8644a3a154ef16b83

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

cf-cache-status: DYNAMIC
cf-ray: 8ea6a63dba2a35e1-FRA
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Sat, 30 Nov 2024 00:16:33 GMT
p3p: CP="CAO CURa ADMa DEVa TAIa OUR IND UNI COM NAV INT"
server: cloudflare
vary: *,Accept-Encoding
x-asset-type: LP
x-content-type-options: nosniff

GET
H2 200 forms2.min.js Show response
go.bishopfox.com/js/forms2/js/ Frame 60E2 199 KB
66 KB 24ms
23ms Script
application/x-javascript 104.17.73.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://go.bishopfox.com/js/forms2/js/forms2.min.js

Requested by

Host: go.bishopfox.com
URL: https://go.bishopfox.com/index.php/form/XDFrame

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.73.206 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0e1bfe53260b5fa35318df2850a20f74c97d41af88b7d233d331811d842f26d3

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://go.bishopfox.com/index.php/form/XDFrame

Response headers

cache-control: public, max-age=14400
content-encoding: gzip
cf-cache-status: HIT
etag: "35e2b53-31b73-6265f6d8e0642"
age: 6737
x-content-type-options: nosniff
cf-ray: 8ea6a63dfa7e35e1-FRA
expires: Sat, 30 Nov 2024 04:16:32 GMT
date: Sat, 30 Nov 2024 00:16:32 GMT
content-type: application/x-javascript
last-modified: Fri, 08 Nov 2024 04:46:02 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 getuidj Show response
secure.adnxs.com/ 11 B
697 B 103ms
21ms XHR
application/json 37.252.172.123
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/getuidj

Requested by

Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.123 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

868.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

nginx/1.23.4 /

Resource Hash

31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui

Response headers

cache-control: no-store, no-cache, private
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 80.255.10.200; 80.255.10.200; 868.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: https://bishopfox.com
an-x-request-uuid: 8855e62b-8927-48c0-9b8e-b2f066384143
content-length: 11
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Sat, 30 Nov 2024 00:16:33 GMT
x-xss-protection: 0
content-type: application/json; charset=utf-8
server: nginx/1.23.4

GET
H2 200 / Show response
c.6sc.co/ 7 B
191 B 10ms
8ms XHR
text/html 95.101.111.170
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to

Full URL: https://c.6sc.co/
Requested by: Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 95.101.111.170 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS: a95-101-111-170.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui

Response headers

access-control-max-age: 86400
access-control-allow-credentials: true
access-control-allow-methods: GET,POST
access-control-allow-origin: https://bishopfox.com
content-length: 7
date: Sat, 30 Nov 2024 00:16:33 GMT
content-type: text/html
access-control-allow-headers: *

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 101ms
98ms Image
image/gif 95.101.111.170
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: bishopfox.com
URL: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

95.101.111.170 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a95-101-111-170.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "60bb2e15-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Sat, 30 Nov 2024 00:16:33 GMT
accept-ranges: bytes
content-length: 43
date: Sat, 30 Nov 2024 00:16:33 GMT
content-type: image/gif
last-modified: Sat, 05 Jun 2021 07:56:05 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 99ms
96ms Image
image/gif 95.101.111.170
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: bishopfox.com
URL: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

95.101.111.170 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a95-101-111-170.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "63f020a0-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Sat, 30 Nov 2024 00:16:33 GMT
accept-ranges: bytes
content-length: 43
date: Sat, 30 Nov 2024 00:16:33 GMT
content-type: image/gif
last-modified: Sat, 18 Feb 2023 00:49:36 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 100ms
98ms Image
image/gif 95.101.111.170
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: bishopfox.com
URL: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

95.101.111.170 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a95-101-111-170.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "60bb2e15-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Sat, 30 Nov 2024 00:16:33 GMT
accept-ranges: bytes
content-length: 43
date: Sat, 30 Nov 2024 00:16:33 GMT
content-type: image/gif
last-modified: Sat, 05 Jun 2021 07:56:05 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 98ms
97ms Image
image/gif 95.101.111.170
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: bishopfox.com
URL: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

95.101.111.170 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a95-101-111-170.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "615ccf10-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Sat, 30 Nov 2024 00:16:33 GMT
accept-ranges: bytes
content-length: 43
date: Sat, 30 Nov 2024 00:16:33 GMT
content-type: image/gif
last-modified: Tue, 05 Oct 2021 22:17:52 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 98ms
97ms Image
image/gif 95.101.111.170
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: bishopfox.com
URL: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

95.101.111.170 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a95-101-111-170.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "63f020a0-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Sat, 30 Nov 2024 00:16:33 GMT
accept-ranges: bytes
content-length: 43
date: Sat, 30 Nov 2024 00:16:33 GMT
content-type: image/gif
last-modified: Sat, 18 Feb 2023 00:49:36 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 265ms
264ms Image
image/gif 95.101.111.170
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: bishopfox.com
URL: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

95.101.111.170 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a95-101-111-170.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "63f020a0-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Sat, 30 Nov 2024 00:16:33 GMT
accept-ranges: bytes
content-length: 43
date: Sat, 30 Nov 2024 00:16:33 GMT
content-type: image/gif
last-modified: Sat, 18 Feb 2023 00:49:36 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 97ms
96ms Image
image/gif 95.101.111.170
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: bishopfox.com
URL: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

95.101.111.170 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a95-101-111-170.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "63f02dad-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Sat, 30 Nov 2024 00:16:33 GMT
accept-ranges: bytes
content-length: 43
date: Sat, 30 Nov 2024 00:16:33 GMT
content-type: image/gif
last-modified: Sat, 18 Feb 2023 01:45:17 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 97ms
95ms Image
image/gif 95.101.111.170
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: bishopfox.com
URL: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

95.101.111.170 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a95-101-111-170.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "63f02dad-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Sat, 30 Nov 2024 00:16:33 GMT
accept-ranges: bytes
content-length: 43
date: Sat, 30 Nov 2024 00:16:33 GMT
content-type: image/gif
last-modified: Sat, 18 Feb 2023 01:45:17 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 98ms
97ms Image
image/gif 95.101.111.170
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: bishopfox.com
URL: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

95.101.111.170 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a95-101-111-170.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "615ccf10-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Sat, 30 Nov 2024 00:16:33 GMT
accept-ranges: bytes
content-length: 43
date: Sat, 30 Nov 2024 00:16:33 GMT
content-type: image/gif
last-modified: Tue, 05 Oct 2021 22:17:52 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 98ms
97ms Image
image/gif 95.101.111.170
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: bishopfox.com
URL: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

95.101.111.170 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a95-101-111-170.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "60bb2e15-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Sat, 30 Nov 2024 00:16:33 GMT
accept-ranges: bytes
content-length: 43
date: Sat, 30 Nov 2024 00:16:33 GMT
content-type: image/gif
last-modified: Sat, 05 Jun 2021 07:56:05 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 97ms
96ms Image
image/gif 95.101.111.170
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: bishopfox.com
URL: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

95.101.111.170 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a95-101-111-170.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "63f02dad-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Sat, 30 Nov 2024 00:16:33 GMT
accept-ranges: bytes
content-length: 43
date: Sat, 30 Nov 2024 00:16:33 GMT
content-type: image/gif
last-modified: Sat, 18 Feb 2023 01:45:17 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 97ms
95ms Image
image/gif 95.101.111.170
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: bishopfox.com
URL: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

95.101.111.170 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a95-101-111-170.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "5e502810-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Sat, 30 Nov 2024 00:16:33 GMT
accept-ranges: bytes
content-length: 43
date: Sat, 30 Nov 2024 00:16:33 GMT
content-type: image/gif
last-modified: Fri, 21 Feb 2020 18:57:20 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 / Show response
c.6sc.co/ 7 B
191 B 15ms
8ms XHR
text/html 95.101.111.170
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to

Full URL: https://c.6sc.co/
Requested by: Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 95.101.111.170 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS: a95-101-111-170.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui

Response headers

access-control-max-age: 86400
access-control-allow-credentials: true
access-control-allow-methods: GET,POST
access-control-allow-origin: https://bishopfox.com
content-length: 7
date: Sat, 30 Nov 2024 00:16:33 GMT
content-type: text/html
access-control-allow-headers: *

GET
H2 200 / Show response
ipv6.6sc.co/ 14 B
297 B 9ms
9ms XHR
text/html 2a02:26f0:480:23::1726:629c
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to

Full URL: https://ipv6.6sc.co/
Requested by: Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:480:23::1726:629c Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS
Software: /
Resource Hash: fbb3bcb80a056423c4e9c19e56998a54ac7444913f387f2294acd76786fad9dc

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui

Response headers

cache-control: max-age=0, no-cache, no-store
pragma: no-cache
6si-ipv6: 2a01:4a0:5a::4
expires: Sat, 30 Nov 2024 00:16:33 GMT
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1732925793013_388391900_684641428_25_1352_6_0_219";dur=1
access-control-allow-origin: https://bishopfox.com
content-length: 14
date: Sat, 30 Nov 2024 00:16:33 GMT
content-type: text/html
vary: Origin

OPTIONS
H2 200 v
v.eps.6sc.co/ Frame 0
0 147ms
104ms Preflight
application/json 13.35.58.85
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://v.eps.6sc.co/v
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.35.58.85 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-35-58-85.fra60.r.cloudfront.net
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://bishopfox.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token
access-control-allow-methods: OPTIONS,POST
access-control-allow-origin: *
content-length: 0
content-type: application/json
date: Sat, 30 Nov 2024 00:16:33 GMT
via: 1.1 0679859c01a1d918f3fb77e42174ecf8.cloudfront.net (CloudFront)
x-amz-apigw-id: CCLnPHYgIAMEXig=
x-amz-cf-id: 0B_yiOtRuWkTGmJL2rdWrnkZcNPyQuwmYj1srHJwINlsL7LbgBu9Cg==
x-amz-cf-pop: FRA60-P10
x-amzn-requestid: f7164490-d31b-4235-acb8-4883c0dff47e
x-cache: Miss from cloudfront

POST
H2 200 v Show response
v.eps.6sc.co/ 12 B
519 B 372ms
371ms XHR
application/json 13.35.58.85
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://v.eps.6sc.co/v
Requested by: Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.35.58.85 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-35-58-85.fra60.r.cloudfront.net
Software: /
Resource Hash: 512a4f403d30a587ad5ab0b9fa7b2fd4f078249ee03f9c23c445332838f6a436

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-type: application/json
Referer: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui

Response headers

x-amz-apigw-id: CCLnSF-AIAMEiBw=
x-amzn-trace-id: Root=1-674a5961-4b7b4f941e86d3231a4b1179;Parent=04d363b7a1f0ff70;Sampled=0;Lineage=1:56167173:0
access-control-allow-methods: OPTIONS,POST
x-amzn-requestid: 59bc687c-da00-4d03-9388-f5d835c6ff4e
via: 1.1 0679859c01a1d918f3fb77e42174ecf8.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-cache: Miss from cloudfront
content-length: 12
x-amz-cf-id: cy0OeUt357iRPQUTeBmd93S4Wydj2q12WUke1eE1j2Y47V1CY_c1oA==
date: Sat, 30 Nov 2024 00:16:33 GMT
content-type: application/json
x-amz-cf-pop: FRA60-P10
access-control-allow-headers: Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 96ms
95ms Image
image/gif 95.101.111.170
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=6sense-temp-analytics&svisitor=null&visitor=3bd058d4-4f59-4b4c-83d5-233cdbb3de9d&session=c8e116c6-e717-4332-8135-72d1e897871f&event=https%3A%2F%2Feps.6sc.co&q=%7B%22name%22%3A%22https%3A%2F%2Feps.6sc.co%2Fv3%2Fcompany%2Fdetails%22%2C%22entryType%22%3A%22resource%22%2C%22startTime%22%3A1120.8999996185303%2C%22duration%22%3A123.10000038146973%2C%22initiatorType%22%3A%22xmlhttprequest%22%2C%22deliveryType%22%3A%22%22%2C%22nextHopProtocol%22%3A%22%22%2C%22renderBlockingStatus%22%3A%22non-blocking%22%2C%22workerStart%22%3A0%2C%22redirectStart%22%3A0%2C%22redirectEnd%22%3A0%2C%22fetchStart%22%3A1120.8999996185303%2C%22domainLookupStart%22%3A0%2C%22domainLookupEnd%22%3A0%2C%22connectStart%22%3A0%2C%22secureConnectionStart%22%3A0%2C%22connectEnd%22%3A0%2C%22requestStart%22%3A0%2C%22responseStart%22%3A0%2C%22firstInterimResponseStart%22%3A0%2C%22responseEnd%22%3A1244%2C%22transferSize%22%3A0%2C%22encodedBodySize%22%3A0%2C%22decodedBodySize%22%3A0%2C%22responseStatus%22%3A200%2C%22serverTiming%22%3A%5B%5D%2C%22metadata%22%3A%7B%22region%22%3A%22header-blocked%22%7D%7D&isIframe=false&m=%7B%22endpoint%22%3A%22epsilon.6sense.com%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fbishopfox.com%2Fblog%2Fcve-2019-18935-remote-code-execution-in-telerik-ui&pageViewId=&d=1&v=1.1.29

Requested by

Host: bishopfox.com
URL: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

95.101.111.170 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a95-101-111-170.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "615ccf10-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Sat, 30 Nov 2024 00:16:33 GMT
accept-ranges: bytes
content-length: 43
date: Sat, 30 Nov 2024 00:16:33 GMT
content-type: image/gif
last-modified: Tue, 05 Oct 2021 22:17:52 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 index.js Show response
assets.adoberesources.net/builds/a9003c40a9fbd8edefc244f3ff896ab7a0cdcc2b/dist/core/src/ 219 KB
48 KB 381ms
381ms Script
application/x-javascript 2a02:26f0:480:980::1e80
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adoberesources.net/builds/a9003c40a9fbd8edefc244f3ff896ab7a0cdcc2b/dist/core/src/index.js
Requested by: Host: assets.adoberesources.net
URL: https://assets.adoberesources.net/loader.js?orgId=C4C8CBC15571F3C07F000101%40AdobeOrg&instanceId=bishopfox&env=prod&geo=va7
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:480:980::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 1f646ac3fe733e1ab872265de6f88b7df14eae05a2aed29690d89a2f3ac08d52

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui

Response headers

cache-control: max-age=600
content-encoding: gzip
etag: "66523cb4a934b683e67c7799e063dcaa:1731909486.013335"
expires: Sat, 30 Nov 2024 00:26:33 GMT
accept-ranges: bytes
date: Sat, 30 Nov 2024 00:16:33 GMT
content-type: application/x-javascript
last-modified: Mon, 18 Nov 2024 05:58:06 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 index.js Show response
assets.adoberesources.net/builds/a9003c40a9fbd8edefc244f3ff896ab7a0cdcc2b/dist/core-ui/src/ 189 KB
49 KB 355ms
354ms Script
application/x-javascript 2a02:26f0:480:980::1e80
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adoberesources.net/builds/a9003c40a9fbd8edefc244f3ff896ab7a0cdcc2b/dist/core-ui/src/index.js
Requested by: Host: assets.adoberesources.net
URL: https://assets.adoberesources.net/loader.js?orgId=C4C8CBC15571F3C07F000101%40AdobeOrg&instanceId=bishopfox&env=prod&geo=va7
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:480:980::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 5476623a31e6f3b61233c5722a2d9c05138481258159cba3302e596fbdc138f0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui

Response headers

cache-control: max-age=600
content-encoding: gzip
etag: "387407bd02590101dfe583ec777ec59f:1731909485.945591"
expires: Sat, 30 Nov 2024 00:26:33 GMT
accept-ranges: bytes
date: Sat, 30 Nov 2024 00:16:33 GMT
content-type: application/x-javascript
last-modified: Mon, 18 Nov 2024 05:58:05 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 details Show response
eps.6sc.co/v3/company/ 740 B
649 B 40ms
40ms XHR
application/json 75.2.108.141
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://eps.6sc.co/v3/company/details
Requested by: Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 75.2.108.141 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afe865822f884bb48.awsglobalaccelerator.com
Software: /
Resource Hash: 5620db9e8a5b228694efb9ce55c54f0b55599f9eec55f49f8f54690b61a5a688

Request headers

Authorization: Token c0fba949f488b90c50c22d5976c56599ae3dfc5e
X-6s-CustomID: WebTag 6f09130d-7972-4a5f-8f14-2c3cb7605834
Referer: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

access-control-expose-headers: X-6si-Region
timing-allow-origin: https://6sense.com
content-encoding: gzip
x-6si-region
access-control-allow-credentials: true
access-control-allow-origin: https://bishopfox.com
content-length: 393
date: Sat, 30 Nov 2024 00:16:33 GMT
content-type: application/json
vary: Origin, Accept-Encoding

GET
H2 200 simpledto-1.0.4.js Show response
go.bishopfox.com/rs/136-UTJ-516/images/ Frame 0F0F 2 KB
0 0ms
0ms Script
application/x-javascript 104.17.73.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://go.bishopfox.com/rs/136-UTJ-516/images/simpledto-1.0.4.js

Requested by

Host: go.bishopfox.com
URL: https://go.bishopfox.com/dtp-1.0.4.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.73.206 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e0ea4dbd2c85145cacf92362ae72dc6d56be63d1a68f0d492f55699959874940

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://go.bishopfox.com/dtp-1.0.4.html

Response headers

cache-control: public, max-age=60
content-encoding: gzip
cf-cache-status: REVALIDATED
etag: "36a0049-8b5-623b1337890de"
x-content-type-options: nosniff
cf-ray: 8ea6a63b792635e1-FRA
expires: Sat, 30 Nov 2024 00:17:32 GMT
accept-ranges: bytes
content-length: 1092
date: Sat, 30 Nov 2024 00:16:32 GMT
content-type: application/x-javascript
last-modified: Sat, 05 Oct 2024 02:03:59 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 stripmkttok.js Show response
go.bishopfox.com/js/ Frame 0F0F 2 KB
785 B 409ms
408ms Script
application/x-javascript 104.17.73.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://go.bishopfox.com/js/stripmkttok.js

Requested by

Host: go.bishopfox.com
URL: https://go.bishopfox.com/dtp-1.0.4.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.73.206 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f7545b96ed2740220c349ae9deb614faf1f0f211d4cf710788e0790f74cc9715

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://go.bishopfox.com/dtp-1.0.4.html

Response headers

cache-control: public, max-age=14400
content-encoding: gzip
cf-cache-status: REVALIDATED
etag: "35e2908-602-62370c030d900"
x-content-type-options: nosniff
cf-ray: 8ea6a640cbcf35e1-FRA
expires: Sat, 30 Nov 2024 04:16:33 GMT
accept-ranges: bytes
content-length: 678
date: Sat, 30 Nov 2024 00:16:33 GMT
content-type: application/x-javascript
last-modified: Tue, 01 Oct 2024 21:10:28 GMT
vary: Accept-Encoding
server: cloudflare

OPTIONS
H2 204 activation
hummingbirdwebsocket-va7.cloud.adobe.io/ Frame 0
0 428ms
98ms Preflight 20.186.185.227
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://hummingbirdwebsocket-va7.cloud.adobe.io/activation
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 20.186.185.227 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: adobe /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://bishopfox.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: content-type
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE
access-control-allow-origin: *
date: Sat, 30 Nov 2024 00:16:33 GMT
server: adobe
vary: Access-Control-Request-Headers

POST
H2 200 activation Show response
hummingbirdwebsocket-va7.cloud.adobe.io/ 376 B
524 B 786ms
785ms Fetch
application/json 20.186.185.227
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://hummingbirdwebsocket-va7.cloud.adobe.io/activation

Requested by

Host: assets.adoberesources.net
URL: https://assets.adoberesources.net/builds/a9003c40a9fbd8edefc244f3ff896ab7a0cdcc2b/dist/core/src/index.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

20.186.185.227 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

adobe /

Resource Hash

85f82cead6dde6364c03467a5b3be4fc25dab7a9dbd9b11fa7fbe0e56bd27d64

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
content-type: application/json
Referer: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui

Response headers

cache-control: no-cache
etag: W/"178-obeaKLOk4zz0TkQxo36LygNEX1s"
x-content-type-options: nosniff
access-control-allow-origin: *
content-length: 376
date: Sat, 30 Nov 2024 00:16:34 GMT
content-type: application/json; charset=utf-8
server: adobe

GET
H2 200 u
cdn.bizible.com/ 43 B
109 B 9ms
9ms Image
image/gif 152.195.15.58
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.bizible.com/u?mapType=mkto&mapValue=id%3A136-UTJ-516%26token%3A_mch-bishopfox.com-1732925792897-42054&_biz_u=9374a1b7d40c4cfbd6ba2ccfa1a19391&_biz_l=https%3A%2F%2Fbishopfox.com%2Fblog%2Fcve-2019-18935-remote-code-execution-in-telerik-ui&_biz_t=1732925793518&_biz_i=CVE-2019-18935%3A%20Remote%20Code%20Execution%20via%20Insecure%E2%80%A6%20%7C%20Bishop%20Fox&_biz_n=1&rnd=937278&cdn_o=a&_biz_z=1732925793518

Requested by

Host: bishopfox.com
URL: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

152.195.15.58 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (frb/67C2) /

Resource Hash

afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSub

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui

Response headers

strict-transport-security: max-age=31536000; includeSub
cache-control: no-cache, no-store
pragma: no-cache
age: 515448
expires: -1
accept-ranges: bytes
x-cache: HIT
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
content-length: 43
date: Sat, 30 Nov 2024 00:16:33 GMT
content-type: Image/GIF
last-modified: Sun, 24 Nov 2024 01:05:45 GMT
server: ECS (frb/67C2)

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 94ms
94ms Image
image/gif 95.101.111.170
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=46da313aa8ef51ce5d666ee13565a60d&svisitor=null&visitor=3bd058d4-4f59-4b4c-83d5-233cdbb3de9d&session=c8e116c6-e717-4332-8135-72d1e897871f&event=active_time_track&q=%7B%22currentTime%22%3A%22Sat%2C%2030%20Nov%202024%2000%3A16%3A33%20GMT%22%2C%22lastTrackTime%22%3A%22Sat%2C%2030%20Nov%202024%2000%3A16%3A32%20GMT%22%2C%22timeSpent%22%3A%221006%22%2C%22totalTimeSpent%22%3A%221006%22%7D&isIframe=false&m=%7B%22description%22%3A%22Telerik%20UI%20for%20ASP.NET%20AJAX%20insecurely%20deserializes%20JSON%20objects%20resulting%20in%20arbitrary%20RCE.%20Learn%20how%20to%20patch%20and%20securely%20configure%20this%20software.%22%2C%22keywords%22%3A%22Bishop%20Fox%2Cbishopfox%22%2C%22title%22%3A%22CVE-2019-18935%3A%20Remote%20Code%20Execution%20via%20Insecure%E2%80%A6%20%7C%20Bishop%20Fox%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fbishopfox.com%2Fblog%2Fcve-2019-18935-remote-code-execution-in-telerik-ui&pageViewId=5f9e516b-bc34-46b9-8658-0bbd346dd798&an_uid=0&webTagId=6f09130d-7972-4a5f-8f14-2c3cb7605834&ipv6=2a01%3A4a0%3A5a%3A%3A4&v=1.1.29

Requested by

Host: bishopfox.com
URL: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

95.101.111.170 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a95-101-111-170.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "5e502810-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Sat, 30 Nov 2024 00:16:33 GMT
accept-ranges: bytes
content-length: 43
date: Sat, 30 Nov 2024 00:16:33 GMT
content-type: image/gif
last-modified: Fri, 21 Feb 2020 18:57:20 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 favicon.ico
bishopfox.com/ 7 KB
2 KB 203ms
203ms Other
image/x-icon 2606:4700:20::ac43:532a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://bishopfox.com/favicon.ico

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:532a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d3826dd7fbdcdef003f176c1794200b4745679b7f9a6da92c3fd58c8dc31dbaa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui

Response headers

content-encoding: gzip
cf-cache-status: REVALIDATED
etag: W/"661d8e63-1cee"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ccWXBkkq5R3fu68dYX2ba12%2FToqHpkhTuOlnsJYUzcOZ5fmJUiVvk8Dg0ueWktQa6BUoAtCctJ0xBHTH5JqSRxJKeapusY4g7OZ4lgrjU3ZZ5VLI8qnYT7StC6sau5XOA%2Bu6mEU4N5jz6tI%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
server-timing: cfL4;desc="?proto=TCP&rtt=12800&min_rtt=6165&rtt_var=10886&sent=437&recv=211&lost=0&retrans=0&sent_bytes=449767&recv_bytes=3884&delivery_rate=17164073&cwnd=358&unsent_bytes=0&cid=37b9743f00a41fe8&ts=2216&x=0"
date: Sat, 30 Nov 2024 00:16:34 GMT
content-type: image/x-icon
last-modified: Mon, 15 Apr 2024 20:30:27 GMT
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8ea6a64379c5dc62-FRA
x-xss-protection: 1; mode=block
server: cloudflare

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 97ms
96ms Image
image/gif 95.101.111.170
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=46da313aa8ef51ce5d666ee13565a60d&svisitor=null&visitor=3bd058d4-4f59-4b4c-83d5-233cdbb3de9d&session=c8e116c6-e717-4332-8135-72d1e897871f&event=active_time_track&q=%7B%22currentTime%22%3A%22Sat%2C%2030%20Nov%202024%2000%3A16%3A34%20GMT%22%2C%22lastTrackTime%22%3A%22Sat%2C%2030%20Nov%202024%2000%3A16%3A33%20GMT%22%2C%22timeSpent%22%3A%221007%22%2C%22totalTimeSpent%22%3A%222013%22%7D&isIframe=false&m=%7B%22description%22%3A%22Telerik%20UI%20for%20ASP.NET%20AJAX%20insecurely%20deserializes%20JSON%20objects%20resulting%20in%20arbitrary%20RCE.%20Learn%20how%20to%20patch%20and%20securely%20configure%20this%20software.%22%2C%22keywords%22%3A%22Bishop%20Fox%2Cbishopfox%22%2C%22title%22%3A%22CVE-2019-18935%3A%20Remote%20Code%20Execution%20via%20Insecure%E2%80%A6%20%7C%20Bishop%20Fox%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fbishopfox.com%2Fblog%2Fcve-2019-18935-remote-code-execution-in-telerik-ui&pageViewId=5f9e516b-bc34-46b9-8658-0bbd346dd798&an_uid=0&webTagId=6f09130d-7972-4a5f-8f14-2c3cb7605834&ipv6=2a01%3A4a0%3A5a%3A%3A4&v=1.1.29

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

95.101.111.170 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a95-101-111-170.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "63f02dad-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Sat, 30 Nov 2024 00:16:34 GMT
accept-ranges: bytes
content-length: 43
date: Sat, 30 Nov 2024 00:16:34 GMT
content-type: image/gif
last-modified: Sat, 18 Feb 2023 01:45:17 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 stylesettings Show response
hummingbirdwebsocket-va7.cloud.adobe.io/ 1 KB
1 KB 171ms
170ms Fetch
application/json 20.186.185.227
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://hummingbirdwebsocket-va7.cloud.adobe.io/stylesettings?settingsUrl=https%3A%2F%2Fassets.adoberesources.net%2Fapi-test%2Fsettings%2FC4C8CBC15571F3C07F000101%2540AdobeOrg-bishopfox-348b5b73-1296-47fd-88ba-14fe3203df1c.json

Requested by

Host: assets.adoberesources.net
URL: https://assets.adoberesources.net/builds/a9003c40a9fbd8edefc244f3ff896ab7a0cdcc2b/dist/core/src/index.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

20.186.185.227 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

adobe /

Resource Hash

e6d708de422b683f821220251f554e997ba36e835f61399b4babcca300560c02

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui

Response headers

cache-control: no-cache
etag: W/"544-OzudnLyyrI19mKc1pVqVRTq2mGU"
x-content-type-options: nosniff
access-control-allow-origin: *
content-length: 1348
date: Sat, 30 Nov 2024 00:16:35 GMT
content-type: application/json; charset=utf-8
server: adobe

GET
H2 200 localization Show response
hummingbirdwebsocket-va7.cloud.adobe.io/ 5 KB
5 KB 108ms
108ms Fetch
application/json 20.186.185.227
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://hummingbirdwebsocket-va7.cloud.adobe.io/localization?localeUrl=https%3A%2F%2Fassets.adoberesources.net%2Fl10n%2Fen_US.json

Requested by

Host: assets.adoberesources.net
URL: https://assets.adoberesources.net/builds/a9003c40a9fbd8edefc244f3ff896ab7a0cdcc2b/dist/core/src/index.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

20.186.185.227 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

adobe /

Resource Hash

39f3e3989367c1c5dcdeab586262418396d04143ef9de99a4d086c3bea42adf5

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui

Response headers

cache-control: no-cache
etag: W/"1557-y6hR3oMJ/25q+/UrbzIiz6rWFUY"
x-content-type-options: nosniff
access-control-allow-origin: *
content-length: 5463
date: Sat, 30 Nov 2024 00:16:35 GMT
content-type: application/json; charset=utf-8
server: adobe

GET
H2 200 hqg0ebf.css
use.typekit.net/ 3 KB
944 B 49ms
13ms Stylesheet
text/css 2a02:26f0:480:f::213:7ec6
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to

Full URL

https://use.typekit.net/hqg0ebf.css

Requested by

Host: assets.adoberesources.net
URL: https://assets.adoberesources.net/builds/a9003c40a9fbd8edefc244f3ff896ab7a0cdcc2b/dist/core-ui/src/index.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:480:f::213:7ec6 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

Software

nginx /

Resource Hash

d3f4f6edc0c442123d55e26f0a4088c3591263c99710f63b9f71bef42866abb0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui

Response headers

strict-transport-security: max-age=31536000; includeSubDomains;
cache-control: private, max-age=600, stale-while-revalidate=604800
timing-allow-origin: *
content-encoding: gzip
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 722
date: Sat, 30 Nov 2024 00:16:35 GMT
content-type: text/css;charset=utf-8
vary: Accept-Encoding
server: nginx

GET
H2 200 S_Chat.svg
assets.adoberesources.net/svg/ 654 B
810 B 359ms
359ms Image
image/svg+xml 2a02:26f0:480:980::1e80
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.adoberesources.net/svg/S_Chat.svg
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:480:980::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 0a41bf8e99425c5dccdb6125752b98fc74f30b883e23a32f58b839e771254972

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://bishopfox.com/

Response headers

accept-ranges: bytes
content-length: 654
etag: "f4ee7d3ae097901f9dec499a736795d7:1674516339.812776"
date: Sat, 30 Nov 2024 00:16:35 GMT
content-type: image/svg+xml
last-modified: Mon, 23 Jan 2023 23:25:39 GMT
server: AkamaiNetStorage

GET
H2 200 p.css
p.typekit.net/ 5 B
173 B 42ms
8ms Stylesheet
text/css 2a02:26f0:480:f::213:7edb
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to

Full URL: https://p.typekit.net/p.css?s=1&k=hqg0ebf&ht=tk&f=6846.6847.6848.6851&a=27321458&app=typekit&e=css
Requested by: Host: use.typekit.net
URL: https://use.typekit.net/hqg0ebf.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:480:f::213:7edb Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS
Software: nginx /
Resource Hash: 1c0ff118a4290c99f39c90abb38703a866e47251b23cca20266c69c812ccafeb

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://use.typekit.net/hqg0ebf.css

Response headers

cache-control: public, max-age=604800
etag: "6649f74c-5"
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
content-length: 5
date: Sat, 30 Nov 2024 00:16:35 GMT
content-type: text/css
last-modified: Sun, 19 May 2024 12:57:48 GMT
server: nginx

GET
H2 200 closebuttondc.svg
assets.adoberesources.net/svg/ 1008 B
1 KB 349ms
348ms Image
image/svg+xml 2a02:26f0:480:980::1e80
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.adoberesources.net/svg/closebuttondc.svg
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:480:980::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 8d91eceb33b79decaa0eeae15dc865a8ce4700a19dbbc063b7884beb0faaca18

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://bishopfox.com/

Response headers

accept-ranges: bytes
content-length: 1008
etag: "8bcaff383d385e41da1857336f0c4afd:1640036276.02663"
date: Sat, 30 Nov 2024 00:16:35 GMT
content-type: image/svg+xml
last-modified: Mon, 20 Dec 2021 21:37:56 GMT
server: AkamaiNetStorage

GET
H2 200 l
use.typekit.net/af/1b1b1e/00000000000000000001709e/27/ 24 KB
24 KB 31ms
7ms Font
application/font-woff2 2a02:26f0:480:f::213:7ec6
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to

Full URL: https://use.typekit.net/af/1b1b1e/00000000000000000001709e/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n7&v=3
Requested by: Host: use.typekit.net
URL: https://use.typekit.net/hqg0ebf.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:480:f::213:7ec6 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS
Software: nginx /
Resource Hash: 9bacad71ca24f6147c4b72a6c0f351b07ba93b70f992082b812681fb3b46d9b6

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://bishopfox.com
Referer: https://use.typekit.net/hqg0ebf.css

Response headers

cache-control: public, max-age=31536000
timing-allow-origin: *
etag: "f507d4945327bf77fa226b6fef0f1c6a6af3bf09"
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 24180
date: Sat, 30 Nov 2024 00:16:35 GMT
content-type: application/font-woff2
server: nginx

GET
H2 200 l
use.typekit.net/af/cafa63/00000000000000000001709a/27/ 24 KB
24 KB 32ms
8ms Font
application/font-woff2 2a02:26f0:480:f::213:7ec6
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to

Full URL: https://use.typekit.net/af/cafa63/00000000000000000001709a/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n4&v=3
Requested by: Host: use.typekit.net
URL: https://use.typekit.net/hqg0ebf.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:480:f::213:7ec6 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS
Software: nginx /
Resource Hash: 5461e0722bbe365dfa0df4652c60a6ced5f83c840d03021c4abd04ae9f9c6980

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://bishopfox.com
Referer: https://use.typekit.net/hqg0ebf.css

Response headers

cache-control: public, max-age=31536000
timing-allow-origin: *
etag: "1500587fffa9a4bb64d06e988493ea23a02a484a"
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 24272
date: Sat, 30 Nov 2024 00:16:35 GMT
content-type: application/font-woff2
server: nginx

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 95ms
95ms Image
image/gif 95.101.111.170
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=46da313aa8ef51ce5d666ee13565a60d&svisitor=null&visitor=3bd058d4-4f59-4b4c-83d5-233cdbb3de9d&session=c8e116c6-e717-4332-8135-72d1e897871f&event=active_time_track&q=%7B%22currentTime%22%3A%22Sat%2C%2030%20Nov%202024%2000%3A16%3A35%20GMT%22%2C%22lastTrackTime%22%3A%22Sat%2C%2030%20Nov%202024%2000%3A16%3A34%20GMT%22%2C%22timeSpent%22%3A%221000%22%2C%22totalTimeSpent%22%3A%223013%22%7D&isIframe=false&m=%7B%22description%22%3A%22Telerik%20UI%20for%20ASP.NET%20AJAX%20insecurely%20deserializes%20JSON%20objects%20resulting%20in%20arbitrary%20RCE.%20Learn%20how%20to%20patch%20and%20securely%20configure%20this%20software.%22%2C%22keywords%22%3A%22Bishop%20Fox%2Cbishopfox%22%2C%22title%22%3A%22CVE-2019-18935%3A%20Remote%20Code%20Execution%20via%20Insecure%E2%80%A6%20%7C%20Bishop%20Fox%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fbishopfox.com%2Fblog%2Fcve-2019-18935-remote-code-execution-in-telerik-ui&pageViewId=5f9e516b-bc34-46b9-8658-0bbd346dd798&an_uid=0&webTagId=6f09130d-7972-4a5f-8f14-2c3cb7605834&ipv6=2a01%3A4a0%3A5a%3A%3A4&v=1.1.29

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

95.101.111.170 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a95-101-111-170.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "5e502810-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Sat, 30 Nov 2024 00:16:35 GMT
accept-ranges: bytes
content-length: 43
date: Sat, 30 Nov 2024 00:16:35 GMT
content-type: image/gif
last-modified: Fri, 21 Feb 2020 18:57:20 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 96ms
96ms Image
image/gif 95.101.111.170
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=46da313aa8ef51ce5d666ee13565a60d&svisitor=null&visitor=3bd058d4-4f59-4b4c-83d5-233cdbb3de9d&session=c8e116c6-e717-4332-8135-72d1e897871f&event=active_time_track&q=%7B%22currentTime%22%3A%22Sat%2C%2030%20Nov%202024%2000%3A16%3A36%20GMT%22%2C%22lastTrackTime%22%3A%22Sat%2C%2030%20Nov%202024%2000%3A16%3A35%20GMT%22%2C%22timeSpent%22%3A%221000%22%2C%22totalTimeSpent%22%3A%224013%22%7D&isIframe=false&m=%7B%22description%22%3A%22Telerik%20UI%20for%20ASP.NET%20AJAX%20insecurely%20deserializes%20JSON%20objects%20resulting%20in%20arbitrary%20RCE.%20Learn%20how%20to%20patch%20and%20securely%20configure%20this%20software.%22%2C%22keywords%22%3A%22Bishop%20Fox%2Cbishopfox%22%2C%22title%22%3A%22CVE-2019-18935%3A%20Remote%20Code%20Execution%20via%20Insecure%E2%80%A6%20%7C%20Bishop%20Fox%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fbishopfox.com%2Fblog%2Fcve-2019-18935-remote-code-execution-in-telerik-ui&pageViewId=5f9e516b-bc34-46b9-8658-0bbd346dd798&an_uid=0&webTagId=6f09130d-7972-4a5f-8f14-2c3cb7605834&ipv6=2a01%3A4a0%3A5a%3A%3A4&v=1.1.29

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

95.101.111.170 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a95-101-111-170.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "5e502810-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Sat, 30 Nov 2024 00:16:36 GMT
accept-ranges: bytes
content-length: 43
date: Sat, 30 Nov 2024 00:16:36 GMT
content-type: image/gif
last-modified: Fri, 21 Feb 2020 18:57:20 GMT
server: nginx/1.14.0 (Ubuntu)

POST
H2 204 collect
region1.analytics.google.com/g/ 0
0 16ms
14ms Fetch
text/plain 2001:4860:4802:34::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-DYCTLWMS7T&gtm=45je4bk0v888887061z8852362024za200zb852362024&_p=1732925791941&gcd=13l3l3l2l1l1&npa=1&dma_cps=syphamo&dma=1&tag_exp=101925629~102067555~102067808~102077855~102081485&cid=1225279321.1732925793&ul=de-de&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&sid=1732925792&sct=1&seg=0&dl=https%3A%2F%2Fbishopfox.com%2Fblog%2Fcve-2019-18935-remote-code-execution-in-telerik-ui&dt=CVE-2019-18935%3A%20Remote%20Code%20Execution%20via%20Insecure%E2%80%A6%20%7C%20Bishop%20Fox&_s=2&tfd=5939
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-DYCTLWMS7T&l=dataLayer&cx=c&gtm=45He4bk0v852362024za200
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:136:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:136:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://bishopfox.com
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 30 Nov 2024 00:16:37 GMT
content-type: text/plain
server: Golfe2

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 96ms
96ms Image
image/gif 95.101.111.170
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=46da313aa8ef51ce5d666ee13565a60d&svisitor=null&visitor=3bd058d4-4f59-4b4c-83d5-233cdbb3de9d&session=c8e116c6-e717-4332-8135-72d1e897871f&event=active_time_track&q=%7B%22currentTime%22%3A%22Sat%2C%2030%20Nov%202024%2000%3A16%3A37%20GMT%22%2C%22lastTrackTime%22%3A%22Sat%2C%2030%20Nov%202024%2000%3A16%3A36%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%225014%22%7D&isIframe=false&m=%7B%22description%22%3A%22Telerik%20UI%20for%20ASP.NET%20AJAX%20insecurely%20deserializes%20JSON%20objects%20resulting%20in%20arbitrary%20RCE.%20Learn%20how%20to%20patch%20and%20securely%20configure%20this%20software.%22%2C%22keywords%22%3A%22Bishop%20Fox%2Cbishopfox%22%2C%22title%22%3A%22CVE-2019-18935%3A%20Remote%20Code%20Execution%20via%20Insecure%E2%80%A6%20%7C%20Bishop%20Fox%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fbishopfox.com%2Fblog%2Fcve-2019-18935-remote-code-execution-in-telerik-ui&pageViewId=5f9e516b-bc34-46b9-8658-0bbd346dd798&an_uid=0&webTagId=6f09130d-7972-4a5f-8f14-2c3cb7605834&ipv6=2a01%3A4a0%3A5a%3A%3A4&v=1.1.29

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

95.101.111.170 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a95-101-111-170.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "5e502810-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Sat, 30 Nov 2024 00:16:37 GMT
accept-ranges: bytes
content-length: 43
date: Sat, 30 Nov 2024 00:16:37 GMT
content-type: image/gif
last-modified: Fri, 21 Feb 2020 18:57:20 GMT
server: nginx/1.14.0 (Ubuntu)

GET img.gif
b.6sc.co/v1/beacon/ 0
0

POST v
v.eps.6sc.co/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: b.6sc.co
URL: https://b.6sc.co/v1/beacon/img.gif?token=6sense-temp-analytics&svisitor=null&visitor=3bd058d4-4f59-4b4c-83d5-233cdbb3de9d&session=c8e116c6-e717-4332-8135-72d1e897871f&event=https%3A%2F%2Feps.6sc.co&q=%7B%22name%22%3A%22https%3A%2F%2Feps.6sc.co%2Fv3%2Fcompany%2Fdetails%22%2C%22entryType%22%3A%22resource%22%2C%22startTime%22%3A1120.8999996185303%2C%22duration%22%3A123.10000038146973%2C%22initiatorType%22%3A%22xmlhttprequest%22%2C%22deliveryType%22%3A%22%22%2C%22nextHopProtocol%22%3A%22%22%2C%22renderBlockingStatus%22%3A%22non-blocking%22%2C%22workerStart%22%3A0%2C%22redirectStart%22%3A0%2C%22redirectEnd%22%3A0%2C%22fetchStart%22%3A1120.8999996185303%2C%22domainLookupStart%22%3A0%2C%22domainLookupEnd%22%3A0%2C%22connectStart%22%3A0%2C%22secureConnectionStart%22%3A0%2C%22connectEnd%22%3A0%2C%22requestStart%22%3A0%2C%22responseStart%22%3A0%2C%22firstInterimResponseStart%22%3A0%2C%22responseEnd%22%3A1244%2C%22transferSize%22%3A0%2C%22encodedBodySize%22%3A0%2C%22decodedBodySize%22%3A0%2C%22responseStatus%22%3A200%2C%22serverTiming%22%3A%5B%5D%2C%22metadata%22%3A%7B%7D%7D&isIframe=false&m=%7B%22endpoint%22%3A%22epsilon.6sense.com%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fbishopfox.com%2Fblog%2Fcve-2019-18935-remote-code-execution-in-telerik-ui&pageViewId=&d=1&v=1.1.29

Domain: v.eps.6sc.co
URL: https://v.eps.6sc.co/v

Verdicts & Comments Add Verdict or Comment

65 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

25 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.youtube.com/	1969-12-31 23:59:59	Name: YSC Value: yo12YUSfegc
.youtube.com/	1970-01-21 05:41:17	Name: VISITOR_INFO1_LIVE Value: XQhrnadqi5I
.youtube.com/	1970-01-21 05:41:17	Name: VISITOR_PRIVACY_METADATA Value: CgJERRIEEgAgOA%3D%3D
.bishopfox.com/	1970-01-21 10:07:41	Name: _biz_uid Value: 9374a1b7d40c4cfbd6ba2ccfa1a19391
.bizible.com/	1970-01-21 10:07:41	Name: _BUID Value: 9374a1b7d40c4cfbd6ba2ccfa1a19391
.bishopfox.com/	1970-01-21 05:41:17	Name: dpi_utmOrigVals Value: %7B%22Utm_Orig_Medium__c%22%3A%22none%22%2C%22Utm_Orig_Source__c%22%3A%22none%22%7D
.go.bishopfox.com/	1970-01-21 01:22:07	Name: __cf_bm Value: MKzx2gkADag57BLpcDqnr6W2FkF7pAlZnHBxbnKprdI-1732925792-1.0.1.1-WcnNDiXzYZjJzZbbtJ23uR.c4H29mMusyBYD_XmsLmp1Chs2AR3kBDUrQ0aum6VPKuHdPh.AI1jLfw7iDoaI3w
.bizibly.com/	1970-01-21 10:07:41	Name: _BUID Value: 5c20870983fe8f86a521b86adf53cc40
.bishopfox.com/	1970-01-21 03:31:41	Name: _rdt_uuid Value: 1732925792600.d2d6697a-c746-41dc-b7ea-879dd680ccfe
.bishopfox.com/	1970-01-21 10:58:05	Name: _ga Value: GA1.1.1225279321.1732925793
bishopfox.com/	1970-01-21 10:58:05	Name: _gd_visitor Value: 3bd058d4-4f59-4b4c-83d5-233cdbb3de9d
bishopfox.com/	1970-01-21 01:22:20	Name: _gd_session Value: c8e116c6-e717-4332-8135-72d1e897871f
.bishopfox.com/	1970-01-21 10:07:41	Name: _hjSessionUser_3197627 Value: eyJpZCI6ImFmNzVkZTAyLWU5YzgtNTJkOC04MDFjLTc2YTNkMjY2OTM4NSIsImNyZWF0ZWQiOjE3MzI5MjU3OTI4OTMsImV4aXN0aW5nIjpmYWxzZX0=
.bishopfox.com/	1970-01-21 01:22:07	Name: _hjSession_3197627 Value: eyJpZCI6IjQ2ZmUzYmE5LTU1ZjctNDIwOS1iODkzLWUzODZmMTk1NDhkMSIsImMiOjE3MzI5MjU3OTI4OTQsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=
.bishopfox.com/	1970-01-21 10:58:05	Name: _mkto_trk Value: id:136-UTJ-516&token:_mch-bishopfox.com-1732925792897-42054
.linkedin.com/	1970-01-21 10:07:41	Name: bcookie Value: "v=2&b6918e44-0c4d-4611-8246-d481ed26fb76"
.linkedin.com/	1970-01-21 05:41:17	Name: li_gc Value: MTswOzE3MzI5MjU3OTI7MjswMjGhu8TDOI+HpfkLy2pMDPTtVoKNwK0e7vE/+ePkqFeJ7g==
.linkedin.com/	1970-01-21 01:23:32	Name: lidc Value: "b=TGST02:s=T:r=T:a=T:p=T:g=3420:u=1:x=1:i=1732925792:t=1733012192:v=2:sig=AQEwW73AdZYgEMQx3lGR3lnybLYV7KEn"
.adnxs.com/	1970-01-21 10:58:05	Name: receive-cookie-deprecation Value: 1
bishopfox.com/	1970-01-21 01:32:10	Name: _an_uid Value: 0
.bishopfox.com/	1970-01-21 10:58:05	Name: _ga_DYCTLWMS7T Value: GS1.1.1732925792.1.0.1732925793.59.0.0
go.bishopfox.com/	1969-12-31 23:59:59	Name: BIGipServersj36web-nginx-app_https Value: !LnWpXtDyTcTduXWu/iht9W3PGpXZcsgmETrVoT3fKnqEmRjvzXd6ze1qFsbnVV4SEi+AaWurscOyRRQ=
.bishopfox.com/	1970-01-21 10:07:41	Name: _biz_nA Value: 2
.bishopfox.com/	1970-01-21 10:07:41	Name: _biz_flagsA Value: %7B%22Version%22%3A1%2C%22ViewThrough%22%3A%221%22%2C%22XDomain%22%3A%221%22%2C%22Mkto%22%3A%221%22%7D
.bishopfox.com/	1970-01-21 10:07:41	Name: _biz_pendingA Value: %5B%5D

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	warning	URL: https://go.bishopfox.com/rs/136-UTJ-516/images/simpledto-1.0.4.js(Line 9) Message: document.domain mutation is ignored because the surrounding agent cluster is origin-keyed.
security	warning	URL: https://go.bishopfox.com/rs/136-UTJ-516/images/simpledto-1.0.4.js(Line 9) Message: document.domain mutation is ignored because the surrounding agent cluster is origin-keyed.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

136-utj-516.mktoresp.com
alb.reddit.com
assets.adoberesources.net
assets.bishopfox.com
b.6sc.co
bishopfox.com
c.6sc.co
cdn.bizible.com
cdn.bizibly.com
cdnjs.cloudflare.com
eps.6sc.co
fast.wistia.net
go.bishopfox.com
hummingbirdwebsocket-va7.cloud.adobe.io
ipv6.6sc.co
j.6sc.co
munchkin.marketo.net
okt.to
p.typekit.net
pixel-config.reddit.com
px.ads.linkedin.com
px4.ads.linkedin.com
region1.analytics.google.com
script.hotjar.com
secure.adnxs.com
snap.licdn.com
static.hotjar.com
static.oktopost.com
stats.g.doubleclick.net
use.typekit.net
v.eps.6sc.co
vc.hotjar.io
www.google.de
www.googletagmanager.com
www.redditstatic.com
www.youtube.com
b.6sc.co
v.eps.6sc.co
104.102.43.106
104.17.24.14
104.17.73.206
13.107.42.14
13.32.27.15
13.33.187.92
13.35.58.85
142.250.184.232
151.101.65.140
152.195.15.58
18.66.112.79
192.28.147.68
20.186.185.227
2001:4860:4802:34::36
216.58.206.67
23.22.90.252
2600:9000:20eb:3000:16:ce50:9480:93a1
2606:4700:20::ac43:532a
2620:1ec:21::14
2a00:1450:4001:809::200e
2a00:1450:4001:827::200e
2a00:1450:4001:831::2008
2a00:1450:400c:c06::9b
2a02:26f0:480:15::213:7e4a
2a02:26f0:480:23::1726:629c
2a02:26f0:480:980::1e80
2a02:26f0:480:f::213:7ec6
2a02:26f0:480:f::213:7edb
2a04:4e42:200::396
2a04:4e42:200::644
3.160.150.119
37.252.172.123
75.2.108.141
95.101.111.170
01d05adf19a7f6884bea90a5630127f932a74e235fe9368ef602481f1e2984d8
09016600a13dd4825b72516765a8da53d1ab896f7582c4619d014e8ee147ea84
0a41bf8e99425c5dccdb6125752b98fc74f30b883e23a32f58b839e771254972
0e1bfe53260b5fa35318df2850a20f74c97d41af88b7d233d331811d842f26d3
10429db431cbd2fc042c7397c8f1e62996d636ddeef2702c912d9fb7fc650c35
14939503c8a97bef459ce94218f0e65933ab569f7b1d726bcb0b3c1031ebccf9
1a3d43e5d83b4956e9fb87e21b9851fb4f87bca59e71e8d8644a3a154ef16b83
1c0ff118a4290c99f39c90abb38703a866e47251b23cca20266c69c812ccafeb
1f646ac3fe733e1ab872265de6f88b7df14eae05a2aed29690d89a2f3ac08d52
22cfce9d9ab7490b5b130e3acda48c6b0087a43bb695cbedcafe351a4879efe6
240d410aca3cee565e1ed42102cbb6a42922fdc9ad93f35a542d66168bf12d63
256e42104f48a5fa80b031da12dc56acde224fba3f9810f8f8192b39136d365a
264de9951d101b21f39220bec07e8e0654052142a85c59ec9ae0589d24eae70f
30777fec6d7682e924cca7808d8effdad171ece801cf2fb0509077fd9532c4f2
31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d
365f167a75f0de021be3c1a8a7cc99a3e21cc666f2889ccce438c3f013e0c10c
39f3e3989367c1c5dcdeab586262418396d04143ef9de99a4d086c3bea42adf5
3d811f5800a3e6af41835100774bcf8bd7c5dfde0e4fa368a8a77eeb1051d524
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
4499ff936d4fd562adca5a5cbe512dc19eb80942eee8618dafbcebc4f7974bdb
4cd9e7223f5db688cfc2941b58f58cba75e045dc75935841d70fe3207df0186a
4d4b6a308f7020554dfd5c36f7a1ec40a7ff919487c17d885ec38e50530d8f1c
512a4f403d30a587ad5ab0b9fa7b2fd4f078249ee03f9c23c445332838f6a436
5461e0722bbe365dfa0df4652c60a6ced5f83c840d03021c4abd04ae9f9c6980
5476623a31e6f3b61233c5722a2d9c05138481258159cba3302e596fbdc138f0
5620db9e8a5b228694efb9ce55c54f0b55599f9eec55f49f8f54690b61a5a688
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
56df5bf2317bc2156b954c3fd2913afcce23eb4947c47f3ac401017dc4a0151d
57cd46adbabd6c40823602b4513aecbe89320a769572255272abe9f008de69fa
59eabacb6366edf0795eec24fb521d41ea071bc70b1c90540235209c8b96e864
5ca272b5c51f5790821b50ebfb5f2868f20230a839431baf92f45bfff38861ea
68cc280ce370c6f1f51a4fc5950103fc38df80a429552c549add04ebd8bd3a23
7eb812bb352bdb0639450b6143b46593f3d7e01891baf0b864d3adcb3fcf9cc8
81f4d966b3823e18a9f948d189f763dce1325f94ecbd6df8282df67daeeab449
85f82cead6dde6364c03467a5b3be4fc25dab7a9dbd9b11fa7fbe0e56bd27d64
86f55ad6b90ad8ce93f7ea64a50306367d20470f43cae86ddd101ed6c7820c6e
8a27dc7b44ebe886390bfa0a9beeea36ea5a3f37479f0e0836b6c9b80d9b35ed
8bde8c262105b0b4001279d19d0aeab2915799d7869b34e2a07bfe6834aeefe3
8d91eceb33b79decaa0eeae15dc865a8ce4700a19dbbc063b7884beb0faaca18
95202acb1dba479b44d42a18e4cc5cea755d755d6bfba29a6ebb9a46c63b7804
98d77039ea9249b3dce91ad7b467ee382f29daa61213c3e2737bd4a8786c8801
9bacad71ca24f6147c4b72a6c0f351b07ba93b70f992082b812681fb3b46d9b6
a16a8eb1006deca6a9a6ccedf5176d374b3ea8d35ff08cf29321623d0c943f69
a2091f1ff92cc073e178dca31707853e0cc6cd913a5344a8978f040fa373efa6
aeb175fdbf6a9899f2d66b87c9d94ff35988926b1a5ae7de18f663d474d092db
afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277
bf85fc51636dd0c0211812a23f4122aa2d61e0c3934ddd43b5939046a07b4c2a
c2c76750672f1668a3df60c8aff4a8276b3bd847914543ca5a32a7751e67aa76
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
cd20510505fb1ae6d197c9183becce66a7cfdc41d4ffb833ecb4dc458e8bf4fd
d35a955dab9185e7b6171395335d054656e2d0006f6131d8cef6562ec18664e5
d3826dd7fbdcdef003f176c1794200b4745679b7f9a6da92c3fd58c8dc31dbaa
d3f4f6edc0c442123d55e26f0a4088c3591263c99710f63b9f71bef42866abb0
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
e0ea4dbd2c85145cacf92362ae72dc6d56be63d1a68f0d492f55699959874940
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e6d708de422b683f821220251f554e997ba36e835f61399b4babcca300560c02
e73bc7b9895bd73f0e62e9654f6d01295c874f1a2a2011f741ed9c6ea9930c29
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f052ee44c3728dfd23aba8a4567150bc314d23903026fbb6ad089422c2df56af
f45cdb3a12560d3dc31a9a244fda2f02526af5f2ac0afd78da98bb65553e0e0a
f7543874fd85ac54022e92bff1f3e54326ad7a136685439729114cd42b44ed2c
f7545b96ed2740220c349ae9deb614faf1f0f211d4cf710788e0790f74cc9715
fbb3bcb80a056423c4e9c19e56998a54ac7444913f387f2294acd76786fad9dc
fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a
feb5c0ee05ef970a3cf34bac95d465e96ccb3a3df353b3a641d9391c168e68ad
ff565c71f3c768cc25eeffcb7aad55834fef188f4ccbdf295589608aa5ae97f8

bishopfox.com Open in urlscan Pro 2606:4700:20::ac43:532a Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

106 Requests

97 %HTTPS

44 %IPv6

25 Domains

36 Subdomains

35 IPs

4 Countries

3616 kBTransfer

6193 kBSize

25 Cookies

35 Outgoing links

Page URL History

Redirected requests

106 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

bishopfox.com Open in urlscan Pro
2606:4700:20::ac43:532a Public Scan

Screenshot
Live screenshot

Full Image

106
Requests

97 %
HTTPS

44 %
IPv6

25
Domains

36
Subdomains

35
IPs

4
Countries

3616 kB
Transfer

6193 kB
Size

25
Cookies

106 HTTP transactions
1 data transactions