0x00sec.org Open in urlscan Pro
2606:4700:30::6812:3030 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/10802
Effective URL:
https://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/10802
Submission: On January 20 via manual (January 20th 2019, 12:55:19 pm UTC) from US

Summary HTTP 52 Redirects Links 13 Behaviour Indicators

Summary

This website contacted 7 IPs in 2 countries across 4 domains to perform 52 HTTP transactions. The main IP is 2606:4700:30::6812:3030, located in United States and belongs to CLOUDFLARENET - Cloudflare, Inc., US. The main domain is 0x00sec.org.
TLS certificate: Issued by COMODO ECC Domain Validation Secure S... on January 19th 2019. Valid for: 6 months.

This is the only time 0x00sec.org was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	2606:4700:30:... 2606:4700:30::6812:3130	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
33	2606:4700:30:... 2606:4700:30::6812:3030	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
2	52.216.107.30 52.216.107.30	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1 3	2a00:1450:400... 2a00:1450:4001:816::200e	15169 (GOOGLE) (GOOGLE - Google LLC)
13	2600:1fa0:802... 2600:1fa0:8024:8dc1:34d8:533b::	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1	52.216.236.251 52.216.236.251	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1	2a00:1450:400... 2a00:1450:400c:c0c::9a	15169 (GOOGLE) (GOOGLE - Google LLC)
52	7

1 2606:4700:30::6812:3130 (United States) 1 redirects

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

0x00sec.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

33 2606:4700:30::6812:3030 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

0x00sec.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.216.107.30 (Ashburn, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: s3-1.amazonaws.com

s3.amazonaws.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:816::200e (Ireland) 1 redirects

ASN15169 (GOOGLE - Google LLC, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 2600:1fa0:8024:8dc1:34d8:533b:: (United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)

0x00sec.s3.dualstack.us-east-1.amazonaws.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.216.236.251 (Ashburn, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: s3-1-w.amazonaws.com

0x00sec.s3.amazonaws.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c0c::9a (Ireland)

ASN15169 (GOOGLE - Google LLC, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
34	0x00sec.org 1 redirects 0x00sec.org	812 KB
16	amazonaws.com s3.amazonaws.com 0x00sec.s3.dualstack.us-east-1.amazonaws.com 0x00sec.s3.amazonaws.com	263 KB
3	google-analytics.com 1 redirects www.google-analytics.com	17 KB
1	doubleclick.net stats.g.doubleclick.net	102 B
52	4

	Domain	Requested by
34	0x00sec.org	1 redirects 0x00sec.org
13	0x00sec.s3.dualstack.us-east-1.amazonaws.com	0x00sec.org
3	www.google-analytics.com	1 redirects 0x00sec.org
2	s3.amazonaws.com	0x00sec.org
1	stats.g.doubleclick.net	0x00sec.org
1	0x00sec.s3.amazonaws.com	0x00sec.org
52	6

This site contains links to these domains. Also see Links.

Domain
init.0x00sec.org
www.bleepingcomputer.com
docs.microsoft.com
0x00sec.s3.dualstack.us-east-1.amazonaws.com
www.hackerone.com
github.com
medium.com
blog.reversinglabs.com
lolbas-project.github.io

Subject Issuer	Validity	Valid
sni52363.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2	`2019-01-19` - `2019-07-28`	6 months	crt.sh
s3.amazonaws.com DigiCert Baltimore CA-2 G2	`2018-12-03` - `2019-10-25`	a year	crt.sh
*.google.com Google Internet Authority G3	`2018-12-19` - `2019-03-13`	3 months	crt.sh
*.s3.amazonaws.com DigiCert Baltimore CA-2 G2	`2018-11-07` - `2020-02-07`	a year	crt.sh
*.g.doubleclick.net Google Internet Authority G3	`2018-12-19` - `2019-03-13`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/10802
Frame ID: FA8246A6FF8B6F83A2327DA35C181FCC
Requests: 54 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shel... HTTP 301
https://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shel... Page URL

Detected technologies

Discourse (Message Boards) Expand

Overall confidence: 100%
Detected patterns

meta generator /Discourse(?: ?\/?([\d.]+\d))?/i
env /Discourse/i

Ruby (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

meta generator /Discourse(?: ?\/?([\d.]+\d))?/i
env /Discourse/i

Ruby on Rails (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

meta generator /Discourse(?: ?\/?([\d.]+\d))?/i
env /Discourse/i

Ember.js (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

env /^Ember$/i

Handlebars (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

env /^Handlebars$/i
env /^Ember$/i

RequireJS (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

env /^requirejs$/i

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /cloudflare/i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|(analytics))\.js/i
env /^gaGlobal$/i

Modernizr (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

env /^Modernizr$/i

Moment.js (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

env /^moment$/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery(?:\-|\.)([\d.]*\d)[^\/]*\.js/i
script /jquery.*\.js/i
env /^jQuery$/i

Page Statistics

52
Requests

98 %
HTTPS

71 %
IPv6

4
Domains

6
Subdomains

7
IPs

2
Countries

1093 kB
Transfer

4288 kB
Size

4
Cookies

13 Outgoing links

These are links going to different origins than the main page.

URL: https://init.0x00sec.org/
Title: Init

Search URL Search Domain Scan URL

URL: https://init.0x00sec.org/?partners
Title: Partners

Search URL Search Domain Scan URL

URL: https://www.bleepingcomputer.com/news/microsoft/microsoft-disables-dde-feature-in-word-to-prevent-further-malware-attacks/
Title: shipped a patch 14

Search URL Search Domain Scan URL

URL: https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/ee844140(v=ws.10)
Title: this article 62

Search URL Search Domain Scan URL

URL: https://0x00sec.s3.dualstack.us-east-1.amazonaws.com/original/2X/6/6bd8344f1586c1c0b508559488cf3f158f8ca597.png
Title: image.png1088x460 181 KB

Search URL Search Domain Scan URL

URL: http://www.hackerone.com/crowdstrike
Title: www.hackerone.com/crowdstrike 52

Search URL Search Domain Scan URL

URL: https://github.com/itm4n/VBA-RunPE
Title: https://github.com/itm4n/VBA-RunPE 60

Search URL Search Domain Scan URL

URL: https://0x00sec.s3.dualstack.us-east-1.amazonaws.com/original/2X/9/9349e9b5fc470bfac5e33dfa3cedbf19ee9a3937.png
Title: excel.png1020x501 28.7 KB

Search URL Search Domain Scan URL

URL: https://medium.com/@Bank_Security/undetectable-c-c-reverse-shells-fab4c0ec4f15
Title: Medium – 16 Oct 18 153

Search URL Search Domain Scan URL

URL: https://docs.microsoft.com/en-us/security-updates/securityadvisories/2017/4053440#mitigating-dde-attack-scenarios
Title: docs.microsoft.com 10

Search URL Search Domain Scan URL

URL: https://0x00sec.s3.dualstack.us-east-1.amazonaws.com/original/2X/7/7d061fc93f07e809da66e911d832687823ad36dc.png
Title: Excel-DDE.png856x662 27.4 KB

Search URL Search Domain Scan URL

URL: https://blog.reversinglabs.com/blog/cvs-dde-exploits-and-obfuscation
Title: https://blog.reversinglabs.com/blog/cvs-dde-exploits-and-obfuscation 9

Search URL Search Domain Scan URL

URL: https://lolbas-project.github.io/
Title: https://lolbas-project.github.io/ 5

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/10802 HTTP 301
https://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/10802 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 50

https://www.google-analytics.com/r/collect?v=1&_v=j72&a=574750370&t=pageview&_s=1&dl=https%3A%2F%2F0x00sec.org%2Ft%2Fbypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell%2F10802&ul=en-us&de=UTF-8&dt=Bypassing%20Crowdstrike%20Falcon%20detection%2C%20from%20phishing%20email%20to%20reverse%20shell%20-%20Malware%20-%200x00sec%20-%20The%20Home%20of%20the%20Hacker&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&_u=IEBAAEAB~&jid=1315822204&gjid=1293116226&cid=736868056.1547988904&tid=UA-76839457-2&_gid=1487651396.1547988904&_r=1&z=693159844 HTTP 302
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-76839457-2&cid=736868056.1547988904&jid=1315822204&_gid=1487651396.1547988904&gjid=1293116226&_v=j72&z=693159844

52 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request 10802 Show response
0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/
Redirect Chain

http://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/10802
https://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/10802

193 KB
26 KB

478ms
453ms

Document
text/html

2606:4700:30::6812:3030
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/10802

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:30::6812:3030 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

c0b4f4cc7e22331a71a786a09a2074212fae6521d3e397de5bc0791a6c261a12

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: 0x00sec.org
:scheme: https
:path: /t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/10802
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

status: 200
date: Sun, 20 Jan 2019 12:55:02 GMT
content-type: text/html; charset=utf-8
set-cookie: __cfduid=ddf12e23ae0db11c7734dc6291a473ae11547988902; expires=Mon, 20-Jan-20 12:55:02 GMT; path=/; domain=.0x00sec.org; HttpOnly
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
x-download-options: noopen
x-permitted-cross-domain-policies: none
referrer-policy: strict-origin-when-cross-origin
x-discourse-route: topics/show
cache-control: no-cache, no-store
x-request-id: 37a2a84f-dd67-4cbd-8b7b-55c70613c9da
x-runtime: 0.401647
x-discourse-trackview: 1
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 49c1b16e9944bf11-FRA
content-encoding: br

Redirect headers

Date: Sun, 20 Jan 2019 12:55:02 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Cache-Control: max-age=3600
Expires: Sun, 20 Jan 2019 13:55:02 GMT
Location: https://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/10802
X-Content-Type-Options: nosniff
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 49c1b16e6732c2e2-FRA

GET
H2 200 en-d6299165162dfc167780df124080c35c02c6c14aeffa56811c064ff43634232d.js Show response
0x00sec.org/assets/locales/ 339 KB
70 KB 16ms
14ms Script
application/javascript 2606:4700:30::6812:3030
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://0x00sec.org/assets/locales/en-d6299165162dfc167780df124080c35c02c6c14aeffa56811c064ff43634232d.js

Requested by

Host: 0x00sec.org
URL: https://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/10802

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:30::6812:3030 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

51c1919c49aced13303ed2089a074a74c7f415c4c41278b78dcec33ed7a5eb8d

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

:path: /assets/locales/en-d6299165162dfc167780df124080c35c02c6c14aeffa56811c064ff43634232d.js
pragma: no-cache
cookie: __cfduid=ddf12e23ae0db11c7734dc6291a473ae11547988902
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: */*
cache-control: no-cache
:authority: 0x00sec.org
referer: https://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/10802
:scheme: https
:method: GET
Referer: https://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/10802
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Sun, 20 Jan 2019 12:55:02 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
last-modified: Wed, 19 Dec 2018 18:22:15 GMT
server: cloudflare
cf-polished: origSize=347225
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
status: 200
expires: Mon, 20 Jan 2020 12:55:02 GMT
cache-control: public, max-age=31536000
cf-ray: 49c1b1717ccabf11-FRA
cf-bgj: minify

GET
H2 200 ember_jquery-07f49b58317ea9292d939348ec0091eb50a9d8aaabd9e86cc074ef5f049918aa.js Show response
0x00sec.org/assets/ 576 KB
149 KB 34ms
33ms Script
application/javascript 2606:4700:30::6812:3030
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://0x00sec.org/assets/ember_jquery-07f49b58317ea9292d939348ec0091eb50a9d8aaabd9e86cc074ef5f049918aa.js

Requested by

Host: 0x00sec.org
URL: https://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/10802

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:30::6812:3030 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

4e4f8bf178e9611f4636f6069200c919076b41dfec98945a24c361a4ef343929

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

:path: /assets/ember_jquery-07f49b58317ea9292d939348ec0091eb50a9d8aaabd9e86cc074ef5f049918aa.js
pragma: no-cache
cookie: __cfduid=ddf12e23ae0db11c7734dc6291a473ae11547988902
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: */*
cache-control: no-cache
:authority: 0x00sec.org
referer: https://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/10802
:scheme: https
:method: GET
Referer: https://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/10802
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Sun, 20 Jan 2019 12:55:02 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
last-modified: Mon, 26 Nov 2018 15:56:08 GMT
server: cloudflare
cf-polished: origSize=589450
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
status: 200
expires: Mon, 20 Jan 2020 12:55:02 GMT
cache-control: public, max-age=31536000
cf-ray: 49c1b1717cccbf11-FRA
cf-bgj: minify

GET
H2 200 preload-store-ec90ffab9d7a6d9e507dda7cf7343e9d50b8bce624f7f44486ac8fd6b9814309.js Show response
0x00sec.org/assets/ 562 B
467 B 11ms
10ms Script
application/javascript 2606:4700:30::6812:3030
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://0x00sec.org/assets/preload-store-ec90ffab9d7a6d9e507dda7cf7343e9d50b8bce624f7f44486ac8fd6b9814309.js

Requested by

Host: 0x00sec.org
URL: https://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/10802

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:30::6812:3030 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

d28954a385094cc1f88c9f3ff1db73f32c6027c304b65aca86fc3af65fcbfc5f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

:path: /assets/preload-store-ec90ffab9d7a6d9e507dda7cf7343e9d50b8bce624f7f44486ac8fd6b9814309.js
pragma: no-cache
cookie: __cfduid=ddf12e23ae0db11c7734dc6291a473ae11547988902
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: */*
cache-control: no-cache
:authority: 0x00sec.org
referer: https://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/10802
:scheme: https
:method: GET
Referer: https://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/10802
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Sun, 20 Jan 2019 12:55:02 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
last-modified: Mon, 26 Nov 2018 15:55:42 GMT
server: cloudflare
cf-polished: origSize=677
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
status: 200
expires: Mon, 20 Jan 2020 12:55:02 GMT
cache-control: public, max-age=31536000
cf-ray: 49c1b1717ccdbf11-FRA
cf-bgj: minify

GET
H2 200 vendor-957bcfd0b1422c19974dcf8f64f73eeada523e3d12dd3c76eb24c753f9399397.js Show response
0x00sec.org/assets/ 165 KB
53 KB 18ms
15ms Script
application/javascript 2606:4700:30::6812:3030
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://0x00sec.org/assets/vendor-957bcfd0b1422c19974dcf8f64f73eeada523e3d12dd3c76eb24c753f9399397.js

Requested by

Host: 0x00sec.org
URL: https://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/10802

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:30::6812:3030 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

2e9519b3e8b10fb2a42d3c9ffe478c4cd1f6afbae9cd82ef58a1dbfa6e74c72f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

:path: /assets/vendor-957bcfd0b1422c19974dcf8f64f73eeada523e3d12dd3c76eb24c753f9399397.js
pragma: no-cache
cookie: __cfduid=ddf12e23ae0db11c7734dc6291a473ae11547988902
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: */*
cache-control: no-cache
:authority: 0x00sec.org
referer: https://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/10802
:scheme: https
:method: GET
Referer: https://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/10802
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Sun, 20 Jan 2019 12:55:02 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
last-modified: Wed, 19 Dec 2018 18:19:21 GMT
server: cloudflare
cf-polished: origSize=168972
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
status: 200
expires: Mon, 20 Jan 2020 12:55:02 GMT
cache-control: public, max-age=31536000
cf-ray: 49c1b1717ccfbf11-FRA
cf-bgj: minify

GET
H2 200 pretty-text-bundle-1ffc769a242112508cf55cebf48084d3d074ec9376e7448676acd524a027b1d6.js Show response
0x00sec.org/assets/ 65 KB
21 KB 16ms
14ms Script
application/javascript 2606:4700:30::6812:3030
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://0x00sec.org/assets/pretty-text-bundle-1ffc769a242112508cf55cebf48084d3d074ec9376e7448676acd524a027b1d6.js

Requested by

Host: 0x00sec.org
URL: https://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/10802

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:30::6812:3030 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

3ef212ba53dc74787edcdc2fea3f7076da242d09ea9bd7816d597480630d4d2b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

:path: /assets/pretty-text-bundle-1ffc769a242112508cf55cebf48084d3d074ec9376e7448676acd524a027b1d6.js
pragma: no-cache
cookie: __cfduid=ddf12e23ae0db11c7734dc6291a473ae11547988902
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: */*
cache-control: no-cache
:authority: 0x00sec.org
referer: https://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/10802
:scheme: https
:method: GET
Referer: https://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/10802
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Sun, 20 Jan 2019 12:55:02 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
last-modified: Wed, 19 Dec 2018 18:20:12 GMT
server: cloudflare
cf-polished: origSize=66847
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
status: 200
expires: Mon, 20 Jan 2020 12:55:02 GMT
cache-control: public, max-age=31536000
cf-ray: 49c1b1717cd0bf11-FRA
cf-bgj: minify

GET
H2 200 application-6b816b9f75671a82e5fb2d0940751d82aee0fd938f6631ad65fd67a6cfae5b38.js Show response
0x00sec.org/assets/ 2 MB
337 KB 14ms
11ms Script
application/javascript 2606:4700:30::6812:3030
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://0x00sec.org/assets/application-6b816b9f75671a82e5fb2d0940751d82aee0fd938f6631ad65fd67a6cfae5b38.js

Requested by

Host: 0x00sec.org
URL: https://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/10802

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:30::6812:3030 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

06000bb4405bd9b83192af15aa749a15acdc05e4762208daa1f9aeb093f8e6fd

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

:path: /assets/application-6b816b9f75671a82e5fb2d0940751d82aee0fd938f6631ad65fd67a6cfae5b38.js
pragma: no-cache
cookie: __cfduid=ddf12e23ae0db11c7734dc6291a473ae11547988902
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: */*
cache-control: no-cache
:authority: 0x00sec.org
referer: https://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/10802
:scheme: https
:method: GET
Referer: https://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/10802
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Sun, 20 Jan 2019 12:55:02 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
last-modified: Wed, 19 Dec 2018 18:27:35 GMT
server: cloudflare
cf-polished: origSize=2072246
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
status: 200
expires: Mon, 20 Jan 2020 12:55:02 GMT
cache-control: public, max-age=31536000
cf-ray: 49c1b1717cd1bf11-FRA
cf-bgj: minify

GET
H2 200 plugin-0e9aef14916a7d791328c50bd1b43c53c14f0eb6aa21d646b4cbef9e2dabb4bc.js Show response
0x00sec.org/assets/ 72 KB
18 KB 18ms
15ms Script
application/javascript 2606:4700:30::6812:3030
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://0x00sec.org/assets/plugin-0e9aef14916a7d791328c50bd1b43c53c14f0eb6aa21d646b4cbef9e2dabb4bc.js

Requested by

Host: 0x00sec.org
URL: https://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/10802

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:30::6812:3030 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

b1d1c4e0f2a3cefb4978fc71e695f3e4e08b47a1e1b13e878f0ee3dff08b95a3

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

:path: /assets/plugin-0e9aef14916a7d791328c50bd1b43c53c14f0eb6aa21d646b4cbef9e2dabb4bc.js
pragma: no-cache
cookie: __cfduid=ddf12e23ae0db11c7734dc6291a473ae11547988902
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: */*
cache-control: no-cache
:authority: 0x00sec.org
referer: https://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/10802
:scheme: https
:method: GET
Referer: https://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/10802
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Sun, 20 Jan 2019 12:55:02 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
last-modified: Wed, 19 Dec 2018 18:20:31 GMT
server: cloudflare
cf-polished: origSize=74062
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
status: 200
expires: Mon, 20 Jan 2020 12:55:02 GMT
cache-control: public, max-age=31536000
cf-ray: 49c1b1718cd6bf11-FRA
cf-bgj: minify

GET
H2 200 plugin-third-party-01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b.js Show response
0x00sec.org/assets/ 0
84 B 15ms
12ms Script
application/javascript 2606:4700:30::6812:3030
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://0x00sec.org/assets/plugin-third-party-01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b.js

Requested by

Host: 0x00sec.org
URL: https://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/10802

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:30::6812:3030 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

:path: /assets/plugin-third-party-01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b.js
pragma: no-cache
cookie: __cfduid=ddf12e23ae0db11c7734dc6291a473ae11547988902
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: */*
cache-control: no-cache
:authority: 0x00sec.org
referer: https://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/10802
:scheme: https
:method: GET
Referer: https://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/10802
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Sun, 20 Jan 2019 12:55:02 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
cf-polished: origSize=120
status: 200
content-length: 0
last-modified: Mon, 26 Nov 2018 15:56:35 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
expires: Mon, 20 Jan 2020 12:55:02 GMT
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 49c1b1718cd7bf11-FRA
cf-bgj: minify

GET
H/1.1 200
OK monokai-sublime.css
s3.amazonaws.com/0x00sec/ 1 KB
1 KB 410ms
115ms Stylesheet
text/css 52.216.107.30
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://s3.amazonaws.com/0x00sec/monokai-sublime.css
Requested by: Host: 0x00sec.org
URL: https://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/10802
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.216.107.30 Ashburn, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: s3-1.amazonaws.com
Software: AmazonS3 /
Resource Hash: fe66aef28788cf660b2383fefb69c360a3c1262f17aee1d3aea7cde5bdc914c0

Request headers

Referer: https://0x00sec.org/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Sun, 20 Jan 2019 12:55:03 GMT
Last-Modified: Sat, 07 May 2016 12:16:56 GMT
Server: AmazonS3
x-amz-request-id: 097505F1FB6FF3F5
ETag: "0c8b4c0e8a584e7142b08d914644cd9d"
Content-Type: text/css
Accept-Ranges: bytes
Content-Length: 1026
x-amz-id-2: bo8IAcA+XB88cwF3anAsEbbQFYeamZILxsEyOJJ5uYbOXPnWZbvvjgHEIkiJfJsKs0H4kYSJJRk=

GET
H/1.1 200
OK highlight.pack.js Show response
s3.amazonaws.com/0x00sec/ 98 KB
99 KB 451ms
142ms Script
application/x-javascript 52.216.107.30
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://s3.amazonaws.com/0x00sec/highlight.pack.js
Requested by: Host: 0x00sec.org
URL: https://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/10802
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.216.107.30 Ashburn, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: s3-1.amazonaws.com
Software: AmazonS3 /
Resource Hash: 6e91e622b9b19d6747fe30842df12cf3bbdd015655f4b0600f2055e82bd5c802

Request headers

Referer: https://0x00sec.org/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Sun, 20 Jan 2019 12:55:04 GMT
Last-Modified: Sat, 07 May 2016 12:16:55 GMT
Server: AmazonS3
x-amz-request-id: A9020241B61285F3
ETag: "694e576ccafa7d5bf5f96cc4e611649b"
Content-Type: application/x-javascript
Accept-Ranges: bytes
Content-Length: 100702
x-amz-id-2: EWEAyw9nD+k0a0cQat6oN2FReh1YMysyyvTiQYEMCrgenoO/O7FgfRRpF2CUf+PVJNaKaKTOmjc=

GET
H2 200 254c9356499cc8d4eb482beb4e42a061cd987c61.js Show response
0x00sec.org/theme-javascripts/ 373 B
486 B 14ms
13ms Script
text/javascript 2606:4700:30::6812:3030
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://0x00sec.org/theme-javascripts/254c9356499cc8d4eb482beb4e42a061cd987c61.js?__ws=0x00sec.org

Requested by

Host: 0x00sec.org
URL: https://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/10802

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:30::6812:3030 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

076706ccad020424fe4f21ec4910e2583f818f14148fc05bb3732d0fec5eedde

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

:path: /theme-javascripts/254c9356499cc8d4eb482beb4e42a061cd987c61.js?__ws=0x00sec.org
pragma: no-cache
cookie: __cfduid=ddf12e23ae0db11c7734dc6291a473ae11547988902
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: */*
cache-control: no-cache
:authority: 0x00sec.org
referer: https://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/10802
:scheme: https
:method: GET
Referer: https://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/10802
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Sun, 20 Jan 2019 12:55:02 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
x-permitted-cross-domain-policies: none
cf-polished: origSize=398
status: 200
content-transfer-encoding: binary
content-disposition: inline; filename="254c9356499cc8d4eb482beb4e42a061cd987c61.js"
x-xss-protection: 1; mode=block
x-request-id: e984bc95-713b-4da5-a50e-0b468f19ee5d
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 26 Nov 2018 16:07:52 GMT
server: cloudflare
cache-control: public, max-age=31556952
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-download-options: noopen
content-type: text/javascript
expires: Mon, 20 Jan 2020 18:44:14 GMT
x-discourse-route: theme_javascripts/show
cf-ray: 49c1b1718cddbf11-FRA
cf-bgj: minify

GET
H2 200 6ad3aa66cde86f17afc660f4e80bec870947d6b4.js Show response
0x00sec.org/theme-javascripts/ 200 B
323 B 17ms
16ms Script
text/javascript 2606:4700:30::6812:3030
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://0x00sec.org/theme-javascripts/6ad3aa66cde86f17afc660f4e80bec870947d6b4.js?__ws=0x00sec.org

Requested by

Host: 0x00sec.org
URL: https://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/10802

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:30::6812:3030 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

a1d0dd8a59c0a44beae54bd6939329314bf7ac7589381400445053ed3114657b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

:path: /theme-javascripts/6ad3aa66cde86f17afc660f4e80bec870947d6b4.js?__ws=0x00sec.org
pragma: no-cache
cookie: __cfduid=ddf12e23ae0db11c7734dc6291a473ae11547988902
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: */*
cache-control: no-cache
:authority: 0x00sec.org
referer: https://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/10802
:scheme: https
:method: GET
Referer: https://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/10802
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Sun, 20 Jan 2019 12:55:02 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
x-permitted-cross-domain-policies: none
cf-polished: origSize=240
status: 200
content-transfer-encoding: binary
content-disposition: inline; filename="6ad3aa66cde86f17afc660f4e80bec870947d6b4.js"
x-xss-protection: 1; mode=block
x-request-id: 86069960-8ccf-4cf7-900c-5696c26af2aa
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 26 Nov 2018 16:07:57 GMT
server: cloudflare
cache-control: public, max-age=31556952
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-download-options: noopen
content-type: text/javascript
expires: Mon, 20 Jan 2020 18:44:14 GMT
x-discourse-route: theme_javascripts/show
cf-ray: 49c1b1718cdfbf11-FRA
cf-bgj: minify

GET
H2 200 desktop_8_48b1a5a22752147776d62fda4b0b37860b93c085.css
0x00sec.org/stylesheets/ 249 KB
47 KB 44ms
43ms Stylesheet
text/css 2606:4700:30::6812:3030
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://0x00sec.org/stylesheets/desktop_8_48b1a5a22752147776d62fda4b0b37860b93c085.css?__ws=0x00sec.org

Requested by

Host: 0x00sec.org
URL: https://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/10802

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:30::6812:3030 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

07aab838827804b5ccb28fe8764e884c9f32a3ba0904712355f8862e69134c59

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

:path: /stylesheets/desktop_8_48b1a5a22752147776d62fda4b0b37860b93c085.css?__ws=0x00sec.org
pragma: no-cache
cookie: __cfduid=ddf12e23ae0db11c7734dc6291a473ae11547988902
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: text/css,*/*;q=0.1
cache-control: no-cache
:authority: 0x00sec.org
referer: https://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/10802
:scheme: https
:method: GET
Referer: https://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/10802
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Sun, 20 Jan 2019 12:55:02 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
x-permitted-cross-domain-policies: none
cf-polished: origSize=255637
status: 200
content-transfer-encoding: binary
content-disposition: inline; filename="desktop_8_48b1a5a22752147776d62fda4b0b37860b93c085.css"
x-xss-protection: 1; mode=block
x-request-id: 5db461fb-1104-442e-b462-f1f40b3b43c8
referrer-policy: strict-origin-when-cross-origin
last-modified: Wed, 19 Dec 2018 18:27:50 GMT
server: cloudflare
cache-control: public, max-age=31556952
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-download-options: noopen
content-type: text/css
expires: Mon, 20 Jan 2020 18:44:14 GMT
x-discourse-route: stylesheets/show
cf-ray: 49c1b1718cdbbf11-FRA
cf-bgj: minify

GET
H2 200 desktop_theme_43_ed6c35c33c802a6135db3621761ca75e72fd2f97.css
0x00sec.org/stylesheets/ 1 KB
652 B 18ms
17ms Stylesheet
text/css 2606:4700:30::6812:3030
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://0x00sec.org/stylesheets/desktop_theme_43_ed6c35c33c802a6135db3621761ca75e72fd2f97.css?__ws=0x00sec.org

Requested by

Host: 0x00sec.org
URL: https://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/10802

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:30::6812:3030 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

3d94deb9689e928b55509367f971c47ed63f3160c4f18591e45e0f31f44d61f5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

:path: /stylesheets/desktop_theme_43_ed6c35c33c802a6135db3621761ca75e72fd2f97.css?__ws=0x00sec.org
pragma: no-cache
cookie: __cfduid=ddf12e23ae0db11c7734dc6291a473ae11547988902
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: text/css,*/*;q=0.1
cache-control: no-cache
:authority: 0x00sec.org
referer: https://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/10802
:scheme: https
:method: GET
Referer: https://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/10802
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Sun, 20 Jan 2019 12:55:02 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
x-permitted-cross-domain-policies: none
cf-polished: origSize=1347
status: 200
content-transfer-encoding: binary
content-disposition: inline; filename="desktop_theme_43_ed6c35c33c802a6135db3621761ca75e72fd2f97.css"
x-xss-protection: 1; mode=block
x-request-id: 5177dace-5543-4657-9b90-9335cea68b9e
referrer-policy: strict-origin-when-cross-origin
last-modified: Wed, 19 Dec 2018 18:27:57 GMT
server: cloudflare
cache-control: public, max-age=31556952
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-download-options: noopen
content-type: text/css
expires: Mon, 20 Jan 2020 18:44:14 GMT
x-discourse-route: stylesheets/show
cf-ray: 49c1b1718ce0bf11-FRA
cf-bgj: minify

GET
H2 200 preload-application-data-0a59ccab480941aaac91f9e7fa7f77496323ae056aaa4158822dea35de319c01.js Show response
0x00sec.org/assets/ 1 KB
683 B 17ms
16ms Script
application/javascript 2606:4700:30::6812:3030
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://0x00sec.org/assets/preload-application-data-0a59ccab480941aaac91f9e7fa7f77496323ae056aaa4158822dea35de319c01.js

Requested by

Host: 0x00sec.org
URL: https://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/10802

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:30::6812:3030 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

2d070e18ff984029d74609ce7659b0c83e7425a1b0260ffdcef3383e18fe6a00

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

:path: /assets/preload-application-data-0a59ccab480941aaac91f9e7fa7f77496323ae056aaa4158822dea35de319c01.js
pragma: no-cache
cookie: __cfduid=ddf12e23ae0db11c7734dc6291a473ae11547988902
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: */*
cache-control: no-cache
:authority: 0x00sec.org
referer: https://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/10802
:scheme: https
:method: GET
Referer: https://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/10802
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Sun, 20 Jan 2019 12:55:02 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
last-modified: Wed, 19 Dec 2018 18:20:42 GMT
server: cloudflare
cf-polished: origSize=1536
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
status: 200
expires: Mon, 20 Jan 2020 12:55:02 GMT
cache-control: public, max-age=31536000
cf-ray: 49c1b1718ce7bf11-FRA
cf-bgj: minify

GET
H2 200 browser-update-d924ff41586d6dcda055f0cfb41488724ba2e2d5271fef65ce5f480b46f9231d.js Show response
0x00sec.org/assets/ 1 KB
681 B 37ms
36ms Script
application/javascript 2606:4700:30::6812:3030
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://0x00sec.org/assets/browser-update-d924ff41586d6dcda055f0cfb41488724ba2e2d5271fef65ce5f480b46f9231d.js

Requested by

Host: 0x00sec.org
URL: https://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/10802

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:30::6812:3030 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

f13b417ef7f4c30f277de5374d0202511c15ccf3f737eca486f8f78e86e43684

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

:path: /assets/browser-update-d924ff41586d6dcda055f0cfb41488724ba2e2d5271fef65ce5f480b46f9231d.js
pragma: no-cache
cookie: __cfduid=ddf12e23ae0db11c7734dc6291a473ae11547988902
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: */*
cache-control: no-cache
:authority: 0x00sec.org
referer: https://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/10802
:scheme: https
:method: GET
Referer: https://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/10802
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Sun, 20 Jan 2019 12:55:02 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
last-modified: Mon, 26 Nov 2018 15:55:43 GMT
server: cloudflare
cf-polished: origSize=1234
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
status: 200
expires: Mon, 20 Jan 2020 12:55:02 GMT
cache-control: public, max-age=31536000
cf-ray: 49c1b1718ce8bf11-FRA
cf-bgj: minify

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 43 KB
17 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:816::200e
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: 0x00sec.org
URL: https://0x00sec.org/theme-javascripts/254c9356499cc8d4eb482beb4e42a061cd987c61.js?__ws=0x00sec.org

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:816::200e , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

b688a3bcd1297cc0fe08e6e52fea14ba9108ee4b9a2052c03e7bac6e19347255

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://0x00sec.org/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 05 Nov 2018 21:10:09 GMT
server: Golfe2
age: 357
date: Sun, 20 Jan 2019 12:49:06 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="44,43,39,35"
content-length: 17404
expires: Sun, 20 Jan 2019 14:49:06 GMT

GET
H2 200 svg-1de34ed3ec4c1b082ebbd3354eb072577922f19b.js Show response
0x00sec.org/svg-sprite/0x00sec.org/ 97 KB
31 KB 17ms
16ms Script
application/javascript 2606:4700:30::6812:3030
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://0x00sec.org/svg-sprite/0x00sec.org/svg-1de34ed3ec4c1b082ebbd3354eb072577922f19b.js

Requested by

Host: 0x00sec.org
URL: https://0x00sec.org/assets/application-6b816b9f75671a82e5fb2d0940751d82aee0fd938f6631ad65fd67a6cfae5b38.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:30::6812:3030 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

92f6deacaf1824e96d36e1be10d639016c46fe2c0e10c5632550dd316740e235

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

:path: /svg-sprite/0x00sec.org/svg-1de34ed3ec4c1b082ebbd3354eb072577922f19b.js
pragma: no-cache
cookie: __cfduid=ddf12e23ae0db11c7734dc6291a473ae11547988902
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: */*
cache-control: no-cache
:authority: 0x00sec.org
referer: https://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/10802
:scheme: https
:method: GET
Referer: https://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/10802
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Sun, 20 Jan 2019 12:55:03 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
x-permitted-cross-domain-policies: none
cf-polished: origSize=98981
status: 200
x-discourse-route: svg_sprite/show
cf-bgj: minify
x-xss-protection: 1; mode=block
x-request-id: d0b538d2-9d90-488a-a255-5dabdee63c9a
referrer-policy: strict-origin-when-cross-origin
last-modified: Fri, 19 Dec 2008 18:33:49 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-download-options: noopen
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=31556952
cf-ray: 49c1b176aaf2bf11-FRA
expires: Mon, 20 Jan 2020 18:44:15 GMT

GET
H2 200 jquery.magnific-popup.min.js Show response
0x00sec.org/javascripts/ 20 KB
7 KB 13ms
13ms Script
application/javascript 2606:4700:30::6812:3030
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://0x00sec.org/javascripts/jquery.magnific-popup.min.js

Requested by

Host: 0x00sec.org
URL: https://0x00sec.org/assets/application-6b816b9f75671a82e5fb2d0940751d82aee0fd938f6631ad65fd67a6cfae5b38.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:30::6812:3030 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

3fddc6d28aba3c13d64cfd4847c333ff48c71d4a5a58bd1a0494ca6ae8ac1bb4

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

:path: /javascripts/jquery.magnific-popup.min.js
pragma: no-cache
cookie: __cfduid=ddf12e23ae0db11c7734dc6291a473ae11547988902
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: */*
cache-control: no-cache
:authority: 0x00sec.org
referer: https://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/10802
:scheme: https
:method: GET
Referer: https://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/10802
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Sun, 20 Jan 2019 12:55:03 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
last-modified: Wed, 19 Dec 2018 18:13:52 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: public, max-age=86400
cf-ray: 49c1b177fc9fbf11-FRA
expires: Mon, 21 Jan 2019 12:55:03 GMT

GET
H2 200 6a88550999021fba7568661984347ac5e0e0b8b7.js Show response
0x00sec.org/highlight-js/0x00sec.org/ 46 KB
18 KB 16ms
15ms Script
application/javascript 2606:4700:30::6812:3030
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://0x00sec.org/highlight-js/0x00sec.org/6a88550999021fba7568661984347ac5e0e0b8b7.js

Requested by

Host: 0x00sec.org
URL: https://0x00sec.org/assets/application-6b816b9f75671a82e5fb2d0940751d82aee0fd938f6631ad65fd67a6cfae5b38.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:30::6812:3030 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

055404c436d4844f5f198144ce1b26d308a4b6fe39ac6c7b02354d880f463896

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

:path: /highlight-js/0x00sec.org/6a88550999021fba7568661984347ac5e0e0b8b7.js
pragma: no-cache
cookie: __cfduid=ddf12e23ae0db11c7734dc6291a473ae11547988902
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: */*
cache-control: no-cache
:authority: 0x00sec.org
referer: https://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/10802
:scheme: https
:method: GET
Referer: https://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/10802
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Sun, 20 Jan 2019 12:55:03 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
x-permitted-cross-domain-policies: none
cf-polished: origSize=47257
status: 200
x-discourse-route: highlight_js/show
cf-bgj: minify
x-xss-protection: 1; mode=block
x-request-id: 85bd0a0f-9f1a-49e8-b1c3-491f3aaae88a
referrer-policy: strict-origin-when-cross-origin
last-modified: Fri, 19 Dec 2008 18:35:13 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-download-options: noopen
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=31556952
cf-ray: 49c1b1783cdfbf11-FRA
expires: Mon, 20 Jan 2020 18:44:15 GMT

GET
DATA 200
OK truncated
/ 533 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0db766eeb2753ac61d001dca4c38534aa633e6fea96f1fde8ac84635d8a23791

Request headers

Response headers

Content-Type: image/svg+xml;charset=utf8

GET
DATA 200
OK truncated
/ 457 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b53b79560b6feda4c827c1a8ba9f82198c5f7133e0f706806f0c8271bfca369d

Request headers

Response headers

Content-Type: image/svg+xml;charset=utf8

GET
H/1.1 200
OK 6fc109c46f8a347cc1d9bebfdc28dbaab1b8631d.png
0x00sec.s3.dualstack.us-east-1.amazonaws.com/original/2X/6/ 4 KB
4 KB 310ms
118ms Image
image/png 2600:1fa0:8024:8dc1:34d8:533b::
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://0x00sec.s3.dualstack.us-east-1.amazonaws.com/original/2X/6/6fc109c46f8a347cc1d9bebfdc28dbaab1b8631d.png
Requested by: Host: 0x00sec.org
URL: https://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/10802
Protocol: HTTP/1.1
Server: 2600:1fa0:8024:8dc1:34d8:533b:: , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: f938ab6cb237e25ba7d2a91040092a6b4fc698bfa413e7b8222e8aa632ca980a

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Sun, 20 Jan 2019 12:55:05 GMT
Last-Modified: Mon, 26 Nov 2018 16:07:45 GMT
Server: AmazonS3
x-amz-request-id: 4152D41D12D4E6DC
ETag: "1e79d693da9181fe6b1dac8fe5b1e43d"
Content-Type: image/png
Accept-Ranges: bytes
Content-Length: 3850
x-amz-id-2: u8EU5VPRK8xESfp2ADuALrZKv2P7yfvazn6WoWFnS2wgKbVCha3SSvGmUdNI2x7CT9N2rFaWiNI=

GET
H/1.1 200
OK 0a6ae7a596a5fd33b9ed9a76031f17f5ba3b9130.png
0x00sec.s3.amazonaws.com/original/2X/0/ 4 KB
4 KB 436ms
112ms Image
image/png 52.216.236.251
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://0x00sec.s3.amazonaws.com/original/2X/0/0a6ae7a596a5fd33b9ed9a76031f17f5ba3b9130.png
Requested by: Host: 0x00sec.org
URL: https://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/10802
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.216.236.251 Ashburn, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: s3-1-w.amazonaws.com
Software: AmazonS3 /
Resource Hash: 21be4d116064c4304a6d1635a4c39f104dc859c79ed213c4cda274861be751c1

Request headers

Referer: https://0x00sec.org/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Sun, 20 Jan 2019 12:55:05 GMT
Last-Modified: Mon, 26 Jun 2017 15:17:45 GMT
Server: AmazonS3
x-amz-request-id: 5D717CEF66BED815
ETag: "ed73f6a6dbaaa46cded4ec8677e5e00b"
Content-Type: image/png
Accept-Ranges: bytes
Content-Length: 4101
x-amz-id-2: 6TW++job9nipaRGFzidOg1R3juFSSpniimRBfte0KE2xCI4f39e+jdVidnT9HCQ0Rh+Wjzz/kYY=

GET
H/1.1 200
OK bb3734339210d8d56a57877905851e9c99a117a5.png
0x00sec.s3.dualstack.us-east-1.amazonaws.com/original/2X/b/ 2 KB
2 KB 479ms
112ms Image
image/png 2600:1fa0:8024:8dc1:34d8:533b::
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://0x00sec.s3.dualstack.us-east-1.amazonaws.com/original/2X/b/bb3734339210d8d56a57877905851e9c99a117a5.png
Requested by: Host: 0x00sec.org
URL: https://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/10802
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1fa0:8024:8dc1:34d8:533b:: , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: b5b0c740dbe4f19af03d0c7d4b61406ff3c80d2e5a81dfbc6ea25d89e6033b6b

Request headers

Referer: https://0x00sec.org/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Sun, 20 Jan 2019 12:55:05 GMT
Last-Modified: Mon, 14 Jan 2019 16:53:25 GMT
Server: AmazonS3
x-amz-request-id: AC4A8312DD910446
ETag: "054d9bb228beec0e2e7c8a1a50f7a57d"
Content-Type: image/png
Accept-Ranges: bytes
Content-Length: 1555
x-amz-id-2: U8tzIDLrjqTWY9Yl08bswbQHtKCmZF/iU33YUCEPV1MeavxdjwCDpWZ0ZU4N2VIYh7GIGq8299M=

GET
H/1.1 200
OK bcfc02745f82dd67c3a43bdaf796c6eb22543511.png
0x00sec.s3.dualstack.us-east-1.amazonaws.com/original/2X/b/ 2 KB
2 KB 485ms
119ms Image
image/png 2600:1fa0:8024:8dc1:34d8:533b::
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://0x00sec.s3.dualstack.us-east-1.amazonaws.com/original/2X/b/bcfc02745f82dd67c3a43bdaf796c6eb22543511.png
Requested by: Host: 0x00sec.org
URL: https://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/10802
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1fa0:8024:8dc1:34d8:533b:: , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: e82d344de5abcd9b4935c93affb6a92a4024d4867fd39c9f811db4cd5f78c9b7

Request headers

Referer: https://0x00sec.org/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Sun, 20 Jan 2019 12:55:05 GMT
Last-Modified: Mon, 14 Jan 2019 16:56:10 GMT
Server: AmazonS3
x-amz-request-id: CEAA8E256FD2D260
ETag: "a01de3006ed85eded27e0da92f7e62e0"
Content-Type: image/png
Accept-Ranges: bytes
Content-Length: 1557
x-amz-id-2: CSrwVpdzQXdOxoRiSx79y/TUHWgYx73QGJUQMDGx92q2RACf29jW7iszrvMPC+7wZE3mIjrANw8=

GET
H/1.1 200
OK 6bd8344f1586c1c0b508559488cf3f158f8ca597_1_690x291.png
0x00sec.s3.dualstack.us-east-1.amazonaws.com/optimized/2X/6/ 109 KB
0 488ms
121ms Image
image/png 2600:1fa0:8024:8dc1:34d8:533b::
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://0x00sec.s3.dualstack.us-east-1.amazonaws.com/optimized/2X/6/6bd8344f1586c1c0b508559488cf3f158f8ca597_1_690x291.png
Requested by: Host: 0x00sec.org
URL: https://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/10802
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1fa0:8024:8dc1:34d8:533b:: , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software: AmazonS3 /
Resource Hash

Request headers

Referer: https://0x00sec.org/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Sun, 20 Jan 2019 12:55:05 GMT
Last-Modified: Fri, 11 Jan 2019 21:23:29 GMT
Server: AmazonS3
x-amz-request-id: 8D9188A7740FFE19
ETag: "ad202b729cc7f5ab5e84ff079f41f4fa"
Content-Type: image/png
Accept-Ranges: bytes
Content-Length: 111322
x-amz-id-2: mLZc2o2Yp1Kg7+mhIpiAYDBwvNHs03orZFwTn9loYQkyH74MgpV/R17keu/WTDi/ACwOidFTdz4=

GET
H2 200 3872_1.png
0x00sec.org/user_avatar/0x00sec.org/hunter/20/ 1 KB
1 KB 17ms
14ms Image
image/png 2606:4700:30::6812:3030
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://0x00sec.org/user_avatar/0x00sec.org/hunter/20/3872_1.png

Requested by

Host: 0x00sec.org
URL: https://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/10802

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:30::6812:3030 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

968d2338d3e692f5571336520179c037d21b588a16d724029a769c45d538b92a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

:path: /user_avatar/0x00sec.org/hunter/20/3872_1.png
pragma: no-cache
cookie: __cfduid=ddf12e23ae0db11c7734dc6291a473ae11547988902
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: 0x00sec.org
referer: https://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/10802
:scheme: https
:method: GET
Referer: https://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/10802
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Sun, 20 Jan 2019 12:55:03 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
x-permitted-cross-domain-policies: none
content-transfer-encoding: binary
status: 200
x-discourse-route: user_avatars/show
content-length: 1184
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 11 Dec 2017 02:20:33 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-download-options: noopen
content-type: image/png
cache-control: public, max-age=31556952
accept-ranges: bytes
cf-ray: 49c1b178fdc5bf11-FRA
expires: Mon, 20 Jan 2020 18:44:15 GMT

GET
H2 200 6902_1.png
0x00sec.org/user_avatar/0x00sec.org/thunderson/32/ 1 KB
1 KB 16ms
13ms Image
image/jpeg 2606:4700:30::6812:3030
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://0x00sec.org/user_avatar/0x00sec.org/thunderson/32/6902_1.png

Requested by

Host: 0x00sec.org
URL: https://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/10802

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:30::6812:3030 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

34f406c10dc099699946566b642e7dc7ac13a85110d448e51edf0735f4772f01

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

:path: /user_avatar/0x00sec.org/thunderson/32/6902_1.png
pragma: no-cache
cookie: __cfduid=ddf12e23ae0db11c7734dc6291a473ae11547988902
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: 0x00sec.org
referer: https://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/10802
:scheme: https
:method: GET
Referer: https://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/10802
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Sun, 20 Jan 2019 12:55:03 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
x-permitted-cross-domain-policies: none
content-transfer-encoding: binary
status: 200
x-discourse-route: user_avatars/show
content-length: 1295
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 14 Jan 2019 16:08:00 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-download-options: noopen
content-type: image/jpeg
cache-control: public, max-age=31556952
accept-ranges: bytes
cf-ray: 49c1b178fdc6bf11-FRA
expires: Mon, 20 Jan 2020 18:44:15 GMT

GET
H2 200 5512_1.png
0x00sec.org/user_avatar/0x00sec.org/baud/45/ 5 KB
5 KB 15ms
12ms Image
image/png 2606:4700:30::6812:3030
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://0x00sec.org/user_avatar/0x00sec.org/baud/45/5512_1.png

Requested by

Host: 0x00sec.org
URL: https://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/10802

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:30::6812:3030 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

3ed94888171f2df3555fc751b733babe1ee9b6cc182ee77156d0ecff0339ae89

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

:path: /user_avatar/0x00sec.org/baud/45/5512_1.png
pragma: no-cache
cookie: __cfduid=ddf12e23ae0db11c7734dc6291a473ae11547988902
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: 0x00sec.org
referer: https://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/10802
:scheme: https
:method: GET
Referer: https://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/10802
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Sun, 20 Jan 2019 12:55:03 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
x-permitted-cross-domain-policies: none
content-transfer-encoding: binary
status: 200
x-discourse-route: user_avatars/show
content-length: 4694
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 06 Aug 2018 22:06:13 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-download-options: noopen
content-type: image/png
cache-control: public, max-age=31556952
accept-ranges: bytes
cf-ray: 49c1b178fdc8bf11-FRA
expires: Mon, 20 Jan 2020 18:44:15 GMT

GET
H2 200 6_1.png
0x00sec.org/user_avatar/0x00sec.org/pry0cc/45/ 1 KB
1 KB 20ms
17ms Image
image/png 2606:4700:30::6812:3030
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://0x00sec.org/user_avatar/0x00sec.org/pry0cc/45/6_1.png

Requested by

Host: 0x00sec.org
URL: https://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/10802

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:30::6812:3030 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

af119fcac0a9cb134865be91a112068099cb2f77e2ba279480a0f2c9c4ac717a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

:path: /user_avatar/0x00sec.org/pry0cc/45/6_1.png
pragma: no-cache
cookie: __cfduid=ddf12e23ae0db11c7734dc6291a473ae11547988902
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: 0x00sec.org
referer: https://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/10802
:scheme: https
:method: GET
Referer: https://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/10802
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Sun, 20 Jan 2019 12:55:03 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
x-permitted-cross-domain-policies: none
content-transfer-encoding: binary
status: 200
x-discourse-route: user_avatars/show
content-length: 1220
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 26 Nov 2018 15:50:21 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-download-options: noopen
content-type: image/png
cache-control: public, max-age=31556952
accept-ranges: bytes
cf-ray: 49c1b178fdc9bf11-FRA
expires: Mon, 20 Jan 2020 18:44:15 GMT

GET
H2 200 5512_1.png
0x00sec.org/user_avatar/0x00sec.org/baud/25/ 2 KB
2 KB 21ms
18ms Image
image/png 2606:4700:30::6812:3030
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://0x00sec.org/user_avatar/0x00sec.org/baud/25/5512_1.png

Requested by

Host: 0x00sec.org
URL: https://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/10802

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:30::6812:3030 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

d8a070072fbf47efbe27c3e6900282876a3db21b53ffe224dc436e651ac5d1b6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

:path: /user_avatar/0x00sec.org/baud/25/5512_1.png
pragma: no-cache
cookie: __cfduid=ddf12e23ae0db11c7734dc6291a473ae11547988902
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: 0x00sec.org
referer: https://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/10802
:scheme: https
:method: GET
Referer: https://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/10802
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Sun, 20 Jan 2019 12:55:03 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
x-permitted-cross-domain-policies: none
content-transfer-encoding: binary
status: 200
x-discourse-route: user_avatars/show
content-length: 1701
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 06 Aug 2018 22:06:13 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-download-options: noopen
content-type: image/png
cache-control: public, max-age=31556952
accept-ranges: bytes
cf-ray: 49c1b178fdcabf11-FRA
expires: Mon, 20 Jan 2020 18:44:15 GMT

GET
H2 200 wink.png
0x00sec.org/images/emoji/twitter/ 760 B
837 B 18ms
15ms Image
image/png 2606:4700:30::6812:3030
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://0x00sec.org/images/emoji/twitter/wink.png?v=6

Requested by

Host: 0x00sec.org
URL: https://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/10802

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:30::6812:3030 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

f6b86554472159b74d0ab91b2cb3cd75cf361ccf96a141a4ebd3363c38e7f8eb

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

:path: /images/emoji/twitter/wink.png?v=6
pragma: no-cache
cookie: __cfduid=ddf12e23ae0db11c7734dc6291a473ae11547988902
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: 0x00sec.org
referer: https://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/10802
:scheme: https
:method: GET
Referer: https://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/10802
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Sun, 20 Jan 2019 12:55:03 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
last-modified: Mon, 26 Nov 2018 15:50:06 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 49c1b178fdcbbf11-FRA
content-length: 760
expires: Mon, 20 Jan 2020 12:55:03 GMT

GET
H/1.1 200
OK 9349e9b5fc470bfac5e33dfa3cedbf19ee9a3937.png
0x00sec.s3.dualstack.us-east-1.amazonaws.com/original/2X/9/ 29 KB
29 KB 466ms
101ms Image
image/png 2600:1fa0:8024:8dc1:34d8:533b::
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://0x00sec.s3.dualstack.us-east-1.amazonaws.com/original/2X/9/9349e9b5fc470bfac5e33dfa3cedbf19ee9a3937.png
Requested by: Host: 0x00sec.org
URL: https://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/10802
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1fa0:8024:8dc1:34d8:533b:: , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 9399e7872e2c55092a9d11ff1e6c01fc3c43044bd171d4e80118be4202798011

Request headers

Referer: https://0x00sec.org/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Sun, 20 Jan 2019 12:55:05 GMT
Last-Modified: Mon, 14 Jan 2019 05:28:30 GMT
Server: AmazonS3
x-amz-request-id: 4910240B5DFCAA60
ETag: "95bfda64223cef5f69308eab240ebca3"
Content-Type: image/png
Accept-Ranges: bytes
Content-Length: 29397
x-amz-id-2: cDUBPxfB6w9ODxjl/V052HP4fNP0ALyLwDl3FefP2Z7TbrU6RWtlMDYdH3J80i/94JlGZ0wRUsk=

GET
H2 200 6409_1.png
0x00sec.org/user_avatar/0x00sec.org/dtm/45/ 3 KB
3 KB 20ms
18ms Image
image/jpeg 2606:4700:30::6812:3030
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://0x00sec.org/user_avatar/0x00sec.org/dtm/45/6409_1.png

Requested by

Host: 0x00sec.org
URL: https://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/10802

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:30::6812:3030 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

72d10d313abbe6d35eca8adcd6287cff6fddbca73dd8576282fb72201d02e173

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

:path: /user_avatar/0x00sec.org/dtm/45/6409_1.png
pragma: no-cache
cookie: __cfduid=ddf12e23ae0db11c7734dc6291a473ae11547988902
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: 0x00sec.org
referer: https://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/10802
:scheme: https
:method: GET
Referer: https://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/10802
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Sun, 20 Jan 2019 12:55:03 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
x-permitted-cross-domain-policies: none
content-transfer-encoding: binary
status: 200
x-discourse-route: user_avatars/show
content-length: 2825
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 05 Nov 2018 05:15:30 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-download-options: noopen
content-type: image/jpeg
cache-control: public, max-age=31556952
accept-ranges: bytes
cf-ray: 49c1b178fdccbf11-FRA
expires: Mon, 20 Jan 2020 18:44:15 GMT

GET
H2 200 6_1.png
0x00sec.org/user_avatar/0x00sec.org/pry0cc/25/ 980 B
1 KB 15ms
12ms Image
image/png 2606:4700:30::6812:3030
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://0x00sec.org/user_avatar/0x00sec.org/pry0cc/25/6_1.png

Requested by

Host: 0x00sec.org
URL: https://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/10802

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:30::6812:3030 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

2852d6d4dd54faaf78f0d9d53f0f28a2045fd78694b282f400e86e51d1d8e06d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

:path: /user_avatar/0x00sec.org/pry0cc/25/6_1.png
pragma: no-cache
cookie: __cfduid=ddf12e23ae0db11c7734dc6291a473ae11547988902
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: 0x00sec.org
referer: https://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/10802
:scheme: https
:method: GET
Referer: https://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/10802
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Sun, 20 Jan 2019 12:55:03 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
x-permitted-cross-domain-policies: none
content-transfer-encoding: binary
status: 200
x-discourse-route: user_avatars/show
content-length: 980
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 26 Nov 2018 15:50:21 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-download-options: noopen
content-type: image/png
cache-control: public, max-age=31556952
accept-ranges: bytes
cf-ray: 49c1b178fdcdbf11-FRA
expires: Mon, 20 Jan 2020 18:44:15 GMT

GET
H/1.1 200
OK 8c7390150cd0078e967a18c7663581b9b334d239.png
0x00sec.s3.dualstack.us-east-1.amazonaws.com/original/2X/8/ 517 B
873 B 498ms
128ms Image
image/png 2600:1fa0:8024:8dc1:34d8:533b::
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://0x00sec.s3.dualstack.us-east-1.amazonaws.com/original/2X/8/8c7390150cd0078e967a18c7663581b9b334d239.png
Requested by: Host: 0x00sec.org
URL: https://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/10802
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1fa0:8024:8dc1:34d8:533b:: , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: dabfc88622035b2a9a54447ac9eaaed64c49c608d1aaf6e441a856623dd28c70

Request headers

Referer: https://0x00sec.org/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Sun, 20 Jan 2019 12:55:05 GMT
Last-Modified: Mon, 19 Nov 2018 08:31:41 GMT
Server: AmazonS3
x-amz-request-id: A27FFF7DC187D357
ETag: "f965583609e8eacf623c8ee6fedf9d47"
Content-Type: image/png
Accept-Ranges: bytes
Content-Length: 517
x-amz-id-2: q/+pBaiNnDXGo8z1fl9b6KSKmUinpx/E22BNqhpPnsqBvkfKZ2Ufsd/yiW2bbx7L6f0NoxGeyw4=

GET
H/1.1 200
OK dba6c5bca5844abc412903ca5ab3e1450fea2171.png
0x00sec.s3.dualstack.us-east-1.amazonaws.com/original/2X/d/ 31 KB
31 KB 478ms
107ms Image
image/png 2600:1fa0:8024:8dc1:34d8:533b::
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://0x00sec.s3.dualstack.us-east-1.amazonaws.com/original/2X/d/dba6c5bca5844abc412903ca5ab3e1450fea2171.png
Requested by: Host: 0x00sec.org
URL: https://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/10802
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1fa0:8024:8dc1:34d8:533b:: , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 48d4fe4f1447530480db85a5283f3728ed37ea8364ec8f4d8079801317361759

Request headers

Referer: https://0x00sec.org/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Sun, 20 Jan 2019 12:55:05 GMT
Last-Modified: Mon, 19 Nov 2018 08:31:44 GMT
Server: AmazonS3
x-amz-request-id: 01C65B7FC6C6A897
ETag: "52f4b1a1e50f6fca66e7bf80163aab82"
Content-Type: image/png
Accept-Ranges: bytes
Content-Length: 31651
x-amz-id-2: fHkIzv5QaIotlJfOO1m+kjePS5pioKRdMkfTIkpFSel9PrKTe5idJ4dwv1tyueEYKhi7tjpawAg=

GET
H2 200 stuck_out_tongue.png
0x00sec.org/images/emoji/twitter/ 843 B
970 B 16ms
15ms Image
image/png 2606:4700:30::6812:3030
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://0x00sec.org/images/emoji/twitter/stuck_out_tongue.png?v=6

Requested by

Host: 0x00sec.org
URL: https://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/10802

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:30::6812:3030 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

f4e081a0fa8795c3b4d7ba51b7cbc72cc2a0868dbaf2039ac78ee08fe073f7b3

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

:path: /images/emoji/twitter/stuck_out_tongue.png?v=6
pragma: no-cache
cookie: __cfduid=ddf12e23ae0db11c7734dc6291a473ae11547988902
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: 0x00sec.org
referer: https://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/10802
:scheme: https
:method: GET
Referer: https://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/10802
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Sun, 20 Jan 2019 12:55:03 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
last-modified: Mon, 26 Nov 2018 15:50:06 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 49c1b178fdd0bf11-FRA
content-length: 843
expires: Mon, 20 Jan 2020 12:55:03 GMT

GET
H/1.1 200
OK 96b68198cda08808004801a4327518a81a267178.png
0x00sec.s3.dualstack.us-east-1.amazonaws.com/original/2X/9/ 59 KB
59 KB 111ms
110ms Image
image/png 2600:1fa0:8024:8dc1:34d8:533b::
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://0x00sec.s3.dualstack.us-east-1.amazonaws.com/original/2X/9/96b68198cda08808004801a4327518a81a267178.png
Requested by: Host: 0x00sec.org
URL: https://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/10802
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1fa0:8024:8dc1:34d8:533b:: , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 193dd33ba0eea3d3eaa0c24334807ab8cf076c41f9b66607818b566880674cc6

Request headers

Referer: https://0x00sec.org/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Sun, 20 Jan 2019 12:55:05 GMT
Last-Modified: Mon, 14 Jan 2019 15:25:20 GMT
Server: AmazonS3
x-amz-request-id: 5C99BEF00D33814E
ETag: "34763919fcb343aa084df9c13a29a9eb"
Content-Type: image/png
Accept-Ranges: bytes
Content-Length: 60226
x-amz-id-2: e59NTbHak0gqBtowshyJbXOazYbHzgJfirhUKhXYgtu0O8+Tvs4YS+qy2tUPbcDv38nX2NNjZrQ=

GET
H2 200 6902_1.png
0x00sec.org/user_avatar/0x00sec.org/thunderson/45/ 2 KB
2 KB 17ms
16ms Image
image/jpeg 2606:4700:30::6812:3030
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://0x00sec.org/user_avatar/0x00sec.org/thunderson/45/6902_1.png

Requested by

Host: 0x00sec.org
URL: https://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/10802

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:30::6812:3030 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

992384c03a986f9c73477a4e1d2df1626e105e3b05ec11f9d2b3605f8e577c4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

:path: /user_avatar/0x00sec.org/thunderson/45/6902_1.png
pragma: no-cache
cookie: __cfduid=ddf12e23ae0db11c7734dc6291a473ae11547988902
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: 0x00sec.org
referer: https://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/10802
:scheme: https
:method: GET
Referer: https://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/10802
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Sun, 20 Jan 2019 12:55:03 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
x-permitted-cross-domain-policies: none
content-transfer-encoding: binary
status: 200
x-discourse-route: user_avatars/show
content-length: 2112
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 14 Jan 2019 16:08:00 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-download-options: noopen
content-type: image/jpeg
cache-control: public, max-age=31556952
accept-ranges: bytes
cf-ray: 49c1b1790dd1bf11-FRA
expires: Mon, 20 Jan 2020 18:44:15 GMT

GET
H2 200 6635_1.png
0x00sec.org/user_avatar/0x00sec.org/guly/45/ 3 KB
3 KB 16ms
14ms Image
image/jpeg 2606:4700:30::6812:3030
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://0x00sec.org/user_avatar/0x00sec.org/guly/45/6635_1.png

Requested by

Host: 0x00sec.org
URL: https://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/10802

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:30::6812:3030 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

8710d0f13f791326cb923e9ba321c6c1bd9f51563f37c65821c5716e194e0137

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

:path: /user_avatar/0x00sec.org/guly/45/6635_1.png
pragma: no-cache
cookie: __cfduid=ddf12e23ae0db11c7734dc6291a473ae11547988902
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: 0x00sec.org
referer: https://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/10802
:scheme: https
:method: GET
Referer: https://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/10802
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Sun, 20 Jan 2019 12:55:03 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
x-permitted-cross-domain-policies: none
content-transfer-encoding: binary
status: 200
x-discourse-route: user_avatars/show
content-length: 2861
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 11 Dec 2018 14:27:50 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-download-options: noopen
content-type: image/jpeg
cache-control: public, max-age=31556952
accept-ranges: bytes
cf-ray: 49c1b1790dd3bf11-FRA
expires: Mon, 20 Jan 2020 18:44:15 GMT

GET
H2 200 6902_1.png
0x00sec.org/user_avatar/0x00sec.org/thunderson/25/ 999 B
1 KB 16ms
15ms Image
image/jpeg 2606:4700:30::6812:3030
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://0x00sec.org/user_avatar/0x00sec.org/thunderson/25/6902_1.png

Requested by

Host: 0x00sec.org
URL: https://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/10802

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:30::6812:3030 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

1c8f69255a3bd34a05cea4f6c5a924749e6e484199e4c3aa04c304c71fb5480c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

:path: /user_avatar/0x00sec.org/thunderson/25/6902_1.png
pragma: no-cache
cookie: __cfduid=ddf12e23ae0db11c7734dc6291a473ae11547988902
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: 0x00sec.org
referer: https://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/10802
:scheme: https
:method: GET
Referer: https://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/10802
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Sun, 20 Jan 2019 12:55:03 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
x-permitted-cross-domain-policies: none
content-transfer-encoding: binary
status: 200
x-discourse-route: user_avatars/show
content-length: 999
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 14 Jan 2019 16:08:00 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-download-options: noopen
content-type: image/jpeg
cache-control: public, max-age=31556952
accept-ranges: bytes
cf-ray: 49c1b1790dd4bf11-FRA
expires: Mon, 20 Jan 2020 18:44:15 GMT

GET
H/1.1 200
OK 046bc4e1c9cc27618d0390eaf9e35705a1a77356.png
0x00sec.s3.dualstack.us-east-1.amazonaws.com/original/2X/0/ 449 B
805 B 117ms
117ms Image
image/png 2600:1fa0:8024:8dc1:34d8:533b::
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://0x00sec.s3.dualstack.us-east-1.amazonaws.com/original/2X/0/046bc4e1c9cc27618d0390eaf9e35705a1a77356.png
Requested by: Host: 0x00sec.org
URL: https://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/10802
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1fa0:8024:8dc1:34d8:533b:: , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 2d59b358c254d5467046e6f341825949aafecfe46af27b541fae72850c9fc41f

Request headers

Referer: https://0x00sec.org/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Sun, 20 Jan 2019 12:55:05 GMT
Last-Modified: Mon, 14 Jan 2019 17:44:35 GMT
Server: AmazonS3
x-amz-request-id: A4E7765C265D039C
ETag: "fa769ba2fd25c9bdd269a736e0942218"
Content-Type: image/png
Accept-Ranges: bytes
Content-Length: 449
x-amz-id-2: nCCCw+VD57oKR5gHLHTgsUShmLaie3b5uZVEDaZNYUS3BAMlNKAXZeZOSOuecWSBxBjy8cekMU8=

GET
H/1.1 200
OK 7d061fc93f07e809da66e911d832687823ad36dc.png
0x00sec.s3.dualstack.us-east-1.amazonaws.com/original/2X/7/ 27 KB
28 KB 106ms
105ms Image
image/png 2600:1fa0:8024:8dc1:34d8:533b::
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://0x00sec.s3.dualstack.us-east-1.amazonaws.com/original/2X/7/7d061fc93f07e809da66e911d832687823ad36dc.png
Requested by: Host: 0x00sec.org
URL: https://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/10802
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1fa0:8024:8dc1:34d8:533b:: , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 4a492224a242d7ddb4eb6b8c1f28d6432d71e033dcb6906aa71ffb035a91857c

Request headers

Referer: https://0x00sec.org/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Sun, 20 Jan 2019 12:55:05 GMT
Last-Modified: Mon, 14 Jan 2019 23:40:10 GMT
Server: AmazonS3
x-amz-request-id: DD25444383980D9A
ETag: "a4962c76d66b60afd9d10e4fbe7816d2"
Content-Type: image/png
Accept-Ranges: bytes
Content-Length: 28058
x-amz-id-2: ju08HFVorjgYf7oxFaGadr5KYI2xa1OoOGDqqw++PvKwE17qj3V6nJgXee1VuhlIwIhv+UfZSgc=

GET
H2 200 6913_1.png
0x00sec.org/user_avatar/0x00sec.org/gettheguru/45/ 3 KB
3 KB 15ms
14ms Image
image/jpeg 2606:4700:30::6812:3030
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://0x00sec.org/user_avatar/0x00sec.org/gettheguru/45/6913_1.png

Requested by

Host: 0x00sec.org
URL: https://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/10802

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:30::6812:3030 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

f8f61aa7e29376beda26a3acd5ad133dec8dae78793243de91e473e26ad4749d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

:path: /user_avatar/0x00sec.org/gettheguru/45/6913_1.png
pragma: no-cache
cookie: __cfduid=ddf12e23ae0db11c7734dc6291a473ae11547988902
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: 0x00sec.org
referer: https://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/10802
:scheme: https
:method: GET
Referer: https://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/10802
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Sun, 20 Jan 2019 12:55:03 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
x-permitted-cross-domain-policies: none
content-transfer-encoding: binary
status: 200
x-discourse-route: user_avatars/show
content-length: 2729
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 15 Jan 2019 07:06:18 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-download-options: noopen
content-type: image/jpeg
cache-control: public, max-age=31556952
accept-ranges: bytes
cf-ray: 49c1b1790dd6bf11-FRA
expires: Mon, 20 Jan 2020 18:44:15 GMT

GET
H2 200 6918_1.png
0x00sec.org/user_avatar/0x00sec.org/gianniscavo/45/ 4 KB
5 KB 20ms
19ms Image
image/png 2606:4700:30::6812:3030
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://0x00sec.org/user_avatar/0x00sec.org/gianniscavo/45/6918_1.png

Requested by

Host: 0x00sec.org
URL: https://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/10802

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:30::6812:3030 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

63c8861c8159b4e8da368cc7231eaf824e88f41e030a5f42d025ed59c76968d5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

:path: /user_avatar/0x00sec.org/gianniscavo/45/6918_1.png
pragma: no-cache
cookie: __cfduid=ddf12e23ae0db11c7734dc6291a473ae11547988902
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: 0x00sec.org
referer: https://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/10802
:scheme: https
:method: GET
Referer: https://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/10802
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Sun, 20 Jan 2019 12:55:03 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
x-permitted-cross-domain-policies: none
content-transfer-encoding: binary
status: 200
x-discourse-route: user_avatars/show
content-length: 4541
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 15 Jan 2019 11:01:33 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-download-options: noopen
content-type: image/png
cache-control: public, max-age=31556952
accept-ranges: bytes
cf-ray: 49c1b1790dd7bf11-FRA
expires: Mon, 20 Jan 2020 18:44:15 GMT

GET
H/1.1 200
OK 6bd8344f1586c1c0b508559488cf3f158f8ca597_1_10x10.png
0x00sec.s3.dualstack.us-east-1.amazonaws.com/optimized/2X/6/ 387 B
743 B 107ms
106ms Image
image/png 2600:1fa0:8024:8dc1:34d8:533b::
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://0x00sec.s3.dualstack.us-east-1.amazonaws.com/optimized/2X/6/6bd8344f1586c1c0b508559488cf3f158f8ca597_1_10x10.png
Requested by: Host: 0x00sec.org
URL: https://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/10802
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1fa0:8024:8dc1:34d8:533b:: , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 317f6aad73425633534f4ace7cb2da5621a7a12815607bb7961708de8f078070

Request headers

Referer: https://0x00sec.org/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Sun, 20 Jan 2019 12:55:05 GMT
Last-Modified: Fri, 11 Jan 2019 21:23:40 GMT
Server: AmazonS3
x-amz-request-id: 92C548ABEBCA42DB
ETag: "f88cbf6c872933c5e5e8e5978161705a"
Content-Type: image/png
Accept-Ranges: bytes
Content-Length: 387
x-amz-id-2: 2AXxfYYYeDHy7jGb+qe81iUbW/n8eKlJcE8H5en55tMNrUq3m1zOspKNj2a8gakQylMgESznR/M=

GET
H/1.1 200
OK 9349e9b5fc470bfac5e33dfa3cedbf19ee9a3937_1_10x10.png
0x00sec.s3.dualstack.us-east-1.amazonaws.com/optimized/2X/9/ 387 B
743 B 97ms
96ms Image
image/png 2600:1fa0:8024:8dc1:34d8:533b::
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://0x00sec.s3.dualstack.us-east-1.amazonaws.com/optimized/2X/9/9349e9b5fc470bfac5e33dfa3cedbf19ee9a3937_1_10x10.png
Requested by: Host: 0x00sec.org
URL: https://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/10802
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1fa0:8024:8dc1:34d8:533b:: , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 86e64add30bec717c5ebb247e64a24ba69378467aa4466ac82c7dd45bc972685

Request headers

Referer: https://0x00sec.org/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Sun, 20 Jan 2019 12:55:05 GMT
Last-Modified: Mon, 14 Jan 2019 05:29:24 GMT
Server: AmazonS3
x-amz-request-id: E41752497726528A
ETag: "8f47cf9d343e048da88fb899151eaa5a"
Content-Type: image/png
Accept-Ranges: bytes
Content-Length: 387
x-amz-id-2: pDOqZ6GqljUXrITRcEAIXEwMxZ5GLHqfKz6trEIZnhU/sQskVtv6xBZN8J35pkk2dNLFC6xDHPU=

GET
H/1.1 200
OK 7d061fc93f07e809da66e911d832687823ad36dc_1_10x10.png
0x00sec.s3.dualstack.us-east-1.amazonaws.com/optimized/2X/7/ 387 B
743 B 107ms
106ms Image
image/png 2600:1fa0:8024:8dc1:34d8:533b::
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://0x00sec.s3.dualstack.us-east-1.amazonaws.com/optimized/2X/7/7d061fc93f07e809da66e911d832687823ad36dc_1_10x10.png
Requested by: Host: 0x00sec.org
URL: https://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/10802
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1fa0:8024:8dc1:34d8:533b:: , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 355836aca35111b2345f951a4208bb970b25c638703449264eac69480783c9b3

Request headers

Referer: https://0x00sec.org/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Sun, 20 Jan 2019 12:55:05 GMT
Last-Modified: Mon, 14 Jan 2019 23:41:25 GMT
Server: AmazonS3
x-amz-request-id: 02449CE2CCD7798F
ETag: "cb30e21a387d6d3042a0dc33af8f947b"
Content-Type: image/png
Accept-Ranges: bytes
Content-Length: 387
x-amz-id-2: YuWpkeLebz6JFOR0Ay/H2oDVnh9WNpGTds8CP8fA1lv2Q9LFIgmkikytyIx2fW7G8EDahW+QboY=

GET
H2

200

collect
stats.g.doubleclick.net/r/
Redirect Chain

https://www.google-analytics.com/r/collect?v=1&_v=j72&a=574750370&t=pageview&_s=1&dl=https%3A%2F%2F0x00sec.org%2Ft%2Fbypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell%2F10...
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-76839457-2&cid=736868056.1547988904&jid=1315822204&_gid=1487651396.1547988904&gjid=1293116226&_v=j72&z=693159844

35 B
102 B

15ms
15ms

Image
image/gif

2a00:1450:400c:c0c::9a
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-76839457-2&cid=736868056.1547988904&jid=1315822204&_gid=1487651396.1547988904&gjid=1293116226&_v=j72&z=693159844

Requested by

Host: 0x00sec.org
URL: https://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/10802

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:400c:c0c::9a , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://0x00sec.org/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
access-control-allow-origin: *
date: Sun, 20 Jan 2019 12:55:03 GMT
content-type: image/gif
status: 200
cache-control: no-cache, no-store, must-revalidate
alt-svc: quic=":443"; ma=2592000; v="44,43,39,35"
content-length: 35
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sun, 20 Jan 2019 12:55:03 GMT
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
access-control-allow-origin: *
location: https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-76839457-2&cid=736868056.1547988904&jid=1315822204&_gid=1487651396.1547988904&gjid=1293116226&_v=j72&z=693159844
content-type: text/html; charset=UTF-8
status: 302
cache-control: no-cache, no-store, must-revalidate
alt-svc: quic=":443"; ma=2592000; v="44,43,39,35"
content-length: 418
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 collect
www.google-analytics.com/ 35 B
99 B 6ms
6ms Image
image/gif 2a00:1450:4001:816::200e
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j72&a=574750370&t=pageview&_s=2&dl=https%3A%2F%2F0x00sec.org%2Ft%2Fbypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell%2F10802&dp=%2Ft%2Fbypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell%2F10802&ul=en-us&de=UTF-8&dt=Bypassing%20Crowdstrike%20Falcon%20detection%2C%20from%20phishing%20email%20to%20reverse%20shell%20-%20Malware%20-%200x00sec%20-%20The%20Home%20of%20the%20Hacker&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&_u=IEBAAEAB~&jid=&gjid=&cid=736868056.1547988904&tid=UA-76839457-2&_gid=1487651396.1547988904&z=1728290881

Requested by

Host: 0x00sec.org
URL: https://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/10802

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:816::200e , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://0x00sec.org/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 20 Dec 2018 22:09:15 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 2645148
content-type: image/gif
status: 200
alt-svc: quic=":443"; ma=2592000; v="44,43,39,35"
cache-control: no-cache, no-store, must-revalidate
access-control-allow-origin: *
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H2 200 poll
0x00sec.org/message-bus/b0a31f28d6264aa5a8b9f2da8c7c2ba2/ 241 B
0 59ms
58ms XHR
text/plain 2606:4700:30::6812:3030
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://0x00sec.org/message-bus/b0a31f28d6264aa5a8b9f2da8c7c2ba2/poll

Requested by

Host: 0x00sec.org
URL: https://0x00sec.org/assets/ember_jquery-07f49b58317ea9292d939348ec0091eb50a9d8aaabd9e86cc074ef5f049918aa.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:30::6812:3030 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

cookie: __cfduid=ddf12e23ae0db11c7734dc6291a473ae11547988902; _ga=GA1.2.736868056.1547988904; _gid=GA1.2.1487651396.1547988904; _gat=1
origin: https://0x00sec.org
accept-encoding: gzip, deflate, br
x-csrf-token: undefined
discourse-visible: true
x-silence-logger: true
x-requested-with: XMLHttpRequest
content-length: 201
:path: /message-bus/b0a31f28d6264aa5a8b9f2da8c7c2ba2/poll
pragma: no-cache
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
content-type: application/x-www-form-urlencoded; charset=UTF-8
accept: text/plain, */*; q=0.01
cache-control: no-cache
:authority: 0x00sec.org
referer: https://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/10802
:scheme: https
:method: POST
Origin: https://0x00sec.org
X-CSRF-Token: undefined
Discourse-Visible: true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-SILENCE-LOGGER: true
Accept: text/plain, */*; q=0.01
Referer: https://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/10802
X-Requested-With: XMLHttpRequest

Response headers

pragma: no-cache
date: Sun, 20 Jan 2019 12:55:05 GMT
content-encoding: br
x-content-type-options: nosniff
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
status: 200
access-control-allow-methods: GET, POST
content-type: text/plain; charset=utf-8
access-control-allow-origin: http://0x00sec.org
cache-control: must-revalidate, private, max-age=0
cf-ray: 49c1b1801e95bf11-FRA
access-control-allow-headers: X-SILENCE-LOGGER, X-Shared-Session-Key, Dont-Chunk, Discourse-Visible
expires: 0

Verdicts & Comments Add Verdict or Comment

60 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

4 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.0x00sec.org/	1970-01-18 21:59:48	Name: _gat Value: 1
.0x00sec.org/	1970-01-18 22:01:15	Name: _gid Value: GA1.2.1487651396.1547988904
.0x00sec.org/	1970-01-19 15:31:00	Name: _ga Value: GA1.2.736868056.1547988904
.0x00sec.org/	1970-01-19 06:45:24	Name: __cfduid Value: ddf12e23ae0db11c7734dc6291a473ae11547988902

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

0x00sec.org
0x00sec.s3.amazonaws.com
0x00sec.s3.dualstack.us-east-1.amazonaws.com
s3.amazonaws.com
stats.g.doubleclick.net
www.google-analytics.com
2600:1fa0:8024:8dc1:34d8:533b::
2606:4700:30::6812:3030
2606:4700:30::6812:3130
2a00:1450:4001:816::200e
2a00:1450:400c:c0c::9a
52.216.107.30
52.216.236.251
055404c436d4844f5f198144ce1b26d308a4b6fe39ac6c7b02354d880f463896
06000bb4405bd9b83192af15aa749a15acdc05e4762208daa1f9aeb093f8e6fd
076706ccad020424fe4f21ec4910e2583f818f14148fc05bb3732d0fec5eedde
07aab838827804b5ccb28fe8764e884c9f32a3ba0904712355f8862e69134c59
0db766eeb2753ac61d001dca4c38534aa633e6fea96f1fde8ac84635d8a23791
193dd33ba0eea3d3eaa0c24334807ab8cf076c41f9b66607818b566880674cc6
1c8f69255a3bd34a05cea4f6c5a924749e6e484199e4c3aa04c304c71fb5480c
21be4d116064c4304a6d1635a4c39f104dc859c79ed213c4cda274861be751c1
2852d6d4dd54faaf78f0d9d53f0f28a2045fd78694b282f400e86e51d1d8e06d
2d070e18ff984029d74609ce7659b0c83e7425a1b0260ffdcef3383e18fe6a00
2d59b358c254d5467046e6f341825949aafecfe46af27b541fae72850c9fc41f
2e9519b3e8b10fb2a42d3c9ffe478c4cd1f6afbae9cd82ef58a1dbfa6e74c72f
317f6aad73425633534f4ace7cb2da5621a7a12815607bb7961708de8f078070
34f406c10dc099699946566b642e7dc7ac13a85110d448e51edf0735f4772f01
355836aca35111b2345f951a4208bb970b25c638703449264eac69480783c9b3
3d94deb9689e928b55509367f971c47ed63f3160c4f18591e45e0f31f44d61f5
3ed94888171f2df3555fc751b733babe1ee9b6cc182ee77156d0ecff0339ae89
3ef212ba53dc74787edcdc2fea3f7076da242d09ea9bd7816d597480630d4d2b
3fddc6d28aba3c13d64cfd4847c333ff48c71d4a5a58bd1a0494ca6ae8ac1bb4
48d4fe4f1447530480db85a5283f3728ed37ea8364ec8f4d8079801317361759
4a492224a242d7ddb4eb6b8c1f28d6432d71e033dcb6906aa71ffb035a91857c
4e4f8bf178e9611f4636f6069200c919076b41dfec98945a24c361a4ef343929
51c1919c49aced13303ed2089a074a74c7f415c4c41278b78dcec33ed7a5eb8d
63c8861c8159b4e8da368cc7231eaf824e88f41e030a5f42d025ed59c76968d5
6e91e622b9b19d6747fe30842df12cf3bbdd015655f4b0600f2055e82bd5c802
72d10d313abbe6d35eca8adcd6287cff6fddbca73dd8576282fb72201d02e173
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
86e64add30bec717c5ebb247e64a24ba69378467aa4466ac82c7dd45bc972685
8710d0f13f791326cb923e9ba321c6c1bd9f51563f37c65821c5716e194e0137
92f6deacaf1824e96d36e1be10d639016c46fe2c0e10c5632550dd316740e235
9399e7872e2c55092a9d11ff1e6c01fc3c43044bd171d4e80118be4202798011
968d2338d3e692f5571336520179c037d21b588a16d724029a769c45d538b92a
992384c03a986f9c73477a4e1d2df1626e105e3b05ec11f9d2b3605f8e577c4f
a1d0dd8a59c0a44beae54bd6939329314bf7ac7589381400445053ed3114657b
af119fcac0a9cb134865be91a112068099cb2f77e2ba279480a0f2c9c4ac717a
b1d1c4e0f2a3cefb4978fc71e695f3e4e08b47a1e1b13e878f0ee3dff08b95a3
b53b79560b6feda4c827c1a8ba9f82198c5f7133e0f706806f0c8271bfca369d
b5b0c740dbe4f19af03d0c7d4b61406ff3c80d2e5a81dfbc6ea25d89e6033b6b
b688a3bcd1297cc0fe08e6e52fea14ba9108ee4b9a2052c03e7bac6e19347255
c0b4f4cc7e22331a71a786a09a2074212fae6521d3e397de5bc0791a6c261a12
d28954a385094cc1f88c9f3ff1db73f32c6027c304b65aca86fc3af65fcbfc5f
d8a070072fbf47efbe27c3e6900282876a3db21b53ffe224dc436e651ac5d1b6
dabfc88622035b2a9a54447ac9eaaed64c49c608d1aaf6e441a856623dd28c70
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e82d344de5abcd9b4935c93affb6a92a4024d4867fd39c9f811db4cd5f78c9b7
f13b417ef7f4c30f277de5374d0202511c15ccf3f737eca486f8f78e86e43684
f4e081a0fa8795c3b4d7ba51b7cbc72cc2a0868dbaf2039ac78ee08fe073f7b3
f6b86554472159b74d0ab91b2cb3cd75cf361ccf96a141a4ebd3363c38e7f8eb
f8f61aa7e29376beda26a3acd5ad133dec8dae78793243de91e473e26ad4749d
f938ab6cb237e25ba7d2a91040092a6b4fc698bfa413e7b8222e8aa632ca980a
fe66aef28788cf660b2383fefb69c360a3c1262f17aee1d3aea7cde5bdc914c0

0x00sec.org Open in urlscan Pro 2606:4700:30::6812:3030 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

52 Requests

98 %HTTPS

71 %IPv6

4 Domains

6 Subdomains

7 IPs

2 Countries

1093 kBTransfer

4288 kBSize

4 Cookies

13 Outgoing links

Page URL History

Redirected requests

52 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

0x00sec.org Open in urlscan Pro
2606:4700:30::6812:3030 Public Scan

Screenshot
Live screenshot

Full Image

52
Requests

98 %
HTTPS

71 %
IPv6

4
Domains

6
Subdomains

7
IPs

2
Countries

1093 kB
Transfer

4288 kB
Size

4
Cookies

52 HTTP transactions
2 data transactions