0x00-0x00.github.io
Open in
urlscan Pro
2606:50c0:8003::153
Public Scan
URL:
https://0x00-0x00.github.io/research/2018/10/28/How-to-bypass-AMSI-and-Execute-ANY-malicious-powershell-code.html
Submission: On November 07 via manual from GB — Scanned from GB
Submission: On November 07 via manual from GB — Scanned from GB
Summary
This website contacted 1 IPs
in 1 countries
across 1 domains to perform 10 HTTP transactions.
The main IP is 2606:50c0:8003::153, located in
United States and
belongs to FASTLY, US.
The main domain is 0x00-0x00.github.io.
TLS certificate: Issued by DigiCert TLS RSA SHA256 2020 CA1 on April 7th 2022. Valid for: a year.
This is the only time 0x00-0x00.github.io was scanned on urlscan.io!
TLS certificate: Issued by DigiCert TLS RSA SHA256 2020 CA1 on April 7th 2022. Valid for: a year.
This is the only time 0x00-0x00.github.io was scanned on urlscan.io!
urlscan.io Verdict: No classification
Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 10 | 2606:50c0:800... 2606:50c0:8003::153 | 54113 (FASTLY) (FASTLY) | |
| 10 | 1 |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 10 |
github.io
0x00-0x00.github.io |
253 KB |
| 10 | 1 |
| Domain | Requested by | |
|---|---|---|
| 10 | 0x00-0x00.github.io |
0x00-0x00.github.io
|
| 10 | 1 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| www.cyberark.com |
| github.com |
| www.twitter.com |
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| *.github.com DigiCert TLS RSA SHA256 2020 CA1 |
2022-04-07 - 2023-04-07 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://0x00-0x00.github.io/research/2018/10/28/How-to-bypass-AMSI-and-Execute-ANY-malicious-powershell-code.html
Frame ID: 8E0998157BEDBCF31692AB5081EF36DE
Requests: 10 HTTP requests in this frame
Screenshot
Page Title
How to bypass AMSI and execute ANY malicious Powershell code | zc00l blogDetected technologies
Jekyll
(Static Site Generator)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- <!-- Begin Jekyll SEO tag
GitHub Pages
(CDN)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- ^https?://[^/]+\.github\.io
Page Statistics
3 Outgoing links
These are links going to different origins than the main page.
URL: https://www.cyberark.com/threat-research-blog/amsi-bypass-redux
Title: Link
Title: Link
Search URL Search Domain Scan URL
URL: https://github.com/0x00-0x00
Title: 0x00-0x00
Title: 0x00-0x00
Search URL Search Domain Scan URL
URL: https://www.twitter.com/_zc00l
Title: _zc00l
Title: _zc00l
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
10 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H2 |
Primary Request
How-to-bypass-AMSI-and-Execute-ANY-malicious-powershell-code.html
0x00-0x00.github.io/research/2018/10/28/ |
27 KB 9 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
main.css
0x00-0x00.github.io/assets/ |
7 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
amsi_01.JPG
0x00-0x00.github.io/assets/ |
23 KB 23 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
amsi_02.JPG
0x00-0x00.github.io/assets/ |
21 KB 21 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
amsi_03.JPG
0x00-0x00.github.io/assets/ |
12 KB 13 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
amsi_04.JPG
0x00-0x00.github.io/assets/ |
18 KB 18 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
amsi_05.JPG
0x00-0x00.github.io/assets/ |
19 KB 19 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
amsi_06.JPG
0x00-0x00.github.io/assets/ |
38 KB 38 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
amsi_07.JPG
0x00-0x00.github.io/assets/ |
106 KB 106 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
minima-social-icons.svg
0x00-0x00.github.io/assets/ |
10 KB 4 KB |
Other
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
9 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
| Source | Level | URL Text |
|---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
| Header | Value |
|---|---|
| Strict-Transport-Security | max-age=31556952 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
0x00-0x00.github.io
2606:50c0:8003::153
39f87ca832d235ede52f66a4d7ae03d050e6a8b4e1ceba6a5b646fd43ee76223
548a092e1a3d7dbce81a5f9135e5f30c6178c6ef01258fbad5dae784241b9af7
55942793c4789f828655418fa3864a1d8a10ad49263706e24b1e5f3cd9a7f027
5b103747c64980bbfd436b11c8fa2bdfd8560211692d65de2a881ecee7d27c4a
6647ee6af809d0e2bd4bdc2cc1ba61213e969850fe1106417c7b49ca5a68773d
b91f995e7e225eda0d06ca68fde19c64ce53bc8dbf8710b7fa6498cd8b6814ac
c3cfdfa23aaa9bbd046d124b97b20243014b115c1528edceebfe9ef6527002f2
db5e627a81ed8ca5db113392ff1076021b06d09088f3267fe6789c9642e98ad6
f861c07e386d770d235e0a7d5674e3b851103960f1b675d5ac614b01f881e02e
fb130a57f4d5a3e62a12fdb83e2b707a71ca077b80065f463147b8ee996edfe6