entertainment media

news media journalism

adult content

gambling betting

technology software

English

_rdt_uuid

consentHunt

cf_clearance

PHP_SESS_ID

__cf_bm

_gcl_au

_gsid

_tt_enable_cookie

_ttp

_fbp

ttcsid_D87IDCRC77U9QCTA729G

_ga_HGEKR6GQHJ

ttcsid

Within the commercial generic top-level domain (.com), 'www.huntshowdown.com' is registered and includes subdomain 'www'. The second-level label 'huntshowdown' is 12 characters long holding 3 vowels versus nine consonants. Splitting it apart reveals 2 words: hunt, showdown. Average segment length settles at six characters. No strong language cues emerged from the frequency lists.

formcheckin

email

afId

csrftoken

consent

html/a5/bf/a5bf43ad-29c8-4dca-92d4-67f82be1ab43.html.gz

45b40732b613817dc4a40c9a79ac52e4d3fd9d34e635e250409adba33c29b85a

e3da8b35554d5fbe94e53934b2077622a2f9ac0a251463d27f8d6ee19a911a50

fc7e184beeda61bf6427938a84560f52348976bb55e807b224eb53930e97ef6a

24b9a49d375465e659dbaecb3fda81fbf0d3eedbf138e29cb5229e502d8a4fa1

81732e25e1d2e678ec73dd14071f683bf50116c0bb946cdb4fb4c479b869fde0

bfffdd27c314fd568b2d242e5e0255dc40204b8e9ec77ef8e0d4ec0203dc9e5a

6e798ee6bc9fe84100e128df742c382c32168dba325899061f9a978bf8a4dd93

6150a35c0f486c46cadf0e230e2aa159c7c23ecfbb5611b64ee3f25fcbff341f

ce7756081523c311f2ff40f23734d9e51e9c89e39bf5e08b892d3f4f5c215754

2c896f1283f2b53915f5e66759d01e85821b5a1dde701d5f2044f7c14bf77d63

9b96a7411ab2e41dd12d819f7a4f32733d1e90d2021d1980b9170b347cc0ef98

default-src *.facebook.com *.fbcdn.net *.facebook.net 'self' blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net blob: 'self' 'nonce-z29JaOGj';style-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob: 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.fbcdn.net attachment.fbsbx.com *.cdninstagram.com blob: 'self' data: https://edge-chat.facebook.net https://edge-chat-latest.facebook.net wss://edge-chat-latest.facebook.net wss://edge-chat.facebook.net wss://edge-chat.socialplugin.facebook.net wss://edge-chat-latest.socialplugin.facebook.net https://edge-chat.socialplugin.facebook.net https://edge-chat-latest.socialplugin.facebook.net;font-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob:;img-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob:;media-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob:;child-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob:;frame-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob:;manifest-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob:;object-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob:;worker-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;

352f60cfde5c2e96250d7dbc8d7113dfde38fcd36d6caecfe373da6561e0f046

54c8548ff33264b9838952e43d0b60ff57340ad06c4568bb718d85680e5dd349

ea17130fab5156f9479524772dfaa476a10f1d031b1d7473fe5883c83224d3ce

e7625480fd0d60e0c96b50f569525e34b1a36a1c87b4eaf7b79a6c424d06abbf

9280b51b41384c2f887090a0afc2c2df36b454d598fc875768aa60b38204bb73

45ad83c7eb328e1011b9c90ad1bab8ec383a0c7c8af0f2b5af034013189b1666

default-src *.facebook.com *.fbcdn.net *.facebook.net 'self' blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net blob: 'self' 'nonce-rWv1AIPm';style-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob: 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.fbcdn.net attachment.fbsbx.com *.cdninstagram.com blob: 'self' data: https://edge-chat.facebook.net https://edge-chat-latest.facebook.net wss://edge-chat-latest.facebook.net wss://edge-chat.facebook.net wss://edge-chat.socialplugin.facebook.net wss://edge-chat-latest.socialplugin.facebook.net https://edge-chat.socialplugin.facebook.net https://edge-chat-latest.socialplugin.facebook.net;font-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob:;img-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob:;media-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob:;child-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob:;frame-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob:;manifest-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob:;object-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob:;worker-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;

417c2fa4ff8cf5e36b1797c558e99b797cf8e9a960ce8e126ccd8de6ff09efca

Axios is vulnerable to Inefficient Regular Expression Complexity

Axios Cross-Site Request Forgery Vulnerability

axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URL

## Summary

When Axios runs on Node.js and is given a URL with the `data:` scheme, it does not perform HTTP. Instead, its Node http adapter decodes the entire payload into memory (`Buffer`/`Blob`) and returns a synthetic 200 response.
This path ignores `maxContentLength` / `maxBodyLength` (which only protect HTTP responses), so an attacker can supply a very large `data:` URI and cause the process to allocate unbounded memory and crash (DoS), even if the caller requested `responseType: 'stream'`.

# Denial of Service via **proto** Key in mergeConfig

### Summary

The `mergeConfig` function in axios crashes with a TypeError when processing configuration objects containing `__proto__` as an own property. An attacker can trigger this by providing a malicious configuration object created via `JSON.parse()`, causing complete denial of service.

### Details

The vulnerability exists in `lib/core/mergeConfig.js` at lines 98-101:

```javascript
utils.forEach(Object.keys({ ...config1, ...config2 }), function computeConfigValue(prop) {
  const merge = mergeMap[prop] || mergeDeepProperties;
  const configValue = merge(config1[prop], config2[prop], prop);
  (utils.isUndefined(configValue) && merge !== mergeDirectKeys) || (config[prop] = configValue);
});
```

When `prop` is `'__proto__'`:

1. `JSON.parse('{"__proto__": {...}}')` creates an object with `__proto__` as an own enumerable property
2. `Object.keys()` includes `'__proto__'` in the iteration
3. `mergeMap['__proto__']` performs prototype chain lookup, returning `Object.prototype` (truthy object)
4. The expression `mergeMap[prop] || mergeDeepProperties` evaluates to `Object.prototype`
5. `Object.prototype(...)` throws `TypeError: merge is not a function`

The `mergeConfig` function is called by:

- `Axios._request()` at `lib/core/Axios.js:75`
- `Axios.getUri()` at `lib/core/Axios.js:201`
- All HTTP method shortcuts (`get`, `post`, etc.) at `lib/core/Axios.js:211,224`

### PoC

```javascript
import axios from "axios";

const maliciousConfig = JSON.parse('{"__proto__": {"x": 1}}');
await axios.get("https://httpbin.org/get", maliciousConfig);
```

**Reproduction steps:**

1. Clone axios repository or `npm install axios`
2. Create file `poc.mjs` with the code above
3. Run: `node poc.mjs`
4. Observe the TypeError crash

**Verified output (axios 1.13.4):**

```
TypeError: merge is not a function
    at computeConfigValue (lib/core/mergeConfig.js:100:25)
    at Object.forEach (lib/utils.js:280:10)
    at mergeConfig (lib/core/mergeConfig.js:98:9)
```

**Control tests performed:**
| Test | Config | Result |
|------|--------|--------|
| Normal config | `{"timeout": 5000}` | SUCCESS |
| Malicious config | `JSON.parse('{"__proto__": {"x": 1}}')` | **CRASH** |
| Nested object | `{"headers": {"X-Test": "value"}}` | SUCCESS |

**Attack scenario:**
An application that accepts user input, parses it with `JSON.parse()`, and passes it to axios configuration will crash when receiving the payload `{"__proto__": {"x": 1}}`.

### Impact

**Denial of Service** - Any application using axios that processes user-controlled JSON and passes it to axios configuration methods is vulnerable. The application will crash when processing the malicious payload.

Affected environments:

- Node.js servers using axios for HTTP requests
- Any backend that passes parsed JSON to axios configuration

This is NOT prototype pollution - the application crashes before any assignment occurs.

Versions before 1.6.8 depends on follow-redirects before 1.15.6 which could leak the proxy authentication credentials

eb43911b35c16af77c142ac668b93a77913056b79331d6cd9a5833e7f629ac41

06ecb7278e0a3bdb52fa8298c9b6671ace09f007e01d3ec1bca18c630645c1a1

5504d953f34d414136c448da4b4c65965ad570dc6a66455fbefcc7e2cc5e4b37

359cb1a0a63c847b143696cff39914b44c90bec727edc56d928ba4f85f758139

22dad31e2a8250cb45e2cc3f76d03a78e8b211fb1673595570e72be272901a71

293b851fe745a459555ff8140f6ef030149e73325cce056e7f5355eb9b4ab008

75a11da44c802486bc6f65640aa48a730f0f684c5c07a42ba3cd1735eb3fb070

DEVELOPER INSIGHT - FAIR PLAY TASK FORCE APRIL UPDATE

google

viewport

Hunt: Showdown is a competitive first-person PvP bounty hunting game with heavy PvE elements. Set in the darkest corners of the world, Hunt packs the thrill of survival games into a match-based format.

description

https://www.huntshowdown.com/assets/img/hero.jpg

application-name

theme-color

YLtx5zFe3yC482qUzJ9mA2N_0Azlbw8kqzgKvQX0kow

google-site-verification

Mesh Digital Limited

HUNTSHOWDOWN.COM

Abuse

Admin

Cloudflare-NOC

Cloudflare, Inc.

CLOUDFLARENET


        window.dataLayer = window.dataLayer || [];

        function gtag() {
            dataLayer.push(arguments);
        }

        gtag('js', new Date());

        gtag('config', 'G-HGEKR6GQHJ');
        


        (function(G, m, s, g, h, t) {
            G.gsght = G.gsght || function() {
            (G.gsght.q = G.gsght.q || []).push(arguments)
            };
            G.gsght.q = [], h = m.createElement(s),
            t = m.getElementsByTagName(s)[0];
            h.async = 1;
            h.src = g;
            t.parentNode.insertBefore(h, t)
        })(window, document, 'script', 'https://cdn.gsght.com/sdk.js');

        gsght('init', 'GS-101421');
        


        ! function(f, b, e, v, n, t, s)


        {
            if (f.fbq) return;
            n = f.fbq = function() {
            n.callMethod ?
                n.callMethod.apply(n, arguments) : n.queue.push(arguments)
            };
            if (!f._fbq) f._fbq = n;
            n.push = n;
            n.loaded = !0;
            n.version = '2.0';
            n.queue = [];
            t = b.createElement(e);
            t.async = !0;

            t.src = v;
            s = b.getElementsByTagName(e)[0];
            s.parentNode.insertBefore(t, s)
        }(window, document, 'script',
            'https://connect.facebook.net/en_US/fbevents.js');
        fbq('consent', 'grant');
        fbq('init', '161180277812144');
        fbq('track', 'PageView');
        

Requests	IP Address	Location	AS Autonomous System
37	104.18.20.175Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
36	104.17.24.14Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
73	2	-	-

Security Scan Report: www.huntshowdown.com

Summary

AI Security Verdict

Safe Website

Safety Factors

Details

Screenshot

Page Load Overview

Language Analysis

Primary Language

Detection Details

Website Classification

Primary Category

All Detected Categories

Detected Features

Domain & IP Information

Detected Technologies11

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

ssdeep (Context Triggered Piecewise Hashing)

sdhash (Similarity Digest Hashing)

Image Hashes

Perceptual Hashes

Other Hashes

Scan History