===== 01a1c103-9f65-7097-8278-27fb241fcbf0 =====
# 01a1c103-9f65-7097-8278-27fb241fcbf0  2026-11-09 15:53:21  curl/hunter-1  status=303  712ms
POST https://infoportal.baloise.de/api/liferay/do
--- request (838 B application/x-java-serialized-object)
POST /api/liferay/do HTTP/1.1
sec-ch-ua: "Chromium";v="152", "Not?A_Brand";v="24", "Google Chrome";v="152"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
Accept: application/x-java-serialized-object
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
cache-control: max-age=0
Cookie: CSRFT759-S=nW7IpcZKY5WQ0cyyZbE3BQ; AL_SESS-S=AYy99joLTNdBrNJEn7FjRvEKklGNKbWhynK1o_Yw91BRCY6lTadopmumufy3vc7GoNbb
Host: infoportal.baloise.de
X-Bug-Bounty: BBS:dwbzn
Content-Type: application/x-java-serialized-object
Content-Length: 29
<binary body 29 B; save with -o>
--- response (414 B text/html)
HTTP/1.1 303 See Other
Date: Mon, 09 Nov 2026 15:53:22 GMT
Server: Apache
Content-Length: 171
Location: /auth/ui/app/auth/application/access?Location=https%3A%2F%2Finfoportal%2Ebaloise%2Ede%2Fapi%2Fliferay%2Fdo
Content-Type: text/html

<html><body>Please follow <a href="/auth/ui/app/auth/application/access?Location=https%3A%2F%2Finfoportal%2Ebaloise%2Ede%2Fapi%2Fliferay%2Fdo">this link</a></body></html>

===== 01a1c21e-17e7-7165-b545-64a0bca21797 =====
# 01a1c21e-17e7-7165-b545-64a0bca21797  2026-11-09 21:01:53  curl/hunter-2  status=303  823ms
POST https://infoportal.baloise.de/api/liferay/do
--- request (1087 B application/x-java-serialized-object)
POST /api/liferay/do HTTP/1.1
sec-ch-ua: "Chromium";v="152", "Not?A_Brand";v="24", "Google Chrome";v="152"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
cache-control: max-age=0
Host: infoportal.baloise.de
X-Bug-Bounty: BBS:dwbzn
Content-Type: application/x-java-serialized-object
Content-Length: 301
<binary body 301 B; save with -o>
--- response (666 B text/html)
HTTP/1.1 303 See Other
Date: Mon, 09 Nov 2026 21:01:54 GMT
Server: Apache
Set-Cookie: AL_SESS-S=AdzmMLxUQitpsdpsh89JnAY_7He9ZjMnRUEmCvlqZpNKP6TwZvJRU5aZN0LLxIdWxOR7; Path=/; Domain=.baloise.de; Secure; HttpOnly; SameSite=Lax
Set-Cookie: CSRFT759-S=E2R3BujIqEdTW_8y9vwpPg; Path=/; Domain=.baloise.de; Secure; SameSite=Strict
Content-Length: 171
Location: /auth/ui/app/auth/application/access?Location=https%3A%2F%2Finfoportal%2Ebaloise%2Ede%2Fapi%2Fliferay%2Fdo
Content-Type: text/html

<html><body>Please follow <a href="/auth/ui/app/auth/application/access?Location=https%3A%2F%2Finfoportal%2Ebaloise%2Ede%2Fapi%2Fliferay%2Fdo">this link</a></body></html>

===== 01a1cb07-f127-7185-8461-96e7c17215a0 =====
# 01a1cb07-f127-7185-8461-96e7c17215a0  2026-11-11 14:34:16  curl/recon  status=303  1004ms
POST https://infoportal.baloise.de/api/liferay/do
--- request (756 B application/x-www-form-urlencoded)
POST /api/liferay/do HTTP/1.1
sec-ch-ua: "Chromium";v="152", "Not?A_Brand";v="24", "Google Chrome";v="152"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
cache-control: max-age=0
Host: infoportal.baloise.de
Content-Length: 0
Content-Type: application/x-www-form-urlencoded
--- response (666 B text/html)
HTTP/1.1 303 See Other
Date: Wed, 11 Nov 2026 14:34:17 GMT
Server: Apache
Set-Cookie: AL_SESS-S=AXwvejcBRVDgX_W4G4zT44Dnj!oYsWc0CHrZFQJkSkkobk4Xs9NUknz5ci4pCRfghqoe; Path=/; Domain=.baloise.de; Secure; HttpOnly; SameSite=Lax
Set-Cookie: CSRFT759-S=muZiCTFcGnlg9BD5MWwq3g; Path=/; Domain=.baloise.de; Secure; SameSite=Strict
Content-Length: 171
Location: /auth/ui/app/auth/application/access?Location=https%3A%2F%2Finfoportal%2Ebaloise%2Ede%2Fapi%2Fliferay%2Fdo
Content-Type: text/html

<html><body>Please follow <a href="/auth/ui/app/auth/application/access?Location=https%3A%2F%2Finfoportal%2Ebaloise%2Ede%2Fapi%2Fliferay%2Fdo">this link</a></body></html>

===== 01a1dad8-13d2-74a7-8409-918bec25ba08 =====
# 01a1dad8-13d2-74a7-8409-918bec25ba08  2026-11-14 16:15:56  egress.cloudfront/hunter-1  status=303  51ms  egress=cloudfront 
POST https://infoportal.baloise.de/api/liferay/do
routed_url: https://dnty51cpc9bji.cloudfront.net
--- request (759 B application/x-java-serialized-object)
POST /api/liferay/do HTTP/1.1
Host: infoportal.baloise.de
sec-ch-ua: "Not;A=Brand";v="8", "Chromium";v="150", "Google Chrome";v="150"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "macOS"
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Language: en-US,en;q=0.9
X-Bug-Bounty: dwbzn
Content-Type: application/x-java-serialized-object
Content-Length: 16
Accept-Encoding: identity
<binary body 16 B; save with -o>
--- response (832 B text/html)
HTTP/1.1 303
content-type: text/html
date: Sat, 14 Nov 2026 16:15:56 GMT
server: Apache
set-cookie: AL_SESS-S=ASSujGRvlziHgNmK4VhgacJW1jngtH_NWLqzSvEsIqwe1PBkDF84OMYJp8A0nwaIBxH_; Path=/; Domain=.baloise.de; Secure; HttpOnly; SameSite=Lax
set-cookie: CSRFT759-S=YxXknHklK!I1NwkV!B2UNQ; Path=/; Domain=.baloise.de; Secure; SameSite=Strict
location: /auth/ui/app/auth/application/access?Location=https%3A%2F%2Finfoportal%2Ebaloise%2Ede%2Fapi%2Fliferay%2Fdo
x-cache: Miss from cloudfront
via: 1.1 0e5084c3f3749abdd1195ad293d2faa2.cloudfront.net (CloudFront)
x-amz-cf-pop: CDG52-P2
x-amz-cf-id: nVGGHgLvgdWj-PrcG6Eq2G3m6SKeoGpjv23uFkJ2L9MoM_gH9FNFkg==

<html><body>Please follow <a href="/auth/ui/app/auth/application/access?Location=https%3A%2F%2Finfoportal%2Ebaloise%2Ede%2Fapi%2Fliferay%2Fdo">this link</a></body></html>

===== 01a1dadc-9533-7c0e-acb3-f2691c1c193c =====
# 01a1dadc-9533-7c0e-acb3-f2691c1c193c  2026-11-14 16:20:51  curl/hunter-1  status=303  68ms
POST https://infoportal.baloise.de/api/spring/portal
--- request (800 B application/x-java-serialized-object)
POST /api/spring/portal HTTP/1.1
sec-ch-ua: "Chromium";v="152", "Not?A_Brand";v="24", "Google Chrome";v="152"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
cache-control: max-age=0
Host: infoportal.baloise.de
X-Bug-Bounty: dwbzn
Content-Type: application/x-java-serialized-object
Content-Length: 16
<binary body 16 B; save with -o>
--- response (672 B text/html)
HTTP/1.1 303 See Other
Date: Sat, 14 Nov 2026 16:20:51 GMT
Server: Apache
Set-Cookie: AL_SESS-S=AS_ROaQSPndCRipiPgS6OmiLDRL5nvE0qPAOksmt!S2Q6caRYAF_NSmbFxUbcamoQnYr; Path=/; Domain=.baloise.de; Secure; HttpOnly; SameSite=Lax
Set-Cookie: CSRFT759-S=8xxFn1ZwzQiH1y3bB4abCQ; Path=/; Domain=.baloise.de; Secure; SameSite=Strict
Content-Length: 174
Location: /auth/ui/app/auth/application/access?Location=https%3A%2F%2Finfoportal%2Ebaloise%2Ede%2Fapi%2Fspring%2Fportal
Content-Type: text/html

<html><body>Please follow <a href="/auth/ui/app/auth/application/access?Location=https%3A%2F%2Finfoportal%2Ebaloise%2Ede%2Fapi%2Fspring%2Fportal">this link</a></body></html>

===== 01a1c40e-b476-70a3-b7e6-f8b8113dbee3 =====
# 01a1c40e-b476-70a3-b7e6-f8b8113dbee3  2026-11-10 06:04:20  curl/hunter-2  status=303  78ms
POST https://infoportal.baloise.de/c/portal/portlet_url
--- request (824 B application/x-www-form-urlencoded)
POST /c/portal/portlet_url HTTP/1.1
sec-ch-ua: "Chromium";v="152", "Not?A_Brand";v="24", "Google Chrome";v="152"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
cache-control: max-age=0
Host: infoportal.baloise.de
X-Bug-Bounty: BBS:dwbzn
Content-Type: application/x-www-form-urlencoded
Content-Length: 36

p_auth=bugbounty&parameterMap=%7B%7D
--- response (682 B text/html)
HTTP/1.1 303 See Other
Date: Tue, 10 Nov 2026 06:04:20 GMT
Server: Apache
Set-Cookie: AL_SESS-S=AV5YJubBA_mPdU7jBXPugwQEafVNoN0SmbeA1mN4le!rx74F_UJFkKfUk6!BGSn96Jsy; Path=/; Domain=.baloise.de; Secure; HttpOnly; SameSite=Lax
Set-Cookie: CSRFT759-S=!R8BDSAp9ze1bKiL88wPTQ; Path=/; Domain=.baloise.de; Secure; SameSite=Strict
Content-Length: 179
Location: /auth/ui/app/auth/application/access?Location=https%3A%2F%2Finfoportal%2Ebaloise%2Ede%2Fc%2Fportal%2Fportlet%5Furl
Content-Type: text/html

<html><body>Please follow <a href="/auth/ui/app/auth/application/access?Location=https%3A%2F%2Finfoportal%2Ebaloise%2Ede%2Fc%2Fportal%2Fportlet%5Furl">this link</a></body></html>

===== 01a1c40e-b529-74e1-9f83-06e5765bdfbd =====
# 01a1c40e-b529-74e1-9f83-06e5765bdfbd  2026-11-10 06:04:20  curl/hunter-2  status=303  80ms
POST https://infoportal.baloise.de/c/portal/portlet_url
--- request (772 B application/json)
POST /c/portal/portlet_url HTTP/1.1
sec-ch-ua: "Chromium";v="152", "Not?A_Brand";v="24", "Google Chrome";v="152"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
cache-control: max-age=0
Host: infoportal.baloise.de
X-Bug-Bounty: BBS:dwbzn
Content-Type: application/json
Content-Length: 2

{}
--- response (682 B text/html)
HTTP/1.1 303 See Other
Date: Tue, 10 Nov 2026 06:04:20 GMT
Server: Apache
Set-Cookie: AL_SESS-S=AXx24QfUuaPP4OjQQuJby5QgEYRRmUELCaaex!h5TWTjMce4wxJIztvgI38nw_RF4qo4; Path=/; Domain=.baloise.de; Secure; HttpOnly; SameSite=Lax
Set-Cookie: CSRFT759-S=lElgE827XtciBplw_aNrqQ; Path=/; Domain=.baloise.de; Secure; SameSite=Strict
Content-Length: 179
Location: /auth/ui/app/auth/application/access?Location=https%3A%2F%2Finfoportal%2Ebaloise%2Ede%2Fc%2Fportal%2Fportlet%5Furl
Content-Type: text/html

<html><body>Please follow <a href="/auth/ui/app/auth/application/access?Location=https%3A%2F%2Finfoportal%2Ebaloise%2Ede%2Fc%2Fportal%2Fportlet%5Furl">this link</a></body></html>

===== 01a1c40e-b5ab-75cb-92af-56291162648d =====
# 01a1c40e-b5ab-75cb-92af-56291162648d  2026-11-10 06:04:20  curl/hunter-2  status=303  55ms
POST https://infoportal.baloise.de/c/portal/portlet_url
--- request (808 B application/octet-stream)
POST /c/portal/portlet_url HTTP/1.1
sec-ch-ua: "Chromium";v="152", "Not?A_Brand";v="24", "Google Chrome";v="152"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
cache-control: max-age=0
Host: infoportal.baloise.de
X-Bug-Bounty: BBS:dwbzn
Content-Type: application/octet-stream
Content-Length: 29

Security-Test-bugbounty-dwbzn
--- response (682 B text/html)
HTTP/1.1 303 See Other
Date: Tue, 10 Nov 2026 06:04:20 GMT
Server: Apache
Set-Cookie: AL_SESS-S=AT7TbXmZyyWdGtwbTXhmzCdsnRKiZNrSeG3_OWmcHYu!HOd4YnpliTnMtDdLbKACbpuf; Path=/; Domain=.baloise.de; Secure; HttpOnly; SameSite=Lax
Set-Cookie: CSRFT759-S=32722mFEYq8ifhLVUqDHpA; Path=/; Domain=.baloise.de; Secure; SameSite=Strict
Content-Length: 179
Location: /auth/ui/app/auth/application/access?Location=https%3A%2F%2Finfoportal%2Ebaloise%2Ede%2Fc%2Fportal%2Fportlet%5Furl
Content-Type: text/html

<html><body>Please follow <a href="/auth/ui/app/auth/application/access?Location=https%3A%2F%2Finfoportal%2Ebaloise%2Ede%2Fc%2Fportal%2Fportlet%5Furl">this link</a></body></html>