[*] Starting server.py on port 19234
[*] Raw response headers for /double:
    HTTP/1.1 200 OK
    X-Content-Type-Options: nosniff
    X-Content-Type-Options: nosniff
    Content-Length: 230
    Connection: close
    
[*] Loading /double (TWO X-Content-Type-Options: nosniff headers) ...
[*] Loading /single (ONE X-Content-Type-Options: nosniff header) ...

===== beacon log =====
from=double ct=text/html
======================

[+] VULNERABLE: duplicated X-Content-Type-Options headers bypass nosniff.
    /double executed inline <script> (sniffed as text/html).
    /single  did NOT execute (nosniff honoured).