Public Domain Vulnerability Information, Security Articles, Vulnerability Reports, GHDB, DORK Search

XSS Home | XSS Crawler | SQLi Crawler | HTTPi Crawler | FI Crawler |

Private Reporting of Security Research is preferred for Online Service Providers

Loading

XSS, Cross Site Scripting in kattack.com, CWE-79, CAPEC-86, DORK, GHDB REPORT SUMMARY

Netsparker - Scan Report Summary
TARGET URL
 http://www.kattack.com/Home/tabid/55/ctl/Regi...
SCAN DATE
 7/18/2011 9:47:54 AM
REPORT DATE
 7/18/2011 12:59:19 PM
SCAN DURATION
 00:08:02

Total Requests

2860

Average Speed

5.93 req/sec.
8
identified
2
confirmed
0
critical
3
informational

SCAN SETTINGS

Scan Settings
PROFILE
 Previous Settings
ENABLED ENGINES
 Static Tests, Find Backup Files, Blind Command Injection, Blind SQL Injection, Boolean SQL Injection, Command Injection, HTTP Header Injection, Local File Inclusion, Open Redirection, Remote Code Evaluation, Remote File Inclusion, SQL Injection, Cross-site Scripting
Authentication
Scheduled

VULNERABILITIES

Vulnerabilities
Netsparker - Web Application Security Scanner
IMPORTANT
25 %
LOW
38 %
INFORMATION
38 %

VULNERABILITY SUMMARY

Vulnerability Summary
URL Parameter Method Vulnerability Confirmed
/Home/tabid/55/ctl/Register/Default.aspx Password Transmitted Over HTTP Yes
Auto Complete Enabled Yes
ASP.NET Version Disclosure No
ViewState is not Encrypted No
ASP.NET Identified No
E-mail Address Disclosure No
IIS Version Disclosure No
/Home/tabid/55/ctl/Register/Default.aspx/%22ns=%22alert(0x00001F) URI-BASED Raw URI Cross-site Scripting No
Cross-site Scripting

Cross-site Scripting
1 TOTAL
IMPORTANT
XSS (Cross-site Scripting) allows an attacker to execute a dynamic script (Javascript, VbScript) in the context of the application. This allows several different attack opportunities, mostly hijacking the current session of the user or changing the look of the page by changing the HTML on the fly to steal the user's credentials. This happens because the input entered by a user has been interpreted as HTML/Javascript/VbScript by the browser.

XSS targets the users of the application instead of the server. Although this is a limitation, since it allows attackers to hijack other users' session, an attacker might attack an administrator to gain full control over the application.

Impact

There are many different attacks that can be leveraged through the use of XSS, including:

Remedy

The issue occurs because the browser interprets the input as active HTML, Javascript or VbScript. To avoid this, all input and output from the application should be filtered. Output should be filtered according to the output format and location. Typically the output location is HTML. Where the output is HTML ensure that all active content is removed prior to its presentation to the server.

Prior to sanitizing user input, ensure you have a pre-defined list of both expected and acceptable characters with which you populate a white-list. This list needs only be defined once and should be used to sanitize and validate all subsequent input.

There are a number of pre-defined, well structured white-list libraries available for many different environments, good examples of these include, OWASP Reform and Microsoft Anti Cross-site Scripting libraries are good examples.

Remedy References

External References

- /Home/tabid/55/ctl/Register/Default.aspx/%22ns=%22alert(0x00001F)

/Home/tabid/55/ctl/Register/Default.aspx/%22ns=%22alert(0x00001F)

http://www.kattack.com/Home/tabid/55/ctl/Register/Default.aspx/%22ns=%22alert(0x00001F)

Parameters

Parameter Type Value
returnurl GET /LoginReg/UserLogin/tabid/125/Default.aspx
URI-BASED Raw URI /"ns="alert(0x00001F)

Request

GET /Home/tabid/55/ctl/Register/Default.aspx/%22ns=%22netsparker(0x00001F) HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: www.kattack.com
Cookie: .ASPXANONYMOUS=9j1If-t7zAEkAAAAYTc5NTAwMTYtNzI2My00ZGJkLTgyMWYtZGQ0Zjg1ZWJjMDEy0; DotNetNukeAnonymous=d87bdcd8-1f09-49d6-abd4-838119c3ee7f; language=en-US
Accept-Encoding: gzip, deflate

Response

HTTP/1.1 200 OK
Date: Mon, 18 Jul 2011 14:48:54 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Set-Cookie: DotNetNukeAnonymous=d87bdcd8-1f09-49d6-abd4-838119c3ee7f; expires=Mon, 18-Jul-2011 15:08:54 GMT; path=/; HttpOnly,language=en-US; path=/; HttpOnly
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 76672


<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<html>
<head id="Head">
<!--**********************************************************************************-->
<!-- DotNetNuke� - http://www.dotnetnuke.com -->
<!-- Copyright (c) 2002-2007 -->
<!-- by DotNetNuke Corporation -->
<!--**********************************************************************************-->
<meta id="MetaDescription" name="DESCRIPTION" content="Kattack GPS Tracking brings world class race tracking to sailboat racing. " /><meta id="MetaKeywords" name="KEYWORDS" content="Kattack, GPS, race tracking, sailing, racing,DotNetNuke,DNN" /><meta id="MetaCopyright" name="COPYRIGHT" content="Copyright 2005-2008 by Kattack, LLC" /><meta id="MetaGenerator" name="GENERATOR" content="DotNetNuke " /><meta id="MetaAuthor" name="AUTHOR" content="Kattack" /><meta name="RESOURCE-TYPE" content="DOCUMENT" /><meta name="DISTRIBUTION" content="GLOBAL" /><meta name="ROBOTS" content="INDEX, FOLLOW" /><meta name="REVISIT-AFTER" content="1 DAYS" /><meta name="RATING" content="GENERAL" /><meta http-equiv="PAGE-ENTER" content="RevealTrans(Duration=0,Transition=1)" /><style id="StylePlaceholder" type="text/css"></style><link id="_Portals__default_" rel="stylesheet" type="text/css" href="/Portals/_default/default.css" /><link id="_Portals__default_Skins_KattackSkins_" rel="stylesheet" type="text/css" href="/Portals/_default/Skins/KattackSkins/skin.css" /><link id="_Portals__default_Containers_KattackSkins_BLueTitle_css" rel="stylesheet" type="text/css" href="/Portals/_default/Containers/KattackSkins/BLueTitle.css" /><link id="_Portals_0_" rel="stylesheet" type="text/css" href="/Portals/0/portal.css" /><meta name="verify-v1" content="wOcKfc7Ekd6YqUa2VXQdxkvFeIsPAR4asIdKaz11CH0=" /><link rel="SHORTCUT ICON" href="/Portals/0/favicon.ico" /><title>
Kattack Race Analysis
</title></head>
<body id="Body" bottommargin="0" leftmargin="0" topmargin="0" rightmargin="0" marginwidth="0" marginheight="0">
<noscript></noscript>
<form name="Form" method="post" action="/Home/tabid/55/ctl/Register/Default.aspx/"ns="netsparker(0x00001F)" onsubmit="javascript:return WebForm_OnSubmit();" id="Form" enctype="multipart/form-data" style="height: 100%;">
<div>
<input type="hidden" name="__EVENTTARGET" id="__EVENTTARGET" value="" />
<input type="hidden" name="__EVENTARGUMENT" id="__EVENTARGUMENT" value="" />

</div>

<script type="text/javascript">
//<![CDATA[
var theForm = document.forms['Form'];
if (!theForm) {
theForm = document.Form;
}
function __doPostBack(eventTarget, eventArgument) {
if (!theForm.onsubmit || (theForm.onsubmit() != false)) {
theForm.__EVENTTARGET.value = eventTarget;
theForm.__EVENTARGUMENT.value = eventArgument;
theForm.submit();
}
}
//]]>
</script>


<script src="/WebResource.axd?d=mywIMMAVWemSOYB8roZ-gCPMsNgaAYOHwN66_gcUbH1ivHikRHELoRsPYJH6DGHTqO_Yt3c6dMmOSM1U0&amp;t=634439634561234820" type="text/javascript"></script>


<script src="/js/dnncore.js" type="text/javascript"></script><script src="/js/dnn.js"></script>
<!-- Solution Partner's ASP.NET Hierarchical Menu (v1.7.2.0) - http://www.solpart.com -->
<SCRIPT SRC="/controls/SolpartMenu/spmenu.js"></SCRIPT><SPAN ID="dnn_dnnSOLPARTMENU_ctldnnSOLPARTMENU_divOuterTables"></SPAN>
<script src="/ScriptResource.axd?d=IzC7Fd9fvAj4IOb7p1OJhBbzIzplaZIDZLg80_F6PsqAvRpHX7XUJATF1LbNLwuPzyhX3ahNIVEpetxahgG2DyrddoXss8Cna0mmqKbyi85Y5SFQzo_NKSz1V_Wc3Hce1A-iLKV-S8JNLvgY0&amp;t=634439634561234820" type="text/javascript"></script>
<script src="/ScriptResource.axd?d=B0SgA1tqW1TDZOPt7LsLhBbcjVkMiKVxo1nw_lcb4VvV7l_gZiD99IPpuopdrWEDU_qpLYXh8KEYsx3xHYjKI82mwaPkJ5fO8wpiQI3QEI_UU9Sspaokn9AMZ441&amp;t=633202793300000000" type="text/javascript"></script>
<script src="/ScriptResource.axd?d=xkvoPXV2O4drUy4NIb9A3sStNa4EHVqnQja-GAw169jD1dAhTnzjOv6aO516nFemzsCJlsm78LVeuENniHyrBooBCmMVlfMafat5o5IO229wZCGZ8VHDDn9YjbIqpHy7HoSrUA2&amp;t=633202793300000000" type="text/javascript"></script>
<script type="text/javascript">
//<![CDATA[
function WebForm_OnSubmit() {
if (typeof(ValidatorOnSubmit) == "function" && ValidatorOnSubmit() == false) return false;
return true;
}
//]]>
</script>



<!-- Skin Design and developed by Sachin Badhe, badhe_sachin@yshoo.co.in -->
<link href="/Portals/_default/Skins/KattackSkins/skin.css" rel="stylesheet" type="text/css">
<table width="100%" height="100%" class="BackgroundTable">
<tr>
<td align="center" valign="top">
<table class="BGTable" width="100%" cellpadding="0" cellspacing="0" border="0">
<tr>
<td align="center" class="BottomBg" valign="top">
<table class="MainTable" cellpadding="0" cellspacing="0" border="0">
<tr>
<td class="LoginPaneBG"></td>
</tr>
<tr>
<td valign="top" class="Contenttable">
<table width="100%" border="0" cellspacing="0" cellpadding="0">
<tr>
<td class="LogoPane" valign="top" width="100%"><a id="dnn_dnnLOGO_hypLogo" title="Kattack" href="http://www.kattack.com/Default.aspx?base"><img id="dnn_dnnLOGO_imgLogo" src="/Portals/0/KattackLogos/KattackLogoHoriz(233X68).png" alt="Kattack" style="border-width:0px;" /></a></td>
<td valign="top" width="1%" align="right">
<img src="/Portals/_default/Skins/KattackSkins/images/HeaderTop.gif" alt="HeaderTop" /></td>
</tr>
</table>
</td>
</tr>
<tr>
<td height="100%" valign="top" class="Contenttable">
<table height="100%" width="100%" border="0" cellspacing="0" cellpadding="0">
<tr>
<td height="100%" valign="top" width="1%" class="LeftSideMain">
<table height="100%" class="LeftSideMainBottomRight" width="168" border="0" cellspacing="0" cellpadding="0">
<tr>
<td id="dnn_TopLeftPane" valign="top" class="LeftTopPane">
</td>

</tr>
<tr>
<td height="100%" class="NavPane"><span id="dnn_dnnSOLPARTMENU_ctldnnSOLPARTMENU" name="dnn$dnnSOLPARTMENU$ctldnnSOLPARTMENU" BackColor="#333333" IconBackgroundColor="#333333" HlColor="#FF8080" ShColor="#404040" SelForeColor="White" SelColor="#CCCCCC" FontStyle="font-family: Tahoma,Arial,Helvetica; font-size: 9pt; font-weight: bold; font-style: normal; text-decoration: " SysImgPath="/images/" Display="vertical" MenuBarHeight="16" MenuItemHeight="21" IconWidth="15" MOutDelay="500" MenuTransition="None" BorderWidth="0" IconImgPath="/Portals/0/" ArrowImage="spacer.gif" CSSMenuArrow="MainMenu_MenuArrow" CSSMenuBreak="MainMenu_MenuBreak" CSSMenuContainer="MainMenu_MenuContainer" CSSMenuBar="MainMenu_MenuBar" CSSSubMenu="MainMenu_SubMenu" CSSMenuIcon="MainMenu_MenuIcon" CSSMenuItem="MainMenu_MenuItem" CSSMenuItemSel="MainMenu_MenuItemSel" CSSRootMenuArw="MainMenu_RootMenuArrow" SupportsTrans="1"><xml id="SolpartMenuDI" onreadystatechange="if (this.readyState == 'complete') spm_initMyMenu(this, spm_getById('dnn_dnnSOLPARTMENU_ctldnnSOLPARTMENU'))"><root><menuitem id="55" title="Home" url="http://www.kattack.com/Home/tabid/55/Default.aspx" selcss="MainMenu_TabMenuItemHover" css="MainMenu_TabRootMenuItem MainMenu_TabRootMenuItemSel MainMenu_TabMenuItemSelHover" /><menuitem id="160" title="Applications" url="http://www.kattack.com/Applications/tabid/160/Default.aspx" css="MainMenu_TabRootMenuItem" selcss="MainMenu_TabMenuItemHover"><menuitem id="162" title="&amp;nbsp;Club Applications" url="http://www.kattack.com/Applications/ClubApplications/tabid/162/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="163" title="&amp;nbsp;Coaching Applications" url="http://www.kattack.com/Applications/CoachingApplications/tabid/163/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="164" title="&amp;nbsp;Regatta Applications" url="http://www.kattack.com/Applications/RegattaApplications/tabid/164/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /></menuitem><menuitem id="57" title="Products" url="http://www.kattack.com/Products/tabid/57/Default.aspx" css="MainMenu_TabRootMenuItem" selcss="MainMenu_TabMenuItemHover"><menuitem id="100" title="&amp;nbsp;Kattack Race Player" url="http://www.kattack.com/Products/KattackRacePlayer/tabid/100/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="93" title="&amp;nbsp;Kattack Race Publisher" url="http://www.kattack.com/Products/KattackRacePublisher/tabid/93/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="81" title="&amp;nbsp;Downloads" url="http://www.kattack.com/Products/Downloads/tabid/81/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /></menuitem><menuitem id="262" title="Kattack LIVE" url="http://www.kattack.com/KattackLIVE/tabid/262/Default.aspx" css="MainMenu_TabRootMenuItem" selcss="MainMenu_TabMenuItemHover"><menuitem id="243" title="&amp;nbsp;About" url="http://www.kattack.com/KattackLIVE/About/tabid/243/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="266" title="&amp;nbsp;Getting Started" url="http://www.kattack.com/KattackLIVE/GettingStarted/tabid/266/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="257" title="&amp;nbsp;Setup" url="http://kws.kattack.com/kattacklivesetup" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="265" title="&amp;nbsp;Data Plan Maintenance" url="http://www.kattack.com/KattackLIVE/DataPlanMaintenance/tabid/265/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="269" title="&amp;nbsp;Phone Recovery" url="http://www.kattack.com/KattackLIVE/PhoneRecovery/tabid/269/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /></menuitem><menuitem id="260" title="SPOT Tracking" url="http://www.kattack.com/SPOTTracking/AboutSPOTandKattack/tabid/259/Default.aspx" css="MainMenu_TabRootMenuItem" selcss="MainMenu_TabMenuItemHover"><menuitem id="259" title="&amp;nbsp;About SPOT and Kattack" url="http://www.kattack.com/SPOTTracking/AboutSPOTandKattack/tabid/259/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /></menuitem><menuitem id="65" title="Support" url="http://www.kattack.com/Support/tabid/65/Default.aspx" css="MainMenu_TabRootMenuItem" selcss="MainMenu_TabMenuItemHover"><menuitem id="77" title="&amp;nbsp;FAQ" url="http://www.kattack.com/Support/FAQ/tabid/77/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="130" title="&amp;nbsp;Downloads" url="http://www.kattack.com/Products/Downloads/tabid/81/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="225" title="&amp;nbsp;Help Videos" selcss="MainMenu_SubMenuItemSelHover"><menuitem id="226" title="&amp;nbsp;Kattack Race Player" url="http://www.kattack.com/Support/HelpVideos/KattackRacePlayer/tabid/226/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="227" title="&amp;nbsp;Kattack Race Publisher" url="http://www.kattack.com/Support/HelpVideos/KattackRacePublisher/tabid/227/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="228" title="&amp;nbsp;Kattack Media Manager" url="http://www.kattack.com/Support/HelpVideos/KattackMediaManager/tabid/228/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /></menuitem><menuitem id="241" title="&amp;nbsp;Hardware Requirements" url="http://www.kattack.com/Support/HardwareRequirements/tabid/241/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="251" title="&amp;nbsp;Kattack and IPhone" url="http://www.kattack.com/Support/KattackandIPhone/tabid/251/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="268" title="&amp;nbsp;YouTube Links" url="http://www.kattack.com/Support/YouTubeLinks/tabid/268/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="271" title="&amp;nbsp;Phone Recovery" url="http://www.kattack.com/KattackLIVE/PhoneRecovery/tabid/269/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /></menuitem><menuitem id="201" title="Regattas" url="http://www.kattack.com/Regattas/RegattaList/tabid/205/Default.aspx" css="MainMenu_TabRootMenuItem" selcss="MainMenu_TabMenuItemHover"><menuitem id="205" title="&amp;nbsp;Regatta List" url="http://www.kattack.com/Regattas/RegattaList/tabid/205/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="202" title="&amp;nbsp;Regatta Details" url="http://www.kattack.com/Regattas/RegattaDetails/tabid/202/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /></menuitem><menuitem id="56" title="Company" url="http://www.kattack.com/Company/AboutUs/tabid/67/Default.aspx" css="MainMenu_TabRootMenuItem" selcss="MainMenu_TabMenuItemHover"><menuitem id="67" title="&amp;nbsp;About Us" url="http://www.kattack.com/Company/AboutUs/tabid/67/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="58" title="&amp;nbsp;Contact Us" url="http://www.kattack.com/Company/ContactUs/tabid/58/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="99" title="&amp;nbsp;Artwork" url="http://www.kattack.com/Company/Artwork/tabid/99/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="245" title="&amp;nbsp;Help Wanted" url="http://www.kattack.com/Company/HelpWanted/tabid/245/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /></menuitem></root></xml></span></td>
</tr>
<tr>

</tr>
<tr>
<td class="LoginPane">
<div class="LoginPaneDiv">
<a id="dnn_dnnUSER_cmdRegister" class="Login" href="javascript:__doPostBack('dnn$dnnUSER$cmdRegister','')">Register</a></div>
<div class="LoginPaneDiv">
<a id="dnn_dnnLOGIN_cmdLogin" class="Login" href="javascript:__doPostBack('dnn$dnnLOGIN$cmdLogin','')">Login</a></div>
</td>
</tr>
<tr>
<td class="PrivacyPane">
<div class="PrivacyPaneDiv">
<a id="dnn_dnnPRIVACY_hypPrivacy" class="Footer" href="http://www.kattack.com/Home/tabid/55/ctl/Privacy/Default.aspx">Privacy Statement</a></div>
<div class="PrivacyPaneDiv">
<a id="dnn_dnnTERMS_hypTerms" class="Footer" href="http://www.kattack.com/Home/tabid/55/ctl/Terms/Default.aspx">Terms Of Use</a></div>
</td>
</tr>
<tr>

</tr>
<tr>
<td class="C..
Password Transmitted Over HTTP

Password Transmitted Over HTTP
1 TOTAL
IMPORTANT
CONFIRMED
1
Netsparker identified that password data is sent over HTTP.

Impact

If an attacker can intercept network traffic he/she can steal users credentials.

Actions to Take

  1. See the remedy for solution.
  2. Move all of your critical forms and pages to HTTPS and do not serve them over HTTP.

Remedy

All sensitive data should be transferred over HTTPS rather than HTTP. Forms should be served over HTTPS. All aspects of the application that accept user input starting from the login process should only be served over HTTPS.
- /Home/tabid/55/ctl/Register/Default.aspx

/Home/tabid/55/ctl/Register/Default.aspx CONFIRMED

http://www.kattack.com/Home/tabid/55/ctl/Register/Default.aspx?returnurl=%2fLoginReg%2fUserLogin%2ft..

Form target action

/Home/tabid/55/ctl/Register/Default.aspx?returnurl=%2fLoginReg%2fUserLogin%2ftabid%2f125%2fDefault.aspx

Request

POST /Home/tabid/55/ctl/Register/Default.aspx?returnurl=%2fLoginReg%2fUserLogin%2ftabid%2f125%2fDefault.aspx HTTP/1.1
Referer: http://www.kattack.com/Home/tabid/55/ctl/Register/Default.aspx?returnurl=%2fLoginReg%2fUserLogin%2ftabid%2f125%2fDefault.aspx
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Content-Type: multipart/form-data; boundary=b8c31a96b274402abf949970734bd19a
Host: www.kattack.com
Cookie: .ASPXANONYMOUS=9j1If-t7zAEkAAAAYTc5NTAwMTYtNzI2My00ZGJkLTgyMWYtZGQ0Zjg1ZWJjMDEy0; DotNetNukeAnonymous=d87bdcd8-1f09-49d6-abd4-838119c3ee7f; language=en-US
Content-Length: 275
Accept-Encoding: gzip, deflate

--b8c31a96b274402abf949970734bd19a
Content-Disposition: form-data; name="__EVENTTARGET"


--b8c31a96b274402abf949970734bd19a
Content-Disposition: form-data; name="__EVENTARGUMENT"


-----------------------------7db2d61718187c--
--b8c31a96b274402abf949970734bd19a--

Response

HTTP/1.1 200 OK
Date: Mon, 18 Jul 2011 14:48:17 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Set-Cookie: DotNetNukeAnonymous=d87bdcd8-1f09-49d6-abd4-838119c3ee7f; expires=Mon, 18-Jul-2011 15:08:17 GMT; path=/; HttpOnly,language=en-US; path=/; HttpOnly
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 76931


<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<html>
<head id="Head">
<!--**********************************************************************************-->
<!-- DotNetNuke� - http://www.dotnetnuke.com -->
<!-- Copyright (c) 2002-2007 -->
<!-- by DotNetNuke Corporation -->
<!--**********************************************************************************-->
<meta id="MetaDescription" name="DESCRIPTION" content="Kattack GPS Tracking brings world class race tracking to sailboat racing. " /><meta id="MetaKeywords" name="KEYWORDS" content="Kattack, GPS, race tracking, sailing, racing,DotNetNuke,DNN" /><meta id="MetaCopyright" name="COPYRIGHT" content="Copyright 2005-2008 by Kattack, LLC" /><meta id="MetaGenerator" name="GENERATOR" content="DotNetNuke " /><meta id="MetaAuthor" name="AUTHOR" content="Kattack" /><meta name="RESOURCE-TYPE" content="DOCUMENT" /><meta name="DISTRIBUTION" content="GLOBAL" /><meta name="ROBOTS" content="INDEX, FOLLOW" /><meta name="REVISIT-AFTER" content="1 DAYS" /><meta name="RATING" content="GENERAL" /><meta http-equiv="PAGE-ENTER" content="RevealTrans(Duration=0,Transition=1)" /><style id="StylePlaceholder" type="text/css"></style><link id="_Portals__default_" rel="stylesheet" type="text/css" href="/Portals/_default/default.css" /><link id="_Portals__default_Skins_KattackSkins_" rel="stylesheet" type="text/css" href="/Portals/_default/Skins/KattackSkins/skin.css" /><link id="_Portals__default_Containers_KattackSkins_BLueTitle_css" rel="stylesheet" type="text/css" href="/Portals/_default/Containers/KattackSkins/BLueTitle.css" /><link id="_Portals_0_" rel="stylesheet" type="text/css" href="/Portals/0/portal.css" /><meta name="verify-v1" content="wOcKfc7Ekd6YqUa2VXQdxkvFeIsPAR4asIdKaz11CH0=" /><link rel="SHORTCUT ICON" href="/Portals/0/favicon.ico" /><title>
Kattack Race Analysis
</title></head>
<body id="Body" bottommargin="0" leftmargin="0" topmargin="0" rightmargin="0" marginwidth="0" marginheight="0">
<noscript></noscript>
<form name="Form" method="post" action="/Home/tabid/55/ctl/Register/Default.aspx?returnurl=%2fLoginReg%2fUserLogin%2ftabid%2f125%2fDefault.aspx" onsubmit="javascript:return WebForm_OnSubmit();" id="Form" enctype="multipart/form-data" style="height: 100%;">
<div>
<input type="hidden" name="__EVENTTARGET" id="__EVENTTARGET" value="" />
<input type="hidden" name="__EVENTARGUMENT" id="__EVENTARGUMENT" value="" />

</div>

<script type="text/javascript">
//<![CDATA[
var theForm = document.forms['Form'];
if (!theForm) {
theForm = document.Form;
}
function __doPostBack(eventTarget, eventArgument) {
if (!theForm.onsubmit || (theForm.onsubmit() != false)) {
theForm.__EVENTTARGET.value = eventTarget;
theForm.__EVENTARGUMENT.value = eventArgument;
theForm.submit();
}
}
//]]>
</script>


<script src="/WebResource.axd?d=mywIMMAVWemSOYB8roZ-gCPMsNgaAYOHwN66_gcUbH1ivHikRHELoRsPYJH6DGHTqO_Yt3c6dMmOSM1U0&amp;t=634439634561234820" type="text/javascript"></script>


<script src="/js/dnncore.js" type="text/javascript"></script><script src="/js/dnn.js"></script>
<!-- Solution Partner's ASP.NET Hierarchical Menu (v1.7.2.0) - http://www.solpart.com -->
<SCRIPT SRC="/controls/SolpartMenu/spmenu.js"></SCRIPT><SPAN ID="dnn_dnnSOLPARTMENU_ctldnnSOLPARTMENU_divOuterTables"></SPAN>
<script src="/ScriptResource.axd?d=IzC7Fd9fvAj4IOb7p1OJhBbzIzplaZIDZLg80_F6PsqAvRpHX7XUJATF1LbNLwuPzyhX3ahNIVEpetxahgG2DyrddoXss8Cna0mmqKbyi85Y5SFQzo_NKSz1V_Wc3Hce1A-iLKV-S8JNLvgY0&amp;t=634439634561234820" type="text/javascript"></script>
<script src="/ScriptResource.axd?d=B0SgA1tqW1TDZOPt7LsLhBbcjVkMiKVxo1nw_lcb4VvV7l_gZiD99IPpuopdrWEDU_qpLYXh8KEYsx3xHYjKI82mwaPkJ5fO8wpiQI3QEI_UU9Sspaokn9AMZ441&amp;t=633202793300000000" type="text/javascript"></script>
<script src="/ScriptResource.axd?d=xkvoPXV2O4drUy4NIb9A3sStNa4EHVqnQja-GAw169jD1dAhTnzjOv6aO516nFemzsCJlsm78LVeuENniHyrBooBCmMVlfMafat5o5IO229wZCGZ8VHDDn9YjbIqpHy7HoSrUA2&amp;t=633202793300000000" type="text/javascript"></script>
<script type="text/javascript">
//<![CDATA[
function WebForm_OnSubmit() {
if (typeof(ValidatorOnSubmit) == "function" && ValidatorOnSubmit() == false) return false;
return true;
}
//]]>
</script>



<!-- Skin Design and developed by Sachin Badhe, badhe_sachin@yshoo.co.in -->
<link href="/Portals/_default/Skins/KattackSkins/skin.css" rel="stylesheet" type="text/css">
<table width="100%" height="100%" class="BackgroundTable">
<tr>
<td align="center" valign="top">
<table class="BGTable" width="100%" cellpadding="0" cellspacing="0" border="0">
<tr>
<td align="center" class="BottomBg" valign="top">
<table class="MainTable" cellpadding="0" cellspacing="0" border="0">
<tr>
<td class="LoginPaneBG"></td>
</tr>
<tr>
<td valign="top" class="Contenttable">
<table width="100%" border="0" cellspacing="0" cellpadding="0">
<tr>
<td class="LogoPane" valign="top" width="100%"><a id="dnn_dnnLOGO_hypLogo" title="Kattack" href="http://www.kattack.com/Default.aspx?base"><img id="dnn_dnnLOGO_imgLogo" src="/Portals/0/KattackLogos/KattackLogoHoriz(233X68).png" alt="Kattack" style="border-width:0px;" /></a></td>
<td valign="top" width="1%" align="right">
<img src="/Portals/_default/Skins/KattackSkins/images/HeaderTop.gif" alt="HeaderTop" /></td>
</tr>
</table>
</td>
</tr>
<tr>
<td height="100%" valign="top" class="Contenttable">
<table height="100%" width="100%" border="0" cellspacing="0" cellpadding="0">
<tr>
<td height="100%" valign="top" width="1%" class="LeftSideMain">
<table height="100%" class="LeftSideMainBottomRight" width="168" border="0" cellspacing="0" cellpadding="0">
<tr>
<td id="dnn_TopLeftPane" valign="top" class="LeftTopPane">
</td>

</tr>
<tr>
<td height="100%" class="NavPane"><span id="dnn_dnnSOLPARTMENU_ctldnnSOLPARTMENU" name="dnn$dnnSOLPARTMENU$ctldnnSOLPARTMENU" BackColor="#333333" IconBackgroundColor="#333333" HlColor="#FF8080" ShColor="#404040" SelForeColor="White" SelColor="#CCCCCC" FontStyle="font-family: Tahoma,Arial,Helvetica; font-size: 9pt; font-weight: bold; font-style: normal; text-decoration: " SysImgPath="/images/" Display="vertical" MenuBarHeight="16" MenuItemHeight="21" IconWidth="15" MOutDelay="500" MenuTransition="None" BorderWidth="0" IconImgPath="/Portals/0/" ArrowImage="spacer.gif" CSSMenuArrow="MainMenu_MenuArrow" CSSMenuBreak="MainMenu_MenuBreak" CSSMenuContainer="MainMenu_MenuContainer" CSSMenuBar="MainMenu_MenuBar" CSSSubMenu="MainMenu_SubMenu" CSSMenuIcon="MainMenu_MenuIcon" CSSMenuItem="MainMenu_MenuItem" CSSMenuItemSel="MainMenu_MenuItemSel" CSSRootMenuArw="MainMenu_RootMenuArrow" SupportsTrans="1"><xml id="SolpartMenuDI" onreadystatechange="if (this.readyState == 'complete') spm_initMyMenu(this, spm_getById('dnn_dnnSOLPARTMENU_ctldnnSOLPARTMENU'))"><root><menuitem id="55" title="Home" url="http://www.kattack.com/Home/tabid/55/Default.aspx" selcss="MainMenu_TabMenuItemHover" css="MainMenu_TabRootMenuItem MainMenu_TabRootMenuItemSel MainMenu_TabMenuItemSelHover" /><menuitem id="160" title="Applications" url="http://www.kattack.com/Applications/tabid/160/Default.aspx" css="MainMenu_TabRootMenuItem" selcss="MainMenu_TabMenuItemHover"><menuitem id="162" title="&amp;nbsp;Club Applications" url="http://www.kattack.com/Applications/ClubApplications/tabid/162/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="163" title="&amp;nbsp;Coaching Applications" url="http://www.kattack.com/Applications/CoachingApplications/tabid/163/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="164" title="&amp;nbsp;Regatta Applications" url="http://www.kattack.com/Applications/RegattaApplications/tabid/164/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /></menuitem><menuitem id="57" title="Products" url="http://www.kattack.com/Products/tabid/57/Default.aspx" css="MainMenu_TabRootMenuItem" selcss="MainMenu_TabMenuItemHover"><menuitem id="100" title="&amp;nbsp;Kattack Race Player" url="http://www.kattack.com/Products/KattackRacePlayer/tabid/100/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="93" title="&amp;nbsp;Kattack Race Publisher" url="http://www.kattack.com/Products/KattackRacePublisher/tabid/93/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="81" title="&amp;nbsp;Downloads" url="http://www.kattack.com/Products/Downloads/tabid/81/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /></menuitem><menuitem id="262" title="Kattack LIVE" url="http://www.kattack.com/KattackLIVE/tabid/262/Default.aspx" css="MainMenu_TabRootMenuItem" selcss="MainMenu_TabMenuItemHover"><menuitem id="243" title="&amp;nbsp;About" url="http://www.kattack.com/KattackLIVE/About/tabid/243/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="266" title="&amp;nbsp;Getting Started" url="http://www.kattack.com/KattackLIVE/GettingStarted/tabid/266/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="257" title="&amp;nbsp;Setup" url="http://kws.kattack.com/kattacklivesetup" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="265" title="&amp;nbsp;Data Plan Maintenance" url="http://www.kattack.com/KattackLIVE/DataPlanMaintenance/tabid/265/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="269" title="&amp;nbsp;Phone Recovery" url="http://www.kattack.com/KattackLIVE/PhoneRecovery/tabid/269/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /></menuitem><menuitem id="260" title="SPOT Tracking" url="http://www.kattack.com/SPOTTracking/AboutSPOTandKattack/tabid/259/Default.aspx" css="MainMenu_TabRootMenuItem" selcss="MainMenu_TabMenuItemHover"><menuitem id="259" title="&amp;nbsp;About SPOT and Kattack" url="http://www.kattack.com/SPOTTracking/AboutSPOTandKattack/tabid/259/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /></menuitem><menuitem id="65" title="Support" url="http://www.kattack.com/Support/tabid/65/Default.aspx" css="MainMenu_TabRootMenuItem" selcss="MainMenu_TabMenuItemHover"><menuitem id="77" title="&amp;nbsp;FAQ" url="http://www.kattack.com/Support/FAQ/tabid/77/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="130" title="&amp;nbsp;Downloads" url="http://www.kattack.com/Products/Downloads/tabid/81/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="225" title="&amp;nbsp;Help Videos" selcss="MainMenu_SubMenuItemSelHover"><menuitem id="226" title="&amp;nbsp;Kattack Race Player" url="http://www.kattack.com/Support/HelpVideos/KattackRacePlayer/tabid/226/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="227" title="&amp;nbsp;Kattack Race Publisher" url="http://www.kattack.com/Support/HelpVideos/KattackRacePublisher/tabid/227/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="228" title="&amp;nbsp;Kattack Media Manager" url="http://www.kattack.com/Support/HelpVideos/KattackMediaManager/tabid/228/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /></menuitem><menuitem id="241" title="&amp;nbsp;Hardware Requirements" url="http://www.kattack.com/Support/HardwareRequirements/tabid/241/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="251" title="&amp;nbsp;Kattack and IPhone" url="http://www.kattack.com/Support/KattackandIPhone/tabid/251/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="268" title="&amp;nbsp;YouTube Links" url="http://www.kattack.com/Support/YouTubeLinks/tabid/268/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="271" title="&amp;nbsp;Phone Recovery" url="http://www.kattack.com/KattackLIVE/PhoneRecovery/tabid/269/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /></menuitem><menuitem id="201" title="Regattas" url="http://www.kattack.com/Regattas/RegattaList/tabid/205/Default.aspx" css="MainMenu_TabRootMenuItem" selcss="MainMenu_TabMenuItemHover"><menuitem id="205" title="&amp;nbsp;Regatta List" url="http://www.kattack.com/Regattas/RegattaList/tabid/205/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="202" title="&amp;nbsp;Regatta Details" url="http://www.kattack.com/Regattas/RegattaDetails/tabid/202/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /></menuitem><menuitem id="56" title="Company" url="http://www.kattack.com/Company/AboutUs/tabid/67/Default.aspx" css="MainMenu_TabRootMenuItem" selcss="MainMenu_TabMenuItemHover"><menuitem id="67" title="&amp;nbsp;About Us" url="http://www.kattack.com/Company/AboutUs/tabid/67/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="58" title="&amp;nbsp;Contact Us" url="http://www.kattack.com/Company/ContactUs/tabid/58/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="99" title="&amp;nbsp;Artwork" url="http://www.kattack.com/Company/Artwork/tabid/99/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="245" title="&amp;nbsp;Help Wanted" url="http://www.kattack.com/Company/HelpWanted/tabid/245/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /></menuitem></root></xml></span></td>
</tr>
<tr>

</tr>
<tr>
<td class="LoginPane">
<div class="LoginPaneDiv">
<a id="dnn_dnnUSER_cmdRegister" class="Login" href="javascript:__doPostBack('dnn$dnnUSER$cmdRegister','')">Register</a></div>
<div class="LoginPaneDiv">
<a id="dnn_dnnLOGIN_cmdLogin" class="Login" href="javascript:__doPostBack('dnn$dnnLOGIN$cmdLogin','')">Login</a></div>
</td>
</tr>
<tr>
<td class="PrivacyPane">
<div class="PrivacyPaneDiv">
<a id="dnn_dnnPRIVACY_hypPrivacy" class="Footer" href="http://www.kattack.com/Home/tabid/55/ctl/Privacy/Default.aspx">Privacy Statement</a></div>
<div class="PrivacyPaneDiv">
<a id="dnn_dnnTERMS_hypTerms" class="Footer" href="http://www.kattack.com/Home/tabid/55/ctl/Terms/Default.aspx">Terms Of Use</a></div>
</td>
</tr>
<tr>

</tr>
<tr>
..
Auto Complete Enabled

Auto Complete Enabled
1 TOTAL
LOW
CONFIRMED
1
"Auto Complete" was enabled in one or more of the form fields. These were either "password" fields or important fields such as "Credit Card".

Impact

Data entered in these fields will be cached by the browser. An attacker who can access the victim's browser could steal this information. This is especially important if the application is commonly used in shared computers such as cyber cafes or airport terminals.

Remedy

Add the attribute autocomplete="off" to the form tag or to individual "input" fields.

Actions to Take

  1. See the remedy for the solution.
  2. Find all instances of inputs which store private data and disable autocomplete. Fields which contain data such as "Credit Card" or "CCV" type data should not be cached. You can allow the application to cache usernames and remember passwords, however, in most cases this is not recommended.
  3. Re-scan the application after addressing the identified issues to ensure that all of the fixes have been applied properly.

Required Skills for Successful Exploitation

Dumping all data from a browser can be fairly easy and there exist a number of automated tools to undertake this. Where the attacker cannot dump the data, he/she could still browse the recently visited websites and activate the auto-complete feature to see previously entered values.

External References

- /Home/tabid/55/ctl/Register/Default.aspx

/Home/tabid/55/ctl/Register/Default.aspx CONFIRMED

http://www.kattack.com/Home/tabid/55/ctl/Register/Default.aspx?returnurl=%2fLoginReg%2fUserLogin%2ft..

Identified Field Name

dnn$ctr$ManageUsers$User$txtConfirm

Request

POST /Home/tabid/55/ctl/Register/Default.aspx?returnurl=%2fLoginReg%2fUserLogin%2ftabid%2f125%2fDefault.aspx HTTP/1.1
Referer: http://www.kattack.com/Home/tabid/55/ctl/Register/Default.aspx?returnurl=%2fLoginReg%2fUserLogin%2ftabid%2f125%2fDefault.aspx
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Content-Type: multipart/form-data; boundary=b8c31a96b274402abf949970734bd19a
Host: www.kattack.com
Cookie: .ASPXANONYMOUS=9j1If-t7zAEkAAAAYTc5NTAwMTYtNzI2My00ZGJkLTgyMWYtZGQ0Zjg1ZWJjMDEy0; DotNetNukeAnonymous=d87bdcd8-1f09-49d6-abd4-838119c3ee7f; language=en-US
Content-Length: 275
Accept-Encoding: gzip, deflate

--b8c31a96b274402abf949970734bd19a
Content-Disposition: form-data; name="__EVENTTARGET"


--b8c31a96b274402abf949970734bd19a
Content-Disposition: form-data; name="__EVENTARGUMENT"


-----------------------------7db2d61718187c--
--b8c31a96b274402abf949970734bd19a--

Response

HTTP/1.1 200 OK
Date: Mon, 18 Jul 2011 14:48:17 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Set-Cookie: DotNetNukeAnonymous=d87bdcd8-1f09-49d6-abd4-838119c3ee7f; expires=Mon, 18-Jul-2011 15:08:17 GMT; path=/; HttpOnly,language=en-US; path=/; HttpOnly
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 76931


<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<html>
<head id="Head">
<!--**********************************************************************************-->
<!-- DotNetNuke� - http://www.dotnetnuke.com -->
<!-- Copyright (c) 2002-2007 -->
<!-- by DotNetNuke Corporation -->
<!--**********************************************************************************-->
<meta id="MetaDescription" name="DESCRIPTION" content="Kattack GPS Tracking brings world class race tracking to sailboat racing. " /><meta id="MetaKeywords" name="KEYWORDS" content="Kattack, GPS, race tracking, sailing, racing,DotNetNuke,DNN" /><meta id="MetaCopyright" name="COPYRIGHT" content="Copyright 2005-2008 by Kattack, LLC" /><meta id="MetaGenerator" name="GENERATOR" content="DotNetNuke " /><meta id="MetaAuthor" name="AUTHOR" content="Kattack" /><meta name="RESOURCE-TYPE" content="DOCUMENT" /><meta name="DISTRIBUTION" content="GLOBAL" /><meta name="ROBOTS" content="INDEX, FOLLOW" /><meta name="REVISIT-AFTER" content="1 DAYS" /><meta name="RATING" content="GENERAL" /><meta http-equiv="PAGE-ENTER" content="RevealTrans(Duration=0,Transition=1)" /><style id="StylePlaceholder" type="text/css"></style><link id="_Portals__default_" rel="stylesheet" type="text/css" href="/Portals/_default/default.css" /><link id="_Portals__default_Skins_KattackSkins_" rel="stylesheet" type="text/css" href="/Portals/_default/Skins/KattackSkins/skin.css" /><link id="_Portals__default_Containers_KattackSkins_BLueTitle_css" rel="stylesheet" type="text/css" href="/Portals/_default/Containers/KattackSkins/BLueTitle.css" /><link id="_Portals_0_" rel="stylesheet" type="text/css" href="/Portals/0/portal.css" /><meta name="verify-v1" content="wOcKfc7Ekd6YqUa2VXQdxkvFeIsPAR4asIdKaz11CH0=" /><link rel="SHORTCUT ICON" href="/Portals/0/favicon.ico" /><title>
Kattack Race Analysis
</title></head>
<body id="Body" bottommargin="0" leftmargin="0" topmargin="0" rightmargin="0" marginwidth="0" marginheight="0">
<noscript></noscript>
<form name="Form" method="post" action="/Home/tabid/55/ctl/Register/Default.aspx?returnurl=%2fLoginReg%2fUserLogin%2ftabid%2f125%2fDefault.aspx" onsubmit="javascript:return WebForm_OnSubmit();" id="Form" enctype="multipart/form-data" style="height: 100%;">
<div>
<input type="hidden" name="__EVENTTARGET" id="__EVENTTARGET" value="" />
<input type="hidden" name="__EVENTARGUMENT" id="__EVENTARGUMENT" value="" />

</div>

<script type="text/javascript">
//<![CDATA[
var theForm = document.forms['Form'];
if (!theForm) {
theForm = document.Form;
}
function __doPostBack(eventTarget, eventArgument) {
if (!theForm.onsubmit || (theForm.onsubmit() != false)) {
theForm.__EVENTTARGET.value = eventTarget;
theForm.__EVENTARGUMENT.value = eventArgument;
theForm.submit();
}
}
//]]>
</script>


<script src="/WebResource.axd?d=mywIMMAVWemSOYB8roZ-gCPMsNgaAYOHwN66_gcUbH1ivHikRHELoRsPYJH6DGHTqO_Yt3c6dMmOSM1U0&amp;t=634439634561234820" type="text/javascript"></script>


<script src="/js/dnncore.js" type="text/javascript"></script><script src="/js/dnn.js"></script>
<!-- Solution Partner's ASP.NET Hierarchical Menu (v1.7.2.0) - http://www.solpart.com -->
<SCRIPT SRC="/controls/SolpartMenu/spmenu.js"></SCRIPT><SPAN ID="dnn_dnnSOLPARTMENU_ctldnnSOLPARTMENU_divOuterTables"></SPAN>
<script src="/ScriptResource.axd?d=IzC7Fd9fvAj4IOb7p1OJhBbzIzplaZIDZLg80_F6PsqAvRpHX7XUJATF1LbNLwuPzyhX3ahNIVEpetxahgG2DyrddoXss8Cna0mmqKbyi85Y5SFQzo_NKSz1V_Wc3Hce1A-iLKV-S8JNLvgY0&amp;t=634439634561234820" type="text/javascript"></script>
<script src="/ScriptResource.axd?d=B0SgA1tqW1TDZOPt7LsLhBbcjVkMiKVxo1nw_lcb4VvV7l_gZiD99IPpuopdrWEDU_qpLYXh8KEYsx3xHYjKI82mwaPkJ5fO8wpiQI3QEI_UU9Sspaokn9AMZ441&amp;t=633202793300000000" type="text/javascript"></script>
<script src="/ScriptResource.axd?d=xkvoPXV2O4drUy4NIb9A3sStNa4EHVqnQja-GAw169jD1dAhTnzjOv6aO516nFemzsCJlsm78LVeuENniHyrBooBCmMVlfMafat5o5IO229wZCGZ8VHDDn9YjbIqpHy7HoSrUA2&amp;t=633202793300000000" type="text/javascript"></script>
<script type="text/javascript">
//<![CDATA[
function WebForm_OnSubmit() {
if (typeof(ValidatorOnSubmit) == "function" && ValidatorOnSubmit() == false) return false;
return true;
}
//]]>
</script>



<!-- Skin Design and developed by Sachin Badhe, badhe_sachin@yshoo.co.in -->
<link href="/Portals/_default/Skins/KattackSkins/skin.css" rel="stylesheet" type="text/css">
<table width="100%" height="100%" class="BackgroundTable">
<tr>
<td align="center" valign="top">
<table class="BGTable" width="100%" cellpadding="0" cellspacing="0" border="0">
<tr>
<td align="center" class="BottomBg" valign="top">
<table class="MainTable" cellpadding="0" cellspacing="0" border="0">
<tr>
<td class="LoginPaneBG"></td>
</tr>
<tr>
<td valign="top" class="Contenttable">
<table width="100%" border="0" cellspacing="0" cellpadding="0">
<tr>
<td class="LogoPane" valign="top" width="100%"><a id="dnn_dnnLOGO_hypLogo" title="Kattack" href="http://www.kattack.com/Default.aspx?base"><img id="dnn_dnnLOGO_imgLogo" src="/Portals/0/KattackLogos/KattackLogoHoriz(233X68).png" alt="Kattack" style="border-width:0px;" /></a></td>
<td valign="top" width="1%" align="right">
<img src="/Portals/_default/Skins/KattackSkins/images/HeaderTop.gif" alt="HeaderTop" /></td>
</tr>
</table>
</td>
</tr>
<tr>
<td height="100%" valign="top" class="Contenttable">
<table height="100%" width="100%" border="0" cellspacing="0" cellpadding="0">
<tr>
<td height="100%" valign="top" width="1%" class="LeftSideMain">
<table height="100%" class="LeftSideMainBottomRight" width="168" border="0" cellspacing="0" cellpadding="0">
<tr>
<td id="dnn_TopLeftPane" valign="top" class="LeftTopPane">
</td>

</tr>
<tr>
<td height="100%" class="NavPane"><span id="dnn_dnnSOLPARTMENU_ctldnnSOLPARTMENU" name="dnn$dnnSOLPARTMENU$ctldnnSOLPARTMENU" BackColor="#333333" IconBackgroundColor="#333333" HlColor="#FF8080" ShColor="#404040" SelForeColor="White" SelColor="#CCCCCC" FontStyle="font-family: Tahoma,Arial,Helvetica; font-size: 9pt; font-weight: bold; font-style: normal; text-decoration: " SysImgPath="/images/" Display="vertical" MenuBarHeight="16" MenuItemHeight="21" IconWidth="15" MOutDelay="500" MenuTransition="None" BorderWidth="0" IconImgPath="/Portals/0/" ArrowImage="spacer.gif" CSSMenuArrow="MainMenu_MenuArrow" CSSMenuBreak="MainMenu_MenuBreak" CSSMenuContainer="MainMenu_MenuContainer" CSSMenuBar="MainMenu_MenuBar" CSSSubMenu="MainMenu_SubMenu" CSSMenuIcon="MainMenu_MenuIcon" CSSMenuItem="MainMenu_MenuItem" CSSMenuItemSel="MainMenu_MenuItemSel" CSSRootMenuArw="MainMenu_RootMenuArrow" SupportsTrans="1"><xml id="SolpartMenuDI" onreadystatechange="if (this.readyState == 'complete') spm_initMyMenu(this, spm_getById('dnn_dnnSOLPARTMENU_ctldnnSOLPARTMENU'))"><root><menuitem id="55" title="Home" url="http://www.kattack.com/Home/tabid/55/Default.aspx" selcss="MainMenu_TabMenuItemHover" css="MainMenu_TabRootMenuItem MainMenu_TabRootMenuItemSel MainMenu_TabMenuItemSelHover" /><menuitem id="160" title="Applications" url="http://www.kattack.com/Applications/tabid/160/Default.aspx" css="MainMenu_TabRootMenuItem" selcss="MainMenu_TabMenuItemHover"><menuitem id="162" title="&amp;nbsp;Club Applications" url="http://www.kattack.com/Applications/ClubApplications/tabid/162/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="163" title="&amp;nbsp;Coaching Applications" url="http://www.kattack.com/Applications/CoachingApplications/tabid/163/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="164" title="&amp;nbsp;Regatta Applications" url="http://www.kattack.com/Applications/RegattaApplications/tabid/164/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /></menuitem><menuitem id="57" title="Products" url="http://www.kattack.com/Products/tabid/57/Default.aspx" css="MainMenu_TabRootMenuItem" selcss="MainMenu_TabMenuItemHover"><menuitem id="100" title="&amp;nbsp;Kattack Race Player" url="http://www.kattack.com/Products/KattackRacePlayer/tabid/100/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="93" title="&amp;nbsp;Kattack Race Publisher" url="http://www.kattack.com/Products/KattackRacePublisher/tabid/93/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="81" title="&amp;nbsp;Downloads" url="http://www.kattack.com/Products/Downloads/tabid/81/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /></menuitem><menuitem id="262" title="Kattack LIVE" url="http://www.kattack.com/KattackLIVE/tabid/262/Default.aspx" css="MainMenu_TabRootMenuItem" selcss="MainMenu_TabMenuItemHover"><menuitem id="243" title="&amp;nbsp;About" url="http://www.kattack.com/KattackLIVE/About/tabid/243/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="266" title="&amp;nbsp;Getting Started" url="http://www.kattack.com/KattackLIVE/GettingStarted/tabid/266/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="257" title="&amp;nbsp;Setup" url="http://kws.kattack.com/kattacklivesetup" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="265" title="&amp;nbsp;Data Plan Maintenance" url="http://www.kattack.com/KattackLIVE/DataPlanMaintenance/tabid/265/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="269" title="&amp;nbsp;Phone Recovery" url="http://www.kattack.com/KattackLIVE/PhoneRecovery/tabid/269/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /></menuitem><menuitem id="260" title="SPOT Tracking" url="http://www.kattack.com/SPOTTracking/AboutSPOTandKattack/tabid/259/Default.aspx" css="MainMenu_TabRootMenuItem" selcss="MainMenu_TabMenuItemHover"><menuitem id="259" title="&amp;nbsp;About SPOT and Kattack" url="http://www.kattack.com/SPOTTracking/AboutSPOTandKattack/tabid/259/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /></menuitem><menuitem id="65" title="Support" url="http://www.kattack.com/Support/tabid/65/Default.aspx" css="MainMenu_TabRootMenuItem" selcss="MainMenu_TabMenuItemHover"><menuitem id="77" title="&amp;nbsp;FAQ" url="http://www.kattack.com/Support/FAQ/tabid/77/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="130" title="&amp;nbsp;Downloads" url="http://www.kattack.com/Products/Downloads/tabid/81/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="225" title="&amp;nbsp;Help Videos" selcss="MainMenu_SubMenuItemSelHover"><menuitem id="226" title="&amp;nbsp;Kattack Race Player" url="http://www.kattack.com/Support/HelpVideos/KattackRacePlayer/tabid/226/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="227" title="&amp;nbsp;Kattack Race Publisher" url="http://www.kattack.com/Support/HelpVideos/KattackRacePublisher/tabid/227/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="228" title="&amp;nbsp;Kattack Media Manager" url="http://www.kattack.com/Support/HelpVideos/KattackMediaManager/tabid/228/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /></menuitem><menuitem id="241" title="&amp;nbsp;Hardware Requirements" url="http://www.kattack.com/Support/HardwareRequirements/tabid/241/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="251" title="&amp;nbsp;Kattack and IPhone" url="http://www.kattack.com/Support/KattackandIPhone/tabid/251/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="268" title="&amp;nbsp;YouTube Links" url="http://www.kattack.com/Support/YouTubeLinks/tabid/268/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="271" title="&amp;nbsp;Phone Recovery" url="http://www.kattack.com/KattackLIVE/PhoneRecovery/tabid/269/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /></menuitem><menuitem id="201" title="Regattas" url="http://www.kattack.com/Regattas/RegattaList/tabid/205/Default.aspx" css="MainMenu_TabRootMenuItem" selcss="MainMenu_TabMenuItemHover"><menuitem id="205" title="&amp;nbsp;Regatta List" url="http://www.kattack.com/Regattas/RegattaList/tabid/205/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="202" title="&amp;nbsp;Regatta Details" url="http://www.kattack.com/Regattas/RegattaDetails/tabid/202/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /></menuitem><menuitem id="56" title="Company" url="http://www.kattack.com/Company/AboutUs/tabid/67/Default.aspx" css="MainMenu_TabRootMenuItem" selcss="MainMenu_TabMenuItemHover"><menuitem id="67" title="&amp;nbsp;About Us" url="http://www.kattack.com/Company/AboutUs/tabid/67/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="58" title="&amp;nbsp;Contact Us" url="http://www.kattack.com/Company/ContactUs/tabid/58/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="99" title="&amp;nbsp;Artwork" url="http://www.kattack.com/Company/Artwork/tabid/99/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="245" title="&amp;nbsp;Help Wanted" url="http://www.kattack.com/Company/HelpWanted/tabid/245/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /></menuitem></root></xml></span></td>
</tr>
<tr>

</tr>
<tr>
<td class="LoginPane">
<div class="LoginPaneDiv">
<a id="dnn_dnnUSER_cmdRegister" class="Login" href="javascript:__doPostBack('dnn$dnnUSER$cmdRegister','')">Register</a></div>
<div class="LoginPaneDiv">
<a id="dnn_dnnLOGIN_cmdLogin" class="Login" href="javascript:__doPostBack('dnn$dnnLOGIN$cmdLogin','')">Login</a></div>
</td>
</tr>
<tr>
<td class="PrivacyPane">
<div class="PrivacyPaneDiv">
<a id="dnn_dnnPRIVACY_hypPrivacy" class="Footer" href="http://www.kattack.com/Home/tabid/55/ctl/Privacy/Default.aspx">Privacy Statement</a></div>
<div class="PrivacyPaneDiv">
<a id="dnn_dnnTERMS_hypTerms" class="Footer" href="http://www.kattack.com/Home/tabid/55/ctl/Terms/Default.aspx">Terms Of Use</a></div>
</td>
</tr>
<tr>

</tr>
<tr>
..
ASP.NET Version Disclosure

ASP.NET Version Disclosure
1 TOTAL
LOW
Netsparker identified that the target web server is disclosing ASP.NET version in the HTTP response. This information can help an attacker to develop further attacks and also the system can become an easier target for automated attacks. It was leaked from X-AspNet-Version banner of HTTP response or default ASP.NET error page.

Impact

An attacker can use disclosed information to harvest specific security vulnerabilities for the version identified. The attacker can also use this information in conjunction with the other vulnerabilities in the application or web server.

Remedy

Apply the following changes on your web.config file to prevent information leakage by using custom error pages and removing X-AspNet-Version from HTTP responses. 
<System.Web>
     < httpRuntime enableVersionHeader="false" /> 
     <customErrors mode="On" defaultRedirect="~/error/GeneralError.aspx">
          <error statusCode="403" redirect="~/error/Forbidden.aspx" />
          <error statusCode="404" redirect="~/error/PageNotFound.aspx" />
          <error statusCode="500" redirect="~/error/InternalError.aspx" />
     </customErrors>
</System.Web>

Remedy References

- /Home/tabid/55/ctl/Register/Default.aspx

/Home/tabid/55/ctl/Register/Default.aspx

http://www.kattack.com/Home/tabid/55/ctl/Register/Default.aspx?returnurl=%2fLoginReg%2fUserLogin%2ft..

Extracted Version

2.0.50727

Request

GET /Home/tabid/55/ctl/Register/Default.aspx?returnurl=%2fLoginReg%2fUserLogin%2ftabid%2f125%2fDefault.aspx HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: www.kattack.com
Accept-Encoding: gzip, deflate
Connection: Keep-Alive

Response

HTTP/1.1 200 OK
Date: Mon, 18 Jul 2011 14:47:47 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Set-Cookie: .ASPXANONYMOUS=9j1If-t7zAEkAAAANzZlYjlmNjEtNzgxMS00MWFiLWIzZTktNTIyZmVjZWQ5ZGRk0; expires=Mon, 26-Sep-2011 01:27:46 GMT; path=/; HttpOnly,DotNetNukeAnonymous=3feb1bf9-f16b-4dc0-b578-9b6c4f49455f; expires=Mon, 18-Jul-2011 15:07:46 GMT; path=/; HttpOnly,language=en-US; path=/; HttpOnly
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 76709


<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<html>
<head id="Head">
<!--**********************************************************************************-->
<!-- DotNetNuke� - http://www.dotnetnuke.com -->
<!-- Copyright (c) 2002-2007 -->
<!-- by DotNetNuke Corporation -->
<!--**********************************************************************************-->
<meta id="MetaDescription" name="DESCRIPTION" content="Kattack GPS Tracking brings world class race tracking to sailboat racing. " /><meta id="MetaKeywords" name="KEYWORDS" content="Kattack, GPS, race tracking, sailing, racing,DotNetNuke,DNN" /><meta id="MetaCopyright" name="COPYRIGHT" content="Copyright 2005-2008 by Kattack, LLC" /><meta id="MetaGenerator" name="GENERATOR" content="DotNetNuke " /><meta id="MetaAuthor" name="AUTHOR" content="Kattack" /><meta name="RESOURCE-TYPE" content="DOCUMENT" /><meta name="DISTRIBUTION" content="GLOBAL" /><meta name="ROBOTS" content="INDEX, FOLLOW" /><meta name="REVISIT-AFTER" content="1 DAYS" /><meta name="RATING" content="GENERAL" /><meta http-equiv="PAGE-ENTER" content="RevealTrans(Duration=0,Transition=1)" /><style id="StylePlaceholder" type="text/css"></style><link id="_Portals__default_" rel="stylesheet" type="text/css" href="/Portals/_default/default.css" /><link id="_Portals__default_Skins_KattackSkins_" rel="stylesheet" type="text/css" href="/Portals/_default/Skins/KattackSkins/skin.css" /><link id="_Portals__default_Containers_KattackSkins_BLueTitle_css" rel="stylesheet" type="text/css" href="/Portals/_default/Containers/KattackSkins/BLueTitle.css" /><link id="_Portals_0_" rel="stylesheet" type="text/css" href="/Portals/0/portal.css" /><meta name="verify-v1" content="wOcKfc7Ekd6YqUa2VXQdxkvFeIsPAR4asIdKaz11CH0=" /><link rel="SHORTCUT ICON" href="/Portals/0/favicon.ico" /><title>
Kattack Race Analysis
</title></head>
<body id="Body" bottommargin="0" leftmargin="0" topmargin="0" rightmargin="0" marginwidth="0" marginheight="0">
<noscript></noscript>
<form name="Form" method="post" action="/Home/tabid/55/ctl/Register/Default.aspx?returnurl=%2fLoginReg%2fUserLogin%2ftabid%2f125%2fDefault.aspx" onsubmit="javascript:return WebForm_OnSubmit();" id="Form" enctype="multipart/form-data" style="height: 100%;">
<div>
<input type="hidden" name="__EVENTTARGET" id="__EVENTTARGET" value="" />
<input type="hidden" name="__EVENTARGUMENT" id="__EVENTARGUMENT" value="" />

</div>

<script type="text/javascript">
//<![CDATA[
var theForm = document.forms['Form'];
if (!theForm) {
theForm = document.Form;
}
function __doPostBack(eventTarget, eventArgument) {
if (!theForm.onsubmit || (theForm.onsubmit() != false)) {
theForm.__EVENTTARGET.value = eventTarget;
theForm.__EVENTARGUMENT.value = eventArgument;
theForm.submit();
}
}
//]]>
</script>


<script src="/WebResource.axd?d=mywIMMAVWemSOYB8roZ-gCPMsNgaAYOHwN66_gcUbH1ivHikRHELoRsPYJH6DGHTqO_Yt3c6dMmOSM1U0&amp;t=634439634561234820" type="text/javascript"></script>


<script src="/js/dnncore.js" type="text/javascript"></script><script src="/js/dnn.js"></script>
<!-- Solution Partner's ASP.NET Hierarchical Menu (v1.7.2.0) - http://www.solpart.com -->
<SCRIPT SRC="/controls/SolpartMenu/spmenu.js"></SCRIPT><SPAN ID="dnn_dnnSOLPARTMENU_ctldnnSOLPARTMENU_divOuterTables"></SPAN>
<script src="/ScriptResource.axd?d=IzC7Fd9fvAj4IOb7p1OJhBbzIzplaZIDZLg80_F6PsqAvRpHX7XUJATF1LbNLwuPzyhX3ahNIVEpetxahgG2DyrddoXss8Cna0mmqKbyi85Y5SFQzo_NKSz1V_Wc3Hce1A-iLKV-S8JNLvgY0&amp;t=634439634561234820" type="text/javascript"></script>
<script src="/ScriptResource.axd?d=B0SgA1tqW1TDZOPt7LsLhBbcjVkMiKVxo1nw_lcb4VvV7l_gZiD99IPpuopdrWEDU_qpLYXh8KEYsx3xHYjKI82mwaPkJ5fO8wpiQI3QEI_UU9Sspaokn9AMZ441&amp;t=633202793300000000" type="text/javascript"></script>
<script src="/ScriptResource.axd?d=xkvoPXV2O4drUy4NIb9A3sStNa4EHVqnQja-GAw169jD1dAhTnzjOv6aO516nFemzsCJlsm78LVeuENniHyrBooBCmMVlfMafat5o5IO229wZCGZ8VHDDn9YjbIqpHy7HoSrUA2&amp;t=633202793300000000" type="text/javascript"></script>
<script type="text/javascript">
//<![CDATA[
function WebForm_OnSubmit() {
if (typeof(ValidatorOnSubmit) == "function" && ValidatorOnSubmit() == false) return false;
return true;
}
//]]>
</script>



<!-- Skin Design and developed by Sachin Badhe, badhe_sachin@yshoo.co.in -->
<link href="/Portals/_default/Skins/KattackSkins/skin.css" rel="stylesheet" type="text/css">
<table width="100%" height="100%" class="BackgroundTable">
<tr>
<td align="center" valign="top">
<table class="BGTable" width="100%" cellpadding="0" cellspacing="0" border="0">
<tr>
<td align="center" class="BottomBg" valign="top">
<table class="MainTable" cellpadding="0" cellspacing="0" border="0">
<tr>
<td class="LoginPaneBG"></td>
</tr>
<tr>
<td valign="top" class="Contenttable">
<table width="100%" border="0" cellspacing="0" cellpadding="0">
<tr>
<td class="LogoPane" valign="top" width="100%"><a id="dnn_dnnLOGO_hypLogo" title="Kattack" href="http://www.kattack.com/Default.aspx?base"><img id="dnn_dnnLOGO_imgLogo" src="/Portals/0/KattackLogos/KattackLogoHoriz(233X68).png" alt="Kattack" style="border-width:0px;" /></a></td>
<td valign="top" width="1%" align="right">
<img src="/Portals/_default/Skins/KattackSkins/images/HeaderTop.gif" alt="HeaderTop" /></td>
</tr>
</table>
</td>
</tr>
<tr>
<td height="100%" valign="top" class="Contenttable">
<table height="100%" width="100%" border="0" cellspacing="0" cellpadding="0">
<tr>
<td height="100%" valign="top" width="1%" class="LeftSideMain">
<table height="100%" class="LeftSideMainBottomRight" width="168" border="0" cellspacing="0" cellpadding="0">
<tr>
<td id="dnn_TopLeftPane" valign="top" class="LeftTopPane">
</td>

</tr>
<tr>
<td height="100%" class="NavPane"><span id="dnn_dnnSOLPARTMENU_ctldnnSOLPARTMENU" name="dnn$dnnSOLPARTMENU$ctldnnSOLPARTMENU" BackColor="#333333" IconBackgroundColor="#333333" HlColor="#FF8080" ShColor="#404040" SelForeColor="White" SelColor="#CCCCCC" FontStyle="font-family: Tahoma,Arial,Helvetica; font-size: 9pt; font-weight: bold; font-style: normal; text-decoration: " SysImgPath="/images/" Display="vertical" MenuBarHeight="16" MenuItemHeight="21" IconWidth="15" MOutDelay="500" MenuTransition="None" BorderWidth="0" IconImgPath="/Portals/0/" ArrowImage="spacer.gif" CSSMenuArrow="MainMenu_MenuArrow" CSSMenuBreak="MainMenu_MenuBreak" CSSMenuContainer="MainMenu_MenuContainer" CSSMenuBar="MainMenu_MenuBar" CSSSubMenu="MainMenu_SubMenu" CSSMenuIcon="MainMenu_MenuIcon" CSSMenuItem="MainMenu_MenuItem" CSSMenuItemSel="MainMenu_MenuItemSel" CSSRootMenuArw="MainMenu_RootMenuArrow" SupportsTrans="1"><xml id="SolpartMenuDI" onreadystatechange="if (this.readyState == 'complete') spm_initMyMenu(this, spm_getById('dnn_dnnSOLPARTMENU_ctldnnSOLPARTMENU'))"><root><menuitem id="55" title="Home" url="http://www.kattack.com/Home/tabid/55/Default.aspx" selcss="MainMenu_TabMenuItemHover" css="MainMenu_TabRootMenuItem MainMenu_TabRootMenuItemSel MainMenu_TabMenuItemSelHover" /><menuitem id="160" title="Applications" url="http://www.kattack.com/Applications/tabid/160/Default.aspx" css="MainMenu_TabRootMenuItem" selcss="MainMenu_TabMenuItemHover"><menuitem id="162" title="&amp;nbsp;Club Applications" url="http://www.kattack.com/Applications/ClubApplications/tabid/162/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="163" title="&amp;nbsp;Coaching Applications" url="http://www.kattack.com/Applications/CoachingApplications/tabid/163/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="164" title="&amp;nbsp;Regatta Applications" url="http://www.kattack.com/Applications/RegattaApplications/tabid/164/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /></menuitem><menuitem id="57" title="Products" url="http://www.kattack.com/Products/tabid/57/Default.aspx" css="MainMenu_TabRootMenuItem" selcss="MainMenu_TabMenuItemHover"><menuitem id="100" title="&amp;nbsp;Kattack Race Player" url="http://www.kattack.com/Products/KattackRacePlayer/tabid/100/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="93" title="&amp;nbsp;Kattack Race Publisher" url="http://www.kattack.com/Products/KattackRacePublisher/tabid/93/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="81" title="&amp;nbsp;Downloads" url="http://www.kattack.com/Products/Downloads/tabid/81/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /></menuitem><menuitem id="262" title="Kattack LIVE" url="http://www.kattack.com/KattackLIVE/tabid/262/Default.aspx" css="MainMenu_TabRootMenuItem" selcss="MainMenu_TabMenuItemHover"><menuitem id="243" title="&amp;nbsp;About" url="http://www.kattack.com/KattackLIVE/About/tabid/243/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="266" title="&amp;nbsp;Getting Started" url="http://www.kattack.com/KattackLIVE/GettingStarted/tabid/266/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="257" title="&amp;nbsp;Setup" url="http://kws.kattack.com/kattacklivesetup" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="265" title="&amp;nbsp;Data Plan Maintenance" url="http://www.kattack.com/KattackLIVE/DataPlanMaintenance/tabid/265/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="269" title="&amp;nbsp;Phone Recovery" url="http://www.kattack.com/KattackLIVE/PhoneRecovery/tabid/269/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /></menuitem><menuitem id="260" title="SPOT Tracking" url="http://www.kattack.com/SPOTTracking/AboutSPOTandKattack/tabid/259/Default.aspx" css="MainMenu_TabRootMenuItem" selcss="MainMenu_TabMenuItemHover"><menuitem id="259" title="&amp;nbsp;About SPOT and Kattack" url="http://www.kattack.com/SPOTTracking/AboutSPOTandKattack/tabid/259/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /></menuitem><menuitem id="65" title="Support" url="http://www.kattack.com/Support/tabid/65/Default.aspx" css="MainMenu_TabRootMenuItem" selcss="MainMenu_TabMenuItemHover"><menuitem id="77" title="&amp;nbsp;FAQ" url="http://www.kattack.com/Support/FAQ/tabid/77/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="130" title="&amp;nbsp;Downloads" url="http://www.kattack.com/Products/Downloads/tabid/81/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="225" title="&amp;nbsp;Help Videos" selcss="MainMenu_SubMenuItemSelHover"><menuitem id="226" title="&amp;nbsp;Kattack Race Player" url="http://www.kattack.com/Support/HelpVideos/KattackRacePlayer/tabid/226/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="227" title="&amp;nbsp;Kattack Race Publisher" url="http://www.kattack.com/Support/HelpVideos/KattackRacePublisher/tabid/227/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="228" title="&amp;nbsp;Kattack Media Manager" url="http://www.kattack.com/Support/HelpVideos/KattackMediaManager/tabid/228/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /></menuitem><menuitem id="241" title="&amp;nbsp;Hardware Requirements" url="http://www.kattack.com/Support/HardwareRequirements/tabid/241/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="251" title="&amp;nbsp;Kattack and IPhone" url="http://www.kattack.com/Support/KattackandIPhone/tabid/251/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="268" title="&amp;nbsp;YouTube Links" url="http://www.kattack.com/Support/YouTubeLinks/tabid/268/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="271" title="&amp;nbsp;Phone Recovery" url="http://www.kattack.com/KattackLIVE/PhoneRecovery/tabid/269/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /></menuitem><menuitem id="201" title="Regattas" url="http://www.kattack.com/Regattas/RegattaList/tabid/205/Default.aspx" css="MainMenu_TabRootMenuItem" selcss="MainMenu_TabMenuItemHover"><menuitem id="205" title="&amp;nbsp;Regatta List" url="http://www.kattack.com/Regattas/RegattaList/tabid/205/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="202" title="&amp;nbsp;Regatta Details" url="http://www.kattack.com/Regattas/RegattaDetails/tabid/202/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /></menuitem><menuitem id="56" title="Company" url="http://www.kattack.com/Company/AboutUs/tabid/67/Default.aspx" css="MainMenu_TabRootMenuItem" selcss="MainMenu_TabMenuItemHover"><menuitem id="67" title="&amp;nbsp;About Us" url="http://www.kattack.com/Company/AboutUs/tabid/67/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="58" title="&amp;nbsp;Contact Us" url="http://www.kattack.com/Company/ContactUs/tabid/58/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="99" title="&amp;nbsp;Artwork" url="http://www.kattack.com/Company/Artwork/tabid/99/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="245" title="&amp;nbsp;Help Wanted" url="http://www.kattack.com/Company/HelpWanted/tabid/245/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /></menuitem></root></xml></span></td>
</tr>
<tr>

</tr>
<tr>
<td class="LoginPane">
<div class="LoginPaneDiv">
<a id="dnn_dnnUSER_cmdRegister" class="Login" href="javascript:__doPostBack('dnn$dnnUSER$cmdRegister','')">Register</a></div>
<div class="LoginPaneDiv">
<a id="dnn_dnnLOGIN_cmdLogin" class="Login" href="javascript:__doPostBack('dnn$dnnLOGIN$cmdLogin','')">Login</a></div>
</td>
</tr>
<tr>
<td class="PrivacyPane">
<div class="PrivacyPaneDiv">
<a id="dnn_dnnPRIVACY_hypPrivacy" class="Footer" href="http://www.kattack.com/Home/tabid/55/ctl/Privacy/Default.aspx">Privacy Statement</a></div>
<div class="PrivacyPaneDiv">
<a id="dnn_dnnTERMS_hypTerms" class="Footer" href="http://www.kattack.com/Home/tabid/55/ctl/Terms/Default.aspx">Terms Of Use</a></div>
..
ViewState is not Encrypted

ViewState is not Encrypted
1 TOTAL
LOW
Netsparker identified that the target web application doesn't use encryption on ViewState data.

Impact

An attacker can study the application's state management logic for possible vulnerabilities and if your application stores application-critical information in the ViewState; it will also be revealed.

Remedy

ASP.NET provides encryption for ViewState parameters.

For page based protection, place the following directive at the top of affected page. 
<%@Page ViewStateEncryptionMode="Always" %>
You can also set this option for the whole application by using web.config files. Apply the following configuration for your application's web.config file. 
<System.Web>
	<pages viewStateEncryptionMode="Always"> 
</System.Web>

Remedy References

- /Home/tabid/55/ctl/Register/Default.aspx

/Home/tabid/55/ctl/Register/Default.aspx

http://www.kattack.com/Home/tabid/55/ctl/Register/Default.aspx?returnurl=%2fLoginReg%2fUserLogin%2ft..

ViewState Version

.NET Framework 2.x

Request

GET /Home/tabid/55/ctl/Register/Default.aspx?returnurl=%2fLoginReg%2fUserLogin%2ftabid%2f125%2fDefault.aspx HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: www.kattack.com
Accept-Encoding: gzip, deflate
Connection: Keep-Alive

Response

HTTP/1.1 200 OK
Date: Mon, 18 Jul 2011 14:47:47 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Set-Cookie: .ASPXANONYMOUS=9j1If-t7zAEkAAAANzZlYjlmNjEtNzgxMS00MWFiLWIzZTktNTIyZmVjZWQ5ZGRk0; expires=Mon, 26-Sep-2011 01:27:46 GMT; path=/; HttpOnly,DotNetNukeAnonymous=3feb1bf9-f16b-4dc0-b578-9b6c4f49455f; expires=Mon, 18-Jul-2011 15:07:46 GMT; path=/; HttpOnly,language=en-US; path=/; HttpOnly
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 76709


<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<html>
<head id="Head">
<!--**********************************************************************************-->
<!-- DotNetNuke� - http://www.dotnetnuke.com -->
<!-- Copyright (c) 2002-2007 -->
<!-- by DotNetNuke Corporation -->
<!--**********************************************************************************-->
<meta id="MetaDescription" name="DESCRIPTION" content="Kattack GPS Tracking brings world class race tracking to sailboat racing. " /><meta id="MetaKeywords" name="KEYWORDS" content="Kattack, GPS, race tracking, sailing, racing,DotNetNuke,DNN" /><meta id="MetaCopyright" name="COPYRIGHT" content="Copyright 2005-2008 by Kattack, LLC" /><meta id="MetaGenerator" name="GENERATOR" content="DotNetNuke " /><meta id="MetaAuthor" name="AUTHOR" content="Kattack" /><meta name="RESOURCE-TYPE" content="DOCUMENT" /><meta name="DISTRIBUTION" content="GLOBAL" /><meta name="ROBOTS" content="INDEX, FOLLOW" /><meta name="REVISIT-AFTER" content="1 DAYS" /><meta name="RATING" content="GENERAL" /><meta http-equiv="PAGE-ENTER" content="RevealTrans(Duration=0,Transition=1)" /><style id="StylePlaceholder" type="text/css"></style><link id="_Portals__default_" rel="stylesheet" type="text/css" href="/Portals/_default/default.css" /><link id="_Portals__default_Skins_KattackSkins_" rel="stylesheet" type="text/css" href="/Portals/_default/Skins/KattackSkins/skin.css" /><link id="_Portals__default_Containers_KattackSkins_BLueTitle_css" rel="stylesheet" type="text/css" href="/Portals/_default/Containers/KattackSkins/BLueTitle.css" /><link id="_Portals_0_" rel="stylesheet" type="text/css" href="/Portals/0/portal.css" /><meta name="verify-v1" content="wOcKfc7Ekd6YqUa2VXQdxkvFeIsPAR4asIdKaz11CH0=" /><link rel="SHORTCUT ICON" href="/Portals/0/favicon.ico" /><title>
Kattack Race Analysis
</title></head>
<body id="Body" bottommargin="0" leftmargin="0" topmargin="0" rightmargin="0" marginwidth="0" marginheight="0">
<noscript></noscript>
<form name="Form" method="post" action="/Home/tabid/55/ctl/Register/Default.aspx?returnurl=%2fLoginReg%2fUserLogin%2ftabid%2f125%2fDefault.aspx" onsubmit="javascript:return WebForm_OnSubmit();" id="Form" enctype="multipart/form-data" style="height: 100%;">
<div>
<input type="hidden" name="__EVENTTARGET" id="__EVENTTARGET" value="" />
<input type="hidden" name="__EVENTARGUMENT" id="__EVENTARGUMENT" value="" />

</div>

<script type="text/javascript">
//<![CDATA[
var theForm = document.forms['Form'];
if (!theForm) {
theForm = document.Form;
}
function __doPostBack(eventTarget, eventArgument) {
if (!theForm.onsubmit || (theForm.onsubmit() != false)) {
theForm.__EVENTTARGET.value = eventTarget;
theForm.__EVENTARGUMENT.value = eventArgument;
theForm.submit();
}
}
//]]>
</script>


<script src="/WebResource.axd?d=mywIMMAVWemSOYB8roZ-gCPMsNgaAYOHwN66_gcUbH1ivHikRHELoRsPYJH6DGHTqO_Yt3c6dMmOSM1U0&amp;t=634439634561234820" type="text/javascript"></script>


<script src="/js/dnncore.js" type="text/javascript"></script><script src="/js/dnn.js"></script>
<!-- Solution Partner's ASP.NET Hierarchical Menu (v1.7.2.0) - http://www.solpart.com -->
<SCRIPT SRC="/controls/SolpartMenu/spmenu.js"></SCRIPT><SPAN ID="dnn_dnnSOLPARTMENU_ctldnnSOLPARTMENU_divOuterTables"></SPAN>
<script src="/ScriptResource.axd?d=IzC7Fd9fvAj4IOb7p1OJhBbzIzplaZIDZLg80_F6PsqAvRpHX7XUJATF1LbNLwuPzyhX3ahNIVEpetxahgG2DyrddoXss8Cna0mmqKbyi85Y5SFQzo_NKSz1V_Wc3Hce1A-iLKV-S8JNLvgY0&amp;t=634439634561234820" type="text/javascript"></script>
<script src="/ScriptResource.axd?d=B0SgA1tqW1TDZOPt7LsLhBbcjVkMiKVxo1nw_lcb4VvV7l_gZiD99IPpuopdrWEDU_qpLYXh8KEYsx3xHYjKI82mwaPkJ5fO8wpiQI3QEI_UU9Sspaokn9AMZ441&amp;t=633202793300000000" type="text/javascript"></script>
<script src="/ScriptResource.axd?d=xkvoPXV2O4drUy4NIb9A3sStNa4EHVqnQja-GAw169jD1dAhTnzjOv6aO516nFemzsCJlsm78LVeuENniHyrBooBCmMVlfMafat5o5IO229wZCGZ8VHDDn9YjbIqpHy7HoSrUA2&amp;t=633202793300000000" type="text/javascript"></script>
<script type="text/javascript">
//<![CDATA[
function WebForm_OnSubmit() {
if (typeof(ValidatorOnSubmit) == "function" && ValidatorOnSubmit() == false) return false;
return true;
}
//]]>
</script>



<!-- Skin Design and developed by Sachin Badhe, badhe_sachin@yshoo.co.in -->
<link href="/Portals/_default/Skins/KattackSkins/skin.css" rel="stylesheet" type="text/css">
<table width="100%" height="100%" class="BackgroundTable">
<tr>
<td align="center" valign="top">
<table class="BGTable" width="100%" cellpadding="0" cellspacing="0" border="0">
<tr>
<td align="center" class="BottomBg" valign="top">
<table class="MainTable" cellpadding="0" cellspacing="0" border="0">
<tr>
<td class="LoginPaneBG"></td>
</tr>
<tr>
<td valign="top" class="Contenttable">
<table width="100%" border="0" cellspacing="0" cellpadding="0">
<tr>
<td class="LogoPane" valign="top" width="100%"><a id="dnn_dnnLOGO_hypLogo" title="Kattack" href="http://www.kattack.com/Default.aspx?base"><img id="dnn_dnnLOGO_imgLogo" src="/Portals/0/KattackLogos/KattackLogoHoriz(233X68).png" alt="Kattack" style="border-width:0px;" /></a></td>
<td valign="top" width="1%" align="right">
<img src="/Portals/_default/Skins/KattackSkins/images/HeaderTop.gif" alt="HeaderTop" /></td>
</tr>
</table>
</td>
</tr>
<tr>
<td height="100%" valign="top" class="Contenttable">
<table height="100%" width="100%" border="0" cellspacing="0" cellpadding="0">
<tr>
<td height="100%" valign="top" width="1%" class="LeftSideMain">
<table height="100%" class="LeftSideMainBottomRight" width="168" border="0" cellspacing="0" cellpadding="0">
<tr>
<td id="dnn_TopLeftPane" valign="top" class="LeftTopPane">
</td>

</tr>
<tr>
<td height="100%" class="NavPane"><span id="dnn_dnnSOLPARTMENU_ctldnnSOLPARTMENU" name="dnn$dnnSOLPARTMENU$ctldnnSOLPARTMENU" BackColor="#333333" IconBackgroundColor="#333333" HlColor="#FF8080" ShColor="#404040" SelForeColor="White" SelColor="#CCCCCC" FontStyle="font-family: Tahoma,Arial,Helvetica; font-size: 9pt; font-weight: bold; font-style: normal; text-decoration: " SysImgPath="/images/" Display="vertical" MenuBarHeight="16" MenuItemHeight="21" IconWidth="15" MOutDelay="500" MenuTransition="None" BorderWidth="0" IconImgPath="/Portals/0/" ArrowImage="spacer.gif" CSSMenuArrow="MainMenu_MenuArrow" CSSMenuBreak="MainMenu_MenuBreak" CSSMenuContainer="MainMenu_MenuContainer" CSSMenuBar="MainMenu_MenuBar" CSSSubMenu="MainMenu_SubMenu" CSSMenuIcon="MainMenu_MenuIcon" CSSMenuItem="MainMenu_MenuItem" CSSMenuItemSel="MainMenu_MenuItemSel" CSSRootMenuArw="MainMenu_RootMenuArrow" SupportsTrans="1"><xml id="SolpartMenuDI" onreadystatechange="if (this.readyState == 'complete') spm_initMyMenu(this, spm_getById('dnn_dnnSOLPARTMENU_ctldnnSOLPARTMENU'))"><root><menuitem id="55" title="Home" url="http://www.kattack.com/Home/tabid/55/Default.aspx" selcss="MainMenu_TabMenuItemHover" css="MainMenu_TabRootMenuItem MainMenu_TabRootMenuItemSel MainMenu_TabMenuItemSelHover" /><menuitem id="160" title="Applications" url="http://www.kattack.com/Applications/tabid/160/Default.aspx" css="MainMenu_TabRootMenuItem" selcss="MainMenu_TabMenuItemHover"><menuitem id="162" title="&amp;nbsp;Club Applications" url="http://www.kattack.com/Applications/ClubApplications/tabid/162/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="163" title="&amp;nbsp;Coaching Applications" url="http://www.kattack.com/Applications/CoachingApplications/tabid/163/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="164" title="&amp;nbsp;Regatta Applications" url="http://www.kattack.com/Applications/RegattaApplications/tabid/164/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /></menuitem><menuitem id="57" title="Products" url="http://www.kattack.com/Products/tabid/57/Default.aspx" css="MainMenu_TabRootMenuItem" selcss="MainMenu_TabMenuItemHover"><menuitem id="100" title="&amp;nbsp;Kattack Race Player" url="http://www.kattack.com/Products/KattackRacePlayer/tabid/100/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="93" title="&amp;nbsp;Kattack Race Publisher" url="http://www.kattack.com/Products/KattackRacePublisher/tabid/93/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="81" title="&amp;nbsp;Downloads" url="http://www.kattack.com/Products/Downloads/tabid/81/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /></menuitem><menuitem id="262" title="Kattack LIVE" url="http://www.kattack.com/KattackLIVE/tabid/262/Default.aspx" css="MainMenu_TabRootMenuItem" selcss="MainMenu_TabMenuItemHover"><menuitem id="243" title="&amp;nbsp;About" url="http://www.kattack.com/KattackLIVE/About/tabid/243/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="266" title="&amp;nbsp;Getting Started" url="http://www.kattack.com/KattackLIVE/GettingStarted/tabid/266/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="257" title="&amp;nbsp;Setup" url="http://kws.kattack.com/kattacklivesetup" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="265" title="&amp;nbsp;Data Plan Maintenance" url="http://www.kattack.com/KattackLIVE/DataPlanMaintenance/tabid/265/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="269" title="&amp;nbsp;Phone Recovery" url="http://www.kattack.com/KattackLIVE/PhoneRecovery/tabid/269/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /></menuitem><menuitem id="260" title="SPOT Tracking" url="http://www.kattack.com/SPOTTracking/AboutSPOTandKattack/tabid/259/Default.aspx" css="MainMenu_TabRootMenuItem" selcss="MainMenu_TabMenuItemHover"><menuitem id="259" title="&amp;nbsp;About SPOT and Kattack" url="http://www.kattack.com/SPOTTracking/AboutSPOTandKattack/tabid/259/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /></menuitem><menuitem id="65" title="Support" url="http://www.kattack.com/Support/tabid/65/Default.aspx" css="MainMenu_TabRootMenuItem" selcss="MainMenu_TabMenuItemHover"><menuitem id="77" title="&amp;nbsp;FAQ" url="http://www.kattack.com/Support/FAQ/tabid/77/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="130" title="&amp;nbsp;Downloads" url="http://www.kattack.com/Products/Downloads/tabid/81/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="225" title="&amp;nbsp;Help Videos" selcss="MainMenu_SubMenuItemSelHover"><menuitem id="226" title="&amp;nbsp;Kattack Race Player" url="http://www.kattack.com/Support/HelpVideos/KattackRacePlayer/tabid/226/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="227" title="&amp;nbsp;Kattack Race Publisher" url="http://www.kattack.com/Support/HelpVideos/KattackRacePublisher/tabid/227/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="228" title="&amp;nbsp;Kattack Media Manager" url="http://www.kattack.com/Support/HelpVideos/KattackMediaManager/tabid/228/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /></menuitem><menuitem id="241" title="&amp;nbsp;Hardware Requirements" url="http://www.kattack.com/Support/HardwareRequirements/tabid/241/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="251" title="&amp;nbsp;Kattack and IPhone" url="http://www.kattack.com/Support/KattackandIPhone/tabid/251/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="268" title="&amp;nbsp;YouTube Links" url="http://www.kattack.com/Support/YouTubeLinks/tabid/268/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="271" title="&amp;nbsp;Phone Recovery" url="http://www.kattack.com/KattackLIVE/PhoneRecovery/tabid/269/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /></menuitem><menuitem id="201" title="Regattas" url="http://www.kattack.com/Regattas/RegattaList/tabid/205/Default.aspx" css="MainMenu_TabRootMenuItem" selcss="MainMenu_TabMenuItemHover"><menuitem id="205" title="&amp;nbsp;Regatta List" url="http://www.kattack.com/Regattas/RegattaList/tabid/205/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="202" title="&amp;nbsp;Regatta Details" url="http://www.kattack.com/Regattas/RegattaDetails/tabid/202/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /></menuitem><menuitem id="56" title="Company" url="http://www.kattack.com/Company/AboutUs/tabid/67/Default.aspx" css="MainMenu_TabRootMenuItem" selcss="MainMenu_TabMenuItemHover"><menuitem id="67" title="&amp;nbsp;About Us" url="http://www.kattack.com/Company/AboutUs/tabid/67/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="58" title="&amp;nbsp;Contact Us" url="http://www.kattack.com/Company/ContactUs/tabid/58/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="99" title="&amp;nbsp;Artwork" url="http://www.kattack.com/Company/Artwork/tabid/99/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="245" title="&amp;nbsp;Help Wanted" url="http://www.kattack.com/Company/HelpWanted/tabid/245/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /></menuitem></root></xml></span></td>
</tr>
<tr>

</tr>
<tr>
<td class="LoginPane">
<div class="LoginPaneDiv">
<a id="dnn_dnnUSER_cmdRegister" class="Login" href="javascript:__doPostBack('dnn$dnnUSER$cmdRegister','')">Register</a></div>
<div class="LoginPaneDiv">
<a id="dnn_dnnLOGIN_cmdLogin" class="Login" href="javascript:__doPostBack('dnn$dnnLOGIN$cmdLogin','')">Login</a></div>
</td>
</tr>
<tr>
<td class="PrivacyPane">
<div class="PrivacyPaneDiv">
<a id="dnn_dnnPRIVACY_hypPrivacy" class="Footer" href="http://www.kattack.com/Home/tabid/55/ctl/Privacy/Default.aspx">Privacy Statement</a></div>
<div class="PrivacyPaneDiv">
<a id="dnn_dnnTERMS_hypTerms" class="Footer" href="http://www.kattack.com/Home/tabid/55/ctl/Terms/Default.aspx">Terms Of Use</a></div>
..
ASP.NET Identified

ASP.NET Identified
1 TOTAL
INFORMATION
Netsparker identified that the target web site is using ASP.NET as web application framework. This issue is reported as extra information only.

Impact

This issue is reported as extra information, there is no direct impact resulting from this issue.
- /Home/tabid/55/ctl/Register/Default.aspx

/Home/tabid/55/ctl/Register/Default.aspx

http://www.kattack.com/Home/tabid/55/ctl/Register/Default.aspx?returnurl=%2fLoginReg%2fUserLogin%2ft..

Request

DEBUG /Home/tabid/55/ctl/Register/Default.aspx?returnurl=%2fLoginReg%2fUserLogin%2ftabid%2f125%2fDefault.aspx HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: www.kattack.com
Accept-Encoding: gzip, deflate

Response

HTTP/1.1 403 Forbidden
Date: Mon, 18 Jul 2011 14:47:47 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 75


/Home/tabid/55/ctl/Register/Default.aspx application debugging not enabled.
E-mail Address Disclosure

E-mail Address Disclosure
1 TOTAL
INFORMATION
Netsparker found e-mail addresses on the web site.

Impact

E-mail addresses discovered within the application can be used by both spam email engines and also brute force tools. Furthermore valid email addresses may lead to social engineering attacks .

Remedy

Use generic email addresses such as contact@ or info@ for general communications, remove user/people specific e-mail addresses from the web site, should this be required use submission forms for this purpose.

External References

- /Home/tabid/55/ctl/Register/Default.aspx

/Home/tabid/55/ctl/Register/Default.aspx

http://www.kattack.com/Home/tabid/55/ctl/Register/Default.aspx?returnurl=%2fLoginReg%2fUserLogin%2ft..

Found E-mails

Request

GET /Home/tabid/55/ctl/Register/Default.aspx?returnurl=%2fLoginReg%2fUserLogin%2ftabid%2f125%2fDefault.aspx HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: www.kattack.com
Accept-Encoding: gzip, deflate
Connection: Keep-Alive

Response

HTTP/1.1 200 OK
Date: Mon, 18 Jul 2011 14:47:47 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Set-Cookie: .ASPXANONYMOUS=9j1If-t7zAEkAAAANzZlYjlmNjEtNzgxMS00MWFiLWIzZTktNTIyZmVjZWQ5ZGRk0; expires=Mon, 26-Sep-2011 01:27:46 GMT; path=/; HttpOnly,DotNetNukeAnonymous=3feb1bf9-f16b-4dc0-b578-9b6c4f49455f; expires=Mon, 18-Jul-2011 15:07:46 GMT; path=/; HttpOnly,language=en-US; path=/; HttpOnly
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 76709


<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<html>
<head id="Head">
<!--**********************************************************************************-->
<!-- DotNetNuke� - http://www.dotnetnuke.com -->
<!-- Copyright (c) 2002-2007 -->
<!-- by DotNetNuke Corporation -->
<!--**********************************************************************************-->
<meta id="MetaDescription" name="DESCRIPTION" content="Kattack GPS Tracking brings world class race tracking to sailboat racing. " /><meta id="MetaKeywords" name="KEYWORDS" content="Kattack, GPS, race tracking, sailing, racing,DotNetNuke,DNN" /><meta id="MetaCopyright" name="COPYRIGHT" content="Copyright 2005-2008 by Kattack, LLC" /><meta id="MetaGenerator" name="GENERATOR" content="DotNetNuke " /><meta id="MetaAuthor" name="AUTHOR" content="Kattack" /><meta name="RESOURCE-TYPE" content="DOCUMENT" /><meta name="DISTRIBUTION" content="GLOBAL" /><meta name="ROBOTS" content="INDEX, FOLLOW" /><meta name="REVISIT-AFTER" content="1 DAYS" /><meta name="RATING" content="GENERAL" /><meta http-equiv="PAGE-ENTER" content="RevealTrans(Duration=0,Transition=1)" /><style id="StylePlaceholder" type="text/css"></style><link id="_Portals__default_" rel="stylesheet" type="text/css" href="/Portals/_default/default.css" /><link id="_Portals__default_Skins_KattackSkins_" rel="stylesheet" type="text/css" href="/Portals/_default/Skins/KattackSkins/skin.css" /><link id="_Portals__default_Containers_KattackSkins_BLueTitle_css" rel="stylesheet" type="text/css" href="/Portals/_default/Containers/KattackSkins/BLueTitle.css" /><link id="_Portals_0_" rel="stylesheet" type="text/css" href="/Portals/0/portal.css" /><meta name="verify-v1" content="wOcKfc7Ekd6YqUa2VXQdxkvFeIsPAR4asIdKaz11CH0=" /><link rel="SHORTCUT ICON" href="/Portals/0/favicon.ico" /><title>
Kattack Race Analysis
</title></head>
<body id="Body" bottommargin="0" leftmargin="0" topmargin="0" rightmargin="0" marginwidth="0" marginheight="0">
<noscript></noscript>
<form name="Form" method="post" action="/Home/tabid/55/ctl/Register/Default.aspx?returnurl=%2fLoginReg%2fUserLogin%2ftabid%2f125%2fDefault.aspx" onsubmit="javascript:return WebForm_OnSubmit();" id="Form" enctype="multipart/form-data" style="height: 100%;">
<div>
<input type="hidden" name="__EVENTTARGET" id="__EVENTTARGET" value="" />
<input type="hidden" name="__EVENTARGUMENT" id="__EVENTARGUMENT" value="" />

</div>

<script type="text/javascript">
//<![CDATA[
var theForm = document.forms['Form'];
if (!theForm) {
theForm = document.Form;
}
function __doPostBack(eventTarget, eventArgument) {
if (!theForm.onsubmit || (theForm.onsubmit() != false)) {
theForm.__EVENTTARGET.value = eventTarget;
theForm.__EVENTARGUMENT.value = eventArgument;
theForm.submit();
}
}
//]]>
</script>


<script src="/WebResource.axd?d=mywIMMAVWemSOYB8roZ-gCPMsNgaAYOHwN66_gcUbH1ivHikRHELoRsPYJH6DGHTqO_Yt3c6dMmOSM1U0&amp;t=634439634561234820" type="text/javascript"></script>


<script src="/js/dnncore.js" type="text/javascript"></script><script src="/js/dnn.js"></script>
<!-- Solution Partner's ASP.NET Hierarchical Menu (v1.7.2.0) - http://www.solpart.com -->
<SCRIPT SRC="/controls/SolpartMenu/spmenu.js"></SCRIPT><SPAN ID="dnn_dnnSOLPARTMENU_ctldnnSOLPARTMENU_divOuterTables"></SPAN>
<script src="/ScriptResource.axd?d=IzC7Fd9fvAj4IOb7p1OJhBbzIzplaZIDZLg80_F6PsqAvRpHX7XUJATF1LbNLwuPzyhX3ahNIVEpetxahgG2DyrddoXss8Cna0mmqKbyi85Y5SFQzo_NKSz1V_Wc3Hce1A-iLKV-S8JNLvgY0&amp;t=634439634561234820" type="text/javascript"></script>
<script src="/ScriptResource.axd?d=B0SgA1tqW1TDZOPt7LsLhBbcjVkMiKVxo1nw_lcb4VvV7l_gZiD99IPpuopdrWEDU_qpLYXh8KEYsx3xHYjKI82mwaPkJ5fO8wpiQI3QEI_UU9Sspaokn9AMZ441&amp;t=633202793300000000" type="text/javascript"></script>
<script src="/ScriptResource.axd?d=xkvoPXV2O4drUy4NIb9A3sStNa4EHVqnQja-GAw169jD1dAhTnzjOv6aO516nFemzsCJlsm78LVeuENniHyrBooBCmMVlfMafat5o5IO229wZCGZ8VHDDn9YjbIqpHy7HoSrUA2&amp;t=633202793300000000" type="text/javascript"></script>
<script type="text/javascript">
//<![CDATA[
function WebForm_OnSubmit() {
if (typeof(ValidatorOnSubmit) == "function" && ValidatorOnSubmit() == false) return false;
return true;
}
//]]>
</script>



<!-- Skin Design and developed by Sachin Badhe, badhe_sachin@yshoo.co.in -->
<link href="/Portals/_default/Skins/KattackSkins/skin.css" rel="stylesheet" type="text/css">
<table width="100%" height="100%" class="BackgroundTable">
<tr>
<td align="center" valign="top">
<table class="BGTable" width="100%" cellpadding="0" cellspacing="0" border="0">
<tr>
<td align="center" class="BottomBg" valign="top">
<table class="MainTable" cellpadding="0" cellspacing="0" border="0">
<tr>
<td class="LoginPaneBG"></td>
</tr>
<tr>
<td valign="top" class="Contenttable">
<table width="100%" border="0" cellspacing="0" cellpadding="0">
<tr>
<td class="LogoPane" valign="top" width="100%"><a id="dnn_dnnLOGO_hypLogo" title="Kattack" href="http://www.kattack.com/Default.aspx?base"><img id="dnn_dnnLOGO_imgLogo" src="/Portals/0/KattackLogos/KattackLogoHoriz(233X68).png" alt="Kattack" style="border-width:0px;" /></a></td>
<td valign="top" width="1%" align="right">
<img src="/Portals/_default/Skins/KattackSkins/images/HeaderTop.gif" alt="HeaderTop" /></td>
</tr>
</table>
</td>
</tr>
<tr>
<td height="100%" valign="top" class="Contenttable">
<table height="100%" width="100%" border="0" cellspacing="0" cellpadding="0">
<tr>
<td height="100%" valign="top" width="1%" class="LeftSideMain">
<table height="100%" class="LeftSideMainBottomRight" width="168" border="0" cellspacing="0" cellpadding="0">
<tr>
<td id="dnn_TopLeftPane" valign="top" class="LeftTopPane">
</td>

</tr>
<tr>
<td height="100%" class="NavPane"><span id="dnn_dnnSOLPARTMENU_ctldnnSOLPARTMENU" name="dnn$dnnSOLPARTMENU$ctldnnSOLPARTMENU" BackColor="#333333" IconBackgroundColor="#333333" HlColor="#FF8080" ShColor="#404040" SelForeColor="White" SelColor="#CCCCCC" FontStyle="font-family: Tahoma,Arial,Helvetica; font-size: 9pt; font-weight: bold; font-style: normal; text-decoration: " SysImgPath="/images/" Display="vertical" MenuBarHeight="16" MenuItemHeight="21" IconWidth="15" MOutDelay="500" MenuTransition="None" BorderWidth="0" IconImgPath="/Portals/0/" ArrowImage="spacer.gif" CSSMenuArrow="MainMenu_MenuArrow" CSSMenuBreak="MainMenu_MenuBreak" CSSMenuContainer="MainMenu_MenuContainer" CSSMenuBar="MainMenu_MenuBar" CSSSubMenu="MainMenu_SubMenu" CSSMenuIcon="MainMenu_MenuIcon" CSSMenuItem="MainMenu_MenuItem" CSSMenuItemSel="MainMenu_MenuItemSel" CSSRootMenuArw="MainMenu_RootMenuArrow" SupportsTrans="1"><xml id="SolpartMenuDI" onreadystatechange="if (this.readyState == 'complete') spm_initMyMenu(this, spm_getById('dnn_dnnSOLPARTMENU_ctldnnSOLPARTMENU'))"><root><menuitem id="55" title="Home" url="http://www.kattack.com/Home/tabid/55/Default.aspx" selcss="MainMenu_TabMenuItemHover" css="MainMenu_TabRootMenuItem MainMenu_TabRootMenuItemSel MainMenu_TabMenuItemSelHover" /><menuitem id="160" title="Applications" url="http://www.kattack.com/Applications/tabid/160/Default.aspx" css="MainMenu_TabRootMenuItem" selcss="MainMenu_TabMenuItemHover"><menuitem id="162" title="&amp;nbsp;Club Applications" url="http://www.kattack.com/Applications/ClubApplications/tabid/162/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="163" title="&amp;nbsp;Coaching Applications" url="http://www.kattack.com/Applications/CoachingApplications/tabid/163/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="164" title="&amp;nbsp;Regatta Applications" url="http://www.kattack.com/Applications/RegattaApplications/tabid/164/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /></menuitem><menuitem id="57" title="Products" url="http://www.kattack.com/Products/tabid/57/Default.aspx" css="MainMenu_TabRootMenuItem" selcss="MainMenu_TabMenuItemHover"><menuitem id="100" title="&amp;nbsp;Kattack Race Player" url="http://www.kattack.com/Products/KattackRacePlayer/tabid/100/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="93" title="&amp;nbsp;Kattack Race Publisher" url="http://www.kattack.com/Products/KattackRacePublisher/tabid/93/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="81" title="&amp;nbsp;Downloads" url="http://www.kattack.com/Products/Downloads/tabid/81/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /></menuitem><menuitem id="262" title="Kattack LIVE" url="http://www.kattack.com/KattackLIVE/tabid/262/Default.aspx" css="MainMenu_TabRootMenuItem" selcss="MainMenu_TabMenuItemHover"><menuitem id="243" title="&amp;nbsp;About" url="http://www.kattack.com/KattackLIVE/About/tabid/243/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="266" title="&amp;nbsp;Getting Started" url="http://www.kattack.com/KattackLIVE/GettingStarted/tabid/266/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="257" title="&amp;nbsp;Setup" url="http://kws.kattack.com/kattacklivesetup" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="265" title="&amp;nbsp;Data Plan Maintenance" url="http://www.kattack.com/KattackLIVE/DataPlanMaintenance/tabid/265/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="269" title="&amp;nbsp;Phone Recovery" url="http://www.kattack.com/KattackLIVE/PhoneRecovery/tabid/269/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /></menuitem><menuitem id="260" title="SPOT Tracking" url="http://www.kattack.com/SPOTTracking/AboutSPOTandKattack/tabid/259/Default.aspx" css="MainMenu_TabRootMenuItem" selcss="MainMenu_TabMenuItemHover"><menuitem id="259" title="&amp;nbsp;About SPOT and Kattack" url="http://www.kattack.com/SPOTTracking/AboutSPOTandKattack/tabid/259/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /></menuitem><menuitem id="65" title="Support" url="http://www.kattack.com/Support/tabid/65/Default.aspx" css="MainMenu_TabRootMenuItem" selcss="MainMenu_TabMenuItemHover"><menuitem id="77" title="&amp;nbsp;FAQ" url="http://www.kattack.com/Support/FAQ/tabid/77/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="130" title="&amp;nbsp;Downloads" url="http://www.kattack.com/Products/Downloads/tabid/81/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="225" title="&amp;nbsp;Help Videos" selcss="MainMenu_SubMenuItemSelHover"><menuitem id="226" title="&amp;nbsp;Kattack Race Player" url="http://www.kattack.com/Support/HelpVideos/KattackRacePlayer/tabid/226/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="227" title="&amp;nbsp;Kattack Race Publisher" url="http://www.kattack.com/Support/HelpVideos/KattackRacePublisher/tabid/227/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="228" title="&amp;nbsp;Kattack Media Manager" url="http://www.kattack.com/Support/HelpVideos/KattackMediaManager/tabid/228/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /></menuitem><menuitem id="241" title="&amp;nbsp;Hardware Requirements" url="http://www.kattack.com/Support/HardwareRequirements/tabid/241/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="251" title="&amp;nbsp;Kattack and IPhone" url="http://www.kattack.com/Support/KattackandIPhone/tabid/251/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="268" title="&amp;nbsp;YouTube Links" url="http://www.kattack.com/Support/YouTubeLinks/tabid/268/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="271" title="&amp;nbsp;Phone Recovery" url="http://www.kattack.com/KattackLIVE/PhoneRecovery/tabid/269/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /></menuitem><menuitem id="201" title="Regattas" url="http://www.kattack.com/Regattas/RegattaList/tabid/205/Default.aspx" css="MainMenu_TabRootMenuItem" selcss="MainMenu_TabMenuItemHover"><menuitem id="205" title="&amp;nbsp;Regatta List" url="http://www.kattack.com/Regattas/RegattaList/tabid/205/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="202" title="&amp;nbsp;Regatta Details" url="http://www.kattack.com/Regattas/RegattaDetails/tabid/202/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /></menuitem><menuitem id="56" title="Company" url="http://www.kattack.com/Company/AboutUs/tabid/67/Default.aspx" css="MainMenu_TabRootMenuItem" selcss="MainMenu_TabMenuItemHover"><menuitem id="67" title="&amp;nbsp;About Us" url="http://www.kattack.com/Company/AboutUs/tabid/67/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="58" title="&amp;nbsp;Contact Us" url="http://www.kattack.com/Company/ContactUs/tabid/58/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="99" title="&amp;nbsp;Artwork" url="http://www.kattack.com/Company/Artwork/tabid/99/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="245" title="&amp;nbsp;Help Wanted" url="http://www.kattack.com/Company/HelpWanted/tabid/245/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /></menuitem></root></xml></span></td>
</tr>
<tr>

</tr>
<tr>
<td class="LoginPane">
<div class="LoginPaneDiv">
<a id="dnn_dnnUSER_cmdRegister" class="Login" href="javascript:__doPostBack('dnn$dnnUSER$cmdRegister','')">Register</a></div>
<div class="LoginPaneDiv">
<a id="dnn_dnnLOGIN_cmdLogin" class="Login" href="javascript:__doPostBack('dnn$dnnLOGIN$cmdLogin','')">Login</a></div>
</td>
</tr>
<tr>
<td class="PrivacyPane">
<div class="PrivacyPaneDiv">
<a id="dnn_dnnPRIVACY_hypPrivacy" class="Footer" href="http://www.kattack.com/Home/tabid/55/ctl/Privacy/Default.aspx">Privacy Statement</a></div>
<div class="PrivacyPaneDiv">
<a id="dnn_dnnTERMS_hypTerms" class="Footer" href="http://www.kattack.com/Home/tabid/55/ctl/Terms/Default.aspx">Terms Of Use</a></div>
..
IIS Version Disclosure

IIS Version Disclosure
1 TOTAL
INFORMATION
Netsparker identified that the target web server is disclosing the web server's version in the HTTP response. This information can help an attacker to gain a greater understanding of the system in use and potentially develop further attacks targeted at the specific web server version.

Impact

An attacker can look for specific security vulnerabilities for the version identified through the SERVER header information.

Remediation

Configure your web server to prevent information leakage from the SERVER header of its HTTP response.
- /Home/tabid/55/ctl/Register/Default.aspx

/Home/tabid/55/ctl/Register/Default.aspx

http://www.kattack.com/Home/tabid/55/ctl/Register/Default.aspx?returnurl=%2fLoginReg%2fUserLogin%2ft..

Extracted Version

Microsoft-IIS/6.0

Request

GET /Home/tabid/55/ctl/Register/Default.aspx?returnurl=%2fLoginReg%2fUserLogin%2ftabid%2f125%2fDefault.aspx HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: www.kattack.com
Accept-Encoding: gzip, deflate
Connection: Keep-Alive

Response

HTTP/1.1 200 OK
Date: Mon, 18 Jul 2011 14:47:47 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Set-Cookie: .ASPXANONYMOUS=9j1If-t7zAEkAAAANzZlYjlmNjEtNzgxMS00MWFiLWIzZTktNTIyZmVjZWQ5ZGRk0; expires=Mon, 26-Sep-2011 01:27:46 GMT; path=/; HttpOnly,DotNetNukeAnonymous=3feb1bf9-f16b-4dc0-b578-9b6c4f49455f; expires=Mon, 18-Jul-2011 15:07:46 GMT; path=/; HttpOnly,language=en-US; path=/; HttpOnly
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 76709


<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<html>
<head id="Head">
<!--**********************************************************************************-->
<!-- DotNetNuke� - http://www.dotnetnuke.com -->
<!-- Copyright (c) 2002-2007 -->
<!-- by DotNetNuke Corporation -->
<!--**********************************************************************************-->
<meta id="MetaDescription" name="DESCRIPTION" content="Kattack GPS Tracking brings world class race tracking to sailboat racing. " /><meta id="MetaKeywords" name="KEYWORDS" content="Kattack, GPS, race tracking, sailing, racing,DotNetNuke,DNN" /><meta id="MetaCopyright" name="COPYRIGHT" content="Copyright 2005-2008 by Kattack, LLC" /><meta id="MetaGenerator" name="GENERATOR" content="DotNetNuke " /><meta id="MetaAuthor" name="AUTHOR" content="Kattack" /><meta name="RESOURCE-TYPE" content="DOCUMENT" /><meta name="DISTRIBUTION" content="GLOBAL" /><meta name="ROBOTS" content="INDEX, FOLLOW" /><meta name="REVISIT-AFTER" content="1 DAYS" /><meta name="RATING" content="GENERAL" /><meta http-equiv="PAGE-ENTER" content="RevealTrans(Duration=0,Transition=1)" /><style id="StylePlaceholder" type="text/css"></style><link id="_Portals__default_" rel="stylesheet" type="text/css" href="/Portals/_default/default.css" /><link id="_Portals__default_Skins_KattackSkins_" rel="stylesheet" type="text/css" href="/Portals/_default/Skins/KattackSkins/skin.css" /><link id="_Portals__default_Containers_KattackSkins_BLueTitle_css" rel="stylesheet" type="text/css" href="/Portals/_default/Containers/KattackSkins/BLueTitle.css" /><link id="_Portals_0_" rel="stylesheet" type="text/css" href="/Portals/0/portal.css" /><meta name="verify-v1" content="wOcKfc7Ekd6YqUa2VXQdxkvFeIsPAR4asIdKaz11CH0=" /><link rel="SHORTCUT ICON" href="/Portals/0/favicon.ico" /><title>
Kattack Race Analysis
</title></head>
<body id="Body" bottommargin="0" leftmargin="0" topmargin="0" rightmargin="0" marginwidth="0" marginheight="0">
<noscript></noscript>
<form name="Form" method="post" action="/Home/tabid/55/ctl/Register/Default.aspx?returnurl=%2fLoginReg%2fUserLogin%2ftabid%2f125%2fDefault.aspx" onsubmit="javascript:return WebForm_OnSubmit();" id="Form" enctype="multipart/form-data" style="height: 100%;">
<div>
<input type="hidden" name="__EVENTTARGET" id="__EVENTTARGET" value="" />
<input type="hidden" name="__EVENTARGUMENT" id="__EVENTARGUMENT" value="" />

</div>

<script type="text/javascript">
//<![CDATA[
var theForm = document.forms['Form'];
if (!theForm) {
theForm = document.Form;
}
function __doPostBack(eventTarget, eventArgument) {
if (!theForm.onsubmit || (theForm.onsubmit() != false)) {
theForm.__EVENTTARGET.value = eventTarget;
theForm.__EVENTARGUMENT.value = eventArgument;
theForm.submit();
}
}
//]]>
</script>


<script src="/WebResource.axd?d=mywIMMAVWemSOYB8roZ-gCPMsNgaAYOHwN66_gcUbH1ivHikRHELoRsPYJH6DGHTqO_Yt3c6dMmOSM1U0&amp;t=634439634561234820" type="text/javascript"></script>


<script src="/js/dnncore.js" type="text/javascript"></script><script src="/js/dnn.js"></script>
<!-- Solution Partner's ASP.NET Hierarchical Menu (v1.7.2.0) - http://www.solpart.com -->
<SCRIPT SRC="/controls/SolpartMenu/spmenu.js"></SCRIPT><SPAN ID="dnn_dnnSOLPARTMENU_ctldnnSOLPARTMENU_divOuterTables"></SPAN>
<script src="/ScriptResource.axd?d=IzC7Fd9fvAj4IOb7p1OJhBbzIzplaZIDZLg80_F6PsqAvRpHX7XUJATF1LbNLwuPzyhX3ahNIVEpetxahgG2DyrddoXss8Cna0mmqKbyi85Y5SFQzo_NKSz1V_Wc3Hce1A-iLKV-S8JNLvgY0&amp;t=634439634561234820" type="text/javascript"></script>
<script src="/ScriptResource.axd?d=B0SgA1tqW1TDZOPt7LsLhBbcjVkMiKVxo1nw_lcb4VvV7l_gZiD99IPpuopdrWEDU_qpLYXh8KEYsx3xHYjKI82mwaPkJ5fO8wpiQI3QEI_UU9Sspaokn9AMZ441&amp;t=633202793300000000" type="text/javascript"></script>
<script src="/ScriptResource.axd?d=xkvoPXV2O4drUy4NIb9A3sStNa4EHVqnQja-GAw169jD1dAhTnzjOv6aO516nFemzsCJlsm78LVeuENniHyrBooBCmMVlfMafat5o5IO229wZCGZ8VHDDn9YjbIqpHy7HoSrUA2&amp;t=633202793300000000" type="text/javascript"></script>
<script type="text/javascript">
//<![CDATA[
function WebForm_OnSubmit() {
if (typeof(ValidatorOnSubmit) == "function" && ValidatorOnSubmit() == false) return false;
return true;
}
//]]>
</script>



<!-- Skin Design and developed by Sachin Badhe, badhe_sachin@yshoo.co.in -->
<link href="/Portals/_default/Skins/KattackSkins/skin.css" rel="stylesheet" type="text/css">
<table width="100%" height="100%" class="BackgroundTable">
<tr>
<td align="center" valign="top">
<table class="BGTable" width="100%" cellpadding="0" cellspacing="0" border="0">
<tr>
<td align="center" class="BottomBg" valign="top">
<table class="MainTable" cellpadding="0" cellspacing="0" border="0">
<tr>
<td class="LoginPaneBG"></td>
</tr>
<tr>
<td valign="top" class="Contenttable">
<table width="100%" border="0" cellspacing="0" cellpadding="0">
<tr>
<td class="LogoPane" valign="top" width="100%"><a id="dnn_dnnLOGO_hypLogo" title="Kattack" href="http://www.kattack.com/Default.aspx?base"><img id="dnn_dnnLOGO_imgLogo" src="/Portals/0/KattackLogos/KattackLogoHoriz(233X68).png" alt="Kattack" style="border-width:0px;" /></a></td>
<td valign="top" width="1%" align="right">
<img src="/Portals/_default/Skins/KattackSkins/images/HeaderTop.gif" alt="HeaderTop" /></td>
</tr>
</table>
</td>
</tr>
<tr>
<td height="100%" valign="top" class="Contenttable">
<table height="100%" width="100%" border="0" cellspacing="0" cellpadding="0">
<tr>
<td height="100%" valign="top" width="1%" class="LeftSideMain">
<table height="100%" class="LeftSideMainBottomRight" width="168" border="0" cellspacing="0" cellpadding="0">
<tr>
<td id="dnn_TopLeftPane" valign="top" class="LeftTopPane">
</td>

</tr>
<tr>
<td height="100%" class="NavPane"><span id="dnn_dnnSOLPARTMENU_ctldnnSOLPARTMENU" name="dnn$dnnSOLPARTMENU$ctldnnSOLPARTMENU" BackColor="#333333" IconBackgroundColor="#333333" HlColor="#FF8080" ShColor="#404040" SelForeColor="White" SelColor="#CCCCCC" FontStyle="font-family: Tahoma,Arial,Helvetica; font-size: 9pt; font-weight: bold; font-style: normal; text-decoration: " SysImgPath="/images/" Display="vertical" MenuBarHeight="16" MenuItemHeight="21" IconWidth="15" MOutDelay="500" MenuTransition="None" BorderWidth="0" IconImgPath="/Portals/0/" ArrowImage="spacer.gif" CSSMenuArrow="MainMenu_MenuArrow" CSSMenuBreak="MainMenu_MenuBreak" CSSMenuContainer="MainMenu_MenuContainer" CSSMenuBar="MainMenu_MenuBar" CSSSubMenu="MainMenu_SubMenu" CSSMenuIcon="MainMenu_MenuIcon" CSSMenuItem="MainMenu_MenuItem" CSSMenuItemSel="MainMenu_MenuItemSel" CSSRootMenuArw="MainMenu_RootMenuArrow" SupportsTrans="1"><xml id="SolpartMenuDI" onreadystatechange="if (this.readyState == 'complete') spm_initMyMenu(this, spm_getById('dnn_dnnSOLPARTMENU_ctldnnSOLPARTMENU'))"><root><menuitem id="55" title="Home" url="http://www.kattack.com/Home/tabid/55/Default.aspx" selcss="MainMenu_TabMenuItemHover" css="MainMenu_TabRootMenuItem MainMenu_TabRootMenuItemSel MainMenu_TabMenuItemSelHover" /><menuitem id="160" title="Applications" url="http://www.kattack.com/Applications/tabid/160/Default.aspx" css="MainMenu_TabRootMenuItem" selcss="MainMenu_TabMenuItemHover"><menuitem id="162" title="&amp;nbsp;Club Applications" url="http://www.kattack.com/Applications/ClubApplications/tabid/162/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="163" title="&amp;nbsp;Coaching Applications" url="http://www.kattack.com/Applications/CoachingApplications/tabid/163/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="164" title="&amp;nbsp;Regatta Applications" url="http://www.kattack.com/Applications/RegattaApplications/tabid/164/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /></menuitem><menuitem id="57" title="Products" url="http://www.kattack.com/Products/tabid/57/Default.aspx" css="MainMenu_TabRootMenuItem" selcss="MainMenu_TabMenuItemHover"><menuitem id="100" title="&amp;nbsp;Kattack Race Player" url="http://www.kattack.com/Products/KattackRacePlayer/tabid/100/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="93" title="&amp;nbsp;Kattack Race Publisher" url="http://www.kattack.com/Products/KattackRacePublisher/tabid/93/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="81" title="&amp;nbsp;Downloads" url="http://www.kattack.com/Products/Downloads/tabid/81/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /></menuitem><menuitem id="262" title="Kattack LIVE" url="http://www.kattack.com/KattackLIVE/tabid/262/Default.aspx" css="MainMenu_TabRootMenuItem" selcss="MainMenu_TabMenuItemHover"><menuitem id="243" title="&amp;nbsp;About" url="http://www.kattack.com/KattackLIVE/About/tabid/243/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="266" title="&amp;nbsp;Getting Started" url="http://www.kattack.com/KattackLIVE/GettingStarted/tabid/266/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="257" title="&amp;nbsp;Setup" url="http://kws.kattack.com/kattacklivesetup" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="265" title="&amp;nbsp;Data Plan Maintenance" url="http://www.kattack.com/KattackLIVE/DataPlanMaintenance/tabid/265/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="269" title="&amp;nbsp;Phone Recovery" url="http://www.kattack.com/KattackLIVE/PhoneRecovery/tabid/269/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /></menuitem><menuitem id="260" title="SPOT Tracking" url="http://www.kattack.com/SPOTTracking/AboutSPOTandKattack/tabid/259/Default.aspx" css="MainMenu_TabRootMenuItem" selcss="MainMenu_TabMenuItemHover"><menuitem id="259" title="&amp;nbsp;About SPOT and Kattack" url="http://www.kattack.com/SPOTTracking/AboutSPOTandKattack/tabid/259/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /></menuitem><menuitem id="65" title="Support" url="http://www.kattack.com/Support/tabid/65/Default.aspx" css="MainMenu_TabRootMenuItem" selcss="MainMenu_TabMenuItemHover"><menuitem id="77" title="&amp;nbsp;FAQ" url="http://www.kattack.com/Support/FAQ/tabid/77/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="130" title="&amp;nbsp;Downloads" url="http://www.kattack.com/Products/Downloads/tabid/81/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="225" title="&amp;nbsp;Help Videos" selcss="MainMenu_SubMenuItemSelHover"><menuitem id="226" title="&amp;nbsp;Kattack Race Player" url="http://www.kattack.com/Support/HelpVideos/KattackRacePlayer/tabid/226/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="227" title="&amp;nbsp;Kattack Race Publisher" url="http://www.kattack.com/Support/HelpVideos/KattackRacePublisher/tabid/227/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="228" title="&amp;nbsp;Kattack Media Manager" url="http://www.kattack.com/Support/HelpVideos/KattackMediaManager/tabid/228/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /></menuitem><menuitem id="241" title="&amp;nbsp;Hardware Requirements" url="http://www.kattack.com/Support/HardwareRequirements/tabid/241/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="251" title="&amp;nbsp;Kattack and IPhone" url="http://www.kattack.com/Support/KattackandIPhone/tabid/251/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="268" title="&amp;nbsp;YouTube Links" url="http://www.kattack.com/Support/YouTubeLinks/tabid/268/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="271" title="&amp;nbsp;Phone Recovery" url="http://www.kattack.com/KattackLIVE/PhoneRecovery/tabid/269/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /></menuitem><menuitem id="201" title="Regattas" url="http://www.kattack.com/Regattas/RegattaList/tabid/205/Default.aspx" css="MainMenu_TabRootMenuItem" selcss="MainMenu_TabMenuItemHover"><menuitem id="205" title="&amp;nbsp;Regatta List" url="http://www.kattack.com/Regattas/RegattaList/tabid/205/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="202" title="&amp;nbsp;Regatta Details" url="http://www.kattack.com/Regattas/RegattaDetails/tabid/202/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /></menuitem><menuitem id="56" title="Company" url="http://www.kattack.com/Company/AboutUs/tabid/67/Default.aspx" css="MainMenu_TabRootMenuItem" selcss="MainMenu_TabMenuItemHover"><menuitem id="67" title="&amp;nbsp;About Us" url="http://www.kattack.com/Company/AboutUs/tabid/67/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="58" title="&amp;nbsp;Contact Us" url="http://www.kattack.com/Company/ContactUs/tabid/58/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="99" title="&amp;nbsp;Artwork" url="http://www.kattack.com/Company/Artwork/tabid/99/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /><menuitem id="245" title="&amp;nbsp;Help Wanted" url="http://www.kattack.com/Company/HelpWanted/tabid/245/Default.aspx" selcss="MainMenu_SubMenuItemSelHover" /></menuitem></root></xml></span></td>
</tr>
<tr>

</tr>
<tr>
<td class="LoginPane">
<div class="LoginPaneDiv">
<a id="dnn_dnnUSER_cmdRegister" class="Login" href="javascript:__doPostBack('dnn$dnnUSER$cmdRegister','')">Register</a></div>
<div class="LoginPaneDiv">
<a id="dnn_dnnLOGIN_cmdLogin" class="Login" href="javascript:__doPostBack('dnn$dnnLOGIN$cmdLogin','')">Login</a></div>
</td>
</tr>
<tr>
<td class="PrivacyPane">
<div class="PrivacyPaneDiv">
<a id="dnn_dnnPRIVACY_hypPrivacy" class="Footer" href="http://www.kattack.com/Home/tabid/55/ctl/Privacy/Default.aspx">Privacy Statement</a></div>
<div class="PrivacyPaneDiv">
<a id="dnn_dnnTERMS_hypTerms" class="Footer" href="http://www.kattack.com/Home/tabid/55/ctl/Terms/Default.aspx">Terms Of Use</a></div>
..